Ghost FTP 0.99.3 — macOS FTP inventory identity and Preview metadata hardening

Channel: Preview. This document describes source changes; public release publication is conditional on the exact-source CI checks and verification of all platform assets on Releases.

Changes

• macOS native FTP now applies the same case-insensitive, Unicode-normalized remote-name identity in both MLSD/LIST inventory parsing and upload overwrite preflight. A directory containing ambiguous aliases fails closed instead of presenting indistinguishable entries for file actions. Valid Unicode names and genuinely distinct accented names remain supported.
• Add targeted Swift regressions covering case and Unicode normalization collisions in both MLSD and legacy Unix LIST responses, plus an unambiguous Unicode case.
• Extend the release metadata reconciliation workflow to immutable v0.99.1 (source eb2e1899f0bb953b731e7b41e0109ba4decb324a) after it is independently checked for the correct original tag, target commit, 21 nonempty digest-bearing assets and correct source SHA. Repair only its Preview classification/name, never existing binary assets, commits or tags.
• Retain existing FTP fail-closed protection for FTPS/SFTP on native macOS until TLS certificate/hostname and SSH host-key verification are fully implemented, with real integration evidence.
• Correct the version-sync CI failure by deterministically rewriting only the four local Cargo workspace package version records inside Cargo.lock; preserve the original third-party dependency graph and checksums, then require cargo metadata --locked to succeed. Add a governance regression test so future version bumps do not repeat the failure.
• Run the existing cross-platform security/dead-code checks and exact-SHA Windows/Linux/Android/macOS/protocol CI gates before promoting any release.

Known limitations and independent acceptance

• Native macOS FTPS/SFTP sessions and file operations remain unavailable; never fall back to plaintext.
• Case/normalization-ambiguous directories on case-sensitive FTP servers are now intentionally rejected pending a server-identity-aware UX.
• Production macOS notarization, Windows signing, Android production signing, real device installation/upgrade checks and full >4 GiB / SHA-256 content roundtrips remain unverified.
• The tests added here are source-level regressions; they do not certify end-to-end transport identity, physical installation or transfer throughput.

Release preservation

v0.99.3 is permitted only after v0.99.2, with unchanged older releases and immutable tags. Next permitted version after a successfully published v0.99.3 is v0.99.4. All downloads belong on Releases.