Ghost FTP 0.20.1

Release cycle: 0.20.1 patch release candidate

Cycle date: 30 September 2026

0.20.1 follows canonical 0.20.0. This document does not assert publication: only an immutable v0.20.1 GitHub Release at the verified source SHA with the required assets establishes the release.

Changes in this cycle

Transfer worker lifecycle race fix

• Route desktop download, upload and manual-retry worker registration through one race-safe task-registration helper.
• Handle the edge case where a very fast worker reaches finalize() before its caller records the spawned JoinHandle.
• Acquire the task-map lock before tokio::spawn, register the JoinHandle while that lock is still held, and let finalize() proceed only after registration releases the same lock.
• Add a Tokio regression test proving an immediately scheduled worker observes its registered handle before cleanup.
• Preserve existing cooperative cancellation, FTP/FTPS ABOR cleanup, pause/resume and durable recovery behavior.

Version and release integrity

• Advance the desktop, Rust workspace, Android and compatibility-tool metadata to 0.20.1.
• Advance Android versionCode to 211030.
• Keep previousVersion pinned to the published 0.20.0 release.
• Keep the stable release channel for 0.20.1 while removing the dependency on private Android release-signing secrets.
• Always verify the intentionally unsigned production com.ghostftp.android build for package identity, version, SDK levels, launcher and non-debuggable state.
• Keep a separate non-debuggable com.ghostftp.android.preview APK for clean-install, reinstall and launch/RESUMED emulator proof, without requiring a private production keystore.

Publication requirements

The exact source intended for v0.20.1 must pass Ghost FTP quality, Ghost FTP protocol E2E, Ghost FTP native build, Ghost FTP Android and Validate Windows hardening on the same head SHA.

The canonical release must contain non-empty Windows portable/NSIS/MSI assets, Linux binary/AppImage/DEB/RPM assets, the explicitly named unsigned production Android artifact, the separately installable Android preview evidence artifact, source/documentation archives, native-QA evidence and SHA-256 checksums.

README/documentation screenshots remain pinned to the newest published release by provenance CI. New 0.20.1 screenshots may replace them only when they are derived from the verified 0.20.1 build and can satisfy that provenance contract.

Stable status

0.20.1 remains in the pre-1.0 version train. Passing automated release gates does not by itself claim 1.0/FINAL product acceptance.