From b4d4d90ecc78b7f3abcd527b6d8825120c96b347 Mon Sep 17 00:00:00 2001
From: Jacob Dahl <dahl.jakejacob@gmail.com>
Date: Mon, 27 Jul 2026 21:08:10 -0600
Subject: [PATCH 1/8] feat(logloader): download logs over MAVLink FTP only

LOG_DATA (msg 120) carries no target_system/target_component, so a router
between logloader and the autopilot has no addressing information and copies
every chunk to every endpoint it serves -- the telemetry radio included. On a
node running mavlink-router a log download saturates links that have no
interest in it.

Move both halves of the job to MAVLink FTP: the listing that finds the logs and
the transfer that downloads them. FILE_TRANSFER_PROTOCOL (msg 110) is addressed
and both PX4 and ArduPilot reply to the requesting sysid/compid, so everything
is unicast to logloader. The classic log protocol is gone entirely -- no
LOG_REQUEST_LIST, no LOG_ENTRY, no LOG_DATA, and no MAVSDK LogFiles plugin.

Dropping LOG_ENTRY means dropping the only thing that identified a log, so
identity moves to the listing: the path below the log root plus the size.
That is also what makes ArduPilot work without special cases. Its list entry
numbering, its LOG_MAX_FILES wrap and its .BIN extension were all consequences
of the old protocol; a directory listing just reports files.

The log root is probed at "@MAV_LOG" -- the virtual directory the MAVLink FTP
specification defines for this -- then at /fs/microsd/log and /APM/LOGS for
firmware that predates it. Timestamps come from the listing when the vehicle
implements ListDirectoryWithTime, otherwise from the start time PX4 encodes in
the path; ArduPilot logs simply have no timestamp and nothing needs one.

MAVSDK's Ftp plugin drops the size and modification time from list replies, so
FtpListClient runs ListDirectory / ListDirectoryWithTime over MavlinkPassthrough
and keeps the whole entry. Bulk transfers still go through the plugin.

Databases written by earlier versions keyed logs on the LOG_ENTRY timestamp,
which FTP cannot reproduce. Their rows are set aside as logs_legacy on first
start and matched to the listing by size, so a fleet upgrading to this does not
re-download and re-upload its history.

Also:
- A log is only queued once two consecutive listings agree on its size, so the
  log being written right now is not downloaded at a size it will not keep.
- Downloads are staged and size-checked before being moved next to the finished
  logs, and a log that cannot be fetched sorts to the back of the queue instead
  of blocking the ones behind it.
- Open FTP sessions are reset at connect, which is what left PX4 refusing
  transfers until reboot after logloader was killed mid-download.
- The databases are created before they are opened, which failed when
  application_directory did not exist yet.
---
 CMakeLists.txt          |   2 +
 README.md               |  21 ++-
 config.toml             |   9 +
 src/FtpListClient.cpp   | 251 +++++++++++++++++++++++++
 src/FtpListClient.hpp   | 114 ++++++++++++
 src/FtpLogFetcher.cpp   | 324 ++++++++++++++++++++++++++++++++
 src/FtpLogFetcher.hpp   |  96 ++++++++++
 src/LogLoader.cpp       | 303 ++++++++++++++++++------------
 src/LogLoader.hpp       |  25 ++-
 src/ServerInterface.cpp | 400 +++++++++++++++++++++++++++++-----------
 src/ServerInterface.hpp |  42 ++++-
 src/main.cpp            |   4 +-
 12 files changed, 1342 insertions(+), 249 deletions(-)
 create mode 100644 src/FtpListClient.cpp
 create mode 100644 src/FtpListClient.hpp
 create mode 100644 src/FtpLogFetcher.cpp
 create mode 100644 src/FtpLogFetcher.hpp

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 6529639..d2a99f6 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -33,6 +33,8 @@ include_directories(${SQLite3_INCLUDE_DIRS})
 add_executable(${PROJECT_NAME}
     src/main.cpp
     src/ServerInterface.cpp
+    src/FtpListClient.cpp
+    src/FtpLogFetcher.cpp
     src/LogLoader.cpp)
 
 target_link_libraries(${PROJECT_NAME}
diff --git a/README.md b/README.md
index 8993abb..8145739 100644
--- a/README.md
+++ b/README.md
@@ -1,12 +1,29 @@
 ![image](logloader_logo.png)
 
-Downloads PX4 log files (.ulg) and uploads them to a local server and optionally a remote server.
+Downloads flight logs from the vehicle and uploads them to a local server and optionally a remote server. Works with PX4 (`.ulg`) and ArduPilot (`.BIN`).
 
 The **config.toml** file is used to configure the program settings.
 
 ### Behavior
 Downloading and uploading will only occur while the vehicle is not armed. Downloading and uploading operations are performed in separate threads. An sqlite database per server is used to track log file download/upload status.
 
+### Log transport
+Everything runs over **MAVLink FTP** (`FILE_TRANSFER_PROTOCOL`, msg 110): the directory listing that finds the logs and the bulk transfer that downloads them. The classic log protocol (`LOG_REQUEST_LIST` / `LOG_ENTRY` / `LOG_DATA`, msgs 117-120) is not used at all.
+
+`FILE_TRANSFER_PROTOCOL` carries `target_system` and `target_component`, and both PX4 and ArduPilot address their replies back to the requesting sysid/compid, so a download is unicast between the vehicle and logloader. `LOG_DATA` has no target fields, which leaves a router in between — mavlink-router, for instance — no choice but to copy every chunk to every endpoint it serves, telemetry radio included. A log download over the old protocol saturates links that have no interest in it.
+
+The autopilot's MAVLink instance must have FTP enabled (`mavlink start -x` on PX4). If it does not, logloader says so and idles.
+
+### Log discovery
+At startup logloader lists the vehicle's log directory, trying `@MAV_LOG` first — the virtual log directory the MAVLink FTP specification defines, supported by PX4 v1.17 and newer — then the physical `/fs/microsd/log` (PX4) and `/APM/LOGS` (ArduPilot). Set `remote_log_directory` to skip the probe. The listing is what identifies a log: its path below the log root plus its size. PX4's nested `<date>/<time>.ulg` layout and ArduPilot's flat `<number>.BIN` layout are both handled, and the file extension follows whatever the vehicle actually has.
+
+Log timestamps come from the modification time in the listing when the vehicle supports the `ListDirectoryWithTime` opcode (PX4 v1.17 and newer). Otherwise PX4 logs fall back to the start time encoded in the path, and ArduPilot logs have no timestamp — nothing depends on having one.
+
+Downloads are staged in a temporary directory and only moved next to the finished logs once the transferred size matches the listing, so a partial file is never mistaken for a complete one.
+
+### Upgrading from a pre-FTP logloader
+Older versions identified logs by the timestamp `LOG_ENTRY` reported, which MAVLink FTP cannot reproduce. On first start the existing `logs` table is renamed to `logs_legacy` and its rows are matched against the FTP listing by size, so logs already downloaded and uploaded are not fetched or uploaded a second time. Nothing is deleted; `logs_legacy` stays behind for inspection.
+
 ### Build
 Install dependencies
 ```
@@ -85,7 +102,7 @@ sudo iftop -i wlo1
 ```
 Or use a Wireshark filter
 ```
-mavlink_proto.msgid == 117 || mavlink_proto.msgid == 118 || mavlink_proto.msgid == 119 || mavlink_proto.msgid == 120
+mavlink_proto.msgid == 110
 ```
 
 Watch your beautiful logs arrive
diff --git a/config.toml b/config.toml
index ff208c2..af7db70 100644
--- a/config.toml
+++ b/config.toml
@@ -4,3 +4,12 @@ remote_server = "https://review.px4.io"
 email = ""
 upload_enabled = false
 public_logs = false
+
+# Vehicle log directory. Empty probes "@MAV_LOG" (the virtual log directory from
+# the MAVLink FTP specification), then "/fs/microsd/log" (PX4) and "/APM/LOGS"
+# (ArduPilot). Set this when the logs live somewhere else.
+remote_log_directory = ""
+
+# FTP burst reads. Much faster, disable it if the flight stack's burst support
+# misbehaves.
+ftp_use_burst = true
diff --git a/src/FtpListClient.cpp b/src/FtpListClient.cpp
new file mode 100644
index 0000000..3966b54
--- /dev/null
+++ b/src/FtpListClient.cpp
@@ -0,0 +1,251 @@
+#include "FtpListClient.hpp"
+#include "Log.hpp"
+
+#include <chrono>
+#include <cstring>
+
+namespace
+{
+
+constexpr int kMaxAttempts = 3;
+
+// Generous enough for a listing that has to come back over a telemetry link.
+// Servers answer a retransmitted request from their reply cache, so a retry
+// after a dropped packet is cheap.
+constexpr auto kReplyTimeout = std::chrono::milliseconds(2000);
+
+} // namespace
+
+FtpListClient::FtpListClient(std::shared_ptr<mavsdk::System> system)
+	: _passthrough(std::make_shared<mavsdk::MavlinkPassthrough>(system))
+{
+	_subscription = _passthrough->subscribe_message(MAVLINK_MSG_ID_FILE_TRANSFER_PROTOCOL,
+	[this](const mavlink_message_t& message) {
+		handle_message(message);
+	});
+}
+
+FtpListClient::~FtpListClient()
+{
+	_passthrough->unsubscribe_message(MAVLINK_MSG_ID_FILE_TRANSFER_PROTOCOL, _subscription);
+}
+
+void FtpListClient::stop()
+{
+	_should_exit = true;
+	_cv.notify_all();
+}
+
+void FtpListClient::reset_sessions()
+{
+	PayloadHeader reply;
+
+	if (transact(kOpcodeResetSessions, "", 0, reply)) {
+		LOG_DEBUG("FTP sessions reset");
+
+	} else {
+		LOG_DEBUG("FTP session reset went unanswered");
+	}
+}
+
+void FtpListClient::handle_message(const mavlink_message_t& message)
+{
+	mavlink_file_transfer_protocol_t ftp;
+	mavlink_msg_file_transfer_protocol_decode(&message, &ftp);
+
+	// The transfer runs unicast: the server addresses its replies to whoever
+	// asked. Anything not for us is another client's traffic.
+	if (ftp.target_system != _passthrough->get_our_sysid()) {
+		return;
+	}
+
+	if (ftp.target_component != _passthrough->get_our_compid() && ftp.target_component != 0) {
+		return;
+	}
+
+	PayloadHeader payload;
+	std::memcpy(&payload, ftp.payload, sizeof(payload));
+
+	if (payload.opcode != kOpcodeAck && payload.opcode != kOpcodeNak) {
+		return;
+	}
+
+	std::lock_guard<std::mutex> lock(_mutex);
+
+	// Match against the in-flight request so replies to MAVSDK's Ftp plugin
+	// (which shares our system and component id) are ignored.
+	if (!_expected_req_opcode.has_value() || payload.req_opcode != _expected_req_opcode.value()
+	    || payload.seq_number != _expected_seq) {
+		return;
+	}
+
+	_reply = payload;
+	_cv.notify_all();
+}
+
+void FtpListClient::send_request(const PayloadHeader& request)
+{
+	_passthrough->queue_message([this, request](MavlinkAddress address, uint8_t channel) {
+		mavlink_message_t message;
+		mavlink_msg_file_transfer_protocol_pack_chan(address.system_id, address.component_id, channel, &message,
+				0, // target_network
+				_passthrough->get_target_sysid(),
+				_passthrough->get_target_compid(),
+				reinterpret_cast<const uint8_t*>(&request));
+		return message;
+	});
+}
+
+bool FtpListClient::transact(uint8_t opcode, const std::string& path, uint32_t offset, PayloadHeader& reply)
+{
+	if (path.size() >= kMaxDataLength) {
+		return false;
+	}
+
+	PayloadHeader request {};
+	request.seq_number = ++_seq;
+	request.opcode = opcode;
+	request.offset = offset;
+	request.size = static_cast<uint8_t>(path.size() + 1);
+	std::memcpy(request.data, path.c_str(), path.size() + 1);
+
+	for (int attempt = 0; attempt < kMaxAttempts && !_should_exit; attempt++) {
+		{
+			std::lock_guard<std::mutex> lock(_mutex);
+			_reply.reset();
+			// Servers reply with the request sequence number plus one, and
+			// answer a retransmission (same sequence number) from their
+			// duplicate-reply cache, so retries reuse the packet as-is.
+			_expected_seq = static_cast<uint16_t>(request.seq_number + 1);
+			_expected_req_opcode = opcode;
+		}
+
+		send_request(request);
+
+		std::unique_lock<std::mutex> lock(_mutex);
+
+		if (_cv.wait_for(lock, kReplyTimeout, [this] { return _reply.has_value() || _should_exit.load(); })) {
+			_expected_req_opcode.reset();
+
+			if (_should_exit || !_reply.has_value()) {
+				return false;
+			}
+
+			reply = _reply.value();
+			return true;
+		}
+	}
+
+	std::lock_guard<std::mutex> lock(_mutex);
+	_expected_req_opcode.reset();
+
+	return false;
+}
+
+void FtpListClient::parse_entries(const PayloadHeader& reply, std::vector<Entry>& entries, uint32_t& next_offset)
+{
+	const size_t data_size = std::min(static_cast<size_t>(reply.size), kMaxDataLength);
+	size_t i = 0;
+
+	while (i < data_size) {
+		const char* raw = reinterpret_cast<const char*>(&reply.data[i]);
+		const size_t length = strnlen(raw, data_size - i);
+		i += length + 1;
+
+		// Every directory entry advances the server-side offset, including the
+		// "skip" placeholders it emits for entries it does not report.
+		next_offset++;
+
+		if (length < 2) {
+			continue;
+		}
+
+		const std::string body(raw + 1, length - 1);
+
+		if (raw[0] == 'D') {
+			Entry entry;
+			entry.name = body;
+			entry.is_directory = true;
+			entries.push_back(entry);
+
+		} else if (raw[0] == 'F') {
+			// "F<name>\t<size>" plus "\t<mtime>" from ListDirectoryWithTime
+			const size_t first_tab = body.find('\t');
+
+			if (first_tab == std::string::npos) {
+				continue;
+			}
+
+			Entry entry;
+			entry.name = body.substr(0, first_tab);
+
+			try {
+				const size_t second_tab = body.find('\t', first_tab + 1);
+				entry.size_bytes = static_cast<uint32_t>(std::stoul(body.substr(first_tab + 1)));
+
+				if (second_tab != std::string::npos) {
+					// The server reports zero when it does not know the time
+					const int64_t mtime = std::stoll(body.substr(second_tab + 1));
+
+					if (mtime > 0) {
+						entry.mtime_utc = mtime;
+					}
+				}
+
+			} catch (const std::exception&) {
+				continue;
+			}
+
+			entries.push_back(entry);
+		}
+	}
+}
+
+FtpListClient::Result FtpListClient::list_directory(const std::string& path, std::vector<Entry>& entries)
+{
+	entries.clear();
+
+	uint32_t offset = 0;
+
+	while (!_should_exit) {
+		const uint8_t opcode = _with_time_supported ? kOpcodeListDirectoryWithTime : kOpcodeListDirectory;
+
+		PayloadHeader reply;
+
+		if (!transact(opcode, path, offset, reply)) {
+			return _should_exit ? Result::Stopped : Result::Timeout;
+		}
+
+		if (reply.opcode == kOpcodeNak) {
+			const uint8_t error = reply.size > 0 ? reply.data[0] : 0;
+
+			if (error == kErrUnknownCommand && opcode == kOpcodeListDirectoryWithTime) {
+				LOG_DEBUG("ListDirectoryWithTime unsupported, falling back to ListDirectory");
+				_with_time_supported = false;
+				continue; // Same offset, plain opcode
+			}
+
+			if (error == kErrEOF) {
+				return Result::Success;
+			}
+
+			if (offset == 0 && (error == kErrFileNotFound || error == kErrFailErrno)) {
+				return Result::FileNotFound;
+			}
+
+			LOG_DEBUG("FTP list of " << path << " failed with error " << static_cast<int>(error)
+				  << " at offset " << offset);
+			return Result::ProtocolError;
+		}
+
+		const uint32_t previous_offset = offset;
+		parse_entries(reply, entries, offset);
+
+		// An ACK that advances nothing would loop forever; treat it as the end
+		if (offset == previous_offset) {
+			return Result::Success;
+		}
+	}
+
+	return Result::Stopped;
+}
diff --git a/src/FtpListClient.hpp b/src/FtpListClient.hpp
new file mode 100644
index 0000000..0c3d060
--- /dev/null
+++ b/src/FtpListClient.hpp
@@ -0,0 +1,114 @@
+#pragma once
+
+#include <mavsdk/system.h>
+#include <mavsdk/plugins/mavlink_passthrough/mavlink_passthrough.h>
+
+#include <atomic>
+#include <condition_variable>
+#include <cstdint>
+#include <memory>
+#include <mutex>
+#include <optional>
+#include <string>
+#include <vector>
+
+// Minimal MAVLink FTP client for directory listings.
+//
+// MAVSDK's Ftp plugin discards the size and modification-time fields from list
+// replies, but those are exactly what identifies a log file. This implements
+// ListDirectory / ListDirectoryWithTime over MavlinkPassthrough and keeps the
+// full entries. Bulk transfers still go through MAVSDK's Ftp plugin.
+//
+// Delete this once a MAVSDK release carries mavlink/MAVSDK#2891, which returns
+// listings as Ftp::FilesystemEntry (name, entry_type, size_bytes,
+// modification_time_s) and makes this redundant. It is on MAVSDK main but not
+// in any release up to v3.17.2.
+//
+// ListDirectoryWithTime is tried first and the client falls back to plain
+// ListDirectory when the server NAKs it with "unknown command" (ArduPilot and
+// PX4 releases before v1.17 do).
+//
+// One request is in flight at a time and requests are issued from a single
+// thread; only stop() may be called from another.
+class FtpListClient
+{
+public:
+	struct Entry {
+		std::string name;
+		bool is_directory {false};
+		uint32_t size_bytes {0};
+		std::optional<int64_t> mtime_utc; // Requires ListDirectoryWithTime support
+	};
+
+	enum class Result {
+		Success,
+		Timeout,      // No reply after retries, FTP likely disabled
+		FileNotFound, // Directory does not exist
+		ProtocolError,
+		Stopped
+	};
+
+	explicit FtpListClient(std::shared_ptr<mavsdk::System> system);
+	~FtpListClient();
+
+	// Closes any sessions a previous (possibly crashed) client left open on the
+	// vehicle. Best effort: PX4 only has a single FTP session and a stale one
+	// blocks transfers until it is reset.
+	void reset_sessions();
+
+	Result list_directory(const std::string& path, std::vector<Entry>& entries);
+
+	void stop();
+
+private:
+	// From the MAV_FTP_OPCODE enum in the MAVLink specification
+	static constexpr uint8_t kOpcodeResetSessions = 2;
+	static constexpr uint8_t kOpcodeListDirectory = 3;
+	static constexpr uint8_t kOpcodeListDirectoryWithTime = 16;
+	static constexpr uint8_t kOpcodeAck = 128;
+	static constexpr uint8_t kOpcodeNak = 129;
+
+	// From the MAV_FTP_ERR enum
+	static constexpr uint8_t kErrFailErrno = 2;
+	static constexpr uint8_t kErrEOF = 6;
+	static constexpr uint8_t kErrUnknownCommand = 7;
+	static constexpr uint8_t kErrFileNotFound = 10;
+
+	static constexpr size_t kMaxDataLength = 239;
+
+	// mavlink_file_transfer_protocol_t.payload is 251 bytes: this 12 byte
+	// header followed by kMaxDataLength bytes of data.
+	struct __attribute__((packed)) PayloadHeader {
+		uint16_t seq_number;
+		uint8_t session;
+		uint8_t opcode;
+		uint8_t size;
+		uint8_t req_opcode;
+		uint8_t burst_complete;
+		uint8_t padding;
+		uint32_t offset;
+		uint8_t data[kMaxDataLength];
+	};
+
+	static_assert(sizeof(PayloadHeader) == 251, "PayloadHeader must fill the FILE_TRANSFER_PROTOCOL payload");
+
+	void handle_message(const mavlink_message_t& message);
+	bool transact(uint8_t opcode, const std::string& path, uint32_t offset, PayloadHeader& reply);
+	void send_request(const PayloadHeader& request);
+
+	static void parse_entries(const PayloadHeader& reply, std::vector<Entry>& entries, uint32_t& next_offset);
+
+	std::shared_ptr<mavsdk::MavlinkPassthrough> _passthrough;
+	mavsdk::MavlinkPassthrough::MessageHandle _subscription;
+
+	std::mutex _mutex;
+	std::condition_variable _cv;
+	std::optional<PayloadHeader> _reply;
+	uint16_t _expected_seq {0};
+	std::optional<uint8_t> _expected_req_opcode;
+
+	uint16_t _seq {0};
+	bool _with_time_supported {true}; // Optimistic until the server NAKs it
+
+	std::atomic<bool> _should_exit {false};
+};
diff --git a/src/FtpLogFetcher.cpp b/src/FtpLogFetcher.cpp
new file mode 100644
index 0000000..48bbc72
--- /dev/null
+++ b/src/FtpLogFetcher.cpp
@@ -0,0 +1,324 @@
+#include "FtpLogFetcher.hpp"
+#include "Log.hpp"
+
+#include <algorithm>
+#include <cctype>
+#include <chrono>
+#include <cstring>
+#include <ctime>
+#include <filesystem>
+#include <future>
+
+namespace fs = std::filesystem;
+
+namespace
+{
+
+// "@MAV_LOG" is the virtual log directory from the MAVLink FTP specification
+// (PX4 >= v1.17). The physical paths cover firmware that predates it.
+constexpr const char* kProbeRoots[] = {
+	"@MAV_LOG",
+	"/fs/microsd/log", // PX4
+	"/APM/LOGS",       // ArduPilot
+};
+
+bool ends_with_ignore_case(const std::string& text, const std::string& suffix)
+{
+	if (text.size() < suffix.size()) {
+		return false;
+	}
+
+	const size_t offset = text.size() - suffix.size();
+
+	for (size_t i = 0; i < suffix.size(); i++) {
+		if (std::tolower(static_cast<unsigned char>(text[offset + i]))
+		    != std::tolower(static_cast<unsigned char>(suffix[i]))) {
+			return false;
+		}
+	}
+
+	return true;
+}
+
+bool is_log_file(const std::string& name)
+{
+	return ends_with_ignore_case(name, ".ulg") || ends_with_ignore_case(name, ".bin");
+}
+
+// PX4 writes logs as <root>/<YYYY-MM-DD>/<HH_MM_SS>.ulg. The parsed time is the
+// log start; used when the vehicle cannot report modification times.
+std::optional<int64_t> parse_px4_start_time(const std::string& directory, const std::string& filename)
+{
+	const std::string stem = fs::path(filename).stem().string();
+
+	if (directory.size() != 10 || stem.size() != 8) {
+		return std::nullopt;
+	}
+
+	std::tm tm {};
+
+	if (sscanf(directory.c_str(), "%4d-%2d-%2d", &tm.tm_year, &tm.tm_mon, &tm.tm_mday) != 3) {
+		return std::nullopt;
+	}
+
+	if (sscanf(stem.c_str(), "%2d_%2d_%2d", &tm.tm_hour, &tm.tm_min, &tm.tm_sec) != 3) {
+		return std::nullopt;
+	}
+
+	tm.tm_year -= 1900;
+	tm.tm_mon -= 1;
+
+	return static_cast<int64_t>(timegm(&tm));
+}
+
+std::string join_path(const std::string& directory, const std::string& name)
+{
+	if (!directory.empty() && directory.back() == '/') {
+		return directory + name;
+	}
+
+	return directory + "/" + name;
+}
+
+} // namespace
+
+FtpLogFetcher::FtpLogFetcher(std::shared_ptr<mavsdk::System> system, const FtpLogFetcher::Settings& settings)
+	: _list_client(std::make_shared<FtpListClient>(system))
+	, _ftp(std::make_shared<mavsdk::Ftp>(system))
+	, _settings(settings)
+{
+	std::error_code ec;
+	fs::create_directories(_settings.temp_directory, ec);
+}
+
+void FtpLogFetcher::stop()
+{
+	_should_exit = true;
+	_list_client->stop();
+}
+
+void FtpLogFetcher::reset_sessions()
+{
+	_list_client->reset_sessions();
+}
+
+bool FtpLogFetcher::refresh()
+{
+	if (_root.empty()) {
+		// The override, when set, is the only candidate
+		std::vector<std::string> roots;
+
+		if (_settings.remote_directory.empty()) {
+			roots.assign(std::begin(kProbeRoots), std::end(kProbeRoots));
+
+		} else {
+			roots.push_back(_settings.remote_directory);
+		}
+
+		for (const auto& root : roots) {
+			std::vector<RemoteLog> logs;
+
+			if (build_index(root, logs)) {
+				_root = root;
+				publish_index(std::move(logs));
+				_reported_unavailable = false;
+				LOG("MAVLink FTP available, indexed " << _logs.size() << " logs in " << _root);
+				return true;
+			}
+		}
+
+		if (!_reported_unavailable) {
+			LOG("Could not index vehicle logs over MAVLink FTP. "
+			    "Make sure the autopilot has MAVLink FTP enabled on this link.");
+			_reported_unavailable = true;
+		}
+
+		return false;
+	}
+
+	std::vector<RemoteLog> logs;
+
+	if (build_index(_root, logs)) {
+		publish_index(std::move(logs));
+		return true;
+	}
+
+	// The directory may have moved out from under us (SD card swap, firmware
+	// update). Forget the root so the next refresh probes again.
+	LOG_DEBUG("Re-indexing " << _root << " failed, will re-probe");
+	_root.clear();
+	_logs.clear();
+
+	return false;
+}
+
+void FtpLogFetcher::publish_index(std::vector<RemoteLog>&& logs)
+{
+	std::map<std::string, uint32_t> sizes;
+
+	for (auto& log : logs) {
+		auto previous = _previous_sizes.find(log.relative_path);
+		log.stable = previous != _previous_sizes.end() && previous->second == log.size_bytes;
+		sizes.emplace(log.relative_path, log.size_bytes);
+	}
+
+	_previous_sizes = std::move(sizes);
+	_logs = std::move(logs);
+}
+
+bool FtpLogFetcher::build_index(const std::string& root, std::vector<RemoteLog>& logs)
+{
+	std::vector<FtpListClient::Entry> entries;
+
+	if (_list_client->list_directory(root, entries) != FtpListClient::Result::Success) {
+		return false;
+	}
+
+	std::vector<std::string> subdirectories;
+
+	for (const auto& entry : entries) {
+		if (entry.is_directory) {
+			if (entry.name != "." && entry.name != "..") {
+				subdirectories.push_back(entry.name);
+			}
+
+		} else if (is_log_file(entry.name)) {
+			RemoteLog log;
+			log.relative_path = entry.name;
+			log.size_bytes = entry.size_bytes;
+			log.time_utc = entry.mtime_utc;
+			logs.push_back(log);
+		}
+	}
+
+	// PX4 nests logs one directory deep (<root>/<date>/<time>.ulg). A partial
+	// index would make missing logs look deleted, so any listing failure fails
+	// the whole refresh.
+	for (const auto& subdirectory : subdirectories) {
+		if (_should_exit) {
+			return false;
+		}
+
+		std::vector<FtpListClient::Entry> sub_entries;
+
+		if (_list_client->list_directory(join_path(root, subdirectory), sub_entries)
+		    != FtpListClient::Result::Success) {
+			LOG_DEBUG("Listing " << join_path(root, subdirectory) << " failed");
+			return false;
+		}
+
+		for (const auto& entry : sub_entries) {
+			if (entry.is_directory || !is_log_file(entry.name)) {
+				continue;
+			}
+
+			RemoteLog log;
+			log.relative_path = subdirectory + "/" + entry.name;
+			log.size_bytes = entry.size_bytes;
+			log.time_utc = entry.mtime_utc;
+
+			if (!log.time_utc.has_value()) {
+				log.time_utc = parse_px4_start_time(subdirectory, entry.name);
+			}
+
+			logs.push_back(log);
+		}
+	}
+
+	return true;
+}
+
+bool FtpLogFetcher::download(const RemoteLog& log, const std::string& local_path,
+			     const FtpLogFetcher::ProgressCallback& progress)
+{
+	std::error_code ec;
+	fs::create_directories(_settings.temp_directory, ec);
+
+	const std::string remote_path = join_path(_root, log.relative_path);
+
+	// MAVSDK writes to <local_dir>/<remote basename>, so stage the transfer and
+	// move it into place afterwards. A partial file never appears in the logs
+	// directory.
+	const std::string staged_path = join_path(_settings.temp_directory, fs::path(log.relative_path).filename().string());
+	fs::remove(staged_path, ec);
+
+	struct Transfer {
+		std::promise<mavsdk::Ftp::Result> promise;
+		std::atomic<bool> settled {false};
+	};
+
+	// Shared so the callback stays valid if we abandon the wait on shutdown
+	auto transfer = std::make_shared<Transfer>();
+	auto future_result = transfer->promise.get_future();
+
+	_ftp->download_async(remote_path, _settings.temp_directory, _settings.use_burst,
+	[transfer, progress](mavsdk::Ftp::Result result, mavsdk::Ftp::ProgressData data) {
+		if (transfer->settled) {
+			return;
+		}
+
+		if (result == mavsdk::Ftp::Result::Next) {
+			if (progress) {
+				progress(data.bytes_transferred, data.total_bytes);
+			}
+
+			return;
+		}
+
+		transfer->settled = true;
+		transfer->promise.set_value(result);
+	});
+
+	// MAVSDK offers no way to cancel the transfer, so on shutdown the wait is
+	// abandoned instead of blocking until MAVSDK times out on its own.
+	while (future_result.wait_for(std::chrono::milliseconds(500)) != std::future_status::ready) {
+		if (_should_exit) {
+			transfer->settled = true;
+			fs::remove(staged_path, ec);
+			return false;
+		}
+	}
+
+	const auto result = future_result.get();
+
+	if (result != mavsdk::Ftp::Result::Success) {
+		LOG("FTP download of " << remote_path << " failed: " << result);
+		fs::remove(staged_path, ec);
+		return false;
+	}
+
+	if (!fs::exists(staged_path)) {
+		LOG("FTP reported success but " << staged_path << " is missing");
+		return false;
+	}
+
+	const uint32_t downloaded_size = static_cast<uint32_t>(fs::file_size(staged_path, ec));
+
+	if (downloaded_size != log.size_bytes) {
+		// The log grew or was rotated since the listing; the next refresh will
+		// index the current state.
+		LOG("Size mismatch for " << remote_path << ": got " << downloaded_size
+		    << " bytes, expected " << log.size_bytes);
+		fs::remove(staged_path, ec);
+		return false;
+	}
+
+	fs::remove(local_path, ec);
+	ec.clear();
+	fs::rename(staged_path, local_path, ec);
+
+	if (ec) {
+		// Different filesystems, fall back to a copy
+		ec.clear();
+		fs::copy_file(staged_path, local_path, fs::copy_options::overwrite_existing, ec);
+		std::error_code remove_ec;
+		fs::remove(staged_path, remove_ec);
+
+		if (ec) {
+			LOG("Failed to move " << staged_path << " to " << local_path << ": " << ec.message());
+			return false;
+		}
+	}
+
+	return true;
+}
diff --git a/src/FtpLogFetcher.hpp b/src/FtpLogFetcher.hpp
new file mode 100644
index 0000000..097401a
--- /dev/null
+++ b/src/FtpLogFetcher.hpp
@@ -0,0 +1,96 @@
+#pragma once
+
+#include <mavsdk/system.h>
+#include <mavsdk/plugins/ftp/ftp.h>
+
+#include <atomic>
+#include <cstdint>
+#include <functional>
+#include <map>
+#include <memory>
+#include <optional>
+#include <string>
+#include <vector>
+
+#include "FtpListClient.hpp"
+
+// Indexes and downloads flight logs over MAVLink FTP.
+//
+// FILE_TRANSFER_PROTOCOL (msg 110) is addressed, and both PX4 and ArduPilot
+// send replies back to the requesting sysid/compid, so everything here is
+// unicast between the vehicle and logloader. The classic log protocol's
+// LOG_ENTRY / LOG_DATA (msgs 118/120) carry no target fields, which forces a
+// router in between to copy them to every endpoint it serves; logloader does
+// not use it at all.
+//
+// The vehicle log directory is probed at "@MAV_LOG" (the virtual directory the
+// MAVLink FTP spec defines for exactly this), then at the physical locations
+// used by PX4 and ArduPilot.
+class FtpLogFetcher
+{
+public:
+	struct RemoteLog {
+		// Path below the log root. The root can change (e.g. a firmware update
+		// that adds @MAV_LOG support), the relative path cannot, so identity is
+		// derived from this plus the size.
+		std::string relative_path;
+		uint32_t size_bytes {0};
+		// Modification time when the vehicle supports ListDirectoryWithTime,
+		// otherwise the start time PX4 encodes in the path, otherwise unknown.
+		std::optional<int64_t> time_utc;
+		// False while the file is still growing, i.e. the log the vehicle is
+		// writing right now. See refresh().
+		bool stable {false};
+	};
+
+	struct Settings {
+		std::string temp_directory;   // Scratch space for in-progress transfers
+		std::string remote_directory; // Empty probes the known locations
+		bool use_burst {true};
+	};
+
+	using ProgressCallback = std::function<void(uint32_t bytes_transferred, uint32_t total_bytes)>;
+
+	FtpLogFetcher(std::shared_ptr<mavsdk::System> system, const Settings& settings);
+
+	// Closes any FTP session a previous run left open on the vehicle
+	void reset_sessions();
+
+	// (Re)indexes the vehicle log directory, probing for it first when it is
+	// not known yet. Returns true only when a complete index was built, so a
+	// missing log can be trusted to actually be gone from the vehicle.
+	//
+	// A log is marked stable once two consecutive listings agree on its size.
+	// The log the vehicle is currently writing keeps growing, and downloading
+	// it would only produce a file that no longer matches what was listed.
+	bool refresh();
+
+	bool available() const { return !_root.empty(); }
+	const std::string& root() const { return _root; }
+	const std::vector<RemoteLog>& logs() const { return _logs; }
+
+	// Downloads a log into local_path, staging the transfer in temp_directory
+	// so partial files never appear next to finished ones. The size reported by
+	// the directory listing must match or the download is discarded.
+	bool download(const RemoteLog& log, const std::string& local_path, const ProgressCallback& progress);
+
+	void stop();
+
+private:
+	bool build_index(const std::string& root, std::vector<RemoteLog>& logs);
+	void publish_index(std::vector<RemoteLog>&& logs);
+
+	std::shared_ptr<FtpListClient> _list_client;
+	std::shared_ptr<mavsdk::Ftp> _ftp;
+	Settings _settings;
+
+	std::string _root;
+	std::vector<RemoteLog> _logs;
+
+	// Sizes from the previous listing, keyed by relative path
+	std::map<std::string, uint32_t> _previous_sizes;
+
+	bool _reported_unavailable {false};
+
+	std::atomic<bool> _should_exit {false};
+};
diff --git a/src/LogLoader.cpp b/src/LogLoader.cpp
index 357b0fe..62a4782 100644
--- a/src/LogLoader.cpp
+++ b/src/LogLoader.cpp
@@ -1,13 +1,30 @@
 #include "LogLoader.hpp"
 #include "Log.hpp"
-#include <iostream>
+
+#include <algorithm>
+#include <chrono>
+#include <ctime>
 #include <filesystem>
-#include <future>
-#include <regex>
-#include <fstream>
+#include <iomanip>
+#include <iostream>
 
 namespace fs = std::filesystem;
 
+namespace
+{
+
+std::string iso8601_utc(int64_t time_utc)
+{
+	char buffer[sizeof "2018-08-31T20:50:42Z"];
+	const time_t as_time_t = static_cast<time_t>(time_utc);
+	std::tm tm {};
+	gmtime_r(&as_time_t, &tm);
+	strftime(buffer, sizeof(buffer), "%FT%TZ", &tm);
+	return buffer;
+}
+
+} // namespace
+
 LogLoader::LogLoader(const LogLoader::Settings& settings)
 	: _settings(settings)
 {
@@ -19,6 +36,10 @@ LogLoader::LogLoader(const LogLoader::Settings& settings)
 
 	_logs_directory = _settings.application_directory + "logs/";
 
+	// Both databases live in the application directory, so it has to exist
+	// before the server interfaces open them
+	fs::create_directories(_logs_directory);
+
 	// Setup local server interface
 	ServerInterface::Settings local_server_settings = {
 		.server_url = settings.local_server,
@@ -43,8 +64,6 @@ LogLoader::LogLoader(const LogLoader::Settings& settings)
 	_remote_server = std::make_shared<ServerInterface>(remote_server_settings);
 
 	std::cout << std::fixed << std::setprecision(8);
-
-	fs::create_directories(_logs_directory);
 }
 
 void LogLoader::stop()
@@ -54,6 +73,17 @@ void LogLoader::stop()
 		_should_exit = true;
 	}
 	_exit_cv.notify_all();
+
+	if (_ftp_fetcher) {
+		_ftp_fetcher->stop();
+	}
+}
+
+bool LogLoader::wait_for(std::chrono::seconds duration)
+{
+	std::unique_lock<std::mutex> lock(_exit_cv_mutex);
+	_exit_cv.wait_for(lock, duration, [this] { return _should_exit.load(); });
+	return _should_exit;
 }
 
 bool LogLoader::wait_for_mavsdk_connection(double timeout_ms)
@@ -78,9 +108,20 @@ bool LogLoader::wait_for_mavsdk_connection(double timeout_ms)
 	LOG("Connected.");
 
 	// MAVSDK plugins
-	_log_files = std::make_shared<mavsdk::LogFiles>(system.value());
 	_telemetry = std::make_shared<mavsdk::Telemetry>(system.value());
 
+	FtpLogFetcher::Settings ftp_settings = {
+		.temp_directory = _settings.application_directory + "tmp/",
+		.remote_directory = _settings.remote_log_directory,
+		.use_burst = _settings.ftp_use_burst,
+	};
+
+	_ftp_fetcher = std::make_shared<FtpLogFetcher>(system.value(), ftp_settings);
+
+	// PX4 serves a single FTP session, so one left open by a previous run (a
+	// hard kill mid-transfer) blocks every transfer until the vehicle reboots.
+	_ftp_fetcher->reset_sessions();
+
 	return true;
 }
 
@@ -110,29 +151,19 @@ void LogLoader::run()
 			std::this_thread::sleep_for(std::chrono::seconds(3));
 		}
 
-		// TODO:
-		// - request log entries at boot after connecting only
-		// - during runtime gate the log entry request on logger on/off events
-		if (!request_log_entries()) {
-			LOG_DEBUG("Failed to get logs");
-			std::this_thread::sleep_for(std::chrono::seconds(5));
+		if (!refresh_log_index()) {
+			if (wait_for(std::chrono::seconds(5))) {
+				break;
+			}
+
 			continue;
 		}
 
-		uint32_t total_to_download = _local_server->num_logs_to_download();
-		uint32_t num_remaining = total_to_download;
-
-		while (!_should_exit && num_remaining) {
-			// Download logs until we should exit or there are none left to download
-			LOG("Downloading log " << total_to_download - num_remaining + 1 << "/" << total_to_download);
-			download_next_log();
-			num_remaining = _local_server->num_logs_to_download();
-		}
+		download_pending_logs();
 
-		// Periodically request log list
-		if (!_should_exit) {
-			std::unique_lock<std::mutex> lock(_exit_cv_mutex);
-			_exit_cv.wait_for(lock, std::chrono::seconds(30), [this] { return _should_exit.load(); });
+		// Periodically re-index the vehicle
+		if (wait_for(std::chrono::seconds(30))) {
+			break;
 		}
 	}
 
@@ -140,150 +171,180 @@ void LogLoader::run()
 	upload_thread.join();
 }
 
-bool LogLoader::request_log_entries()
+bool LogLoader::refresh_log_index()
 {
-	LOG_DEBUG("Requesting log entries...");
+	auto request_start = std::chrono::steady_clock::now();
 
-	// Debug profiling code. We need to check how this performs with 100+ logs
-	auto request_start = std::chrono::high_resolution_clock::now();
-	auto entries_result = _log_files->get_entries();
+	if (!_ftp_fetcher->refresh()) {
+		return false;
+	}
 
-	//  Store log entries
-	_log_entries = entries_result.second;
+	const auto& logs = _ftp_fetcher->logs();
+	size_t growing = 0;
 
-	auto request_end = std::chrono::high_resolution_clock::now();
+	for (const auto& log : logs) {
+		if (!log.stable) {
+			// Almost certainly the log being written right now. Leave it out of
+			// the databases entirely until it stops changing, so it never
+			// enters the download queue at a size it will not keep.
+			growing++;
+			continue;
+		}
 
-	std::chrono::duration<double> request_duration = request_end - request_start;
-	LOG_DEBUG("Received " << _log_entries.size() << "log entries in " << request_duration.count() << " seconds");
+		ServerInterface::LogEntry entry;
+		entry.remote_path = log.relative_path;
+		entry.size_bytes = log.size_bytes;
+		entry.date = log.time_utc.has_value() ? iso8601_utc(log.time_utc.value()) : "";
+		entry.uuid = ServerInterface::generate_uuid(entry.remote_path, entry.size_bytes);
 
-	if (entries_result.first != mavsdk::LogFiles::Result::Success) {
-		LOG("Error getting log entries");
-		return false;
+		_local_server->sync_log(entry);
+		_remote_server->sync_log(entry);
 	}
 
-	// Time the database addition
-	auto db_start = std::chrono::high_resolution_clock::now();
-
-	for (const auto& entry : _log_entries) {
-		_local_server->add_log_entry(entry);
-		_remote_server->add_log_entry(entry);
-	}
+	std::chrono::duration<double> duration = std::chrono::steady_clock::now() - request_start;
+	LOG_DEBUG("Indexed " << logs.size() - growing << " of " << logs.size() << " logs in "
+		  << duration.count() << " seconds (" << growing << " still being written)");
 
-	auto db_end = std::chrono::high_resolution_clock::now();
-	std::chrono::duration<double> db_duration = db_end - db_start;
+	return true;
+}
 
-	LOG_DEBUG("Added log entries to databases in " << db_duration.count() << " seconds");
-	LOG_DEBUG("Total processing time: " << (request_duration + db_duration).count() << " seconds");
+const FtpLogFetcher::RemoteLog* LogLoader::find_remote_log(const ServerInterface::DatabaseEntry& db_entry) const
+{
+	for (const auto& log : _ftp_fetcher->logs()) {
+		if (log.relative_path == db_entry.remote_path && log.size_bytes == db_entry.size_bytes) {
+			return &log;
+		}
+	}
 
-	return true;
+	return nullptr;
 }
 
-void LogLoader::download_next_log()
+void LogLoader::download_pending_logs()
 {
-	// Get one undownloaded log, use the local server for query
-	ServerInterface::DatabaseEntry db_entry = _local_server->get_next_log_to_download();
+	auto pending = _local_server->get_logs_to_download();
 
-	if (db_entry.uuid.empty()) {
+	if (pending.empty()) {
 		return;
 	}
 
-	// Find the corresponding log entry in the list from the vehicle
-	for (const auto& entry : _log_entries) {
-		// Match by UUID (which is based on date and size)
-		std::string uuid = ServerInterface::generate_uuid(entry);
+	// Retry the logs that have failed the least first, so a file that cannot be
+	// fetched never blocks the ones behind it.
+	std::stable_sort(pending.begin(), pending.end(),
+	[this](const ServerInterface::DatabaseEntry & lhs, const ServerInterface::DatabaseEntry & rhs) {
+		auto lhs_it = _download_failures.find(lhs.uuid);
+		auto rhs_it = _download_failures.find(rhs.uuid);
+		const int lhs_failures = lhs_it == _download_failures.end() ? 0 : lhs_it->second;
+		const int rhs_failures = rhs_it == _download_failures.end() ? 0 : rhs_it->second;
+		return lhs_failures < rhs_failures;
+	});
 
-		if (uuid == db_entry.uuid) {
-			if (download_log(entry)) {
-				// Update downloaded status in both databases
-				_local_server->update_download_status(uuid, true);
-				_remote_server->update_download_status(uuid, true);
-			}
+	size_t index = 0;
 
+	for (const auto& db_entry : pending) {
+		if (_should_exit) {
 			return;
 		}
-	}
 
-	// Couldn't find matching entry in _log_entries
-	// This could happen if the log is no longer available on the vehicle
-	// Mark it as processed to avoid trying again in both databases
-	_local_server->update_download_status(db_entry.uuid, true);
-	_remote_server->update_download_status(db_entry.uuid, true);
+		// Downloading competes with the logger for the SD card, so give the
+		// rest of the queue back to the outer loop as soon as the vehicle arms
+		if (_telemetry->armed()) {
+			LOG("Vehicle armed, pausing downloads");
+			return;
+		}
 
-	return;
-}
+		index++;
 
-bool LogLoader::download_log(const mavsdk::LogFiles::Entry& entry)
-{
-	auto prom = std::promise<mavsdk::LogFiles::Result> {};
-	auto future_result = prom.get_future();
-	auto download_path = _local_server->filepath_from_entry(entry);
+		const FtpLogFetcher::RemoteLog* log = find_remote_log(db_entry);
 
-	// Check and delete file if it already exists. This can occur due to partial download.
-	if (fs::exists(download_path)) {
-		LOG("Found existing file, removing: " << download_path);
+		if (log == nullptr) {
+			// The index is only published when the whole directory listed, so
+			// a log that is not in it is genuinely gone from the vehicle.
+			LOG_DEBUG("Log " << db_entry.remote_path << " is no longer on the vehicle, forgetting it");
+			_local_server->delete_log(db_entry.uuid);
+			_remote_server->delete_log(db_entry.uuid);
+			continue;
+		}
+
+		LOG("Downloading log " << index << "/" << pending.size() << ": " << db_entry.remote_path);
 
-		try {
-			fs::remove(download_path);
+		if (download_log(db_entry, *log)) {
+			_download_failures.erase(db_entry.uuid);
 
-		} catch (const fs::filesystem_error& e) {
-			LOG("Error removing existing file: " << e.what());
-			return false;
+		} else {
+			_download_failures[db_entry.uuid]++;
 		}
 	}
+}
+
+std::string LogLoader::local_path_for(const ServerInterface::DatabaseEntry& db_entry)
+{
+	std::string name = db_entry.remote_path;
+	std::replace(name.begin(), name.end(), '/', '_');
+
+	const std::string path = _logs_directory + name;
+
+	// ArduPilot reuses log file names once its numbering wraps at
+	// LOG_MAX_FILES, so the name may already belong to a log we still have.
+	if (_local_server->local_path_in_use(path, db_entry.uuid)) {
+		return _logs_directory + db_entry.uuid.substr(0, 8) + "_" + name;
+	}
 
-	LOG("Downloading " << download_path);
+	return path;
+}
+
+bool LogLoader::download_log(const ServerInterface::DatabaseEntry& db_entry, const FtpLogFetcher::RemoteLog& log)
+{
+	const std::string local_path = local_path_for(db_entry);
 
 	auto time_start = std::chrono::steady_clock::now();
 
-	_log_files->download_log_file_async(
-		entry,
-		download_path,
-	[&prom, &entry, &time_start, this](mavsdk::LogFiles::Result result, mavsdk::LogFiles::ProgressData progress) {
+	FtpLogFetcher::ProgressCallback progress;
 
-		if (_download_cancelled) return;
+#ifdef DEBUG_BUILD
+	// Held by the callback rather than captured by reference: MAVSDK owns the
+	// callback and this function returns without it on shutdown.
+	auto last_print = std::make_shared<std::chrono::steady_clock::time_point>(time_start);
 
-		auto now = std::chrono::steady_clock::now();
+	progress = [remote_path = db_entry.remote_path, size_bytes = db_entry.size_bytes, time_start, last_print](
+	uint32_t bytes_transferred, uint32_t total_bytes) {
+		const auto now = std::chrono::steady_clock::now();
 
-		if (_should_exit) {
-			_download_cancelled = true;
-			prom.set_value(mavsdk::LogFiles::Result::Timeout);
-			std::cout << std::endl << "Download cancelled.. exiting" << std::endl;
+		// One line per chunk buries everything else in the journal
+		if (now - *last_print < std::chrono::seconds(1)) {
 			return;
 		}
 
-#ifdef DEBUG_BUILD
-		// Calculate data rate in Kbps
-		double rate_kbps = ((progress.progress * entry.size_bytes * 8.0)) / std::chrono::duration_cast<std::chrono::milliseconds>(now -
-				   time_start).count(); // Convert bytes to bits and then to Kbps
+		*last_print = now;
+
+		auto elapsed_ms = std::chrono::duration_cast<std::chrono::milliseconds>(now - time_start).count();
+		double rate_kbps = elapsed_ms > 0 ? (bytes_transferred * 8.0) / elapsed_ms : 0.;
+		int percent = total_bytes > 0 ? int((100.0 * bytes_transferred) / total_bytes) : 0;
 
 		LOG_DEBUG("Downloading: "
-			  << std::setw(24) << std::left << entry.date
-			  << std::setw(8) << std::fixed << std::setprecision(2) << entry.size_bytes / 1e6 << "MB"
-			  << std::setw(6) << std::right << int(progress.progress * 100.0f) << "%"
+			  << std::setw(24) << std::left << remote_path
+			  << std::setw(8) << std::fixed << std::setprecision(2) << size_bytes / 1e6 << "MB"
+			  << std::setw(6) << std::right << percent << "%"
 			  << std::setw(12) << std::fixed << std::setprecision(2) << rate_kbps << " Kbps"
 			  << std::flush);
-#else
-		(void)progress;
+	};
 #endif
 
-		if (result != mavsdk::LogFiles::Result::Next) {
-			double seconds = std::chrono::duration_cast<std::chrono::milliseconds>(now - time_start).count() / 1000.;
-			LOG("Finished in " << std::setprecision(2) << seconds << " seconds");
-			prom.set_value(result);
-		}
-	});
-
-	auto result = future_result.get();
-
-	std::cout << std::endl;
-
-	bool success = result == mavsdk::LogFiles::Result::Success;
+	bool success = _ftp_fetcher->download(log, local_path, progress);
 
 	if (!success) {
 		LOG("Download failed");
+		return false;
 	}
 
-	return success;
+	double seconds = std::chrono::duration_cast<std::chrono::milliseconds>(
+				 std::chrono::steady_clock::now() - time_start).count() / 1000.;
+	LOG("Finished in " << std::setprecision(2) << seconds << " seconds");
+
+	// Update downloaded status in both databases
+	_local_server->update_download_status(db_entry.uuid, local_path, true);
+	_remote_server->update_download_status(db_entry.uuid, local_path, true);
+
+	return true;
 }
 
 void LogLoader::upload_logs_thread()
@@ -339,7 +400,7 @@ void LogLoader::upload_pending_logs(std::shared_ptr<ServerInterface> server)
 			return;
 		}
 
-		ServerInterface::UploadResult result = server->upload_log(filepath);
+		ServerInterface::UploadResult result = server->upload_log(log_entry.uuid, filepath);
 
 		if (result.success) {
 			LOG("Log upload SUCCESS: " << result.message);
@@ -350,6 +411,8 @@ void LogLoader::upload_pending_logs(std::shared_ptr<ServerInterface> server)
 		} else {
 			LOG("Log upload TEMPORARILY FAILED (" << result.status_code << "): "
 			    << result.message << " - Will retry later");
+			// Retry on the next pass rather than hammering an unhappy server
+			return;
 		}
 	}
 }
diff --git a/src/LogLoader.hpp b/src/LogLoader.hpp
index 0f2df34..67edbb3 100644
--- a/src/LogLoader.hpp
+++ b/src/LogLoader.hpp
@@ -2,10 +2,11 @@
 
 #include <mavsdk/mavsdk.h>
 #include <mavsdk/plugins/telemetry/telemetry.h>
-#include <mavsdk/plugins/log_files/log_files.h>
 #include <mavsdk/log_callback.h>
 #include <condition_variable>
+#include <map>
 
+#include "FtpLogFetcher.hpp"
 #include "ServerInterface.hpp"
 
 class LogLoader
@@ -19,6 +20,8 @@ class LogLoader
 		std::string application_directory;
 		bool upload_enabled;
 		bool public_logs;
+		std::string remote_log_directory; // Empty probes the known locations
+		bool ftp_use_burst;
 	};
 
 	LogLoader(const Settings& settings);
@@ -29,14 +32,19 @@ class LogLoader
 
 private:
 	// Download
-	bool request_log_entries();
-	void download_next_log();
-	bool download_log(const mavsdk::LogFiles::Entry& entry);
+	bool refresh_log_index();
+	void download_pending_logs();
+	bool download_log(const ServerInterface::DatabaseEntry& db_entry, const FtpLogFetcher::RemoteLog& log);
+	const FtpLogFetcher::RemoteLog* find_remote_log(const ServerInterface::DatabaseEntry& db_entry) const;
+	std::string local_path_for(const ServerInterface::DatabaseEntry& db_entry);
 
 	// Upload
 	void upload_logs_thread();
 	void upload_pending_logs(std::shared_ptr<ServerInterface> server);
 
+	// Returns true if we should exit
+	bool wait_for(std::chrono::seconds duration);
+
 	Settings _settings;
 	std::string _logs_directory;
 
@@ -46,11 +54,14 @@ class LogLoader
 
 	std::shared_ptr<mavsdk::Mavsdk> _mavsdk;
 	std::shared_ptr<mavsdk::Telemetry> _telemetry;
-	std::shared_ptr<mavsdk::LogFiles> _log_files;
-	std::vector<mavsdk::LogFiles::Entry> _log_entries;
+	std::shared_ptr<FtpLogFetcher> _ftp_fetcher;
+
+	// Consecutive download failures per log. A file the vehicle will not part
+	// with (a very large one that keeps timing out, say) is retried last so it
+	// cannot hold up everything behind it.
+	std::map<std::string, int> _download_failures;
 
 	std::atomic<bool> _should_exit = false;
-	std::atomic<bool> _download_cancelled = false;
 
 	std::condition_variable _exit_cv;
 	std::mutex _exit_cv_mutex;
diff --git a/src/ServerInterface.cpp b/src/ServerInterface.cpp
index 554893b..6e78ac4 100644
--- a/src/ServerInterface.cpp
+++ b/src/ServerInterface.cpp
@@ -7,6 +7,7 @@
 #include <chrono>
 #include <ctime>
 #include <iomanip>
+#include <optional>
 #include <sstream>
 #include <functional>
 #define CPPHTTPLIB_OPENSSL_SUPPORT
@@ -14,6 +15,26 @@
 
 namespace fs = std::filesystem;
 
+namespace
+{
+
+std::optional<int64_t> parse_iso8601_utc(const std::string& text)
+{
+	std::tm tm {};
+
+	if (sscanf(text.c_str(), "%4d-%2d-%2dT%2d:%2d:%2dZ",
+		   &tm.tm_year, &tm.tm_mon, &tm.tm_mday, &tm.tm_hour, &tm.tm_min, &tm.tm_sec) != 6) {
+		return std::nullopt;
+	}
+
+	tm.tm_year -= 1900;
+	tm.tm_mon -= 1;
+
+	return static_cast<int64_t>(timegm(&tm));
+}
+
+} // namespace
+
 ServerInterface::ServerInterface(const ServerInterface::Settings& settings)
 	: _settings(settings)
 {
@@ -69,11 +90,11 @@ void ServerInterface::stop()
 	_should_exit = true;
 }
 
-std::string ServerInterface::generate_uuid(const mavsdk::LogFiles::Entry& entry)
+std::string ServerInterface::generate_uuid(const std::string& remote_path, uint32_t size_bytes)
 {
-	// Create a unique identifier based on date and size
+	// Create a unique identifier based on the remote path and size
 	std::stringstream ss;
-	ss << entry.date << "_" << entry.size_bytes;
+	ss << remote_path << "_" << size_bytes;
 
 	// Use a simple hash for the UUID
 	std::hash<std::string> hasher;
@@ -84,20 +105,18 @@ std::string ServerInterface::generate_uuid(const mavsdk::LogFiles::Entry& entry)
 	return ss.str();
 }
 
-bool ServerInterface::add_log_entry(const mavsdk::LogFiles::Entry& entry)
+bool ServerInterface::sync_log(const LogEntry& entry)
 {
-	std::string uuid = generate_uuid(entry);
-
 	// Check if the log already exists
 	sqlite3_stmt* stmt;
 	std::string check_query = "SELECT COUNT(*) FROM logs WHERE uuid = ?";
 
 	if (sqlite3_prepare_v2(_db, check_query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
-		std::cerr << "SQL error preparing add_log_entry check: " << sqlite3_errmsg(_db) << std::endl;
+		std::cerr << "SQL error preparing sync_log check: " << sqlite3_errmsg(_db) << std::endl;
 		return false;
 	}
 
-	sqlite3_bind_text(stmt, 1, uuid.c_str(), -1, SQLITE_STATIC);
+	sqlite3_bind_text(stmt, 1, entry.uuid.c_str(), -1, SQLITE_STATIC);
 
 	bool exists = false;
 
@@ -113,28 +132,32 @@ bool ServerInterface::add_log_entry(const mavsdk::LogFiles::Entry& entry)
 
 	// Insert the log
 	std::string insert_query =
-		"INSERT INTO logs (uuid, id, date, size_bytes, downloaded, uploaded) "
-		"VALUES (?, ?, ?, ?, 0, 0)";
+		"INSERT INTO logs (uuid, remote_path, date, size_bytes, local_path, downloaded, uploaded) "
+		"VALUES (?, ?, ?, ?, '', 0, 0)";
 
 	if (sqlite3_prepare_v2(_db, insert_query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
-		std::cerr << "SQL error preparing add_log_entry insert: " << sqlite3_errmsg(_db) << std::endl;
+		std::cerr << "SQL error preparing sync_log insert: " << sqlite3_errmsg(_db) << std::endl;
 		return false;
 	}
 
-	sqlite3_bind_text(stmt, 1, uuid.c_str(), -1, SQLITE_STATIC);
-	sqlite3_bind_int(stmt, 2, entry.id);
+	sqlite3_bind_text(stmt, 1, entry.uuid.c_str(), -1, SQLITE_STATIC);
+	sqlite3_bind_text(stmt, 2, entry.remote_path.c_str(), -1, SQLITE_STATIC);
 	sqlite3_bind_text(stmt, 3, entry.date.c_str(), -1, SQLITE_STATIC);
-	sqlite3_bind_int(stmt, 4, entry.size_bytes);
+	sqlite3_bind_int64(stmt, 4, entry.size_bytes);
 
 	bool success = sqlite3_step(stmt) == SQLITE_DONE;
 	sqlite3_finalize(stmt);
 
+	if (success) {
+		grandfather_from_legacy(entry);
+	}
+
 	return success;
 }
 
-bool ServerInterface::update_download_status(const std::string& uuid, bool downloaded)
+bool ServerInterface::update_download_status(const std::string& uuid, const std::string& local_path, bool downloaded)
 {
-	std::string query = "UPDATE logs SET downloaded = ? WHERE uuid = ?";
+	std::string query = "UPDATE logs SET downloaded = ?, local_path = ? WHERE uuid = ?";
 	sqlite3_stmt* stmt;
 
 	if (sqlite3_prepare_v2(_db, query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
@@ -143,7 +166,8 @@ bool ServerInterface::update_download_status(const std::string& uuid, bool downl
 	}
 
 	sqlite3_bind_int(stmt, 1, downloaded ? 1 : 0);
-	sqlite3_bind_text(stmt, 2, uuid.c_str(), -1, SQLITE_STATIC);
+	sqlite3_bind_text(stmt, 2, local_path.c_str(), -1, SQLITE_STATIC);
+	sqlite3_bind_text(stmt, 3, uuid.c_str(), -1, SQLITE_STATIC);
 
 	bool success = sqlite3_step(stmt) == SQLITE_DONE;
 	sqlite3_finalize(stmt);
@@ -151,6 +175,43 @@ bool ServerInterface::update_download_status(const std::string& uuid, bool downl
 	return success;
 }
 
+bool ServerInterface::delete_log(const std::string& uuid)
+{
+	std::string query = "DELETE FROM logs WHERE uuid = ?";
+	sqlite3_stmt* stmt;
+
+	if (sqlite3_prepare_v2(_db, query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
+		std::cerr << "SQL error preparing delete_log: " << sqlite3_errmsg(_db) << std::endl;
+		return false;
+	}
+
+	sqlite3_bind_text(stmt, 1, uuid.c_str(), -1, SQLITE_STATIC);
+
+	bool success = sqlite3_step(stmt) == SQLITE_DONE;
+	sqlite3_finalize(stmt);
+
+	return success;
+}
+
+bool ServerInterface::local_path_in_use(const std::string& local_path, const std::string& excluding_uuid)
+{
+	std::string query = "SELECT COUNT(*) FROM logs WHERE local_path = ? AND uuid != ?";
+	sqlite3_stmt* stmt;
+
+	if (sqlite3_prepare_v2(_db, query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
+		std::cerr << "SQL error preparing local_path_in_use: " << sqlite3_errmsg(_db) << std::endl;
+		return false;
+	}
+
+	sqlite3_bind_text(stmt, 1, local_path.c_str(), -1, SQLITE_STATIC);
+	sqlite3_bind_text(stmt, 2, excluding_uuid.c_str(), -1, SQLITE_STATIC);
+
+	bool in_use = sqlite3_step(stmt) == SQLITE_ROW && sqlite3_column_int(stmt, 0) > 0;
+	sqlite3_finalize(stmt);
+
+	return in_use;
+}
+
 uint32_t ServerInterface::num_logs_to_upload()
 {
 	if (!_settings.upload_enabled || _should_exit) {
@@ -160,7 +221,7 @@ uint32_t ServerInterface::num_logs_to_upload()
 	sqlite3_stmt* stmt;
 	std::string query =
 		"SELECT COUNT(*) FROM logs "
-		"WHERE downloaded = 1 AND uploaded = 0 "
+		"WHERE downloaded = 1 AND uploaded = 0 AND local_path != '' "
 		"AND uuid NOT IN (SELECT uuid FROM blacklist)";
 
 	if (sqlite3_prepare_v2(_db, query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
@@ -189,8 +250,8 @@ ServerInterface::DatabaseEntry ServerInterface::get_next_log_to_upload()
 
 	sqlite3_stmt* stmt;
 	std::string query =
-		"SELECT uuid, id, date, size_bytes, downloaded, uploaded FROM logs "
-		"WHERE downloaded = 1 AND uploaded = 0 "
+		"SELECT uuid, remote_path, date, size_bytes, local_path, downloaded FROM logs "
+		"WHERE downloaded = 1 AND uploaded = 0 AND local_path != '' "
 		"AND uuid NOT IN (SELECT uuid FROM blacklist) "
 		"ORDER BY date DESC, size_bytes DESC LIMIT 1";
 
@@ -209,54 +270,14 @@ ServerInterface::DatabaseEntry ServerInterface::get_next_log_to_upload()
 	return entry;
 }
 
-ServerInterface::UploadResult ServerInterface::upload_log(const std::string& filepath)
+ServerInterface::UploadResult ServerInterface::upload_log(const std::string& uuid, const std::string& filepath)
 {
 	if (!_settings.upload_enabled || _should_exit) {
 		return {false, 0, "Upload disabled or shutting down"};
 	}
 
-	// Extract UUID from filename
-	std::string filename = fs::path(filepath).filename().string();
-	std::string uuid;
-
-	// Parse the ID and date from filename (assuming format like LOG0001_2023-04-15T12:34:56Z.ulg)
-	size_t underscore_pos = filename.find('_');
-	size_t dot_pos = filename.find_last_of('.');
-
-	if (underscore_pos != std::string::npos && dot_pos != std::string::npos) {
-		std::string id_part = filename.substr(3, underscore_pos - 3); // Skip "LOG" prefix
-		std::string date_part = filename.substr(underscore_pos + 1, dot_pos - underscore_pos - 1);
-
-		uint32_t id = std::stoi(id_part);
-		uint32_t size = fs::exists(filepath) ? fs::file_size(filepath) : 0;
-
-		// Create a log entry and generate UUID
-		mavsdk::LogFiles::Entry entry;
-		entry.id = id;
-		entry.date = date_part;
-		entry.size_bytes = size;
-
-		uuid = generate_uuid(entry);
-
-		// Add to database if not already there
-		sqlite3_stmt* stmt;
-		std::string check_query = "SELECT COUNT(*) FROM logs WHERE uuid = ?";
-
-		if (sqlite3_prepare_v2(_db, check_query.c_str(), -1, &stmt, nullptr) == SQLITE_OK) {
-			sqlite3_bind_text(stmt, 1, uuid.c_str(), -1, SQLITE_STATIC);
-
-			if (sqlite3_step(stmt) == SQLITE_ROW && sqlite3_column_int(stmt, 0) == 0) {
-				// Log doesn't exist, add it
-				add_log_entry(entry);
-				update_download_status(uuid, true); // Mark as downloaded since we have the file
-			}
-
-			sqlite3_finalize(stmt);
-		}
-	}
-
 	if (uuid.empty()) {
-		return {false, 0, "Could not determine UUID from filename"};
+		return {false, 0, "Missing UUID"};
 	}
 
 	// Check if already blacklisted
@@ -330,45 +351,33 @@ uint32_t ServerInterface::num_logs_to_download()
 	return log_count;
 }
 
-ServerInterface::DatabaseEntry ServerInterface::get_next_log_to_download()
+std::vector<ServerInterface::DatabaseEntry> ServerInterface::get_logs_to_download()
 {
-	DatabaseEntry empty_entry;
-	empty_entry.uuid = ""; // Empty UUID indicates not found
+	std::vector<DatabaseEntry> entries;
 
 	sqlite3_stmt* stmt;
 	std::string query =
-		"SELECT uuid, id, date, size_bytes, downloaded, uploaded "
+		"SELECT uuid, remote_path, date, size_bytes, local_path, downloaded "
 		"FROM logs WHERE downloaded = 0 "
-		"ORDER BY date DESC, size_bytes DESC LIMIT 1";
+		"ORDER BY date DESC, remote_path DESC";
 
 	if (sqlite3_prepare_v2(_db, query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
-		std::cerr << "SQL error preparing get_next_log_to_download: " << sqlite3_errmsg(_db) << std::endl;
-		return empty_entry;
+		std::cerr << "SQL error preparing get_logs_to_download: " << sqlite3_errmsg(_db) << std::endl;
+		return entries;
 	}
 
-	DatabaseEntry entry = empty_entry;
-
-	if (sqlite3_step(stmt) == SQLITE_ROW) {
-		entry = row_to_db_entry(stmt);
+	while (sqlite3_step(stmt) == SQLITE_ROW) {
+		entries.push_back(row_to_db_entry(stmt));
 	}
 
 	sqlite3_finalize(stmt);
-	return entry;
-}
-
-std::string ServerInterface::filepath_from_entry(const mavsdk::LogFiles::Entry& entry) const
-{
-	std::ostringstream ss;
-	ss << _settings.logs_directory << "LOG" << std::setfill('0') << std::setw(4) << entry.id << "_" << entry.date << ".ulg";
-	return ss.str();
+	return entries;
 }
 
 std::string ServerInterface::filepath_from_uuid(const std::string& uuid) const
 {
-	// Look up the log entry by UUID
 	sqlite3_stmt* stmt;
-	std::string query =
-		"SELECT id, date FROM logs WHERE uuid = ?";
+	std::string query = "SELECT local_path FROM logs WHERE uuid = ?";
 
 	if (sqlite3_prepare_v2(_db, query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
 		std::cerr << "SQL error preparing filepath_from_uuid: " << sqlite3_errmsg(_db) << std::endl;
@@ -380,14 +389,10 @@ std::string ServerInterface::filepath_from_uuid(const std::string& uuid) const
 	std::string filepath;
 
 	if (sqlite3_step(stmt) == SQLITE_ROW) {
-		int id = sqlite3_column_int(stmt, 0);
-		const unsigned char* date_text = sqlite3_column_text(stmt, 1);
-
-		if (date_text != nullptr) {
-			std::string date = reinterpret_cast<const char*>(date_text);
-			std::ostringstream ss;
-			ss << _settings.logs_directory << "LOG" << std::setfill('0') << std::setw(4) << id << "_" << date << ".ulg";
-			filepath = ss.str();
+		const unsigned char* path_text = sqlite3_column_text(stmt, 0);
+
+		if (path_text != nullptr) {
+			filepath = reinterpret_cast<const char*>(path_text);
 		}
 	}
 
@@ -496,13 +501,16 @@ bool ServerInterface::init_database()
 		return false;
 	}
 
+	migrate_legacy_schema();
+
 	// Create logs table
 	const char* create_logs_table =
 		"CREATE TABLE IF NOT EXISTS logs ("
 		"  uuid TEXT PRIMARY KEY,"  // UUID of the log
-		"  id INTEGER,"             // Original log ID
-		"  date TEXT,"              // ISO8601 date from log
+		"  remote_path TEXT,"       // Path relative to the vehicle log root
+		"  date TEXT,"              // ISO8601 date, empty when unknown
 		"  size_bytes INTEGER,"     // Size in bytes
+		"  local_path TEXT DEFAULT '',"   // Where the download ended up
 		"  downloaded INTEGER DEFAULT 0," // Has it been downloaded
 		"  uploaded INTEGER DEFAULT 0"   // Has it been uploaded
 		");";
@@ -519,6 +527,187 @@ bool ServerInterface::init_database()
 	return success;
 }
 
+bool ServerInterface::table_exists(const std::string& name) const
+{
+	sqlite3_stmt* stmt;
+	const char* query = "SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = ?";
+
+	if (sqlite3_prepare_v2(_db, query, -1, &stmt, nullptr) != SQLITE_OK) {
+		return false;
+	}
+
+	sqlite3_bind_text(stmt, 1, name.c_str(), -1, SQLITE_STATIC);
+
+	bool exists = sqlite3_step(stmt) == SQLITE_ROW && sqlite3_column_int(stmt, 0) > 0;
+	sqlite3_finalize(stmt);
+
+	return exists;
+}
+
+bool ServerInterface::column_exists(const std::string& table, const std::string& column) const
+{
+	sqlite3_stmt* stmt;
+	const char* query = "SELECT COUNT(*) FROM pragma_table_info(?) WHERE name = ?";
+
+	if (sqlite3_prepare_v2(_db, query, -1, &stmt, nullptr) != SQLITE_OK) {
+		return false;
+	}
+
+	sqlite3_bind_text(stmt, 1, table.c_str(), -1, SQLITE_STATIC);
+	sqlite3_bind_text(stmt, 2, column.c_str(), -1, SQLITE_STATIC);
+
+	bool exists = sqlite3_step(stmt) == SQLITE_ROW && sqlite3_column_int(stmt, 0) > 0;
+	sqlite3_finalize(stmt);
+
+	return exists;
+}
+
+void ServerInterface::migrate_legacy_schema()
+{
+	if (table_exists("logs_legacy") && !column_exists("logs_legacy", "migrated")) {
+		execute_query("ALTER TABLE logs_legacy ADD COLUMN migrated INTEGER DEFAULT 0");
+	}
+
+	// Pre-FTP databases keyed logs on (LOG_ENTRY date, size)
+	if (table_exists("logs") && !column_exists("logs", "remote_path")) {
+		LOG("Migrating " << _settings.db_path << " to the MAVLink FTP log schema");
+
+		if (table_exists("logs_legacy")) {
+			// An older logloader ran again after this one (the ARK-OS installer
+			// allows downgrades), so fold its state into the existing table.
+			execute_query(
+				"INSERT OR IGNORE INTO logs_legacy (uuid, id, date, size_bytes, downloaded, uploaded, migrated) "
+				"SELECT uuid, id, date, size_bytes, downloaded, uploaded, 0 FROM logs");
+			execute_query("DROP TABLE logs");
+
+		} else {
+			execute_query("ALTER TABLE logs RENAME TO logs_legacy");
+			execute_query("ALTER TABLE logs_legacy ADD COLUMN migrated INTEGER DEFAULT 0");
+		}
+	}
+
+	_has_legacy_table = table_exists("logs_legacy");
+}
+
+void ServerInterface::grandfather_from_legacy(const LogEntry& entry)
+{
+	if (!_has_legacy_table) {
+		return;
+	}
+
+	struct LegacyRow {
+		std::string uuid;
+		int id;
+		std::string date;
+		bool downloaded;
+		bool uploaded;
+	};
+
+	std::vector<LegacyRow> candidates;
+
+	sqlite3_stmt* stmt;
+
+	const char* query =
+		"SELECT uuid, id, date, downloaded, uploaded FROM logs_legacy "
+		"WHERE migrated = 0 AND size_bytes = ?";
+
+	if (sqlite3_prepare_v2(_db, query, -1, &stmt, nullptr) != SQLITE_OK) {
+		return;
+	}
+
+	sqlite3_bind_int64(stmt, 1, entry.size_bytes);
+
+	while (sqlite3_step(stmt) == SQLITE_ROW) {
+		LegacyRow row;
+		const unsigned char* uuid_text = sqlite3_column_text(stmt, 0);
+		const unsigned char* date_text = sqlite3_column_text(stmt, 2);
+		row.uuid = uuid_text ? reinterpret_cast<const char*>(uuid_text) : "";
+		row.id = sqlite3_column_int(stmt, 1);
+		row.date = date_text ? reinterpret_cast<const char*>(date_text) : "";
+		row.downloaded = sqlite3_column_int(stmt, 3) != 0;
+		row.uploaded = sqlite3_column_int(stmt, 4) != 0;
+		candidates.push_back(row);
+	}
+
+	sqlite3_finalize(stmt);
+
+	if (candidates.empty()) {
+		return;
+	}
+
+	// The legacy date is the log's modification time; the new one is either
+	// that as well or the start time parsed from the path. Same log, so they
+	// are at most a flight apart. Without a time to compare, only an
+	// unambiguous single candidate is safe to claim.
+	const LegacyRow* match = nullptr;
+	const auto entry_time = parse_iso8601_utc(entry.date);
+
+	if (entry_time.has_value()) {
+		constexpr int64_t kMaxDelta = 48 * 3600;
+		int64_t best_delta = kMaxDelta;
+
+		for (const auto& candidate : candidates) {
+			const auto legacy_time = parse_iso8601_utc(candidate.date);
+
+			if (!legacy_time.has_value()) {
+				continue;
+			}
+
+			const int64_t delta = std::abs(legacy_time.value() - entry_time.value());
+
+			if (delta <= best_delta) {
+				best_delta = delta;
+				match = &candidate;
+			}
+		}
+
+	} else if (candidates.size() == 1) {
+		match = &candidates.front();
+	}
+
+	if (match == nullptr) {
+		return;
+	}
+
+	// Reconstruct the file name the legacy naming scheme used
+	std::ostringstream legacy_name;
+	legacy_name << _settings.logs_directory << "LOG" << std::setfill('0') << std::setw(4)
+		    << match->id << "_" << match->date << ".ulg";
+
+	const std::string legacy_path = legacy_name.str();
+	const bool file_exists = fs::exists(legacy_path);
+
+	// A log whose file went missing before it was uploaded is re-downloaded
+	const bool downloaded = match->downloaded && (file_exists || match->uploaded);
+	const std::string local_path = (match->downloaded && file_exists) ? legacy_path : "";
+
+	const char* update_query = "UPDATE logs SET downloaded = ?, uploaded = ?, local_path = ? WHERE uuid = ?";
+
+	if (sqlite3_prepare_v2(_db, update_query, -1, &stmt, nullptr) == SQLITE_OK) {
+		sqlite3_bind_int(stmt, 1, downloaded ? 1 : 0);
+		sqlite3_bind_int(stmt, 2, match->uploaded ? 1 : 0);
+		sqlite3_bind_text(stmt, 3, local_path.c_str(), -1, SQLITE_STATIC);
+		sqlite3_bind_text(stmt, 4, entry.uuid.c_str(), -1, SQLITE_STATIC);
+		sqlite3_step(stmt);
+		sqlite3_finalize(stmt);
+	}
+
+	if (is_blacklisted(match->uuid)) {
+		add_to_blacklist(entry.uuid, "Migrated from legacy uuid " + match->uuid);
+	}
+
+	const char* mark_query = "UPDATE logs_legacy SET migrated = 1 WHERE uuid = ?";
+
+	if (sqlite3_prepare_v2(_db, mark_query, -1, &stmt, nullptr) == SQLITE_OK) {
+		sqlite3_bind_text(stmt, 1, match->uuid.c_str(), -1, SQLITE_STATIC);
+		sqlite3_step(stmt);
+		sqlite3_finalize(stmt);
+	}
+
+	LOG_DEBUG("Migrated legacy log " << match->uuid << " -> " << entry.uuid
+		  << " (" << entry.remote_path << ")");
+}
+
 void ServerInterface::close_database()
 {
 	if (_db) {
@@ -574,27 +763,20 @@ ServerInterface::DatabaseEntry ServerInterface::row_to_db_entry(sqlite3_stmt* st
 	DatabaseEntry entry;
 
 	const unsigned char* uuid_text = sqlite3_column_text(stmt, 0);
+	entry.uuid = uuid_text ? reinterpret_cast<const char*>(uuid_text) : "";
 
-	if (uuid_text != nullptr) {
-		entry.uuid = reinterpret_cast<const char*>(uuid_text);
-
-	} else {
-		entry.uuid = "";
-	}
-
-	entry.id = sqlite3_column_int(stmt, 1);
+	const unsigned char* path_text = sqlite3_column_text(stmt, 1);
+	entry.remote_path = path_text ? reinterpret_cast<const char*>(path_text) : "";
 
 	const unsigned char* date_text = sqlite3_column_text(stmt, 2);
+	entry.date = date_text ? reinterpret_cast<const char*>(date_text) : "";
 
-	if (date_text != nullptr) {
-		entry.date = reinterpret_cast<const char*>(date_text);
+	entry.size_bytes = static_cast<uint32_t>(sqlite3_column_int64(stmt, 3));
 
-	} else {
-		entry.date = "";
-	}
+	const unsigned char* local_text = sqlite3_column_text(stmt, 4);
+	entry.local_path = local_text ? reinterpret_cast<const char*>(local_text) : "";
 
-	entry.size_bytes = sqlite3_column_int(stmt, 3);
-	entry.downloaded = sqlite3_column_int(stmt, 4) != 0;
+	entry.downloaded = sqlite3_column_int(stmt, 5) != 0;
 
 	return entry;
 }
diff --git a/src/ServerInterface.hpp b/src/ServerInterface.hpp
index ea47559..ad0f156 100644
--- a/src/ServerInterface.hpp
+++ b/src/ServerInterface.hpp
@@ -1,9 +1,9 @@
 #pragma once
 
+#include <cstdint>
 #include <string>
 #include <vector>
 #include <sqlite3.h>
-#include <mavsdk/plugins/log_files/log_files.h>
 
 class ServerInterface
 {
@@ -23,12 +23,23 @@ class ServerInterface
 		std::string message;
 	};
 
+	// A log as tracked in the database. Identity is the remote path (relative
+	// to the vehicle log root) plus the size: the path alone is not enough
+	// because ArduPilot wraps its log numbering and reuses file names.
+	struct LogEntry {
+		std::string uuid;
+		std::string remote_path;
+		std::string date;       // ISO8601 UTC, empty when the vehicle cannot report a time
+		uint32_t size_bytes {};
+	};
+
 	struct DatabaseEntry {
 		std::string uuid;
-		uint32_t id;
+		std::string remote_path;
 		std::string date;
-		uint32_t size_bytes;
-		bool downloaded;
+		uint32_t size_bytes {};
+		std::string local_path; // Empty until downloaded
+		bool downloaded {};
 	};
 
 	ServerInterface(const Settings& settings);
@@ -39,21 +50,22 @@ class ServerInterface
 	void close_database();
 
 	// Log entry management
-	static std::string generate_uuid(const mavsdk::LogFiles::Entry& entry);
-	bool add_log_entry(const mavsdk::LogFiles::Entry& entry);
-	bool update_download_status(const std::string& uuid, bool downloaded);
+	static std::string generate_uuid(const std::string& remote_path, uint32_t size_bytes);
+	bool sync_log(const LogEntry& entry);
+	bool update_download_status(const std::string& uuid, const std::string& local_path, bool downloaded);
+	bool delete_log(const std::string& uuid);
 	uint32_t num_logs_to_download();
+	std::vector<DatabaseEntry> get_logs_to_download();
+	bool local_path_in_use(const std::string& local_path, const std::string& excluding_uuid);
 
 	// Upload management
 	uint32_t num_logs_to_upload();
 	DatabaseEntry get_next_log_to_upload();
-	UploadResult upload_log(const std::string& filepath);
+	UploadResult upload_log(const std::string& uuid, const std::string& filepath);
 
 	// Query methods
 	bool is_blacklisted(const std::string& uuid);
-	DatabaseEntry get_next_log_to_download();
 
-	std::string filepath_from_entry(const mavsdk::LogFiles::Entry& entry) const ;
 	std::string filepath_from_uuid(const std::string& uuid) const;
 
 	void start();
@@ -74,8 +86,18 @@ class ServerInterface
 	bool add_to_blacklist(const std::string& uuid, const std::string& reason);
 	DatabaseEntry row_to_db_entry(sqlite3_stmt* stmt);
 
+	// Databases written before the MAVLink FTP transition keyed logs on the
+	// LOG_ENTRY timestamp, which FTP cannot reproduce. Their rows are moved
+	// aside on startup and matched back up by size as the FTP index comes in,
+	// so download/upload state survives the upgrade.
+	bool table_exists(const std::string& name) const;
+	bool column_exists(const std::string& table, const std::string& column) const;
+	void migrate_legacy_schema();
+	void grandfather_from_legacy(const LogEntry& entry);
+
 	Settings _settings;
 	Protocol _protocol {Protocol::Https};
 	bool _should_exit = false;
+	bool _has_legacy_table = false;
 	sqlite3* _db = nullptr;
 };
diff --git a/src/main.cpp b/src/main.cpp
index 0621092..24f6af5 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -60,7 +60,9 @@ int main(int argc, char** argv)
 		.mavsdk_connection_url = config["connection_url"].value_or("0.0.0"),
 		.application_directory = config["application_directory"].value_or(data_dir.string() + "/"),
 		.upload_enabled = config["upload_enabled"].value_or(false),
-		.public_logs = config["public_logs"].value_or(false)
+		.public_logs = config["public_logs"].value_or(false),
+		.remote_log_directory = config["remote_log_directory"].value_or(""),
+		.ftp_use_burst = config["ftp_use_burst"].value_or(true)
 	};
 
 	_log_loader = std::make_shared<LogLoader>(settings);

From 7831fff2335f44f33049c2461aee53ca4f7d0bab Mon Sep 17 00:00:00 2001
From: Jacob Dahl <37091262+dakejahl@users.noreply.github.com>
Date: Mon, 27 Jul 2026 15:39:49 -0600
Subject: [PATCH 2/8] fix(upload): stop spamming when flight-review is offline

When the local flight-review server is down, the upload loop previously
probed and logged a failure for every pending log. Probe once, log a
single unreachable message with a 60s cooldown, and bail the current
upload batch (HTTP 503) instead of walking the queue.

(cherry picked from commit 7a23c8e894c8f73fb1ac319a78c41963fd99eadf)
---
 src/LogLoader.cpp       |  5 +++++
 src/ServerInterface.cpp | 38 ++++++++++++++++++++++++++++++++++----
 src/ServerInterface.hpp | 12 +++++++++++-
 3 files changed, 50 insertions(+), 5 deletions(-)

diff --git a/src/LogLoader.cpp b/src/LogLoader.cpp
index 62a4782..70f8f6e 100644
--- a/src/LogLoader.cpp
+++ b/src/LogLoader.cpp
@@ -408,6 +408,11 @@ void LogLoader::upload_pending_logs(std::shared_ptr<ServerInterface> server)
 		} else if (result.status_code == 400) {
 			LOG("Log upload failed (" << result.status_code << "): " << result.message);
 
+		} else if (result.status_code == 503) {
+			// Server down (e.g. local flight-review not running). Already logged once
+			// with a cooldown in ServerInterface; do not walk the rest of the queue.
+			return;
+
 		} else {
 			LOG("Log upload TEMPORARILY FAILED (" << result.status_code << "): "
 			    << result.message << " - Will retry later");
diff --git a/src/ServerInterface.cpp b/src/ServerInterface.cpp
index 6e78ac4..bd1e6c3 100644
--- a/src/ServerInterface.cpp
+++ b/src/ServerInterface.cpp
@@ -418,7 +418,9 @@ ServerInterface::UploadResult ServerInterface::upload(const std::string& filepat
 	}
 
 	if (!server_reachable()) {
-		return {false, 0, "Server unreachable: " + _settings.server_url};
+		// 503: treat as service unavailable so the upload loop can bail the batch
+		// instead of hammering a dead local flight-review for every pending log.
+		return {false, 503, "Server unreachable: " + _settings.server_url};
 	}
 
 	std::ifstream file(filepath, std::ios::binary);
@@ -470,24 +472,52 @@ ServerInterface::UploadResult ServerInterface::upload(const std::string& filepat
 
 bool ServerInterface::server_reachable()
 {
+	const auto now = std::chrono::steady_clock::now();
+
+	// Still inside the cooldown from a previous failure — do not re-probe or re-log.
+	if (now < _unreachable_until) {
+		return false;
+	}
+
 	httplib::Result res;
 
 	if (_protocol == Protocol::Https) {
 		httplib::SSLClient cli(_settings.server_url);
+		cli.set_connection_timeout(2, 0);
+		cli.set_read_timeout(2, 0);
 		res = cli.Get("/");
 
 	} else {
 		httplib::Client cli(_settings.server_url);
+		cli.set_connection_timeout(2, 0);
+		cli.set_read_timeout(2, 0);
 		res = cli.Get("/");
 	}
 
-	bool success = res && res->status == 200;
+	const bool success = res && res->status == 200;
 
 	if (!success) {
-		LOG("Connection to " << _settings.server_url << " failed: " << (res ? std::to_string(res->status) : "No response"));
+		_unreachable_until = now + kUnreachableCooldown;
+
+		if (!_reported_unreachable) {
+			const std::string detail = res ? ("HTTP " + std::to_string(res->status)) : "No response";
+			LOG("Upload server " << _settings.server_url << " unreachable (" << detail
+			    << "); skipping uploads for "
+			    << std::chrono::duration_cast<std::chrono::seconds>(kUnreachableCooldown).count()
+			    << "s");
+			_reported_unreachable = true;
+		}
+
+		return false;
 	}
 
-	return success;
+	if (_reported_unreachable) {
+		LOG("Upload server " << _settings.server_url << " is reachable again");
+		_reported_unreachable = false;
+	}
+
+	_unreachable_until = {};
+	return true;
 }
 
 bool ServerInterface::init_database()
diff --git a/src/ServerInterface.hpp b/src/ServerInterface.hpp
index ad0f156..3d8e014 100644
--- a/src/ServerInterface.hpp
+++ b/src/ServerInterface.hpp
@@ -1,5 +1,6 @@
 #pragma once
 
+#include <chrono>
 #include <cstdint>
 #include <string>
 #include <vector>
@@ -19,7 +20,9 @@ class ServerInterface
 
 	struct UploadResult {
 		bool success;
-		int status_code;    // HTTP status code, or 0 if not applicable
+		// HTTP status, or 0 when not applicable. 503 means the server is unreachable
+		// (connectivity); callers should stop the current upload batch and retry later.
+		int status_code;
 		std::string message;
 	};
 
@@ -100,4 +103,11 @@ class ServerInterface
 	bool _should_exit = false;
 	bool _has_legacy_table = false;
 	sqlite3* _db = nullptr;
+
+	// When flight-review (or any upload target) is down, avoid probing and logging
+	// once per pending log. Probe at most every kUnreachableCooldown, and log only on
+	// the down/up transitions.
+	static constexpr auto kUnreachableCooldown = std::chrono::seconds(60);
+	std::chrono::steady_clock::time_point _unreachable_until {};
+	bool _reported_unreachable {false};
 };

From fc4f3ed3bacb1cdbd975b986b2213ca1815e5768 Mon Sep 17 00:00:00 2001
From: Jacob Dahl <37091262+dakejahl@users.noreply.github.com>
Date: Mon, 27 Jul 2026 17:19:55 -0600
Subject: [PATCH 3/8] feat(upload): support Flight Review API keys and harden
 reachability

Add remote_api_key config for ARK Flight Review (Authorization: Bearer and
X-API-Key per flight_review api_key.py). Empty key still attempts remote
upload without auth headers for open servers.

Treat any HTTP response as reachable so 302 home pages (review.arkelectron.com)
are not marked dead. Improve 401/403 handling with response body and stop
retry spam. Slightly longer connection timeouts for probe and upload.

(cherry picked from commit adc72da390050510e226fff7346da0d2e975a88c)
---
 README.md               | 15 +++++++++
 config.toml             |  7 ++++
 src/LogLoader.cpp       | 12 +++++--
 src/LogLoader.hpp       |  2 ++
 src/ServerInterface.cpp | 72 ++++++++++++++++++++++++++++++++++-------
 src/ServerInterface.hpp |  6 ++++
 src/main.cpp            | 22 +++++++++++++
 7 files changed, 122 insertions(+), 14 deletions(-)

diff --git a/README.md b/README.md
index 8145739..ba38858 100644
--- a/README.md
+++ b/README.md
@@ -21,9 +21,24 @@ Log timestamps come from the modification time in the listing when the vehicle s
 
 Downloads are staged in a temporary directory and only moved next to the finished logs once the transferred size matches the listing, so a partial file is never mistaken for a complete one.
 
+`.BIN` files are not accepted by review.px4.io, so on ArduPilot leave `upload_enabled = false` or point `remote_server` somewhere that understands dataflash logs.
+
 ### Upgrading from a pre-FTP logloader
 Older versions identified logs by the timestamp `LOG_ENTRY` reported, which MAVLink FTP cannot reproduce. On first start the existing `logs` table is renamed to `logs_legacy` and its rows are matched against the FTP listing by size, so logs already downloaded and uploaded are not fetched or uploaded a second time. Nothing is deleted; `logs_legacy` stays behind for inspection.
 
+### Configuration
+| Key | Default | Description |
+| --- | --- | --- |
+| `connection_url` | `udp://:14551` | MAVSDK connection string |
+| `local_server` | `http://127.0.0.1:5006` | Local upload target |
+| `remote_server` | `https://review.px4.io` | Remote upload target |
+| `email` | `""` | Email attached to remote uploads |
+| `remote_api_key` | `""` | Per-account API key for authenticated Flight Review (`Authorization: Bearer` + `X-API-Key`). Empty = upload without API key headers (open servers). Generate under /account |
+| `upload_enabled` | `false` | Upload to the remote server |
+| `public_logs` | `false` | Mark remote uploads public |
+| `remote_log_directory` | `""` | Override the vehicle log directory |
+| `ftp_use_burst` | `true` | Use FTP burst reads |
+
 ### Build
 Install dependencies
 ```
diff --git a/config.toml b/config.toml
index af7db70..0e34d76 100644
--- a/config.toml
+++ b/config.toml
@@ -5,6 +5,13 @@ email = ""
 upload_enabled = false
 public_logs = false
 
+# Per-account API key for authenticated Flight Review (ARK).
+# Generate at https://review.arkelectron.com/account (shown once; format fr_...).
+# When set: sent as Authorization: Bearer and X-API-Key on POST /upload.
+# When empty: remote uploads are still attempted without API key headers
+# (works for open servers; ARK Flight Review will reject with 403).
+remote_api_key = ""
+
 # Vehicle log directory. Empty probes "@MAV_LOG" (the virtual log directory from
 # the MAVLink FTP specification), then "/fs/microsd/log" (PX4) and "/APM/LOGS"
 # (ArduPilot). Set this when the logs live somewhere else.
diff --git a/src/LogLoader.cpp b/src/LogLoader.cpp
index 70f8f6e..215c812 100644
--- a/src/LogLoader.cpp
+++ b/src/LogLoader.cpp
@@ -48,6 +48,7 @@ LogLoader::LogLoader(const LogLoader::Settings& settings)
 		.db_path = _settings.application_directory + "local_server.db",
 		.upload_enabled = true, // Always upload to local server
 		.public_logs = true, // Public required true for searching using Web UI
+		.api_key = "", // Local Flight Review is typically open on the companion
 	};
 
 	// Setup remote server interface
@@ -58,6 +59,7 @@ LogLoader::LogLoader(const LogLoader::Settings& settings)
 		.db_path = _settings.application_directory + "remote_server.db",
 		.upload_enabled = settings.upload_enabled,
 		.public_logs = settings.public_logs,
+		.api_key = settings.remote_api_key,
 	};
 
 	_local_server = std::make_shared<ServerInterface>(local_server_settings);
@@ -405,8 +407,14 @@ void LogLoader::upload_pending_logs(std::shared_ptr<ServerInterface> server)
 		if (result.success) {
 			LOG("Log upload SUCCESS: " << result.message);
 
-		} else if (result.status_code == 400) {
-			LOG("Log upload failed (" << result.status_code << "): " << result.message);
+		} else if (result.status_code == 400 || result.status_code == 401 || result.status_code == 403) {
+			LOG("Log upload rejected (" << result.status_code << "): " << result.message);
+
+			// Account/auth policy applies to every log on this server — stop the batch.
+			if (result.status_code == 401 || result.status_code == 403) {
+				LOG("Stopping remote uploads for this cycle (server requires login/approval)");
+				return;
+			}
 
 		} else if (result.status_code == 503) {
 			// Server down (e.g. local flight-review not running). Already logged once
diff --git a/src/LogLoader.hpp b/src/LogLoader.hpp
index 67edbb3..b70b715 100644
--- a/src/LogLoader.hpp
+++ b/src/LogLoader.hpp
@@ -16,6 +16,8 @@ class LogLoader
 		std::string email;
 		std::string local_server;
 		std::string remote_server;
+		// API key for remote_server (ARK Flight Review account key). Empty = none.
+		std::string remote_api_key;
 		std::string mavsdk_connection_url;
 		std::string application_directory;
 		bool upload_enabled;
diff --git a/src/ServerInterface.cpp b/src/ServerInterface.cpp
index bd1e6c3..dede21e 100644
--- a/src/ServerInterface.cpp
+++ b/src/ServerInterface.cpp
@@ -300,8 +300,11 @@ ServerInterface::UploadResult ServerInterface::upload_log(const std::string& uui
 		}
 
 	} else if (result.status_code == 400) {
-		// Permanent failure - add to blacklist
-		add_to_blacklist(uuid, "HTTP 400: Bad Request");
+		// The server will not take this log whoever asks - do not keep retrying it.
+		// 401/403 are not blacklisted: they say the account is not authorized yet,
+		// which is fixed by setting remote_api_key, and every pending log would
+		// otherwise be thrown away one per cycle while the key is missing.
+		add_to_blacklist(uuid, "HTTP 400: " + result.message);
 	}
 
 	return result;
@@ -445,25 +448,64 @@ ServerInterface::UploadResult ServerInterface::upload(const std::string& filepat
 	std::string content((std::istreambuf_iterator<char>(file)), std::istreambuf_iterator<char>());
 	items.push_back({"filearg", content, filepath, "application/octet-stream"});
 
-	LOG("Uploading " << fs::path(filepath).filename().string() << " to " << _settings.server_url);
+	// API-key headers only when a non-empty key is configured. Never send
+	// Authorization/X-API-Key with an empty value.
+	httplib::Headers headers;
+	const bool use_api_key = !_settings.api_key.empty();
+
+	if (use_api_key) {
+		// ARK Flight Review (flight_review api_key.py):
+		//   Authorization: Bearer <key>
+		//   X-API-Key: <key>
+		// (Query ?api_key= also works server-side; form fields cannot — auth
+		// runs in prepare() before the body is available.)
+		headers.emplace("Authorization", "Bearer " + _settings.api_key);
+		headers.emplace("X-API-Key", _settings.api_key);
+	}
+
+	LOG("Uploading " << fs::path(filepath).filename().string() << " to " << _settings.server_url
+	    << (use_api_key ? " (with API key)" : ""));
 
 	// Post multi-part form
 	httplib::Result res;
 
 	if (_protocol == Protocol::Https) {
 		httplib::SSLClient cli(_settings.server_url);
-		res = cli.Post("/upload", items);
+		cli.set_connection_timeout(30, 0);
+		cli.set_read_timeout(120, 0);
+		res = use_api_key ? cli.Post("/upload", headers, items)
+		      : cli.Post("/upload", items);
 
 	} else {
 		httplib::Client cli(_settings.server_url);
-		res = cli.Post("/upload", items);
+		cli.set_connection_timeout(30, 0);
+		cli.set_read_timeout(120, 0);
+		res = use_api_key ? cli.Post("/upload", headers, items)
+		      : cli.Post("/upload", items);
 	}
 
 	if (res && res->status == 302) {
 		return {true, 302, "Success: " + _settings.server_url + res->get_header_value("Location")};
 
-	} else if (res && res->status == 400) {
-		return {false, 400, "Bad Request - Will not retry"};
+	} else if (res && (res->status == 400 || res->status == 401 || res->status == 403)) {
+		// Permanent client/auth errors: do not spin on the same log forever.
+		// review.arkelectron.com returns 403 when the account is not logged in /
+		// not approved for automated uploads.
+		std::string detail = res->body;
+
+		// Collapse HTML / whitespace for a one-line log message.
+		for (char& c : detail) {
+			if (c == '\n' || c == '\r' || c == '\t') {
+				c = ' ';
+			}
+		}
+
+		if (detail.size() > 200) {
+			detail.resize(200);
+			detail += "...";
+		}
+
+		return {false, res->status, detail.empty() ? "Rejected by server (will not retry)" : detail};
 
 	} else {
 		return {false, res ? res->status : 0, "Will retry later"};
@@ -483,18 +525,24 @@ bool ServerInterface::server_reachable()
 
 	if (_protocol == Protocol::Https) {
 		httplib::SSLClient cli(_settings.server_url);
-		cli.set_connection_timeout(2, 0);
-		cli.set_read_timeout(2, 0);
+		cli.set_connection_timeout(5, 0);
+		cli.set_read_timeout(5, 0);
+		// Flight Review often redirects "/" (302). We only need proof the host answers.
+		cli.set_follow_location(false);
 		res = cli.Get("/");
 
 	} else {
 		httplib::Client cli(_settings.server_url);
-		cli.set_connection_timeout(2, 0);
-		cli.set_read_timeout(2, 0);
+		cli.set_connection_timeout(5, 0);
+		cli.set_read_timeout(5, 0);
+		cli.set_follow_location(false);
 		res = cli.Get("/");
 	}
 
-	const bool success = res && res->status == 200;
+	// Any HTTP response means the server is up. Flight Review's home page returns
+	// 302, so requiring status == 200 falsely marked review.arkelectron.com dead.
+	// Connection / TLS failures leave res empty.
+	const bool success = static_cast<bool>(res);
 
 	if (!success) {
 		_unreachable_until = now + kUnreachableCooldown;
diff --git a/src/ServerInterface.hpp b/src/ServerInterface.hpp
index 3d8e014..36c8e87 100644
--- a/src/ServerInterface.hpp
+++ b/src/ServerInterface.hpp
@@ -16,6 +16,12 @@ class ServerInterface
 		std::string db_path;         // Path to this server's database
 		bool upload_enabled {};
 		bool public_logs {};
+		// Per-account API key for authenticated Flight Review instances
+		// (e.g. review.arkelectron.com). Sent as:
+		//   Authorization: Bearer <key>
+		//   X-API-Key: <key>
+		// Matches ARK flight_review api_key.py. Leave empty for open servers.
+		std::string api_key;
 	};
 
 	struct UploadResult {
diff --git a/src/main.cpp b/src/main.cpp
index 24f6af5..542aab4 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -57,6 +57,7 @@ int main(int argc, char** argv)
 		.email = config["email"].value_or(""),
 		.local_server = config["local_server"].value_or("http://127.0.0.1:5006"),
 		.remote_server = config["remote_server"].value_or("https://logs.px4.io"),
+		.remote_api_key = config["remote_api_key"].value_or(""),
 		.mavsdk_connection_url = config["connection_url"].value_or("0.0.0"),
 		.application_directory = config["application_directory"].value_or(data_dir.string() + "/"),
 		.upload_enabled = config["upload_enabled"].value_or(false),
@@ -65,6 +66,27 @@ int main(int argc, char** argv)
 		.ftp_use_burst = config["ftp_use_burst"].value_or(true)
 	};
 
+	// Trim whitespace-only keys so they count as "not set" (no empty auth headers).
+	auto trim = [](std::string s) {
+		const auto start = s.find_first_not_of(" \t\r\n");
+
+		if (start == std::string::npos) {
+			return std::string{};
+		}
+
+		const auto end = s.find_last_not_of(" \t\r\n");
+		return s.substr(start, end - start + 1);
+	};
+	settings.remote_api_key = trim(std::move(settings.remote_api_key));
+
+	// Still attempt remote uploads without a key (open servers like logs.px4.io).
+	// Authenticated ARK Flight Review will 403 until remote_api_key is set; we
+	// never send empty Authorization / X-API-Key headers (see ServerInterface).
+	if (settings.upload_enabled && settings.remote_api_key.empty()) {
+		LOG("upload_enabled is true but remote_api_key is empty — remote uploads will "
+		    "proceed without an API key (open servers only; ARK Flight Review needs a key)");
+	}
+
 	_log_loader = std::make_shared<LogLoader>(settings);
 
 	bool connected = false;

From 8126dd33aa41b534703783959297fe36050d0464 Mon Sep 17 00:00:00 2001
From: Jacob Dahl <dahl.jakejacob@gmail.com>
Date: Tue, 28 Jul 2026 11:31:13 -0600
Subject: [PATCH 4/8] refactor(logloader): split storage from transport and
 make fetching request-driven

Replaces ServerInterface, which was a SQLite repository and an HTTP client
sharing a name, with LogDatabase (one database, the single record of what the
vehicle has and what we mean to do about it) and UploadTarget (one Flight
Review endpoint, no state of its own). LogLoader no longer keeps two databases
in step by calling every mutation twice.

Behaviour change: logloader no longer mirrors the SD card. A log is fetched
because it appeared while logloader was watching -- a flight just happened --
or because something asked for it. On a database that has never seen the
vehicle only the newest log is taken, so a companion powered on for the first
time does not pull and upload an entire card. A listing that turns up more than
max_auto_queue new logs is treated as an unfamiliar card, not a burst of
flights. Intent lives in the database, so automatic and requested work share
one path.

Adds an HTTP API on 127.0.0.1:3005 (list, request, cancel, delete, SSE) for the
ARK-OS Logs page to drive.

Also fixed along the way:
- A pending log whose file was missing or empty was retried forever and blocked
  every older log behind it; only HTTP 400 escaped. Upload outcomes are now
  classified (Success/Rejected/Unauthorized/Unreachable/Retry) and the loop
  iterates a fetched batch instead of re-counting a query that only shrinks on
  success.
- ServerInterface::_should_exit and LogLoader::_loop_disabled were plain bools
  written by one thread and read by another. Both are gone; pausing is derived
  from arm state and shutdown goes through a Waiter.
- SIGINT/SIGTERM are blocked and consumed by a sigtimedwait thread. The handler
  used to take a mutex and signal a condition variable, neither of which is
  async-signal-safe.
- CMAKE_BUILD_TYPE was never set, so the shipped binary was built at -O0.
- Rows are marked absent rather than deleted when a log leaves the vehicle, so
  a downloaded log keeps its file and its upload history.
- generate_uuid hashed with std::hash, which is implementation-defined, into
  persistent state; identity is now (path, size) with an integer primary key.
- Dead code: num_logs_to_download, the .lock file check, the logger_running
  branch that was hardcoded false.
- The staging directory is swept at startup so a run killed mid-transfer does
  not leak partial files.

Verified end to end against PX4 SITL and a local flight-review: probe, index,
first-start policy, download, upload, and manual selection through the API.
---
 .gitmodules             |   3 +
 CMakeLists.txt          |  45 ++-
 README.md               | 153 +++----
 config.toml             |  74 +++-
 src/ApiServer.cpp       | 351 ++++++++++++++++
 src/ApiServer.hpp       |  45 +++
 src/Config.cpp          | 159 ++++++++
 src/Config.hpp          |  67 ++++
 src/FtpLogFetcher.cpp   |  28 +-
 src/FtpLogFetcher.hpp   |   4 +
 src/Log.cpp             |  71 ++++
 src/Log.hpp             |  45 ++-
 src/LogDatabase.cpp     | 739 ++++++++++++++++++++++++++++++++++
 src/LogDatabase.hpp     | 129 ++++++
 src/LogLoader.cpp       | 653 +++++++++++++++++-------------
 src/LogLoader.hpp       | 117 +++---
 src/ServerInterface.cpp | 860 ----------------------------------------
 src/ServerInterface.hpp | 119 ------
 src/Sqlite.cpp          | 176 ++++++++
 src/Sqlite.hpp          |  73 ++++
 src/StatusBoard.cpp     |  44 ++
 src/StatusBoard.hpp     |  56 +++
 src/UploadTarget.cpp    | 177 +++++++++
 src/UploadTarget.hpp    |  55 +++
 src/Waiter.hpp          |  57 +++
 src/main.cpp            | 176 ++++----
 third_party/json        |   1 +
 27 files changed, 2989 insertions(+), 1488 deletions(-)
 create mode 100644 src/ApiServer.cpp
 create mode 100644 src/ApiServer.hpp
 create mode 100644 src/Config.cpp
 create mode 100644 src/Config.hpp
 create mode 100644 src/Log.cpp
 create mode 100644 src/LogDatabase.cpp
 create mode 100644 src/LogDatabase.hpp
 delete mode 100644 src/ServerInterface.cpp
 delete mode 100644 src/ServerInterface.hpp
 create mode 100644 src/Sqlite.cpp
 create mode 100644 src/Sqlite.hpp
 create mode 100644 src/StatusBoard.cpp
 create mode 100644 src/StatusBoard.hpp
 create mode 100644 src/UploadTarget.cpp
 create mode 100644 src/UploadTarget.hpp
 create mode 100644 src/Waiter.hpp
 create mode 160000 third_party/json

diff --git a/.gitmodules b/.gitmodules
index 5b8b83f..13b4e2e 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -4,3 +4,6 @@
 [submodule "third_party/tomlplusplus"]
 	path = third_party/tomlplusplus
 	url = https://github.com/marzer/tomlplusplus.git
+[submodule "third_party/json"]
+	path = third_party/json
+	url = https://github.com/nlohmann/json.git
diff --git a/CMakeLists.txt b/CMakeLists.txt
index d2a99f6..31344c5 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -3,42 +3,53 @@ cmake_minimum_required(VERSION 3.16 FATAL_ERROR)
 set(CMAKE_CXX_STANDARD 20)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
 
-project(logloader VERSION 0.9 LANGUAGES CXX)
+project(logloader VERSION 1.0 LANGUAGES CXX)
 
-option(DEBUG_BUILD "Enable debug logging" OFF)
-if(DEBUG_BUILD)
-    add_definitions(-DDEBUG_BUILD)
-    message(STATUS "Debug logging enabled")
+# Without this the default is an empty build type, i.e. no optimisation at all.
+if(NOT CMAKE_BUILD_TYPE AND NOT CMAKE_CONFIGURATION_TYPES)
+    set(CMAKE_BUILD_TYPE Release CACHE STRING "Build type" FORCE)
 endif()
+message(STATUS "Build type: ${CMAKE_BUILD_TYPE}")
 
 add_compile_options(-Wall -Wextra -Werror -Wpedantic -Wunused)
 
 find_package(OpenSSL 3.0.2 REQUIRED)
 find_package(SQLite3 REQUIRED)
+find_package(Threads REQUIRED)
 
 message(STATUS "OpenSSL version: ${OPENSSL_VERSION}")
-message(STATUS "OpenSSL include dir: ${OPENSSL_INCLUDE_DIR}")
-message(STATUS "OpenSSL libraries: ${OPENSSL_LIBRARIES}")
-message(STATUS "SQLite3 include dir: ${SQLite3_INCLUDE_DIRS}")
-message(STATUS "SQLite3 libraries: ${SQLite3_LIBRARIES}")
+message(STATUS "SQLite3 version: ${SQLite3_VERSION}")
 
-# Assumes MAVSDK system wide install
+# Assumes a system-wide MAVSDK install
 list(APPEND CMAKE_PREFIX_PATH "/usr/local/MAVSDK/install")
 find_package(MAVSDK REQUIRED)
 
-include_directories(third_party/cpp-httplib/)
-include_directories(third_party/tomlplusplus/)
-include_directories(${SQLite3_INCLUDE_DIRS})
-
 add_executable(${PROJECT_NAME}
     src/main.cpp
-    src/ServerInterface.cpp
+    src/ApiServer.cpp
+    src/Config.cpp
     src/FtpListClient.cpp
     src/FtpLogFetcher.cpp
-    src/LogLoader.cpp)
+    src/Log.cpp
+    src/LogDatabase.cpp
+    src/LogLoader.cpp
+    src/Sqlite.cpp
+    src/StatusBoard.cpp
+    src/UploadTarget.cpp)
+
+# Must be set for every translation unit that sees httplib.h: it changes the
+# layout of httplib's socket types, so a per-file #define is an ODR violation.
+target_compile_definitions(${PROJECT_NAME} PRIVATE CPPHTTPLIB_OPENSSL_SUPPORT)
+
+# The vendored headers are SYSTEM so their warnings are not ours to fix.
+target_include_directories(${PROJECT_NAME} SYSTEM PRIVATE
+    third_party/cpp-httplib
+    third_party/tomlplusplus
+    third_party/json/single_include
+    ${SQLite3_INCLUDE_DIRS})
 
 target_link_libraries(${PROJECT_NAME}
-    pthread
+    Threads::Threads
     OpenSSL::SSL
     OpenSSL::Crypto
     MAVSDK::mavsdk
diff --git a/README.md b/README.md
index ba38858..fb37238 100644
--- a/README.md
+++ b/README.md
@@ -1,13 +1,39 @@
 ![image](logloader_logo.png)
 
-Downloads flight logs from the vehicle and uploads them to a local server and optionally a remote server. Works with PX4 (`.ulg`) and ArduPilot (`.BIN`).
+Downloads flight logs from the vehicle over MAVLink FTP and uploads them to a local Flight Review and, optionally, a remote one. Works with PX4 (`.ulg`) and ArduPilot (`.BIN`).
 
-The **config.toml** file is used to configure the program settings.
+### What it fetches, and when
 
-### Behavior
-Downloading and uploading will only occur while the vehicle is not armed. Downloading and uploading operations are performed in separate threads. An sqlite database per server is used to track log file download/upload status.
+logloader does **not** try to mirror the SD card. A companion computer that is powered on for the first time, or one whose database has been reset, would otherwise pull and upload the vehicle's entire history over a link that has better things to do.
+
+The rule is:
+
+- **A log that appears while logloader is watching** is downloaded and uploaded. In practice that means the log a flight just produced.
+- **On a database that has never seen this vehicle**, only the most recent log is taken. Everything else is left alone.
+- **Anything else happens because it was asked for**, from the ARK-OS Logs page or the HTTP API below.
+
+Two further guards fall out of the same idea. A log is only considered at all once two consecutive listings agree on its size, so the log being written right now is never fetched at a size it will not keep. And if a single listing turns up more than `download.max_auto_queue` new logs, that is a card logloader has not seen rather than a flight that just happened, so it queues only the newest and says so.
+
+Downloading and uploading are suspended while the vehicle is armed.
+
+### HTTP API
+
+A small localhost API on port 3005 (`[api]` in the config) is what the ARK-OS Logs page talks to.
+
+| | |
+| --- | --- |
+| `GET /status` | connection, arm state, current transfer |
+| `GET /logs` | every known log with its download and upload state |
+| `GET /events` | the same as server-sent events, one per change |
+| `POST /logs/download` | `{"ids": [1,2]}` or `{"all": true}`; `"upload": false` to fetch without uploading |
+| `POST /logs/upload` | `{"ids": [1,2]}` or `{"all": true}`, optional `"targets": ["local"]` |
+| `POST /logs/cancel` | `{"ids": [1,2]}` — clears pending requests |
+| `DELETE /logs/{id}/file` | removes the downloaded copy to free space |
+
+A successful upload records the path Flight Review redirected to (`/plot_app?log=<uuid>`), which is what lets the UI link straight to the plot.
 
 ### Log transport
+
 Everything runs over **MAVLink FTP** (`FILE_TRANSFER_PROTOCOL`, msg 110): the directory listing that finds the logs and the bulk transfer that downloads them. The classic log protocol (`LOG_REQUEST_LIST` / `LOG_ENTRY` / `LOG_DATA`, msgs 117-120) is not used at all.
 
 `FILE_TRANSFER_PROTOCOL` carries `target_system` and `target_component`, and both PX4 and ArduPilot address their replies back to the requesting sysid/compid, so a download is unicast between the vehicle and logloader. `LOG_DATA` has no target fields, which leaves a router in between — mavlink-router, for instance — no choice but to copy every chunk to every endpoint it serves, telemetry radio included. A log download over the old protocol saturates links that have no interest in it.
@@ -15,90 +41,92 @@ Everything runs over **MAVLink FTP** (`FILE_TRANSFER_PROTOCOL`, msg 110): the di
 The autopilot's MAVLink instance must have FTP enabled (`mavlink start -x` on PX4). If it does not, logloader says so and idles.
 
 ### Log discovery
-At startup logloader lists the vehicle's log directory, trying `@MAV_LOG` first — the virtual log directory the MAVLink FTP specification defines, supported by PX4 v1.17 and newer — then the physical `/fs/microsd/log` (PX4) and `/APM/LOGS` (ArduPilot). Set `remote_log_directory` to skip the probe. The listing is what identifies a log: its path below the log root plus its size. PX4's nested `<date>/<time>.ulg` layout and ArduPilot's flat `<number>.BIN` layout are both handled, and the file extension follows whatever the vehicle actually has.
 
-Log timestamps come from the modification time in the listing when the vehicle supports the `ListDirectoryWithTime` opcode (PX4 v1.17 and newer). Otherwise PX4 logs fall back to the start time encoded in the path, and ArduPilot logs have no timestamp — nothing depends on having one.
+logloader lists the vehicle's log directory, trying `@MAV_LOG` first — the virtual log directory the MAVLink FTP specification defines, supported by PX4 v1.17 and newer — then the physical `/fs/microsd/log` (PX4), `/APM/LOGS` (ArduPilot) and `/log` (PX4 SITL). Set `download.remote_directory` to skip the probe.
+
+The listing is what identifies a log: its path below the log root plus its size. PX4's nested `<date>/<time>.ulg` layout and ArduPilot's flat `<number>.BIN` layout are both handled.
+
+Timestamps come from the modification time in the listing when the vehicle supports the `ListDirectoryWithTime` opcode (PX4 v1.17 and newer). Otherwise PX4 logs fall back to the start time encoded in the path, and ArduPilot logs have no timestamp — nothing depends on having one.
 
 Downloads are staged in a temporary directory and only moved next to the finished logs once the transferred size matches the listing, so a partial file is never mistaken for a complete one.
 
-`.BIN` files are not accepted by review.px4.io, so on ArduPilot leave `upload_enabled = false` or point `remote_server` somewhere that understands dataflash logs.
+`.BIN` files are not accepted by review.px4.io, so on ArduPilot leave the remote target disabled or point it somewhere that understands dataflash logs.
 
 ### Upgrading from a pre-FTP logloader
-Older versions identified logs by the timestamp `LOG_ENTRY` reported, which MAVLink FTP cannot reproduce. On first start the existing `logs` table is renamed to `logs_legacy` and its rows are matched against the FTP listing by size, so logs already downloaded and uploaded are not fetched or uploaded a second time. Nothing is deleted; `logs_legacy` stays behind for inspection.
+
+Older versions kept a database per server and identified logs by the timestamp `LOG_ENTRY` reported, which MAVLink FTP cannot reproduce. On first start `local_server.db` and `remote_server.db` are imported into a single `logloader.db` and their rows matched against the FTP listing by size, so logs already downloaded and uploaded are not fetched or uploaded a second time. The old files are left untouched.
 
 ### Configuration
+
+`config.toml`, in full, is documented inline in the shipped file. The keys:
+
 | Key | Default | Description |
 | --- | --- | --- |
 | `connection_url` | `udp://:14551` | MAVSDK connection string |
-| `local_server` | `http://127.0.0.1:5006` | Local upload target |
-| `remote_server` | `https://review.px4.io` | Remote upload target |
-| `email` | `""` | Email attached to remote uploads |
-| `remote_api_key` | `""` | Per-account API key for authenticated Flight Review (`Authorization: Bearer` + `X-API-Key`). Empty = upload without API key headers (open servers). Generate under /account |
-| `upload_enabled` | `false` | Upload to the remote server |
-| `public_logs` | `false` | Mark remote uploads public |
-| `remote_log_directory` | `""` | Override the vehicle log directory |
-| `ftp_use_burst` | `true` | Use FTP burst reads |
+| `log_level` | `info` | `error`, `warn`, `info` or `debug` |
+| `data.directory` | `$XDG_DATA_HOME/ark/logloader/` | Logs and the database |
+| `api.enabled` / `api.bind` / `api.port` | `true` / `127.0.0.1` / `3005` | Local HTTP API |
+| `download.auto` | `true` | Queue logs that appear while running |
+| `download.latest_on_first_start` | `true` | On a fresh database, take only the newest |
+| `download.auto_upload` | `true` | Upload what was queued automatically |
+| `download.max_auto_queue` | `5` | Bulk-discovery guard; 0 disables |
+| `download.index_interval` | `30` | Seconds between listings |
+| `download.remote_directory` | `""` | Override the vehicle log directory |
+| `download.use_burst` | `true` | FTP burst reads |
+| `upload.interval` | `10` | Seconds between upload passes |
+| `upload.local.*` | enabled, `http://127.0.0.1:5006` | Flight Review on the companion |
+| `upload.remote.*` | disabled, `https://logs.px4.io` | `url`, `email`, `public`, `api_key` |
+
+The flat keys the previous layout used (`local_server`, `remote_server`, `upload_enabled`, `public_logs`, `email`, `remote_api_key`, `remote_log_directory`, `ftp_use_burst`, `application_directory`) are still read, so an existing config keeps working.
 
 ### Build
-Install dependencies
+
 ```
 sudo apt-get install libsqlite3-dev
 ```
-Install MAVSDK if you haven't already, the latest releases can be found at https://github.com/mavlink/MAVSDK/releases
-```
-sudo dpkg -i libmavsdk-dev_2.4.1_debian12_arm64.deb
-```
-Or install MAVSDK from source
+Install MAVSDK if you haven't already; releases are at https://github.com/mavlink/MAVSDK/releases
 ```
-git clone --recurse-submodules https://github.com/mavlink/MAVSDK.git
-cd MAVSDK
-cmake -Bbuild/default -DCMAKE_BUILD_TYPE=Release -H.
-sudo cmake --build build/default -j$(nproc) --target install
-cd ..
-```
-Upgrade OpenSSL if your version is less than 3.0.2
-```
-openssl version
-```
-A script is provided for your convenience
-```
-./install_openssl.sh
+sudo dpkg -i libmavsdk-dev_3.17.1_ubuntu24.04_amd64.deb
 ```
+OpenSSL must be 3.0.2 or newer (`openssl version`); `./install_openssl.sh` is provided if it is not.
 
-Clone this repository
 ```
 git clone --recurse-submodules https://github.com/ARK-Electronics/logloader.git
 cd logloader
 make
 ```
 
+`make` builds Release. `make debug` builds with debug symbols and no optimisation; the log level is a runtime setting either way.
+
 ### Run
+
 ```bash
-./build/logloader | tee output.txt
+./build/logloader --config config.toml
+```
+
+```
+logloader starting, configuration from config.toml
+API listening on 127.0.0.1:3005
+Connected to the autopilot
+MAVLink FTP available, indexed 6 logs in /fs/microsd/log
+First index: 5 logs on the vehicle, queueing only the newest. Use the ARK-OS Logs page to fetch any of the others.
+Downloading 1/1: 2026-07-28/17_21_01.ulg (1.1 MB)
+Downloaded 2026-07-28/17_21_01.ulg in 1.5s (691.4 kB/s)
+Uploaded 2026-07-28/17_21_01.ulg to local: http://127.0.0.1:5006/plot_app?log=95699be6-...
 ```
 
+### Testing against PX4 SITL
+
+SITL keeps its logs in `/log` relative to the working directory, which is in the probe list, so no configuration is needed beyond the port:
+
 ```
-Downloading...	2023-10-05T15:06:42Z	0.97249500MB	100%	3889.98000000 Kbps
-Downloading...	2023-10-05T15:06:58Z	0.46985700MB	98%	3686.40000000 Kbps
-Downloading...	2023-10-05T15:10:56Z0 Kb1.86199000MB	100%	4965.30666667 Kbps
-Downloading...	2023-10-07T08:52:14Z	0.38373500MB	100%	inf Kbps
-Downloading...	2023-10-07T08:56:18Z	0.26428000MB	100%	inf Kbps
-Downloading...	2023-10-07T09:04:18Z	0.42428500MB	100%	3394.28000000 Kbps
-Downloading...	2023-10-07T09:04:40Z	0.91263600MB	100%	7301.08800000 Kbps
-Downloading...	2023-10-07T09:05:20Z	1.33783000MB	100%	3567.54666667 Kbps
-Downloading...	2023-10-07T09:07:32Z	0.85526800MB	100%	3421.07200000 Kbps
-Downloading...	2023-10-07T09:22:00Z	0.82437500MB	100%	6595.00000000 Kbps
-Downloading...	2023-10-07T09:22:26Z	0.79509800MB	100%	6360.78400000 Kbps
-Downloading...	2023-10-07T09:26:10Z	0.88394300MB	100%	3535.77200000 Kbps
-Downloading...	2023-10-07T10:14:00Z	10.71558000MB	100%	2449.27542857 Kbps
-Downloading...	2023-10-07T12:03:40Z	0.64674900MB	100%	5173.99200000 Kbps
-Downloading...	2023-10-07T12:05:04Z	3.79014100MB	100%	3032.11280000 Kbps
-Downloading...	2023-10-07T12:14:46Z	2.24213400MB	100%	2989.51200000 Kbps
-Downloading...	2023-10-07T12:50:12Z	0.78112200MB	100%	3124.48800000 Kbps
+PX4_SIM_MODEL=none build/px4_sitl_default/bin/px4 build/px4_sitl_default/etc \
+    -s build/px4_sitl_default/etc/init.d-posix/rcS -d
+./build/logloader --config <config with connection_url = "udp://:14540">
 ```
 
 ### Install
-Build and install
+
 ```
 make install
 ```
@@ -110,17 +138,6 @@ make install
 | **Data directory**   | `~/.local/share/ark/logloader/`        |
 | **Logs directory**   | `~/.local/share/ark/logloader/logs/`   |
 
-### Performance
-Monitor network traffic
-```
-sudo iftop -i wlo1
-```
-Or use a Wireshark filter
-```
-mavlink_proto.msgid == 110
-```
-
-Watch your beautiful logs arrive
-
 ### Future developments
-- Multiple backends: e.g. RobotoAI, DroneLogbook, Auterion Suite, Aloft etc
+- Resume interrupted transfers rather than restarting them.
+- Multiple backends: e.g. RobotoAI, DroneLogbook, Auterion Suite, Aloft.
diff --git a/config.toml b/config.toml
index 0e34d76..c004c3c 100644
--- a/config.toml
+++ b/config.toml
@@ -1,22 +1,66 @@
+# MAVSDK connection to the autopilot. The link must have MAVLink FTP enabled
+# (PX4: "mavlink start -x").
 connection_url = "udp://:14551"
-local_server = "http://127.0.0.1:5006"
-remote_server = "https://review.px4.io"
-email = ""
-upload_enabled = false
-public_logs = false
 
-# Per-account API key for authenticated Flight Review (ARK).
-# Generate at https://review.arkelectron.com/account (shown once; format fr_...).
-# When set: sent as Authorization: Bearer and X-API-Key on POST /upload.
-# When empty: remote uploads are still attempted without API key headers
-# (works for open servers; ARK Flight Review will reject with 403).
-remote_api_key = ""
+# error | warn | info | debug
+log_level = "info"
+
+[data]
+# Where logs and the database live. Empty uses $XDG_DATA_HOME/ark/logloader/.
+directory = ""
+
+# Local HTTP API. ARK-OS talks to this to list logs and ask for particular ones.
+[api]
+enabled = true
+bind = "127.0.0.1"
+port = 3005
+
+[download]
+# Fetch a log as soon as it appears, which in practice means after a flight.
+auto = true
+
+# On a database that has never seen this vehicle, every log looks new. Rather
+# than pull an entire SD card the first time logloader runs, take only the most
+# recent one. Everything else is available from the ARK-OS Logs page.
+latest_on_first_start = true
+
+# Upload whatever was fetched automatically. Turn this off to download after a
+# flight but upload only on request.
+auto_upload = true
+
+# If one listing turns up more new logs than this, it is a card we have not seen
+# rather than a flight that just happened: queue only the newest and leave the
+# rest to the operator. 0 disables the guard.
+max_auto_queue = 5
+
+# Seconds between vehicle listings. Drops to 5s for a few passes after landing.
+index_interval = 30
 
 # Vehicle log directory. Empty probes "@MAV_LOG" (the virtual log directory from
 # the MAVLink FTP specification), then "/fs/microsd/log" (PX4) and "/APM/LOGS"
-# (ArduPilot). Set this when the logs live somewhere else.
-remote_log_directory = ""
+# (ArduPilot).
+remote_directory = ""
 
-# FTP burst reads. Much faster, disable it if the flight stack's burst support
+# FTP burst reads. Much faster; disable if the flight stack's burst support
 # misbehaves.
-ftp_use_burst = true
+use_burst = true
+
+[upload]
+# Seconds between upload passes.
+interval = 10
+
+# Flight Review running on this companion. Left open, so no key is needed.
+[upload.local]
+enabled = true
+url = "http://127.0.0.1:5006"
+public = true
+
+[upload.remote]
+enabled = false
+url = "https://logs.px4.io"
+email = ""
+public = false
+
+# Per-account key for an authenticated Flight Review. When empty no
+# authorization headers are sent at all, which is what open servers expect.
+api_key = ""
diff --git a/src/ApiServer.cpp b/src/ApiServer.cpp
new file mode 100644
index 0000000..f66442b
--- /dev/null
+++ b/src/ApiServer.cpp
@@ -0,0 +1,351 @@
+#include "ApiServer.hpp"
+#include "Log.hpp"
+#include "LogLoader.hpp"
+
+#include <algorithm>
+#include <chrono>
+#include <ctime>
+
+#include <httplib.h>
+#include <nlohmann/json.hpp>
+
+using json = nlohmann::json;
+
+namespace
+{
+
+// The SSE stream sends a keepalive at this interval when nothing has changed,
+// so an idle connection is not mistaken for a dead one by anything in between.
+constexpr auto kEventKeepalive = std::chrono::seconds(15);
+
+std::string iso8601_utc(int64_t time_utc)
+{
+	char buffer[sizeof "2026-07-28T10:30:00Z"];
+	const auto as_time_t = static_cast<time_t>(time_utc);
+	std::tm tm {};
+	gmtime_r(&as_time_t, &tm);
+	strftime(buffer, sizeof(buffer), "%FT%TZ", &tm);
+	return buffer;
+}
+
+json to_json(const LogDatabase::Entry& entry)
+{
+	json uploads = json::object();
+
+	for (const auto& [target, state] : entry.uploads) {
+		uploads[target] = {
+			{"uploaded", state.uploaded},
+			{"requested", state.requested},
+			{"rejected", state.rejected},
+			{"location", state.location},
+			{"message", state.message},
+		};
+	}
+
+	const auto slash = entry.path.find_last_of('/');
+
+	return {
+		{"id", entry.id},
+		{"path", entry.path},
+		{"name", slash == std::string::npos ? entry.path : entry.path.substr(slash + 1)},
+		{"size_bytes", entry.size_bytes},
+		{"time_utc", entry.time_utc.has_value() ? json(entry.time_utc.value()) : json(nullptr)},
+		{"date", entry.time_utc.has_value() ? iso8601_utc(entry.time_utc.value()) : ""},
+		{"present", entry.present},
+		{"downloaded", entry.downloaded},
+		{"download_requested", entry.download_requested},
+		{"download_failures", entry.download_failures},
+		{"last_error", entry.last_error},
+		{"uploads", uploads},
+	};
+}
+
+json to_json(const StatusBoard::Snapshot& snapshot)
+{
+	return {
+		{"connected", snapshot.connected},
+		{"armed", snapshot.armed},
+		{"ftp_available", snapshot.ftp_available},
+		{"log_root", snapshot.log_root},
+		{"downloading_id", snapshot.downloading_id},
+		{"downloaded_bytes", snapshot.downloaded_bytes},
+		{"download_total_bytes", snapshot.download_total_bytes},
+		{"uploading_id", snapshot.uploading_id},
+		{"uploading_target", snapshot.uploading_target},
+		{"revision", snapshot.revision},
+	};
+}
+
+// Parses a request body, answering 400 rather than throwing on malformed input.
+bool parse_body(const httplib::Request& request, httplib::Response& response, json& out)
+{
+	if (request.body.empty()) {
+		out = json::object();
+		return true;
+	}
+
+	out = json::parse(request.body, nullptr, false);
+
+	if (out.is_discarded() || !out.is_object()) {
+		response.status = 400;
+		response.set_content(json {{"error", "body must be a JSON object"}}.dump(), "application/json");
+		return false;
+	}
+
+	return true;
+}
+
+std::vector<int64_t> ids_from(const json& body)
+{
+	std::vector<int64_t> ids;
+
+	if (!body.contains("ids") || !body["ids"].is_array()) {
+		return ids;
+	}
+
+	for (const auto& id : body["ids"]) {
+		if (id.is_number_integer()) {
+			ids.push_back(id.get<int64_t>());
+		}
+	}
+
+	return ids;
+}
+
+} // namespace
+
+ApiServer::ApiServer(const Config& config, LogLoader& loader)
+	: _config(config)
+	, _loader(loader)
+	, _server(std::make_unique<httplib::Server>())
+{
+	install_routes();
+}
+
+ApiServer::~ApiServer()
+{
+	stop();
+}
+
+bool ApiServer::start()
+{
+	if (!_server->bind_to_port(_config.api_bind, _config.api_port)) {
+		LOG_ERROR("Could not bind the API to " << _config.api_bind << ":" << _config.api_port);
+		return false;
+	}
+
+	_thread = std::thread([this] { _server->listen_after_bind(); });
+	LOG("API listening on " << _config.api_bind << ":" << _config.api_port);
+	return true;
+}
+
+void ApiServer::stop()
+{
+	if (_server) {
+		_server->stop();
+	}
+
+	if (_thread.joinable()) {
+		_thread.join();
+	}
+}
+
+void ApiServer::install_routes()
+{
+	auto& database = _loader.database();
+
+	_server->Get("/status", [this](const httplib::Request&, httplib::Response & response) {
+		json payload = to_json(_loader.status().get());
+		payload["targets"] = _loader.enabled_target_names();
+		response.set_content(payload.dump(), "application/json");
+	});
+
+	_server->Get("/logs", [this, &database](const httplib::Request&, httplib::Response & response) {
+		json logs = json::array();
+
+		for (const auto& entry : database.all_logs()) {
+			logs.push_back(to_json(entry));
+		}
+
+		const json payload = {
+			{"logs", logs},
+			{"status", to_json(_loader.status().get())},
+			{"targets", _loader.enabled_target_names()},
+		};
+		response.set_content(payload.dump(), "application/json");
+	});
+
+	// One event per change, so the page reflects a transfer as it happens
+	// rather than on the next poll.
+	_server->Get("/events", [this, &database](const httplib::Request&, httplib::Response & response) {
+		// nginx buffers a streaming response into uselessness without this.
+		response.set_header("Cache-Control", "no-cache");
+		response.set_header("X-Accel-Buffering", "no");
+
+		auto last_revision = std::make_shared<uint64_t>(UINT64_MAX);
+
+		response.set_chunked_content_provider("text/event-stream",
+		[this, &database, last_revision](size_t, httplib::DataSink & sink) {
+			StatusBoard& status = _loader.status();
+
+			if (status.stopped()) {
+				sink.done();
+				return false;
+			}
+
+			const auto snapshot = status.wait_for_change(*last_revision, kEventKeepalive);
+
+			if (snapshot.revision == *last_revision) {
+				// Nothing happened; prove the connection is still good.
+				return sink.write(": keepalive\n\n", 14);
+			}
+
+			*last_revision = snapshot.revision;
+
+			json logs = json::array();
+
+			for (const auto& entry : database.all_logs()) {
+				logs.push_back(to_json(entry));
+			}
+
+			const json payload = {
+				{"logs", logs},
+				{"status", to_json(snapshot)},
+				{"targets", _loader.enabled_target_names()},
+			};
+			const std::string message = "event: logs\ndata: " + payload.dump() + "\n\n";
+			return sink.write(message.data(), message.size());
+		});
+	});
+
+	_server->Post("/logs/download", [this, &database](const httplib::Request & request, httplib::Response & response) {
+		json body;
+
+		if (!parse_body(request, response, body)) {
+			return;
+		}
+
+		std::vector<int64_t> ids = ids_from(body);
+
+		if (body.value("all", false)) {
+			ids.clear();
+
+			for (const auto& entry : database.all_logs()) {
+				if (entry.present && !entry.downloaded) {
+					ids.push_back(entry.id);
+				}
+			}
+		}
+
+		// An explicit request says nothing about uploading, so only the
+		// configured targets are asked for when the caller wants them.
+		std::vector<std::string> targets;
+
+		if (body.value("upload", true)) {
+			targets = _loader.enabled_target_names();
+		}
+
+		database.request_download(ids, targets);
+		_loader.wake();
+
+		response.set_content(json {{"queued", ids.size()}}.dump(), "application/json");
+	});
+
+	_server->Post("/logs/upload", [this, &database](const httplib::Request & request, httplib::Response & response) {
+		json body;
+
+		if (!parse_body(request, response, body)) {
+			return;
+		}
+
+		std::vector<std::string> targets = _loader.enabled_target_names();
+
+		if (body.contains("targets") && body["targets"].is_array()) {
+			std::vector<std::string> requested;
+
+			for (const auto& target : body["targets"]) {
+				if (target.is_string()) {
+					const std::string name = target.get<std::string>();
+
+					if (std::find(targets.begin(), targets.end(), name) != targets.end()) {
+						requested.push_back(name);
+					}
+				}
+			}
+
+			targets = requested;
+		}
+
+		if (targets.empty()) {
+			response.status = 400;
+			response.set_content(json {{"error", "no enabled upload target named"}}.dump(),
+			"application/json");
+			return;
+		}
+
+		std::vector<int64_t> ids = ids_from(body);
+
+		if (body.value("all", false)) {
+			ids.clear();
+
+			for (const auto& entry : database.all_logs()) {
+				const bool wanted = std::any_of(targets.begin(), targets.end(),
+				[&entry](const std::string & target) {
+					const auto it = entry.uploads.find(target);
+					return it != entry.uploads.end() && !it->second.uploaded;
+				});
+
+				if (wanted && (entry.downloaded || entry.present)) {
+					ids.push_back(entry.id);
+				}
+			}
+		}
+
+		database.request_upload(ids, targets);
+		_loader.wake();
+
+		response.set_content(json {{"queued", ids.size()}}.dump(), "application/json");
+	});
+
+	_server->Post("/logs/cancel", [this, &database](const httplib::Request & request, httplib::Response & response) {
+		json body;
+
+		if (!parse_body(request, response, body)) {
+			return;
+		}
+
+		const std::vector<int64_t> ids = ids_from(body);
+		database.cancel_requests(ids);
+		_loader.wake();
+
+		response.set_content(json {{"cancelled", ids.size()}}.dump(), "application/json");
+	});
+
+	_server->Delete(R"(/logs/(\d+)/file)", [this](const httplib::Request & request, httplib::Response & response) {
+		const int64_t id = std::stoll(request.matches[1]);
+
+		if (!_loader.delete_local_file(id)) {
+			response.status = 404;
+			response.set_content(json {{"error", "no such log"}}.dump(), "application/json");
+			return;
+		}
+
+		response.set_content(json {{"deleted", id}}.dump(), "application/json");
+	});
+
+	_server->set_exception_handler([](const httplib::Request&, httplib::Response & response,
+	std::exception_ptr exception) {
+		std::string message = "internal error";
+
+		try {
+			std::rethrow_exception(exception);
+
+		} catch (const std::exception& error) {
+			message = error.what();
+		}
+
+		LOG_ERROR("API request failed: " << message);
+		response.status = 500;
+		response.set_content(json {{"error", message}}.dump(), "application/json");
+	});
+}
diff --git a/src/ApiServer.hpp b/src/ApiServer.hpp
new file mode 100644
index 0000000..bfd1a34
--- /dev/null
+++ b/src/ApiServer.hpp
@@ -0,0 +1,45 @@
+#pragma once
+
+#include <memory>
+#include <thread>
+
+#include "Config.hpp"
+
+class LogLoader;
+
+namespace httplib
+{
+class Server;
+}
+
+// A small read/write HTTP surface on localhost, so ARK-OS can show the vehicle's
+// logs and ask for particular ones instead of logloader guessing.
+//
+//   GET    /status              what logloader is doing right now
+//   GET    /logs                every known log with its download/upload state
+//   GET    /events              the same, as server-sent events
+//   POST   /logs/download       {"ids": [..]} or {"all": true}
+//   POST   /logs/upload         {"ids": [..]} or {"all": true}, optional "targets"
+//   POST   /logs/cancel         {"ids": [..]}
+//   DELETE /logs/{id}/file      remove the downloaded copy
+class ApiServer
+{
+public:
+	ApiServer(const Config& config, LogLoader& loader);
+	~ApiServer();
+
+	ApiServer(const ApiServer&) = delete;
+	ApiServer& operator=(const ApiServer&) = delete;
+
+	// Binds and serves on a thread of its own. False when the port is taken.
+	bool start();
+	void stop();
+
+private:
+	void install_routes();
+
+	Config _config;
+	LogLoader& _loader;
+	std::unique_ptr<httplib::Server> _server;
+	std::thread _thread;
+};
diff --git a/src/Config.cpp b/src/Config.cpp
new file mode 100644
index 0000000..15b5ce4
--- /dev/null
+++ b/src/Config.cpp
@@ -0,0 +1,159 @@
+#include "Config.hpp"
+
+#include <algorithm>
+#include <cstdlib>
+#include <filesystem>
+#include <sstream>
+#include <stdexcept>
+
+#include <toml.hpp>
+
+namespace fs = std::filesystem;
+
+namespace
+{
+
+std::string env_or(const char* name, const std::string& fallback)
+{
+	const char* value = std::getenv(name);
+	return value != nullptr && value[0] != '\0' ? value : fallback;
+}
+
+std::string with_trailing_slash(std::string path)
+{
+	if (!path.empty() && path.back() != '/') {
+		path += '/';
+	}
+
+	return path;
+}
+
+std::string trim(std::string text)
+{
+	const auto first = text.find_first_not_of(" \t\r\n");
+
+	if (first == std::string::npos) {
+		return {};
+	}
+
+	const auto last = text.find_last_not_of(" \t\r\n");
+	return text.substr(first, last - first + 1);
+}
+
+// Reads preferred, then the flat top-level key the pre-overhaul layout used, so
+// an existing config.toml keeps working unchanged.
+template <typename T, typename Preferred, typename Legacy>
+T value_or(const Preferred& preferred, const Legacy& legacy, T fallback)
+{
+	if (auto value = preferred.template value<T>(); value.has_value()) {
+		return value.value();
+	}
+
+	if (auto value = legacy.template value<T>(); value.has_value()) {
+		return value.value();
+	}
+
+	return fallback;
+}
+
+} // namespace
+
+std::string resolve_config_path(int argc, char** argv)
+{
+	for (int i = 1; i < argc; i++) {
+		const std::string arg = argv[i];
+
+		if (arg == "--config" && i + 1 < argc) {
+			return argv[i + 1];
+		}
+
+		if (arg.rfind("--config=", 0) == 0) {
+			return arg.substr(std::string("--config=").size());
+		}
+	}
+
+	const std::string home = env_or("HOME", "/tmp");
+	const auto user_config = fs::path(home) / ".config/ark/logloader/config.toml";
+	const auto installed_config = fs::path("/opt/ark/share/logloader/config.toml");
+
+	return (fs::exists(user_config) ? user_config : installed_config).string();
+}
+
+Config load_config(const std::string& path)
+{
+	toml::table file;
+
+	try {
+		file = toml::parse_file(path);
+
+	} catch (const toml::parse_error& error) {
+		std::ostringstream message;
+		message << "could not parse " << path << ": " << error.description();
+		throw std::runtime_error(message.str());
+	}
+
+	Config config;
+
+	config.connection_url = file["connection_url"].value_or("udp://:14551");
+
+	const std::string level_text = file["log_level"].value_or("info");
+
+	if (!logging::parse_level(level_text, config.log_level)) {
+		LOG_WARN("Unknown log_level \"" << level_text << "\", using info");
+	}
+
+	const std::string home = env_or("HOME", "/tmp");
+	const std::string xdg_data = env_or("XDG_DATA_HOME", home + "/.local/share");
+	const std::string default_data = xdg_data + "/ark/logloader/";
+
+	const auto data = file["data"];
+	const auto api = file["api"];
+	const auto download = file["download"];
+	const auto upload = file["upload"];
+	const auto local = upload["local"];
+	const auto remote = upload["remote"];
+
+	config.data_directory = with_trailing_slash(
+					value_or<std::string>(data["directory"], file["application_directory"], default_data));
+	config.logs_directory = config.data_directory + "logs/";
+
+	config.api_enabled = api["enabled"].value_or(true);
+	config.api_bind = api["bind"].value_or("127.0.0.1");
+	config.api_port = static_cast<uint16_t>(api["port"].value_or(3005));
+
+	config.auto_download = download["auto"].value_or(true);
+	config.download_latest_on_first_start = download["latest_on_first_start"].value_or(true);
+	config.auto_upload = download["auto_upload"].value_or(true);
+	config.max_auto_queue = download["max_auto_queue"].value_or(5);
+	config.index_interval_s = std::max(1, download["index_interval"].value_or(30));
+	config.upload_interval_s = std::max(1, upload["interval"].value_or(10));
+	config.remote_log_directory =
+		value_or<std::string>(download["remote_directory"], file["remote_log_directory"], "");
+	config.use_burst = value_or<bool>(download["use_burst"], file["ftp_use_burst"], true);
+
+	config.local.name = kTargetLocal;
+	config.local.url = value_or<std::string>(local["url"], file["local_server"], "http://127.0.0.1:5006");
+	config.local.enabled = local["enabled"].value_or(true);
+	// Flight Review on the companion is open, and public is what makes a log
+	// findable in its web UI.
+	config.local.public_logs = local["public"].value_or(true);
+	config.local.email = local["email"].value_or("");
+	config.local.api_key = trim(local["api_key"].value_or<std::string>(""));
+
+	config.remote.name = kTargetRemote;
+	config.remote.url = value_or<std::string>(remote["url"], file["remote_server"], "https://logs.px4.io");
+	config.remote.enabled = value_or<bool>(remote["enabled"], file["upload_enabled"], false);
+	config.remote.public_logs = value_or<bool>(remote["public"], file["public_logs"], false);
+	config.remote.email = value_or<std::string>(remote["email"], file["email"], "");
+	config.remote.api_key = trim(value_or<std::string>(remote["api_key"], file["remote_api_key"], ""));
+
+	if (config.local.url.empty()) {
+		config.local.enabled = false;
+	}
+
+	if (config.remote.url.empty()) {
+		config.remote.enabled = false;
+	}
+
+	return config;
+}
diff --git a/src/Config.hpp b/src/Config.hpp
new file mode 100644
index 0000000..5e42c45
--- /dev/null
+++ b/src/Config.hpp
@@ -0,0 +1,67 @@
+#pragma once
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+#include "Log.hpp"
+
+// Names used for the two upload targets, in the database and in the API.
+constexpr const char* kTargetLocal = "local";
+constexpr const char* kTargetRemote = "remote";
+
+struct UploadTargetConfig {
+	std::string name;
+	bool enabled {false};
+	std::string url;
+	std::string email;
+	// Per-account key for authenticated Flight Review instances. Empty means
+	// no auth headers are sent at all, which is what open servers expect.
+	std::string api_key;
+	bool public_logs {false};
+};
+
+struct Config {
+	std::string connection_url;
+	logging::Level log_level {logging::Level::Info};
+
+	// Absolute, with a trailing slash.
+	std::string data_directory;
+	std::string logs_directory;
+
+	bool api_enabled {true};
+	std::string api_bind;
+	uint16_t api_port {5010};
+
+	// Queue a log for download as soon as it appears in a listing. This is what
+	// picks up the log a flight just produced.
+	bool auto_download {true};
+	// On a database that has never been indexed, queue only the newest log
+	// rather than the vehicle's entire history. See LogLoader::apply_auto_policy.
+	bool download_latest_on_first_start {true};
+	// Upload whatever was queued for download, to every enabled target.
+	bool auto_upload {true};
+	// If a single listing turns up more new logs than this, the vehicle is not
+	// handing us one flight's worth — it is a card we have never seen. Queue
+	// only the newest and leave the rest to the operator. 0 disables the guard.
+	int max_auto_queue {5};
+
+	int index_interval_s {30};
+	int upload_interval_s {10};
+
+	// Empty probes the known vehicle log directories.
+	std::string remote_log_directory;
+	bool use_burst {true};
+
+	UploadTargetConfig local;
+	UploadTargetConfig remote;
+
+	std::vector<const UploadTargetConfig*> targets() const { return {&local, &remote}; }
+};
+
+// --config <path> / --config=<path>, else the user override, else the
+// deb-installed default.
+std::string resolve_config_path(int argc, char** argv);
+
+// Throws std::runtime_error when the file cannot be parsed.
+Config load_config(const std::string& path);
diff --git a/src/FtpLogFetcher.cpp b/src/FtpLogFetcher.cpp
index 48bbc72..53671de 100644
--- a/src/FtpLogFetcher.cpp
+++ b/src/FtpLogFetcher.cpp
@@ -18,8 +18,9 @@ namespace
 // (PX4 >= v1.17). The physical paths cover firmware that predates it.
 constexpr const char* kProbeRoots[] = {
 	"@MAV_LOG",
-	"/fs/microsd/log", // PX4
+	"/fs/microsd/log", // PX4 on hardware
 	"/APM/LOGS",       // ArduPilot
+	"/log",            // PX4 SITL, and hardware without an SD card mount point
 };
 
 bool ends_with_ignore_case(const std::string& text, const std::string& suffix)
@@ -87,7 +88,10 @@ FtpLogFetcher::FtpLogFetcher(std::shared_ptr<mavsdk::System> system, const FtpLo
 	, _ftp(std::make_shared<mavsdk::Ftp>(system))
 	, _settings(settings)
 {
+	// A run killed mid-transfer leaves a partial file behind. Nothing here
+	// resumes, so the staging directory starts empty every time.
 	std::error_code ec;
+	fs::remove_all(_settings.temp_directory, ec);
 	fs::create_directories(_settings.temp_directory, ec);
 }
 
@@ -152,6 +156,17 @@ bool FtpLogFetcher::refresh()
 	return false;
 }
 
+const FtpLogFetcher::RemoteLog* FtpLogFetcher::find(const std::string& relative_path, uint32_t size_bytes) const
+{
+	for (const auto& log : _logs) {
+		if (log.relative_path == relative_path && log.size_bytes == size_bytes) {
+			return &log;
+		}
+	}
+
+	return nullptr;
+}
+
 void FtpLogFetcher::publish_index(std::vector<RemoteLog>&& logs)
 {
 	std::map<std::string, uint32_t> sizes;
@@ -253,7 +268,7 @@ bool FtpLogFetcher::download(const RemoteLog& log, const std::string& local_path
 
 	_ftp->download_async(remote_path, _settings.temp_directory, _settings.use_burst,
 	[transfer, progress](mavsdk::Ftp::Result result, mavsdk::Ftp::ProgressData data) {
-		if (transfer->settled) {
+		if (transfer->settled.load()) {
 			return;
 		}
 
@@ -265,15 +280,18 @@ bool FtpLogFetcher::download(const RemoteLog& log, const std::string& local_path
 			return;
 		}
 
-		transfer->settled = true;
-		transfer->promise.set_value(result);
+		// The waiter abandons the transfer on shutdown by setting this, so
+		// whoever gets there first is the one that settles the promise.
+		if (!transfer->settled.exchange(true)) {
+			transfer->promise.set_value(result);
+		}
 	});
 
 	// MAVSDK offers no way to cancel the transfer, so on shutdown the wait is
 	// abandoned instead of blocking until MAVSDK times out on its own.
 	while (future_result.wait_for(std::chrono::milliseconds(500)) != std::future_status::ready) {
 		if (_should_exit) {
-			transfer->settled = true;
+			transfer->settled.store(true);
 			fs::remove(staged_path, ec);
 			return false;
 		}
diff --git a/src/FtpLogFetcher.hpp b/src/FtpLogFetcher.hpp
index 097401a..2d64b90 100644
--- a/src/FtpLogFetcher.hpp
+++ b/src/FtpLogFetcher.hpp
@@ -69,6 +69,10 @@ class FtpLogFetcher
 	const std::string& root() const { return _root; }
 	const std::vector<RemoteLog>& logs() const { return _logs; }
 
+	// The indexed log with this identity, or nullptr when the last listing did
+	// not report it. The pointer is valid until the next refresh().
+	const RemoteLog* find(const std::string& relative_path, uint32_t size_bytes) const;
+
 	// Downloads a log into local_path, staging the transfer in temp_directory
 	// so partial files never appear next to finished ones. The size reported by
 	// the directory listing must match or the download is discarded.
diff --git a/src/Log.cpp b/src/Log.cpp
new file mode 100644
index 0000000..2a53375
--- /dev/null
+++ b/src/Log.cpp
@@ -0,0 +1,71 @@
+#include "Log.hpp"
+
+#include <atomic>
+#include <iostream>
+#include <mutex>
+
+namespace logging
+{
+
+namespace
+{
+
+std::atomic<Level> g_level {Level::Info};
+std::mutex g_mutex;
+
+const char* prefix(Level level)
+{
+	switch (level) {
+	case Level::Error: return "ERROR: ";
+
+	case Level::Warn: return "WARN: ";
+
+	case Level::Debug: return "DEBUG: ";
+
+	case Level::Info: break;
+	}
+
+	return "";
+}
+
+} // namespace
+
+void set_level(Level level)
+{
+	g_level.store(level, std::memory_order_relaxed);
+}
+
+bool enabled(Level level)
+{
+	return level <= g_level.load(std::memory_order_relaxed);
+}
+
+bool parse_level(const std::string& text, Level& out)
+{
+	if (text == "error") {
+		out = Level::Error;
+
+	} else if (text == "warn" || text == "warning") {
+		out = Level::Warn;
+
+	} else if (text == "info") {
+		out = Level::Info;
+
+	} else if (text == "debug") {
+		out = Level::Debug;
+
+	} else {
+		return false;
+	}
+
+	return true;
+}
+
+void write(Level level, const std::string& message)
+{
+	std::lock_guard<std::mutex> lock(g_mutex);
+	std::ostream& stream = level == Level::Error ? std::cerr : std::cout;
+	stream << prefix(level) << message << std::endl;
+}
+
+} // namespace logging
diff --git a/src/Log.hpp b/src/Log.hpp
index 2845f09..490390d 100644
--- a/src/Log.hpp
+++ b/src/Log.hpp
@@ -1,12 +1,43 @@
 #pragma once
 
-#include <iostream>
 #include <sstream>
+#include <string>
 
-#define LOG(x) std::cout << x << std::endl
+// Leveled, thread-safe logging. The level is a runtime setting (log_level in
+// config.toml) rather than a build flag, so a device in the field can be turned
+// up to debug without reinstalling a differently-compiled binary.
+namespace logging
+{
 
-#ifdef DEBUG_BUILD
-#define LOG_DEBUG(x) std::cout << "[DEBUG] " << x << std::endl
-#else
-#define LOG_DEBUG(x) do {} while(0)
-#endif
+enum class Level {
+	Error = 0,
+	Warn = 1,
+	Info = 2,
+	Debug = 3,
+};
+
+void set_level(Level level);
+bool enabled(Level level);
+
+// Returns false when the text does not name a level; out is left alone.
+bool parse_level(const std::string& text, Level& out);
+
+// One write() call emits one whole line, so lines from different threads never
+// interleave the way chained operator<< on std::cout does.
+void write(Level level, const std::string& message);
+
+} // namespace logging
+
+#define LOG_AT(level, expression)                    \
+	do {                                         \
+		if (logging::enabled(level)) {       \
+			std::ostringstream _log_oss; \
+			_log_oss << expression;      \
+			logging::write(level, _log_oss.str()); \
+		}                                    \
+	} while (0)
+
+#define LOG_ERROR(x) LOG_AT(logging::Level::Error, x)
+#define LOG_WARN(x)  LOG_AT(logging::Level::Warn, x)
+#define LOG(x)       LOG_AT(logging::Level::Info, x)
+#define LOG_DEBUG(x) LOG_AT(logging::Level::Debug, x)
diff --git a/src/LogDatabase.cpp b/src/LogDatabase.cpp
new file mode 100644
index 0000000..68a80a0
--- /dev/null
+++ b/src/LogDatabase.cpp
@@ -0,0 +1,739 @@
+#include "LogDatabase.hpp"
+#include "Config.hpp"
+#include "Log.hpp"
+#include "Sqlite.hpp"
+
+#include <algorithm>
+#include <cstdio>
+#include <cstdlib>
+#include <ctime>
+#include <filesystem>
+#include <iomanip>
+#include <sstream>
+
+namespace fs = std::filesystem;
+
+namespace
+{
+
+// Every SELECT reads the same columns in the same order, so row_to_entry only
+// has to be written once.
+const std::string kLogColumns =
+	"l.id, l.path, l.size_bytes, l.time_utc, l.local_path, l.downloaded, "
+	"l.download_requested, l.present, l.download_failures, l.last_error, l.discovered_at";
+
+// Newest first. Logs whose time the vehicle cannot report sort after the ones
+// it can, and fall back to the path: ArduPilot names logs with a bare counter,
+// so the longer name is the later one (100.BIN comes after 99.BIN).
+const std::string kNewestFirst =
+	"(l.time_utc IS NULL) ASC, l.time_utc DESC, LENGTH(l.path) DESC, l.path DESC";
+
+int64_t now_epoch()
+{
+	return static_cast<int64_t>(std::time(nullptr));
+}
+
+std::optional<int64_t> parse_iso8601_utc(const std::string& text)
+{
+	std::tm tm {};
+
+	if (sscanf(text.c_str(), "%4d-%2d-%2dT%2d:%2d:%2dZ",
+		   &tm.tm_year, &tm.tm_mon, &tm.tm_mday, &tm.tm_hour, &tm.tm_min, &tm.tm_sec) != 6) {
+		return std::nullopt;
+	}
+
+	tm.tm_year -= 1900;
+	tm.tm_mon -= 1;
+
+	return static_cast<int64_t>(timegm(&tm));
+}
+
+LogDatabase::Entry row_to_entry(const sqlite::Statement& stmt)
+{
+	LogDatabase::Entry entry;
+	entry.id = stmt.column_int(0);
+	entry.path = stmt.column_text(1);
+	entry.size_bytes = static_cast<uint32_t>(stmt.column_int(2));
+	entry.time_utc = stmt.column_optional_int(3);
+	entry.local_path = stmt.column_text(4);
+	entry.downloaded = stmt.column_int(5) != 0;
+	entry.download_requested = stmt.column_int(6) != 0;
+	entry.present = stmt.column_int(7) != 0;
+	entry.download_failures = static_cast<int>(stmt.column_int(8));
+	entry.last_error = stmt.column_text(9);
+	entry.discovered_at = stmt.column_int(10);
+	return entry;
+}
+
+} // namespace
+
+LogDatabase::LogDatabase(const std::string& db_path, const std::string& logs_directory,
+			 const std::vector<std::string>& targets)
+	: _logs_directory(logs_directory)
+	, _targets(targets)
+{
+	if (!initialize(db_path)) {
+		LOG_ERROR("Could not open the log database at " << db_path);
+		return;
+	}
+
+	import_legacy_databases(db_path);
+	_has_legacy_rows = sqlite::table_exists(_db, "legacy_logs");
+}
+
+LogDatabase::~LogDatabase()
+{
+	if (_db != nullptr) {
+		sqlite3_close(_db);
+	}
+}
+
+bool LogDatabase::initialize(const std::string& db_path)
+{
+	if (sqlite3_open(db_path.c_str(), &_db) != SQLITE_OK) {
+		LOG_ERROR("Cannot open database: " << sqlite3_errmsg(_db));
+		sqlite3_close(_db);
+		_db = nullptr;
+		return false;
+	}
+
+	// WAL lets the API server read while the download loop writes.
+	sqlite::execute(_db, "PRAGMA journal_mode = WAL");
+	sqlite::execute(_db, "PRAGMA foreign_keys = ON");
+	sqlite::execute(_db, "PRAGMA busy_timeout = 5000");
+
+	return create_schema();
+}
+
+bool LogDatabase::create_schema()
+{
+	const bool logs = sqlite::execute(_db,
+					  "CREATE TABLE IF NOT EXISTS logs ("
+					  "  id                 INTEGER PRIMARY KEY,"
+					  "  path               TEXT    NOT NULL,"
+					  "  size_bytes         INTEGER NOT NULL,"
+					  "  time_utc           INTEGER,"
+					  "  local_path         TEXT    NOT NULL DEFAULT '',"
+					  "  downloaded         INTEGER NOT NULL DEFAULT 0,"
+					  "  download_requested INTEGER NOT NULL DEFAULT 0,"
+					  "  present            INTEGER NOT NULL DEFAULT 1,"
+					  "  download_failures  INTEGER NOT NULL DEFAULT 0,"
+					  "  last_error         TEXT    NOT NULL DEFAULT '',"
+					  "  discovered_at      INTEGER NOT NULL DEFAULT 0,"
+					  "  UNIQUE (path, size_bytes))");
+
+	const bool uploads = sqlite::execute(_db,
+					     "CREATE TABLE IF NOT EXISTS uploads ("
+					     "  log_id     INTEGER NOT NULL REFERENCES logs(id) ON DELETE CASCADE,"
+					     "  target     TEXT    NOT NULL,"
+					     "  uploaded   INTEGER NOT NULL DEFAULT 0,"
+					     "  requested  INTEGER NOT NULL DEFAULT 0,"
+					     "  rejected   INTEGER NOT NULL DEFAULT 0,"
+					     "  location   TEXT    NOT NULL DEFAULT '',"
+					     "  message    TEXT    NOT NULL DEFAULT '',"
+					     "  updated_at INTEGER NOT NULL DEFAULT 0,"
+					     "  PRIMARY KEY (log_id, target))");
+
+	const bool meta = sqlite::execute(_db,
+					  "CREATE TABLE IF NOT EXISTS meta ("
+					  "  key   TEXT PRIMARY KEY,"
+					  "  value TEXT NOT NULL)");
+
+	return logs && uploads && meta;
+}
+
+// -------------------------------------------------------------------------
+// Index
+// -------------------------------------------------------------------------
+
+std::vector<int64_t> LogDatabase::sync_index(const std::vector<Discovered>& logs)
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	std::vector<int64_t> inserted;
+
+	sqlite::Transaction transaction(_db);
+
+	// The listing is complete (a partial one fails the whole refresh), so
+	// anything it does not mention is gone from the vehicle.
+	sqlite::execute(_db, "UPDATE logs SET present = 0");
+
+	const int64_t discovered_at = now_epoch();
+
+	for (const auto& log : logs) {
+		int64_t id = 0;
+		bool is_new = false;
+
+		{
+			sqlite::Statement insert(_db,
+						 "INSERT OR IGNORE INTO logs (path, size_bytes, time_utc, discovered_at) "
+						 "VALUES (?, ?, ?, ?)");
+			insert.bind(1, log.path)
+			.bind(2, static_cast<int64_t>(log.size_bytes))
+			.bind(3, log.time_utc)
+			.bind(4, discovered_at);
+			insert.execute();
+
+			if (sqlite3_changes(_db) > 0) {
+				id = sqlite3_last_insert_rowid(_db);
+				is_new = true;
+			}
+		}
+
+		if (!is_new) {
+			sqlite::Statement find(_db, "SELECT id FROM logs WHERE path = ? AND size_bytes = ?");
+			find.bind(1, log.path).bind(2, static_cast<int64_t>(log.size_bytes));
+
+			if (!find.step()) {
+				continue;
+			}
+
+			id = find.column_int(0);
+		}
+
+		// A firmware upgrade can start reporting modification times for logs
+		// that were indexed without one.
+		sqlite::Statement update(_db,
+					 "UPDATE logs SET present = 1, time_utc = COALESCE(time_utc, ?) WHERE id = ?");
+		update.bind(1, log.time_utc).bind(2, id);
+		update.execute();
+
+		if (is_new) {
+			ensure_upload_rows(id);
+
+			if (_has_legacy_rows) {
+				grandfather(id, log);
+			}
+
+			inserted.push_back(id);
+		}
+	}
+
+	transaction.commit();
+
+	return inserted;
+}
+
+void LogDatabase::ensure_upload_rows(int64_t id)
+{
+	for (const auto& target : _targets) {
+		sqlite::Statement stmt(_db, "INSERT OR IGNORE INTO uploads (log_id, target) VALUES (?, ?)");
+		stmt.bind(1, id).bind(2, target);
+		stmt.execute();
+	}
+}
+
+bool LogDatabase::first_index_seen() const
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	sqlite::Statement stmt(_db, "SELECT value FROM meta WHERE key = 'first_index_seen'");
+	return stmt.step() && stmt.column_text(0) == "1";
+}
+
+void LogDatabase::set_first_index_seen()
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	sqlite::Statement stmt(_db, "INSERT OR REPLACE INTO meta (key, value) VALUES ('first_index_seen', '1')");
+	stmt.execute();
+}
+
+// -------------------------------------------------------------------------
+// Intent
+// -------------------------------------------------------------------------
+
+void LogDatabase::request_download(const std::vector<int64_t>& ids, const std::vector<std::string>& targets)
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	sqlite::Transaction transaction(_db);
+
+	for (int64_t id : ids) {
+		// Clearing the failure count gives an explicitly re-requested log a
+		// fresh place in the queue instead of the back of it.
+		sqlite::Statement stmt(_db,
+				       "UPDATE logs SET download_requested = 1, download_failures = 0, last_error = '' "
+				       "WHERE id = ? AND downloaded = 0");
+		stmt.bind(1, id);
+		stmt.execute();
+
+		for (const auto& target : targets) {
+			sqlite::Statement upload(_db,
+						 "UPDATE uploads SET requested = 1, rejected = 0 "
+						 "WHERE log_id = ? AND target = ? AND uploaded = 0");
+			upload.bind(1, id).bind(2, target);
+			upload.execute();
+		}
+	}
+
+	transaction.commit();
+}
+
+void LogDatabase::request_upload(const std::vector<int64_t>& ids, const std::vector<std::string>& targets)
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	sqlite::Transaction transaction(_db);
+
+	for (int64_t id : ids) {
+		// An upload needs the file, so asking for one implies fetching it.
+		sqlite::Statement stmt(_db,
+				       "UPDATE logs SET download_requested = 1 WHERE id = ? AND downloaded = 0");
+		stmt.bind(1, id);
+		stmt.execute();
+
+		for (const auto& target : targets) {
+			sqlite::Statement upload(_db,
+						 "UPDATE uploads SET requested = 1, rejected = 0 "
+						 "WHERE log_id = ? AND target = ? AND uploaded = 0");
+			upload.bind(1, id).bind(2, target);
+			upload.execute();
+		}
+	}
+
+	transaction.commit();
+}
+
+void LogDatabase::cancel_requests(const std::vector<int64_t>& ids)
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	sqlite::Transaction transaction(_db);
+
+	for (int64_t id : ids) {
+		sqlite::Statement stmt(_db, "UPDATE logs SET download_requested = 0 WHERE id = ?");
+		stmt.bind(1, id);
+		stmt.execute();
+
+		sqlite::Statement upload(_db, "UPDATE uploads SET requested = 0 WHERE log_id = ?");
+		upload.bind(1, id);
+		upload.execute();
+	}
+
+	transaction.commit();
+}
+
+// -------------------------------------------------------------------------
+// Work queues
+// -------------------------------------------------------------------------
+
+std::vector<LogDatabase::Entry> LogDatabase::logs_to_download() const
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+
+	sqlite::Statement stmt(_db,
+			       "SELECT " + kLogColumns + " FROM logs l "
+			       "WHERE l.download_requested = 1 AND l.downloaded = 0 AND l.present = 1 "
+			       "ORDER BY l.download_failures ASC, " + kNewestFirst);
+
+	std::vector<Entry> entries;
+
+	while (stmt.step()) {
+		entries.push_back(row_to_entry(stmt));
+	}
+
+	attach_uploads(entries);
+	return entries;
+}
+
+std::vector<LogDatabase::Entry> LogDatabase::logs_to_upload(const std::string& target) const
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+
+	sqlite::Statement stmt(_db,
+			       "SELECT " + kLogColumns + " FROM logs l "
+			       "JOIN uploads u ON u.log_id = l.id "
+			       "WHERE u.target = ? AND u.requested = 1 AND u.uploaded = 0 AND u.rejected = 0 "
+			       "AND l.downloaded = 1 AND l.local_path != '' "
+			       "ORDER BY " + kNewestFirst);
+	stmt.bind(1, target);
+
+	std::vector<Entry> entries;
+
+	while (stmt.step()) {
+		entries.push_back(row_to_entry(stmt));
+	}
+
+	attach_uploads(entries);
+	return entries;
+}
+
+// -------------------------------------------------------------------------
+// State updates
+// -------------------------------------------------------------------------
+
+void LogDatabase::mark_downloaded(int64_t id, const std::string& local_path)
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	sqlite::Statement stmt(_db,
+			       "UPDATE logs SET downloaded = 1, download_requested = 0, local_path = ?, "
+			       "download_failures = 0, last_error = '' WHERE id = ?");
+	stmt.bind(1, local_path).bind(2, id);
+	stmt.execute();
+}
+
+void LogDatabase::record_download_failure(int64_t id, const std::string& error)
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	sqlite::Statement stmt(_db,
+			       "UPDATE logs SET download_failures = download_failures + 1, last_error = ? WHERE id = ?");
+	stmt.bind(1, error).bind(2, id);
+	stmt.execute();
+}
+
+void LogDatabase::mark_uploaded(int64_t id, const std::string& target, const std::string& location)
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	sqlite::Statement stmt(_db,
+			       "UPDATE uploads SET uploaded = 1, requested = 0, rejected = 0, location = ?, message = '', "
+			       "updated_at = ? WHERE log_id = ? AND target = ?");
+	stmt.bind(1, location).bind(2, now_epoch()).bind(3, id).bind(4, target);
+	stmt.execute();
+}
+
+void LogDatabase::mark_upload_rejected(int64_t id, const std::string& target, const std::string& message)
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	sqlite::Statement stmt(_db,
+			       "UPDATE uploads SET rejected = 1, requested = 0, message = ?, updated_at = ? "
+			       "WHERE log_id = ? AND target = ?");
+	stmt.bind(1, message).bind(2, now_epoch()).bind(3, id).bind(4, target);
+	stmt.execute();
+}
+
+void LogDatabase::record_upload_failure(int64_t id, const std::string& target, const std::string& message)
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	sqlite::Statement stmt(_db,
+			       "UPDATE uploads SET message = ?, updated_at = ? WHERE log_id = ? AND target = ?");
+	stmt.bind(1, message).bind(2, now_epoch()).bind(3, id).bind(4, target);
+	stmt.execute();
+}
+
+void LogDatabase::clear_local_file(int64_t id)
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	sqlite::Statement stmt(_db,
+			       "UPDATE logs SET downloaded = 0, local_path = '', download_requested = 0 WHERE id = ?");
+	stmt.bind(1, id);
+	stmt.execute();
+}
+
+// -------------------------------------------------------------------------
+// Queries
+// -------------------------------------------------------------------------
+
+std::vector<LogDatabase::Entry> LogDatabase::all_logs() const
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+
+	sqlite::Statement stmt(_db, "SELECT " + kLogColumns + " FROM logs l ORDER BY " + kNewestFirst);
+
+	std::vector<Entry> entries;
+
+	while (stmt.step()) {
+		entries.push_back(row_to_entry(stmt));
+	}
+
+	attach_uploads(entries);
+	return entries;
+}
+
+std::optional<LogDatabase::Entry> LogDatabase::log_by_id(int64_t id) const
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+
+	sqlite::Statement stmt(_db, "SELECT " + kLogColumns + " FROM logs l WHERE l.id = ?");
+	stmt.bind(1, id);
+
+	if (!stmt.step()) {
+		return std::nullopt;
+	}
+
+	std::vector<Entry> entries {row_to_entry(stmt)};
+	attach_uploads(entries);
+	return entries.front();
+}
+
+std::optional<int64_t> LogDatabase::newest_log_id(const std::vector<int64_t>& among) const
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+
+	std::string filter = "l.present = 1";
+
+	if (!among.empty()) {
+		filter += " AND l.id IN (?";
+
+		for (size_t i = 1; i < among.size(); i++) {
+			filter += ",?";
+		}
+
+		filter += ")";
+	}
+
+	sqlite::Statement stmt(_db,
+			       "SELECT l.id FROM logs l WHERE " + filter + " ORDER BY " + kNewestFirst + " LIMIT 1");
+
+	for (size_t i = 0; i < among.size(); i++) {
+		stmt.bind(static_cast<int>(i) + 1, among[i]);
+	}
+
+	if (!stmt.step()) {
+		return std::nullopt;
+	}
+
+	return stmt.column_int(0);
+}
+
+bool LogDatabase::local_path_in_use(const std::string& local_path, int64_t excluding_id) const
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+
+	sqlite::Statement stmt(_db, "SELECT COUNT(*) FROM logs WHERE local_path = ? AND id != ?");
+	stmt.bind(1, local_path).bind(2, excluding_id);
+
+	return stmt.step() && stmt.column_int(0) > 0;
+}
+
+void LogDatabase::attach_uploads(std::vector<Entry>& entries) const
+{
+	if (entries.empty()) {
+		return;
+	}
+
+	std::map<int64_t, Entry*> by_id;
+
+	for (auto& entry : entries) {
+		for (const auto& target : _targets) {
+			entry.uploads[target] = {};
+		}
+
+		by_id[entry.id] = &entry;
+	}
+
+	sqlite::Statement stmt(_db, "SELECT log_id, target, uploaded, requested, rejected, location, message FROM uploads");
+
+	while (stmt.step()) {
+		auto it = by_id.find(stmt.column_int(0));
+
+		if (it == by_id.end()) {
+			continue;
+		}
+
+		UploadState state;
+		state.uploaded = stmt.column_int(2) != 0;
+		state.requested = stmt.column_int(3) != 0;
+		state.rejected = stmt.column_int(4) != 0;
+		state.location = stmt.column_text(5);
+		state.message = stmt.column_text(6);
+
+		it->second->uploads[stmt.column_text(1)] = state;
+	}
+}
+
+// -------------------------------------------------------------------------
+// Migration from the pre-overhaul per-server databases
+// -------------------------------------------------------------------------
+
+void LogDatabase::import_legacy_databases(const std::string& db_path)
+{
+	const fs::path directory = fs::path(db_path).parent_path();
+
+	const std::pair<const char*, const char*> sources[] = {
+		{"local_server.db", kTargetLocal},
+		{"remote_server.db", kTargetRemote},
+	};
+
+	for (const auto& [file, target] : sources) {
+		const fs::path source = directory / file;
+
+		if (fs::exists(source)) {
+			import_legacy_database(source.string(), target);
+		}
+	}
+}
+
+void LogDatabase::import_legacy_database(const std::string& file, const std::string& target)
+{
+	// Importing twice would resurrect rows the user has since dealt with.
+	{
+		sqlite::Statement seen(_db, "SELECT value FROM meta WHERE key = ?");
+		seen.bind(1, "imported_" + target);
+
+		if (seen.step()) {
+			return;
+		}
+	}
+
+	sqlite::execute(_db,
+			"CREATE TABLE IF NOT EXISTS legacy_logs ("
+			"  target     TEXT    NOT NULL,"
+			"  uuid       TEXT    NOT NULL,"
+			"  legacy_id  INTEGER NOT NULL DEFAULT 0,"
+			"  date       TEXT    NOT NULL DEFAULT '',"
+			"  size_bytes INTEGER NOT NULL DEFAULT 0,"
+			"  downloaded INTEGER NOT NULL DEFAULT 0,"
+			"  uploaded   INTEGER NOT NULL DEFAULT 0,"
+			"  rejected   INTEGER NOT NULL DEFAULT 0,"
+			"  matched    INTEGER NOT NULL DEFAULT 0,"
+			"  PRIMARY KEY (target, uuid))");
+
+	sqlite::Statement attach(_db, "ATTACH DATABASE ? AS legacy");
+	attach.bind(1, file);
+
+	if (!attach.execute()) {
+		LOG_WARN("Could not read the previous database " << file);
+		return;
+	}
+
+	// Only the pre-FTP schema is ever imported: it keyed logs on a LOG_ENTRY
+	// index and timestamp, which is the state this class cannot reconstruct.
+	sqlite::Statement shape(_db, "SELECT COUNT(*) FROM pragma_table_info('logs', 'legacy') WHERE name = 'id'");
+
+	if (!shape.step() || shape.column_int(0) == 0) {
+		LOG_DEBUG("Previous database " << file << " has no pre-FTP log table, nothing to import");
+		sqlite::execute(_db, "DETACH DATABASE legacy");
+		return;
+	}
+
+	int imported = 0;
+
+	{
+		sqlite::Transaction transaction(_db);
+
+		sqlite::Statement read(_db,
+				       "SELECT uuid, id, date, size_bytes, downloaded, uploaded FROM legacy.logs");
+
+		while (read.step()) {
+			sqlite::Statement row(_db,
+					      "INSERT OR IGNORE INTO legacy_logs "
+					      "(target, uuid, legacy_id, date, size_bytes, downloaded, uploaded, rejected) "
+					      "VALUES (?, ?, ?, ?, ?, ?, ?, 0)");
+			row.bind(1, target)
+			.bind(2, read.column_text(0))
+			.bind(3, read.column_int(1))
+			.bind(4, read.column_text(2))
+			.bind(5, read.column_int(3))
+			.bind(6, read.column_int(4))
+			.bind(7, read.column_int(5));
+			row.execute();
+			imported++;
+		}
+
+		sqlite::Statement blacklist(_db,
+					    "UPDATE legacy_logs SET rejected = 1 "
+					    "WHERE target = ? AND uuid IN (SELECT uuid FROM legacy.blacklist)");
+		blacklist.bind(1, target);
+		blacklist.execute();
+
+		sqlite::Statement mark(_db, "INSERT OR REPLACE INTO meta (key, value) VALUES (?, '1')");
+		mark.bind(1, "imported_" + target);
+		mark.execute();
+
+		transaction.commit();
+	}
+
+	sqlite::execute(_db, "DETACH DATABASE legacy");
+
+	if (imported > 0) {
+		LOG("Imported " << imported << " log records from the previous " << target << " database");
+	}
+}
+
+void LogDatabase::grandfather(int64_t id, const Discovered& log)
+{
+	struct Candidate {
+		std::string target;
+		std::string uuid;
+		int64_t legacy_id {0};
+		std::string date;
+		bool downloaded {false};
+		bool uploaded {false};
+		bool rejected {false};
+	};
+
+	for (const auto& target : _targets) {
+		std::vector<Candidate> candidates;
+
+		{
+			sqlite::Statement stmt(_db,
+					       "SELECT uuid, legacy_id, date, downloaded, uploaded, rejected FROM legacy_logs "
+					       "WHERE target = ? AND matched = 0 AND size_bytes = ?");
+			stmt.bind(1, target).bind(2, static_cast<int64_t>(log.size_bytes));
+
+			while (stmt.step()) {
+				Candidate candidate;
+				candidate.target = target;
+				candidate.uuid = stmt.column_text(0);
+				candidate.legacy_id = stmt.column_int(1);
+				candidate.date = stmt.column_text(2);
+				candidate.downloaded = stmt.column_int(3) != 0;
+				candidate.uploaded = stmt.column_int(4) != 0;
+				candidate.rejected = stmt.column_int(5) != 0;
+				candidates.push_back(candidate);
+			}
+		}
+
+		if (candidates.empty()) {
+			continue;
+		}
+
+		// The old database recorded the log's modification time; the FTP index
+		// reports either that or the start time in the path, so the same log is
+		// at most a flight apart. With no time to compare, only a single
+		// unambiguous candidate is safe to claim.
+		const Candidate* match = nullptr;
+
+		if (log.time_utc.has_value()) {
+			constexpr int64_t kMaxDelta = 48 * 3600;
+			int64_t best = kMaxDelta;
+
+			for (const auto& candidate : candidates) {
+				const auto legacy_time = parse_iso8601_utc(candidate.date);
+
+				if (!legacy_time.has_value()) {
+					continue;
+				}
+
+				const int64_t delta = std::abs(legacy_time.value() - log.time_utc.value());
+
+				if (delta <= best) {
+					best = delta;
+					match = &candidate;
+				}
+			}
+
+		} else if (candidates.size() == 1) {
+			match = &candidates.front();
+		}
+
+		if (match == nullptr) {
+			continue;
+		}
+
+		// The name the old download used, so an already-fetched log is not
+		// fetched again.
+		std::ostringstream legacy_name;
+		legacy_name << _logs_directory << "LOG" << std::setfill('0') << std::setw(4)
+			    << match->legacy_id << "_" << match->date << ".ulg";
+
+		const std::string legacy_path = legacy_name.str();
+		const bool file_exists = fs::exists(legacy_path);
+		// A log whose file went missing but which was already uploaded does not
+		// need fetching again; one that was never uploaded does.
+		const bool downloaded = match->downloaded && (file_exists || match->uploaded);
+
+		sqlite::Statement update(_db,
+					 "UPDATE logs SET downloaded = ?, local_path = ? WHERE id = ? AND downloaded = 0");
+		update.bind(1, downloaded)
+		.bind(2, (match->downloaded && file_exists) ? legacy_path : std::string {})
+		.bind(3, id);
+		update.execute();
+
+		sqlite::Statement upload(_db,
+					 "UPDATE uploads SET uploaded = ?, rejected = ? WHERE log_id = ? AND target = ?");
+		upload.bind(1, match->uploaded).bind(2, match->rejected).bind(3, id).bind(4, target);
+		upload.execute();
+
+		sqlite::Statement mark(_db, "UPDATE legacy_logs SET matched = 1 WHERE target = ? AND uuid = ?");
+		mark.bind(1, target).bind(2, match->uuid);
+		mark.execute();
+
+		LOG_DEBUG("Carried over " << target << " state for " << log.path << " from the previous database");
+	}
+}
diff --git a/src/LogDatabase.hpp b/src/LogDatabase.hpp
new file mode 100644
index 0000000..820b740
--- /dev/null
+++ b/src/LogDatabase.hpp
@@ -0,0 +1,129 @@
+#pragma once
+
+#include <cstdint>
+#include <map>
+#include <mutex>
+#include <optional>
+#include <string>
+#include <vector>
+
+#include <sqlite3.h>
+
+// The inventory of the vehicle's logs and what logloader intends to do with
+// each one. There is exactly one of these; upload targets do not own state.
+//
+// A log is identified by its path below the vehicle log root plus its size.
+// The path alone is not enough: ArduPilot wraps its log numbering and reuses
+// file names, and a log that is still being written changes size.
+//
+// Every public method takes the internal mutex, so the download loop, the
+// upload thread and the API server can all call in without further locking.
+class LogDatabase
+{
+public:
+	struct UploadState {
+		bool uploaded {false};
+		bool requested {false};
+		// A server said no in a way that retrying cannot fix.
+		bool rejected {false};
+		// Path the server redirected to after a successful upload, e.g.
+		// "/plot_app?log=<uuid>". Relative, so the UI can reach it through
+		// whatever host it is talking to rather than the one logloader used.
+		std::string location;
+		std::string message; // Last thing the server said
+	};
+
+	struct Entry {
+		int64_t id {0};
+		std::string path;
+		uint32_t size_bytes {0};
+		std::optional<int64_t> time_utc;
+		std::string local_path;
+		bool downloaded {false};
+		bool download_requested {false};
+		// False once the log is gone from the vehicle. The row stays: a log we
+		// already fetched is still ours, and its upload history still matters.
+		bool present {true};
+		int download_failures {0};
+		std::string last_error;
+		int64_t discovered_at {0};
+		std::map<std::string, UploadState> uploads;
+	};
+
+	// A log as the vehicle listing reports it.
+	struct Discovered {
+		std::string path;
+		uint32_t size_bytes {0};
+		std::optional<int64_t> time_utc;
+	};
+
+	LogDatabase(const std::string& db_path, const std::string& logs_directory,
+		    const std::vector<std::string>& targets);
+	~LogDatabase();
+
+	LogDatabase(const LogDatabase&) = delete;
+	LogDatabase& operator=(const LogDatabase&) = delete;
+
+	bool ok() const { return _db != nullptr; }
+
+	// Index -------------------------------------------------------------
+	// Reconciles the table with a complete vehicle listing: inserts logs not
+	// seen before, and marks every row present or absent. Returns the ids of
+	// the rows this call created, in newest-first order.
+	std::vector<int64_t> sync_index(const std::vector<Discovered>& logs);
+
+	// False until the first complete listing has been reconciled. The
+	// difference matters: on a fresh database every log looks new, and
+	// queueing them all is exactly what we must not do.
+	bool first_index_seen() const;
+	void set_first_index_seen();
+
+	// Intent -------------------------------------------------------------
+	// Queues a download, and an upload to every target named in targets.
+	void request_download(const std::vector<int64_t>& ids, const std::vector<std::string>& targets);
+	void request_upload(const std::vector<int64_t>& ids, const std::vector<std::string>& targets);
+	// Clears pending requests. Work already done is left alone.
+	void cancel_requests(const std::vector<int64_t>& ids);
+
+	// Work ---------------------------------------------------------------
+	// Queued, still on the vehicle, fewest failures first so one log that
+	// cannot be fetched does not block the queue behind it.
+	std::vector<Entry> logs_to_download() const;
+	std::vector<Entry> logs_to_upload(const std::string& target) const;
+
+	void mark_downloaded(int64_t id, const std::string& local_path);
+	void record_download_failure(int64_t id, const std::string& error);
+	void mark_uploaded(int64_t id, const std::string& target, const std::string& location);
+	void mark_upload_rejected(int64_t id, const std::string& target, const std::string& message);
+	void record_upload_failure(int64_t id, const std::string& target, const std::string& message);
+
+	// Forgets the downloaded file (the caller removes it from disk).
+	void clear_local_file(int64_t id);
+
+	// Queries -------------------------------------------------------------
+	std::vector<Entry> all_logs() const;
+	std::optional<Entry> log_by_id(int64_t id) const;
+	// The most recent log still on the vehicle. Pass a non-empty among to
+	// restrict the answer to those ids.
+	std::optional<int64_t> newest_log_id(const std::vector<int64_t>& among = {}) const;
+	bool local_path_in_use(const std::string& local_path, int64_t excluding_id) const;
+
+private:
+	bool initialize(const std::string& db_path);
+	bool create_schema();
+	// Folds the pre-overhaul per-server databases into this one.
+	void import_legacy_databases(const std::string& db_path);
+	void import_legacy_database(const std::string& file, const std::string& target);
+	// Claims the state of a matching pre-FTP row, which was keyed on a
+	// timestamp that MAVLink FTP cannot reproduce, hence the match by size.
+	void grandfather(int64_t id, const Discovered& log);
+
+	void attach_uploads(std::vector<Entry>& entries) const;
+	void ensure_upload_rows(int64_t id);
+
+	mutable std::mutex _mutex;
+	sqlite3* _db {nullptr};
+	std::string _logs_directory;
+	std::vector<std::string> _targets;
+	bool _has_legacy_rows {false};
+};
diff --git a/src/LogLoader.cpp b/src/LogLoader.cpp
index 215c812..bd7e4dc 100644
--- a/src/LogLoader.cpp
+++ b/src/LogLoader.cpp
@@ -3,429 +3,550 @@
 
 #include <algorithm>
 #include <chrono>
-#include <ctime>
 #include <filesystem>
 #include <iomanip>
-#include <iostream>
+#include <sstream>
+
+#include <mavsdk/log_callback.h>
 
 namespace fs = std::filesystem;
 
 namespace
 {
 
-std::string iso8601_utc(int64_t time_utc)
+// How many logs in a row may fail transiently before the batch is abandoned for
+// this cycle. Enough to skip past a bad file, few enough not to hammer a server
+// that is having a bad day.
+constexpr int kMaxConsecutiveUploadRetries = 3;
+
+constexpr auto kFastIndexInterval = std::chrono::seconds(5);
+
+std::string human_size(uint32_t bytes)
 {
-	char buffer[sizeof "2018-08-31T20:50:42Z"];
-	const time_t as_time_t = static_cast<time_t>(time_utc);
-	std::tm tm {};
-	gmtime_r(&as_time_t, &tm);
-	strftime(buffer, sizeof(buffer), "%FT%TZ", &tm);
-	return buffer;
+	std::ostringstream out;
+	out << std::fixed << std::setprecision(1) << bytes / 1e6 << " MB";
+	return out.str();
 }
 
 } // namespace
 
-LogLoader::LogLoader(const LogLoader::Settings& settings)
-	: _settings(settings)
+LogLoader::LogLoader(const Config& config)
+	: _config(config)
+	, _database(config.data_directory + "logloader.db", config.logs_directory,
+		    std::vector<std::string> {kTargetLocal, kTargetRemote})
 {
-	// Disable mavsdk noise
-	mavsdk::log::subscribe([](...) {
-		// https://mavsdk.mavlink.io/main/en/cpp/guide/logging.html
-		return true;
-	});
+	// MAVSDK's own logging is noisy and duplicates what we report ourselves.
+	mavsdk::log::subscribe([](...) { return true; });
 
-	_logs_directory = _settings.application_directory + "logs/";
-
-	// Both databases live in the application directory, so it has to exist
-	// before the server interfaces open them
-	fs::create_directories(_logs_directory);
-
-	// Setup local server interface
-	ServerInterface::Settings local_server_settings = {
-		.server_url = settings.local_server,
-		.user_email = "",
-		.logs_directory = _logs_directory,
-		.db_path = _settings.application_directory + "local_server.db",
-		.upload_enabled = true, // Always upload to local server
-		.public_logs = true, // Public required true for searching using Web UI
-		.api_key = "", // Local Flight Review is typically open on the companion
-	};
+	std::error_code ec;
+	fs::create_directories(_config.logs_directory, ec);
 
-	// Setup remote server interface
-	ServerInterface::Settings remote_server_settings = {
-		.server_url = settings.remote_server,
-		.user_email = settings.email,
-		.logs_directory = _logs_directory,
-		.db_path = _settings.application_directory + "remote_server.db",
-		.upload_enabled = settings.upload_enabled,
-		.public_logs = settings.public_logs,
-		.api_key = settings.remote_api_key,
-	};
+	for (const auto* target : _config.targets()) {
+		_targets.push_back(std::make_unique<UploadTarget>(*target));
+	}
+}
 
-	_local_server = std::make_shared<ServerInterface>(local_server_settings);
-	_remote_server = std::make_shared<ServerInterface>(remote_server_settings);
+LogLoader::~LogLoader()
+{
+	stop();
+
+	if (_upload_thread.joinable()) {
+		_upload_thread.join();
+	}
 
-	std::cout << std::fixed << std::setprecision(8);
+	// Drop the MAVSDK plugins while everything they might call back into is
+	// still alive. Member destruction alone would do this in the right order,
+	// but only by accident of declaration order.
+	_ftp.reset();
+	_telemetry.reset();
+	_mavsdk.reset();
 }
 
-void LogLoader::stop()
+std::vector<std::string> LogLoader::enabled_target_names() const
 {
-	{
-		std::lock_guard<std::mutex> lock(_exit_cv_mutex);
-		_should_exit = true;
+	std::vector<std::string> names;
+
+	for (const auto& target : _targets) {
+		if (target->enabled()) {
+			names.push_back(target->name());
+		}
 	}
-	_exit_cv.notify_all();
 
-	if (_ftp_fetcher) {
-		_ftp_fetcher->stop();
+	return names;
+}
+
+void LogLoader::stop()
+{
+	_index_waiter.stop();
+	_upload_waiter.stop();
+	_status->shutdown();
+
+	if (_ftp) {
+		_ftp->stop();
 	}
 }
 
-bool LogLoader::wait_for(std::chrono::seconds duration)
+void LogLoader::wake()
 {
-	std::unique_lock<std::mutex> lock(_exit_cv_mutex);
-	_exit_cv.wait_for(lock, duration, [this] { return _should_exit.load(); });
-	return _should_exit;
+	_index_waiter.wake();
+	_upload_waiter.wake();
 }
 
-bool LogLoader::wait_for_mavsdk_connection(double timeout_ms)
+bool LogLoader::armed()
 {
-	LOG("Connecting to " << _settings.mavsdk_connection_url);
-	_mavsdk = std::make_shared<mavsdk::Mavsdk>(mavsdk::Mavsdk::Configuration(1, MAV_COMP_ID_ONBOARD_COMPUTER,
-			true)); // Emit heartbeats (Client)
-	auto result = _mavsdk->add_any_connection(_settings.mavsdk_connection_url);
+	return _telemetry && _telemetry->armed();
+}
 
-	if (result != mavsdk::ConnectionResult::Success) {
-		LOG("Connection failed: " << result);
-		return false;
-	}
+bool LogLoader::connect()
+{
+	while (!_index_waiter.stopped()) {
+		LOG("Connecting to " << _config.connection_url);
 
-	auto system = _mavsdk->first_autopilot(timeout_ms);
+		_mavsdk = std::make_shared<mavsdk::Mavsdk>(
+				  mavsdk::Mavsdk::Configuration(1, MAV_COMP_ID_ONBOARD_COMPUTER, true));
 
-	if (!system) {
-		LOG("Timed out waiting for system");
-		return false;
-	}
+		if (_mavsdk->add_any_connection(_config.connection_url) != mavsdk::ConnectionResult::Success) {
+			LOG_ERROR("Could not open " << _config.connection_url);
+			_mavsdk.reset();
+
+			if (_index_waiter.wait(std::chrono::seconds(5))) {
+				return false;
+			}
 
-	LOG("Connected.");
+			continue;
+		}
 
-	// MAVSDK plugins
-	_telemetry = std::make_shared<mavsdk::Telemetry>(system.value());
+		// Seconds, despite what the MAVSDK parameter name suggests.
+		auto system = _mavsdk->first_autopilot(3.0);
 
-	FtpLogFetcher::Settings ftp_settings = {
-		.temp_directory = _settings.application_directory + "tmp/",
-		.remote_directory = _settings.remote_log_directory,
-		.use_burst = _settings.ftp_use_burst,
-	};
+		if (!system) {
+			// Drop the connection before retrying: holding the UDP port open
+			// while rebinding it is how "address in use" happens.
+			_mavsdk.reset();
+			continue;
+		}
 
-	_ftp_fetcher = std::make_shared<FtpLogFetcher>(system.value(), ftp_settings);
+		LOG("Connected to the autopilot");
 
-	// PX4 serves a single FTP session, so one left open by a previous run (a
-	// hard kill mid-transfer) blocks every transfer until the vehicle reboots.
-	_ftp_fetcher->reset_sessions();
+		_telemetry = std::make_shared<mavsdk::Telemetry>(system.value());
 
-	return true;
+		FtpLogFetcher::Settings settings = {
+			.temp_directory = _config.data_directory + "tmp/",
+			.remote_directory = _config.remote_log_directory,
+			.use_burst = _config.use_burst,
+		};
+		_ftp = std::make_shared<FtpLogFetcher>(system.value(), settings);
+
+		// PX4 serves one FTP session at a time, so one left open by a run that
+		// was killed mid-transfer blocks every transfer until the vehicle
+		// reboots.
+		_ftp->reset_sessions();
+
+		_status->update([](StatusBoard::Snapshot & snapshot) { snapshot.connected = true; });
+		return true;
+	}
+
+	return false;
 }
 
 void LogLoader::run()
 {
-	auto upload_thread = std::thread(&LogLoader::upload_logs_thread, this);
-
-	while (!_should_exit) {
-		// Check if vehicle is armed or if the logger is running
-		// TODO: use SYS_STATUS flags to check logger status -- needs MAVSDK impl
-		// bool logger_running = _telemetry->sys_status_sensors().enabled & MAV_SYS_STATUS_LOGGING;
-		bool logger_running = false;
-		bool vehicle_armed = _telemetry->armed();
-
-		if (logger_running || vehicle_armed) {
-			_loop_disabled = true;
-			_remote_server->stop();
-			_local_server->stop();
-			std::this_thread::sleep_for(std::chrono::seconds(1));
-			continue;
+	_upload_thread = std::thread(&LogLoader::upload_loop, this);
+	index_loop();
+
+	_upload_waiter.stop();
+
+	if (_upload_thread.joinable()) {
+		_upload_thread.join();
+	}
+}
+
+// -------------------------------------------------------------------------
+// Index loop: everything that talks to the vehicle
+// -------------------------------------------------------------------------
 
-		} else if (_loop_disabled) {
-			_loop_disabled = false;
-			_remote_server->start();
-			_local_server->start();
-			// Stall for a few seconds to allow logger to finish writing
-			std::this_thread::sleep_for(std::chrono::seconds(3));
+void LogLoader::index_loop()
+{
+	while (!_index_waiter.stopped()) {
+		const bool is_armed = armed();
+
+		if (is_armed != _was_armed) {
+			_was_armed = is_armed;
+			_status->update([is_armed](StatusBoard::Snapshot & snapshot) { snapshot.armed = is_armed; });
+
+			if (!is_armed) {
+				// The logger needs a moment to close the file it was writing.
+				LOG("Vehicle disarmed, looking for a new log");
+				_fast_index_passes = 3;
+
+				if (_index_waiter.wait(std::chrono::seconds(3))) {
+					break;
+				}
+			}
 		}
 
-		if (!refresh_log_index()) {
-			if (wait_for(std::chrono::seconds(5))) {
+		if (is_armed) {
+			// Downloading competes with the logger for the SD card.
+			if (_index_waiter.wait(std::chrono::seconds(1))) {
 				break;
 			}
 
 			continue;
 		}
 
-		download_pending_logs();
+		std::vector<int64_t> new_ids;
+		size_t stable_count = 0;
+
+		if (refresh_index(new_ids, stable_count)) {
+			apply_auto_policy(new_ids, stable_count);
+			download_pending();
+		}
+
+		const auto interval = _fast_index_passes > 0
+				      ? kFastIndexInterval
+				      : std::chrono::seconds(_config.index_interval_s);
+
+		if (_fast_index_passes > 0) {
+			_fast_index_passes--;
+		}
 
-		// Periodically re-index the vehicle
-		if (wait_for(std::chrono::seconds(30))) {
+		if (_index_waiter.wait(interval)) {
 			break;
 		}
 	}
 
-	LOG_DEBUG("Waiting for upload thread");
-	upload_thread.join();
+	LOG_DEBUG("Index loop finished");
 }
 
-bool LogLoader::refresh_log_index()
+bool LogLoader::refresh_index(std::vector<int64_t>& new_ids, size_t& stable_count)
 {
-	auto request_start = std::chrono::steady_clock::now();
-
-	if (!_ftp_fetcher->refresh()) {
+	if (!_ftp->refresh()) {
+		_status->update([](StatusBoard::Snapshot & snapshot) { snapshot.ftp_available = false; });
 		return false;
 	}
 
-	const auto& logs = _ftp_fetcher->logs();
+	std::vector<LogDatabase::Discovered> discovered;
 	size_t growing = 0;
 
-	for (const auto& log : logs) {
+	for (const auto& log : _ftp->logs()) {
 		if (!log.stable) {
-			// Almost certainly the log being written right now. Leave it out of
-			// the databases entirely until it stops changing, so it never
-			// enters the download queue at a size it will not keep.
+			// Almost certainly the log being written right now. Recording it
+			// would enter it into the queue at a size it will not keep.
 			growing++;
 			continue;
 		}
 
-		ServerInterface::LogEntry entry;
-		entry.remote_path = log.relative_path;
-		entry.size_bytes = log.size_bytes;
-		entry.date = log.time_utc.has_value() ? iso8601_utc(log.time_utc.value()) : "";
-		entry.uuid = ServerInterface::generate_uuid(entry.remote_path, entry.size_bytes);
-
-		_local_server->sync_log(entry);
-		_remote_server->sync_log(entry);
+		discovered.push_back({log.relative_path, log.size_bytes, log.time_utc});
 	}
 
-	std::chrono::duration<double> duration = std::chrono::steady_clock::now() - request_start;
-	LOG_DEBUG("Indexed " << logs.size() - growing << " of " << logs.size() << " logs in "
-		  << duration.count() << " seconds (" << growing << " still being written)");
+	stable_count = discovered.size();
+	new_ids = _database.sync_index(discovered);
+
+	const std::string root = _ftp->root();
+	_status->update([&root](StatusBoard::Snapshot & snapshot) {
+		snapshot.ftp_available = true;
+		snapshot.log_root = root;
+	});
+
+	LOG_DEBUG("Indexed " << discovered.size() << " logs in " << root
+		  << (growing > 0 ? " (" + std::to_string(growing) + " still being written)" : ""));
 
 	return true;
 }
 
-const FtpLogFetcher::RemoteLog* LogLoader::find_remote_log(const ServerInterface::DatabaseEntry& db_entry) const
+void LogLoader::apply_auto_policy(const std::vector<int64_t>& new_ids, size_t stable_count)
 {
-	for (const auto& log : _ftp_fetcher->logs()) {
-		if (log.relative_path == db_entry.remote_path && log.size_bytes == db_entry.size_bytes) {
-			return &log;
+	std::vector<std::string> upload_to;
+
+	if (_config.auto_upload) {
+		upload_to = enabled_target_names();
+	}
+
+	// A database that has never been reconciled cannot tell a log produced by
+	// the flight that just happened from one that has been on the card for a
+	// year. Everything looks new, so almost nothing is fetched.
+	if (!_database.first_index_seen()) {
+		// A log only counts once two listings agree on its size, so the very
+		// first listing after startup legitimately reconciles nothing. Calling
+		// that the first index would make the next one -- the vehicle's entire
+		// history -- look like logs that appeared while we were watching, which
+		// is precisely the bulk download this policy exists to prevent.
+		if (stable_count == 0) {
+			return;
+		}
+
+		_database.set_first_index_seen();
+
+		if (!_config.download_latest_on_first_start) {
+			LOG("First index: " << stable_count
+			    << " logs on the vehicle, none queued (download.latest_on_first_start is off)");
+			return;
+		}
+
+		const auto newest = _database.newest_log_id();
+
+		if (!newest.has_value()) {
+			return;
 		}
+
+		_database.request_download({newest.value()}, upload_to);
+		LOG("First index: " << stable_count << " logs on the vehicle, queueing only the newest. "
+		    "Use the ARK-OS Logs page to fetch any of the others.");
+		return;
+	}
+
+	if (!_config.auto_download || new_ids.empty()) {
+		return;
+	}
+
+	// More than a flight's worth appearing at once means the vehicle is showing
+	// us a card we have not seen, not that it flew ten times in 30 seconds.
+	if (_config.max_auto_queue > 0 && static_cast<int>(new_ids.size()) > _config.max_auto_queue) {
+		const auto newest = _database.newest_log_id(new_ids);
+
+		if (newest.has_value()) {
+			_database.request_download({newest.value()}, upload_to);
+		}
+
+		LOG_WARN(new_ids.size() << " new logs appeared at once, which looks like a different SD card. "
+			 "Queued only the newest; use the ARK-OS Logs page for the rest.");
+		return;
 	}
 
-	return nullptr;
+	_database.request_download(new_ids, upload_to);
+	LOG("Queued " << new_ids.size() << (new_ids.size() == 1 ? " new log" : " new logs"));
 }
 
-void LogLoader::download_pending_logs()
+// -------------------------------------------------------------------------
+// Download
+// -------------------------------------------------------------------------
+
+void LogLoader::download_pending()
 {
-	auto pending = _local_server->get_logs_to_download();
+	const auto pending = _database.logs_to_download();
 
 	if (pending.empty()) {
 		return;
 	}
 
-	// Retry the logs that have failed the least first, so a file that cannot be
-	// fetched never blocks the ones behind it.
-	std::stable_sort(pending.begin(), pending.end(),
-	[this](const ServerInterface::DatabaseEntry & lhs, const ServerInterface::DatabaseEntry & rhs) {
-		auto lhs_it = _download_failures.find(lhs.uuid);
-		auto rhs_it = _download_failures.find(rhs.uuid);
-		const int lhs_failures = lhs_it == _download_failures.end() ? 0 : lhs_it->second;
-		const int rhs_failures = rhs_it == _download_failures.end() ? 0 : rhs_it->second;
-		return lhs_failures < rhs_failures;
-	});
-
 	size_t index = 0;
 
-	for (const auto& db_entry : pending) {
-		if (_should_exit) {
+	for (const auto& entry : pending) {
+		if (_index_waiter.stopped()) {
 			return;
 		}
 
-		// Downloading competes with the logger for the SD card, so give the
-		// rest of the queue back to the outer loop as soon as the vehicle arms
-		if (_telemetry->armed()) {
+		if (armed()) {
 			LOG("Vehicle armed, pausing downloads");
 			return;
 		}
 
 		index++;
 
-		const FtpLogFetcher::RemoteLog* log = find_remote_log(db_entry);
+		const FtpLogFetcher::RemoteLog* remote = _ftp->find(entry.path, entry.size_bytes);
 
-		if (log == nullptr) {
-			// The index is only published when the whole directory listed, so
-			// a log that is not in it is genuinely gone from the vehicle.
-			LOG_DEBUG("Log " << db_entry.remote_path << " is no longer on the vehicle, forgetting it");
-			_local_server->delete_log(db_entry.uuid);
-			_remote_server->delete_log(db_entry.uuid);
+		if (remote == nullptr) {
+			// sync_index marks anything the listing omits absent, and the
+			// queue only offers present logs, so this is a race with a
+			// listing rather than a missing file.
+			LOG_DEBUG(entry.path << " is no longer in the index, skipping");
 			continue;
 		}
 
-		LOG("Downloading log " << index << "/" << pending.size() << ": " << db_entry.remote_path);
+		LOG("Downloading " << index << "/" << pending.size() << ": " << entry.path
+		    << " (" << human_size(entry.size_bytes) << ")");
 
-		if (download_log(db_entry, *log)) {
-			_download_failures.erase(db_entry.uuid);
+		if (download(entry, *remote)) {
+			_upload_waiter.wake();
 
 		} else {
-			_download_failures[db_entry.uuid]++;
+			_database.record_download_failure(entry.id, "download failed");
 		}
 	}
 }
 
-std::string LogLoader::local_path_for(const ServerInterface::DatabaseEntry& db_entry)
+bool LogLoader::download(const LogDatabase::Entry& entry, const FtpLogFetcher::RemoteLog& remote)
 {
-	std::string name = db_entry.remote_path;
-	std::replace(name.begin(), name.end(), '/', '_');
+	const std::string local_path = local_path_for(entry);
+	const auto started = std::chrono::steady_clock::now();
 
-	const std::string path = _logs_directory + name;
+	_status->update([&entry](StatusBoard::Snapshot & snapshot) {
+		snapshot.downloading_id = entry.id;
+		snapshot.downloaded_bytes = 0;
+		snapshot.download_total_bytes = entry.size_bytes;
+	});
 
-	// ArduPilot reuses log file names once its numbering wraps at
-	// LOG_MAX_FILES, so the name may already belong to a log we still have.
-	if (_local_server->local_path_in_use(path, db_entry.uuid)) {
-		return _logs_directory + db_entry.uuid.substr(0, 8) + "_" + name;
-	}
+	// MAVSDK reports progress per chunk, which is far more often than anyone
+	// needs to be told about it.
+	auto last_published = std::make_shared<std::chrono::steady_clock::time_point>(started);
 
-	return path;
-}
+	auto progress = [status = _status, last_published](uint32_t transferred, uint32_t total) {
+		const auto now = std::chrono::steady_clock::now();
 
-bool LogLoader::download_log(const ServerInterface::DatabaseEntry& db_entry, const FtpLogFetcher::RemoteLog& log)
-{
-	const std::string local_path = local_path_for(db_entry);
+		if (now - *last_published < std::chrono::milliseconds(500)) {
+			return;
+		}
 
-	auto time_start = std::chrono::steady_clock::now();
+		*last_published = now;
+		status->update([transferred, total](StatusBoard::Snapshot & snapshot) {
+			snapshot.downloaded_bytes = transferred;
+			snapshot.download_total_bytes = total;
+		});
+	};
 
-	FtpLogFetcher::ProgressCallback progress;
+	const bool ok = _ftp->download(remote, local_path, progress);
 
-#ifdef DEBUG_BUILD
-	// Held by the callback rather than captured by reference: MAVSDK owns the
-	// callback and this function returns without it on shutdown.
-	auto last_print = std::make_shared<std::chrono::steady_clock::time_point>(time_start);
+	_status->update([](StatusBoard::Snapshot & snapshot) {
+		snapshot.downloading_id = 0;
+		snapshot.downloaded_bytes = 0;
+		snapshot.download_total_bytes = 0;
+	});
 
-	progress = [remote_path = db_entry.remote_path, size_bytes = db_entry.size_bytes, time_start, last_print](
-	uint32_t bytes_transferred, uint32_t total_bytes) {
-		const auto now = std::chrono::steady_clock::now();
+	if (!ok) {
+		return false;
+	}
 
-		// One line per chunk buries everything else in the journal
-		if (now - *last_print < std::chrono::seconds(1)) {
-			return;
-		}
+	const double seconds = std::chrono::duration<double>(std::chrono::steady_clock::now() - started).count();
+	std::ostringstream rate;
+	rate << std::fixed << std::setprecision(1) << (seconds > 0 ? entry.size_bytes / seconds / 1e3 : 0.);
+	LOG("Downloaded " << entry.path << " in " << std::fixed << std::setprecision(1) << seconds
+	    << "s (" << rate.str() << " kB/s)");
 
-		*last_print = now;
+	_database.mark_downloaded(entry.id, local_path);
+	return true;
+}
 
-		auto elapsed_ms = std::chrono::duration_cast<std::chrono::milliseconds>(now - time_start).count();
-		double rate_kbps = elapsed_ms > 0 ? (bytes_transferred * 8.0) / elapsed_ms : 0.;
-		int percent = total_bytes > 0 ? int((100.0 * bytes_transferred) / total_bytes) : 0;
+std::string LogLoader::local_path_for(const LogDatabase::Entry& entry)
+{
+	std::string name = entry.path;
+	std::replace(name.begin(), name.end(), '/', '_');
 
-		LOG_DEBUG("Downloading: "
-			  << std::setw(24) << std::left << remote_path
-			  << std::setw(8) << std::fixed << std::setprecision(2) << size_bytes / 1e6 << "MB"
-			  << std::setw(6) << std::right << percent << "%"
-			  << std::setw(12) << std::fixed << std::setprecision(2) << rate_kbps << " Kbps"
-			  << std::flush);
-	};
-#endif
+	const std::string path = _config.logs_directory + name;
 
-	bool success = _ftp_fetcher->download(log, local_path, progress);
+	// ArduPilot reuses log file names once its numbering wraps at
+	// LOG_MAX_FILES, so the name may already belong to a log we still hold.
+	if (_database.local_path_in_use(path, entry.id)) {
+		return _config.logs_directory + std::to_string(entry.id) + "_" + name;
+	}
+
+	return path;
+}
 
-	if (!success) {
-		LOG("Download failed");
+bool LogLoader::delete_local_file(int64_t id)
+{
+	const auto entry = _database.log_by_id(id);
+
+	if (!entry.has_value()) {
 		return false;
 	}
 
-	double seconds = std::chrono::duration_cast<std::chrono::milliseconds>(
-				 std::chrono::steady_clock::now() - time_start).count() / 1000.;
-	LOG("Finished in " << std::setprecision(2) << seconds << " seconds");
+	if (!entry->local_path.empty()) {
+		std::error_code ec;
+		fs::remove(entry->local_path, ec);
 
-	// Update downloaded status in both databases
-	_local_server->update_download_status(db_entry.uuid, local_path, true);
-	_remote_server->update_download_status(db_entry.uuid, local_path, true);
+		if (ec) {
+			LOG_WARN("Could not remove " << entry->local_path << ": " << ec.message());
+		}
+	}
 
+	_database.clear_local_file(id);
 	return true;
 }
 
-void LogLoader::upload_logs_thread()
-{
-	while (!_should_exit) {
-		if (_loop_disabled) {
-			std::this_thread::sleep_for(std::chrono::seconds(1));
-			continue;
-		}
+// -------------------------------------------------------------------------
+// Upload loop
+// -------------------------------------------------------------------------
 
-		// Query the number of pending log uploads for both servers
-		uint32_t num_logs_local = _local_server->num_logs_to_upload();
-		uint32_t num_logs_remote = _remote_server->num_logs_to_upload();
-
-		// Process uploads for local server
-		if (!_should_exit && !_settings.local_server.empty() && num_logs_local) {
-			LOG_DEBUG("Uploading " << num_logs_local << " logs to LOCAL server");
-			upload_pending_logs(_local_server);
-		}
+void LogLoader::upload_loop()
+{
+	while (!_upload_waiter.stopped()) {
+		for (auto& target : _targets) {
+			if (_upload_waiter.stopped()) {
+				break;
+			}
 
-		// Process uploads for remote server
-		if (!_should_exit && !_settings.remote_server.empty() && _settings.upload_enabled && num_logs_remote) {
-			LOG_DEBUG("Uploading " << num_logs_remote << " logs to REMOTE server");
-			upload_pending_logs(_remote_server);
+			if (target->enabled()) {
+				upload_pending(*target);
+			}
 		}
 
-		if (!_should_exit) {
-			std::unique_lock<std::mutex> lock(_exit_cv_mutex);
-			_exit_cv.wait_for(lock, std::chrono::seconds(10), [this] { return _should_exit.load(); });
+		if (_upload_waiter.wait(std::chrono::seconds(_config.upload_interval_s))) {
+			break;
 		}
 	}
 
-	LOG_DEBUG("upload_logs_thread exiting");
+	LOG_DEBUG("Upload loop finished");
 }
 
-void LogLoader::upload_pending_logs(std::shared_ptr<ServerInterface> server)
+void LogLoader::upload_pending(UploadTarget& target)
 {
-	// Upload all pending logs for this server
-	while (!_should_exit && server->num_logs_to_upload()) {
+	const auto pending = _database.logs_to_upload(target.name());
 
-		// Get one log at a time to upload
-		ServerInterface::DatabaseEntry log_entry = server->get_next_log_to_upload();
+	if (pending.empty()) {
+		return;
+	}
 
-		if (log_entry.uuid.empty()) {
-			LOG("Log with empty uuid!");
-			return;
-		}
+	LOG_DEBUG("Uploading " << pending.size() << " logs to " << target.name());
 
-		std::string filepath = server->filepath_from_uuid(log_entry.uuid);
+	int consecutive_retries = 0;
 
-		if (filepath.empty()) {
-			LOG("Could not determine file path for UUID: " << log_entry.uuid);
+	for (const auto& entry : pending) {
+		if (_upload_waiter.stopped() || armed()) {
 			return;
 		}
 
-		ServerInterface::UploadResult result = server->upload_log(log_entry.uuid, filepath);
+		_status->update([&entry, &target](StatusBoard::Snapshot & snapshot) {
+			snapshot.uploading_id = entry.id;
+			snapshot.uploading_target = target.name();
+		});
 
-		if (result.success) {
-			LOG("Log upload SUCCESS: " << result.message);
+		const UploadTarget::Result result = target.upload(entry.local_path);
 
-		} else if (result.status_code == 400 || result.status_code == 401 || result.status_code == 403) {
-			LOG("Log upload rejected (" << result.status_code << "): " << result.message);
+		_status->update([](StatusBoard::Snapshot & snapshot) {
+			snapshot.uploading_id = 0;
+			snapshot.uploading_target.clear();
+		});
 
-			// Account/auth policy applies to every log on this server — stop the batch.
-			if (result.status_code == 401 || result.status_code == 403) {
-				LOG("Stopping remote uploads for this cycle (server requires login/approval)");
-				return;
-			}
+		switch (result.outcome) {
+		case UploadTarget::Outcome::Success:
+			LOG("Uploaded " << entry.path << " to " << target.name()
+			    << (result.location.empty() ? "" : ": " + target.url() + result.location));
+			_database.mark_uploaded(entry.id, target.name(), result.location);
+			consecutive_retries = 0;
+			break;
 
-		} else if (result.status_code == 503) {
-			// Server down (e.g. local flight-review not running). Already logged once
-			// with a cooldown in ServerInterface; do not walk the rest of the queue.
+		case UploadTarget::Outcome::Rejected:
+			// Recorded so it is not offered again; the rest of the queue is
+			// unaffected by one log the server will not take.
+			LOG_WARN(target.name() << " rejected " << entry.path << ": " << result.message);
+			_database.mark_upload_rejected(entry.id, target.name(), result.message);
+			consecutive_retries = 0;
+			break;
+
+		case UploadTarget::Outcome::Unauthorized:
+			LOG_WARN(target.name() << " will not accept uploads from this account ("
+				 << result.status_code << "): " << result.message);
+			LOG_WARN("Pausing " << target.name() << " uploads for this cycle; they resume "
+				 "on their own once the account is authorized");
+			_database.record_upload_failure(entry.id, target.name(), result.message);
 			return;
 
-		} else {
-			LOG("Log upload TEMPORARILY FAILED (" << result.status_code << "): "
-			    << result.message << " - Will retry later");
-			// Retry on the next pass rather than hammering an unhappy server
+		case UploadTarget::Outcome::Unreachable:
+			// Already reported once, with a cooldown, by UploadTarget.
 			return;
+
+		case UploadTarget::Outcome::Retry:
+			LOG_WARN("Upload of " << entry.path << " to " << target.name() << " failed ("
+				 << result.status_code << "): " << result.message << "; will retry");
+			_database.record_upload_failure(entry.id, target.name(), result.message);
+
+			if (++consecutive_retries >= kMaxConsecutiveUploadRetries) {
+				LOG_WARN(target.name() << " failed " << consecutive_retries
+					 << " uploads in a row, leaving the rest for the next cycle");
+				return;
+			}
+
+			break;
 		}
 	}
 }
diff --git a/src/LogLoader.hpp b/src/LogLoader.hpp
index b70b715..0b90924 100644
--- a/src/LogLoader.hpp
+++ b/src/LogLoader.hpp
@@ -1,72 +1,95 @@
 #pragma once
 
+#include <memory>
+#include <string>
+#include <thread>
+#include <vector>
+
 #include <mavsdk/mavsdk.h>
 #include <mavsdk/plugins/telemetry/telemetry.h>
-#include <mavsdk/log_callback.h>
-#include <condition_variable>
-#include <map>
 
+#include "Config.hpp"
 #include "FtpLogFetcher.hpp"
-#include "ServerInterface.hpp"
+#include "LogDatabase.hpp"
+#include "StatusBoard.hpp"
+#include "UploadTarget.hpp"
+#include "Waiter.hpp"
 
+// Ties the pieces together: what the vehicle has (FtpLogFetcher), what we mean
+// to do about it (LogDatabase), and where finished logs go (UploadTarget).
+//
+// Two loops run concurrently. The index loop talks to the vehicle and owns the
+// downloads; the upload loop talks to the servers. They share nothing but the
+// database, which is its own monitor.
 class LogLoader
 {
 public:
-	struct Settings {
-		std::string email;
-		std::string local_server;
-		std::string remote_server;
-		// API key for remote_server (ARK Flight Review account key). Empty = none.
-		std::string remote_api_key;
-		std::string mavsdk_connection_url;
-		std::string application_directory;
-		bool upload_enabled;
-		bool public_logs;
-		std::string remote_log_directory; // Empty probes the known locations
-		bool ftp_use_burst;
-	};
-
-	LogLoader(const Settings& settings);
+	explicit LogLoader(const Config& config);
+	~LogLoader();
+
+	LogLoader(const LogLoader&) = delete;
+	LogLoader& operator=(const LogLoader&) = delete;
+
+	bool database_ok() const { return _database.ok(); }
 
+	// Blocks until an autopilot answers or stop() is called.
+	bool connect();
+
+	// Runs until stop(). Returns when both loops have finished.
 	void run();
 	void stop();
-	bool wait_for_mavsdk_connection(double timeout_ms);
+
+	// The API server reaches the same state the loops do.
+	LogDatabase& database() { return _database; }
+	StatusBoard& status() { return *_status; }
+
+	// Nudges both loops, so a request made through the API is acted on now
+	// rather than at the end of the current interval.
+	void wake();
+
+	// Removes a downloaded file from disk and forgets it. Returns false when
+	// the log is unknown.
+	bool delete_local_file(int64_t id);
+
+	std::vector<std::string> enabled_target_names() const;
 
 private:
-	// Download
-	bool refresh_log_index();
-	void download_pending_logs();
-	bool download_log(const ServerInterface::DatabaseEntry& db_entry, const FtpLogFetcher::RemoteLog& log);
-	const FtpLogFetcher::RemoteLog* find_remote_log(const ServerInterface::DatabaseEntry& db_entry) const;
-	std::string local_path_for(const ServerInterface::DatabaseEntry& db_entry);
+	void index_loop();
+	void upload_loop();
 
-	// Upload
-	void upload_logs_thread();
-	void upload_pending_logs(std::shared_ptr<ServerInterface> server);
+	// Reconciles the vehicle listing into the database. False when the vehicle
+	// could not be listed, in which case nothing is assumed about what it has.
+	bool refresh_index(std::vector<int64_t>& new_ids, size_t& stable_count);
 
-	// Returns true if we should exit
-	bool wait_for(std::chrono::seconds duration);
+	// Decides what, if anything, to fetch without being asked. This is the
+	// guard against a freshly-installed companion pulling a whole SD card.
+	void apply_auto_policy(const std::vector<int64_t>& new_ids, size_t stable_count);
 
-	Settings _settings;
-	std::string _logs_directory;
+	void download_pending();
+	bool download(const LogDatabase::Entry& entry, const FtpLogFetcher::RemoteLog& remote);
+	std::string local_path_for(const LogDatabase::Entry& entry);
 
-	// Server objects (each with its own database)
-	std::shared_ptr<ServerInterface> _local_server;
-	std::shared_ptr<ServerInterface> _remote_server;
+	void upload_pending(UploadTarget& target);
 
-	std::shared_ptr<mavsdk::Mavsdk> _mavsdk;
-	std::shared_ptr<mavsdk::Telemetry> _telemetry;
-	std::shared_ptr<FtpLogFetcher> _ftp_fetcher;
+	bool armed();
 
-	// Consecutive download failures per log. A file the vehicle will not part
-	// with (a very large one that keeps timing out, say) is retried last so it
-	// cannot hold up everything behind it.
-	std::map<std::string, int> _download_failures;
+	Config _config;
+	LogDatabase _database;
+	// Shared, not owned by value: the download progress callback belongs to
+	// MAVSDK and can fire after this object has begun tearing down.
+	std::shared_ptr<StatusBoard> _status {std::make_shared<StatusBoard>()};
+	std::vector<std::unique_ptr<UploadTarget>> _targets;
 
-	std::atomic<bool> _should_exit = false;
+	std::shared_ptr<mavsdk::Mavsdk> _mavsdk;
+	std::shared_ptr<mavsdk::Telemetry> _telemetry;
+	std::shared_ptr<FtpLogFetcher> _ftp;
 
-	std::condition_variable _exit_cv;
-	std::mutex _exit_cv_mutex;
+	Waiter _index_waiter;
+	Waiter _upload_waiter;
+	std::thread _upload_thread;
 
-	bool _loop_disabled = false;
+	bool _was_armed {false};
+	// Index more often for a few passes after landing, so the log the flight
+	// just produced is confirmed stable and fetched promptly.
+	int _fast_index_passes {0};
 };
diff --git a/src/ServerInterface.cpp b/src/ServerInterface.cpp
deleted file mode 100644
index dede21e..0000000
--- a/src/ServerInterface.cpp
+++ /dev/null
@@ -1,860 +0,0 @@
-#include "ServerInterface.hpp"
-#include "Log.hpp"
-
-#include <iostream>
-#include <filesystem>
-#include <fstream>
-#include <chrono>
-#include <ctime>
-#include <iomanip>
-#include <optional>
-#include <sstream>
-#include <functional>
-#define CPPHTTPLIB_OPENSSL_SUPPORT
-#include <httplib.h>
-
-namespace fs = std::filesystem;
-
-namespace
-{
-
-std::optional<int64_t> parse_iso8601_utc(const std::string& text)
-{
-	std::tm tm {};
-
-	if (sscanf(text.c_str(), "%4d-%2d-%2dT%2d:%2d:%2dZ",
-		   &tm.tm_year, &tm.tm_mon, &tm.tm_mday, &tm.tm_hour, &tm.tm_min, &tm.tm_sec) != 6) {
-		return std::nullopt;
-	}
-
-	tm.tm_year -= 1900;
-	tm.tm_mon -= 1;
-
-	return static_cast<int64_t>(timegm(&tm));
-}
-
-} // namespace
-
-ServerInterface::ServerInterface(const ServerInterface::Settings& settings)
-	: _settings(settings)
-{
-	// Sanitize the URL to strip off the prefix
-	sanitize_url_and_determine_protocol();
-
-	// Initialize the database
-	if (!init_database()) {
-		std::cerr << "Failed to initialize database for server: " << _settings.server_url << std::endl;
-	}
-}
-
-ServerInterface::~ServerInterface()
-{
-	close_database();
-}
-
-void ServerInterface::sanitize_url_and_determine_protocol()
-{
-	std::string url = _settings.server_url;
-	std::string sanitized_url;
-	Protocol protocol;
-
-	std::string http_prefix = "http://";
-	std::string https_prefix = "https://";
-
-	size_t pos = std::string::npos;
-
-	if ((pos = url.find(https_prefix)) != std::string::npos) {
-		sanitized_url = url.substr(pos + https_prefix.length());
-		protocol = Protocol::Https;
-
-	} else if ((pos = url.find(http_prefix)) != std::string::npos) {
-		sanitized_url = url.substr(pos + http_prefix.length());
-		protocol = Protocol::Http;
-
-	} else {
-		sanitized_url = url;
-		protocol = Protocol::Https;
-	}
-
-	_settings.server_url = sanitized_url;
-	_protocol = protocol;
-}
-
-void ServerInterface::start()
-{
-	_should_exit = false;
-}
-
-void ServerInterface::stop()
-{
-	_should_exit = true;
-}
-
-std::string ServerInterface::generate_uuid(const std::string& remote_path, uint32_t size_bytes)
-{
-	// Create a unique identifier based on the remote path and size
-	std::stringstream ss;
-	ss << remote_path << "_" << size_bytes;
-
-	// Use a simple hash for the UUID
-	std::hash<std::string> hasher;
-	size_t hash = hasher(ss.str());
-
-	ss.str("");
-	ss << std::hex << std::setw(16) << std::setfill('0') << hash;
-	return ss.str();
-}
-
-bool ServerInterface::sync_log(const LogEntry& entry)
-{
-	// Check if the log already exists
-	sqlite3_stmt* stmt;
-	std::string check_query = "SELECT COUNT(*) FROM logs WHERE uuid = ?";
-
-	if (sqlite3_prepare_v2(_db, check_query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
-		std::cerr << "SQL error preparing sync_log check: " << sqlite3_errmsg(_db) << std::endl;
-		return false;
-	}
-
-	sqlite3_bind_text(stmt, 1, entry.uuid.c_str(), -1, SQLITE_STATIC);
-
-	bool exists = false;
-
-	if (sqlite3_step(stmt) == SQLITE_ROW) {
-		exists = sqlite3_column_int(stmt, 0) > 0;
-	}
-
-	sqlite3_finalize(stmt);
-
-	if (exists) {
-		return true; // Already exists, no need to add
-	}
-
-	// Insert the log
-	std::string insert_query =
-		"INSERT INTO logs (uuid, remote_path, date, size_bytes, local_path, downloaded, uploaded) "
-		"VALUES (?, ?, ?, ?, '', 0, 0)";
-
-	if (sqlite3_prepare_v2(_db, insert_query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
-		std::cerr << "SQL error preparing sync_log insert: " << sqlite3_errmsg(_db) << std::endl;
-		return false;
-	}
-
-	sqlite3_bind_text(stmt, 1, entry.uuid.c_str(), -1, SQLITE_STATIC);
-	sqlite3_bind_text(stmt, 2, entry.remote_path.c_str(), -1, SQLITE_STATIC);
-	sqlite3_bind_text(stmt, 3, entry.date.c_str(), -1, SQLITE_STATIC);
-	sqlite3_bind_int64(stmt, 4, entry.size_bytes);
-
-	bool success = sqlite3_step(stmt) == SQLITE_DONE;
-	sqlite3_finalize(stmt);
-
-	if (success) {
-		grandfather_from_legacy(entry);
-	}
-
-	return success;
-}
-
-bool ServerInterface::update_download_status(const std::string& uuid, const std::string& local_path, bool downloaded)
-{
-	std::string query = "UPDATE logs SET downloaded = ?, local_path = ? WHERE uuid = ?";
-	sqlite3_stmt* stmt;
-
-	if (sqlite3_prepare_v2(_db, query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
-		std::cerr << "SQL error preparing update_download_status: " << sqlite3_errmsg(_db) << std::endl;
-		return false;
-	}
-
-	sqlite3_bind_int(stmt, 1, downloaded ? 1 : 0);
-	sqlite3_bind_text(stmt, 2, local_path.c_str(), -1, SQLITE_STATIC);
-	sqlite3_bind_text(stmt, 3, uuid.c_str(), -1, SQLITE_STATIC);
-
-	bool success = sqlite3_step(stmt) == SQLITE_DONE;
-	sqlite3_finalize(stmt);
-
-	return success;
-}
-
-bool ServerInterface::delete_log(const std::string& uuid)
-{
-	std::string query = "DELETE FROM logs WHERE uuid = ?";
-	sqlite3_stmt* stmt;
-
-	if (sqlite3_prepare_v2(_db, query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
-		std::cerr << "SQL error preparing delete_log: " << sqlite3_errmsg(_db) << std::endl;
-		return false;
-	}
-
-	sqlite3_bind_text(stmt, 1, uuid.c_str(), -1, SQLITE_STATIC);
-
-	bool success = sqlite3_step(stmt) == SQLITE_DONE;
-	sqlite3_finalize(stmt);
-
-	return success;
-}
-
-bool ServerInterface::local_path_in_use(const std::string& local_path, const std::string& excluding_uuid)
-{
-	std::string query = "SELECT COUNT(*) FROM logs WHERE local_path = ? AND uuid != ?";
-	sqlite3_stmt* stmt;
-
-	if (sqlite3_prepare_v2(_db, query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
-		std::cerr << "SQL error preparing local_path_in_use: " << sqlite3_errmsg(_db) << std::endl;
-		return false;
-	}
-
-	sqlite3_bind_text(stmt, 1, local_path.c_str(), -1, SQLITE_STATIC);
-	sqlite3_bind_text(stmt, 2, excluding_uuid.c_str(), -1, SQLITE_STATIC);
-
-	bool in_use = sqlite3_step(stmt) == SQLITE_ROW && sqlite3_column_int(stmt, 0) > 0;
-	sqlite3_finalize(stmt);
-
-	return in_use;
-}
-
-uint32_t ServerInterface::num_logs_to_upload()
-{
-	if (!_settings.upload_enabled || _should_exit) {
-		return false;
-	}
-
-	sqlite3_stmt* stmt;
-	std::string query =
-		"SELECT COUNT(*) FROM logs "
-		"WHERE downloaded = 1 AND uploaded = 0 AND local_path != '' "
-		"AND uuid NOT IN (SELECT uuid FROM blacklist)";
-
-	if (sqlite3_prepare_v2(_db, query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
-		std::cerr << "SQL error preparing has_logs_to_upload: " << sqlite3_errmsg(_db) << std::endl;
-		return false;
-	}
-
-	uint32_t log_count = 0;
-
-	if (sqlite3_step(stmt) == SQLITE_ROW) {
-		log_count = sqlite3_column_int(stmt, 0);
-	}
-
-	sqlite3_finalize(stmt);
-	return log_count;
-}
-
-ServerInterface::DatabaseEntry ServerInterface::get_next_log_to_upload()
-{
-	DatabaseEntry empty_entry;
-	empty_entry.uuid = ""; // Empty UUID indicates not found
-
-	if (!_settings.upload_enabled || _should_exit) {
-		return empty_entry;
-	}
-
-	sqlite3_stmt* stmt;
-	std::string query =
-		"SELECT uuid, remote_path, date, size_bytes, local_path, downloaded FROM logs "
-		"WHERE downloaded = 1 AND uploaded = 0 AND local_path != '' "
-		"AND uuid NOT IN (SELECT uuid FROM blacklist) "
-		"ORDER BY date DESC, size_bytes DESC LIMIT 1";
-
-	if (sqlite3_prepare_v2(_db, query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
-		std::cerr << "SQL error preparing get_next_log_to_upload: " << sqlite3_errmsg(_db) << std::endl;
-		return empty_entry;
-	}
-
-	DatabaseEntry entry = empty_entry;
-
-	if (sqlite3_step(stmt) == SQLITE_ROW) {
-		entry = row_to_db_entry(stmt);
-	}
-
-	sqlite3_finalize(stmt);
-	return entry;
-}
-
-ServerInterface::UploadResult ServerInterface::upload_log(const std::string& uuid, const std::string& filepath)
-{
-	if (!_settings.upload_enabled || _should_exit) {
-		return {false, 0, "Upload disabled or shutting down"};
-	}
-
-	if (uuid.empty()) {
-		return {false, 0, "Missing UUID"};
-	}
-
-	// Check if already blacklisted
-	if (is_blacklisted(uuid)) {
-		return {false, 400, "Log is blacklisted"};
-	}
-
-	// Perform the upload
-	UploadResult result = upload(filepath);
-
-	// Update database with result
-	if (result.success) {
-		std::string query = "UPDATE logs SET uploaded = 1 WHERE uuid = ?";
-		sqlite3_stmt* stmt;
-
-		if (sqlite3_prepare_v2(_db, query.c_str(), -1, &stmt, nullptr) == SQLITE_OK) {
-			sqlite3_bind_text(stmt, 1, uuid.c_str(), -1, SQLITE_STATIC);
-			sqlite3_step(stmt);
-			sqlite3_finalize(stmt);
-		}
-
-	} else if (result.status_code == 400) {
-		// The server will not take this log whoever asks - do not keep retrying it.
-		// 401/403 are not blacklisted: they say the account is not authorized yet,
-		// which is fixed by setting remote_api_key, and every pending log would
-		// otherwise be thrown away one per cycle while the key is missing.
-		add_to_blacklist(uuid, "HTTP 400: " + result.message);
-	}
-
-	return result;
-}
-
-bool ServerInterface::is_blacklisted(const std::string& uuid)
-{
-	std::string query = "SELECT COUNT(*) FROM blacklist WHERE uuid = ?";
-	sqlite3_stmt* stmt;
-
-	if (sqlite3_prepare_v2(_db, query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
-		std::cerr << "SQL error preparing is_blacklisted: " << sqlite3_errmsg(_db) << std::endl;
-		return false;
-	}
-
-	sqlite3_bind_text(stmt, 1, uuid.c_str(), -1, SQLITE_STATIC);
-
-	bool blacklisted = false;
-
-	if (sqlite3_step(stmt) == SQLITE_ROW) {
-		blacklisted = sqlite3_column_int(stmt, 0) > 0;
-	}
-
-	sqlite3_finalize(stmt);
-	return blacklisted;
-}
-
-uint32_t ServerInterface::num_logs_to_download()
-{
-	sqlite3_stmt* stmt;
-	std::string query =
-		"SELECT COUNT(*) FROM logs "
-		"WHERE downloaded = 0";
-
-	if (sqlite3_prepare_v2(_db, query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
-		std::cerr << "SQL error preparing num_logs_to_download: " << sqlite3_errmsg(_db) << std::endl;
-		return 0;
-	}
-
-	uint32_t log_count = 0;
-
-	if (sqlite3_step(stmt) == SQLITE_ROW) {
-		log_count = sqlite3_column_int(stmt, 0);
-	}
-
-	sqlite3_finalize(stmt);
-	return log_count;
-}
-
-std::vector<ServerInterface::DatabaseEntry> ServerInterface::get_logs_to_download()
-{
-	std::vector<DatabaseEntry> entries;
-
-	sqlite3_stmt* stmt;
-	std::string query =
-		"SELECT uuid, remote_path, date, size_bytes, local_path, downloaded "
-		"FROM logs WHERE downloaded = 0 "
-		"ORDER BY date DESC, remote_path DESC";
-
-	if (sqlite3_prepare_v2(_db, query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
-		std::cerr << "SQL error preparing get_logs_to_download: " << sqlite3_errmsg(_db) << std::endl;
-		return entries;
-	}
-
-	while (sqlite3_step(stmt) == SQLITE_ROW) {
-		entries.push_back(row_to_db_entry(stmt));
-	}
-
-	sqlite3_finalize(stmt);
-	return entries;
-}
-
-std::string ServerInterface::filepath_from_uuid(const std::string& uuid) const
-{
-	sqlite3_stmt* stmt;
-	std::string query = "SELECT local_path FROM logs WHERE uuid = ?";
-
-	if (sqlite3_prepare_v2(_db, query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
-		std::cerr << "SQL error preparing filepath_from_uuid: " << sqlite3_errmsg(_db) << std::endl;
-		return "";
-	}
-
-	sqlite3_bind_text(stmt, 1, uuid.c_str(), -1, SQLITE_STATIC);
-
-	std::string filepath;
-
-	if (sqlite3_step(stmt) == SQLITE_ROW) {
-		const unsigned char* path_text = sqlite3_column_text(stmt, 0);
-
-		if (path_text != nullptr) {
-			filepath = reinterpret_cast<const char*>(path_text);
-		}
-	}
-
-	sqlite3_finalize(stmt);
-	return filepath;
-}
-
-ServerInterface::UploadResult ServerInterface::upload(const std::string& filepath)
-{
-	// Skip files that are in progress (have a .lock file)
-	if (fs::exists(filepath + ".lock")) {
-		return {false, 0, "File is locked (currently being downloaded)"};
-	}
-
-	// Skip files that don't exist
-	if (!fs::exists(filepath)) {
-		return {false, 404, "Log file does not exist: " + filepath};
-	}
-
-	// Skip files with size zero
-	if (fs::file_size(filepath) == 0) {
-		return {false, 0, "Skipping zero-size log file: " + filepath};
-	}
-
-	if (!server_reachable()) {
-		// 503: treat as service unavailable so the upload loop can bail the batch
-		// instead of hammering a dead local flight-review for every pending log.
-		return {false, 503, "Server unreachable: " + _settings.server_url};
-	}
-
-	std::ifstream file(filepath, std::ios::binary);
-
-	if (!file) {
-		return {false, 0, "Could not open file: " + filepath};
-	}
-
-	// Build multi-part form data
-	httplib::MultipartFormDataItems items = {
-		{"type", _settings.public_logs ? "flightreport" : "personal", "", ""}, // NOTE: backend logic is funky
-		{"description", "Uploaded by logloader", "", ""},
-		{"feedback", "", "", ""},
-		{"email", _settings.user_email, "", ""},
-		{"source", "auto", "", ""},
-		{"videoUrl", "", "", ""},
-		{"rating", "", "", ""},
-		{"windSpeed", "", "", ""},
-		{"public", _settings.public_logs ? "true" : "false", "", ""},
-	};
-
-	std::string content((std::istreambuf_iterator<char>(file)), std::istreambuf_iterator<char>());
-	items.push_back({"filearg", content, filepath, "application/octet-stream"});
-
-	// API-key headers only when a non-empty key is configured. Never send
-	// Authorization/X-API-Key with an empty value.
-	httplib::Headers headers;
-	const bool use_api_key = !_settings.api_key.empty();
-
-	if (use_api_key) {
-		// ARK Flight Review (flight_review api_key.py):
-		//   Authorization: Bearer <key>
-		//   X-API-Key: <key>
-		// (Query ?api_key= also works server-side; form fields cannot — auth
-		// runs in prepare() before the body is available.)
-		headers.emplace("Authorization", "Bearer " + _settings.api_key);
-		headers.emplace("X-API-Key", _settings.api_key);
-	}
-
-	LOG("Uploading " << fs::path(filepath).filename().string() << " to " << _settings.server_url
-	    << (use_api_key ? " (with API key)" : ""));
-
-	// Post multi-part form
-	httplib::Result res;
-
-	if (_protocol == Protocol::Https) {
-		httplib::SSLClient cli(_settings.server_url);
-		cli.set_connection_timeout(30, 0);
-		cli.set_read_timeout(120, 0);
-		res = use_api_key ? cli.Post("/upload", headers, items)
-		      : cli.Post("/upload", items);
-
-	} else {
-		httplib::Client cli(_settings.server_url);
-		cli.set_connection_timeout(30, 0);
-		cli.set_read_timeout(120, 0);
-		res = use_api_key ? cli.Post("/upload", headers, items)
-		      : cli.Post("/upload", items);
-	}
-
-	if (res && res->status == 302) {
-		return {true, 302, "Success: " + _settings.server_url + res->get_header_value("Location")};
-
-	} else if (res && (res->status == 400 || res->status == 401 || res->status == 403)) {
-		// Permanent client/auth errors: do not spin on the same log forever.
-		// review.arkelectron.com returns 403 when the account is not logged in /
-		// not approved for automated uploads.
-		std::string detail = res->body;
-
-		// Collapse HTML / whitespace for a one-line log message.
-		for (char& c : detail) {
-			if (c == '\n' || c == '\r' || c == '\t') {
-				c = ' ';
-			}
-		}
-
-		if (detail.size() > 200) {
-			detail.resize(200);
-			detail += "...";
-		}
-
-		return {false, res->status, detail.empty() ? "Rejected by server (will not retry)" : detail};
-
-	} else {
-		return {false, res ? res->status : 0, "Will retry later"};
-	}
-}
-
-bool ServerInterface::server_reachable()
-{
-	const auto now = std::chrono::steady_clock::now();
-
-	// Still inside the cooldown from a previous failure — do not re-probe or re-log.
-	if (now < _unreachable_until) {
-		return false;
-	}
-
-	httplib::Result res;
-
-	if (_protocol == Protocol::Https) {
-		httplib::SSLClient cli(_settings.server_url);
-		cli.set_connection_timeout(5, 0);
-		cli.set_read_timeout(5, 0);
-		// Flight Review often redirects "/" (302). We only need proof the host answers.
-		cli.set_follow_location(false);
-		res = cli.Get("/");
-
-	} else {
-		httplib::Client cli(_settings.server_url);
-		cli.set_connection_timeout(5, 0);
-		cli.set_read_timeout(5, 0);
-		cli.set_follow_location(false);
-		res = cli.Get("/");
-	}
-
-	// Any HTTP response means the server is up. Flight Review's home page returns
-	// 302, so requiring status == 200 falsely marked review.arkelectron.com dead.
-	// Connection / TLS failures leave res empty.
-	const bool success = static_cast<bool>(res);
-
-	if (!success) {
-		_unreachable_until = now + kUnreachableCooldown;
-
-		if (!_reported_unreachable) {
-			const std::string detail = res ? ("HTTP " + std::to_string(res->status)) : "No response";
-			LOG("Upload server " << _settings.server_url << " unreachable (" << detail
-			    << "); skipping uploads for "
-			    << std::chrono::duration_cast<std::chrono::seconds>(kUnreachableCooldown).count()
-			    << "s");
-			_reported_unreachable = true;
-		}
-
-		return false;
-	}
-
-	if (_reported_unreachable) {
-		LOG("Upload server " << _settings.server_url << " is reachable again");
-		_reported_unreachable = false;
-	}
-
-	_unreachable_until = {};
-	return true;
-}
-
-bool ServerInterface::init_database()
-{
-	int rc = sqlite3_open(_settings.db_path.c_str(), &_db);
-
-	if (rc != SQLITE_OK) {
-		std::cerr << "Cannot open database: " << sqlite3_errmsg(_db) << std::endl;
-		sqlite3_close(_db);
-		_db = nullptr;
-		return false;
-	}
-
-	migrate_legacy_schema();
-
-	// Create logs table
-	const char* create_logs_table =
-		"CREATE TABLE IF NOT EXISTS logs ("
-		"  uuid TEXT PRIMARY KEY,"  // UUID of the log
-		"  remote_path TEXT,"       // Path relative to the vehicle log root
-		"  date TEXT,"              // ISO8601 date, empty when unknown
-		"  size_bytes INTEGER,"     // Size in bytes
-		"  local_path TEXT DEFAULT '',"   // Where the download ended up
-		"  downloaded INTEGER DEFAULT 0," // Has it been downloaded
-		"  uploaded INTEGER DEFAULT 0"   // Has it been uploaded
-		");";
-
-	// Create blacklist table
-	const char* create_blacklist_table =
-		"CREATE TABLE IF NOT EXISTS blacklist ("
-		"  uuid TEXT PRIMARY KEY,"  // UUID of the log
-		"  reason TEXT,"            // Reason for blacklisting
-		"  timestamp TEXT"          // When the log was blacklisted
-		");";
-
-	bool success = execute_query(create_logs_table) && execute_query(create_blacklist_table);
-	return success;
-}
-
-bool ServerInterface::table_exists(const std::string& name) const
-{
-	sqlite3_stmt* stmt;
-	const char* query = "SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = ?";
-
-	if (sqlite3_prepare_v2(_db, query, -1, &stmt, nullptr) != SQLITE_OK) {
-		return false;
-	}
-
-	sqlite3_bind_text(stmt, 1, name.c_str(), -1, SQLITE_STATIC);
-
-	bool exists = sqlite3_step(stmt) == SQLITE_ROW && sqlite3_column_int(stmt, 0) > 0;
-	sqlite3_finalize(stmt);
-
-	return exists;
-}
-
-bool ServerInterface::column_exists(const std::string& table, const std::string& column) const
-{
-	sqlite3_stmt* stmt;
-	const char* query = "SELECT COUNT(*) FROM pragma_table_info(?) WHERE name = ?";
-
-	if (sqlite3_prepare_v2(_db, query, -1, &stmt, nullptr) != SQLITE_OK) {
-		return false;
-	}
-
-	sqlite3_bind_text(stmt, 1, table.c_str(), -1, SQLITE_STATIC);
-	sqlite3_bind_text(stmt, 2, column.c_str(), -1, SQLITE_STATIC);
-
-	bool exists = sqlite3_step(stmt) == SQLITE_ROW && sqlite3_column_int(stmt, 0) > 0;
-	sqlite3_finalize(stmt);
-
-	return exists;
-}
-
-void ServerInterface::migrate_legacy_schema()
-{
-	if (table_exists("logs_legacy") && !column_exists("logs_legacy", "migrated")) {
-		execute_query("ALTER TABLE logs_legacy ADD COLUMN migrated INTEGER DEFAULT 0");
-	}
-
-	// Pre-FTP databases keyed logs on (LOG_ENTRY date, size)
-	if (table_exists("logs") && !column_exists("logs", "remote_path")) {
-		LOG("Migrating " << _settings.db_path << " to the MAVLink FTP log schema");
-
-		if (table_exists("logs_legacy")) {
-			// An older logloader ran again after this one (the ARK-OS installer
-			// allows downgrades), so fold its state into the existing table.
-			execute_query(
-				"INSERT OR IGNORE INTO logs_legacy (uuid, id, date, size_bytes, downloaded, uploaded, migrated) "
-				"SELECT uuid, id, date, size_bytes, downloaded, uploaded, 0 FROM logs");
-			execute_query("DROP TABLE logs");
-
-		} else {
-			execute_query("ALTER TABLE logs RENAME TO logs_legacy");
-			execute_query("ALTER TABLE logs_legacy ADD COLUMN migrated INTEGER DEFAULT 0");
-		}
-	}
-
-	_has_legacy_table = table_exists("logs_legacy");
-}
-
-void ServerInterface::grandfather_from_legacy(const LogEntry& entry)
-{
-	if (!_has_legacy_table) {
-		return;
-	}
-
-	struct LegacyRow {
-		std::string uuid;
-		int id;
-		std::string date;
-		bool downloaded;
-		bool uploaded;
-	};
-
-	std::vector<LegacyRow> candidates;
-
-	sqlite3_stmt* stmt;
-
-	const char* query =
-		"SELECT uuid, id, date, downloaded, uploaded FROM logs_legacy "
-		"WHERE migrated = 0 AND size_bytes = ?";
-
-	if (sqlite3_prepare_v2(_db, query, -1, &stmt, nullptr) != SQLITE_OK) {
-		return;
-	}
-
-	sqlite3_bind_int64(stmt, 1, entry.size_bytes);
-
-	while (sqlite3_step(stmt) == SQLITE_ROW) {
-		LegacyRow row;
-		const unsigned char* uuid_text = sqlite3_column_text(stmt, 0);
-		const unsigned char* date_text = sqlite3_column_text(stmt, 2);
-		row.uuid = uuid_text ? reinterpret_cast<const char*>(uuid_text) : "";
-		row.id = sqlite3_column_int(stmt, 1);
-		row.date = date_text ? reinterpret_cast<const char*>(date_text) : "";
-		row.downloaded = sqlite3_column_int(stmt, 3) != 0;
-		row.uploaded = sqlite3_column_int(stmt, 4) != 0;
-		candidates.push_back(row);
-	}
-
-	sqlite3_finalize(stmt);
-
-	if (candidates.empty()) {
-		return;
-	}
-
-	// The legacy date is the log's modification time; the new one is either
-	// that as well or the start time parsed from the path. Same log, so they
-	// are at most a flight apart. Without a time to compare, only an
-	// unambiguous single candidate is safe to claim.
-	const LegacyRow* match = nullptr;
-	const auto entry_time = parse_iso8601_utc(entry.date);
-
-	if (entry_time.has_value()) {
-		constexpr int64_t kMaxDelta = 48 * 3600;
-		int64_t best_delta = kMaxDelta;
-
-		for (const auto& candidate : candidates) {
-			const auto legacy_time = parse_iso8601_utc(candidate.date);
-
-			if (!legacy_time.has_value()) {
-				continue;
-			}
-
-			const int64_t delta = std::abs(legacy_time.value() - entry_time.value());
-
-			if (delta <= best_delta) {
-				best_delta = delta;
-				match = &candidate;
-			}
-		}
-
-	} else if (candidates.size() == 1) {
-		match = &candidates.front();
-	}
-
-	if (match == nullptr) {
-		return;
-	}
-
-	// Reconstruct the file name the legacy naming scheme used
-	std::ostringstream legacy_name;
-	legacy_name << _settings.logs_directory << "LOG" << std::setfill('0') << std::setw(4)
-		    << match->id << "_" << match->date << ".ulg";
-
-	const std::string legacy_path = legacy_name.str();
-	const bool file_exists = fs::exists(legacy_path);
-
-	// A log whose file went missing before it was uploaded is re-downloaded
-	const bool downloaded = match->downloaded && (file_exists || match->uploaded);
-	const std::string local_path = (match->downloaded && file_exists) ? legacy_path : "";
-
-	const char* update_query = "UPDATE logs SET downloaded = ?, uploaded = ?, local_path = ? WHERE uuid = ?";
-
-	if (sqlite3_prepare_v2(_db, update_query, -1, &stmt, nullptr) == SQLITE_OK) {
-		sqlite3_bind_int(stmt, 1, downloaded ? 1 : 0);
-		sqlite3_bind_int(stmt, 2, match->uploaded ? 1 : 0);
-		sqlite3_bind_text(stmt, 3, local_path.c_str(), -1, SQLITE_STATIC);
-		sqlite3_bind_text(stmt, 4, entry.uuid.c_str(), -1, SQLITE_STATIC);
-		sqlite3_step(stmt);
-		sqlite3_finalize(stmt);
-	}
-
-	if (is_blacklisted(match->uuid)) {
-		add_to_blacklist(entry.uuid, "Migrated from legacy uuid " + match->uuid);
-	}
-
-	const char* mark_query = "UPDATE logs_legacy SET migrated = 1 WHERE uuid = ?";
-
-	if (sqlite3_prepare_v2(_db, mark_query, -1, &stmt, nullptr) == SQLITE_OK) {
-		sqlite3_bind_text(stmt, 1, match->uuid.c_str(), -1, SQLITE_STATIC);
-		sqlite3_step(stmt);
-		sqlite3_finalize(stmt);
-	}
-
-	LOG_DEBUG("Migrated legacy log " << match->uuid << " -> " << entry.uuid
-		  << " (" << entry.remote_path << ")");
-}
-
-void ServerInterface::close_database()
-{
-	if (_db) {
-		sqlite3_close(_db);
-		_db = nullptr;
-	}
-}
-
-bool ServerInterface::add_to_blacklist(const std::string& uuid, const std::string& reason)
-{
-	// Get current timestamp
-	auto now = std::chrono::system_clock::now();
-	auto now_c = std::chrono::system_clock::to_time_t(now);
-	std::stringstream ss;
-	ss << std::put_time(std::localtime(&now_c), "%Y-%m-%d %H:%M:%S");
-	std::string timestamp = ss.str();
-
-	// Add to blacklist
-	std::string query = "INSERT OR REPLACE INTO blacklist (uuid, reason, timestamp) VALUES (?, ?, ?)";
-	sqlite3_stmt* stmt;
-
-	if (sqlite3_prepare_v2(_db, query.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
-		std::cerr << "SQL error preparing add_to_blacklist: " << sqlite3_errmsg(_db) << std::endl;
-		return false;
-	}
-
-	sqlite3_bind_text(stmt, 1, uuid.c_str(), -1, SQLITE_STATIC);
-	sqlite3_bind_text(stmt, 2, reason.c_str(), -1, SQLITE_STATIC);
-	sqlite3_bind_text(stmt, 3, timestamp.c_str(), -1, SQLITE_STATIC);
-
-	bool success = sqlite3_step(stmt) == SQLITE_DONE;
-	sqlite3_finalize(stmt);
-
-	return success;
-}
-
-bool ServerInterface::execute_query(const std::string& query)
-{
-	char* error_msg = nullptr;
-	int rc = sqlite3_exec(_db, query.c_str(), nullptr, nullptr, &error_msg);
-
-	if (rc != SQLITE_OK) {
-		std::cerr << "SQL error: " << error_msg << std::endl;
-		sqlite3_free(error_msg);
-		return false;
-	}
-
-	return true;
-}
-
-ServerInterface::DatabaseEntry ServerInterface::row_to_db_entry(sqlite3_stmt* stmt)
-{
-	DatabaseEntry entry;
-
-	const unsigned char* uuid_text = sqlite3_column_text(stmt, 0);
-	entry.uuid = uuid_text ? reinterpret_cast<const char*>(uuid_text) : "";
-
-	const unsigned char* path_text = sqlite3_column_text(stmt, 1);
-	entry.remote_path = path_text ? reinterpret_cast<const char*>(path_text) : "";
-
-	const unsigned char* date_text = sqlite3_column_text(stmt, 2);
-	entry.date = date_text ? reinterpret_cast<const char*>(date_text) : "";
-
-	entry.size_bytes = static_cast<uint32_t>(sqlite3_column_int64(stmt, 3));
-
-	const unsigned char* local_text = sqlite3_column_text(stmt, 4);
-	entry.local_path = local_text ? reinterpret_cast<const char*>(local_text) : "";
-
-	entry.downloaded = sqlite3_column_int(stmt, 5) != 0;
-
-	return entry;
-}
diff --git a/src/ServerInterface.hpp b/src/ServerInterface.hpp
deleted file mode 100644
index 36c8e87..0000000
--- a/src/ServerInterface.hpp
+++ /dev/null
@@ -1,119 +0,0 @@
-#pragma once
-
-#include <chrono>
-#include <cstdint>
-#include <string>
-#include <vector>
-#include <sqlite3.h>
-
-class ServerInterface
-{
-public:
-	struct Settings {
-		std::string server_url;
-		std::string user_email;
-		std::string logs_directory;
-		std::string db_path;         // Path to this server's database
-		bool upload_enabled {};
-		bool public_logs {};
-		// Per-account API key for authenticated Flight Review instances
-		// (e.g. review.arkelectron.com). Sent as:
-		//   Authorization: Bearer <key>
-		//   X-API-Key: <key>
-		// Matches ARK flight_review api_key.py. Leave empty for open servers.
-		std::string api_key;
-	};
-
-	struct UploadResult {
-		bool success;
-		// HTTP status, or 0 when not applicable. 503 means the server is unreachable
-		// (connectivity); callers should stop the current upload batch and retry later.
-		int status_code;
-		std::string message;
-	};
-
-	// A log as tracked in the database. Identity is the remote path (relative
-	// to the vehicle log root) plus the size: the path alone is not enough
-	// because ArduPilot wraps its log numbering and reuses file names.
-	struct LogEntry {
-		std::string uuid;
-		std::string remote_path;
-		std::string date;       // ISO8601 UTC, empty when the vehicle cannot report a time
-		uint32_t size_bytes {};
-	};
-
-	struct DatabaseEntry {
-		std::string uuid;
-		std::string remote_path;
-		std::string date;
-		uint32_t size_bytes {};
-		std::string local_path; // Empty until downloaded
-		bool downloaded {};
-	};
-
-	ServerInterface(const Settings& settings);
-	~ServerInterface();
-
-	// Database initialization
-	bool init_database();
-	void close_database();
-
-	// Log entry management
-	static std::string generate_uuid(const std::string& remote_path, uint32_t size_bytes);
-	bool sync_log(const LogEntry& entry);
-	bool update_download_status(const std::string& uuid, const std::string& local_path, bool downloaded);
-	bool delete_log(const std::string& uuid);
-	uint32_t num_logs_to_download();
-	std::vector<DatabaseEntry> get_logs_to_download();
-	bool local_path_in_use(const std::string& local_path, const std::string& excluding_uuid);
-
-	// Upload management
-	uint32_t num_logs_to_upload();
-	DatabaseEntry get_next_log_to_upload();
-	UploadResult upload_log(const std::string& uuid, const std::string& filepath);
-
-	// Query methods
-	bool is_blacklisted(const std::string& uuid);
-
-	std::string filepath_from_uuid(const std::string& uuid) const;
-
-	void start();
-	void stop();
-
-private:
-	enum class Protocol {
-		Http,
-		Https
-	};
-
-	void sanitize_url_and_determine_protocol();
-	UploadResult upload(const std::string& filepath);
-	bool server_reachable();
-
-	// Database operations
-	bool execute_query(const std::string& query);
-	bool add_to_blacklist(const std::string& uuid, const std::string& reason);
-	DatabaseEntry row_to_db_entry(sqlite3_stmt* stmt);
-
-	// Databases written before the MAVLink FTP transition keyed logs on the
-	// LOG_ENTRY timestamp, which FTP cannot reproduce. Their rows are moved
-	// aside on startup and matched back up by size as the FTP index comes in,
-	// so download/upload state survives the upgrade.
-	bool table_exists(const std::string& name) const;
-	bool column_exists(const std::string& table, const std::string& column) const;
-	void migrate_legacy_schema();
-	void grandfather_from_legacy(const LogEntry& entry);
-
-	Settings _settings;
-	Protocol _protocol {Protocol::Https};
-	bool _should_exit = false;
-	bool _has_legacy_table = false;
-	sqlite3* _db = nullptr;
-
-	// When flight-review (or any upload target) is down, avoid probing and logging
-	// once per pending log. Probe at most every kUnreachableCooldown, and log only on
-	// the down/up transitions.
-	static constexpr auto kUnreachableCooldown = std::chrono::seconds(60);
-	std::chrono::steady_clock::time_point _unreachable_until {};
-	bool _reported_unreachable {false};
-};
diff --git a/src/Sqlite.cpp b/src/Sqlite.cpp
new file mode 100644
index 0000000..94b1b9d
--- /dev/null
+++ b/src/Sqlite.cpp
@@ -0,0 +1,176 @@
+#include "Sqlite.hpp"
+#include "Log.hpp"
+
+namespace sqlite
+{
+
+Statement::Statement(sqlite3* db, const std::string& sql)
+	: _db(db)
+	, _sql(sql)
+{
+	if (_db == nullptr) {
+		return;
+	}
+
+	if (sqlite3_prepare_v2(_db, sql.c_str(), -1, &_stmt, nullptr) != SQLITE_OK) {
+		LOG_ERROR("SQL prepare failed: " << sqlite3_errmsg(_db) << " -- " << sql);
+		_stmt = nullptr;
+	}
+}
+
+Statement::~Statement()
+{
+	if (_stmt != nullptr) {
+		sqlite3_finalize(_stmt);
+	}
+}
+
+Statement& Statement::bind(int index, int64_t value)
+{
+	if (_stmt != nullptr) {
+		sqlite3_bind_int64(_stmt, index, value);
+	}
+
+	return *this;
+}
+
+Statement& Statement::bind(int index, const std::string& value)
+{
+	if (_stmt != nullptr) {
+		sqlite3_bind_text(_stmt, index, value.c_str(), static_cast<int>(value.size()), SQLITE_TRANSIENT);
+	}
+
+	return *this;
+}
+
+Statement& Statement::bind(int index, bool value)
+{
+	return bind(index, static_cast<int64_t>(value ? 1 : 0));
+}
+
+Statement& Statement::bind(int index, std::optional<int64_t> value)
+{
+	if (_stmt == nullptr) {
+		return *this;
+	}
+
+	if (value.has_value()) {
+		sqlite3_bind_int64(_stmt, index, value.value());
+
+	} else {
+		sqlite3_bind_null(_stmt, index);
+	}
+
+	return *this;
+}
+
+bool Statement::step()
+{
+	if (_stmt == nullptr) {
+		return false;
+	}
+
+	const int rc = sqlite3_step(_stmt);
+
+	if (rc == SQLITE_ROW) {
+		return true;
+	}
+
+	if (rc != SQLITE_DONE) {
+		LOG_ERROR("SQL step failed: " << sqlite3_errmsg(_db) << " -- " << _sql);
+	}
+
+	return false;
+}
+
+bool Statement::execute()
+{
+	if (_stmt == nullptr) {
+		return false;
+	}
+
+	const int rc = sqlite3_step(_stmt);
+
+	if (rc != SQLITE_DONE && rc != SQLITE_ROW) {
+		LOG_ERROR("SQL step failed: " << sqlite3_errmsg(_db) << " -- " << _sql);
+		return false;
+	}
+
+	return true;
+}
+
+int64_t Statement::column_int(int index) const
+{
+	return _stmt != nullptr ? sqlite3_column_int64(_stmt, index) : 0;
+}
+
+std::string Statement::column_text(int index) const
+{
+	if (_stmt == nullptr) {
+		return {};
+	}
+
+	const unsigned char* text = sqlite3_column_text(_stmt, index);
+	return text != nullptr ? reinterpret_cast<const char*>(text) : std::string {};
+}
+
+std::optional<int64_t> Statement::column_optional_int(int index) const
+{
+	if (_stmt == nullptr || sqlite3_column_type(_stmt, index) == SQLITE_NULL) {
+		return std::nullopt;
+	}
+
+	return sqlite3_column_int64(_stmt, index);
+}
+
+bool execute(sqlite3* db, const std::string& sql)
+{
+	char* error = nullptr;
+
+	if (sqlite3_exec(db, sql.c_str(), nullptr, nullptr, &error) != SQLITE_OK) {
+		LOG_ERROR("SQL failed: " << (error != nullptr ? error : "unknown") << " -- " << sql);
+		sqlite3_free(error);
+		return false;
+	}
+
+	return true;
+}
+
+bool table_exists(sqlite3* db, const std::string& table)
+{
+	Statement stmt(db, "SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = ?");
+	stmt.bind(1, table);
+	return stmt.step() && stmt.column_int(0) > 0;
+}
+
+bool column_exists(sqlite3* db, const std::string& table, const std::string& column)
+{
+	Statement stmt(db, "SELECT COUNT(*) FROM pragma_table_info(?) WHERE name = ?");
+	stmt.bind(1, table).bind(2, column);
+	return stmt.step() && stmt.column_int(0) > 0;
+}
+
+Transaction::Transaction(sqlite3* db)
+	: _db(db)
+{
+	_open = execute(_db, "BEGIN");
+}
+
+Transaction::~Transaction()
+{
+	if (_open) {
+		execute(_db, "ROLLBACK");
+	}
+}
+
+bool Transaction::commit()
+{
+	if (!_open) {
+		return false;
+	}
+
+	_open = false;
+	return execute(_db, "COMMIT");
+}
+
+} // namespace sqlite
diff --git a/src/Sqlite.hpp b/src/Sqlite.hpp
new file mode 100644
index 0000000..9b1ee10
--- /dev/null
+++ b/src/Sqlite.hpp
@@ -0,0 +1,73 @@
+#pragma once
+
+#include <cstdint>
+#include <optional>
+#include <string>
+
+#include <sqlite3.h>
+
+// Thin RAII layer over the sqlite3 C API. The point is that a prepared
+// statement finalizes itself, so a query cannot leak one by returning early.
+namespace sqlite
+{
+
+// Bind indices are 1-based and column indices 0-based, matching sqlite3.
+// Text and blob binds copy (SQLITE_TRANSIENT), so binding a temporary is safe.
+class Statement
+{
+public:
+	Statement(sqlite3* db, const std::string& sql);
+	~Statement();
+
+	Statement(const Statement&) = delete;
+	Statement& operator=(const Statement&) = delete;
+
+	// False when the statement failed to prepare; the error is already logged.
+	explicit operator bool() const { return _stmt != nullptr; }
+
+	Statement& bind(int index, int64_t value);
+	Statement& bind(int index, const std::string& value);
+	Statement& bind(int index, bool value);
+	Statement& bind(int index, std::optional<int64_t> value);
+
+	// True while rows remain.
+	bool step();
+
+	// Runs a statement that returns no rows. True when it completed.
+	bool execute();
+
+	int64_t column_int(int index) const;
+	std::string column_text(int index) const;
+	std::optional<int64_t> column_optional_int(int index) const;
+
+private:
+	sqlite3* _db {nullptr};
+	sqlite3_stmt* _stmt {nullptr};
+	std::string _sql;
+};
+
+// Runs statements that take no parameters (schema DDL, PRAGMA, transactions).
+bool execute(sqlite3* db, const std::string& sql);
+
+bool table_exists(sqlite3* db, const std::string& table);
+bool column_exists(sqlite3* db, const std::string& table, const std::string& column);
+
+// Rolls back unless commit() is called, so an early return cannot leave a
+// half-applied multi-statement change behind.
+class Transaction
+{
+public:
+	explicit Transaction(sqlite3* db);
+	~Transaction();
+
+	Transaction(const Transaction&) = delete;
+	Transaction& operator=(const Transaction&) = delete;
+
+	bool commit();
+
+private:
+	sqlite3* _db {nullptr};
+	bool _open {false};
+};
+
+} // namespace sqlite
diff --git a/src/StatusBoard.cpp b/src/StatusBoard.cpp
new file mode 100644
index 0000000..1508a20
--- /dev/null
+++ b/src/StatusBoard.cpp
@@ -0,0 +1,44 @@
+#include "StatusBoard.hpp"
+
+StatusBoard::Snapshot StatusBoard::get() const
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	return _snapshot;
+}
+
+void StatusBoard::update(const std::function<void(Snapshot&)>& mutate)
+{
+	{
+		std::lock_guard<std::mutex> lock(_mutex);
+		mutate(_snapshot);
+		_snapshot.revision++;
+	}
+
+	_cv.notify_all();
+}
+
+StatusBoard::Snapshot StatusBoard::wait_for_change(uint64_t known_revision,
+		std::chrono::milliseconds timeout) const
+{
+	std::unique_lock<std::mutex> lock(_mutex);
+	_cv.wait_for(lock, timeout, [this, known_revision] {
+		return _stopped || _snapshot.revision != known_revision;
+	});
+	return _snapshot;
+}
+
+void StatusBoard::shutdown()
+{
+	{
+		std::lock_guard<std::mutex> lock(_mutex);
+		_stopped = true;
+	}
+
+	_cv.notify_all();
+}
+
+bool StatusBoard::stopped() const
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	return _stopped;
+}
diff --git a/src/StatusBoard.hpp b/src/StatusBoard.hpp
new file mode 100644
index 0000000..4360570
--- /dev/null
+++ b/src/StatusBoard.hpp
@@ -0,0 +1,56 @@
+#pragma once
+
+#include <chrono>
+#include <condition_variable>
+#include <cstdint>
+#include <functional>
+#include <mutex>
+#include <string>
+
+// What logloader is doing right now, shared between the worker loops that write
+// it and the API server that streams it out.
+//
+// Every change bumps a revision, so a reader can block until something actually
+// happened instead of polling. Progress during a transfer is the one thing the
+// database does not hold: it changes many times a second and is worthless after
+// a restart.
+class StatusBoard
+{
+public:
+	struct Snapshot {
+		bool connected {false};
+		bool armed {false};
+		bool ftp_available {false};
+		std::string log_root;
+
+		// 0 when nothing is being transferred.
+		int64_t downloading_id {0};
+		uint32_t downloaded_bytes {0};
+		uint32_t download_total_bytes {0};
+
+		int64_t uploading_id {0};
+		std::string uploading_target;
+
+		// Bumped on every change; a reader compares against what it last saw.
+		uint64_t revision {0};
+	};
+
+	Snapshot get() const;
+
+	// Applies mutate under the lock, then bumps the revision and wakes readers.
+	void update(const std::function<void(Snapshot&)>& mutate);
+
+	// Blocks until the revision moves past known_revision or the timeout
+	// expires, then returns the current snapshot either way.
+	Snapshot wait_for_change(uint64_t known_revision, std::chrono::milliseconds timeout) const;
+
+	// Releases every waiter so the API server's streams can close on shutdown.
+	void shutdown();
+	bool stopped() const;
+
+private:
+	mutable std::mutex _mutex;
+	mutable std::condition_variable _cv;
+	Snapshot _snapshot;
+	bool _stopped {false};
+};
diff --git a/src/UploadTarget.cpp b/src/UploadTarget.cpp
new file mode 100644
index 0000000..832d962
--- /dev/null
+++ b/src/UploadTarget.cpp
@@ -0,0 +1,177 @@
+#include "UploadTarget.hpp"
+#include "Log.hpp"
+
+#include <filesystem>
+#include <fstream>
+#include <memory>
+
+// CPPHTTPLIB_OPENSSL_SUPPORT is set for the whole target in CMakeLists.txt.
+// Defining it per-file would give translation units different definitions of
+// httplib's socket types, which is an ODR violation the linker resolves by
+// silently picking one.
+#include <httplib.h>
+
+namespace fs = std::filesystem;
+
+namespace
+{
+
+// httplib::Client parses the scheme itself and picks TLS accordingly, so the
+// url is passed through as configured. A url without a scheme keeps the old
+// behaviour of assuming TLS rather than silently downgrading to port 80.
+std::string with_scheme(const std::string& url)
+{
+	return url.find("://") == std::string::npos ? "https://" + url : url;
+}
+
+// Server error pages are HTML; this makes one readable line out of one.
+std::string one_line(std::string text, size_t limit = 200)
+{
+	for (char& c : text) {
+		if (c == '\n' || c == '\r' || c == '\t') {
+			c = ' ';
+		}
+	}
+
+	if (text.size() > limit) {
+		text.resize(limit);
+		text += "...";
+	}
+
+	return text;
+}
+
+} // namespace
+
+UploadTarget::UploadTarget(const UploadTargetConfig& config)
+	: _config(config)
+{
+	_config.url = with_scheme(_config.url);
+}
+
+bool UploadTarget::reachable()
+{
+	const auto now = std::chrono::steady_clock::now();
+
+	if (now < _unreachable_until) {
+		return false;
+	}
+
+	httplib::Client client(_config.url);
+	client.set_connection_timeout(5, 0);
+	client.set_read_timeout(5, 0);
+	// Any answer proves the host is up. Flight Review redirects "/", so
+	// requiring 200 would call a healthy server dead.
+	client.set_follow_location(false);
+
+	const httplib::Result response = client.Get("/");
+
+	if (!response) {
+		_unreachable_until = now + kUnreachableCooldown;
+
+		if (!_reported_unreachable) {
+			LOG_WARN("Upload target " << _config.name << " (" << _config.url << ") is unreachable; "
+				 << "retrying in "
+				 << std::chrono::duration_cast<std::chrono::seconds>(kUnreachableCooldown).count()
+				 << "s");
+			_reported_unreachable = true;
+		}
+
+		return false;
+	}
+
+	if (_reported_unreachable) {
+		LOG("Upload target " << _config.name << " (" << _config.url << ") is reachable again");
+		_reported_unreachable = false;
+	}
+
+	_unreachable_until = {};
+	return true;
+}
+
+UploadTarget::Result UploadTarget::upload(const std::string& file_path)
+{
+	std::error_code ec;
+
+	if (!fs::exists(file_path, ec)) {
+		return {Outcome::Rejected, 0, "local file is missing: " + file_path, ""};
+	}
+
+	const auto size = fs::file_size(file_path, ec);
+
+	if (ec || size == 0) {
+		return {Outcome::Rejected, 0, "local file is empty: " + file_path, ""};
+	}
+
+	if (!reachable()) {
+		return {Outcome::Unreachable, 0, "server unreachable", ""};
+	}
+
+	std::ifstream file(file_path, std::ios::binary);
+
+	if (!file) {
+		return {Outcome::Rejected, 0, "cannot open local file: " + file_path, ""};
+	}
+
+	const std::string name = fs::path(file_path).filename().string();
+	std::string content((std::istreambuf_iterator<char>(file)), std::istreambuf_iterator<char>());
+
+	// Flight Review reads every one of these fields off the form; the ones it
+	// does not use for an automated upload still have to be present.
+	httplib::MultipartFormDataItems items = {
+		{"type", _config.public_logs ? "flightreport" : "personal", "", ""},
+		{"description", "Uploaded by logloader", "", ""},
+		{"feedback", "", "", ""},
+		{"email", _config.email, "", ""},
+		{"source", "auto", "", ""},
+		{"videoUrl", "", "", ""},
+		{"rating", "", "", ""},
+		{"windSpeed", "", "", ""},
+		{"public", _config.public_logs ? "true" : "false", "", ""},
+		{"filearg", std::move(content), name, "application/octet-stream"},
+	};
+
+	httplib::Headers headers;
+	const bool use_api_key = !_config.api_key.empty();
+
+	if (use_api_key) {
+		headers.emplace("Authorization", "Bearer " + _config.api_key);
+		headers.emplace("X-API-Key", _config.api_key);
+	}
+
+	LOG("Uploading " << name << " to " << _config.name << " (" << _config.url << ")"
+	    << (use_api_key ? " with API key" : ""));
+
+	httplib::Client client(_config.url);
+	client.set_connection_timeout(30, 0);
+	client.set_read_timeout(300, 0);
+	client.set_write_timeout(300, 0);
+	client.set_follow_location(false);
+
+	const httplib::Result response = client.Post("/upload", headers, items);
+
+	if (!response) {
+		// The connection died mid-transfer; the server may or may not have the
+		// log, so this is worth another attempt rather than a rejection.
+		return {Outcome::Retry, 0, "connection failed during upload", ""};
+	}
+
+	const int status = response->status;
+
+	// Flight Review answers a successful upload with a redirect to the plot.
+	if (status == 302 || status == 200) {
+		return {Outcome::Success, status, "uploaded", response->get_header_value("Location")};
+	}
+
+	const std::string detail = one_line(response->body);
+
+	if (status == 401 || status == 403) {
+		return {Outcome::Unauthorized, status, detail.empty() ? "not authorized" : detail, ""};
+	}
+
+	if (status == 400) {
+		return {Outcome::Rejected, status, detail.empty() ? "rejected by the server" : detail, ""};
+	}
+
+	return {Outcome::Retry, status, detail.empty() ? "server error" : detail, ""};
+}
diff --git a/src/UploadTarget.hpp b/src/UploadTarget.hpp
new file mode 100644
index 0000000..e2c9a35
--- /dev/null
+++ b/src/UploadTarget.hpp
@@ -0,0 +1,55 @@
+#pragma once
+
+#include <chrono>
+#include <string>
+
+#include "Config.hpp"
+
+// One Flight Review endpoint. Knows how to reach it and how to post a log to
+// it; it holds no record of which logs exist or what has been uploaded, which
+// is what LogDatabase is for.
+class UploadTarget
+{
+public:
+	enum class Outcome {
+		Success,
+		// The server will not take this log however often it is asked.
+		Rejected,
+		// The account is not authorized (yet). The log is fine; every other
+		// upload to this target would fail the same way, so stop the batch and
+		// keep the log queued.
+		Unauthorized,
+		// Could not connect. Stop the batch and try again after the cooldown.
+		Unreachable,
+		// Anything else: worth another attempt later.
+		Retry,
+	};
+
+	struct Result {
+		Outcome outcome {Outcome::Retry};
+		int status_code {0};
+		std::string message;
+		// Path the server redirected to, e.g. "/plot_app?log=<uuid>".
+		std::string location;
+	};
+
+	explicit UploadTarget(const UploadTargetConfig& config);
+
+	const std::string& name() const { return _config.name; }
+	const std::string& url() const { return _config.url; }
+	bool enabled() const { return _config.enabled; }
+
+	Result upload(const std::string& file_path);
+
+private:
+	// Probes at most once per cooldown and logs only on the down/up
+	// transitions, so a server that is simply off does not produce one failure
+	// line per pending log.
+	bool reachable();
+
+	UploadTargetConfig _config;
+
+	static constexpr auto kUnreachableCooldown = std::chrono::seconds(60);
+	std::chrono::steady_clock::time_point _unreachable_until {};
+	bool _reported_unreachable {false};
+};
diff --git a/src/Waiter.hpp b/src/Waiter.hpp
new file mode 100644
index 0000000..1113ec4
--- /dev/null
+++ b/src/Waiter.hpp
@@ -0,0 +1,57 @@
+#pragma once
+
+#include <chrono>
+#include <condition_variable>
+#include <mutex>
+
+// An interruptible sleep. A loop that would otherwise sit out its whole
+// interval can be woken as soon as there is something to do (a new request from
+// the API, say) or told to stop.
+//
+// Each loop owns its own Waiter, so a wake meant for one cannot be consumed by
+// the other.
+class Waiter
+{
+public:
+	// Sleeps for at most duration. Returns true when the caller should stop.
+	template <typename Rep, typename Period>
+	bool wait(std::chrono::duration<Rep, Period> duration)
+	{
+		std::unique_lock<std::mutex> lock(_mutex);
+		_cv.wait_for(lock, duration, [this] { return _stop || _wake; });
+		_wake = false;
+		return _stop;
+	}
+
+	void wake()
+	{
+		{
+			std::lock_guard<std::mutex> lock(_mutex);
+			_wake = true;
+		}
+
+		_cv.notify_all();
+	}
+
+	void stop()
+	{
+		{
+			std::lock_guard<std::mutex> lock(_mutex);
+			_stop = true;
+		}
+
+		_cv.notify_all();
+	}
+
+	bool stopped() const
+	{
+		std::lock_guard<std::mutex> lock(_mutex);
+		return _stop;
+	}
+
+private:
+	mutable std::mutex _mutex;
+	std::condition_variable _cv;
+	bool _wake {false};
+	bool _stop {false};
+};
diff --git a/src/main.cpp b/src/main.cpp
index 542aab4..285861f 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -1,114 +1,122 @@
-#include "LogLoader.hpp"
-#include "Log.hpp"
-#include <signal.h>
-#include <iostream>
+#include <atomic>
+#include <cstdio>
 #include <filesystem>
-#include <toml.hpp>
+#include <iostream>
+#include <thread>
 
-static void signal_handler(int signum);
+#include <csignal>
+#include <ctime>
+#include <pthread.h>
 
-std::atomic<bool> _should_exit = false;
-std::shared_ptr<LogLoader> _log_loader;
+#include "ApiServer.hpp"
+#include "Config.hpp"
+#include "Log.hpp"
+#include "LogLoader.hpp"
 
-int main(int argc, char** argv)
+namespace
 {
-	signal(SIGINT, signal_handler);
-	signal(SIGTERM, signal_handler);
-	setbuf(stdout, NULL); // Disable stdout buffering
 
-	// Config lookup: --config <path> (or --config=<path>) overrides everything;
-	// otherwise user override > deb-installed default.
-	const std::string home = getenv("HOME") ? getenv("HOME") : "/tmp";
-	const auto user_config = std::filesystem::path(home) / ".config/ark/logloader/config.toml";
-	const auto default_config = std::filesystem::path("/opt/ark/share/logloader/config.toml");
-	std::string config_path = (std::filesystem::exists(user_config) ? user_config : default_config).string();
+void print_usage()
+{
+	std::cout
+			<< "logloader - download flight logs over MAVLink FTP and upload them to Flight Review\n\n"
+			<< "  --config <path>   configuration file to use\n"
+			<< "  --help            show this message\n\n"
+			<< "Without --config, ~/.config/ark/logloader/config.toml is used when it exists,\n"
+			<< "otherwise /opt/ark/share/logloader/config.toml.\n";
+}
 
-	for (int i = 1; i < argc; i++) {
-		std::string arg = argv[i];
+// SIGINT/SIGTERM are blocked in every thread and consumed here instead. A
+// handler cannot safely take a lock or signal a condition variable, and stopping
+// cleanly needs both.
+std::thread start_signal_thread(const sigset_t& mask, const std::atomic<bool>& running,
+				const std::function<void()>& on_signal)
+{
+	return std::thread([&mask, &running, on_signal] {
+		const timespec timeout {0, 200 * 1000 * 1000};
+
+		while (running.load())
+		{
+			siginfo_t info {};
+			const int signum = sigtimedwait(&mask, &info, &timeout);
+
+			if (signum > 0) {
+				LOG("Received signal " << signum << ", shutting down");
+				on_signal();
+				return;
+			}
+		}
+	});
+}
+
+} // namespace
 
-		if (arg == "--config" && i + 1 < argc) {
-			config_path = argv[++i];
+int main(int argc, char** argv)
+{
+	setbuf(stdout, nullptr); // journald wants lines as they happen
+
+	for (int i = 1; i < argc; i++) {
+		const std::string arg = argv[i];
 
-		} else if (arg.rfind("--config=", 0) == 0) {
-			config_path = arg.substr(std::string("--config=").size());
+		if (arg == "--help" || arg == "-h") {
+			print_usage();
+			return 0;
 		}
 	}
 
-	toml::table config;
+	const std::string config_path = resolve_config_path(argc, argv);
+	Config config;
 
 	try {
-		config = toml::parse_file(config_path);
+		config = load_config(config_path);
 
-	} catch (const toml::parse_error& err) {
-		std::cerr << "Parsing failed:\n" << err << "\n";
-		return -1;
-
-	} catch (const std::exception& err) {
-		std::cerr << "Error: " << err.what() << "\n";
-		return -1;
+	} catch (const std::exception& error) {
+		LOG_ERROR(error.what());
+		return 1;
 	}
 
-	// Writable data directory for logs and SQLite DB
-	const auto data_dir = std::filesystem::path(home) / ".local/share/ark/logloader";
-	std::filesystem::create_directories(data_dir);
-
-	// Setup the LogLoader
-	LogLoader::Settings settings = {
-		.email = config["email"].value_or(""),
-		.local_server = config["local_server"].value_or("http://127.0.0.1:5006"),
-		.remote_server = config["remote_server"].value_or("https://logs.px4.io"),
-		.remote_api_key = config["remote_api_key"].value_or(""),
-		.mavsdk_connection_url = config["connection_url"].value_or("0.0.0"),
-		.application_directory = config["application_directory"].value_or(data_dir.string() + "/"),
-		.upload_enabled = config["upload_enabled"].value_or(false),
-		.public_logs = config["public_logs"].value_or(false),
-		.remote_log_directory = config["remote_log_directory"].value_or(""),
-		.ftp_use_burst = config["ftp_use_burst"].value_or(true)
-	};
-
-	// Trim whitespace-only keys so they count as "not set" (no empty auth headers).
-	auto trim = [](std::string s) {
-		const auto start = s.find_first_not_of(" \t\r\n");
-
-		if (start == std::string::npos) {
-			return std::string{};
-		}
+	logging::set_level(config.log_level);
+	LOG("logloader starting, configuration from " << config_path);
+
+	std::error_code ec;
+	std::filesystem::create_directories(config.logs_directory, ec);
 
-		const auto end = s.find_last_not_of(" \t\r\n");
-		return s.substr(start, end - start + 1);
-	};
-	settings.remote_api_key = trim(std::move(settings.remote_api_key));
-
-	// Still attempt remote uploads without a key (open servers like logs.px4.io).
-	// Authenticated ARK Flight Review will 403 until remote_api_key is set; we
-	// never send empty Authorization / X-API-Key headers (see ServerInterface).
-	if (settings.upload_enabled && settings.remote_api_key.empty()) {
-		LOG("upload_enabled is true but remote_api_key is empty — remote uploads will "
-		    "proceed without an API key (open servers only; ARK Flight Review needs a key)");
+	if (ec) {
+		LOG_ERROR("Cannot create " << config.logs_directory << ": " << ec.message());
+		return 1;
 	}
 
-	_log_loader = std::make_shared<LogLoader>(settings);
+	sigset_t mask;
+	sigemptyset(&mask);
+	sigaddset(&mask, SIGINT);
+	sigaddset(&mask, SIGTERM);
+	pthread_sigmask(SIG_BLOCK, &mask, nullptr);
 
-	bool connected = false;
+	LogLoader loader(config);
 
-	while (!_should_exit && !connected) {
-		connected = _log_loader->wait_for_mavsdk_connection(3);
+	if (!loader.database_ok()) {
+		return 1;
 	}
 
-	if (!_should_exit && connected) {
-		_log_loader->run();
-	}
+	ApiServer api(config, loader);
 
-	LOG("Exiting.");
+	// Serve before connecting, so the UI can say the vehicle is not there yet
+	// rather than failing to load at all.
+	if (config.api_enabled && !api.start()) {
+		return 1;
+	}
 
-	return 0;
-}
+	std::atomic<bool> running {true};
+	std::thread signals = start_signal_thread(mask, running, [&loader] { loader.stop(); });
 
-static void signal_handler(int signum)
-{
-	(void)signum;
+	if (loader.connect()) {
+		loader.run();
+	}
 
-	if (_log_loader.get()) _log_loader->stop();
+	api.stop();
+	running = false;
+	signals.join();
 
-	_should_exit = true;
+	LOG("logloader stopped");
+	return 0;
 }
diff --git a/third_party/json b/third_party/json
new file mode 160000
index 0000000..9cca280
--- /dev/null
+++ b/third_party/json
@@ -0,0 +1 @@
+Subproject commit 9cca280a4d0ccf0c08f47a99aa71d1b0e52f8d03

From 34115fe71f7b0d3e02c45361eef6cf103186e3b2 Mon Sep 17 00:00:00 2001
From: Jacob Dahl <dahl.jakejacob@gmail.com>
Date: Tue, 28 Jul 2026 11:57:42 -0600
Subject: [PATCH 5/8] fix(logloader): close a use-after-free, a
 wedged-transaction path and an OOM upload

Findings from two review passes over the rewrite, verified against PX4 SITL and
a local flight-review.

FtpListClient handed MAVSDK a callback capturing `this`. MAVSDK removes a
message handler asynchronously and does not drain callbacks it has already
queued, so a reply arriving after the client was destroyed -- which is what
happens on SIGTERM during a transfer, since the vehicle keeps sending -- locked
a destroyed mutex and wrote 251 bytes into freed heap. The callback now holds a
weak_ptr to the state it touches. This is the same shape as the progress
callback fixed earlier; it was the second instance.

Transaction::commit cleared _open before running COMMIT, so a COMMIT that
failed (a full data partition) left the transaction open with no rollback.
Every later BEGIN would then fail, every write would be silently discarded, and
the daemon would re-download the same logs forever while appearing healthy.

Uploads serialised the whole log into memory twice: httplib's
MultipartFormDataItems overload concatenates the entire body into a second
string. A 400 MB log needed most of a gigabyte on a Pi, and the resulting OOM
kill retried the same log on restart. The body is now streamed off disk with a
computed Content-Length. Verified byte-identical on arrival.

Also:
- LogDatabase::ok() reported success when only sqlite3_open had succeeded, so a
  read-only data directory produced a daemon that ran and stored nothing.
- A row claiming downloaded=1 with no local file was reachable from neither
  queue. The queues now treat it as not downloaded, and a missing local file at
  upload time is Outcome::Missing (re-fetch) rather than Rejected (give up).
- The SSE keepalive wrote 14 bytes of a 13-byte string, putting a NUL on the
  wire; the frontend then dropped the next real event. Transfer progress also
  re-serialised the whole log table twice a second per client -- status and
  logs are now separate events.
- Each SSE stream holds an httplib worker, and the default pool is 8, so a few
  stale tabs starved the whole API. Pool raised, concurrent streams capped.
- newest_log_id ordered ArduPilot logs by name, which stops meaning age once
  the counter wraps at LOG_MAX_FILES; discovered_at now takes precedence.
- iso8601_utc ignored strftime's return value, so a vehicle reporting an
  absurd mtime caused a stack over-read into the JSON response.
- FtpListClient::stop() mutated its flag outside the lock (lost wakeup), and
  list_directory had no bound on a remote-driven loop.
- download.auto = false no longer leaves latest_on_first_start active; a free
  space check runs before a transfer; `make debug` builds Debug again; astyle
  moved out of the default target.
---
 Makefile              |  18 +++--
 config.toml           |   8 +-
 src/ApiServer.cpp     | 170 ++++++++++++++++++++++++------------------
 src/ApiServer.hpp     |  25 ++++---
 src/Config.cpp        |  31 +++++---
 src/Config.hpp        |   4 +-
 src/FtpListClient.cpp |  82 +++++++++++++-------
 src/FtpListClient.hpp |  31 ++++++--
 src/FtpLogFetcher.cpp |   2 +-
 src/LogDatabase.cpp   | 127 ++++++++++++++++++++++---------
 src/LogDatabase.hpp   |  24 ++++--
 src/LogLoader.cpp     | 137 +++++++++++++++++++---------------
 src/LogLoader.hpp     |   4 +
 src/Sqlite.cpp        |  17 ++---
 src/Sqlite.hpp        |   1 -
 src/StatusBoard.cpp   |  55 ++++++++++++--
 src/StatusBoard.hpp   |  22 ++++--
 src/UploadTarget.cpp  |  62 ++++++++++++---
 src/UploadTarget.hpp  |   3 +
 src/main.cpp          |   2 +-
 20 files changed, 551 insertions(+), 274 deletions(-)

diff --git a/Makefile b/Makefile
index c3ea421..88efb4f 100644
--- a/Makefile
+++ b/Makefile
@@ -1,15 +1,21 @@
 PROJECT_NAME="logloader"
 
 all:
-	@astyle --quiet --options=astylerc src/*.cpp,*.hpp
-	@cmake -Bbuild -H. -DDEBUG_BUILD=OFF; cmake --build build -j$(nproc)
+	@cmake -Bbuild -S. -DCMAKE_BUILD_TYPE=Release; cmake --build build -j$(nproc)
 	@size build/${PROJECT_NAME}
 
 debug:
-	@astyle --quiet --options=astylerc src/*.cpp,*.hpp
-	@cmake -Bbuild -H. -DDEBUG_BUILD=ON; cmake --build build -j$(nproc)
+	@cmake -Bbuild -S. -DCMAKE_BUILD_TYPE=Debug; cmake --build build -j$(nproc)
 	@size build/${PROJECT_NAME}
-	@echo "Debug build with logging enabled"
+
+# Separate from the build on purpose: a `make` that rewrites your sources cannot
+# run from a read-only checkout and makes the build non-reproducible.
+format:
+	@astyle --quiet --options=astylerc src/*.cpp,*.hpp
+
+check-format:
+	@astyle --dry-run --formatted --options=astylerc src/*.cpp,*.hpp | grep Formatted \
+		&& { echo "run 'make format'"; exit 1; } || echo "formatting OK"
 
 install:
 	@bash install.sh
@@ -18,4 +24,4 @@ clean:
 	@rm -rf build
 	@echo "All build artifacts removed"
 
-.PHONY: all debug install clean
+.PHONY: all debug format check-format install clean
diff --git a/config.toml b/config.toml
index c004c3c..15dc8a1 100644
--- a/config.toml
+++ b/config.toml
@@ -24,10 +24,6 @@ auto = true
 # recent one. Everything else is available from the ARK-OS Logs page.
 latest_on_first_start = true
 
-# Upload whatever was fetched automatically. Turn this off to download after a
-# flight but upload only on request.
-auto_upload = true
-
 # If one listing turns up more new logs than this, it is a card we have not seen
 # rather than a flight that just happened: queue only the newest and leave the
 # rest to the operator. 0 disables the guard.
@@ -46,6 +42,10 @@ remote_directory = ""
 use_burst = true
 
 [upload]
+# Upload whatever was fetched automatically. Turn this off to download after a
+# flight but upload only on request.
+auto = true
+
 # Seconds between upload passes.
 interval = 10
 
diff --git a/src/ApiServer.cpp b/src/ApiServer.cpp
index f66442b..40c470b 100644
--- a/src/ApiServer.cpp
+++ b/src/ApiServer.cpp
@@ -1,4 +1,5 @@
 #include "ApiServer.hpp"
+#include "Config.hpp"
 #include "Log.hpp"
 #include "LogLoader.hpp"
 
@@ -18,13 +19,22 @@ namespace
 // so an idle connection is not mistaken for a dead one by anything in between.
 constexpr auto kEventKeepalive = std::chrono::seconds(15);
 
+constexpr size_t kWorkerThreads = 16;
+constexpr size_t kMaxStreams = 8;
+constexpr size_t kMaxRequestBody = 1 << 20;
+
 std::string iso8601_utc(int64_t time_utc)
 {
+	// A vehicle is free to report any mtime it likes; a year that does not fit
+	// makes strftime return 0 and leave the buffer unspecified.
 	char buffer[sizeof "2026-07-28T10:30:00Z"];
 	const auto as_time_t = static_cast<time_t>(time_utc);
 	std::tm tm {};
-	gmtime_r(&as_time_t, &tm);
-	strftime(buffer, sizeof(buffer), "%FT%TZ", &tm);
+
+	if (gmtime_r(&as_time_t, &tm) == nullptr || strftime(buffer, sizeof(buffer), "%FT%TZ", &tm) == 0) {
+		return {};
+	}
+
 	return buffer;
 }
 
@@ -112,10 +122,22 @@ std::vector<int64_t> ids_from(const json& body)
 	return ids;
 }
 
+json list_payload(LogDatabase& database, const StatusBoard::Snapshot& snapshot,
+		  const std::vector<std::string>& targets)
+{
+	json logs = json::array();
+
+	for (const auto& entry : database.all_logs()) {
+		logs.push_back(to_json(entry));
+	}
+
+	return {{"logs", logs}, {"status", to_json(snapshot)}, {"targets", targets}};
+}
+
 } // namespace
 
-ApiServer::ApiServer(const Config& config, LogLoader& loader)
-	: _config(config)
+ApiServer::ApiServer(const Settings& settings, LogLoader& loader)
+	: _settings(settings)
 	, _loader(loader)
 	, _server(std::make_unique<httplib::Server>())
 {
@@ -129,18 +151,29 @@ ApiServer::~ApiServer()
 
 bool ApiServer::start()
 {
-	if (!_server->bind_to_port(_config.api_bind, _config.api_port)) {
-		LOG_ERROR("Could not bind the API to " << _config.api_bind << ":" << _config.api_port);
+	// Every /events stream holds one worker for as long as it is open, so the
+	// pool has to be bigger than the number of streams we are willing to serve.
+	_server->new_task_queue = [] { return new httplib::ThreadPool(kWorkerThreads); };
+	// Nothing here accepts a large body; the only uploads go the other way.
+	_server->set_payload_max_length(kMaxRequestBody);
+
+	if (!_server->bind_to_port(_settings.bind, _settings.port)) {
+		LOG_ERROR("Could not bind the API to " << _settings.bind << ":" << _settings.port);
 		return false;
 	}
 
 	_thread = std::thread([this] { _server->listen_after_bind(); });
-	LOG("API listening on " << _config.api_bind << ":" << _config.api_port);
+	LOG("API listening on " << _settings.bind << ":" << _settings.port);
 	return true;
 }
 
 void ApiServer::stop()
 {
+	_stopping = true;
+	// Releases the streams blocked in wait_for_change, which would otherwise
+	// keep a worker each and hang the join below.
+	_loader.status().shutdown();
+
 	if (_server) {
 		_server->stop();
 	}
@@ -161,59 +194,66 @@ void ApiServer::install_routes()
 	});
 
 	_server->Get("/logs", [this, &database](const httplib::Request&, httplib::Response & response) {
-		json logs = json::array();
-
-		for (const auto& entry : database.all_logs()) {
-			logs.push_back(to_json(entry));
-		}
-
-		const json payload = {
-			{"logs", logs},
-			{"status", to_json(_loader.status().get())},
-			{"targets", _loader.enabled_target_names()},
-		};
+		const json payload =
+			list_payload(database, _loader.status().get(), _loader.enabled_target_names());
 		response.set_content(payload.dump(), "application/json");
 	});
 
 	// One event per change, so the page reflects a transfer as it happens
 	// rather than on the next poll.
 	_server->Get("/events", [this, &database](const httplib::Request&, httplib::Response & response) {
+		if (_streams.fetch_add(1) >= kMaxStreams) {
+			_streams--;
+			response.status = 503;
+			response.set_content(json {{"error", "too many event streams"}}.dump(), "application/json");
+			return;
+		}
+
 		// nginx buffers a streaming response into uselessness without this.
 		response.set_header("Cache-Control", "no-cache");
 		response.set_header("X-Accel-Buffering", "no");
 
-		auto last_revision = std::make_shared<uint64_t>(UINT64_MAX);
+		auto seen_status = std::make_shared<uint64_t>(UINT64_MAX);
+		auto seen_logs = std::make_shared<uint64_t>(UINT64_MAX);
 
 		response.set_chunked_content_provider("text/event-stream",
-		[this, &database, last_revision](size_t, httplib::DataSink & sink) {
+		[this, &database, seen_status, seen_logs](size_t, httplib::DataSink & sink) {
 			StatusBoard& status = _loader.status();
 
-			if (status.stopped()) {
+			// Either side may be shutting down; _stopping covers the case where
+			// the API is stopped on its own, which nothing else would unblock.
+			if (_stopping.load() || status.stopped()) {
 				sink.done();
+				_streams--;
 				return false;
 			}
 
-			const auto snapshot = status.wait_for_change(*last_revision, kEventKeepalive);
+			const auto snapshot = status.wait_for_change(*seen_status, kEventKeepalive);
+			const uint64_t log_revision = database.revision();
 
-			if (snapshot.revision == *last_revision) {
+			if (snapshot.revision == *seen_status && log_revision == *seen_logs) {
 				// Nothing happened; prove the connection is still good.
-				return sink.write(": keepalive\n\n", 14);
+				static constexpr char keepalive[] = ": keepalive\n\n";
+				return sink.write(keepalive, sizeof(keepalive) - 1);
 			}
 
-			*last_revision = snapshot.revision;
+			*seen_status = snapshot.revision;
 
-			json logs = json::array();
+			// Transfer progress ticks several times a second. Re-reading and
+			// re-serialising every log for each of those would be the hottest
+			// path in the program, so the list only goes out when it changed.
+			std::string message;
 
-			for (const auto& entry : database.all_logs()) {
-				logs.push_back(to_json(entry));
+			if (log_revision != *seen_logs) {
+				*seen_logs = log_revision;
+				message = "event: logs\ndata: "
+					  + list_payload(database, snapshot, _loader.enabled_target_names()).dump();
+
+			} else {
+				message = "event: status\ndata: " + to_json(snapshot).dump();
 			}
 
-			const json payload = {
-				{"logs", logs},
-				{"status", to_json(snapshot)},
-				{"targets", _loader.enabled_target_names()},
-			};
-			const std::string message = "event: logs\ndata: " + payload.dump() + "\n\n";
+			message += "\n\n";
 			return sink.write(message.data(), message.size());
 		});
 	});
@@ -225,28 +265,17 @@ void ApiServer::install_routes()
 			return;
 		}
 
-		std::vector<int64_t> ids = ids_from(body);
+		const std::vector<int64_t> ids =
+			body.value("all", false) ? database.ids_not_downloaded() : ids_from(body);
 
-		if (body.value("all", false)) {
-			ids.clear();
+		// Fetching and uploading normally go together; "upload": false is how a
+		// caller asks for the file without publishing it.
+		const std::vector<std::string> targets =
+			body.value("upload", true) ? _loader.enabled_target_names() : std::vector<std::string> {};
 
-			for (const auto& entry : database.all_logs()) {
-				if (entry.present && !entry.downloaded) {
-					ids.push_back(entry.id);
-				}
-			}
-		}
-
-		// An explicit request says nothing about uploading, so only the
-		// configured targets are asked for when the caller wants them.
-		std::vector<std::string> targets;
-
-		if (body.value("upload", true)) {
-			targets = _loader.enabled_target_names();
-		}
-
-		database.request_download(ids, targets);
+		database.request(ids, targets);
 		_loader.wake();
+		_loader.status().notify();
 
 		response.set_content(json {{"queued", ids.size()}}.dump(), "application/json");
 	});
@@ -283,26 +312,12 @@ void ApiServer::install_routes()
 			return;
 		}
 
-		std::vector<int64_t> ids = ids_from(body);
-
-		if (body.value("all", false)) {
-			ids.clear();
-
-			for (const auto& entry : database.all_logs()) {
-				const bool wanted = std::any_of(targets.begin(), targets.end(),
-				[&entry](const std::string & target) {
-					const auto it = entry.uploads.find(target);
-					return it != entry.uploads.end() && !it->second.uploaded;
-				});
+		const std::vector<int64_t> ids =
+			body.value("all", false) ? database.ids_not_uploaded(targets) : ids_from(body);
 
-				if (wanted && (entry.downloaded || entry.present)) {
-					ids.push_back(entry.id);
-				}
-			}
-		}
-
-		database.request_upload(ids, targets);
+		database.request(ids, targets);
 		_loader.wake();
+		_loader.status().notify();
 
 		response.set_content(json {{"queued", ids.size()}}.dump(), "application/json");
 	});
@@ -317,12 +332,22 @@ void ApiServer::install_routes()
 		const std::vector<int64_t> ids = ids_from(body);
 		database.cancel_requests(ids);
 		_loader.wake();
+		_loader.status().notify();
 
 		response.set_content(json {{"cancelled", ids.size()}}.dump(), "application/json");
 	});
 
 	_server->Delete(R"(/logs/(\d+)/file)", [this](const httplib::Request & request, httplib::Response & response) {
-		const int64_t id = std::stoll(request.matches[1]);
+		int64_t id = 0;
+
+		try {
+			id = std::stoll(request.matches[1]);
+
+		} catch (const std::exception&) {
+			response.status = 404;
+			response.set_content(json {{"error", "no such log"}}.dump(), "application/json");
+			return;
+		}
 
 		if (!_loader.delete_local_file(id)) {
 			response.status = 404;
@@ -330,6 +355,7 @@ void ApiServer::install_routes()
 			return;
 		}
 
+		_loader.status().notify();
 		response.set_content(json {{"deleted", id}}.dump(), "application/json");
 	});
 
diff --git a/src/ApiServer.hpp b/src/ApiServer.hpp
index bfd1a34..68d03a5 100644
--- a/src/ApiServer.hpp
+++ b/src/ApiServer.hpp
@@ -1,10 +1,11 @@
 #pragma once
 
+#include <atomic>
+#include <cstdint>
 #include <memory>
+#include <string>
 #include <thread>
 
-#include "Config.hpp"
-
 class LogLoader;
 
 namespace httplib
@@ -15,17 +16,17 @@ class Server;
 // A small read/write HTTP surface on localhost, so ARK-OS can show the vehicle's
 // logs and ask for particular ones instead of logloader guessing.
 //
-//   GET    /status              what logloader is doing right now
-//   GET    /logs                every known log with its download/upload state
-//   GET    /events              the same, as server-sent events
-//   POST   /logs/download       {"ids": [..]} or {"all": true}
-//   POST   /logs/upload         {"ids": [..]} or {"all": true}, optional "targets"
-//   POST   /logs/cancel         {"ids": [..]}
-//   DELETE /logs/{id}/file      remove the downloaded copy
+// The routes are listed in README.md rather than here, so there is one place to
+// keep correct.
 class ApiServer
 {
 public:
-	ApiServer(const Config& config, LogLoader& loader);
+	struct Settings {
+		std::string bind;
+		uint16_t port {3005};
+	};
+
+	ApiServer(const Settings& settings, LogLoader& loader);
 	~ApiServer();
 
 	ApiServer(const ApiServer&) = delete;
@@ -38,8 +39,10 @@ class ApiServer
 private:
 	void install_routes();
 
-	Config _config;
+	Settings _settings;
 	LogLoader& _loader;
 	std::unique_ptr<httplib::Server> _server;
 	std::thread _thread;
+	std::atomic<bool> _stopping {false};
+	std::atomic<size_t> _streams {0};
 };
diff --git a/src/Config.cpp b/src/Config.cpp
index 15b5ce4..26de17c 100644
--- a/src/Config.cpp
+++ b/src/Config.cpp
@@ -40,6 +40,10 @@ std::string trim(std::string text)
 	return text.substr(first, last - first + 1);
 }
 
+// Set when a config file still uses the pre-overhaul flat key layout. Warning
+// once is what makes the fallback deletable later rather than permanent.
+bool g_used_legacy_key = false;
+
 // Reads preferred, then the flat top-level key the pre-overhaul layout used, so
 // an existing config.toml keeps working unchanged.
 template <typename T, typename Preferred, typename Legacy>
@@ -50,6 +54,7 @@ T value_or(const Preferred& preferred, const Legacy& legacy, T fallback)
 	}
 
 	if (auto value = legacy.template value<T>(); value.has_value()) {
+		g_used_legacy_key = true;
 		return value.value();
 	}
 
@@ -117,16 +122,17 @@ Config load_config(const std::string& path)
 					value_or<std::string>(data["directory"], file["application_directory"], default_data));
 	config.logs_directory = config.data_directory + "logs/";
 
-	config.api_enabled = api["enabled"].value_or(true);
-	config.api_bind = api["bind"].value_or("127.0.0.1");
-	config.api_port = static_cast<uint16_t>(api["port"].value_or(3005));
-
-	config.auto_download = download["auto"].value_or(true);
-	config.download_latest_on_first_start = download["latest_on_first_start"].value_or(true);
-	config.auto_upload = download["auto_upload"].value_or(true);
-	config.max_auto_queue = download["max_auto_queue"].value_or(5);
-	config.index_interval_s = std::max(1, download["index_interval"].value_or(30));
-	config.upload_interval_s = std::max(1, upload["interval"].value_or(10));
+	config.api_enabled = api["enabled"].value_or(config.api_enabled);
+	config.api_bind = api["bind"].value_or(config.api_bind);
+	config.api_port = static_cast<uint16_t>(api["port"].value_or(config.api_port));
+
+	config.auto_download = download["auto"].value_or(config.auto_download);
+	config.download_latest_on_first_start =
+		download["latest_on_first_start"].value_or(config.download_latest_on_first_start);
+	config.auto_upload = upload["auto"].value_or(true);
+	config.max_auto_queue = download["max_auto_queue"].value_or(config.max_auto_queue);
+	config.index_interval_s = std::max(1, download["index_interval"].value_or(config.index_interval_s));
+	config.upload_interval_s = std::max(1, upload["interval"].value_or(config.upload_interval_s));
 	config.remote_log_directory =
 		value_or<std::string>(download["remote_directory"], file["remote_log_directory"], "");
 	config.use_burst = value_or<bool>(download["use_burst"], file["ftp_use_burst"], true);
@@ -155,5 +161,10 @@ Config load_config(const std::string& path)
 		config.remote.enabled = false;
 	}
 
+	if (g_used_legacy_key) {
+		LOG_WARN(path << " uses the pre-overhaul flat key layout. It still works, but the "
+			 "shipped config.toml shows the current one and the fallback will be removed.");
+	}
+
 	return config;
 }
diff --git a/src/Config.hpp b/src/Config.hpp
index 5e42c45..e7ce041 100644
--- a/src/Config.hpp
+++ b/src/Config.hpp
@@ -30,8 +30,8 @@ struct Config {
 	std::string logs_directory;
 
 	bool api_enabled {true};
-	std::string api_bind;
-	uint16_t api_port {5010};
+	std::string api_bind {"127.0.0.1"};
+	uint16_t api_port {3005};
 
 	// Queue a log for download as soon as it appears in a listing. This is what
 	// picks up the log a flight just produced.
diff --git a/src/FtpListClient.cpp b/src/FtpListClient.cpp
index 3966b54..70acb94 100644
--- a/src/FtpListClient.cpp
+++ b/src/FtpListClient.cpp
@@ -19,9 +19,16 @@ constexpr auto kReplyTimeout = std::chrono::milliseconds(2000);
 FtpListClient::FtpListClient(std::shared_ptr<mavsdk::System> system)
 	: _passthrough(std::make_shared<mavsdk::MavlinkPassthrough>(system))
 {
+	// Weak, and the ids are copied rather than reached through this: the
+	// callback may outlive the client. See State.
+	const uint8_t our_sysid = _passthrough->get_our_sysid();
+	const uint8_t our_compid = _passthrough->get_our_compid();
+
 	_subscription = _passthrough->subscribe_message(MAVLINK_MSG_ID_FILE_TRANSFER_PROTOCOL,
-	[this](const mavlink_message_t& message) {
-		handle_message(message);
+	[weak = std::weak_ptr<State>(_state), our_sysid, our_compid](const mavlink_message_t& message) {
+		if (auto state = weak.lock()) {
+			handle_message(*state, our_sysid, our_compid, message);
+		}
 	});
 }
 
@@ -32,8 +39,14 @@ FtpListClient::~FtpListClient()
 
 void FtpListClient::stop()
 {
-	_should_exit = true;
-	_cv.notify_all();
+	{
+		// Under the lock, or a notify landing between the waiter's predicate
+		// check and its block is lost and shutdown waits out the full timeout.
+		std::lock_guard<std::mutex> lock(_state->mutex);
+		_state->should_exit = true;
+	}
+
+	_state->cv.notify_all();
 }
 
 void FtpListClient::reset_sessions()
@@ -48,18 +61,19 @@ void FtpListClient::reset_sessions()
 	}
 }
 
-void FtpListClient::handle_message(const mavlink_message_t& message)
+void FtpListClient::handle_message(State& state, uint8_t our_sysid, uint8_t our_compid,
+				   const mavlink_message_t& message)
 {
 	mavlink_file_transfer_protocol_t ftp;
 	mavlink_msg_file_transfer_protocol_decode(&message, &ftp);
 
 	// The transfer runs unicast: the server addresses its replies to whoever
 	// asked. Anything not for us is another client's traffic.
-	if (ftp.target_system != _passthrough->get_our_sysid()) {
+	if (ftp.target_system != our_sysid) {
 		return;
 	}
 
-	if (ftp.target_component != _passthrough->get_our_compid() && ftp.target_component != 0) {
+	if (ftp.target_component != our_compid && ftp.target_component != 0) {
 		return;
 	}
 
@@ -70,17 +84,17 @@ void FtpListClient::handle_message(const mavlink_message_t& message)
 		return;
 	}
 
-	std::lock_guard<std::mutex> lock(_mutex);
+	std::lock_guard<std::mutex> lock(state.mutex);
 
 	// Match against the in-flight request so replies to MAVSDK's Ftp plugin
 	// (which shares our system and component id) are ignored.
-	if (!_expected_req_opcode.has_value() || payload.req_opcode != _expected_req_opcode.value()
-	    || payload.seq_number != _expected_seq) {
+	if (!state.expected_req_opcode.has_value() || payload.req_opcode != state.expected_req_opcode.value()
+	    || payload.seq_number != state.expected_seq) {
 		return;
 	}
 
-	_reply = payload;
-	_cv.notify_all();
+	state.reply = payload;
+	state.cv.notify_all();
 }
 
 void FtpListClient::send_request(const PayloadHeader& request)
@@ -109,35 +123,42 @@ bool FtpListClient::transact(uint8_t opcode, const std::string& path, uint32_t o
 	request.size = static_cast<uint8_t>(path.size() + 1);
 	std::memcpy(request.data, path.c_str(), path.size() + 1);
 
-	for (int attempt = 0; attempt < kMaxAttempts && !_should_exit; attempt++) {
+	State& state = *_state;
+
+	for (int attempt = 0; attempt < kMaxAttempts; attempt++) {
 		{
-			std::lock_guard<std::mutex> lock(_mutex);
-			_reply.reset();
+			std::lock_guard<std::mutex> lock(state.mutex);
+
+			if (state.should_exit) {
+				return false;
+			}
+
+			state.reply.reset();
 			// Servers reply with the request sequence number plus one, and
 			// answer a retransmission (same sequence number) from their
 			// duplicate-reply cache, so retries reuse the packet as-is.
-			_expected_seq = static_cast<uint16_t>(request.seq_number + 1);
-			_expected_req_opcode = opcode;
+			state.expected_seq = static_cast<uint16_t>(request.seq_number + 1);
+			state.expected_req_opcode = opcode;
 		}
 
 		send_request(request);
 
-		std::unique_lock<std::mutex> lock(_mutex);
+		std::unique_lock<std::mutex> lock(state.mutex);
 
-		if (_cv.wait_for(lock, kReplyTimeout, [this] { return _reply.has_value() || _should_exit.load(); })) {
-			_expected_req_opcode.reset();
+		if (state.cv.wait_for(lock, kReplyTimeout, [&state] { return state.reply.has_value() || state.should_exit; })) {
+			state.expected_req_opcode.reset();
 
-			if (_should_exit || !_reply.has_value()) {
+			if (!state.reply.has_value()) {
 				return false;
 			}
 
-			reply = _reply.value();
+			reply = state.reply.value();
 			return true;
 		}
 	}
 
-	std::lock_guard<std::mutex> lock(_mutex);
-	_expected_req_opcode.reset();
+	std::lock_guard<std::mutex> lock(state.mutex);
+	state.expected_req_opcode.reset();
 
 	return false;
 }
@@ -207,13 +228,14 @@ FtpListClient::Result FtpListClient::list_directory(const std::string& path, std
 
 	uint32_t offset = 0;
 
-	while (!_should_exit) {
+	for (int round_trip = 0; round_trip < kMaxRoundTrips; round_trip++) {
 		const uint8_t opcode = _with_time_supported ? kOpcodeListDirectoryWithTime : kOpcodeListDirectory;
 
 		PayloadHeader reply;
 
 		if (!transact(opcode, path, offset, reply)) {
-			return _should_exit ? Result::Stopped : Result::Timeout;
+			std::lock_guard<std::mutex> lock(_state->mutex);
+			return _state->should_exit ? Result::Stopped : Result::Timeout;
 		}
 
 		if (reply.opcode == kOpcodeNak) {
@@ -245,7 +267,13 @@ FtpListClient::Result FtpListClient::list_directory(const std::string& path, std
 		if (offset == previous_offset) {
 			return Result::Success;
 		}
+
+		if (entries.size() > kMaxEntries) {
+			LOG_WARN("Listing of " << path << " exceeded " << kMaxEntries << " entries, giving up");
+			return Result::ProtocolError;
+		}
 	}
 
-	return Result::Stopped;
+	LOG_WARN("Listing of " << path << " did not finish in " << kMaxRoundTrips << " requests");
+	return Result::ProtocolError;
 }
diff --git a/src/FtpListClient.hpp b/src/FtpListClient.hpp
index 0c3d060..3a2a4ed 100644
--- a/src/FtpListClient.hpp
+++ b/src/FtpListClient.hpp
@@ -76,6 +76,12 @@ class FtpListClient
 
 	static constexpr size_t kMaxDataLength = 239;
 
+	// A directory this large is a server that is not honouring the offset. Both
+	// the entry list and the round trips are driven by remote input, so both
+	// need a ceiling.
+	static constexpr size_t kMaxEntries = 20000;
+	static constexpr int kMaxRoundTrips = 2000;
+
 	// mavlink_file_transfer_protocol_t.payload is 251 bytes: this 12 byte
 	// header followed by kMaxDataLength bytes of data.
 	struct __attribute__((packed)) PayloadHeader {
@@ -92,7 +98,22 @@ class FtpListClient
 
 	static_assert(sizeof(PayloadHeader) == 251, "PayloadHeader must fill the FILE_TRANSFER_PROTOCOL payload");
 
-	void handle_message(const mavlink_message_t& message);
+	// Everything the subscription callback touches. Held by shared_ptr and
+	// captured weakly, because MAVSDK removes a message handler asynchronously
+	// and does not drain the callbacks it has already queued: a reply can
+	// arrive after this object is gone, which on shutdown mid-transfer it will.
+	struct State {
+		std::mutex mutex;
+		std::condition_variable cv;
+		std::optional<PayloadHeader> reply;
+		uint16_t expected_seq {0};
+		std::optional<uint8_t> expected_req_opcode;
+		bool should_exit {false};
+	};
+
+	static void handle_message(State& state, uint8_t our_sysid, uint8_t our_compid,
+				   const mavlink_message_t& message);
+
 	bool transact(uint8_t opcode, const std::string& path, uint32_t offset, PayloadHeader& reply);
 	void send_request(const PayloadHeader& request);
 
@@ -101,14 +122,8 @@ class FtpListClient
 	std::shared_ptr<mavsdk::MavlinkPassthrough> _passthrough;
 	mavsdk::MavlinkPassthrough::MessageHandle _subscription;
 
-	std::mutex _mutex;
-	std::condition_variable _cv;
-	std::optional<PayloadHeader> _reply;
-	uint16_t _expected_seq {0};
-	std::optional<uint8_t> _expected_req_opcode;
+	std::shared_ptr<State> _state {std::make_shared<State>()};
 
 	uint16_t _seq {0};
 	bool _with_time_supported {true}; // Optimistic until the server NAKs it
-
-	std::atomic<bool> _should_exit {false};
 };
diff --git a/src/FtpLogFetcher.cpp b/src/FtpLogFetcher.cpp
index 53671de..54766a2 100644
--- a/src/FtpLogFetcher.cpp
+++ b/src/FtpLogFetcher.cpp
@@ -305,7 +305,7 @@ bool FtpLogFetcher::download(const RemoteLog& log, const std::string& local_path
 		return false;
 	}
 
-	if (!fs::exists(staged_path)) {
+	if (!fs::exists(staged_path, ec)) {
 		LOG("FTP reported success but " << staged_path << " is missing");
 		return false;
 	}
diff --git a/src/LogDatabase.cpp b/src/LogDatabase.cpp
index 68a80a0..8494908 100644
--- a/src/LogDatabase.cpp
+++ b/src/LogDatabase.cpp
@@ -23,10 +23,12 @@ const std::string kLogColumns =
 	"l.download_requested, l.present, l.download_failures, l.last_error, l.discovered_at";
 
 // Newest first. Logs whose time the vehicle cannot report sort after the ones
-// it can, and fall back to the path: ArduPilot names logs with a bare counter,
-// so the longer name is the later one (100.BIN comes after 99.BIN).
+// it can; among those, a log we watched appear is newer than one that was
+// already there. The name is the last resort: ArduPilot numbers logs, so the
+// longer name is the later one (100.BIN after 99.BIN) -- until the counter
+// wraps at LOG_MAX_FILES, which is exactly why discovered_at comes first.
 const std::string kNewestFirst =
-	"(l.time_utc IS NULL) ASC, l.time_utc DESC, LENGTH(l.path) DESC, l.path DESC";
+	"(l.time_utc IS NULL) ASC, l.time_utc DESC, l.discovered_at DESC, LENGTH(l.path) DESC, l.path DESC";
 
 int64_t now_epoch()
 {
@@ -48,6 +50,18 @@ std::optional<int64_t> parse_iso8601_utc(const std::string& text)
 	return static_cast<int64_t>(timegm(&tm));
 }
 
+// A failed commit must not look like a successful one: the caller would go on
+// to act on rows that were rolled out from under it.
+bool commit_or_warn(sqlite::Transaction& transaction, const char* what)
+{
+	if (transaction.commit()) {
+		return true;
+	}
+
+	LOG_ERROR("Could not commit " << what << "; the change was rolled back");
+	return false;
+}
+
 LogDatabase::Entry row_to_entry(const sqlite::Statement& stmt)
 {
 	LogDatabase::Entry entry;
@@ -77,6 +91,8 @@ LogDatabase::LogDatabase(const std::string& db_path, const std::string& logs_dir
 		return;
 	}
 
+	_ok = true;
+
 	import_legacy_databases(db_path);
 	_has_legacy_rows = sqlite::table_exists(_db, "legacy_logs");
 }
@@ -84,7 +100,8 @@ LogDatabase::LogDatabase(const std::string& db_path, const std::string& logs_dir
 LogDatabase::~LogDatabase()
 {
 	if (_db != nullptr) {
-		sqlite3_close(_db);
+		// _v2 so a straggling statement leaks nothing and the handle still closes.
+		sqlite3_close_v2(_db);
 	}
 }
 
@@ -208,8 +225,11 @@ std::vector<int64_t> LogDatabase::sync_index(const std::vector<Discovered>& logs
 		}
 	}
 
-	transaction.commit();
+	if (!commit_or_warn(transaction, "the vehicle index")) {
+		return {};
+	}
 
+	_revision++;
 	return inserted;
 }
 
@@ -240,17 +260,18 @@ void LogDatabase::set_first_index_seen()
 // Intent
 // -------------------------------------------------------------------------
 
-void LogDatabase::request_download(const std::vector<int64_t>& ids, const std::vector<std::string>& targets)
+void LogDatabase::request(const std::vector<int64_t>& ids, const std::vector<std::string>& targets)
 {
 	std::lock_guard<std::mutex> lock(_mutex);
 	sqlite::Transaction transaction(_db);
 
 	for (int64_t id : ids) {
-		// Clearing the failure count gives an explicitly re-requested log a
-		// fresh place in the queue instead of the back of it.
+		// An upload needs the file, so asking for either implies fetching it.
+		// Clearing the failure count gives an explicitly requested log a fresh
+		// place in the queue instead of the back of it.
 		sqlite::Statement stmt(_db,
 				       "UPDATE logs SET download_requested = 1, download_failures = 0, last_error = '' "
-				       "WHERE id = ? AND downloaded = 0");
+				       "WHERE id = ? AND (downloaded = 0 OR local_path = '')");
 		stmt.bind(1, id);
 		stmt.execute();
 
@@ -263,31 +284,9 @@ void LogDatabase::request_download(const std::vector<int64_t>& ids, const std::v
 		}
 	}
 
-	transaction.commit();
-}
-
-void LogDatabase::request_upload(const std::vector<int64_t>& ids, const std::vector<std::string>& targets)
-{
-	std::lock_guard<std::mutex> lock(_mutex);
-	sqlite::Transaction transaction(_db);
-
-	for (int64_t id : ids) {
-		// An upload needs the file, so asking for one implies fetching it.
-		sqlite::Statement stmt(_db,
-				       "UPDATE logs SET download_requested = 1 WHERE id = ? AND downloaded = 0");
-		stmt.bind(1, id);
-		stmt.execute();
-
-		for (const auto& target : targets) {
-			sqlite::Statement upload(_db,
-						 "UPDATE uploads SET requested = 1, rejected = 0 "
-						 "WHERE log_id = ? AND target = ? AND uploaded = 0");
-			upload.bind(1, id).bind(2, target);
-			upload.execute();
-		}
+	if (commit_or_warn(transaction, "request")) {
+		_revision++;
 	}
-
-	transaction.commit();
 }
 
 void LogDatabase::cancel_requests(const std::vector<int64_t>& ids)
@@ -305,7 +304,9 @@ void LogDatabase::cancel_requests(const std::vector<int64_t>& ids)
 		upload.execute();
 	}
 
-	transaction.commit();
+	if (commit_or_warn(transaction, "cancel")) {
+		_revision++;
+	}
 }
 
 // -------------------------------------------------------------------------
@@ -318,7 +319,7 @@ std::vector<LogDatabase::Entry> LogDatabase::logs_to_download() const
 
 	sqlite::Statement stmt(_db,
 			       "SELECT " + kLogColumns + " FROM logs l "
-			       "WHERE l.download_requested = 1 AND l.downloaded = 0 AND l.present = 1 "
+			       "WHERE l.download_requested = 1 AND (l.downloaded = 0 OR l.local_path = '') AND l.present = 1 "
 			       "ORDER BY l.download_failures ASC, " + kNewestFirst);
 
 	std::vector<Entry> entries;
@@ -365,6 +366,7 @@ void LogDatabase::mark_downloaded(int64_t id, const std::string& local_path)
 			       "download_failures = 0, last_error = '' WHERE id = ?");
 	stmt.bind(1, local_path).bind(2, id);
 	stmt.execute();
+	_revision++;
 }
 
 void LogDatabase::record_download_failure(int64_t id, const std::string& error)
@@ -374,6 +376,7 @@ void LogDatabase::record_download_failure(int64_t id, const std::string& error)
 			       "UPDATE logs SET download_failures = download_failures + 1, last_error = ? WHERE id = ?");
 	stmt.bind(1, error).bind(2, id);
 	stmt.execute();
+	_revision++;
 }
 
 void LogDatabase::mark_uploaded(int64_t id, const std::string& target, const std::string& location)
@@ -384,6 +387,7 @@ void LogDatabase::mark_uploaded(int64_t id, const std::string& target, const std
 			       "updated_at = ? WHERE log_id = ? AND target = ?");
 	stmt.bind(1, location).bind(2, now_epoch()).bind(3, id).bind(4, target);
 	stmt.execute();
+	_revision++;
 }
 
 void LogDatabase::mark_upload_rejected(int64_t id, const std::string& target, const std::string& message)
@@ -394,6 +398,7 @@ void LogDatabase::mark_upload_rejected(int64_t id, const std::string& target, co
 			       "WHERE log_id = ? AND target = ?");
 	stmt.bind(1, message).bind(2, now_epoch()).bind(3, id).bind(4, target);
 	stmt.execute();
+	_revision++;
 }
 
 void LogDatabase::record_upload_failure(int64_t id, const std::string& target, const std::string& message)
@@ -403,6 +408,7 @@ void LogDatabase::record_upload_failure(int64_t id, const std::string& target, c
 			       "UPDATE uploads SET message = ?, updated_at = ? WHERE log_id = ? AND target = ?");
 	stmt.bind(1, message).bind(2, now_epoch()).bind(3, id).bind(4, target);
 	stmt.execute();
+	_revision++;
 }
 
 void LogDatabase::clear_local_file(int64_t id)
@@ -412,6 +418,7 @@ void LogDatabase::clear_local_file(int64_t id)
 			       "UPDATE logs SET downloaded = 0, local_path = '', download_requested = 0 WHERE id = ?");
 	stmt.bind(1, id);
 	stmt.execute();
+	_revision++;
 }
 
 // -------------------------------------------------------------------------
@@ -490,6 +497,56 @@ bool LogDatabase::local_path_in_use(const std::string& local_path, int64_t exclu
 	return stmt.step() && stmt.column_int(0) > 0;
 }
 
+std::vector<int64_t> LogDatabase::ids_not_downloaded() const
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+
+	sqlite::Statement stmt(_db,
+			       "SELECT l.id FROM logs l WHERE l.present = 1 AND (l.downloaded = 0 OR l.local_path = '') ORDER BY " + kNewestFirst);
+
+	std::vector<int64_t> ids;
+
+	while (stmt.step()) {
+		ids.push_back(stmt.column_int(0));
+	}
+
+	return ids;
+}
+
+std::vector<int64_t> LogDatabase::ids_not_uploaded(const std::vector<std::string>& targets) const
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	std::vector<int64_t> ids;
+
+	if (targets.empty()) {
+		return ids;
+	}
+
+	std::string placeholders = "?";
+
+	for (size_t i = 1; i < targets.size(); i++) {
+		placeholders += ",?";
+	}
+
+	// Still on the vehicle or already fetched -- either way the file can be had.
+	sqlite::Statement stmt(_db,
+			       "SELECT DISTINCT l.id FROM logs l "
+			       "JOIN uploads u ON u.log_id = l.id "
+			       "WHERE u.target IN (" + placeholders + ") AND u.uploaded = 0 "
+			       "AND (l.downloaded = 1 OR l.present = 1) "
+			       "ORDER BY " + kNewestFirst);
+
+	for (size_t i = 0; i < targets.size(); i++) {
+		stmt.bind(static_cast<int>(i) + 1, targets[i]);
+	}
+
+	while (stmt.step()) {
+		ids.push_back(stmt.column_int(0));
+	}
+
+	return ids;
+}
+
 void LogDatabase::attach_uploads(std::vector<Entry>& entries) const
 {
 	if (entries.empty()) {
diff --git a/src/LogDatabase.hpp b/src/LogDatabase.hpp
index 820b740..b820ce7 100644
--- a/src/LogDatabase.hpp
+++ b/src/LogDatabase.hpp
@@ -1,5 +1,6 @@
 #pragma once
 
+#include <atomic>
 #include <cstdint>
 #include <map>
 #include <mutex>
@@ -64,12 +65,12 @@ class LogDatabase
 	LogDatabase(const LogDatabase&) = delete;
 	LogDatabase& operator=(const LogDatabase&) = delete;
 
-	bool ok() const { return _db != nullptr; }
+	bool ok() const { return _ok; }
 
 	// Index -------------------------------------------------------------
 	// Reconciles the table with a complete vehicle listing: inserts logs not
 	// seen before, and marks every row present or absent. Returns the ids of
-	// the rows this call created, in newest-first order.
+	// the rows this call created, in the order the vehicle listed them.
 	std::vector<int64_t> sync_index(const std::vector<Discovered>& logs);
 
 	// False until the first complete listing has been reconciled. The
@@ -78,10 +79,14 @@ class LogDatabase
 	bool first_index_seen() const;
 	void set_first_index_seen();
 
+	// Bumped by every write. A reader that has already rendered a given
+	// revision knows the log list has not moved since.
+	uint64_t revision() const { return _revision.load(std::memory_order_relaxed); }
+
 	// Intent -------------------------------------------------------------
-	// Queues a download, and an upload to every target named in targets.
-	void request_download(const std::vector<int64_t>& ids, const std::vector<std::string>& targets);
-	void request_upload(const std::vector<int64_t>& ids, const std::vector<std::string>& targets);
+	// Queues these logs: fetched if not already local, then uploaded to each
+	// named target. Pass no targets to fetch without uploading.
+	void request(const std::vector<int64_t>& ids, const std::vector<std::string>& targets);
 	// Clears pending requests. Work already done is left alone.
 	void cancel_requests(const std::vector<int64_t>& ids);
 
@@ -108,6 +113,11 @@ class LogDatabase
 	std::optional<int64_t> newest_log_id(const std::vector<int64_t>& among = {}) const;
 	bool local_path_in_use(const std::string& local_path, int64_t excluding_id) const;
 
+	// Backing for the API's "everything" requests, as queries rather than a
+	// full materialisation of the table filtered in the caller.
+	std::vector<int64_t> ids_not_downloaded() const;
+	std::vector<int64_t> ids_not_uploaded(const std::vector<std::string>& targets) const;
+
 private:
 	bool initialize(const std::string& db_path);
 	bool create_schema();
@@ -122,7 +132,11 @@ class LogDatabase
 	void ensure_upload_rows(int64_t id);
 
 	mutable std::mutex _mutex;
+	std::atomic<uint64_t> _revision {0};
 	sqlite3* _db {nullptr};
+	// Opening the file is not enough: the schema still has to exist, and a
+	// read-only or full data directory fails only at CREATE TABLE.
+	bool _ok {false};
 	std::string _logs_directory;
 	std::vector<std::string> _targets;
 	bool _has_legacy_rows {false};
diff --git a/src/LogLoader.cpp b/src/LogLoader.cpp
index bd7e4dc..03e8961 100644
--- a/src/LogLoader.cpp
+++ b/src/LogLoader.cpp
@@ -81,8 +81,16 @@ void LogLoader::stop()
 	_upload_waiter.stop();
 	_status->shutdown();
 
-	if (_ftp) {
-		_ftp->stop();
+	// connect() may be assigning _ftp on the main thread while the signal
+	// thread is in here.
+	std::shared_ptr<FtpLogFetcher> ftp;
+	{
+		std::lock_guard<std::mutex> lock(_ftp_mutex);
+		ftp = _ftp;
+	}
+
+	if (ftp) {
+		ftp->stop();
 	}
 }
 
@@ -135,14 +143,19 @@ bool LogLoader::connect()
 			.remote_directory = _config.remote_log_directory,
 			.use_burst = _config.use_burst,
 		};
-		_ftp = std::make_shared<FtpLogFetcher>(system.value(), settings);
+		{
+			// Published before reset_sessions, which blocks: a stop arriving
+			// during it has to be able to interrupt it.
+			std::lock_guard<std::mutex> lock(_ftp_mutex);
+			_ftp = std::make_shared<FtpLogFetcher>(system.value(), settings);
+		}
 
 		// PX4 serves one FTP session at a time, so one left open by a run that
 		// was killed mid-transfer blocks every transfer until the vehicle
 		// reboots.
 		_ftp->reset_sessions();
 
-		_status->update([](StatusBoard::Snapshot & snapshot) { snapshot.connected = true; });
+		_status->set_connected(true);
 		return true;
 	}
 
@@ -172,7 +185,7 @@ void LogLoader::index_loop()
 
 		if (is_armed != _was_armed) {
 			_was_armed = is_armed;
-			_status->update([is_armed](StatusBoard::Snapshot & snapshot) { snapshot.armed = is_armed; });
+			_status->set_armed(is_armed);
 
 			if (!is_armed) {
 				// The logger needs a moment to close the file it was writing.
@@ -221,7 +234,7 @@ void LogLoader::index_loop()
 bool LogLoader::refresh_index(std::vector<int64_t>& new_ids, size_t& stable_count)
 {
 	if (!_ftp->refresh()) {
-		_status->update([](StatusBoard::Snapshot & snapshot) { snapshot.ftp_available = false; });
+		_status->set_ftp(false, "");
 		return false;
 	}
 
@@ -243,10 +256,7 @@ bool LogLoader::refresh_index(std::vector<int64_t>& new_ids, size_t& stable_coun
 	new_ids = _database.sync_index(discovered);
 
 	const std::string root = _ftp->root();
-	_status->update([&root](StatusBoard::Snapshot & snapshot) {
-		snapshot.ftp_available = true;
-		snapshot.log_root = root;
-	});
+	_status->set_ftp(true, root);
 
 	LOG_DEBUG("Indexed " << discovered.size() << " logs in " << root
 		  << (growing > 0 ? " (" + std::to_string(growing) + " still being written)" : ""));
@@ -256,46 +266,49 @@ bool LogLoader::refresh_index(std::vector<int64_t>& new_ids, size_t& stable_coun
 
 void LogLoader::apply_auto_policy(const std::vector<int64_t>& new_ids, size_t stable_count)
 {
-	std::vector<std::string> upload_to;
-
-	if (_config.auto_upload) {
-		upload_to = enabled_target_names();
+	// A log only counts once two listings agree on its size, so the very first
+	// listing after startup legitimately reconciles nothing. Calling that the
+	// first index would make the next one -- the vehicle's entire history --
+	// look like logs that appeared while we were watching, which is precisely
+	// the bulk download this policy exists to prevent.
+	if (stable_count == 0) {
+		return;
 	}
 
-	// A database that has never been reconciled cannot tell a log produced by
-	// the flight that just happened from one that has been on the card for a
-	// year. Everything looks new, so almost nothing is fetched.
-	if (!_database.first_index_seen()) {
-		// A log only counts once two listings agree on its size, so the very
-		// first listing after startup legitimately reconciles nothing. Calling
-		// that the first index would make the next one -- the vehicle's entire
-		// history -- look like logs that appeared while we were watching, which
-		// is precisely the bulk download this policy exists to prevent.
-		if (stable_count == 0) {
-			return;
-		}
+	const bool first_index = !_database.first_index_seen();
 
+	if (first_index) {
+		// Recorded even when nothing is queued below, so that turning automatic
+		// fetching on later does not then treat the whole card as new.
 		_database.set_first_index_seen();
+	}
+
+	if (!_config.auto_download) {
+		return;
+	}
 
+	const std::vector<std::string> upload_to =
+		_config.auto_upload ? enabled_target_names() : std::vector<std::string> {};
+
+	if (first_index) {
 		if (!_config.download_latest_on_first_start) {
-			LOG("First index: " << stable_count
-			    << " logs on the vehicle, none queued (download.latest_on_first_start is off)");
+			LOG("First index: " << stable_count << " logs on the vehicle, none queued "
+			    "(download.latest_on_first_start is off)");
 			return;
 		}
 
 		const auto newest = _database.newest_log_id();
 
-		if (!newest.has_value()) {
-			return;
+		if (newest.has_value()) {
+			_database.request({newest.value()}, upload_to);
+			LOG("First index: " << stable_count << " logs on the vehicle, queueing only the newest. "
+			    "Use the ARK-OS Logs page to fetch any of the others.");
 		}
 
-		_database.request_download({newest.value()}, upload_to);
-		LOG("First index: " << stable_count << " logs on the vehicle, queueing only the newest. "
-		    "Use the ARK-OS Logs page to fetch any of the others.");
 		return;
 	}
 
-	if (!_config.auto_download || new_ids.empty()) {
+	if (new_ids.empty()) {
 		return;
 	}
 
@@ -305,7 +318,7 @@ void LogLoader::apply_auto_policy(const std::vector<int64_t>& new_ids, size_t st
 		const auto newest = _database.newest_log_id(new_ids);
 
 		if (newest.has_value()) {
-			_database.request_download({newest.value()}, upload_to);
+			_database.request({newest.value()}, upload_to);
 		}
 
 		LOG_WARN(new_ids.size() << " new logs appeared at once, which looks like a different SD card. "
@@ -313,7 +326,7 @@ void LogLoader::apply_auto_policy(const std::vector<int64_t>& new_ids, size_t st
 		return;
 	}
 
-	_database.request_download(new_ids, upload_to);
+	_database.request(new_ids, upload_to);
 	LOG("Queued " << new_ids.size() << (new_ids.size() == 1 ? " new log" : " new logs"));
 }
 
@@ -330,6 +343,7 @@ void LogLoader::download_pending()
 	}
 
 	size_t index = 0;
+	std::error_code ec;
 
 	for (const auto& entry : pending) {
 		if (_index_waiter.stopped()) {
@@ -353,6 +367,17 @@ void LogLoader::download_pending()
 			continue;
 		}
 
+		// A full data partition otherwise fails every transfer at the final
+		// rename, with nothing in the journal pointing at the cause.
+		const auto space = fs::space(_config.logs_directory, ec);
+
+		if (!ec && space.available < static_cast<uintmax_t>(entry.size_bytes) * 2) {
+			LOG_ERROR("Only " << human_size(static_cast<uint32_t>(space.available)) << " free in "
+				  << _config.logs_directory << "; delete downloaded logs from the ARK-OS Logs "
+				  "page to make room");
+			return;
+		}
+
 		LOG("Downloading " << index << "/" << pending.size() << ": " << entry.path
 		    << " (" << human_size(entry.size_bytes) << ")");
 
@@ -370,17 +395,13 @@ bool LogLoader::download(const LogDatabase::Entry& entry, const FtpLogFetcher::R
 	const std::string local_path = local_path_for(entry);
 	const auto started = std::chrono::steady_clock::now();
 
-	_status->update([&entry](StatusBoard::Snapshot & snapshot) {
-		snapshot.downloading_id = entry.id;
-		snapshot.downloaded_bytes = 0;
-		snapshot.download_total_bytes = entry.size_bytes;
-	});
+	_status->set_download(entry.id, 0, entry.size_bytes);
 
 	// MAVSDK reports progress per chunk, which is far more often than anyone
 	// needs to be told about it.
 	auto last_published = std::make_shared<std::chrono::steady_clock::time_point>(started);
 
-	auto progress = [status = _status, last_published](uint32_t transferred, uint32_t total) {
+	auto progress = [status = _status, last_published, id = entry.id](uint32_t transferred, uint32_t total) {
 		const auto now = std::chrono::steady_clock::now();
 
 		if (now - *last_published < std::chrono::milliseconds(500)) {
@@ -388,19 +409,12 @@ bool LogLoader::download(const LogDatabase::Entry& entry, const FtpLogFetcher::R
 		}
 
 		*last_published = now;
-		status->update([transferred, total](StatusBoard::Snapshot & snapshot) {
-			snapshot.downloaded_bytes = transferred;
-			snapshot.download_total_bytes = total;
-		});
+		status->set_download(id, transferred, total);
 	};
 
 	const bool ok = _ftp->download(remote, local_path, progress);
 
-	_status->update([](StatusBoard::Snapshot & snapshot) {
-		snapshot.downloading_id = 0;
-		snapshot.downloaded_bytes = 0;
-		snapshot.download_total_bytes = 0;
-	});
+	_status->set_download(0, 0, 0);
 
 	if (!ok) {
 		return false;
@@ -495,17 +509,11 @@ void LogLoader::upload_pending(UploadTarget& target)
 			return;
 		}
 
-		_status->update([&entry, &target](StatusBoard::Snapshot & snapshot) {
-			snapshot.uploading_id = entry.id;
-			snapshot.uploading_target = target.name();
-		});
+		_status->set_upload(entry.id, target.name());
 
 		const UploadTarget::Result result = target.upload(entry.local_path);
 
-		_status->update([](StatusBoard::Snapshot & snapshot) {
-			snapshot.uploading_id = 0;
-			snapshot.uploading_target.clear();
-		});
+		_status->set_upload(0, "");
 
 		switch (result.outcome) {
 		case UploadTarget::Outcome::Success:
@@ -515,6 +523,17 @@ void LogLoader::upload_pending(UploadTarget& target)
 			consecutive_retries = 0;
 			break;
 
+		case UploadTarget::Outcome::Missing:
+			// Forgetting the file puts the log back in the download queue, which
+			// is the only way it can ever be uploaded. Marking it rejected here
+			// would strand it: never fetched again, never uploaded again.
+			LOG_WARN(entry.local_path << " is gone; queueing it to be fetched again");
+			_database.clear_local_file(entry.id);
+			_database.request({entry.id}, {target.name()});
+			_index_waiter.wake();
+			consecutive_retries = 0;
+			break;
+
 		case UploadTarget::Outcome::Rejected:
 			// Recorded so it is not offered again; the rest of the queue is
 			// unaffected by one log the server will not take.
diff --git a/src/LogLoader.hpp b/src/LogLoader.hpp
index 0b90924..9a38a48 100644
--- a/src/LogLoader.hpp
+++ b/src/LogLoader.hpp
@@ -1,6 +1,7 @@
 #pragma once
 
 #include <memory>
+#include <mutex>
 #include <string>
 #include <thread>
 #include <vector>
@@ -82,6 +83,9 @@ class LogLoader
 
 	std::shared_ptr<mavsdk::Mavsdk> _mavsdk;
 	std::shared_ptr<mavsdk::Telemetry> _telemetry;
+	// Assigned by connect() on the main thread and read by stop() on the signal
+	// thread, so it is not just a plain member.
+	std::mutex _ftp_mutex;
 	std::shared_ptr<FtpLogFetcher> _ftp;
 
 	Waiter _index_waiter;
diff --git a/src/Sqlite.cpp b/src/Sqlite.cpp
index 94b1b9d..58d9254 100644
--- a/src/Sqlite.cpp
+++ b/src/Sqlite.cpp
@@ -143,13 +143,6 @@ bool table_exists(sqlite3* db, const std::string& table)
 	return stmt.step() && stmt.column_int(0) > 0;
 }
 
-bool column_exists(sqlite3* db, const std::string& table, const std::string& column)
-{
-	Statement stmt(db, "SELECT COUNT(*) FROM pragma_table_info(?) WHERE name = ?");
-	stmt.bind(1, table).bind(2, column);
-	return stmt.step() && stmt.column_int(0) > 0;
-}
-
 Transaction::Transaction(sqlite3* db)
 	: _db(db)
 {
@@ -169,8 +162,14 @@ bool Transaction::commit()
 		return false;
 	}
 
-	_open = false;
-	return execute(_db, "COMMIT");
+	const bool committed = execute(_db, "COMMIT");
+
+	// A COMMIT that fails (a full disk, most plausibly) leaves the transaction
+	// open on the connection. Clearing _open unconditionally would skip the
+	// rollback and wedge every later transaction behind this one.
+	_open = !committed && sqlite3_get_autocommit(_db) == 0;
+
+	return committed;
 }
 
 } // namespace sqlite
diff --git a/src/Sqlite.hpp b/src/Sqlite.hpp
index 9b1ee10..96675fa 100644
--- a/src/Sqlite.hpp
+++ b/src/Sqlite.hpp
@@ -50,7 +50,6 @@ class Statement
 bool execute(sqlite3* db, const std::string& sql);
 
 bool table_exists(sqlite3* db, const std::string& table);
-bool column_exists(sqlite3* db, const std::string& table, const std::string& column);
 
 // Rolls back unless commit() is called, so an early return cannot leave a
 // half-applied multi-statement change behind.
diff --git a/src/StatusBoard.cpp b/src/StatusBoard.cpp
index 1508a20..bd477a9 100644
--- a/src/StatusBoard.cpp
+++ b/src/StatusBoard.cpp
@@ -6,17 +6,58 @@ StatusBoard::Snapshot StatusBoard::get() const
 	return _snapshot;
 }
 
-void StatusBoard::update(const std::function<void(Snapshot&)>& mutate)
+// Callers hold _mutex.
+void StatusBoard::bump()
 {
-	{
-		std::lock_guard<std::mutex> lock(_mutex);
-		mutate(_snapshot);
-		_snapshot.revision++;
-	}
-
+	_snapshot.revision++;
 	_cv.notify_all();
 }
 
+void StatusBoard::set_connected(bool connected)
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	_snapshot.connected = connected;
+	bump();
+}
+
+void StatusBoard::set_armed(bool armed)
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	_snapshot.armed = armed;
+	bump();
+}
+
+void StatusBoard::set_ftp(bool available, const std::string& log_root)
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	_snapshot.ftp_available = available;
+	_snapshot.log_root = log_root;
+	bump();
+}
+
+void StatusBoard::set_download(int64_t id, uint32_t transferred, uint32_t total)
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	_snapshot.downloading_id = id;
+	_snapshot.downloaded_bytes = transferred;
+	_snapshot.download_total_bytes = total;
+	bump();
+}
+
+void StatusBoard::set_upload(int64_t id, const std::string& target)
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	_snapshot.uploading_id = id;
+	_snapshot.uploading_target = target;
+	bump();
+}
+
+void StatusBoard::notify()
+{
+	std::lock_guard<std::mutex> lock(_mutex);
+	bump();
+}
+
 StatusBoard::Snapshot StatusBoard::wait_for_change(uint64_t known_revision,
 		std::chrono::milliseconds timeout) const
 {
diff --git a/src/StatusBoard.hpp b/src/StatusBoard.hpp
index 4360570..0cf0c7f 100644
--- a/src/StatusBoard.hpp
+++ b/src/StatusBoard.hpp
@@ -3,17 +3,17 @@
 #include <chrono>
 #include <condition_variable>
 #include <cstdint>
-#include <functional>
 #include <mutex>
 #include <string>
 
 // What logloader is doing right now, shared between the worker loops that write
 // it and the API server that streams it out.
 //
+// Progress during a transfer is the one thing the database does not hold: it
+// changes several times a second and is worthless after a restart.
+//
 // Every change bumps a revision, so a reader can block until something actually
-// happened instead of polling. Progress during a transfer is the one thing the
-// database does not hold: it changes many times a second and is worthless after
-// a restart.
+// happened instead of polling.
 class StatusBoard
 {
 public:
@@ -31,14 +31,20 @@ class StatusBoard
 		int64_t uploading_id {0};
 		std::string uploading_target;
 
-		// Bumped on every change; a reader compares against what it last saw.
 		uint64_t revision {0};
 	};
 
 	Snapshot get() const;
 
-	// Applies mutate under the lock, then bumps the revision and wakes readers.
-	void update(const std::function<void(Snapshot&)>& mutate);
+	void set_connected(bool connected);
+	void set_armed(bool armed);
+	void set_ftp(bool available, const std::string& log_root);
+	void set_download(int64_t id, uint32_t transferred, uint32_t total);
+	void set_upload(int64_t id, const std::string& target);
+
+	// Wakes readers without changing anything, for a caller that has just
+	// written to the database and wants the change streamed out now.
+	void notify();
 
 	// Blocks until the revision moves past known_revision or the timeout
 	// expires, then returns the current snapshot either way.
@@ -49,6 +55,8 @@ class StatusBoard
 	bool stopped() const;
 
 private:
+	void bump();
+
 	mutable std::mutex _mutex;
 	mutable std::condition_variable _cv;
 	Snapshot _snapshot;
diff --git a/src/UploadTarget.cpp b/src/UploadTarget.cpp
index 832d962..a6b008a 100644
--- a/src/UploadTarget.cpp
+++ b/src/UploadTarget.cpp
@@ -1,9 +1,11 @@
 #include "UploadTarget.hpp"
 #include "Log.hpp"
 
+#include <algorithm>
 #include <filesystem>
 #include <fstream>
 #include <memory>
+#include <vector>
 
 // CPPHTTPLIB_OPENSSL_SUPPORT is set for the whole target in CMakeLists.txt.
 // Defining it per-file would give translation units different definitions of
@@ -94,31 +96,30 @@ UploadTarget::Result UploadTarget::upload(const std::string& file_path)
 	std::error_code ec;
 
 	if (!fs::exists(file_path, ec)) {
-		return {Outcome::Rejected, 0, "local file is missing: " + file_path, ""};
+		return {Outcome::Missing, 0, "local file is missing: " + file_path, ""};
 	}
 
 	const auto size = fs::file_size(file_path, ec);
 
 	if (ec || size == 0) {
-		return {Outcome::Rejected, 0, "local file is empty: " + file_path, ""};
+		return {Outcome::Missing, 0, "local file is empty: " + file_path, ""};
 	}
 
 	if (!reachable()) {
 		return {Outcome::Unreachable, 0, "server unreachable", ""};
 	}
 
-	std::ifstream file(file_path, std::ios::binary);
+	auto file = std::make_shared<std::ifstream>(file_path, std::ios::binary);
 
-	if (!file) {
-		return {Outcome::Rejected, 0, "cannot open local file: " + file_path, ""};
+	if (!*file) {
+		return {Outcome::Missing, 0, "cannot open local file: " + file_path, ""};
 	}
 
 	const std::string name = fs::path(file_path).filename().string();
-	std::string content((std::istreambuf_iterator<char>(file)), std::istreambuf_iterator<char>());
 
 	// Flight Review reads every one of these fields off the form; the ones it
 	// does not use for an automated upload still have to be present.
-	httplib::MultipartFormDataItems items = {
+	const httplib::MultipartFormDataItems fields = {
 		{"type", _config.public_logs ? "flightreport" : "personal", "", ""},
 		{"description", "Uploaded by logloader", "", ""},
 		{"feedback", "", "", ""},
@@ -128,9 +129,23 @@ UploadTarget::Result UploadTarget::upload(const std::string& file_path)
 		{"rating", "", "", ""},
 		{"windSpeed", "", "", ""},
 		{"public", _config.public_logs ? "true" : "false", "", ""},
-		{"filearg", std::move(content), name, "application/octet-stream"},
 	};
 
+	// The log is streamed off disk rather than assembled in memory. httplib's
+	// MultipartFormDataItems overload builds the whole body as a std::string
+	// first, so a 400 MB ArduPilot log would need the better part of a gigabyte
+	// on a companion computer that does not have it.
+	const std::string boundary = httplib::detail::make_multipart_data_boundary();
+	const std::string content_type = httplib::detail::serialize_multipart_formdata_get_content_type(boundary);
+
+	const httplib::MultipartFormData log_part {"filearg", "", name, "application/octet-stream"};
+	const std::string prologue = httplib::detail::serialize_multipart_formdata(fields, boundary, false)
+				     + httplib::detail::serialize_multipart_formdata_item_begin(log_part, boundary);
+	const std::string epilogue = httplib::detail::serialize_multipart_formdata_item_end()
+				     + httplib::detail::serialize_multipart_formdata_finish(boundary);
+
+	const size_t body_size = prologue.size() + size + epilogue.size();
+
 	httplib::Headers headers;
 	const bool use_api_key = !_config.api_key.empty();
 
@@ -148,7 +163,36 @@ UploadTarget::Result UploadTarget::upload(const std::string& file_path)
 	client.set_write_timeout(300, 0);
 	client.set_follow_location(false);
 
-	const httplib::Result response = client.Post("/upload", headers, items);
+	// Content-Length is known up front, so this stays a plain request rather
+	// than a chunked one -- Flight Review's multipart reader wants the length.
+	auto provider = [prologue, epilogue, file, size](size_t offset, size_t, httplib::DataSink & sink) {
+		constexpr size_t kChunk = 64 * 1024;
+
+		if (offset < prologue.size()) {
+			const size_t n = std::min(kChunk, prologue.size() - offset);
+			return sink.write(prologue.data() + offset, n);
+		}
+
+		const size_t in_file = offset - prologue.size();
+
+		if (in_file < size) {
+			const size_t n = std::min(kChunk, static_cast<size_t>(size) - in_file);
+			std::vector<char> buffer(n);
+			file->seekg(static_cast<std::streamoff>(in_file));
+
+			if (!file->read(buffer.data(), static_cast<std::streamsize>(n))) {
+				return false;
+			}
+
+			return sink.write(buffer.data(), n);
+		}
+
+		const size_t in_epilogue = in_file - size;
+		return sink.write(epilogue.data() + in_epilogue, epilogue.size() - in_epilogue);
+	};
+
+	const httplib::Result response = client.Post("/upload", headers, body_size, provider, content_type);
+
 
 	if (!response) {
 		// The connection died mid-transfer; the server may or may not have the
diff --git a/src/UploadTarget.hpp b/src/UploadTarget.hpp
index e2c9a35..d066623 100644
--- a/src/UploadTarget.hpp
+++ b/src/UploadTarget.hpp
@@ -13,6 +13,9 @@ class UploadTarget
 public:
 	enum class Outcome {
 		Success,
+		// The local copy is gone or empty. Nothing is wrong with the log itself,
+		// so the caller should fetch it again rather than give up on it.
+		Missing,
 		// The server will not take this log however often it is asked.
 		Rejected,
 		// The account is not authorized (yet). The log is fine; every other
diff --git a/src/main.cpp b/src/main.cpp
index 285861f..de96df4 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -98,7 +98,7 @@ int main(int argc, char** argv)
 		return 1;
 	}
 
-	ApiServer api(config, loader);
+	ApiServer api({config.api_bind, config.api_port}, loader);
 
 	// Serve before connecting, so the UI can say the vehicle is not there yet
 	// rather than failing to load at all.

From 07af3778baa8668b07ccb41a4117cdcfc0c4c831 Mon Sep 17 00:00:00 2001
From: Jacob Dahl <dahl.jakejacob@gmail.com>
Date: Tue, 28 Jul 2026 12:14:35 -0600
Subject: [PATCH 6/8] refactor(logloader): quarantine the upgrade path and
 cover the database with tests

The pre-FTP migration was 28% of LogDatabase and the one thing in it that was
not a repository: an extra table, a fuzzy timestamp heuristic, a reconstruction
of the old file-naming scheme, a member, a constructor parameter and a branch
inside sync_index. It moves to LegacyImport, whose header says plainly that the
file is deletable once the fleet has upgraded. LogDatabase drops from 796 lines
to 560 and is now only a repository.

sync_index returns a SyncResult (what it inserted, how many are present, and
whether this was the first listing with anything in it) instead of writing two
out-parameters and leaving the caller to own the "first index" invariant. The
subtlety -- that the first listing after startup legitimately reconciles
nothing, because stability takes two listings to establish -- now lives in the
one function that can see it. apply_auto_policy is two obvious halves.

Adds tests/test_log_database.cpp: 14 cases over the first-index rule, present/
absent transitions, a growing log, request and cancel, the download-with-no-file
recovery, rejected uploads not blocking the queue, failure ordering, ArduPilot
name reuse, and four covering the legacy import -- which runs once against real
user data and cannot be un-run, so it is the thing least testable any other way.
Plus a GitHub Actions workflow that builds, tests and checks formatting.

Writing the tests turned up a real defect: ordering fell back to discovered_at,
a one-second wall clock, to decide which ArduPilot log is newest once the
counter wraps at LOG_MAX_FILES. Two listings in the same second were
indistinguishable, and on a companion with no RTC the clock can run backwards.
Replaced with a monotonic discovery sequence.

Also: ATTACH is now RAII, so a failed import cannot leave the old database
attached and wedge the next one; the legacy adopt path no longer produces a row
claiming to be downloaded with no file behind it; and equidistant timestamp
candidates leave the claim with the first rather than the last.
---
 .github/workflows/build.yml |  40 +++
 CMakeLists.txt              |  19 ++
 Makefile                    |   3 +-
 src/LegacyImport.cpp        | 277 +++++++++++++++++++++
 src/LegacyImport.hpp        |  44 ++++
 src/LogDatabase.cpp         | 315 ++++--------------------
 src/LogDatabase.hpp         |  34 ++-
 src/LogLoader.cpp           |  55 ++---
 src/LogLoader.hpp           |   5 +-
 tests/test_log_database.cpp | 467 ++++++++++++++++++++++++++++++++++++
 10 files changed, 933 insertions(+), 326 deletions(-)
 create mode 100644 .github/workflows/build.yml
 create mode 100644 src/LegacyImport.cpp
 create mode 100644 src/LegacyImport.hpp
 create mode 100644 tests/test_log_database.cpp

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..1befa2b
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,40 @@
+name: build
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+    env:
+      MAVSDK_VERSION: 3.17.1
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Install dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libsqlite3-dev libssl-dev
+          curl -sL -o mavsdk.deb \
+            "https://github.com/mavlink/MAVSDK/releases/download/v${MAVSDK_VERSION}/libmavsdk-dev_${MAVSDK_VERSION}_ubuntu24.04_amd64.deb"
+          sudo dpkg -i mavsdk.deb
+
+      - name: Configure
+        run: cmake -B build -S . -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=ON
+
+      - name: Build
+        run: cmake --build build -j"$(nproc)"
+
+      - name: Test
+        run: ctest --test-dir build --output-on-failure
+
+  format:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - run: sudo apt-get update && sudo apt-get install -y astyle
+      - run: make check-format
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 31344c5..7c36215 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -30,6 +30,7 @@ add_executable(${PROJECT_NAME}
     src/Config.cpp
     src/FtpListClient.cpp
     src/FtpLogFetcher.cpp
+    src/LegacyImport.cpp
     src/Log.cpp
     src/LogDatabase.cpp
     src/LogLoader.cpp
@@ -54,3 +55,21 @@ target_link_libraries(${PROJECT_NAME}
     OpenSSL::Crypto
     MAVSDK::mavsdk
     ${SQLite3_LIBRARIES})
+
+# The database is the one module worth testing without a vehicle: it holds every
+# decision logloader makes, and the legacy import runs once against real user
+# data and cannot be un-run.
+option(BUILD_TESTING "Build the tests" OFF)
+if(BUILD_TESTING)
+    enable_testing()
+    add_executable(test_log_database
+        tests/test_log_database.cpp
+        src/LegacyImport.cpp
+        src/Log.cpp
+        src/LogDatabase.cpp
+        src/Sqlite.cpp)
+    target_include_directories(test_log_database PRIVATE src)
+    target_include_directories(test_log_database SYSTEM PRIVATE ${SQLite3_INCLUDE_DIRS})
+    target_link_libraries(test_log_database Threads::Threads ${SQLite3_LIBRARIES})
+    add_test(NAME log_database COMMAND test_log_database)
+endif()
diff --git a/Makefile b/Makefile
index 88efb4f..a4afc37 100644
--- a/Makefile
+++ b/Makefile
@@ -12,9 +12,10 @@ debug:
 # run from a read-only checkout and makes the build non-reproducible.
 format:
 	@astyle --quiet --options=astylerc src/*.cpp,*.hpp
+	@astyle --quiet --options=astylerc "tests/*.cpp,*.hpp"
 
 check-format:
-	@astyle --dry-run --formatted --options=astylerc src/*.cpp,*.hpp | grep Formatted \
+	@{ astyle --dry-run --formatted --options=astylerc src/*.cpp,*.hpp; astyle --dry-run --formatted --options=astylerc "tests/*.cpp,*.hpp"; } | grep Formatted \
 		&& { echo "run 'make format'"; exit 1; } || echo "formatting OK"
 
 install:
diff --git a/src/LegacyImport.cpp b/src/LegacyImport.cpp
new file mode 100644
index 0000000..1890104
--- /dev/null
+++ b/src/LegacyImport.cpp
@@ -0,0 +1,277 @@
+#include "LegacyImport.hpp"
+#include "Log.hpp"
+#include "Sqlite.hpp"
+
+#include <cstdio>
+#include <cstdlib>
+#include <ctime>
+#include <filesystem>
+#include <iomanip>
+#include <sstream>
+
+namespace fs = std::filesystem;
+
+namespace legacy
+{
+
+namespace
+{
+
+std::optional<int64_t> parse_iso8601_utc(const std::string& text)
+{
+	std::tm tm {};
+
+	if (sscanf(text.c_str(), "%4d-%2d-%2dT%2d:%2d:%2dZ",
+		   &tm.tm_year, &tm.tm_mon, &tm.tm_mday, &tm.tm_hour, &tm.tm_min, &tm.tm_sec) != 6) {
+		return std::nullopt;
+	}
+
+	tm.tm_year -= 1900;
+	tm.tm_mon -= 1;
+
+	return static_cast<int64_t>(timegm(&tm));
+}
+
+// A second database stays attached on any path that forgets to detach, and the
+// next ATTACH then fails with "already in use".
+class Attached
+{
+public:
+	Attached(sqlite3* db, const std::string& file)
+		: _db(db)
+	{
+		sqlite::Statement attach(_db, "ATTACH DATABASE ? AS legacy");
+		attach.bind(1, file);
+		_attached = attach.execute();
+	}
+
+	~Attached()
+	{
+		if (_attached) {
+			sqlite::execute(_db, "DETACH DATABASE legacy");
+		}
+	}
+
+	Attached(const Attached&) = delete;
+	Attached& operator=(const Attached&) = delete;
+
+	explicit operator bool() const { return _attached; }
+
+private:
+	sqlite3* _db {nullptr};
+	bool _attached {false};
+};
+
+struct Candidate {
+	std::string uuid;
+	int64_t legacy_id {0};
+	std::string date;
+	bool downloaded {false};
+	bool uploaded {false};
+	bool rejected {false};
+};
+
+} // namespace
+
+Importer::Importer(sqlite3* db, const std::string& db_path, const std::string& logs_directory,
+		   const std::vector<std::string>& targets)
+	: _db(db)
+	, _logs_directory(logs_directory)
+	, _targets(targets)
+{
+	const fs::path directory = fs::path(db_path).parent_path();
+
+	// The old database file names, and which target each one's upload state
+	// belongs to.
+	const std::pair<const char*, const char*> sources[] = {
+		{"local_server.db", "local"},
+		{"remote_server.db", "remote"},
+	};
+
+	for (const auto& [file, target] : sources) {
+		const fs::path source = directory / file;
+
+		if (fs::exists(source)) {
+			import_one(source.string(), target);
+		}
+	}
+
+	_has_rows = sqlite::table_exists(_db, "legacy_logs");
+}
+
+void Importer::import_one(const std::string& file, const std::string& target)
+{
+	// Importing twice would resurrect rows the operator has since dealt with.
+	{
+		sqlite::Statement seen(_db, "SELECT value FROM meta WHERE key = ?");
+		seen.bind(1, "imported_" + target);
+
+		if (seen.step()) {
+			return;
+		}
+	}
+
+	sqlite::execute(_db,
+			"CREATE TABLE IF NOT EXISTS legacy_logs ("
+			"  target     TEXT    NOT NULL,"
+			"  uuid       TEXT    NOT NULL,"
+			"  legacy_id  INTEGER NOT NULL DEFAULT 0,"
+			"  date       TEXT    NOT NULL DEFAULT '',"
+			"  size_bytes INTEGER NOT NULL DEFAULT 0,"
+			"  downloaded INTEGER NOT NULL DEFAULT 0,"
+			"  uploaded   INTEGER NOT NULL DEFAULT 0,"
+			"  rejected   INTEGER NOT NULL DEFAULT 0,"
+			"  matched    INTEGER NOT NULL DEFAULT 0,"
+			"  PRIMARY KEY (target, uuid))");
+
+	const Attached legacy_db(_db, file);
+
+	if (!legacy_db) {
+		LOG_WARN("Could not read the previous database " << file);
+		return;
+	}
+
+	// Only the pre-FTP schema is ever imported: it is the one whose state this
+	// class cannot otherwise reconstruct.
+	sqlite::Statement shape(_db, "SELECT COUNT(*) FROM pragma_table_info('logs', 'legacy') WHERE name = 'id'");
+
+	if (!shape.step() || shape.column_int(0) == 0) {
+		LOG_DEBUG("Previous database " << file << " has no pre-FTP log table, nothing to import");
+		return;
+	}
+
+	int imported = 0;
+	sqlite::Transaction transaction(_db);
+
+	{
+		sqlite::Statement read(_db, "SELECT uuid, id, date, size_bytes, downloaded, uploaded FROM legacy.logs");
+
+		while (read.step()) {
+			sqlite::Statement row(_db,
+					      "INSERT OR IGNORE INTO legacy_logs "
+					      "(target, uuid, legacy_id, date, size_bytes, downloaded, uploaded, rejected) "
+					      "VALUES (?, ?, ?, ?, ?, ?, ?, 0)");
+			row.bind(1, target)
+			.bind(2, read.column_text(0))
+			.bind(3, read.column_int(1))
+			.bind(4, read.column_text(2))
+			.bind(5, read.column_int(3))
+			.bind(6, read.column_int(4))
+			.bind(7, read.column_int(5));
+			row.execute();
+			imported++;
+		}
+	}
+
+	sqlite::Statement blacklist(_db,
+				    "UPDATE legacy_logs SET rejected = 1 "
+				    "WHERE target = ? AND uuid IN (SELECT uuid FROM legacy.blacklist)");
+	blacklist.bind(1, target);
+	blacklist.execute();
+
+	sqlite::Statement mark(_db, "INSERT OR REPLACE INTO meta (key, value) VALUES (?, '1')");
+	mark.bind(1, "imported_" + target);
+	mark.execute();
+
+	if (!transaction.commit()) {
+		LOG_WARN("Could not import " << file << "; it will be retried on the next start");
+		return;
+	}
+
+	if (imported > 0) {
+		LOG("Carried over " << imported << " log records from the previous " << target << " database");
+	}
+}
+
+void Importer::adopt(int64_t log_id, uint32_t size_bytes, std::optional<int64_t> time_utc, const std::string& path)
+{
+	for (const auto& target : _targets) {
+		std::vector<Candidate> candidates;
+
+		{
+			sqlite::Statement stmt(_db,
+					       "SELECT uuid, legacy_id, date, downloaded, uploaded, rejected FROM legacy_logs "
+					       "WHERE target = ? AND matched = 0 AND size_bytes = ?");
+			stmt.bind(1, target).bind(2, static_cast<int64_t>(size_bytes));
+
+			while (stmt.step()) {
+				Candidate candidate;
+				candidate.uuid = stmt.column_text(0);
+				candidate.legacy_id = stmt.column_int(1);
+				candidate.date = stmt.column_text(2);
+				candidate.downloaded = stmt.column_int(3) != 0;
+				candidate.uploaded = stmt.column_int(4) != 0;
+				candidate.rejected = stmt.column_int(5) != 0;
+				candidates.push_back(candidate);
+			}
+		}
+
+		if (candidates.empty()) {
+			continue;
+		}
+
+		// The old database recorded the log's modification time; the FTP index
+		// reports either that or the start time in the path, so the same log is
+		// at most a flight apart. With no time to compare, only a single
+		// unambiguous candidate is safe to claim.
+		const Candidate* match = nullptr;
+
+		if (time_utc.has_value()) {
+			constexpr int64_t kMaxDelta = 48 * 3600;
+			int64_t best = kMaxDelta;
+
+			for (const auto& candidate : candidates) {
+				const auto legacy_time = parse_iso8601_utc(candidate.date);
+
+				if (!legacy_time.has_value()) {
+					continue;
+				}
+
+				const int64_t delta = std::abs(legacy_time.value() - time_utc.value());
+
+				// Strictly better, so several equidistant candidates leave
+				// the first one holding the claim rather than the last.
+				if (delta < best) {
+					best = delta;
+					match = &candidate;
+				}
+			}
+
+		} else if (candidates.size() == 1) {
+			match = &candidates.front();
+		}
+
+		if (match == nullptr) {
+			continue;
+		}
+
+		// The name the old download used, so a log already on disk is not
+		// fetched a second time.
+		std::ostringstream legacy_name;
+		legacy_name << _logs_directory << "LOG" << std::setfill('0') << std::setw(4)
+			    << match->legacy_id << "_" << match->date << ".ulg";
+
+		const std::string legacy_path = legacy_name.str();
+		const bool file_exists = fs::exists(legacy_path);
+
+		if (match->downloaded && file_exists) {
+			sqlite::Statement update(_db,
+						 "UPDATE logs SET downloaded = 1, local_path = ? WHERE id = ? AND downloaded = 0");
+			update.bind(1, legacy_path).bind(2, log_id);
+			update.execute();
+		}
+
+		sqlite::Statement upload(_db,
+					 "UPDATE uploads SET uploaded = ?, rejected = ? WHERE log_id = ? AND target = ?");
+		upload.bind(1, match->uploaded).bind(2, match->rejected).bind(3, log_id).bind(4, target);
+		upload.execute();
+
+		sqlite::Statement mark(_db, "UPDATE legacy_logs SET matched = 1 WHERE target = ? AND uuid = ?");
+		mark.bind(1, target).bind(2, match->uuid);
+		mark.execute();
+
+		LOG_DEBUG("Carried over " << target << " state for " << path << " from the previous database");
+	}
+}
+
+} // namespace legacy
diff --git a/src/LegacyImport.hpp b/src/LegacyImport.hpp
new file mode 100644
index 0000000..b212b59
--- /dev/null
+++ b/src/LegacyImport.hpp
@@ -0,0 +1,44 @@
+#pragma once
+
+#include <cstdint>
+#include <optional>
+#include <string>
+#include <vector>
+
+#include <sqlite3.h>
+
+// Carries state over from the pre-FTP logloader, which kept one database per
+// server and identified a log by the index and timestamp LOG_ENTRY reported.
+// MAVLink FTP cannot reproduce either, so the old rows are set aside and
+// matched to the listing by size as it comes in.
+//
+// This exists only while a fleet upgrades. Once every device has run a version
+// containing it, delete the file: nothing else depends on it.
+namespace legacy
+{
+
+class Importer
+{
+public:
+	// Folds local_server.db and remote_server.db, if they are next to db_path,
+	// into a legacy_logs table in db. Doing nothing is the normal case.
+	Importer(sqlite3* db, const std::string& db_path, const std::string& logs_directory,
+		 const std::vector<std::string>& targets);
+
+	// False when there is nothing left to match, which is the steady state.
+	bool has_rows() const { return _has_rows; }
+
+	// Claims the state of a matching old row for a log just inserted. The
+	// caller holds the database lock and is inside its transaction.
+	void adopt(int64_t log_id, uint32_t size_bytes, std::optional<int64_t> time_utc, const std::string& path);
+
+private:
+	void import_one(const std::string& file, const std::string& target);
+
+	sqlite3* _db {nullptr};
+	std::string _logs_directory;
+	std::vector<std::string> _targets;
+	bool _has_rows {false};
+};
+
+} // namespace legacy
diff --git a/src/LogDatabase.cpp b/src/LogDatabase.cpp
index 8494908..248e8bc 100644
--- a/src/LogDatabase.cpp
+++ b/src/LogDatabase.cpp
@@ -1,17 +1,10 @@
 #include "LogDatabase.hpp"
-#include "Config.hpp"
+#include "LegacyImport.hpp"
 #include "Log.hpp"
 #include "Sqlite.hpp"
 
 #include <algorithm>
-#include <cstdio>
-#include <cstdlib>
 #include <ctime>
-#include <filesystem>
-#include <iomanip>
-#include <sstream>
-
-namespace fs = std::filesystem;
 
 namespace
 {
@@ -24,32 +17,18 @@ const std::string kLogColumns =
 
 // Newest first. Logs whose time the vehicle cannot report sort after the ones
 // it can; among those, a log we watched appear is newer than one that was
-// already there. The name is the last resort: ArduPilot numbers logs, so the
-// longer name is the later one (100.BIN after 99.BIN) -- until the counter
-// wraps at LOG_MAX_FILES, which is exactly why discovered_at comes first.
+// already on the card. Only within a single listing, where there is no
+// discovery order to go on, does the name decide: ArduPilot numbers its logs,
+// so the longer name is the later one (100.BIN after 99.BIN) -- right up until
+// the counter wraps at LOG_MAX_FILES, which is why it is the last resort.
 const std::string kNewestFirst =
-	"(l.time_utc IS NULL) ASC, l.time_utc DESC, l.discovered_at DESC, LENGTH(l.path) DESC, l.path DESC";
+	"(l.time_utc IS NULL) ASC, l.time_utc DESC, l.discovered_seq DESC, LENGTH(l.path) DESC, l.path DESC";
 
 int64_t now_epoch()
 {
 	return static_cast<int64_t>(std::time(nullptr));
 }
 
-std::optional<int64_t> parse_iso8601_utc(const std::string& text)
-{
-	std::tm tm {};
-
-	if (sscanf(text.c_str(), "%4d-%2d-%2dT%2d:%2d:%2dZ",
-		   &tm.tm_year, &tm.tm_mon, &tm.tm_mday, &tm.tm_hour, &tm.tm_min, &tm.tm_sec) != 6) {
-		return std::nullopt;
-	}
-
-	tm.tm_year -= 1900;
-	tm.tm_mon -= 1;
-
-	return static_cast<int64_t>(timegm(&tm));
-}
-
 // A failed commit must not look like a successful one: the caller would go on
 // to act on rows that were rolled out from under it.
 bool commit_or_warn(sqlite::Transaction& transaction, const char* what)
@@ -83,18 +62,15 @@ LogDatabase::Entry row_to_entry(const sqlite::Statement& stmt)
 
 LogDatabase::LogDatabase(const std::string& db_path, const std::string& logs_directory,
 			 const std::vector<std::string>& targets)
-	: _logs_directory(logs_directory)
-	, _targets(targets)
+	: _targets(targets)
 {
 	if (!initialize(db_path)) {
 		LOG_ERROR("Could not open the log database at " << db_path);
 		return;
 	}
 
+	_legacy = std::make_unique<legacy::Importer>(_db, db_path, logs_directory, _targets);
 	_ok = true;
-
-	import_legacy_databases(db_path);
-	_has_legacy_rows = sqlite::table_exists(_db, "legacy_logs");
 }
 
 LogDatabase::~LogDatabase()
@@ -137,6 +113,7 @@ bool LogDatabase::create_schema()
 					  "  download_failures  INTEGER NOT NULL DEFAULT 0,"
 					  "  last_error         TEXT    NOT NULL DEFAULT '',"
 					  "  discovered_at      INTEGER NOT NULL DEFAULT 0,"
+					  "  discovered_seq     INTEGER NOT NULL DEFAULT 0,"
 					  "  UNIQUE (path, size_bytes))");
 
 	const bool uploads = sqlite::execute(_db,
@@ -163,10 +140,11 @@ bool LogDatabase::create_schema()
 // Index
 // -------------------------------------------------------------------------
 
-std::vector<int64_t> LogDatabase::sync_index(const std::vector<Discovered>& logs)
+LogDatabase::SyncResult LogDatabase::sync_index(const std::vector<Discovered>& logs)
 {
 	std::lock_guard<std::mutex> lock(_mutex);
-	std::vector<int64_t> inserted;
+	SyncResult result;
+	result.present_count = logs.size();
 
 	sqlite::Transaction transaction(_db);
 
@@ -176,18 +154,32 @@ std::vector<int64_t> LogDatabase::sync_index(const std::vector<Discovered>& logs
 
 	const int64_t discovered_at = now_epoch();
 
+	// A wall clock at one-second resolution cannot separate two listings, and
+	// on a companion with no RTC it can run backwards. The sequence can do
+	// neither.
+	int64_t discovered_seq = 1;
+	{
+		sqlite::Statement stmt(_db, "SELECT COALESCE(MAX(discovered_seq), 0) + 1 FROM logs");
+
+		if (stmt.step()) {
+			discovered_seq = stmt.column_int(0);
+		}
+	}
+
 	for (const auto& log : logs) {
 		int64_t id = 0;
 		bool is_new = false;
 
 		{
 			sqlite::Statement insert(_db,
-						 "INSERT OR IGNORE INTO logs (path, size_bytes, time_utc, discovered_at) "
-						 "VALUES (?, ?, ?, ?)");
+						 "INSERT OR IGNORE INTO logs "
+						 "(path, size_bytes, time_utc, discovered_at, discovered_seq) "
+						 "VALUES (?, ?, ?, ?, ?)");
 			insert.bind(1, log.path)
 			.bind(2, static_cast<int64_t>(log.size_bytes))
 			.bind(3, log.time_utc)
-			.bind(4, discovered_at);
+			.bind(4, discovered_at)
+			.bind(5, discovered_seq);
 			insert.execute();
 
 			if (sqlite3_changes(_db) > 0) {
@@ -217,11 +209,26 @@ std::vector<int64_t> LogDatabase::sync_index(const std::vector<Discovered>& logs
 		if (is_new) {
 			ensure_upload_rows(id);
 
-			if (_has_legacy_rows) {
-				grandfather(id, log);
+			if (_legacy->has_rows()) {
+				_legacy->adopt(id, log.size_bytes, log.time_utc, log.path);
 			}
 
-			inserted.push_back(id);
+			result.inserted.push_back(id);
+		}
+	}
+
+	// A log only counts once two listings agree on its size, so the first
+	// listing after startup reconciles nothing. Recording that as the first
+	// index would make the next one -- the vehicle's whole history -- look like
+	// logs that appeared while we were watching.
+	if (!logs.empty()) {
+		sqlite::Statement seen(_db, "SELECT value FROM meta WHERE key = 'first_index_seen'");
+		result.first_ever = !seen.step();
+
+		if (result.first_ever) {
+			sqlite::Statement mark(_db,
+					       "INSERT OR REPLACE INTO meta (key, value) VALUES ('first_index_seen', '1')");
+			mark.execute();
 		}
 	}
 
@@ -230,7 +237,7 @@ std::vector<int64_t> LogDatabase::sync_index(const std::vector<Discovered>& logs
 	}
 
 	_revision++;
-	return inserted;
+	return result;
 }
 
 void LogDatabase::ensure_upload_rows(int64_t id)
@@ -242,20 +249,6 @@ void LogDatabase::ensure_upload_rows(int64_t id)
 	}
 }
 
-bool LogDatabase::first_index_seen() const
-{
-	std::lock_guard<std::mutex> lock(_mutex);
-	sqlite::Statement stmt(_db, "SELECT value FROM meta WHERE key = 'first_index_seen'");
-	return stmt.step() && stmt.column_text(0) == "1";
-}
-
-void LogDatabase::set_first_index_seen()
-{
-	std::lock_guard<std::mutex> lock(_mutex);
-	sqlite::Statement stmt(_db, "INSERT OR REPLACE INTO meta (key, value) VALUES ('first_index_seen', '1')");
-	stmt.execute();
-}
-
 // -------------------------------------------------------------------------
 // Intent
 // -------------------------------------------------------------------------
@@ -582,215 +575,3 @@ void LogDatabase::attach_uploads(std::vector<Entry>& entries) const
 		it->second->uploads[stmt.column_text(1)] = state;
 	}
 }
-
-// -------------------------------------------------------------------------
-// Migration from the pre-overhaul per-server databases
-// -------------------------------------------------------------------------
-
-void LogDatabase::import_legacy_databases(const std::string& db_path)
-{
-	const fs::path directory = fs::path(db_path).parent_path();
-
-	const std::pair<const char*, const char*> sources[] = {
-		{"local_server.db", kTargetLocal},
-		{"remote_server.db", kTargetRemote},
-	};
-
-	for (const auto& [file, target] : sources) {
-		const fs::path source = directory / file;
-
-		if (fs::exists(source)) {
-			import_legacy_database(source.string(), target);
-		}
-	}
-}
-
-void LogDatabase::import_legacy_database(const std::string& file, const std::string& target)
-{
-	// Importing twice would resurrect rows the user has since dealt with.
-	{
-		sqlite::Statement seen(_db, "SELECT value FROM meta WHERE key = ?");
-		seen.bind(1, "imported_" + target);
-
-		if (seen.step()) {
-			return;
-		}
-	}
-
-	sqlite::execute(_db,
-			"CREATE TABLE IF NOT EXISTS legacy_logs ("
-			"  target     TEXT    NOT NULL,"
-			"  uuid       TEXT    NOT NULL,"
-			"  legacy_id  INTEGER NOT NULL DEFAULT 0,"
-			"  date       TEXT    NOT NULL DEFAULT '',"
-			"  size_bytes INTEGER NOT NULL DEFAULT 0,"
-			"  downloaded INTEGER NOT NULL DEFAULT 0,"
-			"  uploaded   INTEGER NOT NULL DEFAULT 0,"
-			"  rejected   INTEGER NOT NULL DEFAULT 0,"
-			"  matched    INTEGER NOT NULL DEFAULT 0,"
-			"  PRIMARY KEY (target, uuid))");
-
-	sqlite::Statement attach(_db, "ATTACH DATABASE ? AS legacy");
-	attach.bind(1, file);
-
-	if (!attach.execute()) {
-		LOG_WARN("Could not read the previous database " << file);
-		return;
-	}
-
-	// Only the pre-FTP schema is ever imported: it keyed logs on a LOG_ENTRY
-	// index and timestamp, which is the state this class cannot reconstruct.
-	sqlite::Statement shape(_db, "SELECT COUNT(*) FROM pragma_table_info('logs', 'legacy') WHERE name = 'id'");
-
-	if (!shape.step() || shape.column_int(0) == 0) {
-		LOG_DEBUG("Previous database " << file << " has no pre-FTP log table, nothing to import");
-		sqlite::execute(_db, "DETACH DATABASE legacy");
-		return;
-	}
-
-	int imported = 0;
-
-	{
-		sqlite::Transaction transaction(_db);
-
-		sqlite::Statement read(_db,
-				       "SELECT uuid, id, date, size_bytes, downloaded, uploaded FROM legacy.logs");
-
-		while (read.step()) {
-			sqlite::Statement row(_db,
-					      "INSERT OR IGNORE INTO legacy_logs "
-					      "(target, uuid, legacy_id, date, size_bytes, downloaded, uploaded, rejected) "
-					      "VALUES (?, ?, ?, ?, ?, ?, ?, 0)");
-			row.bind(1, target)
-			.bind(2, read.column_text(0))
-			.bind(3, read.column_int(1))
-			.bind(4, read.column_text(2))
-			.bind(5, read.column_int(3))
-			.bind(6, read.column_int(4))
-			.bind(7, read.column_int(5));
-			row.execute();
-			imported++;
-		}
-
-		sqlite::Statement blacklist(_db,
-					    "UPDATE legacy_logs SET rejected = 1 "
-					    "WHERE target = ? AND uuid IN (SELECT uuid FROM legacy.blacklist)");
-		blacklist.bind(1, target);
-		blacklist.execute();
-
-		sqlite::Statement mark(_db, "INSERT OR REPLACE INTO meta (key, value) VALUES (?, '1')");
-		mark.bind(1, "imported_" + target);
-		mark.execute();
-
-		transaction.commit();
-	}
-
-	sqlite::execute(_db, "DETACH DATABASE legacy");
-
-	if (imported > 0) {
-		LOG("Imported " << imported << " log records from the previous " << target << " database");
-	}
-}
-
-void LogDatabase::grandfather(int64_t id, const Discovered& log)
-{
-	struct Candidate {
-		std::string target;
-		std::string uuid;
-		int64_t legacy_id {0};
-		std::string date;
-		bool downloaded {false};
-		bool uploaded {false};
-		bool rejected {false};
-	};
-
-	for (const auto& target : _targets) {
-		std::vector<Candidate> candidates;
-
-		{
-			sqlite::Statement stmt(_db,
-					       "SELECT uuid, legacy_id, date, downloaded, uploaded, rejected FROM legacy_logs "
-					       "WHERE target = ? AND matched = 0 AND size_bytes = ?");
-			stmt.bind(1, target).bind(2, static_cast<int64_t>(log.size_bytes));
-
-			while (stmt.step()) {
-				Candidate candidate;
-				candidate.target = target;
-				candidate.uuid = stmt.column_text(0);
-				candidate.legacy_id = stmt.column_int(1);
-				candidate.date = stmt.column_text(2);
-				candidate.downloaded = stmt.column_int(3) != 0;
-				candidate.uploaded = stmt.column_int(4) != 0;
-				candidate.rejected = stmt.column_int(5) != 0;
-				candidates.push_back(candidate);
-			}
-		}
-
-		if (candidates.empty()) {
-			continue;
-		}
-
-		// The old database recorded the log's modification time; the FTP index
-		// reports either that or the start time in the path, so the same log is
-		// at most a flight apart. With no time to compare, only a single
-		// unambiguous candidate is safe to claim.
-		const Candidate* match = nullptr;
-
-		if (log.time_utc.has_value()) {
-			constexpr int64_t kMaxDelta = 48 * 3600;
-			int64_t best = kMaxDelta;
-
-			for (const auto& candidate : candidates) {
-				const auto legacy_time = parse_iso8601_utc(candidate.date);
-
-				if (!legacy_time.has_value()) {
-					continue;
-				}
-
-				const int64_t delta = std::abs(legacy_time.value() - log.time_utc.value());
-
-				if (delta <= best) {
-					best = delta;
-					match = &candidate;
-				}
-			}
-
-		} else if (candidates.size() == 1) {
-			match = &candidates.front();
-		}
-
-		if (match == nullptr) {
-			continue;
-		}
-
-		// The name the old download used, so an already-fetched log is not
-		// fetched again.
-		std::ostringstream legacy_name;
-		legacy_name << _logs_directory << "LOG" << std::setfill('0') << std::setw(4)
-			    << match->legacy_id << "_" << match->date << ".ulg";
-
-		const std::string legacy_path = legacy_name.str();
-		const bool file_exists = fs::exists(legacy_path);
-		// A log whose file went missing but which was already uploaded does not
-		// need fetching again; one that was never uploaded does.
-		const bool downloaded = match->downloaded && (file_exists || match->uploaded);
-
-		sqlite::Statement update(_db,
-					 "UPDATE logs SET downloaded = ?, local_path = ? WHERE id = ? AND downloaded = 0");
-		update.bind(1, downloaded)
-		.bind(2, (match->downloaded && file_exists) ? legacy_path : std::string {})
-		.bind(3, id);
-		update.execute();
-
-		sqlite::Statement upload(_db,
-					 "UPDATE uploads SET uploaded = ?, rejected = ? WHERE log_id = ? AND target = ?");
-		upload.bind(1, match->uploaded).bind(2, match->rejected).bind(3, id).bind(4, target);
-		upload.execute();
-
-		sqlite::Statement mark(_db, "UPDATE legacy_logs SET matched = 1 WHERE target = ? AND uuid = ?");
-		mark.bind(1, target).bind(2, match->uuid);
-		mark.execute();
-
-		LOG_DEBUG("Carried over " << target << " state for " << log.path << " from the previous database");
-	}
-}
diff --git a/src/LogDatabase.hpp b/src/LogDatabase.hpp
index b820ce7..8e1bfae 100644
--- a/src/LogDatabase.hpp
+++ b/src/LogDatabase.hpp
@@ -3,6 +3,7 @@
 #include <atomic>
 #include <cstdint>
 #include <map>
+#include <memory>
 #include <mutex>
 #include <optional>
 #include <string>
@@ -10,6 +11,8 @@
 
 #include <sqlite3.h>
 
+#include "LegacyImport.hpp"
+
 // The inventory of the vehicle's logs and what logloader intends to do with
 // each one. There is exactly one of these; upload targets do not own state.
 //
@@ -67,17 +70,20 @@ class LogDatabase
 
 	bool ok() const { return _ok; }
 
+	struct SyncResult {
+		// Rows this call created, in the order the vehicle listed them.
+		std::vector<int64_t> inserted;
+		size_t present_count {0};
+		// This call reconciled the first listing that had anything in it. On a
+		// fresh database every log looks new, and queueing them all is exactly
+		// what must not happen.
+		bool first_ever {false};
+	};
+
 	// Index -------------------------------------------------------------
 	// Reconciles the table with a complete vehicle listing: inserts logs not
-	// seen before, and marks every row present or absent. Returns the ids of
-	// the rows this call created, in the order the vehicle listed them.
-	std::vector<int64_t> sync_index(const std::vector<Discovered>& logs);
-
-	// False until the first complete listing has been reconciled. The
-	// difference matters: on a fresh database every log looks new, and
-	// queueing them all is exactly what we must not do.
-	bool first_index_seen() const;
-	void set_first_index_seen();
+	// seen before, and marks every row present or absent.
+	SyncResult sync_index(const std::vector<Discovered>& logs);
 
 	// Bumped by every write. A reader that has already rendered a given
 	// revision knows the log list has not moved since.
@@ -121,13 +127,6 @@ class LogDatabase
 private:
 	bool initialize(const std::string& db_path);
 	bool create_schema();
-	// Folds the pre-overhaul per-server databases into this one.
-	void import_legacy_databases(const std::string& db_path);
-	void import_legacy_database(const std::string& file, const std::string& target);
-	// Claims the state of a matching pre-FTP row, which was keyed on a
-	// timestamp that MAVLink FTP cannot reproduce, hence the match by size.
-	void grandfather(int64_t id, const Discovered& log);
-
 	void attach_uploads(std::vector<Entry>& entries) const;
 	void ensure_upload_rows(int64_t id);
 
@@ -137,7 +136,6 @@ class LogDatabase
 	// Opening the file is not enough: the schema still has to exist, and a
 	// read-only or full data directory fails only at CREATE TABLE.
 	bool _ok {false};
-	std::string _logs_directory;
 	std::vector<std::string> _targets;
-	bool _has_legacy_rows {false};
+	std::unique_ptr<legacy::Importer> _legacy;
 };
diff --git a/src/LogLoader.cpp b/src/LogLoader.cpp
index 03e8961..ca4ae9c 100644
--- a/src/LogLoader.cpp
+++ b/src/LogLoader.cpp
@@ -207,11 +207,8 @@ void LogLoader::index_loop()
 			continue;
 		}
 
-		std::vector<int64_t> new_ids;
-		size_t stable_count = 0;
-
-		if (refresh_index(new_ids, stable_count)) {
-			apply_auto_policy(new_ids, stable_count);
+		if (const auto sync = refresh_index(); sync.has_value()) {
+			apply_auto_policy(sync.value());
 			download_pending();
 		}
 
@@ -231,11 +228,11 @@ void LogLoader::index_loop()
 	LOG_DEBUG("Index loop finished");
 }
 
-bool LogLoader::refresh_index(std::vector<int64_t>& new_ids, size_t& stable_count)
+std::optional<LogDatabase::SyncResult> LogLoader::refresh_index()
 {
 	if (!_ftp->refresh()) {
 		_status->set_ftp(false, "");
-		return false;
+		return std::nullopt;
 	}
 
 	std::vector<LogDatabase::Discovered> discovered;
@@ -252,8 +249,7 @@ bool LogLoader::refresh_index(std::vector<int64_t>& new_ids, size_t& stable_coun
 		discovered.push_back({log.relative_path, log.size_bytes, log.time_utc});
 	}
 
-	stable_count = discovered.size();
-	new_ids = _database.sync_index(discovered);
+	const LogDatabase::SyncResult sync = _database.sync_index(discovered);
 
 	const std::string root = _ftp->root();
 	_status->set_ftp(true, root);
@@ -261,28 +257,11 @@ bool LogLoader::refresh_index(std::vector<int64_t>& new_ids, size_t& stable_coun
 	LOG_DEBUG("Indexed " << discovered.size() << " logs in " << root
 		  << (growing > 0 ? " (" + std::to_string(growing) + " still being written)" : ""));
 
-	return true;
+	return sync;
 }
 
-void LogLoader::apply_auto_policy(const std::vector<int64_t>& new_ids, size_t stable_count)
+void LogLoader::apply_auto_policy(const LogDatabase::SyncResult& sync)
 {
-	// A log only counts once two listings agree on its size, so the very first
-	// listing after startup legitimately reconciles nothing. Calling that the
-	// first index would make the next one -- the vehicle's entire history --
-	// look like logs that appeared while we were watching, which is precisely
-	// the bulk download this policy exists to prevent.
-	if (stable_count == 0) {
-		return;
-	}
-
-	const bool first_index = !_database.first_index_seen();
-
-	if (first_index) {
-		// Recorded even when nothing is queued below, so that turning automatic
-		// fetching on later does not then treat the whole card as new.
-		_database.set_first_index_seen();
-	}
-
 	if (!_config.auto_download) {
 		return;
 	}
@@ -290,9 +269,9 @@ void LogLoader::apply_auto_policy(const std::vector<int64_t>& new_ids, size_t st
 	const std::vector<std::string> upload_to =
 		_config.auto_upload ? enabled_target_names() : std::vector<std::string> {};
 
-	if (first_index) {
+	if (sync.first_ever) {
 		if (!_config.download_latest_on_first_start) {
-			LOG("First index: " << stable_count << " logs on the vehicle, none queued "
+			LOG("First index: " << sync.present_count << " logs on the vehicle, none queued "
 			    "(download.latest_on_first_start is off)");
 			return;
 		}
@@ -301,33 +280,33 @@ void LogLoader::apply_auto_policy(const std::vector<int64_t>& new_ids, size_t st
 
 		if (newest.has_value()) {
 			_database.request({newest.value()}, upload_to);
-			LOG("First index: " << stable_count << " logs on the vehicle, queueing only the newest. "
-			    "Use the ARK-OS Logs page to fetch any of the others.");
+			LOG("First index: " << sync.present_count << " logs on the vehicle, queueing only the "
+			    "newest. Use the ARK-OS Logs page to fetch any of the others.");
 		}
 
 		return;
 	}
 
-	if (new_ids.empty()) {
+	if (sync.inserted.empty()) {
 		return;
 	}
 
 	// More than a flight's worth appearing at once means the vehicle is showing
 	// us a card we have not seen, not that it flew ten times in 30 seconds.
-	if (_config.max_auto_queue > 0 && static_cast<int>(new_ids.size()) > _config.max_auto_queue) {
-		const auto newest = _database.newest_log_id(new_ids);
+	if (_config.max_auto_queue > 0 && static_cast<int>(sync.inserted.size()) > _config.max_auto_queue) {
+		const auto newest = _database.newest_log_id(sync.inserted);
 
 		if (newest.has_value()) {
 			_database.request({newest.value()}, upload_to);
 		}
 
-		LOG_WARN(new_ids.size() << " new logs appeared at once, which looks like a different SD card. "
+		LOG_WARN(sync.inserted.size() << " new logs appeared at once, which looks like a different SD card. "
 			 "Queued only the newest; use the ARK-OS Logs page for the rest.");
 		return;
 	}
 
-	_database.request(new_ids, upload_to);
-	LOG("Queued " << new_ids.size() << (new_ids.size() == 1 ? " new log" : " new logs"));
+	_database.request(sync.inserted, upload_to);
+	LOG("Queued " << sync.inserted.size() << (sync.inserted.size() == 1 ? " new log" : " new logs"));
 }
 
 // -------------------------------------------------------------------------
diff --git a/src/LogLoader.hpp b/src/LogLoader.hpp
index 9a38a48..6f51b89 100644
--- a/src/LogLoader.hpp
+++ b/src/LogLoader.hpp
@@ -2,6 +2,7 @@
 
 #include <memory>
 #include <mutex>
+#include <optional>
 #include <string>
 #include <thread>
 #include <vector>
@@ -60,11 +61,11 @@ class LogLoader
 
 	// Reconciles the vehicle listing into the database. False when the vehicle
 	// could not be listed, in which case nothing is assumed about what it has.
-	bool refresh_index(std::vector<int64_t>& new_ids, size_t& stable_count);
+	std::optional<LogDatabase::SyncResult> refresh_index();
 
 	// Decides what, if anything, to fetch without being asked. This is the
 	// guard against a freshly-installed companion pulling a whole SD card.
-	void apply_auto_policy(const std::vector<int64_t>& new_ids, size_t stable_count);
+	void apply_auto_policy(const LogDatabase::SyncResult& sync);
 
 	void download_pending();
 	bool download(const LogDatabase::Entry& entry, const FtpLogFetcher::RemoteLog& remote);
diff --git a/tests/test_log_database.cpp b/tests/test_log_database.cpp
new file mode 100644
index 0000000..8ccb367
--- /dev/null
+++ b/tests/test_log_database.cpp
@@ -0,0 +1,467 @@
+// LogDatabase holds every decision logloader makes about a log, and the legacy
+// import runs exactly once against real user data and cannot be un-run. Both
+// are worth testing without a vehicle attached.
+//
+//   cmake -B build -DBUILD_TESTING=ON && cmake --build build && ctest --test-dir build
+
+#include "LogDatabase.hpp"
+#include "Sqlite.hpp"
+
+#include <cstdio>
+#include <filesystem>
+#include <iostream>
+#include <string>
+#include <vector>
+
+namespace fs = std::filesystem;
+
+namespace
+{
+
+int g_checks = 0;
+
+#define CHECK(condition)                                                       \
+	do {                                                                   \
+		g_checks++;                                                    \
+		if (!(condition)) {                                            \
+			std::cerr << "FAILED " << __FILE__ << ":" << __LINE__   \
+				  << ": " << #condition << "\n";               \
+			std::abort();                                          \
+		}                                                              \
+	} while (0)
+
+const std::vector<std::string> kTargets {"local", "remote"};
+
+// A directory that cleans up after itself, so a failed run leaves nothing behind.
+class Workspace
+{
+public:
+	Workspace()
+	{
+		_path = fs::temp_directory_path() / ("logloader-test-" + std::to_string(::getpid()) + "-"
+						     + std::to_string(_counter++));
+		fs::create_directories(_path / "logs");
+	}
+
+	~Workspace() { fs::remove_all(_path); }
+
+	std::string db() const { return (_path / "logloader.db").string(); }
+	std::string logs() const { return (_path / "logs").string() + "/"; }
+	fs::path path() const { return _path; }
+
+private:
+	fs::path _path;
+	static inline int _counter = 0;
+};
+
+LogDatabase::Discovered px4(const std::string& path, uint32_t size, int64_t time)
+{
+	return {path, size, time};
+}
+
+LogDatabase::Discovered ardupilot(const std::string& path, uint32_t size)
+{
+	return {path, size, std::nullopt};
+}
+
+const LogDatabase::Entry* find(const std::vector<LogDatabase::Entry>& entries, const std::string& path)
+{
+	for (const auto& entry : entries) {
+		if (entry.path == path) {
+			return &entry;
+		}
+	}
+
+	return nullptr;
+}
+
+// -------------------------------------------------------------------------
+
+void first_index_needs_a_non_empty_listing()
+{
+	Workspace workspace;
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+	CHECK(database.ok());
+
+	// The very first listing after startup reports nothing stable, because
+	// stability takes two listings to establish. That must not count as the
+	// first index, or the next listing looks like a flood of new logs.
+	const auto empty = database.sync_index({});
+	CHECK(!empty.first_ever);
+	CHECK(empty.inserted.empty());
+
+	const auto real = database.sync_index({px4("2026-07-28/10_00_00.ulg", 100, 1000),
+					       px4("2026-07-28/11_00_00.ulg", 200, 2000)});
+	CHECK(real.first_ever);
+	CHECK(real.inserted.size() == 2);
+	CHECK(real.present_count == 2);
+
+	// Only once.
+	const auto later = database.sync_index({px4("2026-07-28/12_00_00.ulg", 300, 3000)});
+	CHECK(!later.first_ever);
+	CHECK(later.inserted.size() == 1);
+}
+
+void newest_is_newest_for_both_stacks()
+{
+	{
+		Workspace workspace;
+		LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+		database.sync_index({px4("2026-07-28/10_00_00.ulg", 100, 1000),
+				     px4("2026-07-28/12_00_00.ulg", 100, 3000),
+				     px4("2026-07-28/11_00_00.ulg", 100, 2000)});
+
+		const auto newest = database.newest_log_id();
+		CHECK(newest.has_value());
+		CHECK(database.log_by_id(newest.value())->path == "2026-07-28/12_00_00.ulg");
+	}
+
+	{
+		// ArduPilot reports no time at all, so the number in the name is all
+		// there is: 100.BIN is later than 99.BIN despite sorting before it.
+		Workspace workspace;
+		LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+		database.sync_index({ardupilot("98.BIN", 100), ardupilot("99.BIN", 100),
+				     ardupilot("100.BIN", 100)});
+
+		const auto newest = database.newest_log_id();
+		CHECK(newest.has_value());
+		CHECK(database.log_by_id(newest.value())->path == "100.BIN");
+	}
+
+	{
+		// ...until the counter wraps at LOG_MAX_FILES, where the only usable
+		// signal is which log we watched appear.
+		Workspace workspace;
+		LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+		database.sync_index({ardupilot("499.BIN", 100), ardupilot("500.BIN", 100)});
+		const auto wrapped = database.sync_index({ardupilot("499.BIN", 100), ardupilot("500.BIN", 100),
+				     ardupilot("1.BIN", 100)});
+		CHECK(wrapped.inserted.size() == 1);
+
+		const auto newest = database.newest_log_id();
+		CHECK(newest.has_value());
+		CHECK(database.log_by_id(newest.value())->path == "1.BIN");
+	}
+}
+
+void a_log_that_leaves_the_vehicle_keeps_its_history()
+{
+	Workspace workspace;
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+
+	const auto sync = database.sync_index({px4("a.ulg", 100, 1000)});
+	const int64_t id = sync.inserted.front();
+
+	database.mark_downloaded(id, workspace.logs() + "a.ulg");
+	database.mark_uploaded(id, "local", "/plot_app?log=abc");
+
+	// Gone from the card.
+	database.sync_index({});
+	const auto gone = database.log_by_id(id);
+	CHECK(gone.has_value());
+	CHECK(!gone->present);
+	CHECK(gone->downloaded);
+	CHECK(gone->uploads.at("local").uploaded);
+	CHECK(gone->uploads.at("local").location == "/plot_app?log=abc");
+
+	// And back again, without losing anything.
+	database.sync_index({px4("a.ulg", 100, 1000)});
+	const auto back = database.log_by_id(id);
+	CHECK(back->present);
+	CHECK(back->uploads.at("local").uploaded);
+}
+
+void a_growing_log_is_a_different_log()
+{
+	Workspace workspace;
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+
+	const auto first = database.sync_index({px4("a.ulg", 100, 1000)});
+	const auto grown = database.sync_index({px4("a.ulg", 200, 1000)});
+
+	CHECK(grown.inserted.size() == 1);
+	CHECK(grown.inserted.front() != first.inserted.front());
+	CHECK(!database.log_by_id(first.inserted.front())->present);
+	CHECK(database.log_by_id(grown.inserted.front())->present);
+}
+
+void requests_drive_the_queues()
+{
+	Workspace workspace;
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+
+	const auto sync = database.sync_index({px4("a.ulg", 100, 1000), px4("b.ulg", 100, 2000)});
+	CHECK(database.logs_to_download().empty());
+
+	const int64_t id = sync.inserted.front();
+	database.request({id}, {"local"});
+
+	auto pending = database.logs_to_download();
+	CHECK(pending.size() == 1);
+	CHECK(pending.front().id == id);
+
+	// Nothing to upload until the file is actually here.
+	CHECK(database.logs_to_upload("local").empty());
+
+	database.mark_downloaded(id, workspace.logs() + "a.ulg");
+	CHECK(database.logs_to_download().empty());
+
+	auto uploadable = database.logs_to_upload("local");
+	CHECK(uploadable.size() == 1);
+	// The request named only one target.
+	CHECK(database.logs_to_upload("remote").empty());
+
+	database.mark_uploaded(id, "local", "/plot_app?log=x");
+	CHECK(database.logs_to_upload("local").empty());
+
+	// Cancelling clears a pending request but not work already done.
+	const int64_t other = sync.inserted.back();
+	database.request({other}, {"local"});
+	CHECK(database.logs_to_download().size() == 1);
+	database.cancel_requests({other});
+	CHECK(database.logs_to_download().empty());
+	CHECK(database.log_by_id(id)->uploads.at("local").uploaded);
+}
+
+void a_downloaded_log_with_no_file_is_not_downloaded()
+{
+	Workspace workspace;
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+
+	const auto sync = database.sync_index({px4("a.ulg", 100, 1000)});
+	const int64_t id = sync.inserted.front();
+
+	database.request({id}, {"local"});
+	database.mark_downloaded(id, workspace.logs() + "a.ulg");
+	CHECK(database.logs_to_upload("local").size() == 1);
+
+	// The file went away -- manual cleanup, a full disk, a failed upload.
+	// The log has to become fetchable again, or it is stranded: reachable from
+	// neither queue and invisible to "download everything".
+	database.clear_local_file(id);
+	CHECK(!database.log_by_id(id)->downloaded);
+	CHECK(database.logs_to_upload("local").empty());
+
+	const auto not_downloaded = database.ids_not_downloaded();
+	CHECK(not_downloaded.size() == 1);
+	CHECK(not_downloaded.front() == id);
+
+	database.request({id}, {"local"});
+	CHECK(database.logs_to_download().size() == 1);
+}
+
+void rejected_uploads_do_not_block_the_queue()
+{
+	Workspace workspace;
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+
+	const auto sync = database.sync_index({px4("a.ulg", 100, 1000), px4("b.ulg", 100, 2000)});
+
+	for (int64_t id : sync.inserted) {
+		database.request({id}, {"local"});
+		database.mark_downloaded(id, workspace.logs() + std::to_string(id) + ".ulg");
+	}
+
+	CHECK(database.logs_to_upload("local").size() == 2);
+
+	database.mark_upload_rejected(sync.inserted.front(), "local", "400: not a ulog");
+	auto remaining = database.logs_to_upload("local");
+	CHECK(remaining.size() == 1);
+	CHECK(remaining.front().id == sync.inserted.back());
+
+	// A transient failure leaves it queued.
+	database.record_upload_failure(sync.inserted.back(), "local", "500");
+	CHECK(database.logs_to_upload("local").size() == 1);
+}
+
+void failure_counts_order_the_download_queue()
+{
+	Workspace workspace;
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+
+	const auto sync = database.sync_index({px4("a.ulg", 100, 3000), px4("b.ulg", 100, 2000)});
+	database.request(sync.inserted, {});
+
+	// Newest first to begin with.
+	CHECK(database.logs_to_download().front().path == "a.ulg");
+
+	// A log the vehicle will not part with sorts to the back rather than
+	// blocking everything behind it.
+	database.record_download_failure(sync.inserted.front(), "timeout");
+	CHECK(database.logs_to_download().front().path == "b.ulg");
+}
+
+void ardupilot_name_reuse_does_not_overwrite()
+{
+	Workspace workspace;
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+
+	const auto sync = database.sync_index({ardupilot("1.BIN", 100), ardupilot("1.BIN", 200)});
+	CHECK(sync.inserted.size() == 2);
+
+	const std::string path = workspace.logs() + "1.BIN";
+	database.mark_downloaded(sync.inserted.front(), path);
+
+	CHECK(database.local_path_in_use(path, sync.inserted.back()));
+	CHECK(!database.local_path_in_use(path, sync.inserted.front()));
+}
+
+void ids_for_everything_respect_target_state()
+{
+	Workspace workspace;
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+
+	const auto sync = database.sync_index({px4("a.ulg", 100, 1000), px4("b.ulg", 100, 2000)});
+	CHECK(database.ids_not_downloaded().size() == 2);
+
+	for (int64_t id : sync.inserted) {
+		database.mark_downloaded(id, workspace.logs() + std::to_string(id) + ".ulg");
+	}
+
+	CHECK(database.ids_not_downloaded().empty());
+	CHECK(database.ids_not_uploaded({"local"}).size() == 2);
+
+	database.mark_uploaded(sync.inserted.front(), "local", "/x");
+	CHECK(database.ids_not_uploaded({"local"}).size() == 1);
+	CHECK(database.ids_not_uploaded({"remote"}).size() == 2);
+	CHECK(database.ids_not_uploaded({}).empty());
+}
+
+// -------------------------------------------------------------------------
+
+// Builds a database in the shape the pre-FTP logloader left behind.
+void write_legacy_database(const fs::path& file, const std::vector<std::tuple<std::string, int, std::string,
+			   int64_t, bool, bool>>& rows)
+{
+	sqlite3* db = nullptr;
+	CHECK(sqlite3_open(file.c_str(), &db) == SQLITE_OK);
+	sqlite::execute(db, "CREATE TABLE logs (uuid TEXT PRIMARY KEY, id INTEGER, date TEXT, size_bytes INTEGER,"
+			" downloaded INTEGER, uploaded INTEGER)");
+	sqlite::execute(db, "CREATE TABLE blacklist (uuid TEXT PRIMARY KEY, reason TEXT, timestamp TEXT)");
+
+	for (const auto& [uuid, legacy_id, date, size, downloaded, uploaded] : rows) {
+		sqlite::Statement stmt(db, "INSERT INTO logs VALUES (?, ?, ?, ?, ?, ?)");
+		stmt.bind(1, uuid).bind(2, static_cast<int64_t>(legacy_id)).bind(3, date)
+		.bind(4, size).bind(5, downloaded).bind(6, uploaded);
+		stmt.execute();
+	}
+
+	sqlite3_close(db);
+}
+
+void the_upgrade_does_not_refetch_or_reupload()
+{
+	Workspace workspace;
+
+	// Three logs: one fetched and uploaded, one fetched but not uploaded, one
+	// neither. Their files are named the way the old version named them.
+	write_legacy_database(workspace.path() / "local_server.db", {
+		{"aaa", 1, "2026-07-28T10:00:00Z", 100, true, true},
+		{"bbb", 2, "2026-07-28T11:00:00Z", 200, true, false},
+		{"ccc", 3, "2026-07-28T12:00:00Z", 300, false, false},
+	});
+
+	const fs::path uploaded_file = fs::path(workspace.logs()) / "LOG0001_2026-07-28T10:00:00Z.ulg";
+	const fs::path fetched_file = fs::path(workspace.logs()) / "LOG0002_2026-07-28T11:00:00Z.ulg";
+	std::fclose(std::fopen(uploaded_file.c_str(), "w"));
+	std::fclose(std::fopen(fetched_file.c_str(), "w"));
+
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+	CHECK(database.ok());
+
+	// The FTP listing reports the same logs by size, with times close to what
+	// the old database recorded.
+	const auto sync = database.sync_index({px4("2026-07-28/10_00_00.ulg", 100, 1785276000),
+					       px4("2026-07-28/11_00_00.ulg", 200, 1785279600),
+					       px4("2026-07-28/12_00_00.ulg", 300, 1785283200)});
+	CHECK(sync.inserted.size() == 3);
+
+	const auto logs = database.all_logs();
+
+	const auto* already_done = find(logs, "2026-07-28/10_00_00.ulg");
+	CHECK(already_done != nullptr);
+	CHECK(already_done->downloaded);
+	CHECK(already_done->uploads.at("local").uploaded);
+
+	const auto* fetched = find(logs, "2026-07-28/11_00_00.ulg");
+	CHECK(fetched->downloaded);
+	CHECK(!fetched->uploads.at("local").uploaded);
+
+	const auto* untouched = find(logs, "2026-07-28/12_00_00.ulg");
+	CHECK(!untouched->downloaded);
+	CHECK(!untouched->uploads.at("local").uploaded);
+
+	// The other target never had these logs.
+	CHECK(!already_done->uploads.at("remote").uploaded);
+}
+
+void the_upgrade_runs_once()
+{
+	Workspace workspace;
+	write_legacy_database(workspace.path() / "local_server.db", {
+		{"aaa", 1, "2026-07-28T10:00:00Z", 100, true, true},
+	});
+
+	{
+		LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+		const auto sync = database.sync_index({px4("2026-07-28/10_00_00.ulg", 100, 1785276000)});
+		database.mark_upload_rejected(sync.inserted.front(), "local", "operator dealt with it");
+	}
+
+	// Re-opening must not resurrect what the first run already applied.
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+	const auto logs = database.all_logs();
+	CHECK(logs.size() == 1);
+	CHECK(logs.front().uploads.at("local").rejected);
+}
+
+void a_missing_legacy_file_is_fetched_again()
+{
+	Workspace workspace;
+	// Recorded as downloaded, but the file is not there any more.
+	write_legacy_database(workspace.path() / "local_server.db", {
+		{"aaa", 1, "2026-07-28T10:00:00Z", 100, true, false},
+	});
+
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+	database.sync_index({px4("2026-07-28/10_00_00.ulg", 100, 1785276000)});
+
+	const auto logs = database.all_logs();
+	CHECK(!logs.front().downloaded);
+	CHECK(logs.front().local_path.empty());
+	CHECK(database.ids_not_downloaded().size() == 1);
+}
+
+void a_database_with_no_predecessor_is_untouched()
+{
+	Workspace workspace;
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+	const auto sync = database.sync_index({px4("a.ulg", 100, 1000)});
+	CHECK(sync.inserted.size() == 1);
+	CHECK(!database.log_by_id(sync.inserted.front())->downloaded);
+}
+
+} // namespace
+
+int main()
+{
+	first_index_needs_a_non_empty_listing();
+	newest_is_newest_for_both_stacks();
+	a_log_that_leaves_the_vehicle_keeps_its_history();
+	a_growing_log_is_a_different_log();
+	requests_drive_the_queues();
+	a_downloaded_log_with_no_file_is_not_downloaded();
+	rejected_uploads_do_not_block_the_queue();
+	failure_counts_order_the_download_queue();
+	ardupilot_name_reuse_does_not_overwrite();
+	ids_for_everything_respect_target_state();
+
+	the_upgrade_does_not_refetch_or_reupload();
+	the_upgrade_runs_once();
+	a_missing_legacy_file_is_fetched_again();
+	a_database_with_no_predecessor_is_untouched();
+
+	std::cout << "all checks passed (" << g_checks << ")\n";
+	return 0;
+}

From 74ee557a26317f93f8156f2f07592cce648e6715 Mon Sep 17 00:00:00 2001
From: Jacob Dahl <dahl.jakejacob@gmail.com>
Date: Tue, 28 Jul 2026 12:16:32 -0600
Subject: [PATCH 7/8] docs(logloader): note what the upgrade does with a
 pre-existing upload backlog

---
 README.md | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index fb37238..1e97702 100644
--- a/README.md
+++ b/README.md
@@ -68,7 +68,7 @@ Older versions kept a database per server and identified logs by the timestamp `
 | `api.enabled` / `api.bind` / `api.port` | `true` / `127.0.0.1` / `3005` | Local HTTP API |
 | `download.auto` | `true` | Queue logs that appear while running |
 | `download.latest_on_first_start` | `true` | On a fresh database, take only the newest |
-| `download.auto_upload` | `true` | Upload what was queued automatically |
+| `upload.auto` | `true` | Upload what was queued automatically |
 | `download.max_auto_queue` | `5` | Bulk-discovery guard; 0 disables |
 | `download.index_interval` | `30` | Seconds between listings |
 | `download.remote_directory` | `""` | Override the vehicle log directory |
@@ -96,7 +96,15 @@ cd logloader
 make
 ```
 
-`make` builds Release. `make debug` builds with debug symbols and no optimisation; the log level is a runtime setting either way.
+`make` builds Release. `make debug` builds with debug symbols and no optimisation; the log level is a runtime setting either way. `make format` runs astyle and `make check-format` fails if anything needs it — the build itself never rewrites your sources.
+
+### Tests
+
+```
+cmake -B build -DBUILD_TESTING=ON && cmake --build build && ctest --test-dir build
+```
+
+`tests/test_log_database.cpp` covers the database, which is where every decision about a log is recorded: the first-index rule, logs appearing and disappearing from the vehicle, request and cancel, recovery when a downloaded file goes missing, ArduPilot's name reuse, and the upgrade from a pre-FTP database — which runs once against real user data and cannot be un-run.
 
 ### Run
 

From ae964b28041590194848236bd585a561df08e8dd Mon Sep 17 00:00:00 2001
From: Jacob Dahl <dahl.jakejacob@gmail.com>
Date: Tue, 28 Jul 2026 12:36:53 -0600
Subject: [PATCH 8/8] fix(logloader): add the missing schema migration and
 close four review findings

A second review pass over the rewrite, verified against PX4 SITL.

The last commit added a discovered_seq column but no migration. CREATE TABLE IF
NOT EXISTS does nothing to a table that already exists, so on any database from
an earlier build every query naming the column failed to prepare and returned
nothing -- while commit succeeded and the daemon reported itself healthy. The
log list would simply be empty forever. There is now an ALTER TABLE path,
backfilled from discovered_at, and a test that opens an older schema; the
existing tests only ever created fresh databases, which is why they missed it.

A log still being written is on the vehicle. sync_index was only told about
stable ones, so the first listing after any restart -- which has nothing stable
yet, stability taking two listings -- marked every row absent, showed "not on
vehicle" across the whole UI, and emptied the download queue for an interval.
The whole listing now goes over with a stable flag; only stable logs are
recorded, but everything listed counts as present.

Outcome::Missing on a zero-byte log was an infinite loop: clear, re-request,
download nothing successfully, clear again. An empty log is a property of the
log, not of the local copy, so that case is Rejected again. Missing now means
only that the file is gone.

clear_local_file is conditional on the path the caller saw. The upload thread
works from a snapshot that can be minutes old, and clearing unconditionally
would wipe the bookkeeping of a download the index thread had just finished and
re-fetch the whole log.

Also: the SSE stream slot is released by httplib's resource releaser, which runs
on every path -- the manual decrement only covered shutdown, so a browser
refresh leaked a slot and eight of them wedged /events permanently; a database
write now bumps the status board, which streams block on, instead of waiting out
a keepalive; upload targets ship their base url, since Flight Review returns a
relative redirect and a remote plot link was resolving against the ARK-OS host;
a failed BEGIN no longer leaves a durable UPDATE behind; an unchanged listing no
longer counts as a change; downloaded is never reported true for a row with no
file; auto_upload keeps its old key and stops hardcoding its default; connect()
cannot leave a fetcher running past stop(); and free space is printed as
uintmax_t in the message that exists to diagnose a full disk.

Config tables are one level deep now ([upload_local] rather than
[upload.local]): ARK-OS's shared config editor renders exactly one level, and a
setting the operator cannot reach from the web UI may as well not exist.
---
 README.md                   |  6 ++-
 config.toml                 |  4 +-
 src/ApiServer.cpp           | 32 +++++++++----
 src/Config.cpp              |  9 ++--
 src/LogDatabase.cpp         | 93 +++++++++++++++++++++++++++++++++----
 src/LogDatabase.hpp         | 14 +++++-
 src/LogLoader.cpp           | 56 +++++++++++++++++-----
 src/LogLoader.hpp           |  4 ++
 src/Sqlite.cpp              |  7 +++
 src/Sqlite.hpp              |  5 ++
 src/UploadTarget.cpp        | 10 +++-
 tests/test_log_database.cpp | 61 ++++++++++++++++++++++++
 12 files changed, 261 insertions(+), 40 deletions(-)

diff --git a/README.md b/README.md
index 1e97702..6857b68 100644
--- a/README.md
+++ b/README.md
@@ -74,8 +74,10 @@ Older versions kept a database per server and identified logs by the timestamp `
 | `download.remote_directory` | `""` | Override the vehicle log directory |
 | `download.use_burst` | `true` | FTP burst reads |
 | `upload.interval` | `10` | Seconds between upload passes |
-| `upload.local.*` | enabled, `http://127.0.0.1:5006` | Flight Review on the companion |
-| `upload.remote.*` | disabled, `https://logs.px4.io` | `url`, `email`, `public`, `api_key` |
+| `upload_local.*` | enabled, `http://127.0.0.1:5006` | Flight Review on the companion |
+| `upload_remote.*` | disabled, `https://logs.px4.io` | `url`, `email`, `public`, `api_key` |
+
+Tables are one level deep on purpose: ARK-OS's config editor renders exactly that, and a setting an operator cannot reach from the web UI may as well not exist.
 
 The flat keys the previous layout used (`local_server`, `remote_server`, `upload_enabled`, `public_logs`, `email`, `remote_api_key`, `remote_log_directory`, `ftp_use_burst`, `application_directory`) are still read, so an existing config keeps working.
 
diff --git a/config.toml b/config.toml
index 15dc8a1..a51995e 100644
--- a/config.toml
+++ b/config.toml
@@ -50,12 +50,12 @@ auto = true
 interval = 10
 
 # Flight Review running on this companion. Left open, so no key is needed.
-[upload.local]
+[upload_local]
 enabled = true
 url = "http://127.0.0.1:5006"
 public = true
 
-[upload.remote]
+[upload_remote]
 enabled = false
 url = "https://logs.px4.io"
 email = ""
diff --git a/src/ApiServer.cpp b/src/ApiServer.cpp
index 40c470b..f24efe9 100644
--- a/src/ApiServer.cpp
+++ b/src/ApiServer.cpp
@@ -122,8 +122,21 @@ std::vector<int64_t> ids_from(const json& body)
 	return ids;
 }
 
-json list_payload(LogDatabase& database, const StatusBoard::Snapshot& snapshot,
-		  const std::vector<std::string>& targets)
+// Flight Review answers an upload with a *relative* redirect, so the stored
+// location is only half a link. Shipping each target's base url lets the UI
+// join them itself rather than guessing an origin.
+json targets_json(LogLoader& loader)
+{
+	json targets = json::array();
+
+	for (const auto& [name, url] : loader.enabled_targets()) {
+		targets.push_back(json {{"name", name}, {"url", url}});
+	}
+
+	return targets;
+}
+
+json list_payload(LogDatabase& database, const StatusBoard::Snapshot& snapshot, const json& targets)
 {
 	json logs = json::array();
 
@@ -189,13 +202,13 @@ void ApiServer::install_routes()
 
 	_server->Get("/status", [this](const httplib::Request&, httplib::Response & response) {
 		json payload = to_json(_loader.status().get());
-		payload["targets"] = _loader.enabled_target_names();
+		payload["targets"] = targets_json(_loader);
 		response.set_content(payload.dump(), "application/json");
 	});
 
 	_server->Get("/logs", [this, &database](const httplib::Request&, httplib::Response & response) {
 		const json payload =
-			list_payload(database, _loader.status().get(), _loader.enabled_target_names());
+			list_payload(database, _loader.status().get(), targets_json(_loader));
 		response.set_content(payload.dump(), "application/json");
 	});
 
@@ -216,6 +229,9 @@ void ApiServer::install_routes()
 		auto seen_status = std::make_shared<uint64_t>(UINT64_MAX);
 		auto seen_logs = std::make_shared<uint64_t>(UINT64_MAX);
 
+		// The releaser runs from ~Response on every path -- client disconnect,
+		// write failure, shutdown -- which the provider itself does not: httplib
+		// simply stops calling it when a write fails.
 		response.set_chunked_content_provider("text/event-stream",
 		[this, &database, seen_status, seen_logs](size_t, httplib::DataSink & sink) {
 			StatusBoard& status = _loader.status();
@@ -224,8 +240,7 @@ void ApiServer::install_routes()
 			// the API is stopped on its own, which nothing else would unblock.
 			if (_stopping.load() || status.stopped()) {
 				sink.done();
-				_streams--;
-				return false;
+				return true;
 			}
 
 			const auto snapshot = status.wait_for_change(*seen_status, kEventKeepalive);
@@ -247,7 +262,7 @@ void ApiServer::install_routes()
 			if (log_revision != *seen_logs) {
 				*seen_logs = log_revision;
 				message = "event: logs\ndata: "
-					  + list_payload(database, snapshot, _loader.enabled_target_names()).dump();
+					  + list_payload(database, snapshot, targets_json(_loader)).dump();
 
 			} else {
 				message = "event: status\ndata: " + to_json(snapshot).dump();
@@ -255,7 +270,8 @@ void ApiServer::install_routes()
 
 			message += "\n\n";
 			return sink.write(message.data(), message.size());
-		});
+		},
+		[this](bool) { _streams--; });
 	});
 
 	_server->Post("/logs/download", [this, &database](const httplib::Request & request, httplib::Response & response) {
diff --git a/src/Config.cpp b/src/Config.cpp
index 26de17c..ad282da 100644
--- a/src/Config.cpp
+++ b/src/Config.cpp
@@ -115,8 +115,11 @@ Config load_config(const std::string& path)
 	const auto api = file["api"];
 	const auto download = file["download"];
 	const auto upload = file["upload"];
-	const auto local = upload["local"];
-	const auto remote = upload["remote"];
+	// Deliberately flat rather than [upload.local]: ARK-OS's config editor
+	// renders one level of tables, and an operator who cannot reach these from
+	// the web UI cannot turn remote uploads on.
+	const auto local = file["upload_local"];
+	const auto remote = file["upload_remote"];
 
 	config.data_directory = with_trailing_slash(
 					value_or<std::string>(data["directory"], file["application_directory"], default_data));
@@ -129,7 +132,7 @@ Config load_config(const std::string& path)
 	config.auto_download = download["auto"].value_or(config.auto_download);
 	config.download_latest_on_first_start =
 		download["latest_on_first_start"].value_or(config.download_latest_on_first_start);
-	config.auto_upload = upload["auto"].value_or(true);
+	config.auto_upload = value_or<bool>(upload["auto"], download["auto_upload"], config.auto_upload);
 	config.max_auto_queue = download["max_auto_queue"].value_or(config.max_auto_queue);
 	config.index_interval_s = std::max(1, download["index_interval"].value_or(config.index_interval_s));
 	config.upload_interval_s = std::max(1, upload["interval"].value_or(config.upload_interval_s));
diff --git a/src/LogDatabase.cpp b/src/LogDatabase.cpp
index 248e8bc..d019e13 100644
--- a/src/LogDatabase.cpp
+++ b/src/LogDatabase.cpp
@@ -49,7 +49,9 @@ LogDatabase::Entry row_to_entry(const sqlite::Statement& stmt)
 	entry.size_bytes = static_cast<uint32_t>(stmt.column_int(2));
 	entry.time_utc = stmt.column_optional_int(3);
 	entry.local_path = stmt.column_text(4);
-	entry.downloaded = stmt.column_int(5) != 0;
+	// The queues treat a row with no file as not downloaded; so must anything
+	// that reports it, or the API and the queue disagree about the same row.
+	entry.downloaded = stmt.column_int(5) != 0 && !entry.local_path.empty();
 	entry.download_requested = stmt.column_int(6) != 0;
 	entry.present = stmt.column_int(7) != 0;
 	entry.download_failures = static_cast<int>(stmt.column_int(8));
@@ -133,7 +135,22 @@ bool LogDatabase::create_schema()
 					  "  key   TEXT PRIMARY KEY,"
 					  "  value TEXT NOT NULL)");
 
-	return logs && uploads && meta;
+	return logs && uploads && meta && migrate_schema();
+}
+
+bool LogDatabase::migrate_schema()
+{
+	if (!sqlite::column_exists(_db, "logs", "discovered_seq")) {
+		if (!sqlite::execute(_db, "ALTER TABLE logs ADD COLUMN discovered_seq INTEGER NOT NULL DEFAULT 0")) {
+			return false;
+		}
+
+		// discovered_at is the same ordering at coarser resolution, which is
+		// the best that can be reconstructed for rows that predate the column.
+		sqlite::execute(_db, "UPDATE logs SET discovered_seq = discovered_at");
+	}
+
+	return true;
 }
 
 // -------------------------------------------------------------------------
@@ -144,14 +161,33 @@ LogDatabase::SyncResult LogDatabase::sync_index(const std::vector<Discovered>& l
 {
 	std::lock_guard<std::mutex> lock(_mutex);
 	SyncResult result;
-	result.present_count = logs.size();
+
+	for (const auto& log : logs) {
+		if (log.stable) {
+			result.present_count++;
+		}
+	}
 
 	sqlite::Transaction transaction(_db);
 
+	if (!transaction) {
+		LOG_ERROR("Could not begin a transaction; skipping this index");
+		return result;
+	}
+
 	// The listing is complete (a partial one fails the whole refresh), so
 	// anything it does not mention is gone from the vehicle.
 	sqlite::execute(_db, "UPDATE logs SET present = 0");
 
+	int64_t present_before = 0;
+	{
+		sqlite::Statement stmt(_db, "SELECT COUNT(*) FROM logs WHERE present = 1");
+
+		if (stmt.step()) {
+			present_before = stmt.column_int(0);
+		}
+	}
+
 	const int64_t discovered_at = now_epoch();
 
 	// A wall clock at one-second resolution cannot separate two listings, and
@@ -170,7 +206,7 @@ LogDatabase::SyncResult LogDatabase::sync_index(const std::vector<Discovered>& l
 		int64_t id = 0;
 		bool is_new = false;
 
-		{
+		if (log.stable) {
 			sqlite::Statement insert(_db,
 						 "INSERT OR IGNORE INTO logs "
 						 "(path, size_bytes, time_utc, discovered_at, discovered_seq) "
@@ -193,6 +229,8 @@ LogDatabase::SyncResult LogDatabase::sync_index(const std::vector<Discovered>& l
 			find.bind(1, log.path).bind(2, static_cast<int64_t>(log.size_bytes));
 
 			if (!find.step()) {
+				// A log we have never recorded, still being written. Nothing to
+				// mark present; it becomes a row once it stops changing.
 				continue;
 			}
 
@@ -221,7 +259,7 @@ LogDatabase::SyncResult LogDatabase::sync_index(const std::vector<Discovered>& l
 	// listing after startup reconciles nothing. Recording that as the first
 	// index would make the next one -- the vehicle's whole history -- look like
 	// logs that appeared while we were watching.
-	if (!logs.empty()) {
+	if (result.present_count > 0) {
 		sqlite::Statement seen(_db, "SELECT value FROM meta WHERE key = 'first_index_seen'");
 		result.first_ever = !seen.step();
 
@@ -232,11 +270,26 @@ LogDatabase::SyncResult LogDatabase::sync_index(const std::vector<Discovered>& l
 		}
 	}
 
+	int64_t present_after = 0;
+	{
+		sqlite::Statement stmt(_db, "SELECT COUNT(*) FROM logs WHERE present = 1");
+
+		if (stmt.step()) {
+			present_after = stmt.column_int(0);
+		}
+	}
+
 	if (!commit_or_warn(transaction, "the vehicle index")) {
 		return {};
 	}
 
-	_revision++;
+	// An identical listing, which is what most of them are, is not a change:
+	// bumping the revision anyway would push the whole log list to every open
+	// stream once per index interval for nothing.
+	if (!result.inserted.empty() || present_before != present_after) {
+		_revision++;
+	}
+
 	return result;
 }
 
@@ -404,14 +457,34 @@ void LogDatabase::record_upload_failure(int64_t id, const std::string& target, c
 	_revision++;
 }
 
-void LogDatabase::clear_local_file(int64_t id)
+bool LogDatabase::clear_local_file(int64_t id, const std::string& expected_local_path)
 {
 	std::lock_guard<std::mutex> lock(_mutex);
-	sqlite::Statement stmt(_db,
-			       "UPDATE logs SET downloaded = 0, local_path = '', download_requested = 0 WHERE id = ?");
+
+	// Bound to the path the caller saw. The upload thread works from a snapshot
+	// that can be minutes old, and clearing unconditionally would wipe the
+	// bookkeeping of a download the index thread finished in the meantime.
+	std::string sql = "UPDATE logs SET downloaded = 0, local_path = '', download_requested = 0 WHERE id = ?";
+
+	if (!expected_local_path.empty()) {
+		sql += " AND local_path = ?";
+	}
+
+	sqlite::Statement stmt(_db, sql);
 	stmt.bind(1, id);
+
+	if (!expected_local_path.empty()) {
+		stmt.bind(2, expected_local_path);
+	}
+
 	stmt.execute();
-	_revision++;
+	const bool changed = sqlite3_changes(_db) > 0;
+
+	if (changed) {
+		_revision++;
+	}
+
+	return changed;
 }
 
 // -------------------------------------------------------------------------
diff --git a/src/LogDatabase.hpp b/src/LogDatabase.hpp
index 8e1bfae..2c6c7e8 100644
--- a/src/LogDatabase.hpp
+++ b/src/LogDatabase.hpp
@@ -59,6 +59,10 @@ class LogDatabase
 		std::string path;
 		uint32_t size_bytes {0};
 		std::optional<int64_t> time_utc;
+		// False while the log is still growing. It is on the vehicle either way,
+		// but only a log that has stopped changing is worth recording, since its
+		// identity includes its size.
+		bool stable {true};
 	};
 
 	LogDatabase(const std::string& db_path, const std::string& logs_directory,
@@ -73,6 +77,7 @@ class LogDatabase
 	struct SyncResult {
 		// Rows this call created, in the order the vehicle listed them.
 		std::vector<int64_t> inserted;
+		// Stable logs in this listing.
 		size_t present_count {0};
 		// This call reconciled the first listing that had anything in it. On a
 		// fresh database every log looks new, and queueing them all is exactly
@@ -108,8 +113,10 @@ class LogDatabase
 	void mark_upload_rejected(int64_t id, const std::string& target, const std::string& message);
 	void record_upload_failure(int64_t id, const std::string& target, const std::string& message);
 
-	// Forgets the downloaded file (the caller removes it from disk).
-	void clear_local_file(int64_t id);
+	// Forgets the downloaded file (the caller removes it from disk). Pass the
+	// path the caller believes is there to avoid clobbering a newer download;
+	// returns false when the row had moved on.
+	bool clear_local_file(int64_t id, const std::string& expected_local_path = {});
 
 	// Queries -------------------------------------------------------------
 	std::vector<Entry> all_logs() const;
@@ -127,6 +134,9 @@ class LogDatabase
 private:
 	bool initialize(const std::string& db_path);
 	bool create_schema();
+	// A column added after a database was created has to be added explicitly:
+	// CREATE TABLE IF NOT EXISTS is a no-op on a table that is already there.
+	bool migrate_schema();
 	void attach_uploads(std::vector<Entry>& entries) const;
 	void ensure_upload_rows(int64_t id);
 
diff --git a/src/LogLoader.cpp b/src/LogLoader.cpp
index ca4ae9c..1047bf3 100644
--- a/src/LogLoader.cpp
+++ b/src/LogLoader.cpp
@@ -21,7 +21,7 @@ constexpr int kMaxConsecutiveUploadRetries = 3;
 
 constexpr auto kFastIndexInterval = std::chrono::seconds(5);
 
-std::string human_size(uint32_t bytes)
+std::string human_size(uintmax_t bytes)
 {
 	std::ostringstream out;
 	out << std::fixed << std::setprecision(1) << bytes / 1e6 << " MB";
@@ -62,6 +62,19 @@ LogLoader::~LogLoader()
 	_mavsdk.reset();
 }
 
+std::vector<std::pair<std::string, std::string>> LogLoader::enabled_targets() const
+{
+	std::vector<std::pair<std::string, std::string>> targets;
+
+	for (const auto& target : _targets) {
+		if (target->enabled()) {
+			targets.emplace_back(target->name(), target->url());
+		}
+	}
+
+	return targets;
+}
+
 std::vector<std::string> LogLoader::enabled_target_names() const
 {
 	std::vector<std::string> names;
@@ -153,6 +166,13 @@ bool LogLoader::connect()
 		// PX4 serves one FTP session at a time, so one left open by a run that
 		// was killed mid-transfer blocks every transfer until the vehicle
 		// reboots.
+		if (_index_waiter.stopped()) {
+			// stop() ran while first_autopilot() was blocking, so it saw a null
+			// _ftp and there is nobody else to shut this one down.
+			_ftp->stop();
+			return false;
+		}
+
 		_ftp->reset_sessions();
 
 		_status->set_connected(true);
@@ -235,18 +255,18 @@ std::optional<LogDatabase::SyncResult> LogLoader::refresh_index()
 		return std::nullopt;
 	}
 
+	// The whole listing goes over, growing logs included: a log being written is
+	// still on the vehicle, and leaving it out would mark every row absent on the
+	// first pass after a restart, when nothing has been seen twice yet.
 	std::vector<LogDatabase::Discovered> discovered;
 	size_t growing = 0;
 
 	for (const auto& log : _ftp->logs()) {
 		if (!log.stable) {
-			// Almost certainly the log being written right now. Recording it
-			// would enter it into the queue at a size it will not keep.
 			growing++;
-			continue;
 		}
 
-		discovered.push_back({log.relative_path, log.size_bytes, log.time_utc});
+		discovered.push_back({log.relative_path, log.size_bytes, log.time_utc, log.stable});
 	}
 
 	const LogDatabase::SyncResult sync = _database.sync_index(discovered);
@@ -254,7 +274,7 @@ std::optional<LogDatabase::SyncResult> LogLoader::refresh_index()
 	const std::string root = _ftp->root();
 	_status->set_ftp(true, root);
 
-	LOG_DEBUG("Indexed " << discovered.size() << " logs in " << root
+	LOG_DEBUG("Indexed " << sync.present_count << " logs in " << root
 		  << (growing > 0 ? " (" + std::to_string(growing) + " still being written)" : ""));
 
 	return sync;
@@ -351,7 +371,7 @@ void LogLoader::download_pending()
 		const auto space = fs::space(_config.logs_directory, ec);
 
 		if (!ec && space.available < static_cast<uintmax_t>(entry.size_bytes) * 2) {
-			LOG_ERROR("Only " << human_size(static_cast<uint32_t>(space.available)) << " free in "
+			LOG_ERROR("Only " << human_size(space.available) << " free in "
 				  << _config.logs_directory << "; delete downloaded logs from the ARK-OS Logs "
 				  "page to make room");
 			return;
@@ -365,6 +385,7 @@ void LogLoader::download_pending()
 
 		} else {
 			_database.record_download_failure(entry.id, "download failed");
+			_status->notify();
 		}
 	}
 }
@@ -406,6 +427,9 @@ bool LogLoader::download(const LogDatabase::Entry& entry, const FtpLogFetcher::R
 	    << "s (" << rate.str() << " kB/s)");
 
 	_database.mark_downloaded(entry.id, local_path);
+	// The status board is what streams are blocked on; without this the finished
+	// download would not reach the UI until the next keepalive.
+	_status->notify();
 	return true;
 }
 
@@ -493,23 +517,30 @@ void LogLoader::upload_pending(UploadTarget& target)
 		const UploadTarget::Result result = target.upload(entry.local_path);
 
 		_status->set_upload(0, "");
+		// Every branch below writes to the database; bumping the board after
+		// them is what tells an open stream to re-read the log list.
+		const auto notify = [this] { _status->notify(); };
 
 		switch (result.outcome) {
 		case UploadTarget::Outcome::Success:
 			LOG("Uploaded " << entry.path << " to " << target.name()
 			    << (result.location.empty() ? "" : ": " + target.url() + result.location));
 			_database.mark_uploaded(entry.id, target.name(), result.location);
+			notify();
 			consecutive_retries = 0;
 			break;
 
 		case UploadTarget::Outcome::Missing:
+
 			// Forgetting the file puts the log back in the download queue, which
 			// is the only way it can ever be uploaded. Marking it rejected here
 			// would strand it: never fetched again, never uploaded again.
-			LOG_WARN(entry.local_path << " is gone; queueing it to be fetched again");
-			_database.clear_local_file(entry.id);
-			_database.request({entry.id}, {target.name()});
-			_index_waiter.wake();
+			if (_database.clear_local_file(entry.id, entry.local_path)) {
+				LOG_WARN(entry.local_path << " is gone; queueing it to be fetched again");
+				_database.request({entry.id}, {target.name()});
+				_index_waiter.wake();
+			}
+
 			consecutive_retries = 0;
 			break;
 
@@ -518,6 +549,7 @@ void LogLoader::upload_pending(UploadTarget& target)
 			// unaffected by one log the server will not take.
 			LOG_WARN(target.name() << " rejected " << entry.path << ": " << result.message);
 			_database.mark_upload_rejected(entry.id, target.name(), result.message);
+			notify();
 			consecutive_retries = 0;
 			break;
 
@@ -527,6 +559,7 @@ void LogLoader::upload_pending(UploadTarget& target)
 			LOG_WARN("Pausing " << target.name() << " uploads for this cycle; they resume "
 				 "on their own once the account is authorized");
 			_database.record_upload_failure(entry.id, target.name(), result.message);
+			notify();
 			return;
 
 		case UploadTarget::Outcome::Unreachable:
@@ -537,6 +570,7 @@ void LogLoader::upload_pending(UploadTarget& target)
 			LOG_WARN("Upload of " << entry.path << " to " << target.name() << " failed ("
 				 << result.status_code << "): " << result.message << "; will retry");
 			_database.record_upload_failure(entry.id, target.name(), result.message);
+			notify();
 
 			if (++consecutive_retries >= kMaxConsecutiveUploadRetries) {
 				LOG_WARN(target.name() << " failed " << consecutive_retries
diff --git a/src/LogLoader.hpp b/src/LogLoader.hpp
index 6f51b89..b2e7247 100644
--- a/src/LogLoader.hpp
+++ b/src/LogLoader.hpp
@@ -5,6 +5,7 @@
 #include <optional>
 #include <string>
 #include <thread>
+#include <utility>
 #include <vector>
 
 #include <mavsdk/mavsdk.h>
@@ -54,6 +55,9 @@ class LogLoader
 	bool delete_local_file(int64_t id);
 
 	std::vector<std::string> enabled_target_names() const;
+	// Name and base url of each enabled target. The url matters because an
+	// upload records only the relative path the server redirected to.
+	std::vector<std::pair<std::string, std::string>> enabled_targets() const;
 
 private:
 	void index_loop();
diff --git a/src/Sqlite.cpp b/src/Sqlite.cpp
index 58d9254..f0238df 100644
--- a/src/Sqlite.cpp
+++ b/src/Sqlite.cpp
@@ -143,6 +143,13 @@ bool table_exists(sqlite3* db, const std::string& table)
 	return stmt.step() && stmt.column_int(0) > 0;
 }
 
+bool column_exists(sqlite3* db, const std::string& table, const std::string& column)
+{
+	Statement stmt(db, "SELECT COUNT(*) FROM pragma_table_info(?) WHERE name = ?");
+	stmt.bind(1, table).bind(2, column);
+	return stmt.step() && stmt.column_int(0) > 0;
+}
+
 Transaction::Transaction(sqlite3* db)
 	: _db(db)
 {
diff --git a/src/Sqlite.hpp b/src/Sqlite.hpp
index 96675fa..29c0768 100644
--- a/src/Sqlite.hpp
+++ b/src/Sqlite.hpp
@@ -50,6 +50,7 @@ class Statement
 bool execute(sqlite3* db, const std::string& sql);
 
 bool table_exists(sqlite3* db, const std::string& table);
+bool column_exists(sqlite3* db, const std::string& table, const std::string& column);
 
 // Rolls back unless commit() is called, so an early return cannot leave a
 // half-applied multi-statement change behind.
@@ -62,6 +63,10 @@ class Transaction
 	Transaction(const Transaction&) = delete;
 	Transaction& operator=(const Transaction&) = delete;
 
+	// False when BEGIN failed, in which case statements run in autocommit and
+	// are durable whatever the caller does next.
+	explicit operator bool() const { return _open; }
+
 	bool commit();
 
 private:
diff --git a/src/UploadTarget.cpp b/src/UploadTarget.cpp
index a6b008a..5e0525d 100644
--- a/src/UploadTarget.cpp
+++ b/src/UploadTarget.cpp
@@ -101,8 +101,14 @@ UploadTarget::Result UploadTarget::upload(const std::string& file_path)
 
 	const auto size = fs::file_size(file_path, ec);
 
-	if (ec || size == 0) {
-		return {Outcome::Missing, 0, "local file is empty: " + file_path, ""};
+	if (ec) {
+		return {Outcome::Missing, 0, "cannot stat local file: " + file_path, ""};
+	}
+
+	// Not Missing: re-fetching a log the vehicle reports as zero bytes would
+	// download nothing, succeed, and come straight back here forever.
+	if (size == 0) {
+		return {Outcome::Rejected, 0, "log is empty: " + file_path, ""};
 	}
 
 	if (!reachable()) {
diff --git a/tests/test_log_database.cpp b/tests/test_log_database.cpp
index 8ccb367..17b4589 100644
--- a/tests/test_log_database.cpp
+++ b/tests/test_log_database.cpp
@@ -172,6 +172,28 @@ void a_log_that_leaves_the_vehicle_keeps_its_history()
 	CHECK(back->uploads.at("local").uploaded);
 }
 
+// The first listing after a restart has nothing stable in it yet, because
+// stability takes two listings. Every log is still on the vehicle, and saying
+// otherwise both lies to the UI and empties the download queue for an interval.
+void a_growing_log_is_still_on_the_vehicle()
+{
+	Workspace workspace;
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+
+	LogDatabase::Discovered settled = px4("a.ulg", 100, 1000);
+	database.sync_index({settled});
+	CHECK(database.log_by_id(database.all_logs().front().id)->present);
+
+	// Same listing, but nothing has been confirmed stable this time round.
+	LogDatabase::Discovered growing = settled;
+	growing.stable = false;
+	const auto sync = database.sync_index({growing});
+
+	CHECK(sync.present_count == 0);
+	CHECK(sync.inserted.empty());
+	CHECK(database.all_logs().front().present);
+}
+
 void a_growing_log_is_a_different_log()
 {
 	Workspace workspace;
@@ -433,6 +455,43 @@ void a_missing_legacy_file_is_fetched_again()
 	CHECK(database.ids_not_downloaded().size() == 1);
 }
 
+// CREATE TABLE IF NOT EXISTS does nothing to a table that is already there, so a
+// column added later is invisible on an existing database and every query naming
+// it silently returns nothing.
+void an_older_schema_is_migrated()
+{
+	Workspace workspace;
+
+	{
+		sqlite3* db = nullptr;
+		CHECK(sqlite3_open(workspace.db().c_str(), &db) == SQLITE_OK);
+		sqlite::execute(db,
+				"CREATE TABLE logs ("
+				"  id INTEGER PRIMARY KEY, path TEXT NOT NULL, size_bytes INTEGER NOT NULL,"
+				"  time_utc INTEGER, local_path TEXT NOT NULL DEFAULT '',"
+				"  downloaded INTEGER NOT NULL DEFAULT 0, download_requested INTEGER NOT NULL DEFAULT 0,"
+				"  present INTEGER NOT NULL DEFAULT 1, download_failures INTEGER NOT NULL DEFAULT 0,"
+				"  last_error TEXT NOT NULL DEFAULT '', discovered_at INTEGER NOT NULL DEFAULT 0,"
+				"  UNIQUE (path, size_bytes))");
+		sqlite::execute(db,
+				"INSERT INTO logs (path, size_bytes, time_utc, discovered_at) "
+				"VALUES ('old.ulg', 100, 1000, 7)");
+		sqlite3_close(db);
+	}
+
+	LogDatabase database(workspace.db(), workspace.logs(), kTargets);
+	CHECK(database.ok());
+
+	const auto logs = database.all_logs();
+	CHECK(logs.size() == 1);
+	CHECK(logs.front().path == "old.ulg");
+
+	// And the new column is usable, not just present.
+	const auto sync = database.sync_index({px4("old.ulg", 100, 1000), px4("new.ulg", 200, 2000)});
+	CHECK(sync.inserted.size() == 1);
+	CHECK(database.newest_log_id().has_value());
+}
+
 void a_database_with_no_predecessor_is_untouched()
 {
 	Workspace workspace;
@@ -449,6 +508,7 @@ int main()
 	first_index_needs_a_non_empty_listing();
 	newest_is_newest_for_both_stacks();
 	a_log_that_leaves_the_vehicle_keeps_its_history();
+	a_growing_log_is_still_on_the_vehicle();
 	a_growing_log_is_a_different_log();
 	requests_drive_the_queues();
 	a_downloaded_log_with_no_file_is_not_downloaded();
@@ -457,6 +517,7 @@ int main()
 	ardupilot_name_reuse_does_not_overwrite();
 	ids_for_everything_respect_target_state();
 
+	an_older_schema_is_migrated();
 	the_upgrade_does_not_refetch_or_reupload();
 	the_upgrade_runs_once();
 	a_missing_legacy_file_is_fetched_again();