Ghost FTP 0.95.9 — signed-cloud peer filtering alignment (development candidate)

Not published. Previous verified public release: v0.95.8 at immutable source 5c1acf285ed8db3f35d75197ef953f7750d6900b, with 21 artifacts. previousVersion=0.95.8 and previousPublishedVersion=0.95.8.

Implemented changes in this source candidate

• Block RFC 7343 ORCHIDv2 2001:20::/28 IPv6 destinations in Android's actual OkHttp public-peer DNS selection and macOS's pinned-address curl selection. Reject either end of the /28 without weakening default TLS hostname/certificate validation.
• Regression coverage on both platforms for the newly excluded network range.
• Android SAF late registration during cancellation now schedules best-effort provider close on a daemon rather than running the provider's potentially blocked close() inline. JVM coverage of a deliberately blocked close does not replace device acceptance.
• Document exact 75-image premium concept coverage for Windows, Linux and Android and the separate real-capture QA gate. Concept images must never masquerade as actual production screenshots.

Required checks before merge or publication

Ghost FTP quality + Rust workspace, Android JVM/lint/package/emulator, macOS Swift tests/build, Windows/Linux native packages and install/launch smoke, Windows hardening and FTP/FTPS/SFTP E2E must pass on the exact final PR SHA. Then require success of the merge-SHA release workflow and remote verification of the immutable tag, assets and checksums before claiming v0.95.9 is public.

Outstanding blocking acceptance — do not close Issues

• #126: actual peer-bound hostname/TLS/proxy/VPN/hostile-DNS lab, split-horizon/rebinding and successful real signed-provider end-to-end test with redacted evidence.
• #127: real Android 8–15 SAF provider with cancellation, process death, permission loss, disk-full and 1 GiB transfers and proof of safe document cleanup/rollback.
• #128: account-scoped Google Drive OAuth Authorization Code + PKCE, Android Keystore/macOS Keychain, refresh/revocation and real paginated list/upload/download/provider error cases; then evaluate OneDrive, Dropbox and Box.
• Visuals: original 75-screen concept pack is not an installed-application capture. Exact UI/UX parity, operation success and accessibility cannot be certified without physical/platform captures and interactive test evidence.

This release candidate does not claim complete cross-platform parity, fully functional cloud accounts, production-signed Android/macOS or issue resolution.