[Tracker] AeroFTP 4.1.7 - Known issues, patches & updates

[axpnet]

AeroFTP 4.1.7, Rolling Tracker

Umbrella issue for the next AeroFTP point release (v4.1.7): known issues reported against v4.1.6 and the patches/updates landing on main after the v4.1.6 tag.

Status note: the current release line is v4.1.6 (release notes, its tracker is #422, now closed); this tracker collects what lands on main for v4.1.7.

Before opening a new issue, please check the lists below. If your problem is already tracked here, just add a thumbs-up reaction or a comment with your environment (OS, version, provider) instead of filing a duplicate. We update this issue as bugs are found and fixed.

Found something that is not listed? Open a new issue and we will link it here.

What shipped in 4.1.6

See the v4.1.6 tracker (#422) and the release notes for the full 4.1.6 change set: the AeroRsync Y-RSC wave closing the distance to stock rsync (md4 and sha1 as first-class negotiated checksums in both roles with the whole-file reconstruction genuinely verified, symlinks end-to-end on unix, streaming download signatures, and retirement of the legacy RSNP server stack so production has one path against stock rsync --server), a stabilised DAG transfer engine (process-global hierarchical governor, durable multipart checkpoints, journal-aware verify and commit, a streaming work frontier bounded over ten million items, endpoint-aware adaptive AIMD, SizeFair scheduling, and five more providers on native multipart workers), MTP and WPD portable devices as a new protocol with its own fingerprint-keyed profile type, AeroCrypt v4 keyslots so a vault unlocks from more than one credential without re-encrypting, measured performance work (multi-file FTPS from 8-18% behind rclone to parity, the FTPS single-stream default 41% ahead, an opt-in SFTP read-ahead about 58% ahead at 12 connections), and the AUDIT-03 sync stack audit closing a remote command execution through a crafted remote filename in rsync-over-SSH plus a class of scan-completeness holes that could drive mass deletion off a truncated listing. 47 languages translated.

Patches & updates queued for 4.1.7

Landed on main after the v4.1.6 tag; shipping in v4.1.7.

#	Type	Change	Status	Commit	Ref
1		winget publishes both installers again, so the package stops duplicating one and stops losing machine-scope upgrades. Details.	🟢 done	7bd78ccf5	winget-pkgs#407642
2		Published release assets are immutable, so re-running a tag build can no longer swap the binaries under a manifest that already pinned their digests. Details.	🟢 done	d3a03d135	winget-pkgs#407672
3		The periodic russh unblock check now tests the actual blocker instead of always failing for the wrong reason. Details.	🟢 done	23b39ee32	dependabot
4		The public rsync comparison now separates what AeroFTP does at another layer on purpose from what is genuinely not implemented yet. Details.	🟢 done	382c638c8	-
5		Nextcloud features are detected by asking the server, not by how the profile URL was typed. Details.	🟢 done	63636e867	-
6		The server-side trash is reachable from the CLI. Details.	🟢 done	63636e867	-
7		size names the real reason a figure is a lower bound. Details.	🟢 done	63636e867	-
8		The AeroRsync vs rsync comparative benchmark measures what it claims again. Details.	🟢 done	2f0a1087c	-
9		The trash manager showed a raw i18n key as a column header. Details.	🟢 done	683d669df	-
10		AeroRsync now speaks the extended-attribute block that rsync appends to a file-list entry, the first real step toward metadata parity with the native client. Details.	🟢 done	ab8067126	-
11		The update toast shows the completed download, and the verification badge says what was actually verified. Details.	🟢 done	60e09505b	#459
12		AeroRsync now handles the extended attributes that are too large to fit in a file-list entry. Details.	🟢 done	bdee1d737	-
13		The three decisions that control whether extended attributes are on the wire now come from one place instead of three. Details.	🟢 done	b926656e7	-
14		The Snap GUI paints again, and CI now proves it with a captured frame instead of a log line. Details.	🟢 done	04e477318, d688efadc, d3c5f71d8	#462
15		The AeroRsync Docker lane no longer dies on a Docker Hub timeout before any protocol test runs. Details.	🟢 done	92202590a	#467
16		The intermittent invalid rsync protocol version: 2015297409 failure is fixed: the write path was discarding the server preamble. Details.	🟢 done	cbc6701d8	#467
17		AeroRsync can now read and apply local user.* extended attributes when a session opts into -X (B3), without changing any default transfer. Details.	🟢 done	4235b8664, 5dcc3a904	#467
18		A portable install can be deleted again, because the vault files no longer lock out the user who owns them. Details.	🟢 done	1c455ff4d	-
19		Linux builds now ask EGL before switching WebKit's GPU compositor off, instead of switching it off for everyone. Details.	🟢 done	a740a3291, d000d41b9	#466
20		The pricing filter on Add Service is a preference again, not a per-visit choice. Details.	🟢 done	7dcc3ce59	#274
21		A dropped profile lands on the blue line instead of one row past it, and a stale text selection no longer locks a row in place. Details.	🟢 done	512b18a6f	#453
22		Zoho WorkDrive moves a file or folder across directories again. Details.	🟢 done	ec9899891	#451
23		Jottacloud delete and Move to Trash work, end to end, confirmed against a live account. Details.	🟢 done	5bf8f57ee, b721d66dd	#397
24		A folder deleted on MEGAcmd goes to the Rubbish Bin, like a file does. Details.	🟢 done	c27d64b16	#397
25		One delete action on Jottacloud instead of two that did the same thing. Details.	🟢 done	2f26f4ac1	#397
26		TAB.DIGITAL is capitalised on the documentation site too, and the suggested profile name is a brand name rather than an internal slug. Details.	🟢 done	02f80507e, docs 12424a2	#347
27		An exported profile carries the OAuth app that refreshes its token, and the region that picks its data centre. Details.	🟢 done	f16b8934d	-
28		The health cell stops being a drag handle exactly when it becomes a button. Details.	🟢 done	cf36833f5	#453
29		A 4shared profile carries its own token and its own app, and a profile exported from an install that never migrated its credentials can refresh again. Details.	🟢 done	de5b9f6ab	#469
30		The multipart resume test cancels from inside the part instead of from a poller, so it stops reporting a scheduling accident as the defect it guards. Details.	🟢 done	2671a9f47	#470, #488
31		AeroRsync preserves user.* extended attributes end to end against stock rsync, and turns -X on in production on Unix. Details.	🟢 done	f6f91f930, 77e38681a, a39e7d6f7	#471
32		The AeroRsync lane 3 gate reports a Docker Hub outage instead of exiting 0 on it. Details.	🟢 done	43c3c1b7f	#481
33		Reading extended attributes no longer follows a symlink to its target, which would have broken symlink uploads now that -X is live. Details.	🟢 done	964e44734	#482, #487
34		The "attributes before rename" invariant is pinned, so moving that block can no longer pass unnoticed. Details.	🟢 done	fe9e8db1e	#483
35		A batch transfer carries the extended-attribute policy of the transport that opened it, instead of dropping it in silence. Details.	🟢 done	5acfd3bbe	#484
36		The snap GPU gate now checks the whole graphics userspace instead of two filename patterns, and the first thing it caught was that the migration it guards has never actually been packaged. Details.	🟢 done	028ef4d01	#485, #465
37		The durable checkpoint store is a parameter now, so a test can no longer reach into the developer's own configuration, which is where the reopened #470 flake was actually coming from. Details.	🟢 done	97c8bab9e	#488, #470
38		The two acceptance gaps that #484 and #482 each declared open are closed against a real rsync, and one of them corrects what #482 predicted would happen. Details.	🟢 done	1a5f47973	#487, #484, #482
39		Six reports from Ehud closed in one pass, two of them cases where an earlier fix was correct and incomplete. Details.	🟢 done	4c810ee76, b02b98e4d, 7ef33a44f, 97a17ea23	#274, #277, #347, #369, #486
40		A NAS that is too old for zstd gets real delta sync again, and the bug that hid it was one predicate asking the wrong question. Details.	🟢 done	b6de141cb, 9660e3847, a2afd6b86, bfa3c8048, d6d4f2aae, 0c084c2ba	#491
41		The Checksum tab says what a backend can hash before you click, and hashing works inside the Overlays Path again. Details.	🟢 done	4b68a188c	#494, #347
42		The status bar describes the page you are on, and 📜 Log joins ↑↓ Queue. Details.	🟢 done	170967239	#493, #347
43		The README logo grid is generated from the catalog, so it cannot drift from the other two public tables or list a company twice. Details.	🟢 done	e9fdc8bec	#495, #347
44		Blomp (40 GB, OpenStack Swift) is a production provider now, after its API turned out to work. Details.	🟢 done	a205ba2c2	#496, details
45		AeroSync Compare stopped reporting "no differences" over a folder that is not, and Filen stopped dating every upload at the moment it was transferred. Details.	🟢 done	5a7efeecb	#497, details, #347
46		We were advertising four compressors while driving two, and ranking one we cannot drive above one we can, so a NAS-era peer lost its delta to our own capability list. Details.	🟢 done	d6951d72f, 11c1777f2	#498
47		Three russh advisories are closed in the tree, and cargo audit was never going to say so. Details.	🟢 done	616140317	#489
48		The snap stopped shipping a payload its own base cannot load, and the invariant is now proven before publishing instead of assumed. Details.	🟢 done	19519567d, fb44b9a91, d94cee4cb, edfe61f0f	#461, #460
49		The md4 bump stops coming back every Monday. Details.	🟢 done	2b07ce5d5	#490
50		Nine routine dependency bumps, merged in two groups split by risk. Details.	🟢 done	94c5d33d2	#472, #473, #474, #475, #476, #478, #479, #480, #492
51		The exit condition on the n0-mainline fork is watched now, and the check that was supposed to watch it had quietly become a liar. Details.	🟢 done	950267687	#499
52		The Quick Connect buttons stopped showing the Google Drive and OneDrive marks that were retired in 2026, and the last 20 untranslated keys are translated in all 46 locales.	🟢 done	41754e855	#500, details, #347
53		Two parity-matrix claims that nothing was checking, found by asking every 🟢 row which test proves it. Details.	🟢 done	be9537c17, 87f011461	#501
54		The n0-mainline watcher could not tell "still blocked" from "I no longer work", which is the one failure it was written to prevent. Details.	🟢 done	9ea9bc95b	#503
55		AUDIT-04 hardened AeroTools across hostile imports, secret-bearing exports and remote probes. Details.	🟢 done	82d0f1ebc	#504
56		Deterministic proof that the Linux file chooser really leaves the process, plus a finding that the source comment about the no-portal case is wrong. Details.	🟢 done / fixed (pending release)	b9ea098f7	#464, #505
57		The last open finding of the parity sweep is closed: the mtime applied to a downloaded symlink is now asserted, and the helper that applies it no longer swallows its own outcome. Details.	🟢 done	186ddf5ee, 91f7bed0f	#508
58		The 29 linguist proposals that were left outside the review's perimeter are closed, and three of them turned out not to be defects at all. Details.	🟢 done	cdf7069d8	#509
59		The file picker that did nothing now says why, in all 68 places, and the mechanism the previous row blamed for the silence was the wrong one. Details.	🟢 done / fixed (pending release)	5d9b47f9c	#510, #515
60		The titlebar would not drag from its right half, and AeroSync could not export a template in any of its four formats. Details.	🟢 done / fixed (pending release)	6d497ba21, 644e27791	#511, #514, #516
61		aeroftp-cli connect reported a plausible port and an empty username instead of the real ones, because it rebuilt them by parsing the human server_info text. Details.	🟢 done	687d6d597, bb463d1cb	#507
62		The build toolchain moved to TypeScript 7, which is a release-note item and not a lockfile detail because tsc sits on the production build chain. Details.	🟢 done	64efc8f56	#413
63		A 46-locale linguist round, and the contradiction that round itself introduced in the S3 ETag caveat by saying an ETag is both omitted and advisory. Details.	🟢 done	56dbd12d8, 249adf75	#502
64		Ehud triage across seven reports, plus two defects the review pass surfaced: a traversal guard missing from server_copy, and the AeroCrypt modal rebuilding the silent salt downgrade. Details.	🟢 done	c5369ee22, d75887175	#506
65		The company is called Drime, not Drime Cloud. Their own title tag and page body say Drime; "Drime Cloud" appears only inside the app.drime.cloud URL. The catalogue also had it inverted, company: 'Drime Cloud', parentCompany: 'Drime', as though the drive were a product under a parent the way pCloud Drive sits under pCloud. README, docs/PROVIDERS.md and cli_catalog.json are regenerated from the corrected entry. Details.	🟢 done	52d907d3c	#520
66		AeroSync stopped deleting the Plan and Sync settings on a tab switch. The tabs are rendered conditionally, so leaving one unmounts it and React drops all fourteen of its state values; they now live in a store owned by the dialog. Asked as "how am I supposed to schedule a Plan with Update if the settings are deleted", which was the right question. Details.	🟢 done	2969103b3	#519
67		The fuzzy duplicate distance was a hash value, not a distance. .max() of the members' signatures rather than of the hamming distances between them, on the raster and text arms both, so a pair two bits apart could report billions and any sort by similarity was meaningless. Test pins it and fails on the old expression. Details.	🟢 done	5c92e91c4	#519
68		Find Duplicates shows the hashes, sorts by similarity and takes a cutoff. Per-file signatures behind a toggle, identical groups first then closest-first, and a Fuzzy cutoff field: the threshold had never reached the engine, so the per-type defaults were the only thing anyone could run. Details.	🟢 done	5c92e91c4	#519
69		The crypt toggle leaves the path bar outside the Overlays Path even when the vault is locked. Locking cleared the session overlay and the badge read its anchor from there, falling back to a value that means "the whole remote is the anchor", so the grey toggle rendered in plaintext folders and the jump button never appeared. Details.	🟢 done	0fc60cdd2	#519
70		Compare and Find Duplicates show files, folders, bytes, depth and elapsed time while they scan. Compare needed no new backend: the events had been emitted since the recursive scan landed and nothing listened. Find Duplicates emits its own, throttled so the reporting cannot slow the scan. Details.	🟢 done	197ba20a5	#519
71		One sortable trash table for all seventeen providers. Sorting, a Type column, a Name header that lines up with the names, timestamps on one line, Shift ranges, Ctrl adding and a rubber band, in a shared component rather than seventeen copies of the same table, none of which had any sorting at all. Details.	🟢 done	621946b88	#519
72		Copy and open buttons on every duplicate row. The Copy glyph in that dialog was decorative, so comparing two candidates meant reading the path off the screen with an OCR app. Copy on the name and on the folder, plus open in the default app and reveal in the file manager. Details.	🟢 done	197ba20a5	#519
73		My Servers says which providers encrypt on this device. The badge Add Service has always shown, now next to the saved profile name, with both surfaces reading one list and a test holding them to it. MEGA S4 stays unbadged on purpose: it is S3 and the server holds the keys. Details.	🟢 done	f3287f23d	#519
74		The last four Tab.digital on the docs site were in the VitePress data and config modules, which the 27 July markdown sweep could never reach: the plan snapshot heading, its source label, the sidebar entry and the meta keywords. Verified on the built artefact, zero mixed-case occurrences across the generated site. Details.	🟢 done	3e81e42	docs#4
75		A failed portal session no longer reports a cascade of chooser regressions. An app_ready environmental miss is retried once with a visible log line; if it still fails, the gate emits one primary failure and skips every assertion whose evidence the session could not produce. Details.	🟢 done	6b748fe08	#521
76		A slow Ubuntu mirror stops looking like a broken commit. Details. The delta-sync fixture job died twice in its 25 minute cap inside apt install, cancelling the job with every test skipped. The packages come from the Actions cache now, and the step has its own budget	🟢 done / fixed (pending release)	3b6cde409	#518
77		An STS session token stops being replayed to whatever host an S3 redirect names, and a hostile rsync peer stops being able to land a setuid binary. The S3 client had no redirect policy and x-amz-security-token is not on reqwest's strip list; aerorsync applied the peer's mode with & 0o7777 in two sites. Details.	🟢 done / fixed (pending release)	f9b77aca8	#526
78		Discover stops promising a perpetual free tier on three providers that only offer a trial, and Blomp's free quota is corrected to 40 GB. AWS S3 and Azure Blob give 5 GB for 12 months, Alibaba OSS 1 to 3 months. Details.	🟢 done / fixed (pending release)	5768937e3	#528
79		Four Major review findings left open on merged PRs are closed (E2E catalogue multiline matcher, portal empty-bus fail-closed, NetworkMonitor v3 pin, speedtest cancelable mkdir, refuse public web roots as speedtest remote_dir). Details.	🟢 done / fixed (pending release)	981e64e63, 2fad7a153	#525
80		Twelve Minor review findings from the post-merge pass (Drime 20 GB copy, Duplicate Finder open errors, FileLu trash date, dedupe oversize skip, local scan final tick, fuzzyCutoff i18n). Details.	🟢 done / fixed (pending release)	05d30ec41, 182a1e3c9, 3c7db9c89	#525
81		CLI catalog New(N) pages 20 rows with Enter=next, and the connect-metadata pin names what it tests. Details.	🟢 done / fixed (pending release)	e8df66b98	#525
82		My Servers table drag under a protocol chip reorders the visible list, not the wrong vault slots. Details.	🟢 done / fixed (pending release)	259ea7548	#453, #525
83		Portal gate cold-start: one precondition red instead of eleven chooser accusations, with a no-build pin and selective app_ready retry. Details.	🟢 done / fixed (pending release)	40a5a880b	#521, #525
84		The Tauri commands that blocked stopped doing it on the window's thread. Details. A synchronous #[tauri::command] runs on the GTK thread, so list_subdirectories walking a dead network mount froze the whole window. The scoping count was wrong too: 82 synchronous out of 853, not 38	🟢 done / fixed (pending release)	c2f7e489d	#517
85		The Speed Test no longer leaks a connected session when cancelled mid-setup, and the public web root guard now rejects everything inside a protected tree (descendants, per-user public_html subtrees, and paths that only land in one after ./.. resolution), while the portal gate stops turning a missing baseline into a chooser-shaped red. Details.	🟢 done	af109a068	#525, #534

Requested / under consideration

Community requests and internal follow-ups being evaluated for this or a later release.

Effort: 🟩 quick win · 🟧 medium · 🟥 large / epic. Ordered by effort (quick wins first).

#	Effort	Type	Request	Status	Source
1	🟧		Eager-evaluation preview and a single-vs-multi-target placeholder for the -i selectors (prioritised by the reporter ahead of Edit(E) and the 2-letter semantics; exact behaviour to be pinned)	🔵 idea	#311 (@EhudKirsh)
2	🟥		Lossless .jpg to .jxl transcode in AeroFile: JXL re-encodes an existing JPEG losslessly and reversibly (the original JPEG bytes reconstruct exactly), for a real size win with no quality loss. Candidate framing: AeroFile as a GUI for libjxl	🔵 idea	aerovault#2 (@EhudKirsh)
3	🟥		macOS shell integration for the OS extract feature (Deliverable G macOS, deferred): Finder Sync "Extract Here / Extract to Folder" menu items mirroring the Linux Nautilus and Windows verbs, plus macOS custom document-type icons (CFBundleDocumentTypes) for the five aero formats and the generic fallback, and rebuilding the mimetype .icns multi-size (the v4.1.0 ones are single-resolution drafts). Needs a Mac to build and live-test	🔵 planned	#361 (Deliverable G)
4	🟥		Filen Encrypted Notes: exit Beta: take Filen Notes out of Beta. Fix the participants/add contactUUID format (currently a best-effort workaround), investigate the Filen free-plan 10-note limit ghost-note cleanup, and add a rich text editor for the rich note type	🔵 planned	-
5	🟥		PRIORITY: Linux tray/GTK heap corruption, still-uncovered off-main-thread corruptor. A GDBus worker thread aborts with malloc(): unaligned fastbin chunk detected while deserializing a D-Bus message, the classic GLib heap-corruption signature (that worker is the victim tripping over an already-poisoned fastbin, not the corruptor). Two marshalling fixes already shipped and are safe: tray badge (31db84f8b) and app_ready + splash-timeout (cae95ee91), present since v4.0.5. But the SIGABRT STILL recurs (v4.0.9 on 2026-06-25, and the v4.1.2-era build on 2026-07-05, identical signature): the marshalling is INCOMPLETE, a still-uncovered off-main-thread GTK path remains. Sync Tauri commands are provably main-thread (safe), so the suspects are the event/plugin callbacks whose thread context is unconfirmed: tray on_menu_event / on_tray_icon_event, the single-instance plugin callback, and on_window_event CloseRequested. Pre-existing across versions, intermittent, triggered by D-Bus storms on suspend/resume or monitor standby; it can corrupt the whole app until restart. Definitive path (owner-approved): adopt self-hosted crash reporting with native minidumps to capture the real corruptor, plus an ASan/valgrind repro, then finish the marshalling on the remaining callbacks	🔵 planned	-
6	🟥		User-supplied custom CSS snippets (Obsidian snippets-folder style) to restyle app chrome such as the preview scrollbar, applied across desktop and future mobile. Noted when the preview scrollbar was widened in v4.1.1	🔵 idea	#347 (@EhudKirsh)
7	🟥		Recommended-protocol highlight on the Add Service / Quick Connect pages, after real benchmarks land (#368)	🔵 idea	#274 (@EhudKirsh)
8	🟧		File association opt-out (deferred, design parked): two switches, AeroFTP's own five formats vs the eight general archive formats, with the choice persisted in HKCU\Software\AeroFTP\Settings and re-read by NSIS_HOOK_POSTINSTALL so an in-app update cannot silently restore it (POSTINSTALL runs on every install, and an update is an install), plus a /NOASSOC setup switch. A visible components-page checkbox is out of reach without forking the Tauri NSIS template, which is why it is parked rather than half built. Raised in #454; deferred because AeroFTP never claims the default handler for the general formats, it only adds itself to "Open with" plus its own context-menu entries, so with the uninstall residue fixed (queued #59) what remains is menu visibility	🔵 planned	#454
9	🟧		CLI / GUI / MCP parity audit across the whole inventory. Three independent findings on 2026-07-25 converge on one root cause: capabilities implemented in the engine, exposed to the GUI, absent from CLI and MCP. (a) ssh_exec.rs / ssh_shell.rs exist and ssh_shell_* are registered Tauri commands (lib.rs:19360), but none of the 92 CLI subcommands and no MCP tool expose them, and MCP's server_exec is file-ops only (ls/cat/stat/find/df) despite the name. (b) nextcloud_empty_trash() (webdav.rs) was reachable only from NextcloudTrashManager.tsx; same for the Koofr, pCloud, Yandex and Dropbox trash managers. Cost already paid: 30 GB of Nextcloud trash on the lab server that no command-line tool could reclaim, diagnosed over SSH with occ instead of one click. Partially closed: the trash surface now exists on the CLI (aeroftp-cli trash list/empty/restore/delete), SSH exec/shell does not. The repo already has the instrument to close the class rather than the instances: diffing aeroftp-cli inventory against the #[tauri::command] set registered in lib.rs yields the full gap list in one pass	🔵 planned	-
10	🟧		The durable checkpoint store has no ceiling and no way out for orphans. Queued #37 closed the test-isolation half of this, so the suite no longer writes into a real user's configuration, but it did not touch the retention rule and was deliberately kept separate from it. stale_nonterminal() only surfaces records past the 7-day TTL, and the scavenger then aborts only those whose provider, protocol, host and account match the endpoint you are currently connecting to. So the condition for cleaning a record is going back to the very server that produced it: stop using a server and its records are not old, they are immortal. Nothing else prunes them, and there is no cap on the directory. The machine where this was found held 325 records accumulated since 21 July, all from mock endpoints that by construction nobody will ever connect to again, which is the pathological case of the same rule a real user hits with a decommissioned server. Wants a decision rather than a patch, since each option has a different failure mode: a hard cap loses the oldest resumable transfer, a global age sweep abandons a session the user might still want, and an explicit "forget this endpoint" is honest but manual. Worth deciding before the store grows on a user's machine rather than a developer's	🔵 idea	#488, 20260728T074500Z-E4-flaky-multipart-cancel-ROOTCAUSE.md
11	🟩		Two hardening items found on the #497 review, bundled for the next pass. Neither is a live defect on the shipped path, which is why they were not folded into #497: the first is unreachable from the current GUI and the second is a diagnosability gap, and both were verified against the code rather than taken from the review as read. (a) The compare's overlay-key precedence is imprecise. resolve_compare_overlay_keys consults this connection's cached overlay whenever the kind matches, without checking that vault_id has the provider-overlay:<kind>:<owner> sentinel shape. Today no caller can reach it: the command is called only by the GUI, and every non-null write of rcloneCryptVaultId / aeroCryptVaultId builds a sentinel, so a real standalone vault UUID never arrives, which also makes the documented vault-map fallback dead code for this command. The moment one does arrive (and the CLI / GUI / MCP parity audit on row 9 is exactly the work that would wire it) the cache would silently outrank a vault the user named explicitly, normalize with the wrong key material, drop every row and read as "no differences": the very symptom #497 closed. Gating the cache branch on the sentinel shape restores the rule that an explicitly named vault wins, and leaves the error surface unchanged (a sentinel with a mismatched kind still falls through to "Crypt vault is not unlocked"). To be taken with a test that passes a real UUID while the cache is armed on the same kind, otherwise the guard is removable as redundant later, which is the same trap already closed for the normalization guard. (b) The Filen multipart mtime capture fails silently. begin_multipart_upload reads the source mtime through tokio::fs::metadata(p).await.ok(), so an I/O error is swallowed and the commit stamps its own time, indistinguishable from the regression #497 just fixed, with no log line to separate the two. filen_log already exists, so it is a match in place of .ok() with the fallback unchanged	🔵 planned	#497 (CodeRabbit review 4800472122)

Known issues found after release

Reported against v4.1.6. Carried over from the #422 tracker where still open.

#	Area	Description	Status	Linked issue
1	OAuth / pCloud	pCloud trash returns "⚠ Authentication failed: Log in required"; the crypt error is gone, a residual OAuth token/scope issue remains on the trash surface. Code review (4.1.6): the trash path is already correct, it authenticates with the access_token query param (pCloud rejects the Bearer header on trash) and refreshes via get_valid_token (both since v3.1.4), with the crypt fix in d1e0bef90, so no code defect remains. The residual is a stale-token / re-auth condition, pending a live re-auth re-test. Carried over from #422 known issue #4	🟡 investigating	#397
2	Security / dependencies	Closed on main by queued #47. Three moderate russh Dependabot advisories (GHSA-g9hv-x236-4qp3, GHSA-5xvq-cp9x-6p6r reachable client-side; GHSA-cqjc-rmpq-xprq server-side only, not reachable), all availability-only panics, all predating v4.1.6 and disclosed in the v4.1.6 release notes. The fix is russh 0.62.4, which was previously unreachable because it requires ed25519-dalek ^3 against the =3.0.0-rc.0 exact pin held by n0-mainline in the iroh P2P graph, with both upstreams already at their newest release so no local version selection resolved it. It is resolved now by a [patch.crates-io] on axpdev-lab/n0-mainline pinned by rev, which is the v0.5.0 release commit plus the single line that relaxes that requirement, and 3.0.0-rc.0 is gone from the lockfile. Two things stay true and should not be read as closed by the green: cargo audit still reports clean because none of the three has a RustSec counterpart, so only the Dependabot graph surfaces them and its silence certifies nothing; and the patch section carries an exit condition that nobody is watching automatically, namely delete it as soon as n0-mainline publishes a release admitting 3.0.0 final, still not the case upstream on 2026-07-28. Analysis in docs/security-evidence/RUSSH-DEPENDABOT-ADVISORIES-2026-07.md; re-check with .github/scripts/check-russh-unblock.sh (queued #3)	🟢 done / fixed (pending release)	dependabot
3	CI / AeroRsync integration	native_rsync_upload_against_stock_rsync_preserves_bytes intermittently failed with a preamble desync; root cause found and fixed on main (queued #16). The upload leg of the stock-rsync integration lane failed with HardRejection(InvalidFrame): server preamble: invalid rsync protocol version: 2015297409 (bytes 81 ff 1e 78), then passed on rerun with no code change, twice on 2026-07-25 (3deea6f3f and 63636e867) and again later. The value was identical every time: LE 81 ff 1e 78 is the server preamble starting at offset +4 after a discarded 4-byte protocol version. Root cause: ssh2::Channel::flush → libssh2_channel_flush_ex empties the read buffer, so a flush after writing the client preamble could drop the already-arrived server reply under CI contention (upload more often than download). Fix in cbc6701d8 removes that flush from the raw write path and frame writes, with a unit pin for the misaligned value. Delta Sync Integration and Aerorsync Protocol (including Docker lane 3) green on the merge of #467	🟢 done / fixed (pending release)	#467

_{Status legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released}

Affected platforms

• Windows
• macOS
• Linux

---

Maintained by the AeroFTP team. Current release v4.1.6 (#422), next v4.1.7. Patches accumulated here; each release line still gets its own tracker.

[axpnet]

Post-v4.1.6 cleanup: winget unblocked, release assets made immutable, and the rsync parity story told honestly

Post-4.1.6 follow-up, done on main, shipping in v4.1.7.

Four things landed today, all of them consequences of the v4.1.6 release audit rather than new work. The winget 4.1.6 submission was blocked; fixing it properly surfaced a second, older defect in the same area that had been quietly breaking an old published version since April.

Area	Description	Status	Ref
Distribution / winget	The 4.1.6 manifest listed the same x64 NSIS .exe twice, differing only by InstallerSwitches, which is not part of the installer identity tuple, so winget rejected it as DuplicateInstallerEntry. Root cause was on our side: installers-regex had been narrowed to the exe alone to dodge a then-failing wix validation lane, while the previously published manifest still declared two installers, and komac builds a new version on the shape of the previous one. It filled the spare slot by repeating the one asset it had. The same thing had already cost the 4.1.5 submission. The regex now matches both release assets, and the 4.1.6 manifest was regenerated with komac 2.16.0 to the correct pair, x64 nullsoft scope user plus x64 wix scope machine	🟢 fixed	7bd78ccf5
Distribution / release integrity	softprops/action-gh-release defaults to overwriting existing assets, so re-running a tag build deleted and re-uploaded every artifact. The builds are not byte reproducible, so the replacement carried different digests under identical filenames, silently invalidating anything that had already pinned them. overwrite_files: false on all four upload steps makes published assets immutable: a re-run now repairs a partial release by uploading only what is missing, and replacing an asset requires a deliberate manual delete	🟢 fixed	d3a03d135
Distribution / winget 3.3.5	That overwrite behaviour had already bitten. Both v3.3.5 Windows assets were rebuilt and re-uploaded on 2026-04-03 after the winget manifest had been cut, so winget install axpnet.AeroFTP --version 3.3.5 has failed its hash check ever since. Microsoft's wingetbot detected it correctly and proposed the same fix seven times since 2026-06-09, but its automation only corrects the .exe digest and leaves the .msi one stale, so every attempt failed validation and was closed. Both digests are now corrected in one submission	🟢 fixed	winget-pkgs#407672
Security / dependencies	The recorded follow-up for the three russh advisories was to re-run cargo update -p russh --precise 0.62.4 each session and treat success as the all-clear. That command cannot succeed and cannot fail for the right reason: Cargo.toml requires ^0.61.2, so cargo rejects 0.62.4 against the requirement and never attempts the resolution where the ed25519-dalek conflict lives. The check is now a script that raises the requirement in a scratch manifest, resolves for real, restores the tree unconditionally, and separates the outcomes by exit code	🟢 fixed	23b39ee32
Docs / AeroRsync	The public rsync comparison listed everything rsync does and AeroRsync does not in a single block, putting a deliberate architectural boundary and a real backlog item in the same bucket. Now split into "out of scope by design", where the authority lives at another layer or it is a different transport, and "not yet implemented", the genuine parity gap ordered by effort	🟢 fixed	382c638c8

An audit ran alongside the 3.3.5 fix, to establish whether the asset drift was isolated or a pattern. Every published winget version was checked against the Sigstore bundle shipped next to each asset in the same GitHub release:

Check	Result
Published versions swept	81, from 2.9.2 to 4.1.5
Installer entries verified against their Sigstore attestation	150 of 162 clean
Not verifiable	10, all in 2.9.2 to 3.1.2, which predate release signing
Digest mismatches	1 version, 3.3.5, both installers

Two independent methods agree on the same single answer: Microsoft's own hash detector flags 3.3.5 and nothing else, and the Sigstore sweep flags 3.3.5 and nothing else. The drift is a one-off, and the immutability fix above closes the mechanism that caused it.

On the parity split, the substance rather than the wording: --delete, --backup and --link-dest are out of scope because deletion and retention belong to AeroSync and AeroCloud, together with the scan-completeness gating and archive-before-propagated-delete helper hardened in v4.1.6 (AUDIT-03), and a wire-level --delete would install a second, weaker deletion authority underneath the one just hardened. --inplace, --append and --partial-dir are out of scope because the destination write strategy is owned by StreamingAtomicWriter, whose kill-9 invariant --inplace would weaken rather than extend. Wire-level filters are covered a layer up by .aeroignore, fail-closed since v4.1.6, and their residual cost is session count rather than correctness. rsync:// daemon mode is a different transport. What genuinely remains is metadata: xattr is the first real candidate, ACL follows it because it builds on xattr in rsync's own implementation, and hardlink is last because it is blocked structurally rather than by effort, needing a device and inode map across a whole file list that a single-file accelerator does not have. owner and group were in neither list before and are now recorded: uid, gid and their resolved names are already emitted in the file-list entry because the wire format requires it, but StreamingAtomicWriter::finalize applies only mode and mtime.

Verified green: .github/scripts/pre-push-gate.sh (cargo fmt, security regression suite, the R10 version consistency check across 7 version files) on both pushes, Checks green on CI for 7bd78ccf5 and d3a03d135, and both edited workflow files parse as valid YAML with all four release upload steps confirmed covered.

[axpnet]

The Nextcloud trash was unreachable from the CLI, and the reason was one string comparison

Post-4.1.6 follow-up, done on main, shipping in v4.1.7.

This batch started as a disk-space cleanup on the lab server and turned into three product defects, one of them user-facing on every Nextcloud-class profile. Reporting it in the order it was found, because the order is the point: each finding was only visible because the previous one had been fixed.

Area	Description	Status	Ref
WebDAV / Nextcloud	nextcloud_base_url() and is_nextcloud() decided whether a server was Nextcloud by searching the CONFIGURED url for /remote.php/. A profile saved as the bare origin browses perfectly, because connect resolves the real root by itself, but reported Not a Nextcloud instance and silently lost its trash manager and share links. Confirmed across three profiles on genuine Nextcloud servers: the two saved with a bare origin were degraded, the one saved with the canonical path worked. Both servers announce themselves on status.php (productname: Nextcloud) and in the WWW-Authenticate realm; neither signal was consulted. Both functions now delegate to the layered is_nextcloud_for_dav() that already existed in the same file for chunked upload	🟢 fixed	63636e867
CLI parity	nextcloud_empty_trash() shipped as a Tauri command wired to NextcloudTrashManager.tsx and reachable from nowhere else. A server filled by our own benchmarks could not be reclaimed from the command line, which is why the first diagnosis went out over SSH with occ instead of one click. Adds aeroftp-cli trash list/empty/restore/delete	🟢 fixed	63636e867
CLI honesty	UsedScan.truncated conflated three causes, so a scan stopped by permission denied reported scan capped (depth 100 / 500000 entries) after reading exactly zero entries. Split into unreadable_dirs / hit_cap / cancelled	🟢 fixed	63636e867
AeroRsync benchmark	Four compounding defects made the comparative suite report wrong numbers when run per its own doc comment	🟢 fixed	2f0a1087c
i18n	contextMenu.trashOriginalPath rendered as a raw key in the trash manager on every Nextcloud profile. Added in all 47 locales	🟢 fixed	683d669df

Live result of the trash work, on real servers:

Endpoint	Before	After
Lab Nextcloud	Not a Nextcloud instance	221 items, 21.4 GB reclaimed
Second Nextcloud profile	no trash surface at all	1 item listed
Third Nextcloud profile	already worked	35 items, 3.7 GB reclaimed, no regression
Lab server disk	77% used	20% used, 58 GB free

On the benchmark, the finding worth remembering: the suite was not idempotent, so from the second execution onward the cold-upload scenario found its target already on the remote and measured a no-op, while keeping the label cold-upload. That is 49 bytes in 481 ms instead of 52 MB in ~1 s. A periodic regression suite would have read a spectacular improvement where the test had stopped doing anything, and it took three consecutive runs before the pattern was visible. Separately, running the three scenarios concurrently against one container inflated the cold upload to 9.49 s against 1.008 s serialized: a 9x artefact that reads exactly like a regression, and was very nearly reported as one. Re-verified against the 2026-07-21 baseline from a clean state: 52,436,493 bytes on the wire, byte-identical, 1.030 s and 1.026 s over two runs against 1.06 s then. No regression.

One correction to an earlier report in this tracker: aeroftp-cli size was described as silently returning 0 B on an unreadable path. That was wrong. It always printed (TRUNCATED) and warned the figure was a lower bound; the first report filtered stderr away. The real defect, now fixed, was that it named the wrong cause.

Verified green: .github/scripts/pre-push-gate.sh (cargo fmt, security regression suite, R10 version consistency across 7 version files, cargo audit over 1206 dependencies), the full library suite, cargo clippy clean, and the repo's own dispatcher_allowlist_matches_clap_subcommands guard, which caught the new subcommand missing from the dispatch allowlist before it could ship.

[axpnet]

AeroRsync learns the xattr block, without changing a single transfer

Post-4.1.6 groundwork, done on main, shipping in v4.1.7 (ab8067126, task X.2a of the AeroRsync xattr track).

rsync appends an extended-attribute block to every file-list entry once -X is negotiated. AeroRsync could not read or write it, which is the first concrete gap on the road to metadata parity with the native client. It can now, for the values that travel inline. Nothing negotiates -X yet, so no transfer behaves differently: the diff is 930 lines added and zero removed, and the frozen byte oracles pass unmodified. That was the gate for this step, and it is the reason the step exists as its own commit.

The wire shape is pinned against bytes measured on rsync 3.2.7 with --only-write-batch, not against a reading of the specification. An encoder that agrees with its own decoder and disagrees with stock rsync passes a round-trip test and fails on the wire, so the tests assert captured bytes.

Area	Description	Status	Ref
Wire codec	marker(varint) count(varint), then per attribute name_len(varint) datum_len(varint) name+NUL datum. Records are concatenated with no separator, so the count in the header is the only thing that says where the block ends. name_len counts the trailing NUL and datum_len is authoritative, so a binary value keeps its interior NUL bytes instead of being truncated at the first one	🟢 done	ab8067126
Three states, not two	-X off is zero bytes on the wire, -X on with no attribute is still two bytes, -X on with attributes is the full list. The type distinguishes all three because the wire does; folding the middle case into absence would desynchronise the stream	🟢 done	ab8067126
Above the inline limit	Past rsync's 32-byte MAX_FULL_DATUM the entry carries a 16-byte digest and the value travels out of band. That form is refused loudly at both ends rather than emitted or decoded in the wrong shape, so the unimplemented case cannot ship silently. It is the next task	🟢 done	ab8067126
Fail-closed on peer input	Every length in the block comes from the peer. Negative count, name length or value length, a zero name length, a name missing its NUL, and the abbreviated back-reference form all produce typed errors, and none can panic. Same stance as the S1 audit on peer-supplied symlink targets	🟢 done	ab8067126

Two defects were found and fixed during the work rather than left for the next session:

Area	Description	Status	Ref
Streaming receive	Truncation is reported as TruncatedBuffer, not as an invalid length, and the distinction is load-bearing. The file list is decoded from a buffer refilled one MSG_DATA frame at a time, and the receive loop retries on exactly three error shapes while everything else aborts the transfer. The first version classified "lengths past the end of the buffer" as an invalid field, so a block straddling a frame boundary would have killed a perfectly good transfer. Structurally impossible lengths must stay fatal, or a hostile peer turns the same loop into an unbounded frame pull. Not reachable today since -X is off everywhere; it would have surfaced when the sender side lands	🟢 fixed	ab8067126
CI lint	The new field pushed FileListEntry past clippy's large_enum_variant threshold, which the AeroRsync workflow treats as an error. Resolved with a justified targeted allow rather than by boxing: the enum is only ever built as an immediate return value and destructured on the spot, never held in a collection, so boxing would add a heap allocation and a free per decoded entry on the path the recursive tree sync will make hot, to save memory that is never held	🟢 fixed	ab8067126

Verified green: cargo fmt --all --check, cargo clippy --lib --features aerorsync --all-targets -- -D warnings, the full library suite at 3289 passed / 0 failed, the AeroRsync module at 570 / 0 including every frozen-oracle test unmodified, cargo check --lib with the feature off, a compile under --cfg ci_lane3 (which a normal cargo check --tests does not cover and CI does), and the full pre-push gate end to end including cargo audit, npm unit tests, typecheck and i18n validation.

On CI: Checks, Aerorsync Protocol (strict clippy with the feature, mock suite, and the Docker lane 3 against a real rsync 3.2.7) and Delta Sync Integration all green on ab8067126. The integration lane passed on its first run, without hitting the intermittent preamble desync tracked as known issue #3.

Three things this step deliberately did not do, recorded so they are not lost: the sender still reads no attribute from the local file, the negotiation flag is hard-wired off in two places that must be flipped together, and the symlink case is handled from a reading of rsync's own call order rather than from captured bytes, so it needs covering in the live acceptance lane.

[axpnet]

The update toast shows the 100% frame, and the badge says what Sigstore actually proved

Post-4.1.6 follow-up, fixed on main, shipping in v4.1.7 (#459, raised from a real v4.1.5 to v4.1.6 in-app update).

Three defects in the same surface. One is visible, the other two are about the app describing its own verification in terms that did not match what it had checked. The Rust verification path itself is unchanged: what changes is that the evidence it already produces now reaches the user, and that the states where there is no evidence stop borrowing the language of the states where there is.

Area	Description	Status	Ref
Progress	The percentage was capped at 99 while bytes streamed, and the only 100% event was emitted after Sigstore verification, one line before download_update returned. The frontend therefore received the completion and the result card in the same tick, so the green bar was replaced in the very frame it should have been visible. The backend now reports its phase (Downloading / Verifying / Complete) and emits 100% as soon as the artifact is flushed to disk, which is when the download is genuinely finished, so the bar completes and stays up for the whole signature check. A 700 ms floor covers the runs where a cached trust root returns in a few milliseconds. The 99 cap stays on purpose: it is what keeps a rounding artefact from painting 100% before the last byte lands	🟢 fixed	60e09505b
Dead code	The consequence of the above was that the verifyingIntegrity branch in App.tsx could never render: downloading:false and completedPath were set in the same setState, so the condition guarding it was never true. It is now reachable and shows "Verifying with Sigstore" for the real duration of the check	🟢 fixed	60e09505b
Provenance	The bundle already travelled with the update carrying the evidence a user needs to re-check the release, and all of it was discarded before the UI saw anything. parse_sigstore_bundle_metadata now reads the bundle format version, the Rekor log index and integrated time, the entry kind and the signed digest out of the raw document before the verifier consumes the typed one. The panel shows the signer, the Rekor index as a link that opens the public entry at search.sigstore.dev in the system browser, and the digest, with identity, issuer, entry kind and verifier version behind a disclosure. Every extracted field is optional, so a bundle shape we do not recognise degrades to "not shown", never to a wrong claim	🟢 fixed	60e09505b
Honesty	SHA-256 verified was not true. No SHA256SUMS is published and none is fetched, so when no signature bundle exists the digest was computed and compared against nothing, while the badge stayed green. That state is now neutral and says the digest was computed locally with nothing signed to compare it against. The real comparison, the local digest against the one signed in the bundle, is reported as a match only when there is one: digest_match is Option<bool> so "nothing to compare" stays distinct from "they differ", and a mismatch shows both digests	🟢 fixed	60e09505b
Reuse	The toast badge and the install-overlay badge were two copies of the same classification logic. Both now render one UpdateVerificationPanel, and UpdateVerificationInfo moved out of the middle of the App component body into utils/updateVerification.ts	🟢 fixed	60e09505b

The verifier version shown in the panel comes from DEP_VERSION_SIGSTORE, which build.rs already emits from Cargo.lock, so it cannot drift from the crate that actually performs the verification.

Two things the review pass is worth recording for:

Finding	Outcome
CodeRabbit raised eleven points on the new translations. Ten held up when checked against the file they live in; the eleventh claimed Romanian should use formal address, but that file is informal (poți 7 vs puteți 3). Its real defect was different and real: Îl poți instala uses a masculine pronoun with no antecedent in the string. Every "this locale uses X" claim was verified by counting the forms already present in the file rather than accepted	🟢 fixed
The same pass surfaced a layout defect no comment named: the evidence rows pinned their label column at 62px, which several of these languages overflow and CJK cannot abbreviate. The column now grows past that floor and the value truncates instead, which is the right thing to sacrifice on a panel whose whole purpose is to be checkable	🟢 fixed

Verified green: cargo fmt --all --check, cargo clippy --lib --all-features with no warnings, cargo test --lib 3284 passed and 0 failed (7 of them new, pinning the bundle parsing against the real v4.1.6 bundle shape including the authentic base64 to hex digest pair, plus the degradation cases: numeric log index, a bundle with no transparency-log entry, unrecognised documents, and a digest that is not 32 bytes), vitest 11/11, tsc --noEmit, npm run build, npm run i18n:validate at 100% on all 46 locales, and the full PR matrix green on Linux, macOS x64, macOS aarch64 and Windows.

Not yet done, and it cannot be: the live test. The verified path is only observable across a signed release pair, so it has to ship first and then be exercised by updating from v4.1.6.

One data point for known issue #3 while it was open in front of me: the rsync preamble desync recurred a third time on 2026-07-25, on this PR at 83c003154, with the identical invalid rsync protocol version: 2015297409. It is a clean one for the file, because the same lane went green at 725e75a15, red at 83c003154 and green again at 6a2b462ae, and those three commits differ only by whitespace in a #[cfg(test)] module and by translation strings. The row itself is left to the tab that owns the investigation.

[axpnet]

The rsync extended-attribute wire is finished, and none of it changes a transfer yet

Post-4.1.6 groundwork, done on main, shipping in v4.1.7 (bdee1d737 and b926656e7, tasks X.2b and the negotiation cleanup that unblocks X.3).

The file-list entry can only carry an attribute value up to 32 bytes. Above rsync's MAX_FULL_DATUM the entry carries a digest instead, and the bytes travel in a separate per-file section. X.2a refused that shape at both ends rather than guess at it; this implements it. Nothing negotiates -X, so every transfer is still byte-identical and the frozen oracles pass unmodified.

Everything below was measured against rsync 3.2.7 with --only-write-batch, not read off a specification. That mattered: of the three things the plan asked for, none would have been guessed correctly, and a fourth turned up that the plan had not anticipated at all.

Area	Description	Status	Ref
The digest	MD5, confirmed by hashing the captured value and comparing, with sha1 and sha256 truncations checked and ruled out. datum_len in the entry stays the value's real length even though the bytes are elsewhere, so the receiver always knows how large the attribute is and whether it still has to fetch it	🟢 done	bdee1d737
The section	skip(varint) len(varint) datum, closed by varint(0). skip is the distance from the previously sent attribute, not its index. The two readings agree on every simple case, which is exactly what makes the mistake easy to ship; three measured cases separate them, and large attributes at positions 0 and 2 emit 1, 2 rather than 1, 3. Since a skip of zero cannot occur, zero is free to terminate. It is a varint and not a byte, which only becomes visible when a list needs a skip above 127	🟢 done	bdee1d737
The thing the plan missed	The section is not about large values. It is per-file, opened by the ITEM_REPORT_XATTR iflag, measured as the difference between the 02 a0 and 02 a1 per-file shortints. A file carrying nothing but small attributes still emits the section, reduced to its lone terminator byte; a file with no attributes emits nothing. Omitting that single byte would leave the peer one byte ahead for the remainder of the stream, which is the least visible kind of desync there is	🟢 done	bdee1d737
Integrity, for free	The entry already carried MD5 of the value, so the split form hands over a check the inline form never had. Bytes arriving in the section that do not hash to the digest are rejected rather than applied	🟢 done	bdee1d737
One source of truth	Whether -X goes into the server flag bundle, whether the codec expects a blob on every entry, and whether the sender emits the section are the same negotiation written three times. They were wired independently and agreed only because all three were off, so turning any one of them on was a latent defect rather than a feature. All three now read from one session field taken from the command spec at the single point every transfer path already goes through	🟢 done	b926656e7

On modelling: an attribute's value is now either inline bytes or a deferred length plus digest, rather than a byte vector that would have had to lie about the deferred case by being empty. After decoding an entry, a large attribute's bytes are genuinely not known yet, and the type says so.

The sender gate also became rsync's own, preserve_xattrs && (iflags & ITEM_REPORT_XATTR). Both halves earn their place: without the first, a peer setting that bit against a session that never asked for -X could make us inject a byte the stream is not expecting.

Verified green: cargo fmt --all --check, cargo clippy --lib --features aerorsync --all-targets -- -D warnings, the full library suite at 3311 passed / 0 failed with every frozen-oracle test unmodified, cargo check --lib with the feature off, a compile under --cfg ci_lane3, the security regression and version-alignment checks, 523 frontend unit tests, typecheck, i18n validation across all locales, and cargo audit. CI on bdee1d737 was green on all four workflows, including the Docker lane against a real rsync 3.2.7.

Still deliberately not done, so it is on the record rather than implied: the sender does not yet read attributes off the local file, nothing applies them on the receiving side, and the symlink case is handled from a reading of rsync's own call order rather than from captured bytes, so it wants covering in the live acceptance lane.

[axpnet]

The snap GUI paints again, and CI has the frame to prove it

Post-4.1.6 follow-up, fixed on main, shipping in v4.1.7 (#462, found while investigating the ABI break of #460).

The snap fixed in #460 started, ran its CLI, and opened a white window. Two separate defects were behind it, and neither was congenital: they were introduced by a packaging change in December. 3bf266430 (2025-12-22) removed extensions: [gnome] "to avoid build dependencies issues", and that extension is exactly what wires GLVND, the GL drivers and the portal integration. Inside strict confinement __EGL_VENDOR_LIBRARY_DIRS and LIBGL_DRIVERS_PATH were empty, the default paths resolved to core22 where nothing exists, and WebKit reported Could not create default EGL display: EGL_BAD_PARAMETER. WebKitGTK does not degrade when its compositor cannot get EGL: it keeps a live window that reports itself visible, answers commands, and paints nothing. That is why roughly 30 revisions could ship without anyone noticing from the logs.

Area	Description	Status	Ref
Snap packaging	extensions: [gnome] restored, so GTK, WebKit, EGL and portal wiring go back to being Canonical's job instead of ours	🟢 fixed	04e477318
GPU userspace	The app snap no longer bundles Mesa drivers or loaders; they come from the graphics-core22 content provider (mesa-core22) through Canonical's maintained wrapper, and gate G1 fails the build if a driver reappears inside the snap	🟢 fixed	d688efadc
Gate G3, readiness	The gate waited for app_ready post-show: is_visible=true, which X11 can never report: that diagnostic runs in the same main-thread callback as show(), while GTK maps the window asynchronously. It now accepts visibility from any app_ready diagnostic, which is no weaker, because those lines exist only after the frontend has invoked the app_ready command	🟢 fixed	d3c5f71d8
Gate G3, blankness	Readiness alone would not have caught this bug, since a blank window is alive and reports itself visible. The gate now captures the X frame and counts distinct colours, and a capture that fails is a failure rather than a pass	🟢 fixed	d3c5f71d8

What the gate measured on run 30239820626, the first machine-checked evidence that this window draws anything:

Signal	Before (run 30220227502)	Now
EGL	WebKit could not initialize EGL inside the snap on three consecutive runs	no EGL failure, one benign DRI3 error warning
Frontend	splash safety timeout, app_ready never signalled	app_ready reached, +300ms: is_visible=true
Pixels	not measured at all	3348 distinct colours against a floor of 64
Evidence	a log line	snap-gui-frame-* artifact, uploaded from both snap workflows

One deliberate trade is still open. WEBKIT_DISABLE_COMPOSITING_MODE=1 is currently pinned for every snap user, which removes the blank window by removing the GPU, including on machines whose driver was fine. #466 probes EGL at startup and sets it only when the answer is no, in the app rather than in the snap, because a remote X session or a VM without DRI3 hands a deb or AppImage build the same white window. It is not merged yet and is not part of this row.

Note for the release: snap-refresh packs with the snapcraft.yaml of the tag it rebuilds, taking only the gates from the current branch, and the v4.1.6 tag predates every fix above. A rebuild of v4.1.6 therefore cannot produce a working snap, and would now be correctly rejected by G3. The first snap that renders reaches the Store with the v4.1.7 tag.

Verified green: Build AeroFTP run 30239820626, all four platform legs plus build-snap, with gate G1 (ABI floor against the base, no bundled Mesa), gate G2 (install the snap and exercise the CLI payload) and gate G3 (confined GUI under Xvfb) all passing; the Checks workflow (format, audit, unit tests) green on the PR; and a local stub harness covering all six branches of the gate script, including a regression case that replays the exact log that produced the false RED.

[axpnet]

Lane 3 survives Docker Hub, the preamble desync is gone, and local xattrs can opt in

Post-4.1.6 follow-up, fixed on main, shipping in v4.1.7 (#467).

Three aerorsync-only landings, isolated from the snap packaging work. None of them changes a default transfer path unless a caller opts into -X.

Area	Description	Status	Ref
CI lane 3	Pre-pull debian:bookworm-slim with backoff and retry compose up --build so a Docker Hub timeout is not reported as a protocol regression. Gate stays hard (no continue-on-error)	🟢 fixed	92202590a
Preamble desync (known issue #3)	ssh2::Channel::flush emptied the read buffer via libssh2, discarding the first 4 bytes of the server preamble under race and decoding as version 2015297409 (81 ff 1e 78 at offset +4). Flush removed from the raw write path and frame writes; unit pin for the misaligned value	🟢 fixed	cbc6701d8
B3 local xattrs	Read/apply user.* with sanitisation, apply on temp before rename, ENOTSUP soft by default. Session opt-in via with_xattrs(true); default off so wire oracles stay identical	🟢 fixed	4235b8664
macOS build	Apple listxattr/getxattr/setxattr/removexattr take extra position/options args. Thin sys wrappers keep Linux and Darwin compiling under cfg(unix)	🟢 fixed	5dcc3a904

What was ruled out before the root cause for known issue #3 (kept for the file): the bad version was byte-identical every time, not the LCG test payload, not the per-session rsync seed, and not caused by pure #[cfg(test)] commits. Live wire dump showed a healthy preamble as 20 00 00 00 81 ff 1e 78… (protocol 32, then compat + algo list). libssh2 man page: flush flushes the read buffer.

Verified green (local, with the aerorsync feature the pre-push gate does not enable): cargo fmt --all --check, cargo clippy --lib --features aerorsync --all-targets -- -D warnings, cargo test --features aerorsync --lib aerorsync 593 passed / 0 failed, RUSTFLAGS='--cfg ci_lane3' cargo check --features aerorsync --lib --tests.

On CI for #467 at 5dcc3a904: Checks, Aerorsync Protocol (clippy + mock suite + Docker lane 3 against real rsync 3.2.7), and Delta Sync Integration (key-auth, password fixture, Windows) all green; macOS aarch64 and x64 builds green after the portability fix. Merged as 0470634b3.

Still open on purpose: B4 live Docker acceptance for xattrs is not in this PR, and -X remains off unless a caller opts in.

[axpnet]

Windows: the vault files stopped being deletable by the user who owns them

Post-4.1.6 follow-up, fixed on main, shipping in v4.1.7. Reported by email against the portable build, on a domain-joined machine.

A user installed the portable build to try it, then could not delete the folder. Everything went except vault.key and vault.db, which returned "You need permission to perform this action. You require permission from DOMAIN\user to make changes to this file", naming the reporter as the owner of the file they could not touch. Rebooting did not help, which is the tell: this is an ACL, not a file lock. The vault.key in the report is 12 bytes, exactly the AutoKeyring marker (magic 8, version 1, mode 1, padding 2), so the file was written by us and hardened by us.

The hardening in windows_acl::restrict_to_owner shelled out to icacls <path> /inheritance:r /grant:r %USERNAME%:F /T /Q, applied to vault.key, to vault.db and to the whole config directory at first run. It is not portable-specific: the same call runs on every Windows install.

Area	Description	Status	Ref
Order of operations	/inheritance:r was applied before the grant, so anything going wrong afterwards left the object with no usable ACE at all	🟢 fixed	1c455ff4d
Account resolution	%USERNAME% is an unqualified name, and LookupAccountName searches the local SAM before the domain, so on a domain-joined machine a local account with the same name wins and the grant lands on a different SID than the interactive user	🟢 fixed	1c455ff4d
Repairability	Removing inheritance also dropped SYSTEM and Administrators, so not even an elevated Explorer could fix the object: the user had to takeown before deleting a portable install	🟢 fixed	1c455ff4d
Silent failure	The icacls exit status was discarded (let _ = ...output()), so a failed or partial apply left no trace	🟢 fixed	1c455ff4d

What replaced it: the DACL is built from the process token's user SID (OpenProcessToken plus GetTokenInformation(TokenUser)), which is correct by construction on domain- and Entra-joined machines and under any UI language, with no name resolution and no child process. SYSTEM and BUILTIN\Administrators keep full control so the object always stays repairable. The whole DACL is applied in one SetNamedSecurityInfoW call, so there is no window in which inheritance is already gone and the grant is not yet in place. The result is then verified, and rolled back to inheritance if the current user can no longer reach the object: hardening must never be the reason someone loses access to their own vault.

Two traps closed on the way: SetEntriesInAclW with zero entries may hand back a NULL pointer, and a NULL DACL does not mean "no access", it means everyone with full control, so the reset path builds its empty ACL with InitializeAcl instead. And on Windows a sharing violation also surfaces as PermissionDenied, so only ERROR_ACCESS_DENIED counts as locked out, otherwise an unrelated open handle would silently undo the hardening.

Recovery	Description	Status	Ref
Already-affected installs	The object owner keeps WRITE_DAC implicitly even when the DACL grants nothing, so the app can repair itself: vault reads now restore inheritance once and retry. Starting the app, or running aeroftp-cli keystore status, is enough	🟢 fixed	1c455ff4d
Manual fallback	For a folder the app can no longer start from, an elevated icacls "data\aeroftp" /reset /t is sufficient. takeown is not required, since the affected user is already the owner	🟢 fixed	-

Verified green: cargo fmt --all -- --check, cargo clippy --lib --all-features -- -D warnings on Linux (exit 0), cargo clippy --all-targets -- -D warnings against the x86_64-pc-windows-gnu target for the rewritten module, and cargo test --lib credential_store (3 passed, 0 failed).

One honest caveat: the five new windows_acl tests are compiled by the Windows CI lane (cargo check --all-targets) but not executed, because cargo test is disabled on Windows over the whisper-rs-sys MSVC linkage. The runtime ACL behaviour still needs a manual cargo test --lib windows_acl on a Windows machine, ideally a domain-joined one. Worth stating plainly, since untested hardening is exactly how this bug shipped.

[axpnet]

The GPU comes back for the machines whose driver works

Post-4.1.6 follow-up, fixed on main, shipping in v4.1.7 (#466, follow-up to queued #14).

Queued #14 made the snap GUI paint again, and one of the steps it took was pinning WEBKIT_DISABLE_COMPOSITING_MODE=1 for every snap user. That works, and it costs the GPU to everyone, including the majority whose driver was never the problem. The reason such a blunt guard was reachable at all is that WebKitGTK gives no softer option: when its accelerated compositor cannot get an EGL display it does not fall back, it keeps a live window that reports itself visible, answers commands, and paints nothing.

So the question is now asked instead of assumed, at startup, before GTK or WebKit initialize anything, since WebKit reads the variable on its way up.

Area	Description	Status	Ref
Probe	libEGL is asked for exactly what the compositor will need: a display that initializes, a renderable config, and a GL ES 2 context. Anything short of all three sets the variable, and only then	🟢 fixed	a740a3291
Scope	The check lives in the app, not in snapcraft.yaml, because the failure is not snap-specific: a remote X session, a VM without DRI3, or a container with no GPU userspace hands a deb or AppImage build the same white window	🟢 fixed	a740a3291
Crash safety	A marker file is written before the probe and removed immediately after, on success and on graceful failure alike. Only a driver crash can leave it behind, and finding it at the next start means software compositing with no probe, plus a warning naming the file to delete to try the GPU again. Turning a blank window into a startup crash would have been the worse trade	🟢 fixed	a740a3291
Library handling	libEGL is deliberately left mapped: dlclose after a driver has initialized is a known way to crash at exit, and WebKit is about to map the same library anyway	🟢 fixed	a740a3291
Observability	The probe necessarily runs before tauri_plugin_log exists, so its verdict was being written into a facade with no logger behind it and never reached the logs. It is now stored and replayed from setup. That line is the first thing a blank-window report needs to answer	🟢 fixed	d000d41b9

What the snap gate measured on run 30247614244:

Signal	Result
Probe verdict	WebKit accelerated compositing enabled: EGL is usable on this display
Path exercised	accelerated, the same one a user with a working driver takes, not a software path that exists only in CI
Pixels	3348 distinct colours against a floor of 64

Worth recording, because it inverts the assumption the pinned variable was based on: mesa-core22 provides a usable EGL under Xvfb through llvmpipe even with no DRI3, so the DRI3 error line in those logs is an advisory about hardware acceleration, not a failure. The gate therefore covers the user-facing path rather than a CI-only one, which was the stated objection to test-only overrides when the variable was pinned.

Verified green: Build AeroFTP run 30247614244, all four platform legs plus build-snap with gates G1, G2 and G3; the Checks workflow (format, audit, unit tests), the two SFTP fixture lanes and CodeRabbit green on the PR; cargo clippy --lib -- -D warnings clean; five unit tests on the decision, which is a pure function with the probe injected so it needs no GPU, no display and no EGL; and one #[ignore]d test that runs the real probe against the real libEGL, exercised on a desktop in both directions (Ok(()) with a display, a clean Err with DISPLAY unset), because a wrong FFI signature segfaults rather than fails.

[axpnet]

Community triage pass: ten fixes across Discover, My Servers, Zoho WorkDrive, Jottacloud, MEGAcmd, profile export and the docs

Post-4.1.6 follow-up, fixed on main, shipping in v4.1.7 (#274, #347, #397, #451, #453, all reported by @EhudKirsh).

One pass over the open feedback. Three of the reports turned out to be something other than what the symptom suggested: the profile drop was landing correctly and the indicator was wrong, the Zoho failure was the API gateway rejecting a URL rather than WorkDrive rejecting a move, and the TAB.DIGITAL placeholder was not a TAB.DIGITAL miss but a catalogue-wide one. Two more defects were found while answering questions rather than reported at all, and one more while verifying the Zoho fix end to end on a live account, which is the export defect at the bottom of the table and the one with the widest blast radius of the batch.

Area	Description	Status	Ref
Discover / Add Service	The pricing filter was the only toolbar control in plain component state, so leaving the tab destroyed it and rebuilt it at All, while its neighbours (view mode, category, columns) all persisted. Now stored the same way	🟢 fixed	7dcc3ce59
My Servers, table view	The insertion line was painted on the row's bottom edge whatever the direction of travel, but a drop makes the profile inherit the target row's index, so it lands above the row when coming from below. Upward drags were therefore aimed one row too high. The line now follows the drag direction	🟢 fixed	512b18a6f
My Servers, table view	The grip cell was selectable text: a selection left from an earlier click made the engine start a text drag instead of the row drag, so some rows refused to lift until the selection was cleared by dragging another one	🟢 fixed	512b18a6f
Zoho WorkDrive	Cross-folder move went to PATCH /files/{id}/move, a route WorkDrive does not have, so its gateway answered 400 F6016 URL Rule is not configured. Renames were unaffected (PATCH /files/{id} exists), which made the failure look provider-specific. Relocation is now the bulk write on PATCH /files	🟢 fixed	ec9899891
Jottacloud	Every JFS command POST carried Content-Type: application/octet-stream with an empty body, which on a file URL is JFS's upload shape, so the command in the query string was never reached and returned 404. Both Move to Trash and hard Delete did nothing to files for this reason. Commands now go out bare	🟢 fixed	5bf8f57ee
Jottacloud	The soft delete fired the file form at folders and fell back to the folder form only on failure, and ?dl=true on a folder does not fill the recycle bin, so folders left the account for good. The entry type now picks the parameter	🟢 fixed	5bf8f57ee
Jottacloud	With the 404 gone, the trash call succeeded and exposed the rest: trash_url() omitted the device segment, and Trash is a mountpoint of the device, so JFS read "Trash" as a device name and the 404 was reported as an empty bin; the folder listing honoured a deleted attribute on folders but only the <deleted> element on files, while the live API tombstones a trashed file with the attribute, so a file that really had moved to the bin kept showing as live; and mountpoint discovery read a name attribute where JFS nests <mountPoint><name>, returning an empty list	🟢 fixed	b721d66dd
Jottacloud	Delete and Move to Trash were two context-menu entries firing the same call, once delete() routed through the bin. One entry now, labelled as what it does	🟢 fixed	2f26f4ac1
MEGA (MEGAcmd)	Files were moved to //bin/ and were recoverable, folders went through mega-rm -r -f and skipped the bin. Same account, same gesture, one of the two unrecoverable. Both now move to //bin/	🟢 fixed	c27d64b16
My Servers, table view	Follow-up from the review pass: the health radial becomes a real button when a retry is available, and making every control-free cell a drag handle had swept that cell in, so a few pixels of travel on the button started a reorder instead of the retry. Excluded now, on the same condition the radial uses to decide it is a button	🟢 fixed	cf36833f5
Docs and connect form	The v4.1.6 capitalisation sweep covered the app but not the documentation site, a separate repository. Site capitalised throughout; the connection-name placeholder now uses the provider's brand name instead of its internal slug, which had it reading tabdigital, pcloud and googledrive	🟢 fixed	02f80507e, docs 12424a2
Profile export / import	A .aeroftp export carried an OAuth profile's token but not the BYO app credentials that refresh it, because the map deciding what travels excluded Zoho WorkDrive on the grounds that it has no BYO app. It has one: the Quick Connect page asks for exactly those two values. The imported profile failed its first refresh with Failed to parse server response and could never reconnect on a fresh machine. The region singleton travels too, since it selects the API host and an import silently reset a European or Indian account to us	🟢 fixed	f16b8934d

Both provider chains are confirmed against live accounts, not just against the documented shapes. Jottacloud: a folder listing of 13 entries, two files moved to the bin, the listing down to 11, and both files present in the recycle bin with contextType="TRASH". Zoho WorkDrive: the reporter's exact case, a folder moved to sibling level, plus a file moved with a rename, with the source folder left empty and the test data cleaned up afterwards. The export fix was verified the same way, exporting from one vault and importing into another.

Still open from the same batch, reported after these landed: in table view a profile row will not lift at all while a sidebar protocol chip is active (it does on All, and the card view is unaffected). Under investigation, tracked on #453.

Verified green: cargo fmt --all -- --check, cargo clippy --all-targets -- -D warnings, cargo test --lib (3324 passed, 17 ignored), tsc --noEmit, vitest run (523 passed).