Merge main and verify all Automatic initial actions

docs/glossary.md

@@ -98,6 +98,10 @@ recovery guidance, or diagnostics intended for users.
 - **ID recovery code:** A versioned text form of the saved ID key which can be
   shown on the current device and imported without deriving a different key.
   Treat it as a secret.
+- **Joined devices:** The dialogue showing device records held by the active
+  CouchDB or Object Storage remote, with the current device first. Records
+  describe participation, not current online activity. **Forget device** removes
+  an obsolete device record; it does not delete Vault files or revoke credentials.
 - **JWT Authentication:** An experimental CouchDB authentication option which
   uses a JSON Web Token instead of standard credentials. It requires a private
   key or secret, algorithm, expiry duration, subject, and key ID.

docs/releases/1.0.md

@@ -2,6 +2,30 @@
 
 This document contains earlier published releases from the 1.0 line of the [current Self-hosted LiveSync release history](../../updates.md). Beta and release-candidate builds published before 1.0.0 are recorded in the [1.0 preview history](1.0-previews.md). Earlier release lines continue in the [0.25 history](0.25.md) and the [legacy history](legacy.md).
 
+## 1.0.35
+
+5th October, 2026
+
+### Synchronisation
+
+#### Fixed
+
+- We can continue synchronising after rebuilding an encrypted CouchDB remote, including when Hidden File Sync and Customisation Sync are enabled. (#1234)
+    - This plug-in reads the rebuilt data without reusing HTTP responses encrypted with the previous Security Seed.
+
+### Customisation Sync
+
+#### Fixed
+
+- Customisation Sync now waits until this plug-in is ready before handling configuration file events, and applying settings while synchronisation is suspended no longer scans configuration files. (#1220)
+    - Resuming synchronisation scans once and restarts the periodic scan when enabled.
+
+### Acknowledgements
+
+Thank you for your contributions!
+
+- @kimjansheden (#1220)
+
 ## 1.0.34
 
 2nd October, 2026

docs/settings.md

@@ -234,6 +234,16 @@ Setting key: remoteType
 
 The active connection type. This is automatically projected to the legacy configuration when you activate a connection profile.
 
+### Joined devices
+
+Choose **Review devices** under **Joined devices** to read the device records on the active CouchDB or Object Storage connection. The same **Review devices** action is available from the command palette and version Notices. **Refresh** reads the remote again. This device appears first, including when its record is absent from the remote. Opening or refreshing this dialogue does not create a missing CouchDB database.
+
+The list shows each device ID, recorded platform, plug-in version, app version, and last recorded connection time. Older clients may have incomplete information. These records do not establish whether a device is online. On a locked remote, a device outside the accepted list is shown as **Locked out**.
+
+Before synchronisation starts, and when this dialogue refreshes, Self-hosted LiveSync checks for recorded plug-in versions newer or older than its own. These Notices recommend reviewing and aligning plug-in versions across devices; they are advisory and do not stop synchronisation. The dialogue explains that synchronisation between different versions is generally safe unless the connection is explicitly blocked, but may be less efficient or use more storage. P2P synchronisation may also be unavailable. Unknown development version labels are left unclassified. Automatic checks run at most once per minute when synchronisation starts; they do not poll a continuously running connection.
+
+**Forget device** removes another device's participation records after confirmation. It preserves the remote lock state and every other device. It does not delete Vault files or revoke credentials. A device can register again on an unlocked remote; on a locked remote, the existing recovery process applies. The result is checked after saving to CouchDB; if it cannot be confirmed, refresh the list and try again. CouchDB stores these records together in a local document which does not reject simultaneous updates, so changes from other devices can be overwritten. Pausing synchronisation on the other devices avoids that overlap. Object Storage uses conditional updates; if the server cannot support them, the record is retained.
+
 ### 2. Notification
 
 #### Notify when the estimated remote storage size exceeds on start up
@@ -750,11 +760,13 @@ If enabled, the notification of hidden files change will be suppressed.
 
 #### Synchronising files
 
-(RegExp) Empty to sync all files. Set filter as a regular expression to limit synchronising files.
+Setting key: syncOnlyRegEx
+(RegExp) Limit normal files to matching paths. Leave empty to allow all normal file paths. Hidden File Sync uses its own target patterns.
 
 #### Non-Synchronising files
 
-(RegExp) If this is set, any changes to local and remote files that match this will be skipped.
+Setting key: syncIgnoreRegEx
+(RegExp) Skip changes to matching normal and hidden files, locally and remotely.
 
 #### Maximum file size
 
@@ -938,6 +950,18 @@ Setting key: hashCacheMaxAmount
 
 Setting key: customChunkSize
 
+New setup uses 0 for every remote type. With V3 Rabin–Karp, this gives binary
+Chunks a 100 KiB maximum, a 25 KiB minimum, and an approximate 25 KiB candidate
+gap. The candidate gap is not the mean Chunk length. Text below 4 MiB retains
+adaptive smaller boundaries; large text uses the binary thresholds with
+UTF-8-safe cuts.
+
+Larger values can reduce document counts for mostly immutable binary files,
+but can increase the new content stored after an edit. Existing explicit and
+agreed values are retained. Updating the plug-in does not re-chunk the Vault;
+editing, forced writes, Chunk recreation, or a full Rebuild can create new
+boundaries while existing content remains readable.
+
 #### Chunk Splitter
 
 Setting key: chunkSplitterVersion
@@ -959,7 +983,10 @@ If this enabled, chunks will be split into semantically meaningful segments. Not
 #### Fetch chunks on demand
 
 Setting key: readChunksOnline
-(ex. Read chunks online) If this option is enabled, LiveSync reads chunks online directly instead of replicating them locally. Increasing Custom chunk size is recommended.
+If enabled, this plug-in obtains missing Chunks when they are needed instead
+of including all Chunks in ordinary pull replication. New setup retains the
+same Chunk-size recommendation of 0. This setting does not re-chunk content
+already stored by another device.
 
 #### Batch size of on-demand fetching
 
@@ -1012,12 +1039,18 @@ The setting remains disabled by default because the measured storage and transfe
 #### Batch size
 
 Setting key: batch_size
-Number of changes to sync at a time. Defaults to 50. Minimum is 2.
+Number of changes in an ordinary CouchDB replication batch. The schema default
+is 25, and the minimum is 2. Changing this value alone preserves the
+replication checkpoint. Larger counts can reduce round trips, but do not bound
+the final request size or memory use.
 
 #### Batch limit
 
 Setting key: batches_limit
-Number of batches to process at a time. Defaults to 40. Minimum is 2. This along with batch size controls how many docs are kept in memory at a time.
+Number of changes batches which PouchDB can read ahead. The schema default is
+25, and the minimum is 2. This does not create parallel body transfers;
+PouchDB processes one current replication batch at a time. It does not control
+the separate P2P or Object Storage transfer units.
 
 #### Use timeouts instead of heartbeats
 

docs/setup_object_storage.md

@@ -24,7 +24,7 @@ export secret_key=<SECRET KEY>
 export bucket=vault-data
 export region=auto
 export bucket_prefix=my-vault
-export passphrase=<A STRONG VAULT ENCRYPTION PASSPHRASE>
+export LIVESYNC_PASSPHRASE=<A STRONG VAULT ENCRYPTION PASSPHRASE>
 export uri_passphrase=<A SEPARATE SETUP URI PASSPHRASE>
 deno run --minimum-dependency-age=0 --allow-env https://raw.githubusercontent.com/vrtmrz/obsidian-livesync/main/utils/setup/generate_setup_uri.ts
 ```

docs/setup_own_server.md

@@ -128,6 +128,9 @@ export database=obsidiannotes
 curl -s https://raw.githubusercontent.com/vrtmrz/obsidian-livesync/main/utils/couchdb/couchdb-init.sh | bash
 ```
 
+> [!TIP]
+> In fish, `hostname` is read-only and cannot be exported. Pass the values through `env` instead: `curl -s https://raw.githubusercontent.com/vrtmrz/obsidian-livesync/main/utils/couchdb/couchdb-init.sh | env hostname=http://localhost:5984 username=<...> password=<...> database=obsidiannotes bash`.
+
 If it results like the following:
 ```
 CouchDB provisioning completed.
@@ -173,20 +176,20 @@ Now `https://tiles-photograph-routine-groundwater.trycloudflare.com` is our serv
 
 ### 1. Generate the setup URI on a desktop device or server
 
-The `username` and `password` here are the credentials which Self-hosted LiveSync will store for routine access to this database. They may be the administrator credentials from step 2. If you have separately configured a CouchDB account with the required access to this database, use that account instead. Neither the provisioning wrapper nor the Setup URI generator creates that separate account.
+The `LIVESYNC_USER` and `LIVESYNC_PASS` here are the credentials which Self-hosted LiveSync will store for routine access to this database. They may be the administrator credentials from step 2. If you have separately configured a CouchDB account with the required access to this database, use that account instead. Neither the provisioning wrapper nor the Setup URI generator creates that separate account.
 
 ```bash
-export hostname=https://tiles-photograph-routine-groundwater.trycloudflare.com
-export database=obsidiannotes
-export username=<INSERT COUCHDB USERNAME FOR LIVESYNC>
-export password=<INSERT THE COUCHDB PASSWORD>
-export passphrase=<INSERT A STRONG VAULT ENCRYPTION PASSPHRASE>
+export LIVESYNC_HOST=https://tiles-photograph-routine-groundwater.trycloudflare.com
+export LIVESYNC_DB=obsidiannotes
+export LIVESYNC_USER=<INSERT COUCHDB USERNAME FOR LIVESYNC>
+export LIVESYNC_PASS=<INSERT THE COUCHDB PASSWORD>
+export LIVESYNC_PASSPHRASE=<INSERT A STRONG VAULT ENCRYPTION PASSPHRASE>
 export uri_passphrase=<INSERT A SEPARATE SETUP URI PASSPHRASE> # Optional
 deno run --minimum-dependency-age=0 --allow-env https://raw.githubusercontent.com/vrtmrz/obsidian-livesync/main/utils/setup/generate_setup_uri.ts
 ```
 
 > [!TIP]
-> `passphrase` protects the synchronised Vault data with end-to-end encryption. `uri_passphrase` protects only the Setup URI. Use different values, store both securely, and do not send the Setup URI and its passphrase through the same channel.
+> `LIVESYNC_PASSPHRASE` protects the synchronised Vault data with end-to-end encryption. `uri_passphrase` protects only the Setup URI. Use different values, store both securely, and do not send the Setup URI and its passphrase through the same channel.
 >
 > If `uri_passphrase` is omitted, the generator creates a cryptographically random value and prints it once.
 

docs/setup_p2p.md

@@ -130,7 +130,7 @@ export remote_type=p2p
 export p2p_relays=wss://relay.example.com
 export p2p_room_id=<A PRIVATE ROOM ID> # Optional; generated when omitted
 export p2p_passphrase=<A PRIVATE P2P PASSPHRASE> # Optional; generated when omitted
-export passphrase=<A STRONG VAULT ENCRYPTION PASSPHRASE>
+export LIVESYNC_PASSPHRASE=<A STRONG VAULT ENCRYPTION PASSPHRASE>
 export uri_passphrase=<A SEPARATE SETUP URI PASSPHRASE>
 deno run --minimum-dependency-age=0 --allow-env https://raw.githubusercontent.com/vrtmrz/obsidian-livesync/main/utils/setup/generate_setup_uri.ts
 ```

docs/tips/hidden-file-sync.md

@@ -32,6 +32,10 @@ Enabling Hidden File Sync requires an initialisation direction:
 
 Prefer a narrow target list. Device-specific workspace state and another plug-in's credentials are usually poor candidates for cross-device synchronisation.
 
+`Normal Files` → `Synchronising files` limits ordinary files only. Hidden File Sync uses its own `Target patterns`. The `Non-Synchronising files` patterns under `Normal Files` also exclude matching hidden files, so review them alongside the hidden-file selectors.
+
+If an earlier version skipped hidden files because of the normal-file allow-list, repeat Hidden File Sync initialisation after updating. A routine scan can skip unchanged files which were already checked. Back up the Vault and choose the intended source direction as described above.
+
 Target patterns also control directory traversal. A pattern must therefore match each parent directory as well as the intended files. For example, the following pattern admits the `.obsidian` parent and only its `snippets` subtree:
 
 ```text