Ghost FTP v0.95.38 — Transactional SQLite sync recovery (development preview)

Published predecessor: v0.95.37.

Changes

• Prevent destructive or misleading synchronization plans when the source or target inventory is incomplete due to inaccessible directories: plan_indexed now uses strict scanning on both local and remote filesystem adapters.
• Fail closed if ghostftp.db cannot return the sync history; never substitute an empty index during database read errors.
• Replace each completed pair's SQLite source inventory atomically using a single transaction, with prepared statements and rollback on any SQL error, rather than hundreds or thousands of independent upsert/delete writes.
• Preserve the previous source history when Mirror deletion safety guards withhold work; do not mark that warning as a fully successful synchronization timestamp.
• Add Rust regression tests for an unreadable source, per-pair snapshot isolation, signed-size overflow and simulated SQL trigger failure.

Verification required before merge/publication

• Exact-head Rustfmt, Rust workspace tests, Clippy
• TypeScript, frontend build, UI interaction contracts and full source-reachability/dead-file check
• Real FTP, explicit FTPS and OpenSSH SFTP protocol E2E
• Windows native NSIS/MSI and Linux AppImage/DEB/RPM lifecycle and QA
• Android and macOS cross-platform compatibility checks

Existing scope: the installed product already contains OS-keyring-backed saved passwords (Windows native, Linux Secret Service), SQLite-backed sync/config, watch-based live folder sync, safe CMD/PowerShell/.NET script generation, S3-compatible and WebDAV/GCS cloud adapter code and a built-in UTF-8 editor for PHP, JavaScript, HTML and CSS. This patch does not establish 59-screen visual 1:1 compliance, mass-transfer superiority over FileZilla, real vendor cloud-account E2E, or a separate persistent master-password vault.