Ghost FTP 0.99.9 — Android remote batch-rename collision hardening (development Preview)

Previous published release: v0.99.8. Current source train: 0.99.9. This is a Preview, not a production-stable or Apple-notarized claim. GitHub publication requires all exact-head release gates.

Android: prevent destructive aliases before batch rename

• Compare proposed destination paths with the fresh full remote directory listing (both files and directories), rather than file-only case-sensitive string matches. Apply NFC Unicode normalization and locale-independent case folding as a conservative cross-server safeguard.
• Reject duplicate or canonically equivalent selected source paths and malformed paths (dot segments, empty segments, control characters or backslashes) before any protocol write.
• Add regression tests for case-insensitive collisions, NFC/NFD collisions, directory targets, duplicate sources and malformed paths.
• Preserve original user data and stored FTP/FTPS/SFTP profiles. No simulated server states or fake transfer metrics have been added.

Additional cross-platform stability and security fixes

• Windows CLI PATH: refuse to change HKCU\\Environment\\Path if its registry value has an unexpected non-string type, cannot be decoded, or fails to read for any reason other than genuine absence. Protect the original bytes instead of rewriting an apparently empty value; exercise this in a scratch registry test.
• Linux/macOS CLI PATH: prefer the application-owned binary over an existing managed ~/.local/bin/ghostftp-cli symlink when adding the CLI to PATH. Avoid making a symlink to itself and preserve safe failure when no other CLI binary exists; add Unix regression tests.
• macOS native connection validation: reject invalid bracketed/unbracketed IPv6 text using the system IPv6 parser instead of relying on colon counts. Test malformed literals, embedded port strings and scoped addresses.
• These are targeted code corrections and tests, not claims that all device, real-server or installer acceptance checks have completed.

Internationalization / localization progress

• Shared Windows/Linux 24-language dictionaries reviewed and parity checker retained.
• Added native macOS 24-language resource bundle (269 translated keys per non-English language), a system-language-aware L10n helper, localized workspace controls and native XCTest coverage.
• Added 10 high-frequency Android UI labels translated across all 24 languages, migrated 25 inline UI literal references to Android resources and added a CI parity check.
• Remaining native dynamic/untranslated text and complete semantic locale QA are tracked in docs/audits/LANGUAGE.md. This is a progressive localization change, not a false full-coverage claim.
• Critical issue #223 (native macOS verified FTPS/SFTP) remains open pending real secure protocol and installed-app test acceptance.

Windows release-blocking regression repair

• Isolated raw UTF-16 HKCU\\Environment\\Path decoding so malformed bytes, embedded NULs, surrogate errors and unsupported registry types are tested directly, independent of Win32 value normalization.
• Corrected the scratch-key round-trip test to validate the actual registry bytes read back after a write. Windows is allowed to add a missing string terminator; this must never be mistaken for an unsafe decoder success.
• No relaxation of the fail-closed protection for malformed data actually returned by the registry. Release remains blocked until every exact-source Windows and cross-platform CI gate passes.
• Resolved Windows Rust E0507: the validated registry type is cloned from the borrowed raw value rather than moved; this leaves strict UTF-16 validation and the original registry bytes intact.

Source and verification gates

• Android lint, JVM unit tests and Android 16 emulator instrumentation must pass for the 0.99.9 source SHA.
• Recheck the Rust, TypeScript, Go, Windows, Linux, both macOS targets, protocol E2E, dead-code/security scans, packaging and immutable-release checks.
• Existing Ghost FTP Android UI maketa.png and Ghost FTP Android UI Showcase.png are still the authoritative design references. The sixteen screens are not yet pixel-certified 1:1; real-device crash reproduction and real FTP/FTPS/SFTP server acceptance remain open.
• Android Play signing requires owner-held credentials; Apple Developer ID/notarization is not asserted for ad-hoc-signed macOS DMGs. Signed Preview APK, if available, is not the same as a Play production AAB.

Historical v0.99.8 and older tags, packages and source remain unchanged.