Ghost FTP 0.95.29 — Windows/Linux reliability and file workflow hardening (development preview)

Published predecessor: v0.95.28. The published v0.95.28 tag and its assets must remain immutable.

Windows/Linux improvements

• Atomic local rename refuses to overwrite an existing destination (regular files, folders or symbolic links), using Windows MoveFileW and Linux renameat2(RENAME_NOREPLACE).
• Linux local chmod opens the final inode without following a symbolic link, checks the opened descriptor's file type, and changes that same inode's permissions with fchmod.
• Add Rust tests for occupied targets, preserved bytes, successful free-target renames, dangling symlink destinations and chmod refusals.
• Protect the user's active connection tab from older, slower connection completions; only the latest connection intent can focus a newly finished session.
• Ignore outdated saved-profile and session-health responses, coalesce Agent Bridge focus state updates under rapid tab switching.
• Keep transfer activity count in the transfer store rather than O(n) filter work/re-rendering whenever transfer progress updates.
• Shared file panes now discard stale asynchronous directory listings on fast path/session changes and clear previous-directory rows and selections immediately. Failed new-directory loads cannot leave old-directory file actions visible.
• Extend UI source contracts for these cross-platform safety and stability invariants; no intentional premium UI redesign.

Acceptance checklist

• Exact-source Rust formatting, Clippy, workspace tests and native UI contracts.
• Windows hardening, Windows NSIS/MSI and Linux DEB/RPM/AppImage native builds.
• Real FTP/FTPS/SFTP integration tests.
• Android and macOS compatibility CI (no functional feature claims on those platforms).
• Manual installed Windows/Linux UI, accessibility, rename collision, symlink/race, and performance acceptance.

This release candidate is preview source, not an independent security audit, production-stable certification or full FileZilla feature parity. Linux intermediate-directory symlinks remain a distinct hardening area; non-Linux/Windows fallback rename is not atomic.