diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..1befa2b
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,40 @@
+name: build
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+    env:
+      MAVSDK_VERSION: 3.17.1
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Install dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libsqlite3-dev libssl-dev
+          curl -sL -o mavsdk.deb \
+            "https://github.com/mavlink/MAVSDK/releases/download/v${MAVSDK_VERSION}/libmavsdk-dev_${MAVSDK_VERSION}_ubuntu24.04_amd64.deb"
+          sudo dpkg -i mavsdk.deb
+
+      - name: Configure
+        run: cmake -B build -S . -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=ON
+
+      - name: Build
+        run: cmake --build build -j"$(nproc)"
+
+      - name: Test
+        run: ctest --test-dir build --output-on-failure
+
+  format:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - run: sudo apt-get update && sudo apt-get install -y astyle
+      - run: make check-format
diff --git a/.gitmodules b/.gitmodules
index 5b8b83f..13b4e2e 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -4,3 +4,6 @@
 [submodule "third_party/tomlplusplus"]
 	path = third_party/tomlplusplus
 	url = https://github.com/marzer/tomlplusplus.git
+[submodule "third_party/json"]
+	path = third_party/json
+	url = https://github.com/nlohmann/json.git
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 6529639..7c36215 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -3,41 +3,73 @@ cmake_minimum_required(VERSION 3.16 FATAL_ERROR)
 set(CMAKE_CXX_STANDARD 20)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
 
-project(logloader VERSION 0.9 LANGUAGES CXX)
+project(logloader VERSION 1.0 LANGUAGES CXX)
 
-option(DEBUG_BUILD "Enable debug logging" OFF)
-if(DEBUG_BUILD)
-    add_definitions(-DDEBUG_BUILD)
-    message(STATUS "Debug logging enabled")
+# Without this the default is an empty build type, i.e. no optimisation at all.
+if(NOT CMAKE_BUILD_TYPE AND NOT CMAKE_CONFIGURATION_TYPES)
+    set(CMAKE_BUILD_TYPE Release CACHE STRING "Build type" FORCE)
 endif()
+message(STATUS "Build type: ${CMAKE_BUILD_TYPE}")
 
 add_compile_options(-Wall -Wextra -Werror -Wpedantic -Wunused)
 
 find_package(OpenSSL 3.0.2 REQUIRED)
 find_package(SQLite3 REQUIRED)
+find_package(Threads REQUIRED)
 
 message(STATUS "OpenSSL version: ${OPENSSL_VERSION}")
-message(STATUS "OpenSSL include dir: ${OPENSSL_INCLUDE_DIR}")
-message(STATUS "OpenSSL libraries: ${OPENSSL_LIBRARIES}")
-message(STATUS "SQLite3 include dir: ${SQLite3_INCLUDE_DIRS}")
-message(STATUS "SQLite3 libraries: ${SQLite3_LIBRARIES}")
+message(STATUS "SQLite3 version: ${SQLite3_VERSION}")
 
-# Assumes MAVSDK system wide install
+# Assumes a system-wide MAVSDK install
 list(APPEND CMAKE_PREFIX_PATH "/usr/local/MAVSDK/install")
 find_package(MAVSDK REQUIRED)
 
-include_directories(third_party/cpp-httplib/)
-include_directories(third_party/tomlplusplus/)
-include_directories(${SQLite3_INCLUDE_DIRS})
-
 add_executable(${PROJECT_NAME}
     src/main.cpp
-    src/ServerInterface.cpp
-    src/LogLoader.cpp)
+    src/ApiServer.cpp
+    src/Config.cpp
+    src/FtpListClient.cpp
+    src/FtpLogFetcher.cpp
+    src/LegacyImport.cpp
+    src/Log.cpp
+    src/LogDatabase.cpp
+    src/LogLoader.cpp
+    src/Sqlite.cpp
+    src/StatusBoard.cpp
+    src/UploadTarget.cpp)
+
+# Must be set for every translation unit that sees httplib.h: it changes the
+# layout of httplib's socket types, so a per-file #define is an ODR violation.
+target_compile_definitions(${PROJECT_NAME} PRIVATE CPPHTTPLIB_OPENSSL_SUPPORT)
+
+# The vendored headers are SYSTEM so their warnings are not ours to fix.
+target_include_directories(${PROJECT_NAME} SYSTEM PRIVATE
+    third_party/cpp-httplib
+    third_party/tomlplusplus
+    third_party/json/single_include
+    ${SQLite3_INCLUDE_DIRS})
 
 target_link_libraries(${PROJECT_NAME}
-    pthread
+    Threads::Threads
     OpenSSL::SSL
     OpenSSL::Crypto
     MAVSDK::mavsdk
     ${SQLite3_LIBRARIES})
+
+# The database is the one module worth testing without a vehicle: it holds every
+# decision logloader makes, and the legacy import runs once against real user
+# data and cannot be un-run.
+option(BUILD_TESTING "Build the tests" OFF)
+if(BUILD_TESTING)
+    enable_testing()
+    add_executable(test_log_database
+        tests/test_log_database.cpp
+        src/LegacyImport.cpp
+        src/Log.cpp
+        src/LogDatabase.cpp
+        src/Sqlite.cpp)
+    target_include_directories(test_log_database PRIVATE src)
+    target_include_directories(test_log_database SYSTEM PRIVATE ${SQLite3_INCLUDE_DIRS})
+    target_link_libraries(test_log_database Threads::Threads ${SQLite3_LIBRARIES})
+    add_test(NAME log_database COMMAND test_log_database)
+endif()
diff --git a/Makefile b/Makefile
index c3ea421..a4afc37 100644
--- a/Makefile
+++ b/Makefile
@@ -1,15 +1,22 @@
 PROJECT_NAME="logloader"
 
 all:
-	@astyle --quiet --options=astylerc src/*.cpp,*.hpp
-	@cmake -Bbuild -H. -DDEBUG_BUILD=OFF; cmake --build build -j$(nproc)
+	@cmake -Bbuild -S. -DCMAKE_BUILD_TYPE=Release; cmake --build build -j$(nproc)
 	@size build/${PROJECT_NAME}
 
 debug:
-	@astyle --quiet --options=astylerc src/*.cpp,*.hpp
-	@cmake -Bbuild -H. -DDEBUG_BUILD=ON; cmake --build build -j$(nproc)
+	@cmake -Bbuild -S. -DCMAKE_BUILD_TYPE=Debug; cmake --build build -j$(nproc)
 	@size build/${PROJECT_NAME}
-	@echo "Debug build with logging enabled"
+
+# Separate from the build on purpose: a `make` that rewrites your sources cannot
+# run from a read-only checkout and makes the build non-reproducible.
+format:
+	@astyle --quiet --options=astylerc src/*.cpp,*.hpp
+	@astyle --quiet --options=astylerc "tests/*.cpp,*.hpp"
+
+check-format:
+	@{ astyle --dry-run --formatted --options=astylerc src/*.cpp,*.hpp; astyle --dry-run --formatted --options=astylerc "tests/*.cpp,*.hpp"; } | grep Formatted \
+		&& { echo "run 'make format'"; exit 1; } || echo "formatting OK"
 
 install:
 	@bash install.sh
@@ -18,4 +25,4 @@ clean:
 	@rm -rf build
 	@echo "All build artifacts removed"
 
-.PHONY: all debug install clean
+.PHONY: all debug format check-format install clean
diff --git a/README.md b/README.md
index 8993abb..6857b68 100644
--- a/README.md
+++ b/README.md
@@ -1,72 +1,142 @@
 ![image](logloader_logo.png)
 
-Downloads PX4 log files (.ulg) and uploads them to a local server and optionally a remote server.
+Downloads flight logs from the vehicle over MAVLink FTP and uploads them to a local Flight Review and, optionally, a remote one. Works with PX4 (`.ulg`) and ArduPilot (`.BIN`).
 
-The **config.toml** file is used to configure the program settings.
+### What it fetches, and when
 
-### Behavior
-Downloading and uploading will only occur while the vehicle is not armed. Downloading and uploading operations are performed in separate threads. An sqlite database per server is used to track log file download/upload status.
+logloader does **not** try to mirror the SD card. A companion computer that is powered on for the first time, or one whose database has been reset, would otherwise pull and upload the vehicle's entire history over a link that has better things to do.
+
+The rule is:
+
+- **A log that appears while logloader is watching** is downloaded and uploaded. In practice that means the log a flight just produced.
+- **On a database that has never seen this vehicle**, only the most recent log is taken. Everything else is left alone.
+- **Anything else happens because it was asked for**, from the ARK-OS Logs page or the HTTP API below.
+
+Two further guards fall out of the same idea. A log is only considered at all once two consecutive listings agree on its size, so the log being written right now is never fetched at a size it will not keep. And if a single listing turns up more than `download.max_auto_queue` new logs, that is a card logloader has not seen rather than a flight that just happened, so it queues only the newest and says so.
+
+Downloading and uploading are suspended while the vehicle is armed.
+
+### HTTP API
+
+A small localhost API on port 3005 (`[api]` in the config) is what the ARK-OS Logs page talks to.
+
+| | |
+| --- | --- |
+| `GET /status` | connection, arm state, current transfer |
+| `GET /logs` | every known log with its download and upload state |
+| `GET /events` | the same as server-sent events, one per change |
+| `POST /logs/download` | `{"ids": [1,2]}` or `{"all": true}`; `"upload": false` to fetch without uploading |
+| `POST /logs/upload` | `{"ids": [1,2]}` or `{"all": true}`, optional `"targets": ["local"]` |
+| `POST /logs/cancel` | `{"ids": [1,2]}` — clears pending requests |
+| `DELETE /logs/{id}/file` | removes the downloaded copy to free space |
+
+A successful upload records the path Flight Review redirected to (`/plot_app?log=<uuid>`), which is what lets the UI link straight to the plot.
+
+### Log transport
+
+Everything runs over **MAVLink FTP** (`FILE_TRANSFER_PROTOCOL`, msg 110): the directory listing that finds the logs and the bulk transfer that downloads them. The classic log protocol (`LOG_REQUEST_LIST` / `LOG_ENTRY` / `LOG_DATA`, msgs 117-120) is not used at all.
+
+`FILE_TRANSFER_PROTOCOL` carries `target_system` and `target_component`, and both PX4 and ArduPilot address their replies back to the requesting sysid/compid, so a download is unicast between the vehicle and logloader. `LOG_DATA` has no target fields, which leaves a router in between — mavlink-router, for instance — no choice but to copy every chunk to every endpoint it serves, telemetry radio included. A log download over the old protocol saturates links that have no interest in it.
+
+The autopilot's MAVLink instance must have FTP enabled (`mavlink start -x` on PX4). If it does not, logloader says so and idles.
+
+### Log discovery
+
+logloader lists the vehicle's log directory, trying `@MAV_LOG` first — the virtual log directory the MAVLink FTP specification defines, supported by PX4 v1.17 and newer — then the physical `/fs/microsd/log` (PX4), `/APM/LOGS` (ArduPilot) and `/log` (PX4 SITL). Set `download.remote_directory` to skip the probe.
+
+The listing is what identifies a log: its path below the log root plus its size. PX4's nested `<date>/<time>.ulg` layout and ArduPilot's flat `<number>.BIN` layout are both handled.
+
+Timestamps come from the modification time in the listing when the vehicle supports the `ListDirectoryWithTime` opcode (PX4 v1.17 and newer). Otherwise PX4 logs fall back to the start time encoded in the path, and ArduPilot logs have no timestamp — nothing depends on having one.
+
+Downloads are staged in a temporary directory and only moved next to the finished logs once the transferred size matches the listing, so a partial file is never mistaken for a complete one.
+
+`.BIN` files are not accepted by review.px4.io, so on ArduPilot leave the remote target disabled or point it somewhere that understands dataflash logs.
+
+### Upgrading from a pre-FTP logloader
+
+Older versions kept a database per server and identified logs by the timestamp `LOG_ENTRY` reported, which MAVLink FTP cannot reproduce. On first start `local_server.db` and `remote_server.db` are imported into a single `logloader.db` and their rows matched against the FTP listing by size, so logs already downloaded and uploaded are not fetched or uploaded a second time. The old files are left untouched.
+
+### Configuration
+
+`config.toml`, in full, is documented inline in the shipped file. The keys:
+
+| Key | Default | Description |
+| --- | --- | --- |
+| `connection_url` | `udp://:14551` | MAVSDK connection string |
+| `log_level` | `info` | `error`, `warn`, `info` or `debug` |
+| `data.directory` | `$XDG_DATA_HOME/ark/logloader/` | Logs and the database |
+| `api.enabled` / `api.bind` / `api.port` | `true` / `127.0.0.1` / `3005` | Local HTTP API |
+| `download.auto` | `true` | Queue logs that appear while running |
+| `download.latest_on_first_start` | `true` | On a fresh database, take only the newest |
+| `upload.auto` | `true` | Upload what was queued automatically |
+| `download.max_auto_queue` | `5` | Bulk-discovery guard; 0 disables |
+| `download.index_interval` | `30` | Seconds between listings |
+| `download.remote_directory` | `""` | Override the vehicle log directory |
+| `download.use_burst` | `true` | FTP burst reads |
+| `upload.interval` | `10` | Seconds between upload passes |
+| `upload_local.*` | enabled, `http://127.0.0.1:5006` | Flight Review on the companion |
+| `upload_remote.*` | disabled, `https://logs.px4.io` | `url`, `email`, `public`, `api_key` |
+
+Tables are one level deep on purpose: ARK-OS's config editor renders exactly that, and a setting an operator cannot reach from the web UI may as well not exist.
+
+The flat keys the previous layout used (`local_server`, `remote_server`, `upload_enabled`, `public_logs`, `email`, `remote_api_key`, `remote_log_directory`, `ftp_use_burst`, `application_directory`) are still read, so an existing config keeps working.
 
 ### Build
-Install dependencies
+
 ```
 sudo apt-get install libsqlite3-dev
 ```
-Install MAVSDK if you haven't already, the latest releases can be found at https://github.com/mavlink/MAVSDK/releases
-```
-sudo dpkg -i libmavsdk-dev_2.4.1_debian12_arm64.deb
-```
-Or install MAVSDK from source
-```
-git clone --recurse-submodules https://github.com/mavlink/MAVSDK.git
-cd MAVSDK
-cmake -Bbuild/default -DCMAKE_BUILD_TYPE=Release -H.
-sudo cmake --build build/default -j$(nproc) --target install
-cd ..
-```
-Upgrade OpenSSL if your version is less than 3.0.2
-```
-openssl version
-```
-A script is provided for your convenience
+Install MAVSDK if you haven't already; releases are at https://github.com/mavlink/MAVSDK/releases
 ```
-./install_openssl.sh
+sudo dpkg -i libmavsdk-dev_3.17.1_ubuntu24.04_amd64.deb
 ```
+OpenSSL must be 3.0.2 or newer (`openssl version`); `./install_openssl.sh` is provided if it is not.
 
-Clone this repository
 ```
 git clone --recurse-submodules https://github.com/ARK-Electronics/logloader.git
 cd logloader
 make
 ```
 
+`make` builds Release. `make debug` builds with debug symbols and no optimisation; the log level is a runtime setting either way. `make format` runs astyle and `make check-format` fails if anything needs it — the build itself never rewrites your sources.
+
+### Tests
+
+```
+cmake -B build -DBUILD_TESTING=ON && cmake --build build && ctest --test-dir build
+```
+
+`tests/test_log_database.cpp` covers the database, which is where every decision about a log is recorded: the first-index rule, logs appearing and disappearing from the vehicle, request and cancel, recovery when a downloaded file goes missing, ArduPilot's name reuse, and the upgrade from a pre-FTP database — which runs once against real user data and cannot be un-run.
+
 ### Run
+
 ```bash
-./build/logloader | tee output.txt
+./build/logloader --config config.toml
 ```
 
 ```
-Downloading...	2023-10-05T15:06:42Z	0.97249500MB	100%	3889.98000000 Kbps
-Downloading...	2023-10-05T15:06:58Z	0.46985700MB	98%	3686.40000000 Kbps
-Downloading...	2023-10-05T15:10:56Z0 Kb1.86199000MB	100%	4965.30666667 Kbps
-Downloading...	2023-10-07T08:52:14Z	0.38373500MB	100%	inf Kbps
-Downloading...	2023-10-07T08:56:18Z	0.26428000MB	100%	inf Kbps
-Downloading...	2023-10-07T09:04:18Z	0.42428500MB	100%	3394.28000000 Kbps
-Downloading...	2023-10-07T09:04:40Z	0.91263600MB	100%	7301.08800000 Kbps
-Downloading...	2023-10-07T09:05:20Z	1.33783000MB	100%	3567.54666667 Kbps
-Downloading...	2023-10-07T09:07:32Z	0.85526800MB	100%	3421.07200000 Kbps
-Downloading...	2023-10-07T09:22:00Z	0.82437500MB	100%	6595.00000000 Kbps
-Downloading...	2023-10-07T09:22:26Z	0.79509800MB	100%	6360.78400000 Kbps
-Downloading...	2023-10-07T09:26:10Z	0.88394300MB	100%	3535.77200000 Kbps
-Downloading...	2023-10-07T10:14:00Z	10.71558000MB	100%	2449.27542857 Kbps
-Downloading...	2023-10-07T12:03:40Z	0.64674900MB	100%	5173.99200000 Kbps
-Downloading...	2023-10-07T12:05:04Z	3.79014100MB	100%	3032.11280000 Kbps
-Downloading...	2023-10-07T12:14:46Z	2.24213400MB	100%	2989.51200000 Kbps
-Downloading...	2023-10-07T12:50:12Z	0.78112200MB	100%	3124.48800000 Kbps
+logloader starting, configuration from config.toml
+API listening on 127.0.0.1:3005
+Connected to the autopilot
+MAVLink FTP available, indexed 6 logs in /fs/microsd/log
+First index: 5 logs on the vehicle, queueing only the newest. Use the ARK-OS Logs page to fetch any of the others.
+Downloading 1/1: 2026-07-28/17_21_01.ulg (1.1 MB)
+Downloaded 2026-07-28/17_21_01.ulg in 1.5s (691.4 kB/s)
+Uploaded 2026-07-28/17_21_01.ulg to local: http://127.0.0.1:5006/plot_app?log=95699be6-...
+```
+
+### Testing against PX4 SITL
+
+SITL keeps its logs in `/log` relative to the working directory, which is in the probe list, so no configuration is needed beyond the port:
+
+```
+PX4_SIM_MODEL=none build/px4_sitl_default/bin/px4 build/px4_sitl_default/etc \
+    -s build/px4_sitl_default/etc/init.d-posix/rcS -d
+./build/logloader --config <config with connection_url = "udp://:14540">
 ```
 
 ### Install
-Build and install
+
 ```
 make install
 ```
@@ -78,17 +148,6 @@ make install
 | **Data directory**   | `~/.local/share/ark/logloader/`        |
 | **Logs directory**   | `~/.local/share/ark/logloader/logs/`   |
 
-### Performance
-Monitor network traffic
-```
-sudo iftop -i wlo1
-```
-Or use a Wireshark filter
-```
-mavlink_proto.msgid == 117 || mavlink_proto.msgid == 118 || mavlink_proto.msgid == 119 || mavlink_proto.msgid == 120
-```
-
-Watch your beautiful logs arrive
-
 ### Future developments
-- Multiple backends: e.g. RobotoAI, DroneLogbook, Auterion Suite, Aloft etc
+- Resume interrupted transfers rather than restarting them.
+- Multiple backends: e.g. RobotoAI, DroneLogbook, Auterion Suite, Aloft.
diff --git a/config.toml b/config.toml
index ff208c2..a51995e 100644
--- a/config.toml
+++ b/config.toml
@@ -1,6 +1,66 @@
+# MAVSDK connection to the autopilot. The link must have MAVLink FTP enabled
+# (PX4: "mavlink start -x").
 connection_url = "udp://:14551"
-local_server = "http://127.0.0.1:5006"
-remote_server = "https://review.px4.io"
+
+# error | warn | info | debug
+log_level = "info"
+
+[data]
+# Where logs and the database live. Empty uses $XDG_DATA_HOME/ark/logloader/.
+directory = ""
+
+# Local HTTP API. ARK-OS talks to this to list logs and ask for particular ones.
+[api]
+enabled = true
+bind = "127.0.0.1"
+port = 3005
+
+[download]
+# Fetch a log as soon as it appears, which in practice means after a flight.
+auto = true
+
+# On a database that has never seen this vehicle, every log looks new. Rather
+# than pull an entire SD card the first time logloader runs, take only the most
+# recent one. Everything else is available from the ARK-OS Logs page.
+latest_on_first_start = true
+
+# If one listing turns up more new logs than this, it is a card we have not seen
+# rather than a flight that just happened: queue only the newest and leave the
+# rest to the operator. 0 disables the guard.
+max_auto_queue = 5
+
+# Seconds between vehicle listings. Drops to 5s for a few passes after landing.
+index_interval = 30
+
+# Vehicle log directory. Empty probes "@MAV_LOG" (the virtual log directory from
+# the MAVLink FTP specification), then "/fs/microsd/log" (PX4) and "/APM/LOGS"
+# (ArduPilot).
+remote_directory = ""
+
+# FTP burst reads. Much faster; disable if the flight stack's burst support
+# misbehaves.
+use_burst = true
+
+[upload]
+# Upload whatever was fetched automatically. Turn this off to download after a
+# flight but upload only on request.
+auto = true
+
+# Seconds between upload passes.
+interval = 10
+
+# Flight Review running on this companion. Left open, so no key is needed.
+[upload_local]
+enabled = true
+url = "http://127.0.0.1:5006"
+public = true
+
+[upload_remote]
+enabled = false
+url = "https://logs.px4.io"
 email = ""
-upload_enabled = false
-public_logs = false
+public = false
+
+# Per-account key for an authenticated Flight Review. When empty no
+# authorization headers are sent at all, which is what open servers expect.
+api_key = ""
diff --git a/src/ApiServer.cpp b/src/ApiServer.cpp
new file mode 100644
index 0000000..f24efe9
--- /dev/null
+++ b/src/ApiServer.cpp
@@ -0,0 +1,393 @@
+#include "ApiServer.hpp"
+#include "Config.hpp"
+#include "Log.hpp"
+#include "LogLoader.hpp"
+
+#include <algorithm>
+#include <chrono>
+#include <ctime>
+
+#include <httplib.h>
+#include <nlohmann/json.hpp>
+
+using json = nlohmann::json;
+
+namespace
+{
+
+// The SSE stream sends a keepalive at this interval when nothing has changed,
+// so an idle connection is not mistaken for a dead one by anything in between.
+constexpr auto kEventKeepalive = std::chrono::seconds(15);
+
+constexpr size_t kWorkerThreads = 16;
+constexpr size_t kMaxStreams = 8;
+constexpr size_t kMaxRequestBody = 1 << 20;
+
+std::string iso8601_utc(int64_t time_utc)
+{
+	// A vehicle is free to report any mtime it likes; a year that does not fit
+	// makes strftime return 0 and leave the buffer unspecified.
+	char buffer[sizeof "2026-07-28T10:30:00Z"];
+	const auto as_time_t = static_cast<time_t>(time_utc);
+	std::tm tm {};
+
+	if (gmtime_r(&as_time_t, &tm) == nullptr || strftime(buffer, sizeof(buffer), "%FT%TZ", &tm) == 0) {
+		return {};
+	}
+
+	return buffer;
+}
+
+json to_json(const LogDatabase::Entry& entry)
+{
+	json uploads = json::object();
+
+	for (const auto& [target, state] : entry.uploads) {
+		uploads[target] = {
+			{"uploaded", state.uploaded},
+			{"requested", state.requested},
+			{"rejected", state.rejected},
+			{"location", state.location},
+			{"message", state.message},
+		};
+	}
+
+	const auto slash = entry.path.find_last_of('/');
+
+	return {
+		{"id", entry.id},
+		{"path", entry.path},
+		{"name", slash == std::string::npos ? entry.path : entry.path.substr(slash + 1)},
+		{"size_bytes", entry.size_bytes},
+		{"time_utc", entry.time_utc.has_value() ? json(entry.time_utc.value()) : json(nullptr)},
+		{"date", entry.time_utc.has_value() ? iso8601_utc(entry.time_utc.value()) : ""},
+		{"present", entry.present},
+		{"downloaded", entry.downloaded},
+		{"download_requested", entry.download_requested},
+		{"download_failures", entry.download_failures},
+		{"last_error", entry.last_error},
+		{"uploads", uploads},
+	};
+}
+
+json to_json(const StatusBoard::Snapshot& snapshot)
+{
+	return {
+		{"connected", snapshot.connected},
+		{"armed", snapshot.armed},
+		{"ftp_available", snapshot.ftp_available},
+		{"log_root", snapshot.log_root},
+		{"downloading_id", snapshot.downloading_id},
+		{"downloaded_bytes", snapshot.downloaded_bytes},
+		{"download_total_bytes", snapshot.download_total_bytes},
+		{"uploading_id", snapshot.uploading_id},
+		{"uploading_target", snapshot.uploading_target},
+		{"revision", snapshot.revision},
+	};
+}
+
+// Parses a request body, answering 400 rather than throwing on malformed input.
+bool parse_body(const httplib::Request& request, httplib::Response& response, json& out)
+{
+	if (request.body.empty()) {
+		out = json::object();
+		return true;
+	}
+
+	out = json::parse(request.body, nullptr, false);
+
+	if (out.is_discarded() || !out.is_object()) {
+		response.status = 400;
+		response.set_content(json {{"error", "body must be a JSON object"}}.dump(), "application/json");
+		return false;
+	}
+
+	return true;
+}
+
+std::vector<int64_t> ids_from(const json& body)
+{
+	std::vector<int64_t> ids;
+
+	if (!body.contains("ids") || !body["ids"].is_array()) {
+		return ids;
+	}
+
+	for (const auto& id : body["ids"]) {
+		if (id.is_number_integer()) {
+			ids.push_back(id.get<int64_t>());
+		}
+	}
+
+	return ids;
+}
+
+// Flight Review answers an upload with a *relative* redirect, so the stored
+// location is only half a link. Shipping each target's base url lets the UI
+// join them itself rather than guessing an origin.
+json targets_json(LogLoader& loader)
+{
+	json targets = json::array();
+
+	for (const auto& [name, url] : loader.enabled_targets()) {
+		targets.push_back(json {{"name", name}, {"url", url}});
+	}
+
+	return targets;
+}
+
+json list_payload(LogDatabase& database, const StatusBoard::Snapshot& snapshot, const json& targets)
+{
+	json logs = json::array();
+
+	for (const auto& entry : database.all_logs()) {
+		logs.push_back(to_json(entry));
+	}
+
+	return {{"logs", logs}, {"status", to_json(snapshot)}, {"targets", targets}};
+}
+
+} // namespace
+
+ApiServer::ApiServer(const Settings& settings, LogLoader& loader)
+	: _settings(settings)
+	, _loader(loader)
+	, _server(std::make_unique<httplib::Server>())
+{
+	install_routes();
+}
+
+ApiServer::~ApiServer()
+{
+	stop();
+}
+
+bool ApiServer::start()
+{
+	// Every /events stream holds one worker for as long as it is open, so the
+	// pool has to be bigger than the number of streams we are willing to serve.
+	_server->new_task_queue = [] { return new httplib::ThreadPool(kWorkerThreads); };
+	// Nothing here accepts a large body; the only uploads go the other way.
+	_server->set_payload_max_length(kMaxRequestBody);
+
+	if (!_server->bind_to_port(_settings.bind, _settings.port)) {
+		LOG_ERROR("Could not bind the API to " << _settings.bind << ":" << _settings.port);
+		return false;
+	}
+
+	_thread = std::thread([this] { _server->listen_after_bind(); });
+	LOG("API listening on " << _settings.bind << ":" << _settings.port);
+	return true;
+}
+
+void ApiServer::stop()
+{
+	_stopping = true;
+	// Releases the streams blocked in wait_for_change, which would otherwise
+	// keep a worker each and hang the join below.
+	_loader.status().shutdown();
+
+	if (_server) {
+		_server->stop();
+	}
+
+	if (_thread.joinable()) {
+		_thread.join();
+	}
+}
+
+void ApiServer::install_routes()
+{
+	auto& database = _loader.database();
+
+	_server->Get("/status", [this](const httplib::Request&, httplib::Response & response) {
+		json payload = to_json(_loader.status().get());
+		payload["targets"] = targets_json(_loader);
+		response.set_content(payload.dump(), "application/json");
+	});
+
+	_server->Get("/logs", [this, &database](const httplib::Request&, httplib::Response & response) {
+		const json payload =
+			list_payload(database, _loader.status().get(), targets_json(_loader));
+		response.set_content(payload.dump(), "application/json");
+	});
+
+	// One event per change, so the page reflects a transfer as it happens
+	// rather than on the next poll.
+	_server->Get("/events", [this, &database](const httplib::Request&, httplib::Response & response) {
+		if (_streams.fetch_add(1) >= kMaxStreams) {
+			_streams--;
+			response.status = 503;
+			response.set_content(json {{"error", "too many event streams"}}.dump(), "application/json");
+			return;
+		}
+
+		// nginx buffers a streaming response into uselessness without this.
+		response.set_header("Cache-Control", "no-cache");
+		response.set_header("X-Accel-Buffering", "no");
+
+		auto seen_status = std::make_shared<uint64_t>(UINT64_MAX);
+		auto seen_logs = std::make_shared<uint64_t>(UINT64_MAX);
+
+		// The releaser runs from ~Response on every path -- client disconnect,
+		// write failure, shutdown -- which the provider itself does not: httplib
+		// simply stops calling it when a write fails.
+		response.set_chunked_content_provider("text/event-stream",
+		[this, &database, seen_status, seen_logs](size_t, httplib::DataSink & sink) {
+			StatusBoard& status = _loader.status();
+
+			// Either side may be shutting down; _stopping covers the case where
+			// the API is stopped on its own, which nothing else would unblock.
+			if (_stopping.load() || status.stopped()) {
+				sink.done();
+				return true;
+			}
+
+			const auto snapshot = status.wait_for_change(*seen_status, kEventKeepalive);
+			const uint64_t log_revision = database.revision();
+
+			if (snapshot.revision == *seen_status && log_revision == *seen_logs) {
+				// Nothing happened; prove the connection is still good.
+				static constexpr char keepalive[] = ": keepalive\n\n";
+				return sink.write(keepalive, sizeof(keepalive) - 1);
+			}
+
+			*seen_status = snapshot.revision;
+
+			// Transfer progress ticks several times a second. Re-reading and
+			// re-serialising every log for each of those would be the hottest
+			// path in the program, so the list only goes out when it changed.
+			std::string message;
+
+			if (log_revision != *seen_logs) {
+				*seen_logs = log_revision;
+				message = "event: logs\ndata: "
+					  + list_payload(database, snapshot, targets_json(_loader)).dump();
+
+			} else {
+				message = "event: status\ndata: " + to_json(snapshot).dump();
+			}
+
+			message += "\n\n";
+			return sink.write(message.data(), message.size());
+		},
+		[this](bool) { _streams--; });
+	});
+
+	_server->Post("/logs/download", [this, &database](const httplib::Request & request, httplib::Response & response) {
+		json body;
+
+		if (!parse_body(request, response, body)) {
+			return;
+		}
+
+		const std::vector<int64_t> ids =
+			body.value("all", false) ? database.ids_not_downloaded() : ids_from(body);
+
+		// Fetching and uploading normally go together; "upload": false is how a
+		// caller asks for the file without publishing it.
+		const std::vector<std::string> targets =
+			body.value("upload", true) ? _loader.enabled_target_names() : std::vector<std::string> {};
+
+		database.request(ids, targets);
+		_loader.wake();
+		_loader.status().notify();
+
+		response.set_content(json {{"queued", ids.size()}}.dump(), "application/json");
+	});
+
+	_server->Post("/logs/upload", [this, &database](const httplib::Request & request, httplib::Response & response) {
+		json body;
+
+		if (!parse_body(request, response, body)) {
+			return;
+		}
+
+		std::vector<std::string> targets = _loader.enabled_target_names();
+
+		if (body.contains("targets") && body["targets"].is_array()) {
+			std::vector<std::string> requested;
+
+			for (const auto& target : body["targets"]) {
+				if (target.is_string()) {
+					const std::string name = target.get<std::string>();
+
+					if (std::find(targets.begin(), targets.end(), name) != targets.end()) {
+						requested.push_back(name);
+					}
+				}
+			}
+
+			targets = requested;
+		}
+
+		if (targets.empty()) {
+			response.status = 400;
+			response.set_content(json {{"error", "no enabled upload target named"}}.dump(),
+			"application/json");
+			return;
+		}
+
+		const std::vector<int64_t> ids =
+			body.value("all", false) ? database.ids_not_uploaded(targets) : ids_from(body);
+
+		database.request(ids, targets);
+		_loader.wake();
+		_loader.status().notify();
+
+		response.set_content(json {{"queued", ids.size()}}.dump(), "application/json");
+	});
+
+	_server->Post("/logs/cancel", [this, &database](const httplib::Request & request, httplib::Response & response) {
+		json body;
+
+		if (!parse_body(request, response, body)) {
+			return;
+		}
+
+		const std::vector<int64_t> ids = ids_from(body);
+		database.cancel_requests(ids);
+		_loader.wake();
+		_loader.status().notify();
+
+		response.set_content(json {{"cancelled", ids.size()}}.dump(), "application/json");
+	});
+
+	_server->Delete(R"(/logs/(\d+)/file)", [this](const httplib::Request & request, httplib::Response & response) {
+		int64_t id = 0;
+
+		try {
+			id = std::stoll(request.matches[1]);
+
+		} catch (const std::exception&) {
+			response.status = 404;
+			response.set_content(json {{"error", "no such log"}}.dump(), "application/json");
+			return;
+		}
+
+		if (!_loader.delete_local_file(id)) {
+			response.status = 404;
+			response.set_content(json {{"error", "no such log"}}.dump(), "application/json");
+			return;
+		}
+
+		_loader.status().notify();
+		response.set_content(json {{"deleted", id}}.dump(), "application/json");
+	});
+
+	_server->set_exception_handler([](const httplib::Request&, httplib::Response & response,
+	std::exception_ptr exception) {
+		std::string message = "internal error";
+
+		try {
+			std::rethrow_exception(exception);
+
+		} catch (const std::exception& error) {
+			message = error.what();
+		}
+
+		LOG_ERROR("API request failed: " << message);
+		response.status = 500;
+		response.set_content(json {{"error", message}}.dump(), "application/json");
+	});
+}
diff --git a/src/ApiServer.hpp b/src/ApiServer.hpp
new file mode 100644
index 0000000..68d03a5
--- /dev/null
+++ b/src/ApiServer.hpp
@@ -0,0 +1,48 @@
+#pragma once
+
+#include <atomic>
+#include <cstdint>
+#include <memory>
+#include <string>
+#include <thread>
+
+class LogLoader;
+
+namespace httplib
+{
+class Server;
+}
+
+// A small read/write HTTP surface on localhost, so ARK-OS can show the vehicle's
+// logs and ask for particular ones instead of logloader guessing.
+//
+// The routes are listed in README.md rather than here, so there is one place to
+// keep correct.
+class ApiServer
+{
+public:
+	struct Settings {
+		std::string bind;
+		uint16_t port {3005};
+	};
+
+	ApiServer(const Settings& settings, LogLoader& loader);
+	~ApiServer();
+
+	ApiServer(const ApiServer&) = delete;
+	ApiServer& operator=(const ApiServer&) = delete;
+
+	// Binds and serves on a thread of its own. False when the port is taken.
+	bool start();
+	void stop();
+
+private:
+	void install_routes();
+
+	Settings _settings;
+	LogLoader& _loader;
+	std::unique_ptr<httplib::Server> _server;
+	std::thread _thread;
+	std::atomic<bool> _stopping {false};
+	std::atomic<size_t> _streams {0};
+};
diff --git a/src/Config.cpp b/src/Config.cpp
new file mode 100644
index 0000000..ad282da
--- /dev/null
+++ b/src/Config.cpp
@@ -0,0 +1,173 @@
+#include "Config.hpp"
+
+#include <algorithm>
+#include <cstdlib>
+#include <filesystem>
+#include <sstream>
+#include <stdexcept>
+
+#include <toml.hpp>
+
+namespace fs = std::filesystem;
+
+namespace
+{
+
+std::string env_or(const char* name, const std::string& fallback)
+{
+	const char* value = std::getenv(name);
+	return value != nullptr && value[0] != '\0' ? value : fallback;
+}
+
+std::string with_trailing_slash(std::string path)
+{
+	if (!path.empty() && path.back() != '/') {
+		path += '/';
+	}
+
+	return path;
+}
+
+std::string trim(std::string text)
+{
+	const auto first = text.find_first_not_of(" \t\r\n");
+
+	if (first == std::string::npos) {
+		return {};
+	}
+
+	const auto last = text.find_last_not_of(" \t\r\n");
+	return text.substr(first, last - first + 1);
+}
+
+// Set when a config file still uses the pre-overhaul flat key layout. Warning
+// once is what makes the fallback deletable later rather than permanent.
+bool g_used_legacy_key = false;
+
+// Reads preferred, then the flat top-level key the pre-overhaul layout used, so
+// an existing config.toml keeps working unchanged.
+template <typename T, typename Preferred, typename Legacy>
+T value_or(const Preferred& preferred, const Legacy& legacy, T fallback)
+{
+	if (auto value = preferred.template value<T>(); value.has_value()) {
+		return value.value();
+	}
+
+	if (auto value = legacy.template value<T>(); value.has_value()) {
+		g_used_legacy_key = true;
+		return value.value();
+	}
+
+	return fallback;
+}
+
+} // namespace
+
+std::string resolve_config_path(int argc, char** argv)
+{
+	for (int i = 1; i < argc; i++) {
+		const std::string arg = argv[i];
+
+		if (arg == "--config" && i + 1 < argc) {
+			return argv[i + 1];
+		}
+
+		if (arg.rfind("--config=", 0) == 0) {
+			return arg.substr(std::string("--config=").size());
+		}
+	}
+
+	const std::string home = env_or("HOME", "/tmp");
+	const auto user_config = fs::path(home) / ".config/ark/logloader/config.toml";
+	const auto installed_config = fs::path("/opt/ark/share/logloader/config.toml");
+
+	return (fs::exists(user_config) ? user_config : installed_config).string();
+}
+
+Config load_config(const std::string& path)
+{
+	toml::table file;
+
+	try {
+		file = toml::parse_file(path);
+
+	} catch (const toml::parse_error& error) {
+		std::ostringstream message;
+		message << "could not parse " << path << ": " << error.description();
+		throw std::runtime_error(message.str());
+	}
+
+	Config config;
+
+	config.connection_url = file["connection_url"].value_or("udp://:14551");
+
+	const std::string level_text = file["log_level"].value_or("info");
+
+	if (!logging::parse_level(level_text, config.log_level)) {
+		LOG_WARN("Unknown log_level \"" << level_text << "\", using info");
+	}
+
+	const std::string home = env_or("HOME", "/tmp");
+	const std::string xdg_data = env_or("XDG_DATA_HOME", home + "/.local/share");
+	const std::string default_data = xdg_data + "/ark/logloader/";
+
+	const auto data = file["data"];
+	const auto api = file["api"];
+	const auto download = file["download"];
+	const auto upload = file["upload"];
+	// Deliberately flat rather than [upload.local]: ARK-OS's config editor
+	// renders one level of tables, and an operator who cannot reach these from
+	// the web UI cannot turn remote uploads on.
+	const auto local = file["upload_local"];
+	const auto remote = file["upload_remote"];
+
+	config.data_directory = with_trailing_slash(
+					value_or<std::string>(data["directory"], file["application_directory"], default_data));
+	config.logs_directory = config.data_directory + "logs/";
+
+	config.api_enabled = api["enabled"].value_or(config.api_enabled);
+	config.api_bind = api["bind"].value_or(config.api_bind);
+	config.api_port = static_cast<uint16_t>(api["port"].value_or(config.api_port));
+
+	config.auto_download = download["auto"].value_or(config.auto_download);
+	config.download_latest_on_first_start =
+		download["latest_on_first_start"].value_or(config.download_latest_on_first_start);
+	config.auto_upload = value_or<bool>(upload["auto"], download["auto_upload"], config.auto_upload);
+	config.max_auto_queue = download["max_auto_queue"].value_or(config.max_auto_queue);
+	config.index_interval_s = std::max(1, download["index_interval"].value_or(config.index_interval_s));
+	config.upload_interval_s = std::max(1, upload["interval"].value_or(config.upload_interval_s));
+	config.remote_log_directory =
+		value_or<std::string>(download["remote_directory"], file["remote_log_directory"], "");
+	config.use_burst = value_or<bool>(download["use_burst"], file["ftp_use_burst"], true);
+
+	config.local.name = kTargetLocal;
+	config.local.url = value_or<std::string>(local["url"], file["local_server"], "http://127.0.0.1:5006");
+	config.local.enabled = local["enabled"].value_or(true);
+	// Flight Review on the companion is open, and public is what makes a log
+	// findable in its web UI.
+	config.local.public_logs = local["public"].value_or(true);
+	config.local.email = local["email"].value_or("");
+	config.local.api_key = trim(local["api_key"].value_or<std::string>(""));
+
+	config.remote.name = kTargetRemote;
+	config.remote.url = value_or<std::string>(remote["url"], file["remote_server"], "https://logs.px4.io");
+	config.remote.enabled = value_or<bool>(remote["enabled"], file["upload_enabled"], false);
+	config.remote.public_logs = value_or<bool>(remote["public"], file["public_logs"], false);
+	config.remote.email = value_or<std::string>(remote["email"], file["email"], "");
+	config.remote.api_key = trim(value_or<std::string>(remote["api_key"], file["remote_api_key"], ""));
+
+	if (config.local.url.empty()) {
+		config.local.enabled = false;
+	}
+
+	if (config.remote.url.empty()) {
+		config.remote.enabled = false;
+	}
+
+	if (g_used_legacy_key) {
+		LOG_WARN(path << " uses the pre-overhaul flat key layout. It still works, but the "
+			 "shipped config.toml shows the current one and the fallback will be removed.");
+	}
+
+	return config;
+}
diff --git a/src/Config.hpp b/src/Config.hpp
new file mode 100644
index 0000000..e7ce041
--- /dev/null
+++ b/src/Config.hpp
@@ -0,0 +1,67 @@
+#pragma once
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+#include "Log.hpp"
+
+// Names used for the two upload targets, in the database and in the API.
+constexpr const char* kTargetLocal = "local";
+constexpr const char* kTargetRemote = "remote";
+
+struct UploadTargetConfig {
+	std::string name;
+	bool enabled {false};
+	std::string url;
+	std::string email;
+	// Per-account key for authenticated Flight Review instances. Empty means
+	// no auth headers are sent at all, which is what open servers expect.
+	std::string api_key;
+	bool public_logs {false};
+};
+
+struct Config {
+	std::string connection_url;
+	logging::Level log_level {logging::Level::Info};
+
+	// Absolute, with a trailing slash.
+	std::string data_directory;
+	std::string logs_directory;
+
+	bool api_enabled {true};
+	std::string api_bind {"127.0.0.1"};
+	uint16_t api_port {3005};
+
+	// Queue a log for download as soon as it appears in a listing. This is what
+	// picks up the log a flight just produced.
+	bool auto_download {true};
+	// On a database that has never been indexed, queue only the newest log
+	// rather than the vehicle's entire history. See LogLoader::apply_auto_policy.
+	bool download_latest_on_first_start {true};
+	// Upload whatever was queued for download, to every enabled target.
+	bool auto_upload {true};
+	// If a single listing turns up more new logs than this, the vehicle is not
+	// handing us one flight's worth — it is a card we have never seen. Queue
+	// only the newest and leave the rest to the operator. 0 disables the guard.
+	int max_auto_queue {5};
+
+	int index_interval_s {30};
+	int upload_interval_s {10};
+
+	// Empty probes the known vehicle log directories.
+	std::string remote_log_directory;
+	bool use_burst {true};
+
+	UploadTargetConfig local;
+	UploadTargetConfig remote;
+
+	std::vector<const UploadTargetConfig*> targets() const { return {&local, &remote}; }
+};
+
+// --config <path> / --config=<path>, else the user override, else the
+// deb-installed default.
+std::string resolve_config_path(int argc, char** argv);
+
+// Throws std::runtime_error when the file cannot be parsed.
+Config load_config(const std::string& path);
diff --git a/src/FtpListClient.cpp b/src/FtpListClient.cpp
new file mode 100644
index 0000000..70acb94
--- /dev/null
+++ b/src/FtpListClient.cpp
@@ -0,0 +1,279 @@
+#include "FtpListClient.hpp"
+#include "Log.hpp"
+
+#include <chrono>
+#include <cstring>
+
+namespace
+{
+
+constexpr int kMaxAttempts = 3;
+
+// Generous enough for a listing that has to come back over a telemetry link.
+// Servers answer a retransmitted request from their reply cache, so a retry
+// after a dropped packet is cheap.
+constexpr auto kReplyTimeout = std::chrono::milliseconds(2000);
+
+} // namespace
+
+FtpListClient::FtpListClient(std::shared_ptr<mavsdk::System> system)
+	: _passthrough(std::make_shared<mavsdk::MavlinkPassthrough>(system))
+{
+	// Weak, and the ids are copied rather than reached through this: the
+	// callback may outlive the client. See State.
+	const uint8_t our_sysid = _passthrough->get_our_sysid();
+	const uint8_t our_compid = _passthrough->get_our_compid();
+
+	_subscription = _passthrough->subscribe_message(MAVLINK_MSG_ID_FILE_TRANSFER_PROTOCOL,
+	[weak = std::weak_ptr<State>(_state), our_sysid, our_compid](const mavlink_message_t& message) {
+		if (auto state = weak.lock()) {
+			handle_message(*state, our_sysid, our_compid, message);
+		}
+	});
+}
+
+FtpListClient::~FtpListClient()
+{
+	_passthrough->unsubscribe_message(MAVLINK_MSG_ID_FILE_TRANSFER_PROTOCOL, _subscription);
+}
+
+void FtpListClient::stop()
+{
+	{
+		// Under the lock, or a notify landing between the waiter's predicate
+		// check and its block is lost and shutdown waits out the full timeout.
+		std::lock_guard<std::mutex> lock(_state->mutex);
+		_state->should_exit = true;
+	}
+
+	_state->cv.notify_all();
+}
+
+void FtpListClient::reset_sessions()
+{
+	PayloadHeader reply;
+
+	if (transact(kOpcodeResetSessions, "", 0, reply)) {
+		LOG_DEBUG("FTP sessions reset");
+
+	} else {
+		LOG_DEBUG("FTP session reset went unanswered");
+	}
+}
+
+void FtpListClient::handle_message(State& state, uint8_t our_sysid, uint8_t our_compid,
+				   const mavlink_message_t& message)
+{
+	mavlink_file_transfer_protocol_t ftp;
+	mavlink_msg_file_transfer_protocol_decode(&message, &ftp);
+
+	// The transfer runs unicast: the server addresses its replies to whoever
+	// asked. Anything not for us is another client's traffic.
+	if (ftp.target_system != our_sysid) {
+		return;
+	}
+
+	if (ftp.target_component != our_compid && ftp.target_component != 0) {
+		return;
+	}
+
+	PayloadHeader payload;
+	std::memcpy(&payload, ftp.payload, sizeof(payload));
+
+	if (payload.opcode != kOpcodeAck && payload.opcode != kOpcodeNak) {
+		return;
+	}
+
+	std::lock_guard<std::mutex> lock(state.mutex);
+
+	// Match against the in-flight request so replies to MAVSDK's Ftp plugin
+	// (which shares our system and component id) are ignored.
+	if (!state.expected_req_opcode.has_value() || payload.req_opcode != state.expected_req_opcode.value()
+	    || payload.seq_number != state.expected_seq) {
+		return;
+	}
+
+	state.reply = payload;
+	state.cv.notify_all();
+}
+
+void FtpListClient::send_request(const PayloadHeader& request)
+{
+	_passthrough->queue_message([this, request](MavlinkAddress address, uint8_t channel) {
+		mavlink_message_t message;
+		mavlink_msg_file_transfer_protocol_pack_chan(address.system_id, address.component_id, channel, &message,
+				0, // target_network
+				_passthrough->get_target_sysid(),
+				_passthrough->get_target_compid(),
+				reinterpret_cast<const uint8_t*>(&request));
+		return message;
+	});
+}
+
+bool FtpListClient::transact(uint8_t opcode, const std::string& path, uint32_t offset, PayloadHeader& reply)
+{
+	if (path.size() >= kMaxDataLength) {
+		return false;
+	}
+
+	PayloadHeader request {};
+	request.seq_number = ++_seq;
+	request.opcode = opcode;
+	request.offset = offset;
+	request.size = static_cast<uint8_t>(path.size() + 1);
+	std::memcpy(request.data, path.c_str(), path.size() + 1);
+
+	State& state = *_state;
+
+	for (int attempt = 0; attempt < kMaxAttempts; attempt++) {
+		{
+			std::lock_guard<std::mutex> lock(state.mutex);
+
+			if (state.should_exit) {
+				return false;
+			}
+
+			state.reply.reset();
+			// Servers reply with the request sequence number plus one, and
+			// answer a retransmission (same sequence number) from their
+			// duplicate-reply cache, so retries reuse the packet as-is.
+			state.expected_seq = static_cast<uint16_t>(request.seq_number + 1);
+			state.expected_req_opcode = opcode;
+		}
+
+		send_request(request);
+
+		std::unique_lock<std::mutex> lock(state.mutex);
+
+		if (state.cv.wait_for(lock, kReplyTimeout, [&state] { return state.reply.has_value() || state.should_exit; })) {
+			state.expected_req_opcode.reset();
+
+			if (!state.reply.has_value()) {
+				return false;
+			}
+
+			reply = state.reply.value();
+			return true;
+		}
+	}
+
+	std::lock_guard<std::mutex> lock(state.mutex);
+	state.expected_req_opcode.reset();
+
+	return false;
+}
+
+void FtpListClient::parse_entries(const PayloadHeader& reply, std::vector<Entry>& entries, uint32_t& next_offset)
+{
+	const size_t data_size = std::min(static_cast<size_t>(reply.size), kMaxDataLength);
+	size_t i = 0;
+
+	while (i < data_size) {
+		const char* raw = reinterpret_cast<const char*>(&reply.data[i]);
+		const size_t length = strnlen(raw, data_size - i);
+		i += length + 1;
+
+		// Every directory entry advances the server-side offset, including the
+		// "skip" placeholders it emits for entries it does not report.
+		next_offset++;
+
+		if (length < 2) {
+			continue;
+		}
+
+		const std::string body(raw + 1, length - 1);
+
+		if (raw[0] == 'D') {
+			Entry entry;
+			entry.name = body;
+			entry.is_directory = true;
+			entries.push_back(entry);
+
+		} else if (raw[0] == 'F') {
+			// "F<name>\t<size>" plus "\t<mtime>" from ListDirectoryWithTime
+			const size_t first_tab = body.find('\t');
+
+			if (first_tab == std::string::npos) {
+				continue;
+			}
+
+			Entry entry;
+			entry.name = body.substr(0, first_tab);
+
+			try {
+				const size_t second_tab = body.find('\t', first_tab + 1);
+				entry.size_bytes = static_cast<uint32_t>(std::stoul(body.substr(first_tab + 1)));
+
+				if (second_tab != std::string::npos) {
+					// The server reports zero when it does not know the time
+					const int64_t mtime = std::stoll(body.substr(second_tab + 1));
+
+					if (mtime > 0) {
+						entry.mtime_utc = mtime;
+					}
+				}
+
+			} catch (const std::exception&) {
+				continue;
+			}
+
+			entries.push_back(entry);
+		}
+	}
+}
+
+FtpListClient::Result FtpListClient::list_directory(const std::string& path, std::vector<Entry>& entries)
+{
+	entries.clear();
+
+	uint32_t offset = 0;
+
+	for (int round_trip = 0; round_trip < kMaxRoundTrips; round_trip++) {
+		const uint8_t opcode = _with_time_supported ? kOpcodeListDirectoryWithTime : kOpcodeListDirectory;
+
+		PayloadHeader reply;
+
+		if (!transact(opcode, path, offset, reply)) {
+			std::lock_guard<std::mutex> lock(_state->mutex);
+			return _state->should_exit ? Result::Stopped : Result::Timeout;
+		}
+
+		if (reply.opcode == kOpcodeNak) {
+			const uint8_t error = reply.size > 0 ? reply.data[0] : 0;
+
+			if (error == kErrUnknownCommand && opcode == kOpcodeListDirectoryWithTime) {
+				LOG_DEBUG("ListDirectoryWithTime unsupported, falling back to ListDirectory");
+				_with_time_supported = false;
+				continue; // Same offset, plain opcode
+			}
+
+			if (error == kErrEOF) {
+				return Result::Success;
+			}
+
+			if (offset == 0 && (error == kErrFileNotFound || error == kErrFailErrno)) {
+				return Result::FileNotFound;
+			}
+
+			LOG_DEBUG("FTP list of " << path << " failed with error " << static_cast<int>(error)
+				  << " at offset " << offset);
+			return Result::ProtocolError;
+		}
+
+		const uint32_t previous_offset = offset;
+		parse_entries(reply, entries, offset);
+
+		// An ACK that advances nothing would loop forever; treat it as the end
+		if (offset == previous_offset) {
+			return Result::Success;
+		}
+
+		if (entries.size() > kMaxEntries) {
+			LOG_WARN("Listing of " << path << " exceeded " << kMaxEntries << " entries, giving up");
+			return Result::ProtocolError;
+		}
+	}
+
+	LOG_WARN("Listing of " << path << " did not finish in " << kMaxRoundTrips << " requests");
+	return Result::ProtocolError;
+}
diff --git a/src/FtpListClient.hpp b/src/FtpListClient.hpp
new file mode 100644
index 0000000..3a2a4ed
--- /dev/null
+++ b/src/FtpListClient.hpp
@@ -0,0 +1,129 @@
+#pragma once
+
+#include <mavsdk/system.h>
+#include <mavsdk/plugins/mavlink_passthrough/mavlink_passthrough.h>
+
+#include <atomic>
+#include <condition_variable>
+#include <cstdint>
+#include <memory>
+#include <mutex>
+#include <optional>
+#include <string>
+#include <vector>
+
+// Minimal MAVLink FTP client for directory listings.
+//
+// MAVSDK's Ftp plugin discards the size and modification-time fields from list
+// replies, but those are exactly what identifies a log file. This implements
+// ListDirectory / ListDirectoryWithTime over MavlinkPassthrough and keeps the
+// full entries. Bulk transfers still go through MAVSDK's Ftp plugin.
+//
+// Delete this once a MAVSDK release carries mavlink/MAVSDK#2891, which returns
+// listings as Ftp::FilesystemEntry (name, entry_type, size_bytes,
+// modification_time_s) and makes this redundant. It is on MAVSDK main but not
+// in any release up to v3.17.2.
+//
+// ListDirectoryWithTime is tried first and the client falls back to plain
+// ListDirectory when the server NAKs it with "unknown command" (ArduPilot and
+// PX4 releases before v1.17 do).
+//
+// One request is in flight at a time and requests are issued from a single
+// thread; only stop() may be called from another.
+class FtpListClient
+{
+public:
+	struct Entry {
+		std::string name;
+		bool is_directory {false};
+		uint32_t size_bytes {0};
+		std::optional<int64_t> mtime_utc; // Requires ListDirectoryWithTime support
+	};
+
+	enum class Result {
+		Success,
+		Timeout,      // No reply after retries, FTP likely disabled
+		FileNotFound, // Directory does not exist
+		ProtocolError,
+		Stopped
+	};
+
+	explicit FtpListClient(std::shared_ptr<mavsdk::System> system);
+	~FtpListClient();
+
+	// Closes any sessions a previous (possibly crashed) client left open on the
+	// vehicle. Best effort: PX4 only has a single FTP session and a stale one
+	// blocks transfers until it is reset.
+	void reset_sessions();
+
+	Result list_directory(const std::string& path, std::vector<Entry>& entries);
+
+	void stop();
+
+private:
+	// From the MAV_FTP_OPCODE enum in the MAVLink specification
+	static constexpr uint8_t kOpcodeResetSessions = 2;
+	static constexpr uint8_t kOpcodeListDirectory = 3;
+	static constexpr uint8_t kOpcodeListDirectoryWithTime = 16;
+	static constexpr uint8_t kOpcodeAck = 128;
+	static constexpr uint8_t kOpcodeNak = 129;
+
+	// From the MAV_FTP_ERR enum
+	static constexpr uint8_t kErrFailErrno = 2;
+	static constexpr uint8_t kErrEOF = 6;
+	static constexpr uint8_t kErrUnknownCommand = 7;
+	static constexpr uint8_t kErrFileNotFound = 10;
+
+	static constexpr size_t kMaxDataLength = 239;
+
+	// A directory this large is a server that is not honouring the offset. Both
+	// the entry list and the round trips are driven by remote input, so both
+	// need a ceiling.
+	static constexpr size_t kMaxEntries = 20000;
+	static constexpr int kMaxRoundTrips = 2000;
+
+	// mavlink_file_transfer_protocol_t.payload is 251 bytes: this 12 byte
+	// header followed by kMaxDataLength bytes of data.
+	struct __attribute__((packed)) PayloadHeader {
+		uint16_t seq_number;
+		uint8_t session;
+		uint8_t opcode;
+		uint8_t size;
+		uint8_t req_opcode;
+		uint8_t burst_complete;
+		uint8_t padding;
+		uint32_t offset;
+		uint8_t data[kMaxDataLength];
+	};
+
+	static_assert(sizeof(PayloadHeader) == 251, "PayloadHeader must fill the FILE_TRANSFER_PROTOCOL payload");
+
+	// Everything the subscription callback touches. Held by shared_ptr and
+	// captured weakly, because MAVSDK removes a message handler asynchronously
+	// and does not drain the callbacks it has already queued: a reply can
+	// arrive after this object is gone, which on shutdown mid-transfer it will.
+	struct State {
+		std::mutex mutex;
+		std::condition_variable cv;
+		std::optional<PayloadHeader> reply;
+		uint16_t expected_seq {0};
+		std::optional<uint8_t> expected_req_opcode;
+		bool should_exit {false};
+	};
+
+	static void handle_message(State& state, uint8_t our_sysid, uint8_t our_compid,
+				   const mavlink_message_t& message);
+
+	bool transact(uint8_t opcode, const std::string& path, uint32_t offset, PayloadHeader& reply);
+	void send_request(const PayloadHeader& request);
+
+	static void parse_entries(const PayloadHeader& reply, std::vector<Entry>& entries, uint32_t& next_offset);
+
+	std::shared_ptr<mavsdk::MavlinkPassthrough> _passthrough;
+	mavsdk::MavlinkPassthrough::MessageHandle _subscription;
+
+	std::shared_ptr<State> _state {std::make_shared<State>()};
+
+	uint16_t _seq {0};
+	bool _with_time_supported {true}; // Optimistic until the server NAKs it
+};
diff --git a/src/FtpLogFetcher.cpp b/src/FtpLogFetcher.cpp
new file mode 100644
index 0000000..54766a2
--- /dev/null
+++ b/src/FtpLogFetcher.cpp
@@ -0,0 +1,342 @@
+#include "FtpLogFetcher.hpp"
+#include "Log.hpp"
+
+#include <algorithm>
+#include <cctype>
+#include <chrono>
+#include <cstring>
+#include <ctime>
+#include <filesystem>
+#include <future>
+
+namespace fs = std::filesystem;
+
+namespace
+{
+
+// "@MAV_LOG" is the virtual log directory from the MAVLink FTP specification
+// (PX4 >= v1.17). The physical paths cover firmware that predates it.
+constexpr const char* kProbeRoots[] = {
+	"@MAV_LOG",
+	"/fs/microsd/log", // PX4 on hardware
+	"/APM/LOGS",       // ArduPilot
+	"/log",            // PX4 SITL, and hardware without an SD card mount point
+};
+
+bool ends_with_ignore_case(const std::string& text, const std::string& suffix)
+{
+	if (text.size() < suffix.size()) {
+		return false;
+	}
+
+	const size_t offset = text.size() - suffix.size();
+
+	for (size_t i = 0; i < suffix.size(); i++) {
+		if (std::tolower(static_cast<unsigned char>(text[offset + i]))
+		    != std::tolower(static_cast<unsigned char>(suffix[i]))) {
+			return false;
+		}
+	}
+
+	return true;
+}
+
+bool is_log_file(const std::string& name)
+{
+	return ends_with_ignore_case(name, ".ulg") || ends_with_ignore_case(name, ".bin");
+}
+
+// PX4 writes logs as <root>/<YYYY-MM-DD>/<HH_MM_SS>.ulg. The parsed time is the
+// log start; used when the vehicle cannot report modification times.
+std::optional<int64_t> parse_px4_start_time(const std::string& directory, const std::string& filename)
+{
+	const std::string stem = fs::path(filename).stem().string();
+
+	if (directory.size() != 10 || stem.size() != 8) {
+		return std::nullopt;
+	}
+
+	std::tm tm {};
+
+	if (sscanf(directory.c_str(), "%4d-%2d-%2d", &tm.tm_year, &tm.tm_mon, &tm.tm_mday) != 3) {
+		return std::nullopt;
+	}
+
+	if (sscanf(stem.c_str(), "%2d_%2d_%2d", &tm.tm_hour, &tm.tm_min, &tm.tm_sec) != 3) {
+		return std::nullopt;
+	}
+
+	tm.tm_year -= 1900;
+	tm.tm_mon -= 1;
+
+	return static_cast<int64_t>(timegm(&tm));
+}
+
+std::string join_path(const std::string& directory, const std::string& name)
+{
+	if (!directory.empty() && directory.back() == '/') {
+		return directory + name;
+	}
+
+	return directory + "/" + name;
+}
+
+} // namespace
+
+FtpLogFetcher::FtpLogFetcher(std::shared_ptr<mavsdk::System> system, const FtpLogFetcher::Settings& settings)
+	: _list_client(std::make_shared<FtpListClient>(system))
+	, _ftp(std::make_shared<mavsdk::Ftp>(system))
+	, _settings(settings)
+{
+	// A run killed mid-transfer leaves a partial file behind. Nothing here
+	// resumes, so the staging directory starts empty every time.
+	std::error_code ec;
+	fs::remove_all(_settings.temp_directory, ec);
+	fs::create_directories(_settings.temp_directory, ec);
+}
+
+void FtpLogFetcher::stop()
+{
+	_should_exit = true;
+	_list_client->stop();
+}
+
+void FtpLogFetcher::reset_sessions()
+{
+	_list_client->reset_sessions();
+}
+
+bool FtpLogFetcher::refresh()
+{
+	if (_root.empty()) {
+		// The override, when set, is the only candidate
+		std::vector<std::string> roots;
+
+		if (_settings.remote_directory.empty()) {
+			roots.assign(std::begin(kProbeRoots), std::end(kProbeRoots));
+
+		} else {
+			roots.push_back(_settings.remote_directory);
+		}
+
+		for (const auto& root : roots) {
+			std::vector<RemoteLog> logs;
+
+			if (build_index(root, logs)) {
+				_root = root;
+				publish_index(std::move(logs));
+				_reported_unavailable = false;
+				LOG("MAVLink FTP available, indexed " << _logs.size() << " logs in " << _root);
+				return true;
+			}
+		}
+
+		if (!_reported_unavailable) {
+			LOG("Could not index vehicle logs over MAVLink FTP. "
+			    "Make sure the autopilot has MAVLink FTP enabled on this link.");
+			_reported_unavailable = true;
+		}
+
+		return false;
+	}
+
+	std::vector<RemoteLog> logs;
+
+	if (build_index(_root, logs)) {
+		publish_index(std::move(logs));
+		return true;
+	}
+
+	// The directory may have moved out from under us (SD card swap, firmware
+	// update). Forget the root so the next refresh probes again.
+	LOG_DEBUG("Re-indexing " << _root << " failed, will re-probe");
+	_root.clear();
+	_logs.clear();
+
+	return false;
+}
+
+const FtpLogFetcher::RemoteLog* FtpLogFetcher::find(const std::string& relative_path, uint32_t size_bytes) const
+{
+	for (const auto& log : _logs) {
+		if (log.relative_path == relative_path && log.size_bytes == size_bytes) {
+			return &log;
+		}
+	}
+
+	return nullptr;
+}
+
+void FtpLogFetcher::publish_index(std::vector<RemoteLog>&& logs)
+{
+	std::map<std::string, uint32_t> sizes;
+
+	for (auto& log : logs) {
+		auto previous = _previous_sizes.find(log.relative_path);
+		log.stable = previous != _previous_sizes.end() && previous->second == log.size_bytes;
+		sizes.emplace(log.relative_path, log.size_bytes);
+	}
+
+	_previous_sizes = std::move(sizes);
+	_logs = std::move(logs);
+}
+
+bool FtpLogFetcher::build_index(const std::string& root, std::vector<RemoteLog>& logs)
+{
+	std::vector<FtpListClient::Entry> entries;
+
+	if (_list_client->list_directory(root, entries) != FtpListClient::Result::Success) {
+		return false;
+	}
+
+	std::vector<std::string> subdirectories;
+
+	for (const auto& entry : entries) {
+		if (entry.is_directory) {
+			if (entry.name != "." && entry.name != "..") {
+				subdirectories.push_back(entry.name);
+			}
+
+		} else if (is_log_file(entry.name)) {
+			RemoteLog log;
+			log.relative_path = entry.name;
+			log.size_bytes = entry.size_bytes;
+			log.time_utc = entry.mtime_utc;
+			logs.push_back(log);
+		}
+	}
+
+	// PX4 nests logs one directory deep (<root>/<date>/<time>.ulg). A partial
+	// index would make missing logs look deleted, so any listing failure fails
+	// the whole refresh.
+	for (const auto& subdirectory : subdirectories) {
+		if (_should_exit) {
+			return false;
+		}
+
+		std::vector<FtpListClient::Entry> sub_entries;
+
+		if (_list_client->list_directory(join_path(root, subdirectory), sub_entries)
+		    != FtpListClient::Result::Success) {
+			LOG_DEBUG("Listing " << join_path(root, subdirectory) << " failed");
+			return false;
+		}
+
+		for (const auto& entry : sub_entries) {
+			if (entry.is_directory || !is_log_file(entry.name)) {
+				continue;
+			}
+
+			RemoteLog log;
+			log.relative_path = subdirectory + "/" + entry.name;
+			log.size_bytes = entry.size_bytes;
+			log.time_utc = entry.mtime_utc;
+
+			if (!log.time_utc.has_value()) {
+				log.time_utc = parse_px4_start_time(subdirectory, entry.name);
+			}
+
+			logs.push_back(log);
+		}
+	}
+
+	return true;
+}
+
+bool FtpLogFetcher::download(const RemoteLog& log, const std::string& local_path,
+			     const FtpLogFetcher::ProgressCallback& progress)
+{
+	std::error_code ec;
+	fs::create_directories(_settings.temp_directory, ec);
+
+	const std::string remote_path = join_path(_root, log.relative_path);
+
+	// MAVSDK writes to <local_dir>/<remote basename>, so stage the transfer and
+	// move it into place afterwards. A partial file never appears in the logs
+	// directory.
+	const std::string staged_path = join_path(_settings.temp_directory, fs::path(log.relative_path).filename().string());
+	fs::remove(staged_path, ec);
+
+	struct Transfer {
+		std::promise<mavsdk::Ftp::Result> promise;
+		std::atomic<bool> settled {false};
+	};
+
+	// Shared so the callback stays valid if we abandon the wait on shutdown
+	auto transfer = std::make_shared<Transfer>();
+	auto future_result = transfer->promise.get_future();
+
+	_ftp->download_async(remote_path, _settings.temp_directory, _settings.use_burst,
+	[transfer, progress](mavsdk::Ftp::Result result, mavsdk::Ftp::ProgressData data) {
+		if (transfer->settled.load()) {
+			return;
+		}
+
+		if (result == mavsdk::Ftp::Result::Next) {
+			if (progress) {
+				progress(data.bytes_transferred, data.total_bytes);
+			}
+
+			return;
+		}
+
+		// The waiter abandons the transfer on shutdown by setting this, so
+		// whoever gets there first is the one that settles the promise.
+		if (!transfer->settled.exchange(true)) {
+			transfer->promise.set_value(result);
+		}
+	});
+
+	// MAVSDK offers no way to cancel the transfer, so on shutdown the wait is
+	// abandoned instead of blocking until MAVSDK times out on its own.
+	while (future_result.wait_for(std::chrono::milliseconds(500)) != std::future_status::ready) {
+		if (_should_exit) {
+			transfer->settled.store(true);
+			fs::remove(staged_path, ec);
+			return false;
+		}
+	}
+
+	const auto result = future_result.get();
+
+	if (result != mavsdk::Ftp::Result::Success) {
+		LOG("FTP download of " << remote_path << " failed: " << result);
+		fs::remove(staged_path, ec);
+		return false;
+	}
+
+	if (!fs::exists(staged_path, ec)) {
+		LOG("FTP reported success but " << staged_path << " is missing");
+		return false;
+	}
+
+	const uint32_t downloaded_size = static_cast<uint32_t>(fs::file_size(staged_path, ec));
+
+	if (downloaded_size != log.size_bytes) {
+		// The log grew or was rotated since the listing; the next refresh will
+		// index the current state.
+		LOG("Size mismatch for " << remote_path << ": got " << downloaded_size
+		    << " bytes, expected " << log.size_bytes);
+		fs::remove(staged_path, ec);
+		return false;
+	}
+
+	fs::remove(local_path, ec);
+	ec.clear();
+	fs::rename(staged_path, local_path, ec);
+
+	if (ec) {
+		// Different filesystems, fall back to a copy
+		ec.clear();
+		fs::copy_file(staged_path, local_path, fs::copy_options::overwrite_existing, ec);
+		std::error_code remove_ec;
+		fs::remove(staged_path, remove_ec);
+
+		if (ec) {
+			LOG("Failed to move " << staged_path << " to " << local_path << ": " << ec.message());
+			return false;
+		}
+	}
+
+	return true;
+}
diff --git a/src/FtpLogFetcher.hpp b/src/FtpLogFetcher.hpp
new file mode 100644
index 0000000..2d64b90
--- /dev/null
+++ b/src/FtpLogFetcher.hpp
@@ -0,0 +1,100 @@
+#pragma once
+
+#include <mavsdk/system.h>
+#include <mavsdk/plugins/ftp/ftp.h>
+
+#include <atomic>
+#include <cstdint>
+#include <functional>
+#include <map>
+#include <memory>
+#include <optional>
+#include <string>
+#include <vector>
+
+#include "FtpListClient.hpp"
+
+// Indexes and downloads flight logs over MAVLink FTP.
+//
+// FILE_TRANSFER_PROTOCOL (msg 110) is addressed, and both PX4 and ArduPilot
+// send replies back to the requesting sysid/compid, so everything here is
+// unicast between the vehicle and logloader. The classic log protocol's
+// LOG_ENTRY / LOG_DATA (msgs 118/120) carry no target fields, which forces a
+// router in between to copy them to every endpoint it serves; logloader does
+// not use it at all.
+//
+// The vehicle log directory is probed at "@MAV_LOG" (the virtual directory the
+// MAVLink FTP spec defines for exactly this), then at the physical locations
+// used by PX4 and ArduPilot.
+class FtpLogFetcher
+{
+public:
+	struct RemoteLog {
+		// Path below the log root. The root can change (e.g. a firmware update
+		// that adds @MAV_LOG support), the relative path cannot, so identity is
+		// derived from this plus the size.
+		std::string relative_path;
+		uint32_t size_bytes {0};
+		// Modification time when the vehicle supports ListDirectoryWithTime,
+		// otherwise the start time PX4 encodes in the path, otherwise unknown.
+		std::optional<int64_t> time_utc;
+		// False while the file is still growing, i.e. the log the vehicle is
+		// writing right now. See refresh().
+		bool stable {false};
+	};
+
+	struct Settings {
+		std::string temp_directory;   // Scratch space for in-progress transfers
+		std::string remote_directory; // Empty probes the known locations
+		bool use_burst {true};
+	};
+
+	using ProgressCallback = std::function<void(uint32_t bytes_transferred, uint32_t total_bytes)>;
+
+	FtpLogFetcher(std::shared_ptr<mavsdk::System> system, const Settings& settings);
+
+	// Closes any FTP session a previous run left open on the vehicle
+	void reset_sessions();
+
+	// (Re)indexes the vehicle log directory, probing for it first when it is
+	// not known yet. Returns true only when a complete index was built, so a
+	// missing log can be trusted to actually be gone from the vehicle.
+	//
+	// A log is marked stable once two consecutive listings agree on its size.
+	// The log the vehicle is currently writing keeps growing, and downloading
+	// it would only produce a file that no longer matches what was listed.
+	bool refresh();
+
+	bool available() const { return !_root.empty(); }
+	const std::string& root() const { return _root; }
+	const std::vector<RemoteLog>& logs() const { return _logs; }
+
+	// The indexed log with this identity, or nullptr when the last listing did
+	// not report it. The pointer is valid until the next refresh().
+	const RemoteLog* find(const std::string& relative_path, uint32_t size_bytes) const;
+
+	// Downloads a log into local_path, staging the transfer in temp_directory
+	// so partial files never appear next to finished ones. The size reported by
+	// the directory listing must match or the download is discarded.
+	bool download(const RemoteLog& log, const std::string& local_path, const ProgressCallback& progress);
+
+	void stop();
+
+private:
+	bool build_index(const std::string& root, std::vector<RemoteLog>& logs);
+	void publish_index(std::vector<RemoteLog>&& logs);
+
+	std::shared_ptr<FtpListClient> _list_client;
+	std::shared_ptr<mavsdk::Ftp> _ftp;
+	Settings _settings;
+
+	std::string _root;
+	std::vector<RemoteLog> _logs;
+
+	// Sizes from the previous listing, keyed by relative path
+	std::map<std::string, uint32_t> _previous_sizes;
+
+	bool _reported_unavailable {false};
+
+	std::atomic<bool> _should_exit {false};
+};
diff --git a/src/LegacyImport.cpp b/src/LegacyImport.cpp
new file mode 100644
index 0000000..1890104
--- /dev/null
+++ b/src/LegacyImport.cpp
@@ -0,0 +1,277 @@
+#include "LegacyImport.hpp"
+#include "Log.hpp"
+#include "Sqlite.hpp"
+
+#include <cstdio>
+#include <cstdlib>
+#include <ctime>
+#include <filesystem>
+#include <iomanip>
+#include <sstream>
+
+namespace fs = std::filesystem;
+
+namespace legacy
+{
+
+namespace
+{
+
+std::optional<int64_t> parse_iso8601_utc(const std::string& text)
+{
+	std::tm tm {};
+
+	if (sscanf(text.c_str(), "%4d-%2d-%2dT%2d:%2d:%2dZ",
+		   &tm.tm_year, &tm.tm_mon, &tm.tm_mday, &tm.tm_hour, &tm.tm_min, &tm.tm_sec) != 6) {
+		return std::nullopt;
+	}
+
+	tm.tm_year -= 1900;
+	tm.tm_mon -= 1;
+
+	return static_cast<int64_t>(timegm(&tm));
+}
+
+// A second database stays attached on any path that forgets to detach, and the
+// next ATTACH then fails with "already in use".
+class Attached
+{
+public:
+	Attached(sqlite3* db, const std::string& file)
+		: _db(db)
+	{
+		sqlite::Statement attach(_db, "ATTACH DATABASE ? AS legacy");
+		attach.bind(1, file);
+		_attached = attach.execute();
+	}
+
+	~Attached()
+	{
+		if (_attached) {
+			sqlite::execute(_db, "DETACH DATABASE legacy");
+		}
+	}
+
+	Attached(const Attached&) = delete;
+	Attached& operator=(const Attached&) = delete;
+
+	explicit operator bool() const { return _attached; }
+
+private:
+	sqlite3* _db {nullptr};
+	bool _attached {false};
+};
+
+struct Candidate {
+	std::string uuid;
+	int64_t legacy_id {0};
+	std::string date;
+	bool downloaded {false};
+	bool uploaded {false};
+	bool rejected {false};
+};
+
+} // namespace
+
+Importer::Importer(sqlite3* db, const std::string& db_path, const std::string& logs_directory,
+		   const std::vector<std::string>& targets)
+	: _db(db)
+	, _logs_directory(logs_directory)
+	, _targets(targets)
+{
+	const fs::path directory = fs::path(db_path).parent_path();
+
+	// The old database file names, and which target each one's upload state
+	// belongs to.
+	const std::pair<const char*, const char*> sources[] = {
+		{"local_server.db", "local"},
+		{"remote_server.db", "remote"},
+	};
+
+	for (const auto& [file, target] : sources) {
+		const fs::path source = directory / file;
+
+		if (fs::exists(source)) {
+			import_one(source.string(), target);
+		}
+	}
+
+	_has_rows = sqlite::table_exists(_db, "legacy_logs");
+}
+
+void Importer::import_one(const std::string& file, const std::string& target)
+{
+	// Importing twice would resurrect rows the operator has since dealt with.
+	{
+		sqlite::Statement seen(_db, "SELECT value FROM meta WHERE key = ?");
+		seen.bind(1, "imported_" + target);
+
+		if (seen.step()) {
+			return;
+		}
+	}
+
+	sqlite::execute(_db,
+			"CREATE TABLE IF NOT EXISTS legacy_logs ("
+			"  target     TEXT    NOT NULL,"
+			"  uuid       TEXT    NOT NULL,"
+			"  legacy_id  INTEGER NOT NULL DEFAULT 0,"
+			"  date       TEXT    NOT NULL DEFAULT '',"
+			"  size_bytes INTEGER NOT NULL DEFAULT 0,"
+			"  downloaded INTEGER NOT NULL DEFAULT 0,"
+			"  uploaded   INTEGER NOT NULL DEFAULT 0,"
+			"  rejected   INTEGER NOT NULL DEFAULT 0,"
+			"  matched    INTEGER NOT NULL DEFAULT 0,"
+			"  PRIMARY KEY (target, uuid))");
+
+	const Attached legacy_db(_db, file);
+
+	if (!legacy_db) {
+		LOG_WARN("Could not read the previous database " << file);
+		return;
+	}
+
+	// Only the pre-FTP schema is ever imported: it is the one whose state this
+	// class cannot otherwise reconstruct.
+	sqlite::Statement shape(_db, "SELECT COUNT(*) FROM pragma_table_info('logs', 'legacy') WHERE name = 'id'");
+
+	if (!shape.step() || shape.column_int(0) == 0) {
+		LOG_DEBUG("Previous database " << file << " has no pre-FTP log table, nothing to import");
+		return;
+	}
+
+	int imported = 0;
+	sqlite::Transaction transaction(_db);
+
+	{
+		sqlite::Statement read(_db, "SELECT uuid, id, date, size_bytes, downloaded, uploaded FROM legacy.logs");
+
+		while (read.step()) {
+			sqlite::Statement row(_db,
+					      "INSERT OR IGNORE INTO legacy_logs "
+					      "(target, uuid, legacy_id, date, size_bytes, downloaded, uploaded, rejected) "
+					      "VALUES (?, ?, ?, ?, ?, ?, ?, 0)");
+			row.bind(1, target)
+			.bind(2, read.column_text(0))
+			.bind(3, read.column_int(1))
+			.bind(4, read.column_text(2))
+			.bind(5, read.column_int(3))
+			.bind(6, read.column_int(4))
+			.bind(7, read.column_int(5));
+			row.execute();
+			imported++;
+		}
+	}
+
+	sqlite::Statement blacklist(_db,
+				    "UPDATE legacy_logs SET rejected = 1 "
+				    "WHERE target = ? AND uuid IN (SELECT uuid FROM legacy.blacklist)");
+	blacklist.bind(1, target);
+	blacklist.execute();
+
+	sqlite::Statement mark(_db, "INSERT OR REPLACE INTO meta (key, value) VALUES (?, '1')");
+	mark.bind(1, "imported_" + target);
+	mark.execute();
+
+	if (!transaction.commit()) {
+		LOG_WARN("Could not import " << file << "; it will be retried on the next start");
+		return;
+	}
+
+	if (imported > 0) {
+		LOG("Carried over " << imported << " log records from the previous " << target << " database");
+	}
+}
+
+void Importer::adopt(int64_t log_id, uint32_t size_bytes, std::optional<int64_t> time_utc, const std::string& path)
+{
+	for (const auto& target : _targets) {
+		std::vector<Candidate> candidates;
+
+		{
+			sqlite::Statement stmt(_db,
+					       "SELECT uuid, legacy_id, date, downloaded, uploaded, rejected FROM legacy_logs "
+					       "WHERE target = ? AND matched = 0 AND size_bytes = ?");
+			stmt.bind(1, target).bind(2, static_cast<int64_t>(size_bytes));
+
+			while (stmt.step()) {
+				Candidate candidate;
+				candidate.uuid = stmt.column_text(0);
+				candidate.legacy_id = stmt.column_int(1);
+				candidate.date = stmt.column_text(2);
+				candidate.downloaded = stmt.column_int(3) != 0;
+				candidate.uploaded = stmt.column_int(4) != 0;
+				candidate.rejected = stmt.column_int(5) != 0;
+				candidates.push_back(candidate);
+			}
+		}
+
+		if (candidates.empty()) {
+			continue;
+		}
+
+		// The old database recorded the log's modification time; the FTP index
+		// reports either that or the start time in the path, so the same log is
+		// at most a flight apart. With no time to compare, only a single
+		// unambiguous candidate is safe to claim.
+		const Candidate* match = nullptr;
+
+		if (time_utc.has_value()) {
+			constexpr int64_t kMaxDelta = 48 * 3600;
+			int64_t best = kMaxDelta;
+
+			for (const auto& candidate : candidates) {
+				const auto legacy_time = parse_iso8601_utc(candidate.date);
+
+				if (!legacy_time.has_value()) {
+					continue;
+				}
+
+				const int64_t delta = std::abs(legacy_time.value() - time_utc.value());
+
+				// Strictly better, so several equidistant candidates leave
+				// the first one holding the claim rather than the last.
+				if (delta < best) {
+					best = delta;
+					match = &candidate;
+				}
+			}
+
+		} else if (candidates.size() == 1) {
+			match = &candidates.front();
+		}
+
+		if (match == nullptr) {
+			continue;
+		}
+
+		// The name the old download used, so a log already on disk is not
+		// fetched a second time.
+		std::ostringstream legacy_name;
+		legacy_name << _logs_directory << "LOG" << std::setfill('0') << std::setw(4)
+			    << match->legacy_id << "_" << match->date << ".ulg";
+
+		const std::string legacy_path = legacy_name.str();
+		const bool file_exists = fs::exists(legacy_path);
+
+		if (match->downloaded && file_exists) {
+			sqlite::Statement update(_db,
+						 "UPDATE logs SET downloaded = 1, local_path = ? WHERE id = ? AND downloaded = 0");
+			update.bind(1, legacy_path).bind(2, log_id);
+			update.execute();
+		}
+
+		sqlite::Statement upload(_db,
+					 "UPDATE uploads SET uploaded = ?, rejected = ? WHERE log_id = ? AND target = ?");
+		upload.bind(1, match->uploaded).bind(2, match->rejected).bind(3, log_id).bind(4, target);
+		upload.execute();
+
+		sqlite::Statement mark(_db, "UPDATE legacy_logs SET matched = 1 WHERE target = ? AND uuid = ?");
+		mark.bind(1, target).bind(2, match->uuid);
+		mark.execute();
+
+		LOG_DEBUG("Carried over " << target << " state for " << path << " from the previous database");
+	}
+}
+
+} // namespace legacy
diff --git a/src/LegacyImport.hpp b/src/LegacyImport.hpp
new file mode 100644
index 0000000..b212b59
--- /dev/null
+++ b/src/LegacyImport.hpp
@@ -0,0 +1,44 @@
+#pragma once
+
+#include <cstdint>
+#include <optional>
+#include <string>
+#include <vector>
+
+#include <sqlite3.h>
+
+// Carries state over from the pre-FTP logloader, which kept one database per
+// server and identified a log by the index and timestamp LOG_ENTRY reported.
+// MAVLink FTP cannot reproduce either, so the old rows are set aside and
+// matched to the listing by size as it comes in.
+//
+// This exists only while a fleet upgrades. Once every device has run a version
+// containing it, delete the file: nothing else depends on it.
+namespace legacy
+{
+
+class Importer
+{
+public:
+	// Folds local_server.db and remote_server.db, if they are next to db_path,
+	// into a legacy_logs table in db. Doing nothing is the normal case.
+	Importer(sqlite3* db, const std::string& db_path, const std::string& logs_directory,
+		 const std::vector<std::string>& targets);
+
+	// False when there is nothing left to match, which is the steady state.
+	bool has_rows() const { return _has_rows; }
+
+	// Claims the state of a matching old row for a log just inserted. The
+	// caller holds the database lock and is inside its transaction.
+	void adopt(int64_t log_id, uint32_t size_bytes, std::optional<int64_t> time_utc, const std::string& path);
+
+private:
+	void import_one(const std::string& file, const std::string& target);
+
+	sqlite3* _db {nullptr};
+	std::string _logs_directory;
+	std::vector<std::string> _targets;
+	bool _has_rows {false};
+};
+
+} // namespace legacy
diff --git a/src/Log.cpp b/src/Log.cpp
new file mode 100644
index 0000000..2a53375
--- /dev/null
+++ b/src/Log.cpp
@@ -0,0 +1,71 @@
+#include "Log.hpp"
+
+#include <atomic>
+#include <iostream>
+#include <mutex>
+
+namespace logging
+{
+
+namespace
+{
+
+std::atomic<Level> g_level {Level::Info};
+std::mutex g_mutex;
+
+const char* prefix(Level level)
+{
+	switch (level) {
+	case Level::Error: return "ERROR: ";
+
+	case Level::Warn: return "WARN: ";
+
+	case Level::Debug: return "DEBUG: ";
+
+	case Level::Info: break;
+	}
+
+	return "";
+}
+
+} // namespace
+
+void set_level(Level level)
+{
+	g_level.store(level, std::memory_order_relaxed);
+}
+
+bool enabled(Level level)
+{
+	return level <= g_level.load(std::memory_order_relaxed);
+}
+
+bool parse_level(const std::string& text, Level& out)
+{
+	if (text == "error") {
+		out = Level::Error;
+
+	} else if (text == "warn" || text == "warning") {
+		out = Level::Warn;
+
+	} else if (text == "info") {
+		out = Level::Info;
+
+	} else if (text == "debug") {
+		out = Level::Debug;
+
+	} else {
+		return false;
+	}
+
+	return true;
+}
+
+void write(Level level, const std::string& message)
+{
+	std::lock_guard<std::mutex> lock(g_mutex);
+	std::ostream& stream = level == Level::Error ? std::cerr : std::cout;
+	stream << prefix(level) << message << std::endl;
+}
+
+} // namespace logging
diff --git a/src/Log.hpp b/src/Log.hpp
index 2845f09..490390d 100644
--- a/src/Log.hpp
+++ b/src/Log.hpp
@@ -1,12 +1,43 @@
 #pragma once
 
-#include <iostream>
 #include <sstream>
+#include <string>
 
-#define LOG(x) std::cout << x << std::endl
+// Leveled, thread-safe logging. The level is a runtime setting (log_level in
+// config.toml) rather than a build flag, so a device in the field can be turned
+// up to debug without reinstalling a differently-compiled binary.
+namespace logging
+{
 
-#ifdef DEBUG_BUILD
-#define LOG_DEBUG(x) std::cout << "[DEBUG] " << x << std::endl
-#else
-#define LOG_DEBUG(x) do {} while(0)
-#endif
+enum class Level {
+	Error = 0,
+	Warn = 1,
+	Info = 2,
+	Debug = 3,
+};
+
+void set_level(Level level);
+bool enabled(Level level);
+
+// Returns false when the text does not name a level; out is left alone.
+bool parse_level(const std::string& text, Level& out);
+
+// One write() call emits one whole line, so lines from different threads never
+// interleave the way chained operator<< on std::cout does.
+void write(Level level, const std::string& message);
+
+} // namespace logging
+
+#define LOG_AT(level, expression)                    \
+	do {                                         \
+		if (logging::enabled(level)) {       \
+			std::ostringstream _log_oss; \
+			_log_oss << expression;      \
+			logging::write(level, _log_oss.str()); \
+		}                                    \
+	} while (0)
+
+#define LOG_ERROR(x) LOG_AT(logging::Level::Error, x)
+#define LOG_WARN(x)  LOG_AT(logging::Level::Warn, x)
+#define LOG(x)       LOG_AT(logging::Level::Info, x)
+#define LOG_DEBUG(x) LOG_AT(logging::Level::Debug, x)
diff --git a/src/LogDatabase.cpp b/src/LogDatabase.cpp
new file mode 100644
index 0000000..d019e13
--- /dev/null
+++ b/src/LogDatabase.cpp
@@ -0,0 +1,650 @@
+#include "LogDatabase.hpp"
+#include "LegacyImport.hpp"
+#include "Log.hpp"
+#include "Sqlite.hpp"
+
+#include <algorithm>
+#include <ctime>
+
+namespace
+{
+
+// Every SELECT reads the same columns in the same order, so row_to_entry only
+// has to be written once.
+const std::string kLogColumns =
+	"l.id, l.path, l.size_bytes, l.time_utc, l.local_path, l.downloaded, "
+	"l.download_requested, l.present, l.download_failures, l.last_error, l.discovered_at";
+
+// Newest first. Logs whose time the vehicle cannot report sort after the ones
+// it can; among those, a log we watched appear is newer than one that was
+// already on the card. Only within a single listing, where there is no
+// discovery order to go on, does the name decide: ArduPilot numbers its logs,
+// so the longer name is the later one (100.BIN after 99.BIN) -- right up until
+// the counter wraps at LOG_MAX_FILES, which is why it is the last resort.
+const std::string kNewestFirst =
+	"(l.time_utc IS NULL) ASC, l.time_utc DESC, l.discovered_seq DESC, LENGTH(l.path) DESC, l.path DESC";
+
+int64_t now_epoch()
+{
+	return static_cast<int64_t>(std::time(nullptr));
+}
+
+// A failed commit must not look like a successful one: the caller would go on
+// to act on rows that were rolled out from under it.
+bool commit_or_warn(sqlite::Transaction& transaction, const char* what)
+{
+	if (transaction.commit()) {
+		return true;
+	}
+
+	LOG_ERROR("Could not commit " << what << "; the change was rolled back");
+	return false;
+}
+
+LogDatabase::Entry row_to_entry(const sqlite::Statement& stmt)
+{
+	LogDatabase::Entry entry;
+	entry.id = stmt.column_int(0);
+	entry.path = stmt.column_text(1);
+	entry.size_bytes = static_cast<uint32_t>(stmt.column_int(2));
+	entry.time_utc = stmt.column_optional_int(3);
+	entry.local_path = stmt.column_text(4);
+	// The queues treat a row with no file as not downloaded; so must anything
+	// that reports it, or the API and the queue disagree about the same row.
+	entry.downloaded = stmt.column_int(5) != 0 && !entry.local_path.empty();
+	entry.download_requested = stmt.column_int(6) != 0;
+	entry.present = stmt.column_int(7) != 0;
+	entry.download_failures = static_cast<int>(stmt.column_int(8));
+	entry.last_error = stmt.column_text(9);
+	entry.discovered_at = stmt.column_int(10);
+	return entry;
+}
+
+} // namespace
+
+LogDatabase::LogDatabase(const std::string& db_path, const std::string& logs_directory,
+			 const std::vector<std::string>& targets)
+	: _targets(targets)
+{
+	if (!initialize(db_path)) {
+		LOG_ERROR("Could not open the log database at " << db_path);
+		return;
+	}
+
+	_legacy = std::make_unique<legacy::Importer>(_db, db_path, logs_directory, _targets);
+	_ok = true;
+}
+
+LogDatabase::~LogDatabase()
+{
+	if (_db != nullptr) {
+		// _v2 so a straggling statement leaks nothing and the handle still closes.
+		sqlite3_close_v2(_db);
+	}
+}
+
+bool LogDatabase::initialize(const std::string& db_path)
+{
+	if (sqlite3_open(db_path.c_str(), &_db) != SQLITE_OK) {
+		LOG_ERROR("Cannot open database: " << sqlite3_errmsg(_db));
+		sqlite3_close(_db);
+		_db = nullptr;
+		return false;
+	}
+
+	// WAL lets the API server read while the download loop writes.
+	sqlite::execute(_db, "PRAGMA journal_mode = WAL");
+	sqlite::execute(_db, "PRAGMA foreign_keys = ON");
+	sqlite::execute(_db, "PRAGMA busy_timeout = 5000");
+
+	return create_schema();
+}
+
+bool LogDatabase::create_schema()
+{
+	const bool logs = sqlite::execute(_db,
+					  "CREATE TABLE IF NOT EXISTS logs ("
+					  "  id                 INTEGER PRIMARY KEY,"
+					  "  path               TEXT    NOT NULL,"
+					  "  size_bytes         INTEGER NOT NULL,"
+					  "  time_utc           INTEGER,"
+					  "  local_path         TEXT    NOT NULL DEFAULT '',"
+					  "  downloaded         INTEGER NOT NULL DEFAULT 0,"
+					  "  download_requested INTEGER NOT NULL DEFAULT 0,"
+					  "  present            INTEGER NOT NULL DEFAULT 1,"
+					  "  download_failures  INTEGER NOT NULL DEFAULT 0,"
+					  "  last_error         TEXT    NOT NULL DEFAULT '',"
+					  "  discovered_at      INTEGER NOT NULL DEFAULT 0,"
+					  "  discovered_seq     INTEGER NOT NULL DEFAULT 0,"
+					  "  UNIQUE (path, size_bytes))");
+
+	const bool uploads = sqlite::execute(_db,
+					     "CREATE TABLE IF NOT EXISTS uploads ("
+					     "  log_id     INTEGER NOT NULL REFERENCES logs(id) ON DELETE CASCADE,"
+					     "  target     TEXT    NOT NULL,"
+					     "  uploaded   INTEGER NOT NULL DEFAULT 0,"
+					     "  requested  INTEGER NOT NULL DEFAULT 0,"
+					     "  rejected   INTEGER NOT NULL DEFAULT 0,"
+					     "  location   TEXT    NOT NULL DEFAULT '',"
+					     "  message    TEXT    NOT NULL DEFAULT '',"
+					     "  updated_at INTEGER NOT NULL DEFAULT 0,"
+					     "  PRIMARY KEY (log_id, target))");
+
+	const bool meta = sqlite::execute(_db,
+					  "CREATE TABLE IF NOT EXISTS meta ("
+					  "  key   TEXT PRIMARY KEY,"
+					  "  value TEXT NOT NULL)");
+
+	return logs && uploads && meta && migrate_schema();
+}
+
+bool LogDatabase::migrate_schema()
+{
+	if (!sqlite::column_exists(_db, "logs", "discovered_seq")) {
+		if (!sqlite::execute(_db, "ALTER TABLE logs ADD COLUMN discovered_seq INTEGER NOT NULL DEFAULT 0")) {
+			return false;
+		}
+
+		// discovered_at is the same ordering at coarser resolution, which is
+		// the best that can be reconstructed for rows that predate the column.
+		sqlite::execute(_db, "UPDATE logs SET discovered_seq = discovered_at");
+	}
+
+	return true;
+}
+
+// -------------------------------------------------------------------------
+// Index
+// -------------------------------------------------------------------------
+
+LogDatabase::SyncResult LogDatabase::sync_index(const std::vector<Discovered>& logs)
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	SyncResult result;
+
+	for (const auto& log : logs) {
+		if (log.stable) {
+			result.present_count++;
+		}
+	}
+
+	sqlite::Transaction transaction(_db);
+
+	if (!transaction) {
+		LOG_ERROR("Could not begin a transaction; skipping this index");
+		return result;
+	}
+
+	// The listing is complete (a partial one fails the whole refresh), so
+	// anything it does not mention is gone from the vehicle.
+	sqlite::execute(_db, "UPDATE logs SET present = 0");
+
+	int64_t present_before = 0;
+	{
+		sqlite::Statement stmt(_db, "SELECT COUNT(*) FROM logs WHERE present = 1");
+
+		if (stmt.step()) {
+			present_before = stmt.column_int(0);
+		}
+	}
+
+	const int64_t discovered_at = now_epoch();
+
+	// A wall clock at one-second resolution cannot separate two listings, and
+	// on a companion with no RTC it can run backwards. The sequence can do
+	// neither.
+	int64_t discovered_seq = 1;
+	{
+		sqlite::Statement stmt(_db, "SELECT COALESCE(MAX(discovered_seq), 0) + 1 FROM logs");
+
+		if (stmt.step()) {
+			discovered_seq = stmt.column_int(0);
+		}
+	}
+
+	for (const auto& log : logs) {
+		int64_t id = 0;
+		bool is_new = false;
+
+		if (log.stable) {
+			sqlite::Statement insert(_db,
+						 "INSERT OR IGNORE INTO logs "
+						 "(path, size_bytes, time_utc, discovered_at, discovered_seq) "
+						 "VALUES (?, ?, ?, ?, ?)");
+			insert.bind(1, log.path)
+			.bind(2, static_cast<int64_t>(log.size_bytes))
+			.bind(3, log.time_utc)
+			.bind(4, discovered_at)
+			.bind(5, discovered_seq);
+			insert.execute();
+
+			if (sqlite3_changes(_db) > 0) {
+				id = sqlite3_last_insert_rowid(_db);
+				is_new = true;
+			}
+		}
+
+		if (!is_new) {
+			sqlite::Statement find(_db, "SELECT id FROM logs WHERE path = ? AND size_bytes = ?");
+			find.bind(1, log.path).bind(2, static_cast<int64_t>(log.size_bytes));
+
+			if (!find.step()) {
+				// A log we have never recorded, still being written. Nothing to
+				// mark present; it becomes a row once it stops changing.
+				continue;
+			}
+
+			id = find.column_int(0);
+		}
+
+		// A firmware upgrade can start reporting modification times for logs
+		// that were indexed without one.
+		sqlite::Statement update(_db,
+					 "UPDATE logs SET present = 1, time_utc = COALESCE(time_utc, ?) WHERE id = ?");
+		update.bind(1, log.time_utc).bind(2, id);
+		update.execute();
+
+		if (is_new) {
+			ensure_upload_rows(id);
+
+			if (_legacy->has_rows()) {
+				_legacy->adopt(id, log.size_bytes, log.time_utc, log.path);
+			}
+
+			result.inserted.push_back(id);
+		}
+	}
+
+	// A log only counts once two listings agree on its size, so the first
+	// listing after startup reconciles nothing. Recording that as the first
+	// index would make the next one -- the vehicle's whole history -- look like
+	// logs that appeared while we were watching.
+	if (result.present_count > 0) {
+		sqlite::Statement seen(_db, "SELECT value FROM meta WHERE key = 'first_index_seen'");
+		result.first_ever = !seen.step();
+
+		if (result.first_ever) {
+			sqlite::Statement mark(_db,
+					       "INSERT OR REPLACE INTO meta (key, value) VALUES ('first_index_seen', '1')");
+			mark.execute();
+		}
+	}
+
+	int64_t present_after = 0;
+	{
+		sqlite::Statement stmt(_db, "SELECT COUNT(*) FROM logs WHERE present = 1");
+
+		if (stmt.step()) {
+			present_after = stmt.column_int(0);
+		}
+	}
+
+	if (!commit_or_warn(transaction, "the vehicle index")) {
+		return {};
+	}
+
+	// An identical listing, which is what most of them are, is not a change:
+	// bumping the revision anyway would push the whole log list to every open
+	// stream once per index interval for nothing.
+	if (!result.inserted.empty() || present_before != present_after) {
+		_revision++;
+	}
+
+	return result;
+}
+
+void LogDatabase::ensure_upload_rows(int64_t id)
+{
+	for (const auto& target : _targets) {
+		sqlite::Statement stmt(_db, "INSERT OR IGNORE INTO uploads (log_id, target) VALUES (?, ?)");
+		stmt.bind(1, id).bind(2, target);
+		stmt.execute();
+	}
+}
+
+// -------------------------------------------------------------------------
+// Intent
+// -------------------------------------------------------------------------
+
+void LogDatabase::request(const std::vector<int64_t>& ids, const std::vector<std::string>& targets)
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	sqlite::Transaction transaction(_db);
+
+	for (int64_t id : ids) {
+		// An upload needs the file, so asking for either implies fetching it.
+		// Clearing the failure count gives an explicitly requested log a fresh
+		// place in the queue instead of the back of it.
+		sqlite::Statement stmt(_db,
+				       "UPDATE logs SET download_requested = 1, download_failures = 0, last_error = '' "
+				       "WHERE id = ? AND (downloaded = 0 OR local_path = '')");
+		stmt.bind(1, id);
+		stmt.execute();
+
+		for (const auto& target : targets) {
+			sqlite::Statement upload(_db,
+						 "UPDATE uploads SET requested = 1, rejected = 0 "
+						 "WHERE log_id = ? AND target = ? AND uploaded = 0");
+			upload.bind(1, id).bind(2, target);
+			upload.execute();
+		}
+	}
+
+	if (commit_or_warn(transaction, "request")) {
+		_revision++;
+	}
+}
+
+void LogDatabase::cancel_requests(const std::vector<int64_t>& ids)
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	sqlite::Transaction transaction(_db);
+
+	for (int64_t id : ids) {
+		sqlite::Statement stmt(_db, "UPDATE logs SET download_requested = 0 WHERE id = ?");
+		stmt.bind(1, id);
+		stmt.execute();
+
+		sqlite::Statement upload(_db, "UPDATE uploads SET requested = 0 WHERE log_id = ?");
+		upload.bind(1, id);
+		upload.execute();
+	}
+
+	if (commit_or_warn(transaction, "cancel")) {
+		_revision++;
+	}
+}
+
+// -------------------------------------------------------------------------
+// Work queues
+// -------------------------------------------------------------------------
+
+std::vector<LogDatabase::Entry> LogDatabase::logs_to_download() const
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+
+	sqlite::Statement stmt(_db,
+			       "SELECT " + kLogColumns + " FROM logs l "
+			       "WHERE l.download_requested = 1 AND (l.downloaded = 0 OR l.local_path = '') AND l.present = 1 "
+			       "ORDER BY l.download_failures ASC, " + kNewestFirst);
+
+	std::vector<Entry> entries;
+
+	while (stmt.step()) {
+		entries.push_back(row_to_entry(stmt));
+	}
+
+	attach_uploads(entries);
+	return entries;
+}
+
+std::vector<LogDatabase::Entry> LogDatabase::logs_to_upload(const std::string& target) const
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+
+	sqlite::Statement stmt(_db,
+			       "SELECT " + kLogColumns + " FROM logs l "
+			       "JOIN uploads u ON u.log_id = l.id "
+			       "WHERE u.target = ? AND u.requested = 1 AND u.uploaded = 0 AND u.rejected = 0 "
+			       "AND l.downloaded = 1 AND l.local_path != '' "
+			       "ORDER BY " + kNewestFirst);
+	stmt.bind(1, target);
+
+	std::vector<Entry> entries;
+
+	while (stmt.step()) {
+		entries.push_back(row_to_entry(stmt));
+	}
+
+	attach_uploads(entries);
+	return entries;
+}
+
+// -------------------------------------------------------------------------
+// State updates
+// -------------------------------------------------------------------------
+
+void LogDatabase::mark_downloaded(int64_t id, const std::string& local_path)
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	sqlite::Statement stmt(_db,
+			       "UPDATE logs SET downloaded = 1, download_requested = 0, local_path = ?, "
+			       "download_failures = 0, last_error = '' WHERE id = ?");
+	stmt.bind(1, local_path).bind(2, id);
+	stmt.execute();
+	_revision++;
+}
+
+void LogDatabase::record_download_failure(int64_t id, const std::string& error)
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	sqlite::Statement stmt(_db,
+			       "UPDATE logs SET download_failures = download_failures + 1, last_error = ? WHERE id = ?");
+	stmt.bind(1, error).bind(2, id);
+	stmt.execute();
+	_revision++;
+}
+
+void LogDatabase::mark_uploaded(int64_t id, const std::string& target, const std::string& location)
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	sqlite::Statement stmt(_db,
+			       "UPDATE uploads SET uploaded = 1, requested = 0, rejected = 0, location = ?, message = '', "
+			       "updated_at = ? WHERE log_id = ? AND target = ?");
+	stmt.bind(1, location).bind(2, now_epoch()).bind(3, id).bind(4, target);
+	stmt.execute();
+	_revision++;
+}
+
+void LogDatabase::mark_upload_rejected(int64_t id, const std::string& target, const std::string& message)
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	sqlite::Statement stmt(_db,
+			       "UPDATE uploads SET rejected = 1, requested = 0, message = ?, updated_at = ? "
+			       "WHERE log_id = ? AND target = ?");
+	stmt.bind(1, message).bind(2, now_epoch()).bind(3, id).bind(4, target);
+	stmt.execute();
+	_revision++;
+}
+
+void LogDatabase::record_upload_failure(int64_t id, const std::string& target, const std::string& message)
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	sqlite::Statement stmt(_db,
+			       "UPDATE uploads SET message = ?, updated_at = ? WHERE log_id = ? AND target = ?");
+	stmt.bind(1, message).bind(2, now_epoch()).bind(3, id).bind(4, target);
+	stmt.execute();
+	_revision++;
+}
+
+bool LogDatabase::clear_local_file(int64_t id, const std::string& expected_local_path)
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+
+	// Bound to the path the caller saw. The upload thread works from a snapshot
+	// that can be minutes old, and clearing unconditionally would wipe the
+	// bookkeeping of a download the index thread finished in the meantime.
+	std::string sql = "UPDATE logs SET downloaded = 0, local_path = '', download_requested = 0 WHERE id = ?";
+
+	if (!expected_local_path.empty()) {
+		sql += " AND local_path = ?";
+	}
+
+	sqlite::Statement stmt(_db, sql);
+	stmt.bind(1, id);
+
+	if (!expected_local_path.empty()) {
+		stmt.bind(2, expected_local_path);
+	}
+
+	stmt.execute();
+	const bool changed = sqlite3_changes(_db) > 0;
+
+	if (changed) {
+		_revision++;
+	}
+
+	return changed;
+}
+
+// -------------------------------------------------------------------------
+// Queries
+// -------------------------------------------------------------------------
+
+std::vector<LogDatabase::Entry> LogDatabase::all_logs() const
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+
+	sqlite::Statement stmt(_db, "SELECT " + kLogColumns + " FROM logs l ORDER BY " + kNewestFirst);
+
+	std::vector<Entry> entries;
+
+	while (stmt.step()) {
+		entries.push_back(row_to_entry(stmt));
+	}
+
+	attach_uploads(entries);
+	return entries;
+}
+
+std::optional<LogDatabase::Entry> LogDatabase::log_by_id(int64_t id) const
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+
+	sqlite::Statement stmt(_db, "SELECT " + kLogColumns + " FROM logs l WHERE l.id = ?");
+	stmt.bind(1, id);
+
+	if (!stmt.step()) {
+		return std::nullopt;
+	}
+
+	std::vector<Entry> entries {row_to_entry(stmt)};
+	attach_uploads(entries);
+	return entries.front();
+}
+
+std::optional<int64_t> LogDatabase::newest_log_id(const std::vector<int64_t>& among) const
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+
+	std::string filter = "l.present = 1";
+
+	if (!among.empty()) {
+		filter += " AND l.id IN (?";
+
+		for (size_t i = 1; i < among.size(); i++) {
+			filter += ",?";
+		}
+
+		filter += ")";
+	}
+
+	sqlite::Statement stmt(_db,
+			       "SELECT l.id FROM logs l WHERE " + filter + " ORDER BY " + kNewestFirst + " LIMIT 1");
+
+	for (size_t i = 0; i < among.size(); i++) {
+		stmt.bind(static_cast<int>(i) + 1, among[i]);
+	}
+
+	if (!stmt.step()) {
+		return std::nullopt;
+	}
+
+	return stmt.column_int(0);
+}
+
+bool LogDatabase::local_path_in_use(const std::string& local_path, int64_t excluding_id) const
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+
+	sqlite::Statement stmt(_db, "SELECT COUNT(*) FROM logs WHERE local_path = ? AND id != ?");
+	stmt.bind(1, local_path).bind(2, excluding_id);
+
+	return stmt.step() && stmt.column_int(0) > 0;
+}
+
+std::vector<int64_t> LogDatabase::ids_not_downloaded() const
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+
+	sqlite::Statement stmt(_db,
+			       "SELECT l.id FROM logs l WHERE l.present = 1 AND (l.downloaded = 0 OR l.local_path = '') ORDER BY " + kNewestFirst);
+
+	std::vector<int64_t> ids;
+
+	while (stmt.step()) {
+		ids.push_back(stmt.column_int(0));
+	}
+
+	return ids;
+}
+
+std::vector<int64_t> LogDatabase::ids_not_uploaded(const std::vector<std::string>& targets) const
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	std::vector<int64_t> ids;
+
+	if (targets.empty()) {
+		return ids;
+	}
+
+	std::string placeholders = "?";
+
+	for (size_t i = 1; i < targets.size(); i++) {
+		placeholders += ",?";
+	}
+
+	// Still on the vehicle or already fetched -- either way the file can be had.
+	sqlite::Statement stmt(_db,
+			       "SELECT DISTINCT l.id FROM logs l "
+			       "JOIN uploads u ON u.log_id = l.id "
+			       "WHERE u.target IN (" + placeholders + ") AND u.uploaded = 0 "
+			       "AND (l.downloaded = 1 OR l.present = 1) "
+			       "ORDER BY " + kNewestFirst);
+
+	for (size_t i = 0; i < targets.size(); i++) {
+		stmt.bind(static_cast<int>(i) + 1, targets[i]);
+	}
+
+	while (stmt.step()) {
+		ids.push_back(stmt.column_int(0));
+	}
+
+	return ids;
+}
+
+void LogDatabase::attach_uploads(std::vector<Entry>& entries) const
+{
+	if (entries.empty()) {
+		return;
+	}
+
+	std::map<int64_t, Entry*> by_id;
+
+	for (auto& entry : entries) {
+		for (const auto& target : _targets) {
+			entry.uploads[target] = {};
+		}
+
+		by_id[entry.id] = &entry;
+	}
+
+	sqlite::Statement stmt(_db, "SELECT log_id, target, uploaded, requested, rejected, location, message FROM uploads");
+
+	while (stmt.step()) {
+		auto it = by_id.find(stmt.column_int(0));
+
+		if (it == by_id.end()) {
+			continue;
+		}
+
+		UploadState state;
+		state.uploaded = stmt.column_int(2) != 0;
+		state.requested = stmt.column_int(3) != 0;
+		state.rejected = stmt.column_int(4) != 0;
+		state.location = stmt.column_text(5);
+		state.message = stmt.column_text(6);
+
+		it->second->uploads[stmt.column_text(1)] = state;
+	}
+}
diff --git a/src/LogDatabase.hpp b/src/LogDatabase.hpp
new file mode 100644
index 0000000..2c6c7e8
--- /dev/null
+++ b/src/LogDatabase.hpp
@@ -0,0 +1,151 @@
+#pragma once
+
+#include <atomic>
+#include <cstdint>
+#include <map>
+#include <memory>
+#include <mutex>
+#include <optional>
+#include <string>
+#include <vector>
+
+#include <sqlite3.h>
+
+#include "LegacyImport.hpp"
+
+// The inventory of the vehicle's logs and what logloader intends to do with
+// each one. There is exactly one of these; upload targets do not own state.
+//
+// A log is identified by its path below the vehicle log root plus its size.
+// The path alone is not enough: ArduPilot wraps its log numbering and reuses
+// file names, and a log that is still being written changes size.
+//
+// Every public method takes the internal mutex, so the download loop, the
+// upload thread and the API server can all call in without further locking.
+class LogDatabase
+{
+public:
+	struct UploadState {
+		bool uploaded {false};
+		bool requested {false};
+		// A server said no in a way that retrying cannot fix.
+		bool rejected {false};
+		// Path the server redirected to after a successful upload, e.g.
+		// "/plot_app?log=<uuid>". Relative, so the UI can reach it through
+		// whatever host it is talking to rather than the one logloader used.
+		std::string location;
+		std::string message; // Last thing the server said
+	};
+
+	struct Entry {
+		int64_t id {0};
+		std::string path;
+		uint32_t size_bytes {0};
+		std::optional<int64_t> time_utc;
+		std::string local_path;
+		bool downloaded {false};
+		bool download_requested {false};
+		// False once the log is gone from the vehicle. The row stays: a log we
+		// already fetched is still ours, and its upload history still matters.
+		bool present {true};
+		int download_failures {0};
+		std::string last_error;
+		int64_t discovered_at {0};
+		std::map<std::string, UploadState> uploads;
+	};
+
+	// A log as the vehicle listing reports it.
+	struct Discovered {
+		std::string path;
+		uint32_t size_bytes {0};
+		std::optional<int64_t> time_utc;
+		// False while the log is still growing. It is on the vehicle either way,
+		// but only a log that has stopped changing is worth recording, since its
+		// identity includes its size.
+		bool stable {true};
+	};
+
+	LogDatabase(const std::string& db_path, const std::string& logs_directory,
+		    const std::vector<std::string>& targets);
+	~LogDatabase();
+
+	LogDatabase(const LogDatabase&) = delete;
+	LogDatabase& operator=(const LogDatabase&) = delete;
+
+	bool ok() const { return _ok; }
+
+	struct SyncResult {
+		// Rows this call created, in the order the vehicle listed them.
+		std::vector<int64_t> inserted;
+		// Stable logs in this listing.
+		size_t present_count {0};
+		// This call reconciled the first listing that had anything in it. On a
+		// fresh database every log looks new, and queueing them all is exactly
+		// what must not happen.
+		bool first_ever {false};
+	};
+
+	// Index -------------------------------------------------------------
+	// Reconciles the table with a complete vehicle listing: inserts logs not
+	// seen before, and marks every row present or absent.
+	SyncResult sync_index(const std::vector<Discovered>& logs);
+
+	// Bumped by every write. A reader that has already rendered a given
+	// revision knows the log list has not moved since.
+	uint64_t revision() const { return _revision.load(std::memory_order_relaxed); }
+
+	// Intent -------------------------------------------------------------
+	// Queues these logs: fetched if not already local, then uploaded to each
+	// named target. Pass no targets to fetch without uploading.
+	void request(const std::vector<int64_t>& ids, const std::vector<std::string>& targets);
+	// Clears pending requests. Work already done is left alone.
+	void cancel_requests(const std::vector<int64_t>& ids);
+
+	// Work ---------------------------------------------------------------
+	// Queued, still on the vehicle, fewest failures first so one log that
+	// cannot be fetched does not block the queue behind it.
+	std::vector<Entry> logs_to_download() const;
+	std::vector<Entry> logs_to_upload(const std::string& target) const;
+
+	void mark_downloaded(int64_t id, const std::string& local_path);
+	void record_download_failure(int64_t id, const std::string& error);
+	void mark_uploaded(int64_t id, const std::string& target, const std::string& location);
+	void mark_upload_rejected(int64_t id, const std::string& target, const std::string& message);
+	void record_upload_failure(int64_t id, const std::string& target, const std::string& message);
+
+	// Forgets the downloaded file (the caller removes it from disk). Pass the
+	// path the caller believes is there to avoid clobbering a newer download;
+	// returns false when the row had moved on.
+	bool clear_local_file(int64_t id, const std::string& expected_local_path = {});
+
+	// Queries -------------------------------------------------------------
+	std::vector<Entry> all_logs() const;
+	std::optional<Entry> log_by_id(int64_t id) const;
+	// The most recent log still on the vehicle. Pass a non-empty among to
+	// restrict the answer to those ids.
+	std::optional<int64_t> newest_log_id(const std::vector<int64_t>& among = {}) const;
+	bool local_path_in_use(const std::string& local_path, int64_t excluding_id) const;
+
+	// Backing for the API's "everything" requests, as queries rather than a
+	// full materialisation of the table filtered in the caller.
+	std::vector<int64_t> ids_not_downloaded() const;
+	std::vector<int64_t> ids_not_uploaded(const std::vector<std::string>& targets) const;
+
+private:
+	bool initialize(const std::string& db_path);
+	bool create_schema();
+	// A column added after a database was created has to be added explicitly:
+	// CREATE TABLE IF NOT EXISTS is a no-op on a table that is already there.
+	bool migrate_schema();
+	void attach_uploads(std::vector<Entry>& entries) const;
+	void ensure_upload_rows(int64_t id);
+
+	mutable std::mutex _mutex;
+	std::atomic<uint64_t> _revision {0};
+	sqlite3* _db {nullptr};
+	// Opening the file is not enough: the schema still has to exist, and a
+	// read-only or full data directory fails only at CREATE TABLE.
+	bool _ok {false};
+	std::vector<std::string> _targets;
+	std::unique_ptr<legacy::Importer> _legacy;
+};
diff --git a/src/LogLoader.cpp b/src/LogLoader.cpp
index 357b0fe..1047bf3 100644
--- a/src/LogLoader.cpp
+++ b/src/LogLoader.cpp
@@ -1,355 +1,584 @@
 #include "LogLoader.hpp"
 #include "Log.hpp"
-#include <iostream>
+
+#include <algorithm>
+#include <chrono>
 #include <filesystem>
-#include <future>
-#include <regex>
-#include <fstream>
+#include <iomanip>
+#include <sstream>
+
+#include <mavsdk/log_callback.h>
 
 namespace fs = std::filesystem;
 
-LogLoader::LogLoader(const LogLoader::Settings& settings)
-	: _settings(settings)
+namespace
 {
-	// Disable mavsdk noise
-	mavsdk::log::subscribe([](...) {
-		// https://mavsdk.mavlink.io/main/en/cpp/guide/logging.html
-		return true;
-	});
-
-	_logs_directory = _settings.application_directory + "logs/";
-
-	// Setup local server interface
-	ServerInterface::Settings local_server_settings = {
-		.server_url = settings.local_server,
-		.user_email = "",
-		.logs_directory = _logs_directory,
-		.db_path = _settings.application_directory + "local_server.db",
-		.upload_enabled = true, // Always upload to local server
-		.public_logs = true, // Public required true for searching using Web UI
-	};
 
-	// Setup remote server interface
-	ServerInterface::Settings remote_server_settings = {
-		.server_url = settings.remote_server,
-		.user_email = settings.email,
-		.logs_directory = _logs_directory,
-		.db_path = _settings.application_directory + "remote_server.db",
-		.upload_enabled = settings.upload_enabled,
-		.public_logs = settings.public_logs,
-	};
+// How many logs in a row may fail transiently before the batch is abandoned for
+// this cycle. Enough to skip past a bad file, few enough not to hammer a server
+// that is having a bad day.
+constexpr int kMaxConsecutiveUploadRetries = 3;
+
+constexpr auto kFastIndexInterval = std::chrono::seconds(5);
+
+std::string human_size(uintmax_t bytes)
+{
+	std::ostringstream out;
+	out << std::fixed << std::setprecision(1) << bytes / 1e6 << " MB";
+	return out.str();
+}
+
+} // namespace
 
-	_local_server = std::make_shared<ServerInterface>(local_server_settings);
-	_remote_server = std::make_shared<ServerInterface>(remote_server_settings);
+LogLoader::LogLoader(const Config& config)
+	: _config(config)
+	, _database(config.data_directory + "logloader.db", config.logs_directory,
+		    std::vector<std::string> {kTargetLocal, kTargetRemote})
+{
+	// MAVSDK's own logging is noisy and duplicates what we report ourselves.
+	mavsdk::log::subscribe([](...) { return true; });
 
-	std::cout << std::fixed << std::setprecision(8);
+	std::error_code ec;
+	fs::create_directories(_config.logs_directory, ec);
 
-	fs::create_directories(_logs_directory);
+	for (const auto* target : _config.targets()) {
+		_targets.push_back(std::make_unique<UploadTarget>(*target));
+	}
 }
 
-void LogLoader::stop()
+LogLoader::~LogLoader()
 {
-	{
-		std::lock_guard<std::mutex> lock(_exit_cv_mutex);
-		_should_exit = true;
+	stop();
+
+	if (_upload_thread.joinable()) {
+		_upload_thread.join();
 	}
-	_exit_cv.notify_all();
+
+	// Drop the MAVSDK plugins while everything they might call back into is
+	// still alive. Member destruction alone would do this in the right order,
+	// but only by accident of declaration order.
+	_ftp.reset();
+	_telemetry.reset();
+	_mavsdk.reset();
 }
 
-bool LogLoader::wait_for_mavsdk_connection(double timeout_ms)
+std::vector<std::pair<std::string, std::string>> LogLoader::enabled_targets() const
 {
-	LOG("Connecting to " << _settings.mavsdk_connection_url);
-	_mavsdk = std::make_shared<mavsdk::Mavsdk>(mavsdk::Mavsdk::Configuration(1, MAV_COMP_ID_ONBOARD_COMPUTER,
-			true)); // Emit heartbeats (Client)
-	auto result = _mavsdk->add_any_connection(_settings.mavsdk_connection_url);
+	std::vector<std::pair<std::string, std::string>> targets;
 
-	if (result != mavsdk::ConnectionResult::Success) {
-		LOG("Connection failed: " << result);
-		return false;
+	for (const auto& target : _targets) {
+		if (target->enabled()) {
+			targets.emplace_back(target->name(), target->url());
+		}
 	}
 
-	auto system = _mavsdk->first_autopilot(timeout_ms);
+	return targets;
+}
 
-	if (!system) {
-		LOG("Timed out waiting for system");
-		return false;
+std::vector<std::string> LogLoader::enabled_target_names() const
+{
+	std::vector<std::string> names;
+
+	for (const auto& target : _targets) {
+		if (target->enabled()) {
+			names.push_back(target->name());
+		}
 	}
 
-	LOG("Connected.");
+	return names;
+}
+
+void LogLoader::stop()
+{
+	_index_waiter.stop();
+	_upload_waiter.stop();
+	_status->shutdown();
 
-	// MAVSDK plugins
-	_log_files = std::make_shared<mavsdk::LogFiles>(system.value());
-	_telemetry = std::make_shared<mavsdk::Telemetry>(system.value());
+	// connect() may be assigning _ftp on the main thread while the signal
+	// thread is in here.
+	std::shared_ptr<FtpLogFetcher> ftp;
+	{
+		std::lock_guard<std::mutex> lock(_ftp_mutex);
+		ftp = _ftp;
+	}
 
-	return true;
+	if (ftp) {
+		ftp->stop();
+	}
 }
 
-void LogLoader::run()
+void LogLoader::wake()
 {
-	auto upload_thread = std::thread(&LogLoader::upload_logs_thread, this);
-
-	while (!_should_exit) {
-		// Check if vehicle is armed or if the logger is running
-		// TODO: use SYS_STATUS flags to check logger status -- needs MAVSDK impl
-		// bool logger_running = _telemetry->sys_status_sensors().enabled & MAV_SYS_STATUS_LOGGING;
-		bool logger_running = false;
-		bool vehicle_armed = _telemetry->armed();
-
-		if (logger_running || vehicle_armed) {
-			_loop_disabled = true;
-			_remote_server->stop();
-			_local_server->stop();
-			std::this_thread::sleep_for(std::chrono::seconds(1));
-			continue;
+	_index_waiter.wake();
+	_upload_waiter.wake();
+}
+
+bool LogLoader::armed()
+{
+	return _telemetry && _telemetry->armed();
+}
+
+bool LogLoader::connect()
+{
+	while (!_index_waiter.stopped()) {
+		LOG("Connecting to " << _config.connection_url);
 
-		} else if (_loop_disabled) {
-			_loop_disabled = false;
-			_remote_server->start();
-			_local_server->start();
-			// Stall for a few seconds to allow logger to finish writing
-			std::this_thread::sleep_for(std::chrono::seconds(3));
+		_mavsdk = std::make_shared<mavsdk::Mavsdk>(
+				  mavsdk::Mavsdk::Configuration(1, MAV_COMP_ID_ONBOARD_COMPUTER, true));
+
+		if (_mavsdk->add_any_connection(_config.connection_url) != mavsdk::ConnectionResult::Success) {
+			LOG_ERROR("Could not open " << _config.connection_url);
+			_mavsdk.reset();
+
+			if (_index_waiter.wait(std::chrono::seconds(5))) {
+				return false;
+			}
+
+			continue;
 		}
 
-		// TODO:
-		// - request log entries at boot after connecting only
-		// - during runtime gate the log entry request on logger on/off events
-		if (!request_log_entries()) {
-			LOG_DEBUG("Failed to get logs");
-			std::this_thread::sleep_for(std::chrono::seconds(5));
+		// Seconds, despite what the MAVSDK parameter name suggests.
+		auto system = _mavsdk->first_autopilot(3.0);
+
+		if (!system) {
+			// Drop the connection before retrying: holding the UDP port open
+			// while rebinding it is how "address in use" happens.
+			_mavsdk.reset();
 			continue;
 		}
 
-		uint32_t total_to_download = _local_server->num_logs_to_download();
-		uint32_t num_remaining = total_to_download;
+		LOG("Connected to the autopilot");
+
+		_telemetry = std::make_shared<mavsdk::Telemetry>(system.value());
 
-		while (!_should_exit && num_remaining) {
-			// Download logs until we should exit or there are none left to download
-			LOG("Downloading log " << total_to_download - num_remaining + 1 << "/" << total_to_download);
-			download_next_log();
-			num_remaining = _local_server->num_logs_to_download();
+		FtpLogFetcher::Settings settings = {
+			.temp_directory = _config.data_directory + "tmp/",
+			.remote_directory = _config.remote_log_directory,
+			.use_burst = _config.use_burst,
+		};
+		{
+			// Published before reset_sessions, which blocks: a stop arriving
+			// during it has to be able to interrupt it.
+			std::lock_guard<std::mutex> lock(_ftp_mutex);
+			_ftp = std::make_shared<FtpLogFetcher>(system.value(), settings);
 		}
 
-		// Periodically request log list
-		if (!_should_exit) {
-			std::unique_lock<std::mutex> lock(_exit_cv_mutex);
-			_exit_cv.wait_for(lock, std::chrono::seconds(30), [this] { return _should_exit.load(); });
+		// PX4 serves one FTP session at a time, so one left open by a run that
+		// was killed mid-transfer blocks every transfer until the vehicle
+		// reboots.
+		if (_index_waiter.stopped()) {
+			// stop() ran while first_autopilot() was blocking, so it saw a null
+			// _ftp and there is nobody else to shut this one down.
+			_ftp->stop();
+			return false;
 		}
+
+		_ftp->reset_sessions();
+
+		_status->set_connected(true);
+		return true;
 	}
 
-	LOG_DEBUG("Waiting for upload thread");
-	upload_thread.join();
+	return false;
 }
 
-bool LogLoader::request_log_entries()
+void LogLoader::run()
 {
-	LOG_DEBUG("Requesting log entries...");
+	_upload_thread = std::thread(&LogLoader::upload_loop, this);
+	index_loop();
 
-	// Debug profiling code. We need to check how this performs with 100+ logs
-	auto request_start = std::chrono::high_resolution_clock::now();
-	auto entries_result = _log_files->get_entries();
+	_upload_waiter.stop();
 
-	//  Store log entries
-	_log_entries = entries_result.second;
+	if (_upload_thread.joinable()) {
+		_upload_thread.join();
+	}
+}
 
-	auto request_end = std::chrono::high_resolution_clock::now();
+// -------------------------------------------------------------------------
+// Index loop: everything that talks to the vehicle
+// -------------------------------------------------------------------------
 
-	std::chrono::duration<double> request_duration = request_end - request_start;
-	LOG_DEBUG("Received " << _log_entries.size() << "log entries in " << request_duration.count() << " seconds");
+void LogLoader::index_loop()
+{
+	while (!_index_waiter.stopped()) {
+		const bool is_armed = armed();
 
-	if (entries_result.first != mavsdk::LogFiles::Result::Success) {
-		LOG("Error getting log entries");
-		return false;
+		if (is_armed != _was_armed) {
+			_was_armed = is_armed;
+			_status->set_armed(is_armed);
+
+			if (!is_armed) {
+				// The logger needs a moment to close the file it was writing.
+				LOG("Vehicle disarmed, looking for a new log");
+				_fast_index_passes = 3;
+
+				if (_index_waiter.wait(std::chrono::seconds(3))) {
+					break;
+				}
+			}
+		}
+
+		if (is_armed) {
+			// Downloading competes with the logger for the SD card.
+			if (_index_waiter.wait(std::chrono::seconds(1))) {
+				break;
+			}
+
+			continue;
+		}
+
+		if (const auto sync = refresh_index(); sync.has_value()) {
+			apply_auto_policy(sync.value());
+			download_pending();
+		}
+
+		const auto interval = _fast_index_passes > 0
+				      ? kFastIndexInterval
+				      : std::chrono::seconds(_config.index_interval_s);
+
+		if (_fast_index_passes > 0) {
+			_fast_index_passes--;
+		}
+
+		if (_index_waiter.wait(interval)) {
+			break;
+		}
 	}
 
-	// Time the database addition
-	auto db_start = std::chrono::high_resolution_clock::now();
+	LOG_DEBUG("Index loop finished");
+}
 
-	for (const auto& entry : _log_entries) {
-		_local_server->add_log_entry(entry);
-		_remote_server->add_log_entry(entry);
+std::optional<LogDatabase::SyncResult> LogLoader::refresh_index()
+{
+	if (!_ftp->refresh()) {
+		_status->set_ftp(false, "");
+		return std::nullopt;
 	}
 
-	auto db_end = std::chrono::high_resolution_clock::now();
-	std::chrono::duration<double> db_duration = db_end - db_start;
+	// The whole listing goes over, growing logs included: a log being written is
+	// still on the vehicle, and leaving it out would mark every row absent on the
+	// first pass after a restart, when nothing has been seen twice yet.
+	std::vector<LogDatabase::Discovered> discovered;
+	size_t growing = 0;
 
-	LOG_DEBUG("Added log entries to databases in " << db_duration.count() << " seconds");
-	LOG_DEBUG("Total processing time: " << (request_duration + db_duration).count() << " seconds");
+	for (const auto& log : _ftp->logs()) {
+		if (!log.stable) {
+			growing++;
+		}
 
-	return true;
+		discovered.push_back({log.relative_path, log.size_bytes, log.time_utc, log.stable});
+	}
+
+	const LogDatabase::SyncResult sync = _database.sync_index(discovered);
+
+	const std::string root = _ftp->root();
+	_status->set_ftp(true, root);
+
+	LOG_DEBUG("Indexed " << sync.present_count << " logs in " << root
+		  << (growing > 0 ? " (" + std::to_string(growing) + " still being written)" : ""));
+
+	return sync;
 }
 
-void LogLoader::download_next_log()
+void LogLoader::apply_auto_policy(const LogDatabase::SyncResult& sync)
 {
-	// Get one undownloaded log, use the local server for query
-	ServerInterface::DatabaseEntry db_entry = _local_server->get_next_log_to_download();
-
-	if (db_entry.uuid.empty()) {
+	if (!_config.auto_download) {
 		return;
 	}
 
-	// Find the corresponding log entry in the list from the vehicle
-	for (const auto& entry : _log_entries) {
-		// Match by UUID (which is based on date and size)
-		std::string uuid = ServerInterface::generate_uuid(entry);
-
-		if (uuid == db_entry.uuid) {
-			if (download_log(entry)) {
-				// Update downloaded status in both databases
-				_local_server->update_download_status(uuid, true);
-				_remote_server->update_download_status(uuid, true);
-			}
+	const std::vector<std::string> upload_to =
+		_config.auto_upload ? enabled_target_names() : std::vector<std::string> {};
 
+	if (sync.first_ever) {
+		if (!_config.download_latest_on_first_start) {
+			LOG("First index: " << sync.present_count << " logs on the vehicle, none queued "
+			    "(download.latest_on_first_start is off)");
 			return;
 		}
+
+		const auto newest = _database.newest_log_id();
+
+		if (newest.has_value()) {
+			_database.request({newest.value()}, upload_to);
+			LOG("First index: " << sync.present_count << " logs on the vehicle, queueing only the "
+			    "newest. Use the ARK-OS Logs page to fetch any of the others.");
+		}
+
+		return;
 	}
 
-	// Couldn't find matching entry in _log_entries
-	// This could happen if the log is no longer available on the vehicle
-	// Mark it as processed to avoid trying again in both databases
-	_local_server->update_download_status(db_entry.uuid, true);
-	_remote_server->update_download_status(db_entry.uuid, true);
+	if (sync.inserted.empty()) {
+		return;
+	}
+
+	// More than a flight's worth appearing at once means the vehicle is showing
+	// us a card we have not seen, not that it flew ten times in 30 seconds.
+	if (_config.max_auto_queue > 0 && static_cast<int>(sync.inserted.size()) > _config.max_auto_queue) {
+		const auto newest = _database.newest_log_id(sync.inserted);
+
+		if (newest.has_value()) {
+			_database.request({newest.value()}, upload_to);
+		}
+
+		LOG_WARN(sync.inserted.size() << " new logs appeared at once, which looks like a different SD card. "
+			 "Queued only the newest; use the ARK-OS Logs page for the rest.");
+		return;
+	}
 
-	return;
+	_database.request(sync.inserted, upload_to);
+	LOG("Queued " << sync.inserted.size() << (sync.inserted.size() == 1 ? " new log" : " new logs"));
 }
 
-bool LogLoader::download_log(const mavsdk::LogFiles::Entry& entry)
+// -------------------------------------------------------------------------
+// Download
+// -------------------------------------------------------------------------
+
+void LogLoader::download_pending()
 {
-	auto prom = std::promise<mavsdk::LogFiles::Result> {};
-	auto future_result = prom.get_future();
-	auto download_path = _local_server->filepath_from_entry(entry);
+	const auto pending = _database.logs_to_download();
 
-	// Check and delete file if it already exists. This can occur due to partial download.
-	if (fs::exists(download_path)) {
-		LOG("Found existing file, removing: " << download_path);
+	if (pending.empty()) {
+		return;
+	}
 
-		try {
-			fs::remove(download_path);
+	size_t index = 0;
+	std::error_code ec;
 
-		} catch (const fs::filesystem_error& e) {
-			LOG("Error removing existing file: " << e.what());
-			return false;
+	for (const auto& entry : pending) {
+		if (_index_waiter.stopped()) {
+			return;
 		}
-	}
 
-	LOG("Downloading " << download_path);
+		if (armed()) {
+			LOG("Vehicle armed, pausing downloads");
+			return;
+		}
 
-	auto time_start = std::chrono::steady_clock::now();
+		index++;
 
-	_log_files->download_log_file_async(
-		entry,
-		download_path,
-	[&prom, &entry, &time_start, this](mavsdk::LogFiles::Result result, mavsdk::LogFiles::ProgressData progress) {
+		const FtpLogFetcher::RemoteLog* remote = _ftp->find(entry.path, entry.size_bytes);
 
-		if (_download_cancelled) return;
+		if (remote == nullptr) {
+			// sync_index marks anything the listing omits absent, and the
+			// queue only offers present logs, so this is a race with a
+			// listing rather than a missing file.
+			LOG_DEBUG(entry.path << " is no longer in the index, skipping");
+			continue;
+		}
 
-		auto now = std::chrono::steady_clock::now();
+		// A full data partition otherwise fails every transfer at the final
+		// rename, with nothing in the journal pointing at the cause.
+		const auto space = fs::space(_config.logs_directory, ec);
 
-		if (_should_exit) {
-			_download_cancelled = true;
-			prom.set_value(mavsdk::LogFiles::Result::Timeout);
-			std::cout << std::endl << "Download cancelled.. exiting" << std::endl;
+		if (!ec && space.available < static_cast<uintmax_t>(entry.size_bytes) * 2) {
+			LOG_ERROR("Only " << human_size(space.available) << " free in "
+				  << _config.logs_directory << "; delete downloaded logs from the ARK-OS Logs "
+				  "page to make room");
 			return;
 		}
 
-#ifdef DEBUG_BUILD
-		// Calculate data rate in Kbps
-		double rate_kbps = ((progress.progress * entry.size_bytes * 8.0)) / std::chrono::duration_cast<std::chrono::milliseconds>(now -
-				   time_start).count(); // Convert bytes to bits and then to Kbps
-
-		LOG_DEBUG("Downloading: "
-			  << std::setw(24) << std::left << entry.date
-			  << std::setw(8) << std::fixed << std::setprecision(2) << entry.size_bytes / 1e6 << "MB"
-			  << std::setw(6) << std::right << int(progress.progress * 100.0f) << "%"
-			  << std::setw(12) << std::fixed << std::setprecision(2) << rate_kbps << " Kbps"
-			  << std::flush);
-#else
-		(void)progress;
-#endif
-
-		if (result != mavsdk::LogFiles::Result::Next) {
-			double seconds = std::chrono::duration_cast<std::chrono::milliseconds>(now - time_start).count() / 1000.;
-			LOG("Finished in " << std::setprecision(2) << seconds << " seconds");
-			prom.set_value(result);
+		LOG("Downloading " << index << "/" << pending.size() << ": " << entry.path
+		    << " (" << human_size(entry.size_bytes) << ")");
+
+		if (download(entry, *remote)) {
+			_upload_waiter.wake();
+
+		} else {
+			_database.record_download_failure(entry.id, "download failed");
+			_status->notify();
+		}
+	}
+}
+
+bool LogLoader::download(const LogDatabase::Entry& entry, const FtpLogFetcher::RemoteLog& remote)
+{
+	const std::string local_path = local_path_for(entry);
+	const auto started = std::chrono::steady_clock::now();
+
+	_status->set_download(entry.id, 0, entry.size_bytes);
+
+	// MAVSDK reports progress per chunk, which is far more often than anyone
+	// needs to be told about it.
+	auto last_published = std::make_shared<std::chrono::steady_clock::time_point>(started);
+
+	auto progress = [status = _status, last_published, id = entry.id](uint32_t transferred, uint32_t total) {
+		const auto now = std::chrono::steady_clock::now();
+
+		if (now - *last_published < std::chrono::milliseconds(500)) {
+			return;
 		}
-	});
 
-	auto result = future_result.get();
+		*last_published = now;
+		status->set_download(id, transferred, total);
+	};
 
-	std::cout << std::endl;
+	const bool ok = _ftp->download(remote, local_path, progress);
 
-	bool success = result == mavsdk::LogFiles::Result::Success;
+	_status->set_download(0, 0, 0);
 
-	if (!success) {
-		LOG("Download failed");
+	if (!ok) {
+		return false;
 	}
 
-	return success;
+	const double seconds = std::chrono::duration<double>(std::chrono::steady_clock::now() - started).count();
+	std::ostringstream rate;
+	rate << std::fixed << std::setprecision(1) << (seconds > 0 ? entry.size_bytes / seconds / 1e3 : 0.);
+	LOG("Downloaded " << entry.path << " in " << std::fixed << std::setprecision(1) << seconds
+	    << "s (" << rate.str() << " kB/s)");
+
+	_database.mark_downloaded(entry.id, local_path);
+	// The status board is what streams are blocked on; without this the finished
+	// download would not reach the UI until the next keepalive.
+	_status->notify();
+	return true;
 }
 
-void LogLoader::upload_logs_thread()
+std::string LogLoader::local_path_for(const LogDatabase::Entry& entry)
 {
-	while (!_should_exit) {
-		if (_loop_disabled) {
-			std::this_thread::sleep_for(std::chrono::seconds(1));
-			continue;
-		}
+	std::string name = entry.path;
+	std::replace(name.begin(), name.end(), '/', '_');
+
+	const std::string path = _config.logs_directory + name;
+
+	// ArduPilot reuses log file names once its numbering wraps at
+	// LOG_MAX_FILES, so the name may already belong to a log we still hold.
+	if (_database.local_path_in_use(path, entry.id)) {
+		return _config.logs_directory + std::to_string(entry.id) + "_" + name;
+	}
+
+	return path;
+}
+
+bool LogLoader::delete_local_file(int64_t id)
+{
+	const auto entry = _database.log_by_id(id);
+
+	if (!entry.has_value()) {
+		return false;
+	}
 
-		// Query the number of pending log uploads for both servers
-		uint32_t num_logs_local = _local_server->num_logs_to_upload();
-		uint32_t num_logs_remote = _remote_server->num_logs_to_upload();
+	if (!entry->local_path.empty()) {
+		std::error_code ec;
+		fs::remove(entry->local_path, ec);
 
-		// Process uploads for local server
-		if (!_should_exit && !_settings.local_server.empty() && num_logs_local) {
-			LOG_DEBUG("Uploading " << num_logs_local << " logs to LOCAL server");
-			upload_pending_logs(_local_server);
+		if (ec) {
+			LOG_WARN("Could not remove " << entry->local_path << ": " << ec.message());
 		}
+	}
+
+	_database.clear_local_file(id);
+	return true;
+}
 
-		// Process uploads for remote server
-		if (!_should_exit && !_settings.remote_server.empty() && _settings.upload_enabled && num_logs_remote) {
-			LOG_DEBUG("Uploading " << num_logs_remote << " logs to REMOTE server");
-			upload_pending_logs(_remote_server);
+// -------------------------------------------------------------------------
+// Upload loop
+// -------------------------------------------------------------------------
+
+void LogLoader::upload_loop()
+{
+	while (!_upload_waiter.stopped()) {
+		for (auto& target : _targets) {
+			if (_upload_waiter.stopped()) {
+				break;
+			}
+
+			if (target->enabled()) {
+				upload_pending(*target);
+			}
 		}
 
-		if (!_should_exit) {
-			std::unique_lock<std::mutex> lock(_exit_cv_mutex);
-			_exit_cv.wait_for(lock, std::chrono::seconds(10), [this] { return _should_exit.load(); });
+		if (_upload_waiter.wait(std::chrono::seconds(_config.upload_interval_s))) {
+			break;
 		}
 	}
 
-	LOG_DEBUG("upload_logs_thread exiting");
+	LOG_DEBUG("Upload loop finished");
 }
 
-void LogLoader::upload_pending_logs(std::shared_ptr<ServerInterface> server)
+void LogLoader::upload_pending(UploadTarget& target)
 {
-	// Upload all pending logs for this server
-	while (!_should_exit && server->num_logs_to_upload()) {
+	const auto pending = _database.logs_to_upload(target.name());
 
-		// Get one log at a time to upload
-		ServerInterface::DatabaseEntry log_entry = server->get_next_log_to_upload();
+	if (pending.empty()) {
+		return;
+	}
+
+	LOG_DEBUG("Uploading " << pending.size() << " logs to " << target.name());
 
-		if (log_entry.uuid.empty()) {
-			LOG("Log with empty uuid!");
+	int consecutive_retries = 0;
+
+	for (const auto& entry : pending) {
+		if (_upload_waiter.stopped() || armed()) {
 			return;
 		}
 
-		std::string filepath = server->filepath_from_uuid(log_entry.uuid);
+		_status->set_upload(entry.id, target.name());
+
+		const UploadTarget::Result result = target.upload(entry.local_path);
+
+		_status->set_upload(0, "");
+		// Every branch below writes to the database; bumping the board after
+		// them is what tells an open stream to re-read the log list.
+		const auto notify = [this] { _status->notify(); };
+
+		switch (result.outcome) {
+		case UploadTarget::Outcome::Success:
+			LOG("Uploaded " << entry.path << " to " << target.name()
+			    << (result.location.empty() ? "" : ": " + target.url() + result.location));
+			_database.mark_uploaded(entry.id, target.name(), result.location);
+			notify();
+			consecutive_retries = 0;
+			break;
+
+		case UploadTarget::Outcome::Missing:
+
+			// Forgetting the file puts the log back in the download queue, which
+			// is the only way it can ever be uploaded. Marking it rejected here
+			// would strand it: never fetched again, never uploaded again.
+			if (_database.clear_local_file(entry.id, entry.local_path)) {
+				LOG_WARN(entry.local_path << " is gone; queueing it to be fetched again");
+				_database.request({entry.id}, {target.name()});
+				_index_waiter.wake();
+			}
 
-		if (filepath.empty()) {
-			LOG("Could not determine file path for UUID: " << log_entry.uuid);
+			consecutive_retries = 0;
+			break;
+
+		case UploadTarget::Outcome::Rejected:
+			// Recorded so it is not offered again; the rest of the queue is
+			// unaffected by one log the server will not take.
+			LOG_WARN(target.name() << " rejected " << entry.path << ": " << result.message);
+			_database.mark_upload_rejected(entry.id, target.name(), result.message);
+			notify();
+			consecutive_retries = 0;
+			break;
+
+		case UploadTarget::Outcome::Unauthorized:
+			LOG_WARN(target.name() << " will not accept uploads from this account ("
+				 << result.status_code << "): " << result.message);
+			LOG_WARN("Pausing " << target.name() << " uploads for this cycle; they resume "
+				 "on their own once the account is authorized");
+			_database.record_upload_failure(entry.id, target.name(), result.message);
+			notify();
 			return;
-		}
 
-		ServerInterface::UploadResult result = server->upload_log(filepath);
+		case UploadTarget::Outcome::Unreachable:
+			// Already reported once, with a cooldown, by UploadTarget.
+			return;
 
-		if (result.success) {
-			LOG("Log upload SUCCESS: " << result.message);
+		case UploadTarget::Outcome::Retry:
+			LOG_WARN("Upload of " << entry.path << " to " << target.name() << " failed ("
+				 << result.status_code << "): " << result.message << "; will retry");
+			_database.record_upload_failure(entry.id, target.name(), result.message);
+			notify();
 
-		} else if (result.status_code == 400) {
-			LOG("Log upload failed (" << result.status_code << "): " << result.message);
+			if (++consecutive_retries >= kMaxConsecutiveUploadRetries) {
+				LOG_WARN(target.name() << " failed " << consecutive_retries
+					 << " uploads in a row, leaving the rest for the next cycle");
+				return;
+			}
 
-		} else {
-			LOG("Log upload TEMPORARILY FAILED (" << result.status_code << "): "
-			    << result.message << " - Will retry later");
+			break;
 		}
 	}
 }
diff --git a/src/LogLoader.hpp b/src/LogLoader.hpp
index 0f2df34..b2e7247 100644
--- a/src/LogLoader.hpp
+++ b/src/LogLoader.hpp
@@ -1,59 +1,104 @@
 #pragma once
 
+#include <memory>
+#include <mutex>
+#include <optional>
+#include <string>
+#include <thread>
+#include <utility>
+#include <vector>
+
 #include <mavsdk/mavsdk.h>
 #include <mavsdk/plugins/telemetry/telemetry.h>
-#include <mavsdk/plugins/log_files/log_files.h>
-#include <mavsdk/log_callback.h>
-#include <condition_variable>
 
-#include "ServerInterface.hpp"
+#include "Config.hpp"
+#include "FtpLogFetcher.hpp"
+#include "LogDatabase.hpp"
+#include "StatusBoard.hpp"
+#include "UploadTarget.hpp"
+#include "Waiter.hpp"
 
+// Ties the pieces together: what the vehicle has (FtpLogFetcher), what we mean
+// to do about it (LogDatabase), and where finished logs go (UploadTarget).
+//
+// Two loops run concurrently. The index loop talks to the vehicle and owns the
+// downloads; the upload loop talks to the servers. They share nothing but the
+// database, which is its own monitor.
 class LogLoader
 {
 public:
-	struct Settings {
-		std::string email;
-		std::string local_server;
-		std::string remote_server;
-		std::string mavsdk_connection_url;
-		std::string application_directory;
-		bool upload_enabled;
-		bool public_logs;
-	};
-
-	LogLoader(const Settings& settings);
+	explicit LogLoader(const Config& config);
+	~LogLoader();
+
+	LogLoader(const LogLoader&) = delete;
+	LogLoader& operator=(const LogLoader&) = delete;
+
+	bool database_ok() const { return _database.ok(); }
 
+	// Blocks until an autopilot answers or stop() is called.
+	bool connect();
+
+	// Runs until stop(). Returns when both loops have finished.
 	void run();
 	void stop();
-	bool wait_for_mavsdk_connection(double timeout_ms);
+
+	// The API server reaches the same state the loops do.
+	LogDatabase& database() { return _database; }
+	StatusBoard& status() { return *_status; }
+
+	// Nudges both loops, so a request made through the API is acted on now
+	// rather than at the end of the current interval.
+	void wake();
+
+	// Removes a downloaded file from disk and forgets it. Returns false when
+	// the log is unknown.
+	bool delete_local_file(int64_t id);
+
+	std::vector<std::string> enabled_target_names() const;
+	// Name and base url of each enabled target. The url matters because an
+	// upload records only the relative path the server redirected to.
+	std::vector<std::pair<std::string, std::string>> enabled_targets() const;
 
 private:
-	// Download
-	bool request_log_entries();
-	void download_next_log();
-	bool download_log(const mavsdk::LogFiles::Entry& entry);
+	void index_loop();
+	void upload_loop();
+
+	// Reconciles the vehicle listing into the database. False when the vehicle
+	// could not be listed, in which case nothing is assumed about what it has.
+	std::optional<LogDatabase::SyncResult> refresh_index();
 
-	// Upload
-	void upload_logs_thread();
-	void upload_pending_logs(std::shared_ptr<ServerInterface> server);
+	// Decides what, if anything, to fetch without being asked. This is the
+	// guard against a freshly-installed companion pulling a whole SD card.
+	void apply_auto_policy(const LogDatabase::SyncResult& sync);
 
-	Settings _settings;
-	std::string _logs_directory;
+	void download_pending();
+	bool download(const LogDatabase::Entry& entry, const FtpLogFetcher::RemoteLog& remote);
+	std::string local_path_for(const LogDatabase::Entry& entry);
 
-	// Server objects (each with its own database)
-	std::shared_ptr<ServerInterface> _local_server;
-	std::shared_ptr<ServerInterface> _remote_server;
+	void upload_pending(UploadTarget& target);
+
+	bool armed();
+
+	Config _config;
+	LogDatabase _database;
+	// Shared, not owned by value: the download progress callback belongs to
+	// MAVSDK and can fire after this object has begun tearing down.
+	std::shared_ptr<StatusBoard> _status {std::make_shared<StatusBoard>()};
+	std::vector<std::unique_ptr<UploadTarget>> _targets;
 
 	std::shared_ptr<mavsdk::Mavsdk> _mavsdk;
 	std::shared_ptr<mavsdk::Telemetry> _telemetry;
-	std::shared_ptr<mavsdk::LogFiles> _log_files;
-	std::vector<mavsdk::LogFiles::Entry> _log_entries;
-
-	std::atomic<bool> _should_exit = false;
-	std::atomic<bool> _download_cancelled = false;
+	// Assigned by connect() on the main thread and read by stop() on the signal
+	// thread, so it is not just a plain member.
+	std::mutex _ftp_mutex;
+	std::shared_ptr<FtpLogFetcher> _ftp;
 
-	std::condition_variable _exit_cv;
-	std::mutex _exit_cv_mutex;
+	Waiter _index_waiter;
+	Waiter _upload_waiter;
+	std::thread _upload_thread;
 
-	bool _loop_disabled = false;
+	bool _was_armed {false};
+	// Index more often for a few passes after landing, so the log the flight
+	// just produced is confirmed stable and fetched promptly.
+	int _fast_index_passes {0};
 };
diff --git a/src/ServerInterface.cpp b/src/ServerInterface.cpp
deleted file mode 100644
index 554893b..0000000
--- a/src/ServerInterface.cpp
+++ /dev/null
@@ -1,600 +0,0 @@
-#include "ServerInterface.hpp"
-#include "Log.hpp"
-
-#include <iostream>
-#include <filesystem>
-#include <fstream>
-#include <chrono>
-#include <ctime>
-#include <iomanip>
-#include <sstream>
-#include <functional>
-#define CPPHTTPLIB_OPENSSL_SUPPORT
-#include <httplib.h>
-
-namespace fs = std::filesystem;
-
-ServerInterface::ServerInterface(const ServerInterface::Settings& settings)
-	: _settings(settings)
-{
-	// Sanitize the URL to strip off the prefix
-	sanitize_url_and_determine_protocol();
-
-	// Initialize the database
-	if (!init_database()) {
-		std::cerr << "Failed to initialize database for server: " << _settings.server_url << std::endl;
-	}
-}
-
-ServerInterface::~ServerInterface()
-{
-	close_database();
-}
-
-void ServerInterface::sanitize_url_and_determine_protocol()
-{
-	std::string url = _settings.server_url;
-	std::string sanitized_url;
-	Protocol protocol;
-
-	std::string http_prefix = "http://";
-	std::string https_prefix = "https://";
-
-	size_t pos = std::string::npos;
-
-	if ((pos = url.find(https_prefix)) != std::string::npos) {
-		sanitized_url = url.substr(pos + https_prefix.length());
-		protocol = Protocol::Https;
-
-	} else if ((pos = url.find(http_prefix)) != std::string::npos) {
-		sanitized_url = url.substr(pos + http_prefix.length());
-		protocol = Protocol::Http;
-
-	} else {
-		sanitized_url = url;
-		protocol = Protocol::Https;
-	}
-
-	_settings.server_url = sanitized_url;
-	_protocol = protocol;
-}
-
-void ServerInterface::start()
-{
-	_should_exit = false;
-}
-
-void ServerInterface::stop()
-{
-	_should_exit = true;
-}
-
-std::string ServerInterface::generate_uuid(const mavsdk::LogFiles::Entry& entry)
-{
-	// Create a unique identifier based on date and size
-	std::stringstream ss;
-	ss << entry.date << "_" << entry.size_bytes;
-
-	// Use a simple hash for the UUID
-	std::hash<std::string> hasher;
-	size_t hash = hasher(ss.str());
-
-	ss.str("");
-	ss << std::hex << std::setw(16) << std::setfill('0') << hash;
-	return ss.str();
-}
-
-bool ServerInterface::add_log_entry(const mavsdk::LogFiles::Entry& entry)
-{
-	std::string uuid = generate_uuid(entry);
-
-	// Check if the log already exists
-	sqlite3_stmt* stmt;
-	std::string check_query = "SELECT COUNT(*) FROM logs WHERE uuid = ?";
-
-	if (sqlite3_prepare_v2(_db, check_query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
-		std::cerr << "SQL error preparing add_log_entry check: " << sqlite3_errmsg(_db) << std::endl;
-		return false;
-	}
-
-	sqlite3_bind_text(stmt, 1, uuid.c_str(), -1, SQLITE_STATIC);
-
-	bool exists = false;
-
-	if (sqlite3_step(stmt) == SQLITE_ROW) {
-		exists = sqlite3_column_int(stmt, 0) > 0;
-	}
-
-	sqlite3_finalize(stmt);
-
-	if (exists) {
-		return true; // Already exists, no need to add
-	}
-
-	// Insert the log
-	std::string insert_query =
-		"INSERT INTO logs (uuid, id, date, size_bytes, downloaded, uploaded) "
-		"VALUES (?, ?, ?, ?, 0, 0)";
-
-	if (sqlite3_prepare_v2(_db, insert_query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
-		std::cerr << "SQL error preparing add_log_entry insert: " << sqlite3_errmsg(_db) << std::endl;
-		return false;
-	}
-
-	sqlite3_bind_text(stmt, 1, uuid.c_str(), -1, SQLITE_STATIC);
-	sqlite3_bind_int(stmt, 2, entry.id);
-	sqlite3_bind_text(stmt, 3, entry.date.c_str(), -1, SQLITE_STATIC);
-	sqlite3_bind_int(stmt, 4, entry.size_bytes);
-
-	bool success = sqlite3_step(stmt) == SQLITE_DONE;
-	sqlite3_finalize(stmt);
-
-	return success;
-}
-
-bool ServerInterface::update_download_status(const std::string& uuid, bool downloaded)
-{
-	std::string query = "UPDATE logs SET downloaded = ? WHERE uuid = ?";
-	sqlite3_stmt* stmt;
-
-	if (sqlite3_prepare_v2(_db, query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
-		std::cerr << "SQL error preparing update_download_status: " << sqlite3_errmsg(_db) << std::endl;
-		return false;
-	}
-
-	sqlite3_bind_int(stmt, 1, downloaded ? 1 : 0);
-	sqlite3_bind_text(stmt, 2, uuid.c_str(), -1, SQLITE_STATIC);
-
-	bool success = sqlite3_step(stmt) == SQLITE_DONE;
-	sqlite3_finalize(stmt);
-
-	return success;
-}
-
-uint32_t ServerInterface::num_logs_to_upload()
-{
-	if (!_settings.upload_enabled || _should_exit) {
-		return false;
-	}
-
-	sqlite3_stmt* stmt;
-	std::string query =
-		"SELECT COUNT(*) FROM logs "
-		"WHERE downloaded = 1 AND uploaded = 0 "
-		"AND uuid NOT IN (SELECT uuid FROM blacklist)";
-
-	if (sqlite3_prepare_v2(_db, query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
-		std::cerr << "SQL error preparing has_logs_to_upload: " << sqlite3_errmsg(_db) << std::endl;
-		return false;
-	}
-
-	uint32_t log_count = 0;
-
-	if (sqlite3_step(stmt) == SQLITE_ROW) {
-		log_count = sqlite3_column_int(stmt, 0);
-	}
-
-	sqlite3_finalize(stmt);
-	return log_count;
-}
-
-ServerInterface::DatabaseEntry ServerInterface::get_next_log_to_upload()
-{
-	DatabaseEntry empty_entry;
-	empty_entry.uuid = ""; // Empty UUID indicates not found
-
-	if (!_settings.upload_enabled || _should_exit) {
-		return empty_entry;
-	}
-
-	sqlite3_stmt* stmt;
-	std::string query =
-		"SELECT uuid, id, date, size_bytes, downloaded, uploaded FROM logs "
-		"WHERE downloaded = 1 AND uploaded = 0 "
-		"AND uuid NOT IN (SELECT uuid FROM blacklist) "
-		"ORDER BY date DESC, size_bytes DESC LIMIT 1";
-
-	if (sqlite3_prepare_v2(_db, query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
-		std::cerr << "SQL error preparing get_next_log_to_upload: " << sqlite3_errmsg(_db) << std::endl;
-		return empty_entry;
-	}
-
-	DatabaseEntry entry = empty_entry;
-
-	if (sqlite3_step(stmt) == SQLITE_ROW) {
-		entry = row_to_db_entry(stmt);
-	}
-
-	sqlite3_finalize(stmt);
-	return entry;
-}
-
-ServerInterface::UploadResult ServerInterface::upload_log(const std::string& filepath)
-{
-	if (!_settings.upload_enabled || _should_exit) {
-		return {false, 0, "Upload disabled or shutting down"};
-	}
-
-	// Extract UUID from filename
-	std::string filename = fs::path(filepath).filename().string();
-	std::string uuid;
-
-	// Parse the ID and date from filename (assuming format like LOG0001_2023-04-15T12:34:56Z.ulg)
-	size_t underscore_pos = filename.find('_');
-	size_t dot_pos = filename.find_last_of('.');
-
-	if (underscore_pos != std::string::npos && dot_pos != std::string::npos) {
-		std::string id_part = filename.substr(3, underscore_pos - 3); // Skip "LOG" prefix
-		std::string date_part = filename.substr(underscore_pos + 1, dot_pos - underscore_pos - 1);
-
-		uint32_t id = std::stoi(id_part);
-		uint32_t size = fs::exists(filepath) ? fs::file_size(filepath) : 0;
-
-		// Create a log entry and generate UUID
-		mavsdk::LogFiles::Entry entry;
-		entry.id = id;
-		entry.date = date_part;
-		entry.size_bytes = size;
-
-		uuid = generate_uuid(entry);
-
-		// Add to database if not already there
-		sqlite3_stmt* stmt;
-		std::string check_query = "SELECT COUNT(*) FROM logs WHERE uuid = ?";
-
-		if (sqlite3_prepare_v2(_db, check_query.c_str(), -1, &stmt, nullptr) == SQLITE_OK) {
-			sqlite3_bind_text(stmt, 1, uuid.c_str(), -1, SQLITE_STATIC);
-
-			if (sqlite3_step(stmt) == SQLITE_ROW && sqlite3_column_int(stmt, 0) == 0) {
-				// Log doesn't exist, add it
-				add_log_entry(entry);
-				update_download_status(uuid, true); // Mark as downloaded since we have the file
-			}
-
-			sqlite3_finalize(stmt);
-		}
-	}
-
-	if (uuid.empty()) {
-		return {false, 0, "Could not determine UUID from filename"};
-	}
-
-	// Check if already blacklisted
-	if (is_blacklisted(uuid)) {
-		return {false, 400, "Log is blacklisted"};
-	}
-
-	// Perform the upload
-	UploadResult result = upload(filepath);
-
-	// Update database with result
-	if (result.success) {
-		std::string query = "UPDATE logs SET uploaded = 1 WHERE uuid = ?";
-		sqlite3_stmt* stmt;
-
-		if (sqlite3_prepare_v2(_db, query.c_str(), -1, &stmt, nullptr) == SQLITE_OK) {
-			sqlite3_bind_text(stmt, 1, uuid.c_str(), -1, SQLITE_STATIC);
-			sqlite3_step(stmt);
-			sqlite3_finalize(stmt);
-		}
-
-	} else if (result.status_code == 400) {
-		// Permanent failure - add to blacklist
-		add_to_blacklist(uuid, "HTTP 400: Bad Request");
-	}
-
-	return result;
-}
-
-bool ServerInterface::is_blacklisted(const std::string& uuid)
-{
-	std::string query = "SELECT COUNT(*) FROM blacklist WHERE uuid = ?";
-	sqlite3_stmt* stmt;
-
-	if (sqlite3_prepare_v2(_db, query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
-		std::cerr << "SQL error preparing is_blacklisted: " << sqlite3_errmsg(_db) << std::endl;
-		return false;
-	}
-
-	sqlite3_bind_text(stmt, 1, uuid.c_str(), -1, SQLITE_STATIC);
-
-	bool blacklisted = false;
-
-	if (sqlite3_step(stmt) == SQLITE_ROW) {
-		blacklisted = sqlite3_column_int(stmt, 0) > 0;
-	}
-
-	sqlite3_finalize(stmt);
-	return blacklisted;
-}
-
-uint32_t ServerInterface::num_logs_to_download()
-{
-	sqlite3_stmt* stmt;
-	std::string query =
-		"SELECT COUNT(*) FROM logs "
-		"WHERE downloaded = 0";
-
-	if (sqlite3_prepare_v2(_db, query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
-		std::cerr << "SQL error preparing num_logs_to_download: " << sqlite3_errmsg(_db) << std::endl;
-		return 0;
-	}
-
-	uint32_t log_count = 0;
-
-	if (sqlite3_step(stmt) == SQLITE_ROW) {
-		log_count = sqlite3_column_int(stmt, 0);
-	}
-
-	sqlite3_finalize(stmt);
-	return log_count;
-}
-
-ServerInterface::DatabaseEntry ServerInterface::get_next_log_to_download()
-{
-	DatabaseEntry empty_entry;
-	empty_entry.uuid = ""; // Empty UUID indicates not found
-
-	sqlite3_stmt* stmt;
-	std::string query =
-		"SELECT uuid, id, date, size_bytes, downloaded, uploaded "
-		"FROM logs WHERE downloaded = 0 "
-		"ORDER BY date DESC, size_bytes DESC LIMIT 1";
-
-	if (sqlite3_prepare_v2(_db, query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
-		std::cerr << "SQL error preparing get_next_log_to_download: " << sqlite3_errmsg(_db) << std::endl;
-		return empty_entry;
-	}
-
-	DatabaseEntry entry = empty_entry;
-
-	if (sqlite3_step(stmt) == SQLITE_ROW) {
-		entry = row_to_db_entry(stmt);
-	}
-
-	sqlite3_finalize(stmt);
-	return entry;
-}
-
-std::string ServerInterface::filepath_from_entry(const mavsdk::LogFiles::Entry& entry) const
-{
-	std::ostringstream ss;
-	ss << _settings.logs_directory << "LOG" << std::setfill('0') << std::setw(4) << entry.id << "_" << entry.date << ".ulg";
-	return ss.str();
-}
-
-std::string ServerInterface::filepath_from_uuid(const std::string& uuid) const
-{
-	// Look up the log entry by UUID
-	sqlite3_stmt* stmt;
-	std::string query =
-		"SELECT id, date FROM logs WHERE uuid = ?";
-
-	if (sqlite3_prepare_v2(_db, query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
-		std::cerr << "SQL error preparing filepath_from_uuid: " << sqlite3_errmsg(_db) << std::endl;
-		return "";
-	}
-
-	sqlite3_bind_text(stmt, 1, uuid.c_str(), -1, SQLITE_STATIC);
-
-	std::string filepath;
-
-	if (sqlite3_step(stmt) == SQLITE_ROW) {
-		int id = sqlite3_column_int(stmt, 0);
-		const unsigned char* date_text = sqlite3_column_text(stmt, 1);
-
-		if (date_text != nullptr) {
-			std::string date = reinterpret_cast<const char*>(date_text);
-			std::ostringstream ss;
-			ss << _settings.logs_directory << "LOG" << std::setfill('0') << std::setw(4) << id << "_" << date << ".ulg";
-			filepath = ss.str();
-		}
-	}
-
-	sqlite3_finalize(stmt);
-	return filepath;
-}
-
-ServerInterface::UploadResult ServerInterface::upload(const std::string& filepath)
-{
-	// Skip files that are in progress (have a .lock file)
-	if (fs::exists(filepath + ".lock")) {
-		return {false, 0, "File is locked (currently being downloaded)"};
-	}
-
-	// Skip files that don't exist
-	if (!fs::exists(filepath)) {
-		return {false, 404, "Log file does not exist: " + filepath};
-	}
-
-	// Skip files with size zero
-	if (fs::file_size(filepath) == 0) {
-		return {false, 0, "Skipping zero-size log file: " + filepath};
-	}
-
-	if (!server_reachable()) {
-		return {false, 0, "Server unreachable: " + _settings.server_url};
-	}
-
-	std::ifstream file(filepath, std::ios::binary);
-
-	if (!file) {
-		return {false, 0, "Could not open file: " + filepath};
-	}
-
-	// Build multi-part form data
-	httplib::MultipartFormDataItems items = {
-		{"type", _settings.public_logs ? "flightreport" : "personal", "", ""}, // NOTE: backend logic is funky
-		{"description", "Uploaded by logloader", "", ""},
-		{"feedback", "", "", ""},
-		{"email", _settings.user_email, "", ""},
-		{"source", "auto", "", ""},
-		{"videoUrl", "", "", ""},
-		{"rating", "", "", ""},
-		{"windSpeed", "", "", ""},
-		{"public", _settings.public_logs ? "true" : "false", "", ""},
-	};
-
-	std::string content((std::istreambuf_iterator<char>(file)), std::istreambuf_iterator<char>());
-	items.push_back({"filearg", content, filepath, "application/octet-stream"});
-
-	LOG("Uploading " << fs::path(filepath).filename().string() << " to " << _settings.server_url);
-
-	// Post multi-part form
-	httplib::Result res;
-
-	if (_protocol == Protocol::Https) {
-		httplib::SSLClient cli(_settings.server_url);
-		res = cli.Post("/upload", items);
-
-	} else {
-		httplib::Client cli(_settings.server_url);
-		res = cli.Post("/upload", items);
-	}
-
-	if (res && res->status == 302) {
-		return {true, 302, "Success: " + _settings.server_url + res->get_header_value("Location")};
-
-	} else if (res && res->status == 400) {
-		return {false, 400, "Bad Request - Will not retry"};
-
-	} else {
-		return {false, res ? res->status : 0, "Will retry later"};
-	}
-}
-
-bool ServerInterface::server_reachable()
-{
-	httplib::Result res;
-
-	if (_protocol == Protocol::Https) {
-		httplib::SSLClient cli(_settings.server_url);
-		res = cli.Get("/");
-
-	} else {
-		httplib::Client cli(_settings.server_url);
-		res = cli.Get("/");
-	}
-
-	bool success = res && res->status == 200;
-
-	if (!success) {
-		LOG("Connection to " << _settings.server_url << " failed: " << (res ? std::to_string(res->status) : "No response"));
-	}
-
-	return success;
-}
-
-bool ServerInterface::init_database()
-{
-	int rc = sqlite3_open(_settings.db_path.c_str(), &_db);
-
-	if (rc != SQLITE_OK) {
-		std::cerr << "Cannot open database: " << sqlite3_errmsg(_db) << std::endl;
-		sqlite3_close(_db);
-		_db = nullptr;
-		return false;
-	}
-
-	// Create logs table
-	const char* create_logs_table =
-		"CREATE TABLE IF NOT EXISTS logs ("
-		"  uuid TEXT PRIMARY KEY,"  // UUID of the log
-		"  id INTEGER,"             // Original log ID
-		"  date TEXT,"              // ISO8601 date from log
-		"  size_bytes INTEGER,"     // Size in bytes
-		"  downloaded INTEGER DEFAULT 0," // Has it been downloaded
-		"  uploaded INTEGER DEFAULT 0"   // Has it been uploaded
-		");";
-
-	// Create blacklist table
-	const char* create_blacklist_table =
-		"CREATE TABLE IF NOT EXISTS blacklist ("
-		"  uuid TEXT PRIMARY KEY,"  // UUID of the log
-		"  reason TEXT,"            // Reason for blacklisting
-		"  timestamp TEXT"          // When the log was blacklisted
-		");";
-
-	bool success = execute_query(create_logs_table) && execute_query(create_blacklist_table);
-	return success;
-}
-
-void ServerInterface::close_database()
-{
-	if (_db) {
-		sqlite3_close(_db);
-		_db = nullptr;
-	}
-}
-
-bool ServerInterface::add_to_blacklist(const std::string& uuid, const std::string& reason)
-{
-	// Get current timestamp
-	auto now = std::chrono::system_clock::now();
-	auto now_c = std::chrono::system_clock::to_time_t(now);
-	std::stringstream ss;
-	ss << std::put_time(std::localtime(&now_c), "%Y-%m-%d %H:%M:%S");
-	std::string timestamp = ss.str();
-
-	// Add to blacklist
-	std::string query = "INSERT OR REPLACE INTO blacklist (uuid, reason, timestamp) VALUES (?, ?, ?)";
-	sqlite3_stmt* stmt;
-
-	if (sqlite3_prepare_v2(_db, query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
-		std::cerr << "SQL error preparing add_to_blacklist: " << sqlite3_errmsg(_db) << std::endl;
-		return false;
-	}
-
-	sqlite3_bind_text(stmt, 1, uuid.c_str(), -1, SQLITE_STATIC);
-	sqlite3_bind_text(stmt, 2, reason.c_str(), -1, SQLITE_STATIC);
-	sqlite3_bind_text(stmt, 3, timestamp.c_str(), -1, SQLITE_STATIC);
-
-	bool success = sqlite3_step(stmt) == SQLITE_DONE;
-	sqlite3_finalize(stmt);
-
-	return success;
-}
-
-bool ServerInterface::execute_query(const std::string& query)
-{
-	char* error_msg = nullptr;
-	int rc = sqlite3_exec(_db, query.c_str(), nullptr, nullptr, &error_msg);
-
-	if (rc != SQLITE_OK) {
-		std::cerr << "SQL error: " << error_msg << std::endl;
-		sqlite3_free(error_msg);
-		return false;
-	}
-
-	return true;
-}
-
-ServerInterface::DatabaseEntry ServerInterface::row_to_db_entry(sqlite3_stmt* stmt)
-{
-	DatabaseEntry entry;
-
-	const unsigned char* uuid_text = sqlite3_column_text(stmt, 0);
-
-	if (uuid_text != nullptr) {
-		entry.uuid = reinterpret_cast<const char*>(uuid_text);
-
-	} else {
-		entry.uuid = "";
-	}
-
-	entry.id = sqlite3_column_int(stmt, 1);
-
-	const unsigned char* date_text = sqlite3_column_text(stmt, 2);
-
-	if (date_text != nullptr) {
-		entry.date = reinterpret_cast<const char*>(date_text);
-
-	} else {
-		entry.date = "";
-	}
-
-	entry.size_bytes = sqlite3_column_int(stmt, 3);
-	entry.downloaded = sqlite3_column_int(stmt, 4) != 0;
-
-	return entry;
-}
diff --git a/src/ServerInterface.hpp b/src/ServerInterface.hpp
deleted file mode 100644
index ea47559..0000000
--- a/src/ServerInterface.hpp
+++ /dev/null
@@ -1,81 +0,0 @@
-#pragma once
-
-#include <string>
-#include <vector>
-#include <sqlite3.h>
-#include <mavsdk/plugins/log_files/log_files.h>
-
-class ServerInterface
-{
-public:
-	struct Settings {
-		std::string server_url;
-		std::string user_email;
-		std::string logs_directory;
-		std::string db_path;         // Path to this server's database
-		bool upload_enabled {};
-		bool public_logs {};
-	};
-
-	struct UploadResult {
-		bool success;
-		int status_code;    // HTTP status code, or 0 if not applicable
-		std::string message;
-	};
-
-	struct DatabaseEntry {
-		std::string uuid;
-		uint32_t id;
-		std::string date;
-		uint32_t size_bytes;
-		bool downloaded;
-	};
-
-	ServerInterface(const Settings& settings);
-	~ServerInterface();
-
-	// Database initialization
-	bool init_database();
-	void close_database();
-
-	// Log entry management
-	static std::string generate_uuid(const mavsdk::LogFiles::Entry& entry);
-	bool add_log_entry(const mavsdk::LogFiles::Entry& entry);
-	bool update_download_status(const std::string& uuid, bool downloaded);
-	uint32_t num_logs_to_download();
-
-	// Upload management
-	uint32_t num_logs_to_upload();
-	DatabaseEntry get_next_log_to_upload();
-	UploadResult upload_log(const std::string& filepath);
-
-	// Query methods
-	bool is_blacklisted(const std::string& uuid);
-	DatabaseEntry get_next_log_to_download();
-
-	std::string filepath_from_entry(const mavsdk::LogFiles::Entry& entry) const ;
-	std::string filepath_from_uuid(const std::string& uuid) const;
-
-	void start();
-	void stop();
-
-private:
-	enum class Protocol {
-		Http,
-		Https
-	};
-
-	void sanitize_url_and_determine_protocol();
-	UploadResult upload(const std::string& filepath);
-	bool server_reachable();
-
-	// Database operations
-	bool execute_query(const std::string& query);
-	bool add_to_blacklist(const std::string& uuid, const std::string& reason);
-	DatabaseEntry row_to_db_entry(sqlite3_stmt* stmt);
-
-	Settings _settings;
-	Protocol _protocol {Protocol::Https};
-	bool _should_exit = false;
-	sqlite3* _db = nullptr;
-};
diff --git a/src/Sqlite.cpp b/src/Sqlite.cpp
new file mode 100644
index 0000000..f0238df
--- /dev/null
+++ b/src/Sqlite.cpp
@@ -0,0 +1,182 @@
+#include "Sqlite.hpp"
+#include "Log.hpp"
+
+namespace sqlite
+{
+
+Statement::Statement(sqlite3* db, const std::string& sql)
+	: _db(db)
+	, _sql(sql)
+{
+	if (_db == nullptr) {
+		return;
+	}
+
+	if (sqlite3_prepare_v2(_db, sql.c_str(), -1, &_stmt, nullptr) != SQLITE_OK) {
+		LOG_ERROR("SQL prepare failed: " << sqlite3_errmsg(_db) << " -- " << sql);
+		_stmt = nullptr;
+	}
+}
+
+Statement::~Statement()
+{
+	if (_stmt != nullptr) {
+		sqlite3_finalize(_stmt);
+	}
+}
+
+Statement& Statement::bind(int index, int64_t value)
+{
+	if (_stmt != nullptr) {
+		sqlite3_bind_int64(_stmt, index, value);
+	}
+
+	return *this;
+}
+
+Statement& Statement::bind(int index, const std::string& value)
+{
+	if (_stmt != nullptr) {
+		sqlite3_bind_text(_stmt, index, value.c_str(), static_cast<int>(value.size()), SQLITE_TRANSIENT);
+	}
+
+	return *this;
+}
+
+Statement& Statement::bind(int index, bool value)
+{
+	return bind(index, static_cast<int64_t>(value ? 1 : 0));
+}
+
+Statement& Statement::bind(int index, std::optional<int64_t> value)
+{
+	if (_stmt == nullptr) {
+		return *this;
+	}
+
+	if (value.has_value()) {
+		sqlite3_bind_int64(_stmt, index, value.value());
+
+	} else {
+		sqlite3_bind_null(_stmt, index);
+	}
+
+	return *this;
+}
+
+bool Statement::step()
+{
+	if (_stmt == nullptr) {
+		return false;
+	}
+
+	const int rc = sqlite3_step(_stmt);
+
+	if (rc == SQLITE_ROW) {
+		return true;
+	}
+
+	if (rc != SQLITE_DONE) {
+		LOG_ERROR("SQL step failed: " << sqlite3_errmsg(_db) << " -- " << _sql);
+	}
+
+	return false;
+}
+
+bool Statement::execute()
+{
+	if (_stmt == nullptr) {
+		return false;
+	}
+
+	const int rc = sqlite3_step(_stmt);
+
+	if (rc != SQLITE_DONE && rc != SQLITE_ROW) {
+		LOG_ERROR("SQL step failed: " << sqlite3_errmsg(_db) << " -- " << _sql);
+		return false;
+	}
+
+	return true;
+}
+
+int64_t Statement::column_int(int index) const
+{
+	return _stmt != nullptr ? sqlite3_column_int64(_stmt, index) : 0;
+}
+
+std::string Statement::column_text(int index) const
+{
+	if (_stmt == nullptr) {
+		return {};
+	}
+
+	const unsigned char* text = sqlite3_column_text(_stmt, index);
+	return text != nullptr ? reinterpret_cast<const char*>(text) : std::string {};
+}
+
+std::optional<int64_t> Statement::column_optional_int(int index) const
+{
+	if (_stmt == nullptr || sqlite3_column_type(_stmt, index) == SQLITE_NULL) {
+		return std::nullopt;
+	}
+
+	return sqlite3_column_int64(_stmt, index);
+}
+
+bool execute(sqlite3* db, const std::string& sql)
+{
+	char* error = nullptr;
+
+	if (sqlite3_exec(db, sql.c_str(), nullptr, nullptr, &error) != SQLITE_OK) {
+		LOG_ERROR("SQL failed: " << (error != nullptr ? error : "unknown") << " -- " << sql);
+		sqlite3_free(error);
+		return false;
+	}
+
+	return true;
+}
+
+bool table_exists(sqlite3* db, const std::string& table)
+{
+	Statement stmt(db, "SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = ?");
+	stmt.bind(1, table);
+	return stmt.step() && stmt.column_int(0) > 0;
+}
+
+bool column_exists(sqlite3* db, const std::string& table, const std::string& column)
+{
+	Statement stmt(db, "SELECT COUNT(*) FROM pragma_table_info(?) WHERE name = ?");
+	stmt.bind(1, table).bind(2, column);
+	return stmt.step() && stmt.column_int(0) > 0;
+}
+
+Transaction::Transaction(sqlite3* db)
+	: _db(db)
+{
+	_open = execute(_db, "BEGIN");
+}
+
+Transaction::~Transaction()
+{
+	if (_open) {
+		execute(_db, "ROLLBACK");
+	}
+}
+
+bool Transaction::commit()
+{
+	if (!_open) {
+		return false;
+	}
+
+	const bool committed = execute(_db, "COMMIT");
+
+	// A COMMIT that fails (a full disk, most plausibly) leaves the transaction
+	// open on the connection. Clearing _open unconditionally would skip the
+	// rollback and wedge every later transaction behind this one.
+	_open = !committed && sqlite3_get_autocommit(_db) == 0;
+
+	return committed;
+}
+
+} // namespace sqlite
diff --git a/src/Sqlite.hpp b/src/Sqlite.hpp
new file mode 100644
index 0000000..29c0768
--- /dev/null
+++ b/src/Sqlite.hpp
@@ -0,0 +1,77 @@
+#pragma once
+
+#include <cstdint>
+#include <optional>
+#include <string>
+
+#include <sqlite3.h>
+
+// Thin RAII layer over the sqlite3 C API. The point is that a prepared
+// statement finalizes itself, so a query cannot leak one by returning early.
+namespace sqlite
+{
+
+// Bind indices are 1-based and column indices 0-based, matching sqlite3.
+// Text and blob binds copy (SQLITE_TRANSIENT), so binding a temporary is safe.
+class Statement
+{
+public:
+	Statement(sqlite3* db, const std::string& sql);
+	~Statement();
+
+	Statement(const Statement&) = delete;
+	Statement& operator=(const Statement&) = delete;
+
+	// False when the statement failed to prepare; the error is already logged.
+	explicit operator bool() const { return _stmt != nullptr; }
+
+	Statement& bind(int index, int64_t value);
+	Statement& bind(int index, const std::string& value);
+	Statement& bind(int index, bool value);
+	Statement& bind(int index, std::optional<int64_t> value);
+
+	// True while rows remain.
+	bool step();
+
+	// Runs a statement that returns no rows. True when it completed.
+	bool execute();
+
+	int64_t column_int(int index) const;
+	std::string column_text(int index) const;
+	std::optional<int64_t> column_optional_int(int index) const;
+
+private:
+	sqlite3* _db {nullptr};
+	sqlite3_stmt* _stmt {nullptr};
+	std::string _sql;
+};
+
+// Runs statements that take no parameters (schema DDL, PRAGMA, transactions).
+bool execute(sqlite3* db, const std::string& sql);
+
+bool table_exists(sqlite3* db, const std::string& table);
+bool column_exists(sqlite3* db, const std::string& table, const std::string& column);
+
+// Rolls back unless commit() is called, so an early return cannot leave a
+// half-applied multi-statement change behind.
+class Transaction
+{
+public:
+	explicit Transaction(sqlite3* db);
+	~Transaction();
+
+	Transaction(const Transaction&) = delete;
+	Transaction& operator=(const Transaction&) = delete;
+
+	// False when BEGIN failed, in which case statements run in autocommit and
+	// are durable whatever the caller does next.
+	explicit operator bool() const { return _open; }
+
+	bool commit();
+
+private:
+	sqlite3* _db {nullptr};
+	bool _open {false};
+};
+
+} // namespace sqlite
diff --git a/src/StatusBoard.cpp b/src/StatusBoard.cpp
new file mode 100644
index 0000000..bd477a9
--- /dev/null
+++ b/src/StatusBoard.cpp
@@ -0,0 +1,85 @@
+#include "StatusBoard.hpp"
+
+StatusBoard::Snapshot StatusBoard::get() const
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	return _snapshot;
+}
+
+// Callers hold _mutex.
+void StatusBoard::bump()
+{
+	_snapshot.revision++;
+	_cv.notify_all();
+}
+
+void StatusBoard::set_connected(bool connected)
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	_snapshot.connected = connected;
+	bump();
+}
+
+void StatusBoard::set_armed(bool armed)
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	_snapshot.armed = armed;
+	bump();
+}
+
+void StatusBoard::set_ftp(bool available, const std::string& log_root)
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	_snapshot.ftp_available = available;
+	_snapshot.log_root = log_root;
+	bump();
+}
+
+void StatusBoard::set_download(int64_t id, uint32_t transferred, uint32_t total)
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	_snapshot.downloading_id = id;
+	_snapshot.downloaded_bytes = transferred;
+	_snapshot.download_total_bytes = total;
+	bump();
+}
+
+void StatusBoard::set_upload(int64_t id, const std::string& target)
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	_snapshot.uploading_id = id;
+	_snapshot.uploading_target = target;
+	bump();
+}
+
+void StatusBoard::notify()
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	bump();
+}
+
+StatusBoard::Snapshot StatusBoard::wait_for_change(uint64_t known_revision,
+		std::chrono::milliseconds timeout) const
+{
+	std::unique_lock<std::mutex> lock(_mutex);
+	_cv.wait_for(lock, timeout, [this, known_revision] {
+		return _stopped || _snapshot.revision != known_revision;
+	});
+	return _snapshot;
+}
+
+void StatusBoard::shutdown()
+{
+	{
+		std::lock_guard<std::mutex> lock(_mutex);
+		_stopped = true;
+	}
+
+	_cv.notify_all();
+}
+
+bool StatusBoard::stopped() const
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	return _stopped;
+}
diff --git a/src/StatusBoard.hpp b/src/StatusBoard.hpp
new file mode 100644
index 0000000..0cf0c7f
--- /dev/null
+++ b/src/StatusBoard.hpp
@@ -0,0 +1,64 @@
+#pragma once
+
+#include <chrono>
+#include <condition_variable>
+#include <cstdint>
+#include <mutex>
+#include <string>
+
+// What logloader is doing right now, shared between the worker loops that write
+// it and the API server that streams it out.
+//
+// Progress during a transfer is the one thing the database does not hold: it
+// changes several times a second and is worthless after a restart.
+//
+// Every change bumps a revision, so a reader can block until something actually
+// happened instead of polling.
+class StatusBoard
+{
+public:
+	struct Snapshot {
+		bool connected {false};
+		bool armed {false};
+		bool ftp_available {false};
+		std::string log_root;
+
+		// 0 when nothing is being transferred.
+		int64_t downloading_id {0};
+		uint32_t downloaded_bytes {0};
+		uint32_t download_total_bytes {0};
+
+		int64_t uploading_id {0};
+		std::string uploading_target;
+
+		uint64_t revision {0};
+	};
+
+	Snapshot get() const;
+
+	void set_connected(bool connected);
+	void set_armed(bool armed);
+	void set_ftp(bool available, const std::string& log_root);
+	void set_download(int64_t id, uint32_t transferred, uint32_t total);
+	void set_upload(int64_t id, const std::string& target);
+
+	// Wakes readers without changing anything, for a caller that has just
+	// written to the database and wants the change streamed out now.
+	void notify();
+
+	// Blocks until the revision moves past known_revision or the timeout
+	// expires, then returns the current snapshot either way.
+	Snapshot wait_for_change(uint64_t known_revision, std::chrono::milliseconds timeout) const;
+
+	// Releases every waiter so the API server's streams can close on shutdown.
+	void shutdown();
+	bool stopped() const;
+
+private:
+	void bump();
+
+	mutable std::mutex _mutex;
+	mutable std::condition_variable _cv;
+	Snapshot _snapshot;
+	bool _stopped {false};
+};
diff --git a/src/UploadTarget.cpp b/src/UploadTarget.cpp
new file mode 100644
index 0000000..5e0525d
--- /dev/null
+++ b/src/UploadTarget.cpp
@@ -0,0 +1,227 @@
+#include "UploadTarget.hpp"
+#include "Log.hpp"
+
+#include <algorithm>
+#include <filesystem>
+#include <fstream>
+#include <memory>
+#include <vector>
+
+// CPPHTTPLIB_OPENSSL_SUPPORT is set for the whole target in CMakeLists.txt.
+// Defining it per-file would give translation units different definitions of
+// httplib's socket types, which is an ODR violation the linker resolves by
+// silently picking one.
+#include <httplib.h>
+
+namespace fs = std::filesystem;
+
+namespace
+{
+
+// httplib::Client parses the scheme itself and picks TLS accordingly, so the
+// url is passed through as configured. A url without a scheme keeps the old
+// behaviour of assuming TLS rather than silently downgrading to port 80.
+std::string with_scheme(const std::string& url)
+{
+	return url.find("://") == std::string::npos ? "https://" + url : url;
+}
+
+// Server error pages are HTML; this makes one readable line out of one.
+std::string one_line(std::string text, size_t limit = 200)
+{
+	for (char& c : text) {
+		if (c == '\n' || c == '\r' || c == '\t') {
+			c = ' ';
+		}
+	}
+
+	if (text.size() > limit) {
+		text.resize(limit);
+		text += "...";
+	}
+
+	return text;
+}
+
+} // namespace
+
+UploadTarget::UploadTarget(const UploadTargetConfig& config)
+	: _config(config)
+{
+	_config.url = with_scheme(_config.url);
+}
+
+bool UploadTarget::reachable()
+{
+	const auto now = std::chrono::steady_clock::now();
+
+	if (now < _unreachable_until) {
+		return false;
+	}
+
+	httplib::Client client(_config.url);
+	client.set_connection_timeout(5, 0);
+	client.set_read_timeout(5, 0);
+	// Any answer proves the host is up. Flight Review redirects "/", so
+	// requiring 200 would call a healthy server dead.
+	client.set_follow_location(false);
+
+	const httplib::Result response = client.Get("/");
+
+	if (!response) {
+		_unreachable_until = now + kUnreachableCooldown;
+
+		if (!_reported_unreachable) {
+			LOG_WARN("Upload target " << _config.name << " (" << _config.url << ") is unreachable; "
+				 << "retrying in "
+				 << std::chrono::duration_cast<std::chrono::seconds>(kUnreachableCooldown).count()
+				 << "s");
+			_reported_unreachable = true;
+		}
+
+		return false;
+	}
+
+	if (_reported_unreachable) {
+		LOG("Upload target " << _config.name << " (" << _config.url << ") is reachable again");
+		_reported_unreachable = false;
+	}
+
+	_unreachable_until = {};
+	return true;
+}
+
+UploadTarget::Result UploadTarget::upload(const std::string& file_path)
+{
+	std::error_code ec;
+
+	if (!fs::exists(file_path, ec)) {
+		return {Outcome::Missing, 0, "local file is missing: " + file_path, ""};
+	}
+
+	const auto size = fs::file_size(file_path, ec);
+
+	if (ec) {
+		return {Outcome::Missing, 0, "cannot stat local file: " + file_path, ""};
+	}
+
+	// Not Missing: re-fetching a log the vehicle reports as zero bytes would
+	// download nothing, succeed, and come straight back here forever.
+	if (size == 0) {
+		return {Outcome::Rejected, 0, "log is empty: " + file_path, ""};
+	}
+
+	if (!reachable()) {
+		return {Outcome::Unreachable, 0, "server unreachable", ""};
+	}
+
+	auto file = std::make_shared<std::ifstream>(file_path, std::ios::binary);
+
+	if (!*file) {
+		return {Outcome::Missing, 0, "cannot open local file: " + file_path, ""};
+	}
+
+	const std::string name = fs::path(file_path).filename().string();
+
+	// Flight Review reads every one of these fields off the form; the ones it
+	// does not use for an automated upload still have to be present.
+	const httplib::MultipartFormDataItems fields = {
+		{"type", _config.public_logs ? "flightreport" : "personal", "", ""},
+		{"description", "Uploaded by logloader", "", ""},
+		{"feedback", "", "", ""},
+		{"email", _config.email, "", ""},
+		{"source", "auto", "", ""},
+		{"videoUrl", "", "", ""},
+		{"rating", "", "", ""},
+		{"windSpeed", "", "", ""},
+		{"public", _config.public_logs ? "true" : "false", "", ""},
+	};
+
+	// The log is streamed off disk rather than assembled in memory. httplib's
+	// MultipartFormDataItems overload builds the whole body as a std::string
+	// first, so a 400 MB ArduPilot log would need the better part of a gigabyte
+	// on a companion computer that does not have it.
+	const std::string boundary = httplib::detail::make_multipart_data_boundary();
+	const std::string content_type = httplib::detail::serialize_multipart_formdata_get_content_type(boundary);
+
+	const httplib::MultipartFormData log_part {"filearg", "", name, "application/octet-stream"};
+	const std::string prologue = httplib::detail::serialize_multipart_formdata(fields, boundary, false)
+				     + httplib::detail::serialize_multipart_formdata_item_begin(log_part, boundary);
+	const std::string epilogue = httplib::detail::serialize_multipart_formdata_item_end()
+				     + httplib::detail::serialize_multipart_formdata_finish(boundary);
+
+	const size_t body_size = prologue.size() + size + epilogue.size();
+
+	httplib::Headers headers;
+	const bool use_api_key = !_config.api_key.empty();
+
+	if (use_api_key) {
+		headers.emplace("Authorization", "Bearer " + _config.api_key);
+		headers.emplace("X-API-Key", _config.api_key);
+	}
+
+	LOG("Uploading " << name << " to " << _config.name << " (" << _config.url << ")"
+	    << (use_api_key ? " with API key" : ""));
+
+	httplib::Client client(_config.url);
+	client.set_connection_timeout(30, 0);
+	client.set_read_timeout(300, 0);
+	client.set_write_timeout(300, 0);
+	client.set_follow_location(false);
+
+	// Content-Length is known up front, so this stays a plain request rather
+	// than a chunked one -- Flight Review's multipart reader wants the length.
+	auto provider = [prologue, epilogue, file, size](size_t offset, size_t, httplib::DataSink & sink) {
+		constexpr size_t kChunk = 64 * 1024;
+
+		if (offset < prologue.size()) {
+			const size_t n = std::min(kChunk, prologue.size() - offset);
+			return sink.write(prologue.data() + offset, n);
+		}
+
+		const size_t in_file = offset - prologue.size();
+
+		if (in_file < size) {
+			const size_t n = std::min(kChunk, static_cast<size_t>(size) - in_file);
+			std::vector<char> buffer(n);
+			file->seekg(static_cast<std::streamoff>(in_file));
+
+			if (!file->read(buffer.data(), static_cast<std::streamsize>(n))) {
+				return false;
+			}
+
+			return sink.write(buffer.data(), n);
+		}
+
+		const size_t in_epilogue = in_file - size;
+		return sink.write(epilogue.data() + in_epilogue, epilogue.size() - in_epilogue);
+	};
+
+	const httplib::Result response = client.Post("/upload", headers, body_size, provider, content_type);
+
+
+	if (!response) {
+		// The connection died mid-transfer; the server may or may not have the
+		// log, so this is worth another attempt rather than a rejection.
+		return {Outcome::Retry, 0, "connection failed during upload", ""};
+	}
+
+	const int status = response->status;
+
+	// Flight Review answers a successful upload with a redirect to the plot.
+	if (status == 302 || status == 200) {
+		return {Outcome::Success, status, "uploaded", response->get_header_value("Location")};
+	}
+
+	const std::string detail = one_line(response->body);
+
+	if (status == 401 || status == 403) {
+		return {Outcome::Unauthorized, status, detail.empty() ? "not authorized" : detail, ""};
+	}
+
+	if (status == 400) {
+		return {Outcome::Rejected, status, detail.empty() ? "rejected by the server" : detail, ""};
+	}
+
+	return {Outcome::Retry, status, detail.empty() ? "server error" : detail, ""};
+}
diff --git a/src/UploadTarget.hpp b/src/UploadTarget.hpp
new file mode 100644
index 0000000..d066623
--- /dev/null
+++ b/src/UploadTarget.hpp
@@ -0,0 +1,58 @@
+#pragma once
+
+#include <chrono>
+#include <string>
+
+#include "Config.hpp"
+
+// One Flight Review endpoint. Knows how to reach it and how to post a log to
+// it; it holds no record of which logs exist or what has been uploaded, which
+// is what LogDatabase is for.
+class UploadTarget
+{
+public:
+	enum class Outcome {
+		Success,
+		// The local copy is gone or empty. Nothing is wrong with the log itself,
+		// so the caller should fetch it again rather than give up on it.
+		Missing,
+		// The server will not take this log however often it is asked.
+		Rejected,
+		// The account is not authorized (yet). The log is fine; every other
+		// upload to this target would fail the same way, so stop the batch and
+		// keep the log queued.
+		Unauthorized,
+		// Could not connect. Stop the batch and try again after the cooldown.
+		Unreachable,
+		// Anything else: worth another attempt later.
+		Retry,
+	};
+
+	struct Result {
+		Outcome outcome {Outcome::Retry};
+		int status_code {0};
+		std::string message;
+		// Path the server redirected to, e.g. "/plot_app?log=<uuid>".
+		std::string location;
+	};
+
+	explicit UploadTarget(const UploadTargetConfig& config);
+
+	const std::string& name() const { return _config.name; }
+	const std::string& url() const { return _config.url; }
+	bool enabled() const { return _config.enabled; }
+
+	Result upload(const std::string& file_path);
+
+private:
+	// Probes at most once per cooldown and logs only on the down/up
+	// transitions, so a server that is simply off does not produce one failure
+	// line per pending log.
+	bool reachable();
+
+	UploadTargetConfig _config;
+
+	static constexpr auto kUnreachableCooldown = std::chrono::seconds(60);
+	std::chrono::steady_clock::time_point _unreachable_until {};
+	bool _reported_unreachable {false};
+};
diff --git a/src/Waiter.hpp b/src/Waiter.hpp
new file mode 100644
index 0000000..1113ec4
--- /dev/null
+++ b/src/Waiter.hpp
@@ -0,0 +1,57 @@
+#pragma once
+
+#include <chrono>
+#include <condition_variable>
+#include <mutex>
+
+// An interruptible sleep. A loop that would otherwise sit out its whole
+// interval can be woken as soon as there is something to do (a new request from
+// the API, say) or told to stop.
+//
+// Each loop owns its own Waiter, so a wake meant for one cannot be consumed by
+// the other.
+class Waiter
+{
+public:
+	// Sleeps for at most duration. Returns true when the caller should stop.
+	template <typename Rep, typename Period>
+	bool wait(std::chrono::duration<Rep, Period> duration)
+	{
+		std::unique_lock<std::mutex> lock(_mutex);
+		_cv.wait_for(lock, duration, [this] { return _stop || _wake; });
+		_wake = false;
+		return _stop;
+	}
+
+	void wake()
+	{
+		{
+			std::lock_guard<std::mutex> lock(_mutex);
+			_wake = true;
+		}
+
+		_cv.notify_all();
+	}
+
+	void stop()
+	{
+		{
+			std::lock_guard<std::mutex> lock(_mutex);
+			_stop = true;
+		}
+
+		_cv.notify_all();
+	}
+
+	bool stopped() const
+	{
+		std::lock_guard<std::mutex> lock(_mutex);
+		return _stop;
+	}
+
+private:
+	mutable std::mutex _mutex;
+	std::condition_variable _cv;
+	bool _wake {false};
+	bool _stop {false};
+};
diff --git a/src/main.cpp b/src/main.cpp
index 0621092..de96df4 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -1,90 +1,122 @@
-#include "LogLoader.hpp"
-#include "Log.hpp"
-#include <signal.h>
-#include <iostream>
+#include <atomic>
+#include <cstdio>
 #include <filesystem>
-#include <toml.hpp>
+#include <iostream>
+#include <thread>
 
-static void signal_handler(int signum);
+#include <csignal>
+#include <ctime>
+#include <pthread.h>
 
-std::atomic<bool> _should_exit = false;
-std::shared_ptr<LogLoader> _log_loader;
+#include "ApiServer.hpp"
+#include "Config.hpp"
+#include "Log.hpp"
+#include "LogLoader.hpp"
 
-int main(int argc, char** argv)
+namespace
 {
-	signal(SIGINT, signal_handler);
-	signal(SIGTERM, signal_handler);
-	setbuf(stdout, NULL); // Disable stdout buffering
 
-	// Config lookup: --config <path> (or --config=<path>) overrides everything;
-	// otherwise user override > deb-installed default.
-	const std::string home = getenv("HOME") ? getenv("HOME") : "/tmp";
-	const auto user_config = std::filesystem::path(home) / ".config/ark/logloader/config.toml";
-	const auto default_config = std::filesystem::path("/opt/ark/share/logloader/config.toml");
-	std::string config_path = (std::filesystem::exists(user_config) ? user_config : default_config).string();
+void print_usage()
+{
+	std::cout
+			<< "logloader - download flight logs over MAVLink FTP and upload them to Flight Review\n\n"
+			<< "  --config <path>   configuration file to use\n"
+			<< "  --help            show this message\n\n"
+			<< "Without --config, ~/.config/ark/logloader/config.toml is used when it exists,\n"
+			<< "otherwise /opt/ark/share/logloader/config.toml.\n";
+}
 
-	for (int i = 1; i < argc; i++) {
-		std::string arg = argv[i];
+// SIGINT/SIGTERM are blocked in every thread and consumed here instead. A
+// handler cannot safely take a lock or signal a condition variable, and stopping
+// cleanly needs both.
+std::thread start_signal_thread(const sigset_t& mask, const std::atomic<bool>& running,
+				const std::function<void()>& on_signal)
+{
+	return std::thread([&mask, &running, on_signal] {
+		const timespec timeout {0, 200 * 1000 * 1000};
+
+		while (running.load())
+		{
+			siginfo_t info {};
+			const int signum = sigtimedwait(&mask, &info, &timeout);
+
+			if (signum > 0) {
+				LOG("Received signal " << signum << ", shutting down");
+				on_signal();
+				return;
+			}
+		}
+	});
+}
+
+} // namespace
 
-		if (arg == "--config" && i + 1 < argc) {
-			config_path = argv[++i];
+int main(int argc, char** argv)
+{
+	setbuf(stdout, nullptr); // journald wants lines as they happen
+
+	for (int i = 1; i < argc; i++) {
+		const std::string arg = argv[i];
 
-		} else if (arg.rfind("--config=", 0) == 0) {
-			config_path = arg.substr(std::string("--config=").size());
+		if (arg == "--help" || arg == "-h") {
+			print_usage();
+			return 0;
 		}
 	}
 
-	toml::table config;
+	const std::string config_path = resolve_config_path(argc, argv);
+	Config config;
 
 	try {
-		config = toml::parse_file(config_path);
+		config = load_config(config_path);
 
-	} catch (const toml::parse_error& err) {
-		std::cerr << "Parsing failed:\n" << err << "\n";
-		return -1;
-
-	} catch (const std::exception& err) {
-		std::cerr << "Error: " << err.what() << "\n";
-		return -1;
+	} catch (const std::exception& error) {
+		LOG_ERROR(error.what());
+		return 1;
 	}
 
-	// Writable data directory for logs and SQLite DB
-	const auto data_dir = std::filesystem::path(home) / ".local/share/ark/logloader";
-	std::filesystem::create_directories(data_dir);
+	logging::set_level(config.log_level);
+	LOG("logloader starting, configuration from " << config_path);
 
-	// Setup the LogLoader
-	LogLoader::Settings settings = {
-		.email = config["email"].value_or(""),
-		.local_server = config["local_server"].value_or("http://127.0.0.1:5006"),
-		.remote_server = config["remote_server"].value_or("https://logs.px4.io"),
-		.mavsdk_connection_url = config["connection_url"].value_or("0.0.0"),
-		.application_directory = config["application_directory"].value_or(data_dir.string() + "/"),
-		.upload_enabled = config["upload_enabled"].value_or(false),
-		.public_logs = config["public_logs"].value_or(false)
-	};
+	std::error_code ec;
+	std::filesystem::create_directories(config.logs_directory, ec);
 
-	_log_loader = std::make_shared<LogLoader>(settings);
+	if (ec) {
+		LOG_ERROR("Cannot create " << config.logs_directory << ": " << ec.message());
+		return 1;
+	}
 
-	bool connected = false;
+	sigset_t mask;
+	sigemptyset(&mask);
+	sigaddset(&mask, SIGINT);
+	sigaddset(&mask, SIGTERM);
+	pthread_sigmask(SIG_BLOCK, &mask, nullptr);
 
-	while (!_should_exit && !connected) {
-		connected = _log_loader->wait_for_mavsdk_connection(3);
-	}
+	LogLoader loader(config);
 
-	if (!_should_exit && connected) {
-		_log_loader->run();
+	if (!loader.database_ok()) {
+		return 1;
 	}
 
-	LOG("Exiting.");
+	ApiServer api({config.api_bind, config.api_port}, loader);
 
-	return 0;
-}
+	// Serve before connecting, so the UI can say the vehicle is not there yet
+	// rather than failing to load at all.
+	if (config.api_enabled && !api.start()) {
+		return 1;
+	}
 
-static void signal_handler(int signum)
-{
-	(void)signum;
+	std::atomic<bool> running {true};
+	std::thread signals = start_signal_thread(mask, running, [&loader] { loader.stop(); });
 
-	if (_log_loader.get()) _log_loader->stop();
+	if (loader.connect()) {
+		loader.run();
+	}
+
+	api.stop();
+	running = false;
+	signals.join();
 
-	_should_exit = true;
+	LOG("logloader stopped");
+	return 0;
 }
diff --git a/tests/test_log_database.cpp b/tests/test_log_database.cpp
new file mode 100644
index 0000000..17b4589
--- /dev/null
+++ b/tests/test_log_database.cpp
@@ -0,0 +1,528 @@
+// LogDatabase holds every decision logloader makes about a log, and the legacy
+// import runs exactly once against real user data and cannot be un-run. Both
+// are worth testing without a vehicle attached.
+//
+//   cmake -B build -DBUILD_TESTING=ON && cmake --build build && ctest --test-dir build
+
+#include "LogDatabase.hpp"
+#include "Sqlite.hpp"
+
+#include <cstdio>
+#include <filesystem>
+#include <iostream>
+#include <string>
+#include <vector>
+
+namespace fs = std::filesystem;
+
+namespace
+{
+
+int g_checks = 0;
+
+#define CHECK(condition)                                                       \
+	do {                                                                   \
+		g_checks++;                                                    \
+		if (!(condition)) {                                            \
+			std::cerr << "FAILED " << __FILE__ << ":" << __LINE__   \
+				  << ": " << #condition << "\n";               \
+			std::abort();                                          \
+		}                                                              \
+	} while (0)
+
+const std::vector<std::string> kTargets {"local", "remote"};
+
+// A directory that cleans up after itself, so a failed run leaves nothing behind.
+class Workspace
+{
+public:
+	Workspace()
+	{
+		_path = fs::temp_directory_path() / ("logloader-test-" + std::to_string(::getpid()) + "-"
+						     + std::to_string(_counter++));
+		fs::create_directories(_path / "logs");
+	}
+
+	~Workspace() { fs::remove_all(_path); }
+
+	std::string db() const { return (_path / "logloader.db").string(); }
+	std::string logs() const { return (_path / "logs").string() + "/"; }
+	fs::path path() const { return _path; }
+
+private:
+	fs::path _path;
+	static inline int _counter = 0;
+};
+
+LogDatabase::Discovered px4(const std::string& path, uint32_t size, int64_t time)
+{
+	return {path, size, time};
+}
+
+LogDatabase::Discovered ardupilot(const std::string& path, uint32_t size)
+{
+	return {path, size, std::nullopt};
+}
+
+const LogDatabase::Entry* find(const std::vector<LogDatabase::Entry>& entries, const std::string& path)
+{
+	for (const auto& entry : entries) {
+		if (entry.path == path) {
+			return &entry;
+		}
+	}
+
+	return nullptr;
+}
+
+// -------------------------------------------------------------------------
+
+void first_index_needs_a_non_empty_listing()
+{
+	Workspace workspace;
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+	CHECK(database.ok());
+
+	// The very first listing after startup reports nothing stable, because
+	// stability takes two listings to establish. That must not count as the
+	// first index, or the next listing looks like a flood of new logs.
+	const auto empty = database.sync_index({});
+	CHECK(!empty.first_ever);
+	CHECK(empty.inserted.empty());
+
+	const auto real = database.sync_index({px4("2026-07-28/10_00_00.ulg", 100, 1000),
+					       px4("2026-07-28/11_00_00.ulg", 200, 2000)});
+	CHECK(real.first_ever);
+	CHECK(real.inserted.size() == 2);
+	CHECK(real.present_count == 2);
+
+	// Only once.
+	const auto later = database.sync_index({px4("2026-07-28/12_00_00.ulg", 300, 3000)});
+	CHECK(!later.first_ever);
+	CHECK(later.inserted.size() == 1);
+}
+
+void newest_is_newest_for_both_stacks()
+{
+	{
+		Workspace workspace;
+		LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+		database.sync_index({px4("2026-07-28/10_00_00.ulg", 100, 1000),
+				     px4("2026-07-28/12_00_00.ulg", 100, 3000),
+				     px4("2026-07-28/11_00_00.ulg", 100, 2000)});
+
+		const auto newest = database.newest_log_id();
+		CHECK(newest.has_value());
+		CHECK(database.log_by_id(newest.value())->path == "2026-07-28/12_00_00.ulg");
+	}
+
+	{
+		// ArduPilot reports no time at all, so the number in the name is all
+		// there is: 100.BIN is later than 99.BIN despite sorting before it.
+		Workspace workspace;
+		LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+		database.sync_index({ardupilot("98.BIN", 100), ardupilot("99.BIN", 100),
+				     ardupilot("100.BIN", 100)});
+
+		const auto newest = database.newest_log_id();
+		CHECK(newest.has_value());
+		CHECK(database.log_by_id(newest.value())->path == "100.BIN");
+	}
+
+	{
+		// ...until the counter wraps at LOG_MAX_FILES, where the only usable
+		// signal is which log we watched appear.
+		Workspace workspace;
+		LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+		database.sync_index({ardupilot("499.BIN", 100), ardupilot("500.BIN", 100)});
+		const auto wrapped = database.sync_index({ardupilot("499.BIN", 100), ardupilot("500.BIN", 100),
+				     ardupilot("1.BIN", 100)});
+		CHECK(wrapped.inserted.size() == 1);
+
+		const auto newest = database.newest_log_id();
+		CHECK(newest.has_value());
+		CHECK(database.log_by_id(newest.value())->path == "1.BIN");
+	}
+}
+
+void a_log_that_leaves_the_vehicle_keeps_its_history()
+{
+	Workspace workspace;
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+
+	const auto sync = database.sync_index({px4("a.ulg", 100, 1000)});
+	const int64_t id = sync.inserted.front();
+
+	database.mark_downloaded(id, workspace.logs() + "a.ulg");
+	database.mark_uploaded(id, "local", "/plot_app?log=abc");
+
+	// Gone from the card.
+	database.sync_index({});
+	const auto gone = database.log_by_id(id);
+	CHECK(gone.has_value());
+	CHECK(!gone->present);
+	CHECK(gone->downloaded);
+	CHECK(gone->uploads.at("local").uploaded);
+	CHECK(gone->uploads.at("local").location == "/plot_app?log=abc");
+
+	// And back again, without losing anything.
+	database.sync_index({px4("a.ulg", 100, 1000)});
+	const auto back = database.log_by_id(id);
+	CHECK(back->present);
+	CHECK(back->uploads.at("local").uploaded);
+}
+
+// The first listing after a restart has nothing stable in it yet, because
+// stability takes two listings. Every log is still on the vehicle, and saying
+// otherwise both lies to the UI and empties the download queue for an interval.
+void a_growing_log_is_still_on_the_vehicle()
+{
+	Workspace workspace;
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+
+	LogDatabase::Discovered settled = px4("a.ulg", 100, 1000);
+	database.sync_index({settled});
+	CHECK(database.log_by_id(database.all_logs().front().id)->present);
+
+	// Same listing, but nothing has been confirmed stable this time round.
+	LogDatabase::Discovered growing = settled;
+	growing.stable = false;
+	const auto sync = database.sync_index({growing});
+
+	CHECK(sync.present_count == 0);
+	CHECK(sync.inserted.empty());
+	CHECK(database.all_logs().front().present);
+}
+
+void a_growing_log_is_a_different_log()
+{
+	Workspace workspace;
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+
+	const auto first = database.sync_index({px4("a.ulg", 100, 1000)});
+	const auto grown = database.sync_index({px4("a.ulg", 200, 1000)});
+
+	CHECK(grown.inserted.size() == 1);
+	CHECK(grown.inserted.front() != first.inserted.front());
+	CHECK(!database.log_by_id(first.inserted.front())->present);
+	CHECK(database.log_by_id(grown.inserted.front())->present);
+}
+
+void requests_drive_the_queues()
+{
+	Workspace workspace;
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+
+	const auto sync = database.sync_index({px4("a.ulg", 100, 1000), px4("b.ulg", 100, 2000)});
+	CHECK(database.logs_to_download().empty());
+
+	const int64_t id = sync.inserted.front();
+	database.request({id}, {"local"});
+
+	auto pending = database.logs_to_download();
+	CHECK(pending.size() == 1);
+	CHECK(pending.front().id == id);
+
+	// Nothing to upload until the file is actually here.
+	CHECK(database.logs_to_upload("local").empty());
+
+	database.mark_downloaded(id, workspace.logs() + "a.ulg");
+	CHECK(database.logs_to_download().empty());
+
+	auto uploadable = database.logs_to_upload("local");
+	CHECK(uploadable.size() == 1);
+	// The request named only one target.
+	CHECK(database.logs_to_upload("remote").empty());
+
+	database.mark_uploaded(id, "local", "/plot_app?log=x");
+	CHECK(database.logs_to_upload("local").empty());
+
+	// Cancelling clears a pending request but not work already done.
+	const int64_t other = sync.inserted.back();
+	database.request({other}, {"local"});
+	CHECK(database.logs_to_download().size() == 1);
+	database.cancel_requests({other});
+	CHECK(database.logs_to_download().empty());
+	CHECK(database.log_by_id(id)->uploads.at("local").uploaded);
+}
+
+void a_downloaded_log_with_no_file_is_not_downloaded()
+{
+	Workspace workspace;
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+
+	const auto sync = database.sync_index({px4("a.ulg", 100, 1000)});
+	const int64_t id = sync.inserted.front();
+
+	database.request({id}, {"local"});
+	database.mark_downloaded(id, workspace.logs() + "a.ulg");
+	CHECK(database.logs_to_upload("local").size() == 1);
+
+	// The file went away -- manual cleanup, a full disk, a failed upload.
+	// The log has to become fetchable again, or it is stranded: reachable from
+	// neither queue and invisible to "download everything".
+	database.clear_local_file(id);
+	CHECK(!database.log_by_id(id)->downloaded);
+	CHECK(database.logs_to_upload("local").empty());
+
+	const auto not_downloaded = database.ids_not_downloaded();
+	CHECK(not_downloaded.size() == 1);
+	CHECK(not_downloaded.front() == id);
+
+	database.request({id}, {"local"});
+	CHECK(database.logs_to_download().size() == 1);
+}
+
+void rejected_uploads_do_not_block_the_queue()
+{
+	Workspace workspace;
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+
+	const auto sync = database.sync_index({px4("a.ulg", 100, 1000), px4("b.ulg", 100, 2000)});
+
+	for (int64_t id : sync.inserted) {
+		database.request({id}, {"local"});
+		database.mark_downloaded(id, workspace.logs() + std::to_string(id) + ".ulg");
+	}
+
+	CHECK(database.logs_to_upload("local").size() == 2);
+
+	database.mark_upload_rejected(sync.inserted.front(), "local", "400: not a ulog");
+	auto remaining = database.logs_to_upload("local");
+	CHECK(remaining.size() == 1);
+	CHECK(remaining.front().id == sync.inserted.back());
+
+	// A transient failure leaves it queued.
+	database.record_upload_failure(sync.inserted.back(), "local", "500");
+	CHECK(database.logs_to_upload("local").size() == 1);
+}
+
+void failure_counts_order_the_download_queue()
+{
+	Workspace workspace;
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+
+	const auto sync = database.sync_index({px4("a.ulg", 100, 3000), px4("b.ulg", 100, 2000)});
+	database.request(sync.inserted, {});
+
+	// Newest first to begin with.
+	CHECK(database.logs_to_download().front().path == "a.ulg");
+
+	// A log the vehicle will not part with sorts to the back rather than
+	// blocking everything behind it.
+	database.record_download_failure(sync.inserted.front(), "timeout");
+	CHECK(database.logs_to_download().front().path == "b.ulg");
+}
+
+void ardupilot_name_reuse_does_not_overwrite()
+{
+	Workspace workspace;
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+
+	const auto sync = database.sync_index({ardupilot("1.BIN", 100), ardupilot("1.BIN", 200)});
+	CHECK(sync.inserted.size() == 2);
+
+	const std::string path = workspace.logs() + "1.BIN";
+	database.mark_downloaded(sync.inserted.front(), path);
+
+	CHECK(database.local_path_in_use(path, sync.inserted.back()));
+	CHECK(!database.local_path_in_use(path, sync.inserted.front()));
+}
+
+void ids_for_everything_respect_target_state()
+{
+	Workspace workspace;
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+
+	const auto sync = database.sync_index({px4("a.ulg", 100, 1000), px4("b.ulg", 100, 2000)});
+	CHECK(database.ids_not_downloaded().size() == 2);
+
+	for (int64_t id : sync.inserted) {
+		database.mark_downloaded(id, workspace.logs() + std::to_string(id) + ".ulg");
+	}
+
+	CHECK(database.ids_not_downloaded().empty());
+	CHECK(database.ids_not_uploaded({"local"}).size() == 2);
+
+	database.mark_uploaded(sync.inserted.front(), "local", "/x");
+	CHECK(database.ids_not_uploaded({"local"}).size() == 1);
+	CHECK(database.ids_not_uploaded({"remote"}).size() == 2);
+	CHECK(database.ids_not_uploaded({}).empty());
+}
+
+// -------------------------------------------------------------------------
+
+// Builds a database in the shape the pre-FTP logloader left behind.
+void write_legacy_database(const fs::path& file, const std::vector<std::tuple<std::string, int, std::string,
+			   int64_t, bool, bool>>& rows)
+{
+	sqlite3* db = nullptr;
+	CHECK(sqlite3_open(file.c_str(), &db) == SQLITE_OK);
+	sqlite::execute(db, "CREATE TABLE logs (uuid TEXT PRIMARY KEY, id INTEGER, date TEXT, size_bytes INTEGER,"
+			" downloaded INTEGER, uploaded INTEGER)");
+	sqlite::execute(db, "CREATE TABLE blacklist (uuid TEXT PRIMARY KEY, reason TEXT, timestamp TEXT)");
+
+	for (const auto& [uuid, legacy_id, date, size, downloaded, uploaded] : rows) {
+		sqlite::Statement stmt(db, "INSERT INTO logs VALUES (?, ?, ?, ?, ?, ?)");
+		stmt.bind(1, uuid).bind(2, static_cast<int64_t>(legacy_id)).bind(3, date)
+		.bind(4, size).bind(5, downloaded).bind(6, uploaded);
+		stmt.execute();
+	}
+
+	sqlite3_close(db);
+}
+
+void the_upgrade_does_not_refetch_or_reupload()
+{
+	Workspace workspace;
+
+	// Three logs: one fetched and uploaded, one fetched but not uploaded, one
+	// neither. Their files are named the way the old version named them.
+	write_legacy_database(workspace.path() / "local_server.db", {
+		{"aaa", 1, "2026-07-28T10:00:00Z", 100, true, true},
+		{"bbb", 2, "2026-07-28T11:00:00Z", 200, true, false},
+		{"ccc", 3, "2026-07-28T12:00:00Z", 300, false, false},
+	});
+
+	const fs::path uploaded_file = fs::path(workspace.logs()) / "LOG0001_2026-07-28T10:00:00Z.ulg";
+	const fs::path fetched_file = fs::path(workspace.logs()) / "LOG0002_2026-07-28T11:00:00Z.ulg";
+	std::fclose(std::fopen(uploaded_file.c_str(), "w"));
+	std::fclose(std::fopen(fetched_file.c_str(), "w"));
+
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+	CHECK(database.ok());
+
+	// The FTP listing reports the same logs by size, with times close to what
+	// the old database recorded.
+	const auto sync = database.sync_index({px4("2026-07-28/10_00_00.ulg", 100, 1785276000),
+					       px4("2026-07-28/11_00_00.ulg", 200, 1785279600),
+					       px4("2026-07-28/12_00_00.ulg", 300, 1785283200)});
+	CHECK(sync.inserted.size() == 3);
+
+	const auto logs = database.all_logs();
+
+	const auto* already_done = find(logs, "2026-07-28/10_00_00.ulg");
+	CHECK(already_done != nullptr);
+	CHECK(already_done->downloaded);
+	CHECK(already_done->uploads.at("local").uploaded);
+
+	const auto* fetched = find(logs, "2026-07-28/11_00_00.ulg");
+	CHECK(fetched->downloaded);
+	CHECK(!fetched->uploads.at("local").uploaded);
+
+	const auto* untouched = find(logs, "2026-07-28/12_00_00.ulg");
+	CHECK(!untouched->downloaded);
+	CHECK(!untouched->uploads.at("local").uploaded);
+
+	// The other target never had these logs.
+	CHECK(!already_done->uploads.at("remote").uploaded);
+}
+
+void the_upgrade_runs_once()
+{
+	Workspace workspace;
+	write_legacy_database(workspace.path() / "local_server.db", {
+		{"aaa", 1, "2026-07-28T10:00:00Z", 100, true, true},
+	});
+
+	{
+		LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+		const auto sync = database.sync_index({px4("2026-07-28/10_00_00.ulg", 100, 1785276000)});
+		database.mark_upload_rejected(sync.inserted.front(), "local", "operator dealt with it");
+	}
+
+	// Re-opening must not resurrect what the first run already applied.
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+	const auto logs = database.all_logs();
+	CHECK(logs.size() == 1);
+	CHECK(logs.front().uploads.at("local").rejected);
+}
+
+void a_missing_legacy_file_is_fetched_again()
+{
+	Workspace workspace;
+	// Recorded as downloaded, but the file is not there any more.
+	write_legacy_database(workspace.path() / "local_server.db", {
+		{"aaa", 1, "2026-07-28T10:00:00Z", 100, true, false},
+	});
+
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+	database.sync_index({px4("2026-07-28/10_00_00.ulg", 100, 1785276000)});
+
+	const auto logs = database.all_logs();
+	CHECK(!logs.front().downloaded);
+	CHECK(logs.front().local_path.empty());
+	CHECK(database.ids_not_downloaded().size() == 1);
+}
+
+// CREATE TABLE IF NOT EXISTS does nothing to a table that is already there, so a
+// column added later is invisible on an existing database and every query naming
+// it silently returns nothing.
+void an_older_schema_is_migrated()
+{
+	Workspace workspace;
+
+	{
+		sqlite3* db = nullptr;
+		CHECK(sqlite3_open(workspace.db().c_str(), &db) == SQLITE_OK);
+		sqlite::execute(db,
+				"CREATE TABLE logs ("
+				"  id INTEGER PRIMARY KEY, path TEXT NOT NULL, size_bytes INTEGER NOT NULL,"
+				"  time_utc INTEGER, local_path TEXT NOT NULL DEFAULT '',"
+				"  downloaded INTEGER NOT NULL DEFAULT 0, download_requested INTEGER NOT NULL DEFAULT 0,"
+				"  present INTEGER NOT NULL DEFAULT 1, download_failures INTEGER NOT NULL DEFAULT 0,"
+				"  last_error TEXT NOT NULL DEFAULT '', discovered_at INTEGER NOT NULL DEFAULT 0,"
+				"  UNIQUE (path, size_bytes))");
+		sqlite::execute(db,
+				"INSERT INTO logs (path, size_bytes, time_utc, discovered_at) "
+				"VALUES ('old.ulg', 100, 1000, 7)");
+		sqlite3_close(db);
+	}
+
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+	CHECK(database.ok());
+
+	const auto logs = database.all_logs();
+	CHECK(logs.size() == 1);
+	CHECK(logs.front().path == "old.ulg");
+
+	// And the new column is usable, not just present.
+	const auto sync = database.sync_index({px4("old.ulg", 100, 1000), px4("new.ulg", 200, 2000)});
+	CHECK(sync.inserted.size() == 1);
+	CHECK(database.newest_log_id().has_value());
+}
+
+void a_database_with_no_predecessor_is_untouched()
+{
+	Workspace workspace;
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+	const auto sync = database.sync_index({px4("a.ulg", 100, 1000)});
+	CHECK(sync.inserted.size() == 1);
+	CHECK(!database.log_by_id(sync.inserted.front())->downloaded);
+}
+
+} // namespace
+
+int main()
+{
+	first_index_needs_a_non_empty_listing();
+	newest_is_newest_for_both_stacks();
+	a_log_that_leaves_the_vehicle_keeps_its_history();
+	a_growing_log_is_still_on_the_vehicle();
+	a_growing_log_is_a_different_log();
+	requests_drive_the_queues();
+	a_downloaded_log_with_no_file_is_not_downloaded();
+	rejected_uploads_do_not_block_the_queue();
+	failure_counts_order_the_download_queue();
+	ardupilot_name_reuse_does_not_overwrite();
+	ids_for_everything_respect_target_state();
+
+	an_older_schema_is_migrated();
+	the_upgrade_does_not_refetch_or_reupload();
+	the_upgrade_runs_once();
+	a_missing_legacy_file_is_fetched_again();
+	a_database_with_no_predecessor_is_untouched();
+
+	std::cout << "all checks passed (" << g_checks << ")\n";
+	return 0;
+}
diff --git a/third_party/json b/third_party/json
new file mode 160000
index 0000000..9cca280
--- /dev/null
+++ b/third_party/json
@@ -0,0 +1 @@
+Subproject commit 9cca280a4d0ccf0c08f47a99aa71d1b0e52f8d03