Ghost FTP 0.95.1 — development candidate (NOT PUBLISHED)

The latest public release remains 0.95.0. Do not change immutable public tags or advertise 0.95.1 installation files until all exact-head production gates and release artifact verification pass.

Implemented in the development branch

• Issue #131 (partial): Windows/Linux Settings now uses genuine interactive, keyboard-reachable vertical category navigation at reference-sized desktop windows, with compact horizontal navigation retained at smaller widths. Existing real settings and Sync-only mode remain operational. A Quality contract validates integration and compact-layout rules.
• Issue #126 (security candidate, pending provider proof): macOS signed-object PUT/GET now routes through a fail-closed public-address resolver and a peer-bound HTTPS client using macOS system curl with pinned public IPs. TLS uses the original cloud hostname, system certificate trust and no redirection or proxy. The short-lived signed bearer URL is sent via process stdin configuration, not process arguments or telemetry, and never written to configuration files. Invalid private/reserved IP addresses, dangerous URL config characters, mismatched provider checksums and duplicate final HTTP headers are rejected. Tests cover address classes and HTTP header parsing.
• Issue #127: GitHub currently reports the SAF issue closed in 0.95.0. Note that physical document-provider, permission-revocation, disk-full and large-file acceptance evidence is still not established by macOS peer-bound transport work.
• Issue #128: Vendor OAuth account browsing for Android/macOS remains unimplemented. Signed-object URL support is NOT a Google Drive login or Dropbox/OneDrive account session.

Required before merge, publishing or closure

1. Six GitHub CI workflows all green on the exact final commit and no version drift.
2. macOS real public-provider S3/GCS/Azure/R2 PUT/GET, SSL hostname trust, DNS-rebinding, split-horizon, private/metadata IP, proxy, cancellation and VPN acceptance; verify curl availability, sandbox behavior and no bearer disclosure. #126 stays open until this is done.
3. Real Android and macOS OAuth, PKCE, system browser, token vault and provider E2E for #128.
4. Genuine Windows/Linux 1290×852 and compact screenshots, click-by-click Settings/Files/Sites/Transfers QA and full 30/29 visual acceptance for #131.
5. Android real SAF provider failure/cancel/recovery proof under #127's original acceptance checklist.

No new installation or production release artifacts are claimed by this document.