Ghost FTP v0.95.35 — Windows/Linux transfer safety and audit (development preview)

Published predecessor: v0.95.34.

Delivered source changes

• Local download Skip/Rename decisions use symlink-aware existence checks. Incomplete symlinks can no longer be mistaken for absent destinations.
• Staged downloads refuse symlink, directory and other unsupported final targets or staging paths. Preserve existing original-file backups and use atomic no-replace local moves on Windows/Linux.
• Local file pickers cannot cause symlink targets to be uploaded as plain files; unsafe Linux filenames containing literal backslashes are refused instead of truncated.
• Recursive directory uploads validate the entire local inventory before making remote changes; fail on unsupported entries, bad filenames, too many entries, too deep a tree and oversized path inventories.
• Two-pane file dragging binds each batch to its actual source session; malformed drag data or a tab/connection switch cannot silently queue transfers from another session.
• Add Rust regression coverage for file preservation, symbolic links, folders and limits, plus frontend UI hardening contracts. Audit evidence: Windows/Linux 0.95.35.

Exact-head verification

• Cargo workspace formatting, build, Clippy and Rust regressions
• TypeScript checks, production UI build, noUnusedLocals and source-reachability/dead-file checks
• Real FTP/explicit FTPS/OpenSSH SFTP round-trip protocol E2E
• Native Windows EXE/MSI install/uninstall and Linux AppImage/DEB/RPM packaging
• Android/macOS shared-code compatibility
• Manual screenshot-by-screenshot 75-reference visual acceptance and FileZilla feature benchmark

Known limitations: Windows/Linux no-replace moves protect final directory entries but parent-directory symlink swaps and other cross-process filesystem races require further OS-handle-level testing. Remote directory uploads aren't transactional. Actual 75-screen pixel parity and claims of global FileZilla superiority are not proven.