Ghost FTP v0.95.43 — Honest Preview distribution and release safety (development candidate)

Published predecessor: v0.95.42.

Release hardening scope

• Block stable at the source quality and publication stage because the current release still intentionally contains unsigned production Android AAB/APK and ad-hoc signed macOS Preview; genuine Authenticode/Play acceptance/notarization/upgrade evidence is unavailable.
• Classify future preview GitHub releases using the GitHub prerelease flag, without marking as stable latest. Retain immutable tags; use actual latest nondraft release across regular releases and prereleases for provenance.
• Introduce regression tests for preview, stable, absent and malformed release-channel state; run them on each PR SHA in quality CI.
• Do not change user files, profiles, signing secrets or existing tags. This is a safety gate, not production signing.

QA requirements and remaining blockers

• Six exact-HEAD workflow families plus Windows/Linux native packaging, Rust tests/Clippy, Android emulator and macOS preview build.
• Run install/upgrade/rollback/uninstall tests on Windows 10/11, Linux DEB/RPM/AppImage, Android real device and macOS.
• Certify real Windows Authenticode signer, Play Console AAB, persisted Android key lineage/data retention, Developer ID notarization and desktop updater private-key recovery.
• Capture and review all 75 real app screens by SHA/OS/viewport; inspect accessibility, keyboard navigation and modal clipping at 480-1290 widths and 125-200% scale.
• Audit third-party licence inventory and notices against exact dependency graph.

No production-stable claim, all-75-accepted claim, real signing or new release is made by these source changes.