Ghost FTP v0.95.41 — HTTP remote-inventory fail-closed safety (development preview)

Published predecessor: v0.95.40.

FILE-03 P0 — implemented scope

• Bound HTTP autoindex listing responses to 16 MiB using incremental reqwest response chunks before UTF-8 conversion/parsing; reject oversize results, including missing Content-Length.
• Reject generic HTML/redirect login/error bodies pretending to be empty source directories. Require recognizable index heading and closing HTML.
• Reject ambiguous multi-href rows, duplicated names, invalid percent UTF-8, unsafe leaf paths, JSON duplicate/unsafe names and unknown JSON item types.
• Keep legitimate empty nginx JSON array and recognizable empty HTML index as valid empty inventories; preserve Apache/nginx fixture support.
• Record regression tests and version train metadata as a candidate. No previous release tag was changed.

Mandatory acceptance not yet established

• Final exact-SHA Rustfmt, workspace test/check, Clippy and frontend checks.
• Real FTP, explicit FTPS and SFTP E2E; Windows native hardening.
• Windows/Linux installable package lifecycle; Android emulator/lint; macOS Preview.
• Real nginx, Apache, Python HTTP directory index servers with empty, Unicode and large directories; malformed chunk/body failure injection.
• Broader SFTP/WebDAV/cloud inventory fuzz and complete FILE-03 acceptance, FILE-02 transfer hashes, signed URL DNS rebinding/proxy and Android SAF process death.

This is a development Preview. It does not certify all Phase B tasks, real-provider SSRF tests, UI parity, production signing or a new published release.