Ghost FTP 0.99.18 — state recovery and client protocol safety (Preview)

Previous source edition: 0.99.17. Required prior public release: v0.99.17.

Changes

• Do not silently replace saved FTP sites or settings with empty defaults when the primary is missing and the existing backup is corrupted or unreadable.
• Reject invalid persisted JSON root, site-list and settings shapes; recover from a valid backup without deleting the original.
• Reject non-regular (including symlinked) saved state and backup paths.
• Preserve corrupted regular primary state with deduplicated private content-addressed forensic snapshots. Repeated recovery of unchanged damage does not create unlimited duplicate files.
• Add fail-closed state recovery regressions, a concurrent readers/writers stress test, and Go race-detector coverage alongside the 0.99.17 atomic-write and backup-rotation tests.
• Preserve the state JSON format and existing FTP/FTPS/SFTP engines; prevent concurrent same-process state writes and reads from interleaving backup rotations.
• Windows/Linux Rust FTP and SFTP mutation operations now validate rename, delete, mkdir, and chmod targets for parent traversal, control characters, Windows separators and excessive lengths before sending commands.
• Rust FTP preflight now treats case-alias file names conservatively (e.g. REPORT.txt vs report.txt) instead of assuming the remote target is absent and risking an overwrite. Added positive/negative collision regressions.
• Phase 3 comparator counts exact RGBA differences including one-unit alpha changes, rejects symlinked/non-PNG screenshots and preserves per-screen errors in the audit report. The optional --require-exact gate fails any non-identical captures; synthetic unit tests cover opacity, hidden color values, PNG validity and matching content.
• The 75-image reference ZIP (10) is byte-identical to (8) and its geometry/inventory were verified (30 Windows, 29 Linux, 16 Android). This confirms the design reference source, not the actual app screens.
• Native Swift macOS FTP upload preflight now requires a dotfile-visible directory inventory: use MLSD when available and LIST -a for a legacy server; refuse upload if the legacy completeness request fails rather than silently overwriting a hidden target. Reject Windows backslash separators in remote file names.
• Add Rust path-guard and native Swift parser/command-path regression tests.

Evidence and blockers

• All tests/builds require re-verification on the exact new head commit.
• v0.99.17 is now publicly published with 25 artifacts and a successful release workflow; exact-head v0.99.18 CI, including native macOS unit tests and live protocol fixtures, is still required before merge.
• Native Swift macOS identity-verified FTPS/SFTP remains tracked by issue #223; this preview does not claim to implement those secure protocols.
• FTP LIST -a cannot cryptographically prove a malicious server has disclosed every hidden entry; cross-server upload atomic create-if-absent and TOCTOU collisions remain separate protocol-level limitations.
• Complete installed-state 75/75 screenshot comparison, Windows compatibility filesystem fault injection, full security/dead-code audits and the separate Ghost FTP Server are not claimed finished.
• Preview is not a signed/notarized production release. No file download is claimed without real release assets.