Refine the release note structure and tone

docs: credit CLI scan fix contributors

.github/workflows/cli-deno-tests.yml

@@ -56,7 +56,7 @@ jobs:
 
           case "$SELECTED_TASK" in
             test:ci)
-              TASK_MATRIX='["test:setup-put-cat","test:mirror","test:daemon","test:push-pull","test:decoupled-vault","test:sync-two-local","test:sync-locked-remote","test:remote-commands","test:e2e-matrix:couchdb-enc0","test:e2e-matrix:couchdb-enc1","test:e2e-matrix:minio-enc0","test:e2e-matrix:minio-enc1"]'
+              TASK_MATRIX='["test:setup-put-cat","test:mirror","test:daemon","test:daemon-startup","test:push-pull","test:decoupled-vault","test:sync-two-local","test:sync-locked-remote","test:remote-commands","test:e2e-matrix:couchdb-enc0","test:e2e-matrix:couchdb-enc1","test:e2e-matrix:minio-enc0","test:e2e-matrix:minio-enc1"]'
               ;;
             test:local)
               TASK_MATRIX='["test:setup-put-cat","test:mirror","test:daemon"]'
@@ -84,10 +84,10 @@ jobs:
         task: ${{ fromJson(needs.prepare.outputs.task_matrix) }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: '24.x'
           cache: 'npm'
@@ -99,7 +99,7 @@ jobs:
           deno-version: v2.x
 
       - name: Cache Deno dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.cache/deno
           key: ${{ runner.os }}-deno-${{ hashFiles('src/apps/cli/testdeno/deno.lock', 'src/apps/cli/testdeno/deno.json') }}
@@ -151,7 +151,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Show Docker versions
         run: |

.github/workflows/cli-docker.yml

@@ -46,7 +46,7 @@ jobs:
 
         steps:
             - name: Checkout
-              uses: actions/checkout@v4
+              uses: actions/checkout@v5
 
             - name: Derive image tag
               id: meta
@@ -86,22 +86,22 @@ jobs:
                   echo "push=${PUSH}" >> $GITHUB_OUTPUT
 
             - name: Log in to GitHub Container Registry
-              uses: docker/login-action@v3
+              uses: docker/login-action@v4
               with:
                   registry: ghcr.io
                   username: ${{ github.actor }}
                   password: ${{ secrets.GITHUB_TOKEN }}
 
             - name: Set up QEMU
-              uses: docker/setup-qemu-action@v3
+              uses: docker/setup-qemu-action@v4
               with:
                   platforms: arm64
 
             - name: Set up Docker Buildx
-              uses: docker/setup-buildx-action@v3
+              uses: docker/setup-buildx-action@v4
 
             - name: Setup Node.js
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@v5
               with:
                   node-version: "24.x"
                   cache: "npm"
@@ -128,7 +128,7 @@ jobs:
 
             - name: Build and push
               if: ${{ steps.e2e.outcome == 'success' || (github.event_name == 'workflow_dispatch' && inputs.force) }}
-              uses: docker/build-push-action@v6
+              uses: docker/build-push-action@v7
               with:
                   context: .
                   file: src/apps/cli/Dockerfile

.github/workflows/cli-e2e.yml

@@ -22,10 +22,10 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: '24.x'
           cache: 'npm'

.github/workflows/cli-p2p-compose-smoke.yml

@@ -38,7 +38,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Show Docker versions
         run: |
@@ -83,7 +83,7 @@ jobs:
 
       - name: Upload benchmark results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: cli-p2p-compose-smoke-results
           path: test/bench-network/bench-results/**

.github/workflows/deploy-pages.yml

@@ -36,10 +36,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: '24.x'
           cache: 'npm'
@@ -85,10 +85,10 @@ jobs:
         run: npm run test:browser-apps:pages
 
       - name: Configure GitHub Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@v6
 
       - name: Upload GitHub Pages artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5
         with:
           path: _site
 
@@ -103,4 +103,4 @@ jobs:
     steps:
       - name: Deploy GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

.github/workflows/finalise-release.yml

@@ -47,13 +47,13 @@ jobs:
                   fi
                   echo "name=${BRANCH}" >> "$GITHUB_OUTPUT"
 
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v5
               with:
                   ref: ${{ steps.branch.outputs.name }}
                   fetch-depth: 0
 
             - name: Use Node.js
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@v5
               with:
                   node-version: "24.x"
 

.github/workflows/prepare-release.yml

@@ -33,13 +33,13 @@ jobs:
             contents: write
             pull-requests: write
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v5
               with:
                   ref: ${{ inputs.base_branch }}
                   fetch-depth: 0
 
             - name: Use Node.js
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@v5
               with:
                   node-version: "24.x"
                   cache: npm

.github/workflows/release.yml

@@ -26,12 +26,12 @@ jobs:
       id-token: write
       attestations: write
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         fetch-depth: 0
         ref: ${{ inputs.tag }}
     - name: Use Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v5
       with:
         node-version: '24.x'
     - name: Validate release
@@ -61,7 +61,7 @@ jobs:
               manifest.json
               styles.css
     - name: Create Release and Upload Assets
-      uses: softprops/action-gh-release@v2
+      uses: softprops/action-gh-release@v3
       with:
         files: |
           main.js

.github/workflows/unit-ci.yml

@@ -65,10 +65,10 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: '24.x'
           cache: 'npm'
@@ -113,10 +113,10 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: '24.x'
           cache: 'npm'
@@ -127,6 +127,9 @@ jobs:
       - name: Run source checks
         run: npm run check
 
+      - name: Run release process tests
+        run: npm run test:release-process
+
       - name: Run unit tests suite with coverage
         run: npm run test:unit:coverage
 
@@ -135,7 +138,7 @@ jobs:
 
       - name: Upload coverage report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: unit-coverage-report
           path: coverage/**
@@ -146,7 +149,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Detect LiveSync-owned integration tests
         id: integration_tests
@@ -165,7 +168,7 @@ jobs:
 
       - name: Setup Node.js
         if: ${{ steps.integration_tests.outputs.present == 'true' }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: '24.x'
           cache: 'npm'
@@ -196,7 +199,7 @@ jobs:
         if: ${{ steps.integration_tests.outputs.present == 'true' }}
         run: npm run test:docker-couchdb:start
 
-      - name: Start MinIO container
+      - name: Start RustFS container
         if: ${{ steps.integration_tests.outputs.present == 'true' }}
         run: npm run test:docker-s3:start
 

CITATION.cff

@@ -0,0 +1,24 @@
+cff-version: 1.2.0
+message: "If you use this software, please cite it using the metadata from this file."
+title: "Self-hosted LiveSync"
+abstract: "Self-hosted LiveSync is an open-source synchronisation plug-in for Obsidian that replicates note vaults and supporting files across desktop and mobile devices using user-controlled servers, object storage, or direct peer-to-peer connections."
+type: software
+authors:
+  - name: "vorotamoroz"
+    website: "https://github.com/vrtmrz"
+  - name: "Self-hosted LiveSync Contributors"
+repository-code: "https://github.com/vrtmrz/obsidian-livesync"
+url: "https://github.com/vrtmrz/obsidian-livesync"
+version: 1.0.23
+doi: 10.5281/zenodo.22247183
+date-released: "2026-09-05"
+license: MIT
+keywords:
+  - obsidian
+  - obsidian-plugin
+  - synchronisation
+  - local-first
+  - couchdb
+  - pouchdb
+  - webrtc
+  - peer-to-peer

devs.md

@@ -87,9 +87,9 @@ Regression tests remain in the suite owned by the implementation under test. Plu
 
 - **CLI E2E** (`src/apps/cli/testdeno/`): Host-independent consumer workflows. The canonical Compose P2P suite covers ordinary two-peer synchronisation, replacement of the current Replicator followed by transfer with the same peer, and explicit relay disconnection followed by paused and resumed reconnection. Its lifecycle entry point is included only in the Docker test build and does not add a public CLI command. Run `npm run test:e2e:cli` for the ordinary suite or `npm run test:e2e:cli:p2p` for P2P validation.
 - **Self-hosted setup tools** (`utils/couchdb/`, `utils/setup/`, and `utils/flyio/`): Deno contract tests consume the exact locked Commonlib registry package, verify current CouchDB, Object Storage, and random-room P2P Setup URI defaults and remote profiles, and keep CouchDB administration separate from package-owned LiveSync database-version negotiation. `unit-ci` also provisions a real temporary CouchDB database and verifies its version document against the installed Commonlib package. Run `npm run test:setup-tools` for the local contract gate.
-- **Real Obsidian E2E** (`test/e2e-obsidian/`): Local-first scripts that launch real Obsidian with temporary vaults and the built Self-hosted LiveSync plug-in. Use these for boot-up sequence, vault reflection, RedFlag flows, Fast Setup (Simple Fetch), settings dialogues, restart-sensitive workflows, Object Storage regressions, and other behaviour that depends on Obsidian itself. Run focused scripts such as `npm run test:e2e:obsidian:two-vault-sync`, or use `npm run test:e2e:obsidian:local-suite:services` to run the broader local suite with CouchDB and MinIO fixtures managed by the wrapper.
+- **Real Obsidian E2E** (`test/e2e-obsidian/`): Local-first scripts that launch real Obsidian with temporary vaults and the built Self-hosted LiveSync plug-in. Use these for boot-up sequence, vault reflection, RedFlag flows, Fast Setup (Simple Fetch), settings dialogues, restart-sensitive workflows, Object Storage regressions, and other behaviour that depends on Obsidian itself. Run focused scripts such as `npm run test:e2e:obsidian:two-vault-sync`, or use `npm run test:e2e:obsidian:local-suite:services` to run the broader local suite with CouchDB and RustFS fixtures managed by the wrapper.
 
-- **Docker Services**: Service-backed tests use CouchDB and MinIO (S3). Canonical P2P validation owns its relay through the CLI Compose runner:
+- **Docker Services**: Service-backed tests use CouchDB and RustFS (S3). Canonical P2P validation owns its relay through the CLI Compose runner:
 
     ```bash
     npm run test:docker-all:start  # Start all test services
@@ -133,6 +133,15 @@ The [Project glossary](docs/glossary.md#developer-and-design-terms) defines the
 stable developer and design vocabulary used in this section. The guidance
 below describes how those boundaries are applied.
 
+For file-event admission versus physical Vault writes, see
+[File events and storage writes](docs/tech_info.md#file-events-and-storage-writes)
+and its linked Commonlib contract. Keep regression coverage for those two
+directions separate when changing deletion handling.
+
+For shared synchronisation-setting comparisons, directional reconstruction
+consequences, and the lifetime of a recovery decision, see
+[Tweak compatibility and recovery](docs/design_docs/tweak_compatibility.md).
+
 ### Service composition and legacy Modules
 
 The application is composed from Services, ServiceModules, serviceFeatures, add-ons, and a legacy Module layer:
@@ -180,6 +189,8 @@ steps required to add a built-in provider.
 
 Commonlib owns one stable `LiveSyncP2PService`, its `P2PRoomSessionOwner`, and the replaceable Trystero room session. Host commands, event handlers, and views consume the focused transport, connection-probe admission, directory, peer-admission, transfer, change-relay, configuration, and diagnostic views returned by the service feature. They must not retain the deprecated compatibility Replicator as an ordinary service locator, close Trystero-owned raw peers, or install another Trystero transport generation at the application root. The exact implemented ownership and shutdown boundaries are recorded in Commonlib's [P2P transport lifecycle](https://github.com/vrtmrz/livesync-commonlib/blob/main/docs/p2p-transport-lifecycle.md) design document.
 
+The [TURN connection settings design](docs/design_docs/renewable_turn_credentials.md) describes how the host prepares temporary ICE credentials in a connection-only settings copy. It covers room reuse and expiry, replication continuation, profile persistence and sharing, and report redaction.
+
 ### Conflict Merge Policy
 
 Markdown conflict auto-merge should behave like a conservative three-way merge. The guiding rule is to merge changes when they touch non-overlapping regions, and to keep a manual conflict when the edits overlap semantically.
@@ -238,6 +249,21 @@ Commonlib owns the typed English fallback for messages requested by its services
 - Dev mode creates `ls-debug/` folder in `.obsidian/` for debug outputs (e.g., missing translations)
     - This causes pretty significant performance overhead.
 
+#### Diagnostic and notice ownership
+
+- A Commonlib or service operation should normally record detailed diagnostics at `LOG_LEVEL_VERBOSE` and return a typed result which lets its caller distinguish complete, partial, and failed outcomes. Do not make callers infer an outcome by parsing log text.
+- Detailed diagnostics may be long and remain in English when they are intended for tracing and the generated report. Include enough context to identify the operation, affected target, and remaining state or retry behaviour.
+- The application boundary which owns the workflow should decide whether to raise `LOG_LEVEL_NOTICE`. It has the interaction context to describe the user-visible consequence and the next useful action; an internal stage description alone is not a useful notice.
+- When several files fail, issue one concise summary notice after the operation returns. Keep the per-file paths and technical causes at verbose level so that the notice remains readable and the generated report remains traceable.
+- Commonlib should raise a notice only when its contract explicitly owns user presentation and no higher-level caller can add the required workflow context.
+
+The ordinary start-up scan provides a concrete comparison:
+
+- Good verbose diagnostic: `Offline scan failed to synchronise ${path} between storage and the local database; this path remains eligible for a later scan.` It identifies the operation, the two states being reconciled, the exact target, and what can happen next. Its length is appropriate for a report.
+- Notice which needs more context: `Local database initialisation did not complete. See the log for details.` It describes an internal stage, but does not tell the user whether synchronisation can continue, what may be affected, or how to obtain the detailed log.
+- Good application notice for a partial result: `Not all files could be synchronised. Check the affected files. Generate a report to review the detailed log.` It states the observable consequence, gives a proportionate action, and leaves the per-file evidence in the report.
+- Good application notice for a failed result: `Self-hosted LiveSync cannot synchronise. Generate a report to review the detailed log.` It states the operational consequence without exposing the internal initialisation stage.
+
 ## Common Patterns
 
 ### Service feature implementation

docs/adr/2026_08_p2p_transport_compatibility.md

@@ -46,7 +46,7 @@ LiveSync will expose a separate `Connection path` choice:
 - `Automatic` retains normal ICE selection and is the default.
 - `TURN relay only` supplies `iceTransportPolicy: 'relay'` and prevents direct or server-reflexive candidates from being selected.
 
-`TURN relay only` is enabled only when at least one syntactically valid `turn:` or `turns:` URL is configured. If the last valid TURN URL is removed while relay-only mode is selected, the dialogue restores `Automatic` and displays a concise explanation.
+`TURN relay only` is enabled when a managed TURN provider is selected or at least one syntactically valid manual `turn:` or `turns:` URL is configured. If neither is available while relay-only mode is selected, the dialogue restores `Automatic` and displays a concise explanation. Selecting a managed provider does not itself force relay use; `Automatic` retains normal ICE selection.
 
 The route policy is an ordinary P2P profile property. It is retained in P2P connection strings and encrypted Setup URIs so that an imported compatibility profile has reproducible transport behaviour.
 
@@ -60,7 +60,15 @@ The first settings revision retains the existing storage and dialogue contract o
 
 A future interface may present the existing comma-separated value as ordered `turn:` and `turns:` URL rows without changing its serialised representation. A structured list of multiple credential profiles is deferred until a provider or self-hosted use case requires different credentials in the same P2P profile.
 
-Static long-term credentials are the supported first stage. Managed providers may return short-lived credentials, but LiveSync must not store a provider API token or a Coturn shared authentication secret. A future managed-credential design needs a separately trusted HTTPS endpoint, expiry handling, refresh behaviour, failure reporting, and a clear Setup URI policy. It is not represented as another static password field.
+Static long-term credentials remain supported. For managed credentials, a host preparation hook requests ICE settings and places them on a connection-only copy of `P2PSyncSetting`. Service-specific requests and validation belong under `src/integrations/`; Commonlib consumes that copy and owns room reuse, expiry checks, and replacement. It has no provider catalogue or source factory.
+
+A user-supplied provider API token is persisted as a sensitive P2P profile setting and included in encrypted Setup URI sharing, so that participating devices can use the same configuration without repeated token entry. Existing profile-URI encryption covers the saved token; its flat runtime projection is omitted from persistence. Reports and logs redact the complete provider configuration and issued credentials, including inactive profiles and settings projections. Coturn's server-side shared authentication secret remains outside client settings.
+
+Issued short-lived TURN credentials and their expiry remain in memory. The existing room reuse decision checks both the effective connection settings and credential validity. When reconciliation finds expired credentials, it uses the normal room retirement and replacement path with newly acquired credentials. Replacement may cancel an in-progress transfer; the next replication attempt uses stored checkpoints and revision comparison to retain received progress. Whether that next attempt starts automatically follows the existing synchronisation policy.
+
+Time passing alone does not trigger acquisition or disconnection. This design adds no renewal timer, per-peer acquisition hook, configuration update on raw peers, or credential-driven ICE restart. Internal peer reconnection within an unchanged room does not guarantee fresh issuance. Acquisition failure is reported without changing the selected provider or route policy. See [TURN connection settings](../design_docs/renewable_turn_credentials.md) for the preparation hook, persistence and sharing formats, room replacement, and verified replication continuation behaviour.
+
+Relay-only validation accepts a valid managed TURN configuration as well as the existing manual URL list. Failure to acquire usable TURN entries keeps relay-only mode selected and reports the connection failure; it does not restore `Automatic` silently.
 
 ### TURN allocation check and route diagnostics
 

docs/design_docs/path_component_length_compatibility.md

@@ -0,0 +1,70 @@
+---
+date: 2026-09-04
+commonlib-version: "0.1.21"
+self-hosted-livesync-version: "1.0.24"
+status: unreleased
+---
+
+# Path component length compatibility
+
+## Purpose
+
+File systems place limits on each file or folder name, rather than applying one
+common limit to an entire Vault-relative path. Those limits are also expressed
+in different units. Self-hosted LiveSync therefore treats 255 UTF-8 bytes as a
+focused Android and Linux compatibility warning, not as a universal definition
+of a valid path.
+
+## Basis for the 255-byte warning
+
+- The Linux kernel documentation gives ext4 a maximum file-name length of
+  [255 bytes](https://www.kernel.org/doc/html/latest/filesystems/ext4/directory.html).
+- The F2FS on-disk header defines
+  [`F2FS_NAME_LEN` as 255](https://android.googlesource.com/kernel/common/+/88d92fb1c034922572bab93482ac9cc61d4ba43c/include/linux/f2fs_fs.h)
+  and stores names in byte arrays.
+- Android's MediaProvider uses a
+  [`MAX_FILENAME_BYTES` value of 255](https://android.googlesource.com/platform/packages/providers/MediaProvider/+/bae279463/src/com/android/providers/media/util/FileUtils.java)
+  when building file names. Its source notes that emulated storage can write to
+  ext4 through FUSE, where names are encoded as UTF-8.
+- Android 11 and later use
+  [FUSE for emulated storage](https://source.android.com/docs/core/storage/fuse-passthrough),
+  with requests passing through to the underlying file system.
+
+Together, these provide a conservative compatibility boundary for file names
+which may reach Android or Linux storage. They do not show that every Android
+device, storage provider, or Linux file system has the same limit.
+
+## Why the rule is not universal
+
+Other platforms describe component limits differently. Microsoft's file-system
+comparison documents limits in
+[Unicode characters](https://learn.microsoft.com/en-us/windows/win32/fileio/filesystem-functionality-comparison),
+not UTF-8 bytes. Apple's HFS Plus format stores a name as up to
+[255 16-bit `UniChar` values](https://developer.apple.com/library/archive/technotes/tn/tn1150.html).
+Apple's APFS guidance discusses valid UTF-8 names, normalisation, and case
+sensitivity, but does not establish a universal
+[255-byte component rule](https://developer.apple.com/library/archive/documentation/FileManagement/Conceptual/APFS_Guide/FAQ/FAQ.html).
+
+A name can consequently exceed 255 UTF-8 bytes and still work on one platform,
+or fail for another platform-specific reason while remaining below this
+boundary.
+
+## Product policy
+
+Self-hosted LiveSync applies the warning as follows:
+
+1. split the Vault-relative path on `/` and inspect each non-empty component;
+2. measure each component after UTF-8 encoding;
+3. accept 255 bytes without this warning and warn at 256 bytes or more;
+4. identify every over-limit file or folder name in the active-file status;
+5. do not reject, truncate, or rename the path; and
+6. treat the result of the real storage operation as authoritative.
+
+If a scan cannot process an individual file, its path is recorded in the
+verbose log and remains eligible for a later retry. Ordinary start-up may still
+become ready so that unaffected files can synchronise. Explicit Fetch and
+Rebuild operations retain strict scan completion because they establish an
+authoritative local or remote state.
+
+This policy does not replace the existing checks for reserved characters,
+case collisions, ignore rules, or configured file-size limits.

docs/design_docs/renewable_turn_credentials.md

@@ -0,0 +1,177 @@
+---
+date: 2026-09-16
+commonlib-version: "0.1.25"
+self-hosted-livesync-version: "1.0.28"
+status: unreleased
+---
+
+# TURN credentials in P2P connection settings
+
+## Purpose
+
+This design addresses [Issue #1182](https://github.com/vrtmrz/obsidian-livesync/issues/1182)
+by acquiring temporary TURN credentials on the device before opening a P2P room.
+The [P2P transport compatibility ADR](../adr/2026_08_p2p_transport_compatibility.md)
+records the connection and persistence policy.
+
+LiveSync prepares a connection copy of `P2PSyncSetting`. Commonlib owns the room
+lifecycle and consumes the resulting ICE settings. Service-specific HTTP and
+validation remain under `src/integrations/`; Commonlib has no provider catalogue
+or versioned acquisition descriptor. Cloudflare is the first optional integration.
+Manual TURN configuration remains available without a provider account.
+
+## Settings and ownership
+
+| Setting | Meaning | Lifetime |
+| --- | --- | --- |
+| `P2P_managedType` | Provider identifier; `CF` selects Cloudflare | P2P profile |
+| `P2P_managedId` | Provider key identifier; Cloudflare TURN Key ID | P2P profile |
+| `P2P_managedToken` | Provider API token used to request credentials | P2P profile |
+| `P2P_iceServers` | Prepared `RTCIceServer[]` | One room connection |
+| `P2P_iceServersExpiresAt` | Absolute expiry in Unix milliseconds | One room connection |
+
+The first three values use ordinary ConnStr query parameters `managedType`,
+`managedId`, and `token`. The existing `appId` parameter continues to identify the
+P2P application. Commonlib reads and writes the three scalar values so profile
+editing and activation preserve them. The host interprets the provider identifier.
+An absent identifier selects the existing manual fields; an unsupported identifier
+produces an explicit error when a connection is requested.
+
+Keep `P2P_turnServers`, `P2P_turnUsername`, and `P2P_turnCredential` for manual
+configuration. Issuance does not overwrite them. Retain the complete ICE array:
+individual entries can contain different credentials or STUN-only URLs.
+
+## Host preparation
+
+The optional `prepareP2PSettings(settings, signal)` composition hook receives a
+snapshot of requested P2P settings. LiveSync supplies the same preparation function
+to Obsidian, CLI, WebApp, and WebPeer using each host's HTTP adapter.
+
+For a managed selection, the function validates the provider inputs, requests
+credentials, and returns a connection copy:
+
+```typescript
+return {
+    ...settings,
+    P2P_iceServers: iceServers,
+    P2P_iceServersExpiresAt: expiresAt,
+};
+```
+
+Commonlib takes the prepared ICE fields into its session snapshot and passes that
+snapshot through `ReplicatorHostEnv.settings`. The hook does not change the
+requested room identity, persist settings, own replication, or schedule renewal.
+Its HTTP request must settle on cancellation and has a bounded deadline. The room
+owner also stops waiting for preparation when the connection request is retired.
+An explicitly managed configuration requires a preparation hook and usable ICE
+credentials; acquisition failure does not select a fallback provider or route.
+Managed credential acquisition is independent of the connection path. `Automatic`
+retains normal ICE selection, including direct candidates; only `TURN relay only`
+forces relay use. Acquisition must still succeed before opening a managed room
+when `Automatic` is selected.
+
+## Room reuse and expiry
+
+The active connection settings hold the issued credentials. They are the only
+credential cache. The existing room reuse decision checks:
+
+1. whether the requested database and connection settings still match; and
+2. whether the active connection's credentials have enough remaining lifetime.
+
+The static connection signature includes the provider type, key ID, and token.
+It excludes the generated ICE array and expiry. Comparing the prepared and stored
+settings directly would incorrectly trigger issuance on every reconciliation.
+
+When reuse is unavailable, the owner retires the existing room, obtains a fresh
+connection copy, and opens its replacement. It checks settings, room demand,
+cancellation, and expiry again before publishing the replacement. A late result
+cannot reopen a closed room or apply credentials requested for different settings.
+Explicit reconnection acquires fresh credentials. Closing the room releases its
+credential references. Preserve a 30-second connection-establishment margin.
+
+Reconciliation runs at existing connection, settings, and lifecycle boundaries.
+Time passing alone does not trigger acquisition or disconnection. There is no
+renewal timer, per-peer acquisition, raw WebRTC configuration update, ICE restart,
+or general retry mechanism. Trystero's internal peer reconnection within an
+unchanged room uses that room's existing configuration.
+
+Normal retirement may cancel an in-progress transfer. A later replication attempt
+uses stored checkpoints and revision comparison to retain received progress.
+An unfinished network message may be sent again. Whether another attempt starts
+automatically continues to follow the existing synchronisation policy.
+
+## Persistence, sharing, and privacy
+
+Persist provider values only inside the selected P2P profile URI. Flat values in
+runtime settings are a projection restored by profile activation. Profile edits
+update that URI explicitly. General settings saves do not rebuild a P2P profile
+from unrelated flat settings. Flat-settings migration creates and selects its
+P2P profile once, independently of the selected main remote.
+
+Existing whole-profile encryption covers the saved API token. The default mode
+uses the existing built-in key; a user-supplied configuration passphrase has its
+existing protection semantics. Failure to encrypt a managed profile leaves the
+previous saved data intact. No separate encrypted-token field is added. A draft
+containing provider credentials but no Group ID remains unsaved.
+
+Setup URIs and ordinary settings QR codes already contain `remoteConfigurations`.
+The provider values travel inside that profile URI, including inactive profiles.
+Omit their duplicate flat projections from sharing. No new URI scheme, encoded QR
+slot, or encryption envelope is needed. Setup URIs retain passphrase encryption;
+QR codes retain their unencrypted format and 'FOR YOUR EYES ONLY' display.
+
+Issued ICE credentials and expiry appear only in connection copies. Remove both
+runtime fields at save, import, and sharing boundaries, including
+`TrysteroReplicator.getAllConfig`, which starts from the session settings.
+Incoming settings cannot install an issued credential override. Reports omit
+runtime ICE fields, redact provider values, and retain scheme-only profile URIs.
+Logs use safe errors and omit request headers, raw responses, and connection
+signatures. Ordinary plaintext in process memory is permitted.
+
+Markdown settings omit managed provider values and the profile collection with
+its selections. If that group is omitted during import, preserve the corresponding
+local P2P connection values as well as the profiles. This prevents combining an
+imported room with the local provider token or overwriting the saved profile.
+
+## Cloudflare integration
+
+The UI presents `Manual` and `Managed (Cloudflare)`, with `TURN Key ID` and a masked
+`TURN Key API Token` input for Cloudflare. It requires no account ID, custom
+endpoint, SDK, credential broker, or renewal interval setting.
+
+The provider function uses Cloudflare's
+[credential-generation endpoint](https://developers.cloudflare.com/realtime/turn/generate-credentials/)
+and converts its response into ICE servers. The implementation requests a fixed
+24-hour lifetime and derives local expiry from the clock before the request starts.
+This lifetime applies to the issued TURN credentials, not the provider API token.
+There is currently no setting to change it.
+
+The HTTP boundary uses the injected standard fetch adapter with cancellation,
+a 15-second deadline, refused redirects, omitted cookies, and disabled caching.
+It bounds the response to 32 KiB, 16 ICE entries, and 32 URLs, and validates URLs
+and complete TURN credentials. These are local implementation limits. Keep this
+validation at the provider boundary instead of repeating it in Commonlib.
+
+The token is supplied and shared by the user on their devices. The provider
+function sends the key ID, API token, and requested lifetime; it has no need for
+Vault data, the Group ID, or the Vault passphrase.
+
+## Setup and verification
+
+The Setup connection test remains a signalling check. A separately owned trial
+uses signalling-only settings and performs no managed TURN issuance. The existing
+active-relay admission rule still applies. Success does not verify the API token,
+TURN allocation, or document transfer. Actual room connections use the preparation
+hook and preserve the selected route policy on failure.
+
+Focused tests cover provider validation and cancellation, room reuse and expiry,
+late results after configuration changes or closure, migration without duplicate
+profiles, Markdown import through save/reload, safe acquisition failures, and
+exclusion of runtime credentials from storage and sharing.
+
+Validate Commonlib as an exact packed artefact before testing its LiveSync
+consumer. Verify the changed settings and restart boundary in real Obsidian.
+Previously observed provider issuance and relay synchronisation do not establish
+expiry-driven reconnection for a revised build. Fresh TURN allocation after
+expiry, mobile runtimes, and cross-network behaviour require their own runtime
+verification; a surviving Trystero shared peer is not evidence of new allocation.

docs/design_docs/tweak_compatibility.md

@@ -0,0 +1,93 @@
+---
+date: 2026-09-08
+commonlib-version: "0.1.24"
+self-hosted-livesync-version: "1.0.27"
+status: unreleased
+---
+
+# Tweak compatibility and recovery
+
+This document describes the integration of Commonlib 0.1.24 with
+Self-hosted LiveSync 1.0.27. Commonlib owns the interpretation of synchronisation
+settings; LiveSync owns the dialogues and operations which consume that result.
+
+## Shared assessment
+
+`assessTweakCompatibility`, exported by Commonlib's `settings` entry point,
+compares one snapshot of current settings with one snapshot of preferred settings.
+The result contains the original values, effective values, differences, and
+reconstruction consequences for each direction of adoption. It performs no
+settings writes, translation, network requests, or database operations.
+
+The interpretation of a missing value is specific to its setting. A missing
+`handleFilenameCaseSensitive` means `false`, matching legacy conversion from paths to
+document IDs. An explicitly enabled value is therefore different from either an
+explicitly disabled value or a missing value. Settings whose historical missing
+value has not been established remain unadvertised; the evaluator does not
+invent defaults or turn every falsy value into an absent value.
+
+The central replication gate, mismatch dialogues, and RedFlag Fetch preparation
+consume the same effective differences. The P2P transport retains its separate
+policy: ordinary representation differences warn without rejecting transfer,
+while its existing passphrase and peer checks still apply. Sharing assessment
+does not make the central replication policy appropriate for every transport.
+
+## Host responsibilities
+
+`ModuleResolvingMismatchedTweaks` renders the assessment supplied by the failed
+attempt. A legacy recovery hint without an assessment is adapted through the
+same Commonlib function. The remote profile review uses the trial settings as
+its current snapshot, including when deciding whether compatible chunk settings
+can be accepted automatically.
+
+Each adoption direction has its own reconstruction consequence. The remote
+values becoming local values can require local Fetch; the local values becoming
+preferred remote values can require remote Rebuild. The host must not infer the
+second consequence from the first. Existing explicit Fetch choices and manual
+acceptance controls remain host decisions.
+
+The common assessment identifies whether every known difference qualifies for
+automatic alignment. LiveSync retains the opt-out and modification-time policy
+which chooses a side. An unadvertised setting does not expand automatic
+alignment to a case whose effect cannot be assessed.
+
+Only defined, permitted settings are applied. A partial preferred configuration
+must not erase a local value with `undefined`. Recommended settings outside the
+set of settings which must match retain their existing adoption behaviour; RedFlag Fetch
+continues to apply only the set of settings which must match. RedFlag Rebuild remains
+authoritative from this device and does not adopt the remote configuration.
+
+## Decision lifetime
+
+An assessment describes one pair of inputs; it does not authorise a later
+write. LiveSync checks the settings and active publication again after waiting
+for a decision and before applying it. A changed target or changed settings
+discard that decision. The signature used for this check can contain sensitive
+configuration and must not be logged, persisted, or included in diagnostics.
+
+The active publication reservation is not held while waiting for the dialogue.
+Remote writes use the failed attempt's publication guard. Fetch and Rebuild use
+their existing owners and propagate failure without claiming a successful
+retry. A subsequent attempt must use fresh settings and respect publication
+replacement rather than reusing the rejected attempt's settings snapshot.
+
+Ordinary typed OneShot replication retains the failed outcome after its recovery
+dialogue; the next synchronisation request is a separate attempt. Directional
+replication can retry once after `CHECKAGAIN`, using freshly captured settings
+and the same publication guard. Setting adoption does not turn the original
+failed transfer into a completed transfer.
+
+## Verification boundaries
+
+Commonlib tests protect missing-value interpretation, representation differences,
+directional consequences, immutable results, central admission, and P2P policy.
+LiveSync unit tests protect ordinary versus reconstruction choices, trial-setting
+selection, partial-setting adoption, and invalidated decisions. RedFlag tests
+protect the distinction between adopting settings for Fetch and retaining local
+settings for Rebuild.
+
+Real-runtime verification must separately cover setting adoption, actual
+replication, explicit Fetch, and replication after restart. A unit test which
+mocks Fetch does not establish those behaviours, and a corrected mismatch
+dialogue alone does not establish the cause of a reported persistent automatic
+synchronisation failure.

docs/p2p.md

@@ -18,7 +18,7 @@ flowchart LR
 The signalling relay and TURN server have different roles:
 
 - The **signalling relay** is required for peer discovery and connection negotiation. LiveSync uses Nostr-compatible WebSocket relays for this role. The relay does not store or transfer Vault contents.
-- A **TURN server** is an optional fallback. WebRTC uses it to relay the encrypted peer connection only when the devices cannot establish a direct path through their networks.
+- A **TURN server** is an optional fallback. WebRTC uses it to relay the encrypted peer connection when the devices cannot establish a direct path through their networks, or whenever **TURN relay only** is selected.
 
 ## The project's public signalling relay
 
@@ -40,16 +40,49 @@ Both settings contain server addresses, but they are not interchangeable.
 | Setting | Required | Carries Vault contents | Purpose |
 | --- | --- | --- | --- |
 | **Signalling relay URLs** | Yes | No | Finds peers and exchanges the information needed to establish WebRTC connections. |
-| **TURN server URLs** | Only when direct WebRTC connectivity fails | Encrypted WebRTC traffic | Relays traffic between peers when NAT or firewall rules prevent a direct path. |
+| **TURN server URLs** | When direct WebRTC connectivity fails or **TURN relay only** is selected | Encrypted WebRTC traffic | Relays traffic between peers when NAT or firewall rules prevent a direct path. |
 
-A TURN provider cannot read LiveSync's encrypted Vault contents, but it can observe connection metadata and traffic volume. Use a provider you trust. The project does not operate an official TURN service.
+WebRTC encrypts data between the devices, including when it passes through TURN. The TURN provider cannot read the transferred data, but it can observe network addresses and traffic volume. This transport encryption also applies when LiveSync's optional database encryption is disabled. The project does not operate an official TURN service.
+
+## TURN credentials
+
+In **TURN configuration**, select **Manual** to enter your own TURN server URLs,
+username, and credential, or select **Managed (Cloudflare)** to enter a **TURN Key ID** and
+**TURN Key API Token**. Cloudflare is optional; the project does not require a
+particular TURN provider or operate a credential broker. See Cloudflare's
+[credential instructions](https://developers.cloudflare.com/realtime/turn/generate-credentials/)
+for creating a TURN key and its API token.
+
+The API token is saved with the P2P profile and included when sharing settings
+through an existing Setup URI or QR code. Setup URIs retain their existing
+passphrase encryption. QR codes retain their existing unencrypted format and
+'FOR YOUR EYES ONLY' display. Missing provider settings use the ordinary manual
+configuration defaults. Receiving clients need support for the selected provider
+to acquire its temporary TURN credentials.
+Markdown settings omit the connection profile group when it contains a managed
+TURN provider, including inactive profiles, and importing those omitted settings
+preserves this device's existing profiles. Diagnostic reports redact provider settings. The existing profile-URI
+encryption also covers the saved token.
+
+Each device requests temporary TURN credentials when opening a new room.
+An existing room reuses its credentials while they remain valid. Cloudflare credentials have a requested lifetime
+of 24 hours and remain in memory only. Expiry is checked when LiveSync next
+reconciles the room connection. If necessary, it replaces the room and obtains
+new credentials. There is no periodic renewal: if a long-lived room cannot
+reconnect after credentials expire, disconnect and open the connection again.
+
+Room replacement may interrupt replication. The next synchronisation keeps
+received Metadata and Chunks, resumes from its saved checkpoint, and compares
+revisions to fetch missing data. An unfinished network message can be sent
+again. Automatic synchronisation follows the existing peer rules; after an
+interrupted manual operation, use **Replicate now** again.
 
 ## Connection compatibility profiles
 
 `P2P Configuration` includes a separate `Connection compatibility` section. Its defaults preserve the existing transport behaviour:
 
 - **P2P message size** defaults to **Standard**. **Reduced**, **Conservative**, and **Maximum compatibility** progressively limit outgoing P2P messages when a network path appears to drop larger WebRTC messages. This is not a Vault Chunk size or an IP MTU. Smaller values add framing and processing overhead.
-- **Connection path** defaults to **Automatic**, which lets WebRTC select a viable direct or TURN-relayed path. **TURN relay only** forces the encrypted connection through TURN and is available only when the profile contains at least one valid `turn:` or `turns:` URL.
+- **Connection path** defaults to **Automatic**, which lets WebRTC select a viable direct or TURN-relayed path. **TURN relay only** forces the encrypted connection through TURN and is available when the profile contains a valid manual TURN URL or a configured TURN provider.
 
 The sending device controls its outgoing message size. Select the same conservative preset on every device which may send across the constrained path. Existing devices do not receive the choice retrospectively merely because another device changed it.
 

docs/releases/1.0.md

@@ -2,6 +2,131 @@
 
 This document contains earlier published releases from the 1.0 line of the [current Self-hosted LiveSync release history](../../updates.md). Beta and release-candidate builds published before 1.0.0 are recorded in the [1.0 preview history](1.0-previews.md). Earlier release lines continue in the [0.25 history](0.25.md) and the [legacy history](legacy.md).
 
+## 1.0.23
+
+2nd September, 2026
+
+I am sorry to make this release while several pull requests are still awaiting merge, but I believe that the safeguards provided by this work are significant, so I have decided to release it. I will merge the remaining pull requests in turn. Thank you for bearing with me while I have been less active recently.
+
+### Synchronisation and storage
+
+#### Fixed
+
+- **Sync now** once again keeps routine progress quiet, while still opening recovery dialogues when a decision is required. Repeated OneShot Sync requests received while an earlier attempt is running are now ignored instead of starting overlapping work.
+
+## 1.0.22
+
+1st September, 2026
+
+I am sorry to make this release while several pull requests are still awaiting merge, but I believe that the safeguards provided by this work are significant, so I have decided to release it. I will merge the remaining pull requests in turn. Thank you for bearing with me while I have been less active recently.
+
+### Synchronisation and storage
+
+#### Fixed
+
+- **Sync on Startup** now runs an immediate Object Storage synchronisation after start-up or resume, including migrated profiles which retain a Continuous setting that Object Storage cannot use.
+- A temporarily unavailable Object Storage synchronisation-parameter read is no longer treated as a missing object and cannot regenerate the shared Security Seed. Flow-specific Security Seed checks also bypass an earlier process-cached result.
+- Local database reset and plug-in unload now retire active replication through its owner before closing the database, without reporting a missing active Replicator or describing unload as a database reset.
+- **Fresh Start Wipe** now reports an incomplete Object Storage deletion instead of announcing success, and releases its temporary storage client after each attempt.
+
+### Peer-to-peer synchronisation
+
+#### Fixed
+
+- The P2P Setup connection test no longer interrupts an active P2P room. It observes an active compatible relay binding, blocks a test which would add another relay until P2P is disconnected, and uses a short-lived trial only while P2P is idle.
+- User-initiated P2P synchronisation now reports success only after the requested target transfer completes.
+- Optional WebApp P2P synchronisation now becomes ready after a successful local-file scan even when CouchDB remains unconfigured; failed preparation is not reported as ready.
+- Unattended P2P synchronisation no longer raises Notice-level messages for missing configured targets, authentication rejection, configuration mismatch, or an overlapping transfer. User-initiated operations retain their existing feedback.
+- P2P replication failure reasons now survive the JSON RPC boundary instead of reaching the requesting device as an empty object.
+
+### Command-line interface
+
+#### Fixed
+
+- `mark-resolved`, `lock-remote`, and `unlock-remote` now return a non-zero exit code when the selected provider cannot verify the requested remote state. Use `--compat-remote-admin-exit-zero` to retain the former exit code for returned verification failures; unknown remote IDs and mutation errors still fail.
+
+## 1.0.21
+
+26th August, 2026
+
+It is becoming more 'ordinary' with each release, but please let me know if anything has become less convenient.
+
+### Interface and translation
+
+#### Fixed
+
+- Remote Configuration section headings no longer overlap their contents when scrolling on mobile. Action buttons in Remote Configuration, Maintenance, and Patches now remain inside the settings pane on narrow screens.
+
+## 1.0.20
+
+~~1.0.19~~ was cancelled because prerelease validation exposed an incorrect warning at start-up.
+
+25th August, 2026
+
+I know this is the second time I have said it, but I had grown quite fond of the settings screen. It seems, however, that a simpler, healthier life is called for.
+
+### Interface and translation
+
+#### Fixed
+
+- Compatibility pause warnings now direct you to the dedicated compatibility review instead of the Change Log.
+- The Obsidian 1.13 settings page now waits for saved settings before choosing its initial layout. This prevents a spurious missing-replicator warning at start-up, keeps configured devices on the Synchronisation-first layout even when automatic synchronisation triggers are disabled, and keeps Quick Setup first on unconfigured devices.
+
+#### Improved
+
+- Settings page names, controls in General Settings, Quick Setup actions, and Advanced controls now use Obsidian 1.13's native settings interface and global search, while retaining their familiar icons. The landing page keeps Remote Configuration and Sync Settings together, places Appearance, Logging, and Extra menus under General Settings, and groups maintenance, optional features, advanced settings, and help by purpose. Earlier supported Obsidian versions continue to use the pane-based interface.
+- Settings changes which require database initialisation now use a focused Setup Manager dialogue to choose between existing synchronisation data and the files in the current Vault. The selected reset or rebuild is reserved before the settings are saved, while cancelling offers a separate, explicit settings-only fallback.
+
+## 1.0.18
+
+24th August, 2026
+
+### Synchronisation and storage
+
+#### Fixed
+
+- Reset and rebuild workflows now use the local database selected by their updated settings, preventing stale data from reopening after a **Database Suffix** change. If database initialisation does not complete, the workflow remains paused instead of continuing with incomplete state.
+
+#### Improved
+
+- Rebuilds now recheck restored file events against the current Vault, use current file contents, and finish processing them before the plug-in reports readiness.
+
+## 1.0.17
+
+23rd August, 2026
+
+### Interface and translation
+
+#### Fixed
+
+- Settings generated from the settings manifest, Setup Wizard configuration summaries, and warnings about externally changed settings now honour **Display language** when a translation is available, instead of remaining in English (PR #1123). Thank you to @nimula for the contribution!
+
+### Peer-to-peer synchronisation
+
+#### Improved
+
+- P2P connection profiles now provide four **P2P message size** presets and a **Connection path** choice between **Automatic** and **TURN relay only**. Smaller messages can improve compatibility on paths which fragment or drop larger WebRTC messages, while relay-only routing requires a configured TURN server. P2P connection strings and encrypted Setup URIs preserve both choices.
+    - Thank you to @andrewschreiber for the detailed fragmentation diagnosis and working 800-byte threshold in vrtmrz/livesync-commonlib#97, which informed this compatibility design.
+- An optional self-hosted Coturn Compose starter is now available for P2P deployments that need a TURN relay. It uses a pinned upstream image and documents its network, credential, security, and verification boundaries.
+
+## 1.0.16
+
+19th August, 2026
+
+### Conflict handling and recovery
+
+#### Fixed
+
+- **Back to this revision** in Document History now restores the selected content as a new non-deleted successor revision before reflecting it to the Vault. A readable revision restored after a logical deletion therefore remains restored through later synchronisation instead of being overwritten by the deletion.
+    - If the file changes while restoration is in progress, the operation stops instead of extending a stale revision. Existing conflicts remain available through **Inspect conflicts and file/database differences**.
+
+### Synchronisation and storage
+
+#### Improved
+
+- One-shot CouchDB synchronisation now releases stalled web-compatible connection checks before replication starts, so a later synchronisation can make a fresh attempt (Commonlib 0.1.16).
+    - The 60-second safeguard applies only to pre-replication checks. It does not limit ordinary synchronisation, and the **Use Internal API** path is unchanged.
+
 ## 1.0.15
 
 15th August, 2026

docs/settings.md

@@ -485,6 +485,25 @@ Setting key: P2P_AutoBroadcast
 
 When enabled, this device notifies connected peers after a local change. The notification contains no Vault data. A receiving peer fetches the change only when it follows this device.
 
+#### TURN configuration
+
+Setting key: P2P_managedType
+
+Select **Manual** for the existing TURN server fields, or **Managed (Cloudflare)** for a
+TURN Key ID and TURN Key API Token. The API token is persisted with the profile
+and included in Setup URI and QR code sharing. Issued temporary credentials are
+kept in memory only. Reports redact the provider settings. See
+[TURN credentials](p2p.md#turn-credentials) for sharing, expiry, and reconnect
+behaviour.
+
+#### TURN Key ID and TURN Key API Token
+
+Setting keys: P2P_managedId, P2P_managedToken
+
+These fields appear when **Managed (Cloudflare)** is selected. Enter the TURN key's ID and
+its dedicated API token. The token field is masked. No account ID, custom
+endpoint, or renewal interval is required.
+
 #### TURN Server URLs (comma-separated)
 
 Setting key: P2P_turnServers
@@ -515,7 +534,7 @@ The sender controls the size of its outgoing messages. Select the same conservat
 
 Setting key: P2P_connectionPath
 
-**Automatic** lets WebRTC select a viable direct or TURN-relayed path and is the default. **TURN relay only** forces `iceTransportPolicy: 'relay'` and is available only when the profile contains at least one valid `turn:` or `turns:` URL. Removing the last valid TURN URL while relay-only mode is selected restores **Automatic** and displays a Notice.
+**Automatic** lets WebRTC select a viable direct or TURN-relayed path and is the default. **TURN relay only** forces `iceTransportPolicy: 'relay'` and is available when the profile contains a valid manual TURN URL or a configured TURN credential source. Removing the manual TURN configuration while relay-only mode is selected restores **Automatic** and displays a Notice. A selected credential source which cannot supply credentials prevents the connection from opening; it does not change the connection path.
 
 This choice belongs to the P2P profile and is retained in P2P connection strings and encrypted Setup URIs. Separate profiles may use the same Group ID and credentials with different compatibility choices; only the selected P2P profile is active.
 

docs/tech_info.md

@@ -11,6 +11,26 @@
 
 Note: The figure is drawn as single-directional, between two devices for demonstration purposes. Everything actually occurs bi-directionally between many devices at the same time.
 
+## File events and storage writes
+
+File events describe changes observed in the Vault. Commonlib filters and
+serialises those events before updating file Metadata in the local database.
+A queued `DELETE` therefore requests a database change; it is not itself an
+instruction to delete the physical file. A rename out of the selected files
+can also become a database deletion while the destination remains on disk.
+
+The opposite direction starts with database Metadata. Replicated changes and
+full scans can call the database-to-storage handler, which writes or removes
+Vault files subject to its conflict and content-preservation rules. Preventing
+a stale file event from deleting Metadata and applying a valid replicated
+deletion are separate decisions.
+
+Commonlib's [Storage events and database-to-storage reflection](https://github.com/vrtmrz/livesync-commonlib/blob/main/docs/storage-events-and-reflection.md)
+documents the event boundary, the deletion revalidation introduced in
+Commonlib 0.1.23, and its limits. In particular, deletion protection does not
+promise full support for external folder case changes or convergence of path
+spelling.
+
 ## Current technical references
 
 - [Database Data Structures](datastructure.md) describes current Metadata and
@@ -22,6 +42,9 @@ Note: The figure is drawn as single-directional, between two devices for demonst
   defines the current revision-tree and file-provenance rules.
 - [Chunk Retrieval and Waiting](design_docs/chunk_retrieval_and_waiting.md)
   defines missing-Chunk arrival and quiescence handling.
+- [Path component length compatibility](design_docs/path_component_length_compatibility.md)
+  explains why 255 UTF-8 bytes is an Android and Linux compatibility warning,
+  rather than a universal rule for deciding whether a path is valid.
 - [Data Compression](specs_data_compression.md) and [Garbage Collection
   V3](specs_garbage_collection.md) describe their respective storage and
   maintenance contracts.

docs/troubleshooting.md

@@ -88,6 +88,8 @@ Some settings must match across devices. LiveSync pauses synchronisation when th
 
 Current releases automatically align compatible settings which control how new chunks are created, by default and where possible. This applies to the chunk hash algorithm, chunk size, and splitter version. Existing content remains readable across these choices, although using different choices can reduce chunk reuse and increase storage or transfer work. An explicit opt-out retains the manual review. A mismatch involving encryption, path obfuscation, file-name case handling, or any combination which includes one of those settings always remains a manual decision.
 
+A missing legacy file-name case setting means case-insensitive handling. It matches an explicit disabled setting and does not require a rebuild for that difference. An explicitly enabled setting can use different document IDs and still requires a compatibility decision against either value. Other configuration differences shown in the dialogue must still be resolved.
+
 The `Sync now` command keeps routine replication progress quiet so that it is convenient to assign to a keyboard shortcut; assign one in Obsidian if that suits your workflow. A quiet command may still open this dialogue when a mismatch or another decision requires your attention.
 
 The available actions depend on when the mismatch is found:

eslint.community.config.mjs

@@ -63,6 +63,13 @@ export default defineConfig(
             "@typescript-eslint/no-unnecessary-type-assertion": "warn",
         },
     },
+    {
+        files: ["src/integrations/**/*.ts"],
+        rules: {
+            // External-service integrations also run in Node and do not own window UI.
+            "obsidianmd/no-global-this": "off",
+        },
+    },
     {
         files: ["src/apps/**/*.{ts,js,mjs}"],
         rules: {

eslint.config.mjs

@@ -99,6 +99,13 @@ export default defineConfig([
             ...ImportAliasRules("."),
         },
     },
+    {
+        files: ["src/integrations/**/*.ts"],
+        rules: {
+            // External-service integrations also run in Node and do not own window UI.
+            "obsidianmd/no-global-this": "off",
+        },
+    },
     {
         files: ["src/apps/**/*.ts"],
         rules: {

manifest.json

@@ -1,7 +1,7 @@
 {
     "id": "obsidian-livesync",
     "name": "Self-hosted LiveSync",
-    "version": "1.0.24",
+    "version": "1.0.29",
     "minAppVersion": "1.7.2",
     "description": "Community implementation of self-hosted livesync. Reflect your vault changes to some other devices immediately. Please make sure to disable other synchronize solutions to avoid content corruption or duplication.",
     "author": "vorotamoroz",

package-lock.json

@@ -1,12 +1,12 @@
 {
     "name": "obsidian-livesync",
-    "version": "1.0.24",
+    "version": "1.0.29",
     "lockfileVersion": 3,
     "requires": true,
     "packages": {
         "": {
             "name": "obsidian-livesync",
-            "version": "1.0.24",
+            "version": "1.0.29",
             "license": "MIT",
             "workspaces": [
                 "src/apps/cli",
@@ -23,11 +23,10 @@
                 "@smithy/types": "^4.14.3",
                 "@smithy/util-retry": "^4.4.5",
                 "@vrtmrz/browser-ui-kit": "0.1.0",
-                "@vrtmrz/livesync-commonlib": "0.1.21",
+                "@vrtmrz/livesync-commonlib": "0.1.25",
                 "@vrtmrz/obsidian-plugin-kit": "0.1.4",
                 "@vrtmrz/ui-interactions": "0.1.2",
                 "diff-match-patch": "^1.0.5",
-                "fflate": "^0.8.2",
                 "idb": "^8.0.3",
                 "markdown-it": "^14.2.0",
                 "minimatch": "^10.2.5",
@@ -56,7 +55,7 @@
                 "@types/pouchdb-mapreduce": "^6.1.10",
                 "@types/pouchdb-replication": "^6.4.7",
                 "@types/transform-pouch": "^1.0.6",
-                "@typescript-eslint/parser": "8.56.1",
+                "@typescript-eslint/parser": "8.69.0",
                 "@vitest/coverage-v8": "^4.1.8",
                 "@vrtmrz/obsidian-test-session": "0.2.6",
                 "dotenv-cli": "^11.0.0",
@@ -86,13 +85,13 @@
                 "svelte": "5.56.3",
                 "svelte-check": "^4.6.0",
                 "svelte-eslint-parser": "^1.8.0",
-                "svelte-preprocess": "^6.0.3",
+                "svelte-preprocess": "6.0.5",
                 "terser": "^5.39.0",
                 "tinyglobby": "^0.2.15",
                 "transform-pouch": "^2.0.0",
                 "tsx": "^4.21.0",
-                "typescript": "5.9.3",
-                "typescript-eslint": "^8.61.0",
+                "typescript": "6.0.3",
+                "typescript-eslint": "8.69.0",
                 "vite": "^8.0.16",
                 "vitest": "^4.1.8",
                 "yaml": "^2.8.2"
@@ -2054,29 +2053,43 @@
             }
         },
         "node_modules/@humanfs/core": {
-            "version": "0.19.1",
-            "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.1.tgz",
-            "integrity": "sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==",
+            "version": "0.19.2",
+            "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
+            "integrity": "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==",
             "dev": true,
             "license": "Apache-2.0",
+            "dependencies": {
+                "@humanfs/types": "^0.15.0"
+            },
             "engines": {
                 "node": ">=18.18.0"
             }
         },
         "node_modules/@humanfs/node": {
-            "version": "0.16.7",
-            "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.7.tgz",
-            "integrity": "sha512-/zUx+yOsIrG4Y43Eh2peDeKCxlRt/gET6aHfaKpuq267qXdYDFViVHfMaLyygZOnl0kGWxFIgsBy8QFuTLUXEQ==",
+            "version": "0.16.8",
+            "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.8.tgz",
+            "integrity": "sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==",
             "dev": true,
             "license": "Apache-2.0",
             "dependencies": {
-                "@humanfs/core": "^0.19.1",
+                "@humanfs/core": "^0.19.2",
+                "@humanfs/types": "^0.15.0",
                 "@humanwhocodes/retry": "^0.4.0"
             },
             "engines": {
                 "node": ">=18.18.0"
             }
         },
+        "node_modules/@humanfs/types": {
+            "version": "0.15.0",
+            "resolved": "https://registry.npmjs.org/@humanfs/types/-/types-0.15.0.tgz",
+            "integrity": "sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==",
+            "dev": true,
+            "license": "Apache-2.0",
+            "engines": {
+                "node": ">=18.18.0"
+            }
+        },
         "node_modules/@humanwhocodes/module-importer": {
             "version": "1.0.1",
             "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
@@ -4157,17 +4170,56 @@
             "devOptional": true,
             "license": "MIT"
         },
-        "node_modules/@typescript-eslint/parser": {
-            "version": "8.56.1",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.56.1.tgz",
-            "integrity": "sha512-klQbnPAAiGYFyI02+znpBRLyjL4/BrBd0nyWkdC0s/6xFLkXYQ8OoRrSkqacS1ddVxf/LDyODIKbQ5TgKAf/Fg==",
+        "node_modules/@typescript-eslint/eslint-plugin": {
+            "version": "8.69.0",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.69.0.tgz",
+            "integrity": "sha512-t5jQTKPIgVW1PE6dR6H6Qz5gm8zjMlX5/2gRaOGd9eO6V7J+tQc6iWKukEe7dY8u9HyYasQ0yfF0/FSSTEO2gA==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@typescript-eslint/scope-manager": "8.56.1",
-                "@typescript-eslint/types": "8.56.1",
-                "@typescript-eslint/typescript-estree": "8.56.1",
-                "@typescript-eslint/visitor-keys": "8.56.1",
+                "@eslint-community/regexpp": "^4.12.2",
+                "@typescript-eslint/scope-manager": "8.69.0",
+                "@typescript-eslint/type-utils": "8.69.0",
+                "@typescript-eslint/utils": "8.69.0",
+                "@typescript-eslint/visitor-keys": "8.69.0",
+                "ignore": "^7.0.5",
+                "natural-compare": "^1.4.0",
+                "ts-api-utils": "^2.5.0"
+            },
+            "engines": {
+                "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+            },
+            "funding": {
+                "type": "opencollective",
+                "url": "https://opencollective.com/typescript-eslint"
+            },
+            "peerDependencies": {
+                "@typescript-eslint/parser": "^8.69.0",
+                "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+                "typescript": ">=4.8.4 <6.1.0"
+            }
+        },
+        "node_modules/@typescript-eslint/eslint-plugin/node_modules/ignore": {
+            "version": "7.0.8",
+            "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.8.tgz",
+            "integrity": "sha512-YYNsSlXBjMk92SKnkwvB5LOVSa6OznlFUGcsvrFgNJbJCd0M1XKeFVRc8ZByeCqz32FivYNHJVooLmdqrmvp/Q==",
+            "dev": true,
+            "license": "MIT",
+            "engines": {
+                "node": ">= 4"
+            }
+        },
+        "node_modules/@typescript-eslint/parser": {
+            "version": "8.69.0",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.69.0.tgz",
+            "integrity": "sha512-l4b0DhWioGg6Gt2ebGlvfkFMOjRsauxtsnDRwUSRX1qHq3HdTfQHV8wW9zEXeciai6HfeaKOedQn2Zoofx3WBw==",
+            "dev": true,
+            "license": "MIT",
+            "dependencies": {
+                "@typescript-eslint/scope-manager": "8.69.0",
+                "@typescript-eslint/types": "8.69.0",
+                "@typescript-eslint/typescript-estree": "8.69.0",
+                "@typescript-eslint/visitor-keys": "8.69.0",
                 "debug": "^4.4.3"
             },
             "engines": {
@@ -4179,18 +4231,18 @@
             },
             "peerDependencies": {
                 "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
-                "typescript": ">=4.8.4 <6.0.0"
+                "typescript": ">=4.8.4 <6.1.0"
             }
         },
         "node_modules/@typescript-eslint/project-service": {
-            "version": "8.56.1",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.56.1.tgz",
-            "integrity": "sha512-TAdqQTzHNNvlVFfR+hu2PDJrURiwKsUvxFn1M0h95BB8ah5jejas08jUWG4dBA68jDMI988IvtfdAI53JzEHOQ==",
+            "version": "8.69.0",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.69.0.tgz",
+            "integrity": "sha512-yi4obFrHMmnsesWehHbkg9zMA7Jt8cXT+mKM08G999pH1yT6nqgsHx7MYm0uY1wAj8CqiBXYRJ7WAT0QdQHQXg==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@typescript-eslint/tsconfig-utils": "^8.56.1",
-                "@typescript-eslint/types": "^8.56.1",
+                "@typescript-eslint/tsconfig-utils": "^8.69.0",
+                "@typescript-eslint/types": "^8.69.0",
                 "debug": "^4.4.3"
             },
             "engines": {
@@ -4201,18 +4253,18 @@
                 "url": "https://opencollective.com/typescript-eslint"
             },
             "peerDependencies": {
-                "typescript": ">=4.8.4 <6.0.0"
+                "typescript": ">=4.8.4 <6.1.0"
             }
         },
         "node_modules/@typescript-eslint/scope-manager": {
-            "version": "8.56.1",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.56.1.tgz",
-            "integrity": "sha512-YAi4VDKcIZp0O4tz/haYKhmIDZFEUPOreKbfdAN3SzUDMcPhJ8QI99xQXqX+HoUVq8cs85eRKnD+rne2UAnj2w==",
+            "version": "8.69.0",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.69.0.tgz",
+            "integrity": "sha512-ewfspqWvSxKSOaplqAUNbaSFO0eB6w1EtQ+esfYFRm3614Ty4uNtExkcbgd6nWsXphbqKyf9ZYdbZdv2xEoWEQ==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@typescript-eslint/types": "8.56.1",
-                "@typescript-eslint/visitor-keys": "8.56.1"
+                "@typescript-eslint/types": "8.69.0",
+                "@typescript-eslint/visitor-keys": "8.69.0"
             },
             "engines": {
                 "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -4223,9 +4275,9 @@
             }
         },
         "node_modules/@typescript-eslint/tsconfig-utils": {
-            "version": "8.56.1",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.56.1.tgz",
-            "integrity": "sha512-qOtCYzKEeyr3aR9f28mPJqBty7+DBqsdd63eO0yyDwc6vgThj2UjWfJIcsFeSucYydqcuudMOprZ+x1SpF3ZuQ==",
+            "version": "8.69.0",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.69.0.tgz",
+            "integrity": "sha512-xNqK7YTDZsLniQMV/4rpFR8Z5JlqeRvVjuG1YgF/mdPVH84HSD19L8CczMA0qg2RfwEV231GHH3VnToJDo4MfQ==",
             "dev": true,
             "license": "MIT",
             "engines": {
@@ -4236,13 +4288,38 @@
                 "url": "https://opencollective.com/typescript-eslint"
             },
             "peerDependencies": {
-                "typescript": ">=4.8.4 <6.0.0"
+                "typescript": ">=4.8.4 <6.1.0"
+            }
+        },
+        "node_modules/@typescript-eslint/type-utils": {
+            "version": "8.69.0",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.69.0.tgz",
+            "integrity": "sha512-ZfoJAVg3JZndQEpEl9petVlxau3lRuElc4HRMuAlLCf8to04/iHz692RUSNmXKDjEuJmIL+KZ2/BsOcBc16dsA==",
+            "dev": true,
+            "license": "MIT",
+            "dependencies": {
+                "@typescript-eslint/types": "8.69.0",
+                "@typescript-eslint/typescript-estree": "8.69.0",
+                "@typescript-eslint/utils": "8.69.0",
+                "debug": "^4.4.3",
+                "ts-api-utils": "^2.5.0"
+            },
+            "engines": {
+                "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+            },
+            "funding": {
+                "type": "opencollective",
+                "url": "https://opencollective.com/typescript-eslint"
+            },
+            "peerDependencies": {
+                "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+                "typescript": ">=4.8.4 <6.1.0"
             }
         },
         "node_modules/@typescript-eslint/types": {
-            "version": "8.56.1",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.56.1.tgz",
-            "integrity": "sha512-dbMkdIUkIkchgGDIv7KLUpa0Mda4IYjo4IAMJUZ+3xNoUXxMsk9YtKpTHSChRS85o+H9ftm51gsK1dZReY9CVw==",
+            "version": "8.69.0",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.69.0.tgz",
+            "integrity": "sha512-K3VrubUPhlo9VDBS6QdI8YB5j7ClpqLRdefcz6PFrhnwicehBweqQ9Evhl4l+FYz0HdDmMqIiSX0aldGRYtDCA==",
             "dev": true,
             "license": "MIT",
             "engines": {
@@ -4254,139 +4331,16 @@
             }
         },
         "node_modules/@typescript-eslint/typescript-estree": {
-            "version": "8.56.1",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.56.1.tgz",
-            "integrity": "sha512-qzUL1qgalIvKWAf9C1HpvBjif+Vm6rcT5wZd4VoMb9+Km3iS3Cv9DY6dMRMDtPnwRAFyAi7YXJpTIEXLvdfPxg==",
+            "version": "8.69.0",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.69.0.tgz",
+            "integrity": "sha512-AdFkgqck3Vudb/kWnxlyafU/4aBhHrbQ9locP2N4psXTy5mOBg0SHJumnLvx7r6g1gV4DKvUFwV2nJZBoqOD8w==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@typescript-eslint/project-service": "8.56.1",
-                "@typescript-eslint/tsconfig-utils": "8.56.1",
-                "@typescript-eslint/types": "8.56.1",
-                "@typescript-eslint/visitor-keys": "8.56.1",
-                "debug": "^4.4.3",
-                "minimatch": "^10.2.2",
-                "semver": "^7.7.3",
-                "tinyglobby": "^0.2.15",
-                "ts-api-utils": "^2.4.0"
-            },
-            "engines": {
-                "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-            },
-            "funding": {
-                "type": "opencollective",
-                "url": "https://opencollective.com/typescript-eslint"
-            },
-            "peerDependencies": {
-                "typescript": ">=4.8.4 <6.0.0"
-            }
-        },
-        "node_modules/@typescript-eslint/utils": {
-            "version": "8.61.1",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.61.1.tgz",
-            "integrity": "sha512-1+P/3Dj6jvtybE1q0HQ6yBt/gq+oKJyLdEv4HdnqasaEXRSYCAsD59mXEVQnM/ULNdQxbX77tdG4jPRjIS6knA==",
-            "dev": true,
-            "license": "MIT",
-            "dependencies": {
-                "@eslint-community/eslint-utils": "^4.9.1",
-                "@typescript-eslint/scope-manager": "8.61.1",
-                "@typescript-eslint/types": "8.61.1",
-                "@typescript-eslint/typescript-estree": "8.61.1"
-            },
-            "engines": {
-                "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-            },
-            "funding": {
-                "type": "opencollective",
-                "url": "https://opencollective.com/typescript-eslint"
-            },
-            "peerDependencies": {
-                "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
-                "typescript": ">=4.8.4 <6.1.0"
-            }
-        },
-        "node_modules/@typescript-eslint/utils/node_modules/@typescript-eslint/project-service": {
-            "version": "8.61.1",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.61.1.tgz",
-            "integrity": "sha512-PrC4JYGmR241lYnfhmKGTXkFqv8+ymbTFgSAY0fVXpY82/QkMw5TZPl+vGzuDDU2QYJk9fIDOBTntF+yDv9LEA==",
-            "dev": true,
-            "license": "MIT",
-            "dependencies": {
-                "@typescript-eslint/tsconfig-utils": "^8.61.1",
-                "@typescript-eslint/types": "^8.61.1",
-                "debug": "^4.4.3"
-            },
-            "engines": {
-                "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-            },
-            "funding": {
-                "type": "opencollective",
-                "url": "https://opencollective.com/typescript-eslint"
-            },
-            "peerDependencies": {
-                "typescript": ">=4.8.4 <6.1.0"
-            }
-        },
-        "node_modules/@typescript-eslint/utils/node_modules/@typescript-eslint/scope-manager": {
-            "version": "8.61.1",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.61.1.tgz",
-            "integrity": "sha512-L2bdIeoQS8FlKAvONAr20w6OcLXeB+qiDKbAooS9A0Ben+iSIkBef0FxqwKWYqt5sa0i4KJtxVyVmhMylKzF5w==",
-            "dev": true,
-            "license": "MIT",
-            "dependencies": {
-                "@typescript-eslint/types": "8.61.1",
-                "@typescript-eslint/visitor-keys": "8.61.1"
-            },
-            "engines": {
-                "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-            },
-            "funding": {
-                "type": "opencollective",
-                "url": "https://opencollective.com/typescript-eslint"
-            }
-        },
-        "node_modules/@typescript-eslint/utils/node_modules/@typescript-eslint/tsconfig-utils": {
-            "version": "8.61.1",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.61.1.tgz",
-            "integrity": "sha512-UN/H4di+OO7EWx2ovME+8t31YO+KVnK0RRKEHR3kOt21/Ay8BOq3M1OMvWs5vNiqcFCYGYoxK3MXPZzmMUE+yg==",
-            "dev": true,
-            "license": "MIT",
-            "engines": {
-                "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-            },
-            "funding": {
-                "type": "opencollective",
-                "url": "https://opencollective.com/typescript-eslint"
-            },
-            "peerDependencies": {
-                "typescript": ">=4.8.4 <6.1.0"
-            }
-        },
-        "node_modules/@typescript-eslint/utils/node_modules/@typescript-eslint/types": {
-            "version": "8.61.1",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.61.1.tgz",
-            "integrity": "sha512-G+CRlPqLv7Bz1IZVs03x5K59F1veqL0EJUROAdGhKsEq8qOiRiZbI+HUojPq5l0fEGOKModD9br6lObhB8zkoA==",
-            "dev": true,
-            "license": "MIT",
-            "engines": {
-                "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-            },
-            "funding": {
-                "type": "opencollective",
-                "url": "https://opencollective.com/typescript-eslint"
-            }
-        },
-        "node_modules/@typescript-eslint/utils/node_modules/@typescript-eslint/typescript-estree": {
-            "version": "8.61.1",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.61.1.tgz",
-            "integrity": "sha512-u+oQD3BqYWPc8YV9Zab4vaJElJuwOLPRc10Jm1o/qS+6Qwen14HCWwx0Seo4LnSn2wxea2Ik8DxPt2/FHmuhrg==",
-            "dev": true,
-            "license": "MIT",
-            "dependencies": {
-                "@typescript-eslint/project-service": "8.61.1",
-                "@typescript-eslint/tsconfig-utils": "8.61.1",
-                "@typescript-eslint/types": "8.61.1",
-                "@typescript-eslint/visitor-keys": "8.61.1",
+                "@typescript-eslint/project-service": "8.69.0",
+                "@typescript-eslint/tsconfig-utils": "8.69.0",
+                "@typescript-eslint/types": "8.69.0",
+                "@typescript-eslint/visitor-keys": "8.69.0",
                 "debug": "^4.4.3",
                 "minimatch": "^10.2.2",
                 "semver": "^7.7.3",
@@ -4404,15 +4358,17 @@
                 "typescript": ">=4.8.4 <6.1.0"
             }
         },
-        "node_modules/@typescript-eslint/utils/node_modules/@typescript-eslint/visitor-keys": {
-            "version": "8.61.1",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.61.1.tgz",
-            "integrity": "sha512-6fJ9MHWtK14C1DSkiMlHUSOmrVebL7150xZJBlJiL62jjhIA4JmOq6flwBgDxIdBKKdoiZRel+dfPD5MLfny3w==",
+        "node_modules/@typescript-eslint/utils": {
+            "version": "8.69.0",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.69.0.tgz",
+            "integrity": "sha512-tUbx60BBqQa31kXF5MCsOOLL5E/WzUuxIn7YpAvq+eaUlqvk8/NXnXMBNAdLCr0icjkzem7iUA5QqWHe/hJ1aw==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@typescript-eslint/types": "8.61.1",
-                "eslint-visitor-keys": "^5.0.0"
+                "@eslint-community/eslint-utils": "^4.9.1",
+                "@typescript-eslint/scope-manager": "8.69.0",
+                "@typescript-eslint/types": "8.69.0",
+                "@typescript-eslint/typescript-estree": "8.69.0"
             },
             "engines": {
                 "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -4420,29 +4376,20 @@
             "funding": {
                 "type": "opencollective",
                 "url": "https://opencollective.com/typescript-eslint"
-            }
-        },
-        "node_modules/@typescript-eslint/utils/node_modules/eslint-visitor-keys": {
-            "version": "5.0.1",
-            "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-5.0.1.tgz",
-            "integrity": "sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA==",
-            "dev": true,
-            "license": "Apache-2.0",
-            "engines": {
-                "node": "^20.19.0 || ^22.13.0 || >=24"
             },
-            "funding": {
-                "url": "https://opencollective.com/eslint"
+            "peerDependencies": {
+                "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+                "typescript": ">=4.8.4 <6.1.0"
             }
         },
         "node_modules/@typescript-eslint/visitor-keys": {
-            "version": "8.56.1",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.56.1.tgz",
-            "integrity": "sha512-KiROIzYdEV85YygXw6BI/Dx4fnBlFQu6Mq4QE4MOH9fFnhohw6wX/OAvDY2/C+ut0I3RSPKenvZJIVYqJNkhEw==",
+            "version": "8.69.0",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.69.0.tgz",
+            "integrity": "sha512-+rmdgPA+EXkNgKYvHvFfhrs35utXbwaC5PGpDquSXcoXQDKUA5UjV0LmTucG/4JXkM31BTu4TilHtrN8IVBe8w==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@typescript-eslint/types": "8.56.1",
+                "@typescript-eslint/types": "8.69.0",
                 "eslint-visitor-keys": "^5.0.0"
             },
             "engines": {
@@ -4620,9 +4567,9 @@
             }
         },
         "node_modules/@vrtmrz/livesync-commonlib": {
-            "version": "0.1.21",
-            "resolved": "https://registry.npmjs.org/@vrtmrz/livesync-commonlib/-/livesync-commonlib-0.1.21.tgz",
-            "integrity": "sha512-AGuZ3eqBP37HJXEkTSpJ5M5bvTx2lYNq+6Q5NuCPZeGdbv7g6cujGvccVR5ozGfKdHGSyFZND5x1oFS9crRhUg==",
+            "version": "0.1.25",
+            "resolved": "https://registry.npmjs.org/@vrtmrz/livesync-commonlib/-/livesync-commonlib-0.1.25.tgz",
+            "integrity": "sha512-uWlzcXi32EvrEx6OgKsSEuNQsY+PQDHPY3eq4Xd9W9lHKu2LNh5n1f2z+bMsfZJh1AGMuTkjjFW26X2Bvv/iog==",
             "license": "MIT",
             "dependencies": {
                 "@aws-sdk/client-s3": "^3.808.0",
@@ -7214,9 +7161,9 @@
             }
         },
         "node_modules/fflate": {
-            "version": "0.8.2",
-            "resolved": "https://registry.npmjs.org/fflate/-/fflate-0.8.2.tgz",
-            "integrity": "sha512-cPJU47OaAoCbg0pBvzsgpTPhmhqI5eJjh/JIu8tPj5q+T7iLvW/JAYUqmE7KOB4R1ZyEhzBaIQpQpardBF5z8A==",
+            "version": "0.8.3",
+            "resolved": "https://registry.npmjs.org/fflate/-/fflate-0.8.3.tgz",
+            "integrity": "sha512-tbZNuJrLwGUp3zshBtdy4W+ORxZuIh8a5ilyIEQDC5rY1f3U20JMry0Ll3WBzU58EZKsEuJFXhb5gwv8CsPvgA==",
             "license": "MIT"
         },
         "node_modules/file-entry-cache": {
@@ -11521,9 +11468,9 @@
             }
         },
         "node_modules/svelte-preprocess": {
-            "version": "6.0.3",
-            "resolved": "https://registry.npmjs.org/svelte-preprocess/-/svelte-preprocess-6.0.3.tgz",
-            "integrity": "sha512-PLG2k05qHdhmRG7zR/dyo5qKvakhm8IJ+hD2eFRQmMLHp7X3eJnjeupUtvuRpbNiF31RjVw45W+abDwHEmP5OA==",
+            "version": "6.0.5",
+            "resolved": "https://registry.npmjs.org/svelte-preprocess/-/svelte-preprocess-6.0.5.tgz",
+            "integrity": "sha512-sgwew5yV/2eMeQobIWgAxCNarKwiTUDIc3siAUbq3sp0G6ONtzk0W+wJihMdqjbYb3iGU3ubpGv0usnnuXT3qg==",
             "dev": true,
             "hasInstallScript": true,
             "license": "MIT",
@@ -11541,7 +11488,7 @@
                 "stylus": ">=0.55",
                 "sugarss": "^2.0.0 || ^3.0.0 || ^4.0.0",
                 "svelte": "^4.0.0 || ^5.0.0-next.100 || ^5.0.0",
-                "typescript": "^5.0.0"
+                "typescript": "^5.0.0 || ^6.0.0"
             },
             "peerDependenciesMeta": {
                 "@babel/core": {
@@ -11993,9 +11940,9 @@
             }
         },
         "node_modules/typescript": {
-            "version": "5.9.3",
-            "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
-            "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
+            "version": "6.0.3",
+            "resolved": "https://registry.npmjs.org/typescript/-/typescript-6.0.3.tgz",
+            "integrity": "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw==",
             "dev": true,
             "license": "Apache-2.0",
             "bin": {
@@ -12007,16 +11954,16 @@
             }
         },
         "node_modules/typescript-eslint": {
-            "version": "8.61.1",
-            "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.61.1.tgz",
-            "integrity": "sha512-V7PayAfJokV3pEHgN7/v03D1SpujhRfQtYLbLIiBfDDncdg4PAiRBfoS4cnCANK4jmAPncczi59QO3afiXUlNw==",
+            "version": "8.69.0",
+            "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.69.0.tgz",
+            "integrity": "sha512-B3MltX0VqjUBNEe3b3sSuiRbfa6XrfHFtBiPamjT5AsW/dfq+y+bc0wyuS9DxAS1LyzCxRp2+rxzpLUvqM2BvA==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@typescript-eslint/eslint-plugin": "8.61.1",
-                "@typescript-eslint/parser": "8.61.1",
-                "@typescript-eslint/typescript-estree": "8.61.1",
-                "@typescript-eslint/utils": "8.61.1"
+                "@typescript-eslint/eslint-plugin": "8.69.0",
+                "@typescript-eslint/parser": "8.69.0",
+                "@typescript-eslint/typescript-estree": "8.69.0",
+                "@typescript-eslint/utils": "8.69.0"
             },
             "engines": {
                 "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -12030,225 +11977,6 @@
                 "typescript": ">=4.8.4 <6.1.0"
             }
         },
-        "node_modules/typescript-eslint/node_modules/@typescript-eslint/eslint-plugin": {
-            "version": "8.61.1",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.61.1.tgz",
-            "integrity": "sha512-ZPlVl3PB3et/59Ne0fv/sci6ZXz4T4Hp4nTJ56i/Y0gR89ARb+KphojTq6j+56E5PIezmOIOOWyY+aWQFd+IkQ==",
-            "dev": true,
-            "license": "MIT",
-            "dependencies": {
-                "@eslint-community/regexpp": "^4.12.2",
-                "@typescript-eslint/scope-manager": "8.61.1",
-                "@typescript-eslint/type-utils": "8.61.1",
-                "@typescript-eslint/utils": "8.61.1",
-                "@typescript-eslint/visitor-keys": "8.61.1",
-                "ignore": "^7.0.5",
-                "natural-compare": "^1.4.0",
-                "ts-api-utils": "^2.5.0"
-            },
-            "engines": {
-                "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-            },
-            "funding": {
-                "type": "opencollective",
-                "url": "https://opencollective.com/typescript-eslint"
-            },
-            "peerDependencies": {
-                "@typescript-eslint/parser": "^8.61.1",
-                "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
-                "typescript": ">=4.8.4 <6.1.0"
-            }
-        },
-        "node_modules/typescript-eslint/node_modules/@typescript-eslint/parser": {
-            "version": "8.61.1",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.61.1.tgz",
-            "integrity": "sha512-PJ5vePq5/ognBbrIcoC5+SHO5dfpeLPzP9FpLkzWrguoYQEeeSjlJpVwOpo1JRSTEi7dRcwNy4h4dzV70PqHcg==",
-            "dev": true,
-            "license": "MIT",
-            "dependencies": {
-                "@typescript-eslint/scope-manager": "8.61.1",
-                "@typescript-eslint/types": "8.61.1",
-                "@typescript-eslint/typescript-estree": "8.61.1",
-                "@typescript-eslint/visitor-keys": "8.61.1",
-                "debug": "^4.4.3"
-            },
-            "engines": {
-                "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-            },
-            "funding": {
-                "type": "opencollective",
-                "url": "https://opencollective.com/typescript-eslint"
-            },
-            "peerDependencies": {
-                "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
-                "typescript": ">=4.8.4 <6.1.0"
-            }
-        },
-        "node_modules/typescript-eslint/node_modules/@typescript-eslint/project-service": {
-            "version": "8.61.1",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.61.1.tgz",
-            "integrity": "sha512-PrC4JYGmR241lYnfhmKGTXkFqv8+ymbTFgSAY0fVXpY82/QkMw5TZPl+vGzuDDU2QYJk9fIDOBTntF+yDv9LEA==",
-            "dev": true,
-            "license": "MIT",
-            "dependencies": {
-                "@typescript-eslint/tsconfig-utils": "^8.61.1",
-                "@typescript-eslint/types": "^8.61.1",
-                "debug": "^4.4.3"
-            },
-            "engines": {
-                "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-            },
-            "funding": {
-                "type": "opencollective",
-                "url": "https://opencollective.com/typescript-eslint"
-            },
-            "peerDependencies": {
-                "typescript": ">=4.8.4 <6.1.0"
-            }
-        },
-        "node_modules/typescript-eslint/node_modules/@typescript-eslint/scope-manager": {
-            "version": "8.61.1",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.61.1.tgz",
-            "integrity": "sha512-L2bdIeoQS8FlKAvONAr20w6OcLXeB+qiDKbAooS9A0Ben+iSIkBef0FxqwKWYqt5sa0i4KJtxVyVmhMylKzF5w==",
-            "dev": true,
-            "license": "MIT",
-            "dependencies": {
-                "@typescript-eslint/types": "8.61.1",
-                "@typescript-eslint/visitor-keys": "8.61.1"
-            },
-            "engines": {
-                "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-            },
-            "funding": {
-                "type": "opencollective",
-                "url": "https://opencollective.com/typescript-eslint"
-            }
-        },
-        "node_modules/typescript-eslint/node_modules/@typescript-eslint/tsconfig-utils": {
-            "version": "8.61.1",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.61.1.tgz",
-            "integrity": "sha512-UN/H4di+OO7EWx2ovME+8t31YO+KVnK0RRKEHR3kOt21/Ay8BOq3M1OMvWs5vNiqcFCYGYoxK3MXPZzmMUE+yg==",
-            "dev": true,
-            "license": "MIT",
-            "engines": {
-                "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-            },
-            "funding": {
-                "type": "opencollective",
-                "url": "https://opencollective.com/typescript-eslint"
-            },
-            "peerDependencies": {
-                "typescript": ">=4.8.4 <6.1.0"
-            }
-        },
-        "node_modules/typescript-eslint/node_modules/@typescript-eslint/type-utils": {
-            "version": "8.61.1",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.61.1.tgz",
-            "integrity": "sha512-GYRicKmVK0C4fsKgaACaknOUAq9Oa2kwsjnpFhFcS/5p4Ht5IP9OVLbgIgcK4SRk92nVHFluurg1lumD9dBcLw==",
-            "dev": true,
-            "license": "MIT",
-            "dependencies": {
-                "@typescript-eslint/types": "8.61.1",
-                "@typescript-eslint/typescript-estree": "8.61.1",
-                "@typescript-eslint/utils": "8.61.1",
-                "debug": "^4.4.3",
-                "ts-api-utils": "^2.5.0"
-            },
-            "engines": {
-                "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-            },
-            "funding": {
-                "type": "opencollective",
-                "url": "https://opencollective.com/typescript-eslint"
-            },
-            "peerDependencies": {
-                "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
-                "typescript": ">=4.8.4 <6.1.0"
-            }
-        },
-        "node_modules/typescript-eslint/node_modules/@typescript-eslint/types": {
-            "version": "8.61.1",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.61.1.tgz",
-            "integrity": "sha512-G+CRlPqLv7Bz1IZVs03x5K59F1veqL0EJUROAdGhKsEq8qOiRiZbI+HUojPq5l0fEGOKModD9br6lObhB8zkoA==",
-            "dev": true,
-            "license": "MIT",
-            "engines": {
-                "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-            },
-            "funding": {
-                "type": "opencollective",
-                "url": "https://opencollective.com/typescript-eslint"
-            }
-        },
-        "node_modules/typescript-eslint/node_modules/@typescript-eslint/typescript-estree": {
-            "version": "8.61.1",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.61.1.tgz",
-            "integrity": "sha512-u+oQD3BqYWPc8YV9Zab4vaJElJuwOLPRc10Jm1o/qS+6Qwen14HCWwx0Seo4LnSn2wxea2Ik8DxPt2/FHmuhrg==",
-            "dev": true,
-            "license": "MIT",
-            "dependencies": {
-                "@typescript-eslint/project-service": "8.61.1",
-                "@typescript-eslint/tsconfig-utils": "8.61.1",
-                "@typescript-eslint/types": "8.61.1",
-                "@typescript-eslint/visitor-keys": "8.61.1",
-                "debug": "^4.4.3",
-                "minimatch": "^10.2.2",
-                "semver": "^7.7.3",
-                "tinyglobby": "^0.2.15",
-                "ts-api-utils": "^2.5.0"
-            },
-            "engines": {
-                "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-            },
-            "funding": {
-                "type": "opencollective",
-                "url": "https://opencollective.com/typescript-eslint"
-            },
-            "peerDependencies": {
-                "typescript": ">=4.8.4 <6.1.0"
-            }
-        },
-        "node_modules/typescript-eslint/node_modules/@typescript-eslint/visitor-keys": {
-            "version": "8.61.1",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.61.1.tgz",
-            "integrity": "sha512-6fJ9MHWtK14C1DSkiMlHUSOmrVebL7150xZJBlJiL62jjhIA4JmOq6flwBgDxIdBKKdoiZRel+dfPD5MLfny3w==",
-            "dev": true,
-            "license": "MIT",
-            "dependencies": {
-                "@typescript-eslint/types": "8.61.1",
-                "eslint-visitor-keys": "^5.0.0"
-            },
-            "engines": {
-                "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-            },
-            "funding": {
-                "type": "opencollective",
-                "url": "https://opencollective.com/typescript-eslint"
-            }
-        },
-        "node_modules/typescript-eslint/node_modules/eslint-visitor-keys": {
-            "version": "5.0.1",
-            "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-5.0.1.tgz",
-            "integrity": "sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA==",
-            "dev": true,
-            "license": "Apache-2.0",
-            "engines": {
-                "node": "^20.19.0 || ^22.13.0 || >=24"
-            },
-            "funding": {
-                "url": "https://opencollective.com/eslint"
-            }
-        },
-        "node_modules/typescript-eslint/node_modules/ignore": {
-            "version": "7.0.5",
-            "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
-            "integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==",
-            "dev": true,
-            "license": "MIT",
-            "engines": {
-                "node": ">= 4"
-            }
-        },
         "node_modules/uc.micro": {
             "version": "2.1.0",
             "resolved": "https://registry.npmjs.org/uc.micro/-/uc.micro-2.1.0.tgz",
@@ -12937,11 +12665,11 @@
         },
         "src/apps/cli": {
             "name": "self-hosted-livesync-cli",
-            "version": "1.0.24-cli",
+            "version": "1.0.29-cli",
             "dependencies": {
                 "chokidar": "^4.0.0",
                 "minimatch": "^10.2.5",
-                "octagonal-wheels": "^0.1.53",
+                "octagonal-wheels": "^0.1.54",
                 "pouchdb-adapter-http": "^9.0.0",
                 "pouchdb-adapter-leveldb": "^9.0.0",
                 "pouchdb-core": "^9.0.0",
@@ -12955,28 +12683,28 @@
                 "werift": "^0.24.4"
             },
             "devDependencies": {
-                "typescript": "5.9.3",
+                "typescript": "6.0.3",
                 "vite": "^8.0.16",
                 "vitest": "^4.1.8"
             }
         },
         "src/apps/webapp": {
             "name": "livesync-webapp",
-            "version": "1.0.24-webapp",
+            "version": "1.0.29-webapp",
             "dependencies": {
-                "octagonal-wheels": "^0.1.53"
+                "octagonal-wheels": "^0.1.54"
             },
             "devDependencies": {
                 "@sveltejs/vite-plugin-svelte": "^7.1.2",
                 "svelte": "5.56.3",
-                "typescript": "5.9.3",
+                "typescript": "6.0.3",
                 "vite": "^8.0.16"
             }
         },
         "src/apps/webpeer": {
-            "version": "1.0.24-webpeer",
+            "version": "1.0.29-webpeer",
             "dependencies": {
-                "octagonal-wheels": "^0.1.53"
+                "octagonal-wheels": "^0.1.54"
             },
             "devDependencies": {
                 "@sveltejs/vite-plugin-svelte": "^7.1.2",
@@ -12984,7 +12712,7 @@
                 "eslint-plugin-svelte": "^3.19.0",
                 "svelte": "5.56.3",
                 "svelte-check": "^4.6.0",
-                "typescript": "5.9.3",
+                "typescript": "6.0.3",
                 "vite": "^8.0.16"
             }
         }

package.json

@@ -1,6 +1,6 @@
 {
     "name": "obsidian-livesync",
-    "version": "1.0.24",
+    "version": "1.0.29",
     "description": "Reflect your vault changes to some other devices immediately. Please make sure to disable other synchronize solutions to avoid content corruption or duplication.",
     "main": "main.js",
     "type": "module",
@@ -30,6 +30,7 @@
         "i18n:json2yaml": "tsx _tools/json2yaml.ts",
         "i18n:yaml2json": "tsx _tools/yaml2json.ts",
         "test:unit": "vitest run --config vitest.config.unit.ts",
+        "test:release-process": "vitest run --config vitest.config.unit.ts utils/release-process.unit.spec.ts",
         "build:browser-apps": "npm run build --workspace livesync-webapp --workspace webpeer",
         "test:browser-apps": "npm run test:browser --workspace livesync-webapp && npm run test:browser --workspace webpeer",
         "test:browser-apps:pages": "deno test -A --no-check --frozen --config test/browser-apps/deno.json --lock test/browser-apps/deno.lock test/browser-apps/pages/browser-smoke.test.ts",
@@ -46,7 +47,7 @@
         "test:e2e:cli:p2p": "npm run test:e2e:p2p --workspace self-hosted-livesync-cli",
         "test:e2e:cli:all": "npm run test:e2e:all --workspace self-hosted-livesync-cli",
         "test:integration": "npx dotenv-cli -e .env -e .test.env -- vitest run --config vitest.config.integration.ts",
-        "test:unit:coverage": "vitest run --config vitest.config.unit.ts --coverage",
+        "test:unit:coverage": "vitest run --config vitest.config.unit.ts --coverage --exclude utils/release-process.unit.spec.ts",
         "test:e2e:obsidian:install-appimage": "tsx test/e2e-obsidian/scripts/install-appimage.ts",
         "test:e2e:obsidian:runner": "vitest run --config vitest.config.e2e-runner.ts",
         "test:e2e:obsidian:discover": "tsx test/e2e-obsidian/scripts/discover.ts",
@@ -65,14 +66,17 @@
         "test:e2e:obsidian:p2p-pane": "tsx test/e2e-obsidian/scripts/p2p-pane.ts",
         "test:e2e:obsidian:vault-reflection": "tsx test/e2e-obsidian/scripts/vault-reflection.ts",
         "test:e2e:obsidian:couchdb-upload": "tsx test/e2e-obsidian/scripts/couchdb-upload.ts",
+        "test:e2e:obsidian:tweak-compatibility": "tsx test/e2e-obsidian/scripts/tweak-compatibility.ts",
         "test:e2e:obsidian:couchdb-manual-setup-workflow": "tsx test/e2e-obsidian/scripts/couchdb-manual-setup-workflow.ts",
         "test:e2e:obsidian:cli-to-obsidian-sync": "tsx test/e2e-obsidian/scripts/cli-to-obsidian-sync.ts",
         "test:e2e:obsidian:minio-upload": "tsx test/e2e-obsidian/scripts/minio-upload.ts",
         "test:e2e:obsidian:object-storage-setup-uri-workflow": "tsx test/e2e-obsidian/scripts/object-storage-setup-uri-workflow.ts",
+        "test:e2e:obsidian:object-storage-custom-http-handler-setup-uri-workflow": "tsx test/e2e-obsidian/scripts/object-storage-setup-uri-workflow.ts --custom-http-handler",
         "test:e2e:obsidian:p2p-setup-uri-workflow": "tsx test/e2e-obsidian/scripts/p2p-setup-uri-workflow.ts",
         "pretest:e2e:obsidian:p2p-connection-check": "npm run build && npm run build --workspace webpeer",
         "test:e2e:obsidian:p2p-connection-check": "tsx test/e2e-obsidian/scripts/p2p-connection-check.ts",
         "test:e2e:obsidian:p2p-connection-check:services": "npm run test:e2e:obsidian:p2p-connection-check -- --manage-p2p",
+        "test:e2e:obsidian:partial-startup-file-failure": "tsx test/e2e-obsidian/scripts/partial-startup-file-failure.ts",
         "test:e2e:obsidian:startup-scan": "tsx test/e2e-obsidian/scripts/startup-scan.ts",
         "test:e2e:obsidian:setup-uri-workflow": "tsx test/e2e-obsidian/scripts/setup-uri-workflow.ts",
         "test:e2e:obsidian:two-vault-sync": "tsx test/e2e-obsidian/scripts/two-vault-sync.ts",
@@ -126,7 +130,7 @@
         "@types/pouchdb-mapreduce": "^6.1.10",
         "@types/pouchdb-replication": "^6.4.7",
         "@types/transform-pouch": "^1.0.6",
-        "@typescript-eslint/parser": "8.56.1",
+        "@typescript-eslint/parser": "8.69.0",
         "@vitest/coverage-v8": "^4.1.8",
         "@vrtmrz/obsidian-test-session": "0.2.6",
         "dotenv-cli": "^11.0.0",
@@ -156,13 +160,13 @@
         "svelte": "5.56.3",
         "svelte-check": "^4.6.0",
         "svelte-eslint-parser": "^1.8.0",
-        "svelte-preprocess": "^6.0.3",
+        "svelte-preprocess": "6.0.5",
         "terser": "^5.39.0",
         "tinyglobby": "^0.2.15",
         "transform-pouch": "^2.0.0",
         "tsx": "^4.21.0",
-        "typescript": "5.9.3",
-        "typescript-eslint": "^8.61.0",
+        "typescript": "6.0.3",
+        "typescript-eslint": "8.69.0",
         "vite": "^8.0.16",
         "vitest": "^4.1.8",
         "yaml": "^2.8.2"
@@ -177,11 +181,10 @@
         "@smithy/types": "^4.14.3",
         "@smithy/util-retry": "^4.4.5",
         "@vrtmrz/browser-ui-kit": "0.1.0",
-        "@vrtmrz/livesync-commonlib": "0.1.21",
+        "@vrtmrz/livesync-commonlib": "0.1.25",
         "@vrtmrz/obsidian-plugin-kit": "0.1.4",
         "@vrtmrz/ui-interactions": "0.1.2",
         "diff-match-patch": "^1.0.5",
-        "fflate": "^0.8.2",
         "idb": "^8.0.3",
         "markdown-it": "^14.2.0",
         "minimatch": "^10.2.5",
@@ -202,5 +205,11 @@
         "src/apps/cli",
         "src/apps/webpeer",
         "src/apps/webapp"
-    ]
+    ],
+    "allowScripts": {
+        "esbuild@0.28.1": true,
+        "leveldown@5.6.0": true,
+        "leveldown@6.1.1": true,
+        "svelte-preprocess": false
+    }
 }

paper/README.md

@@ -0,0 +1,30 @@
+# Self-hosted LiveSync technical paper manuscript
+
+This directory contains a technical manuscript prepared in the format of the Journal of Open Source Software (JOSS) to document the design intent, architecture, and workflow context of Self-hosted LiveSync.
+
+This document is not currently published as a formal journal paper; rather, it serves as an architectural overview explaining the project's background and replication model (describing Self-hosted LiveSync 1.0.23 pinned to Commonlib 0.1.21). If you reference or utilise Self-hosted LiveSync in academic research, laboratory workflows, or technical publications, citing the software via [CITATION.cff](../CITATION.cff) or this manuscript is greatly appreciated.
+
+## Contents
+
+- [paper.md](paper.md): English manuscript.
+- [paper.ja.md](paper.ja.md): Japanese reference translation.
+- [paper.bib](paper.bib): Shared bibliography.
+
+## Citing Self-hosted LiveSync
+
+Please refer to the repository's [CITATION.cff](../CITATION.cff) file or the metadata recorded in [paper.bib](paper.bib) if you wish to cite this software in your research papers, technical reports, or presentations.
+
+## Feedback and Contributions
+
+For corrections, suggestions, or questions regarding the manuscript, please open an [issue](https://github.com/vrtmrz/obsidian-livesync/issues) or submit a pull request.
+
+If I have overlooked or misrepresented anyone's contribution, please let me know.
+
+---
+
+## 本原稿について
+
+本ディレクトリーには、Journal of Open Source Software（JOSS）の形式を想定し、Self-hosted LiveSync の設計意図やアーキテクチャー、および運用の背景をまとめた原稿を配置しています。
+
+本稿は現時点で正式に出版された論文ではなく、プロジェクトの背景や同期モデルを整理した技術資料として作成されたものです（Commonlib 0.1.21 に固定された Self-hosted LiveSync 1.0.23 を基準としています）。もし学術研究、実験ノートの管理、あるいは技術レポート等で Self-hosted LiveSync を利用・言及される機会がありましたら、リポジトリーの [CITATION.cff](../CITATION.cff) や本稿を引用していただけますと幸いです。
+日本語版は翻訳メモリーの使用を想定した逐語訳的な参考訳として位置づけられており、技術的意味論の正確性は英語版を基準としています。

paper/paper.bib

@@ -0,0 +1,161 @@
+@inproceedings{kleppmann2019localfirst,
+  author = {Kleppmann, Martin and Wiggins, Adam and van Hardenberg, Peter and McGranaghan, Mark},
+  title = {Local-first software: you own your data, in spite of the cloud},
+  booktitle = {Proceedings of the 2019 ACM SIGPLAN International Symposium on New Ideas, New Paradigms, and Reflections on Programming and Software},
+  pages = {154--178},
+  year = {2019},
+  publisher = {Association for Computing Machinery},
+  doi = {10.1145/3359591.3359737},
+  url = {https://doi.org/10.1145/3359591.3359737}
+}
+
+@software{selfhostedlivesync,
+  author = {{vorotamoroz} and {Self-hosted LiveSync Contributors}},
+  title = {vrtmrz/obsidian-livesync: 1.0.23},
+  version = {1.0.23},
+  year = {2026},
+  publisher = {Zenodo},
+  doi = {10.5281/zenodo.22247183},
+  url = {https://doi.org/10.5281/zenodo.22247183}
+}
+
+@software{commonlib,
+  author = {{vorotamoroz} and {livesync-commonlib Contributors}},
+  title = {vrtmrz/livesync-commonlib: 0.1.19},
+  version = {0.1.19},
+  year = {2026},
+  publisher = {Zenodo},
+  doi = {10.5281/zenodo.22074979},
+  url = {https://doi.org/10.5281/zenodo.22074979}
+}
+
+@software{commonlib021,
+  author = {{vorotamoroz} and {livesync-commonlib Contributors}},
+  title = {livesync-commonlib: Platform-independent replication and synchronisation engine for Self-hosted LiveSync},
+  version = {0.1.21},
+  year = {2026},
+  publisher = {npm},
+  url = {https://registry.npmjs.org/@vrtmrz/livesync-commonlib/-/livesync-commonlib-0.1.21.tgz}
+}
+
+@software{fancykit,
+  author = {{vorotamoroz}},
+  title = {vrtmrz/fancy-kit: Fancy Kit repository snapshot 2026.08.24.1},
+  version = {fancy-kit-2026.08.24.1},
+  year = {2026},
+  publisher = {Zenodo},
+  doi = {10.5281/zenodo.22088208},
+  url = {https://doi.org/10.5281/zenodo.22088208}
+}
+
+@misc{selfhostedlivesyncrepo,
+  author = {{vorotamoroz} and {Self-hosted LiveSync Contributors}},
+  title = {Self-hosted LiveSync source repository},
+  year = {2026},
+  url = {https://github.com/vrtmrz/obsidian-livesync},
+  urldate = {2026-09-02}
+}
+
+@misc{obsidian,
+  author = {{Dynalist Inc.}},
+  title = {Obsidian: A knowledge base that works on local Markdown files},
+  year = {2026},
+  url = {https://obsidian.md}
+}
+
+@misc{couchdb,
+  author = {{The Apache Software Foundation}},
+  title = {Apache CouchDB: Seamless multi-master syncing database with an intuitive HTTP/JSON API},
+  year = {2026},
+  url = {https://couchdb.apache.org}
+}
+
+@misc{couchdbreplication,
+  author = {{The Apache Software Foundation}},
+  title = {{CouchDB} Replication Protocol},
+  year = {2026},
+  url = {https://docs.couchdb.org/en/stable/replication/protocol.html},
+  urldate = {2026-09-07}
+}
+
+@misc{pouchdb,
+  author = {{PouchDB Authors}},
+  title = {PouchDB: The Database that Syncs!},
+  year = {2026},
+  url = {https://pouchdb.com}
+}
+
+@misc{webrtc,
+  author = {{World Wide Web Consortium}},
+  title = {WebRTC 1.0: Real-Time Communication Between Browsers},
+  year = {2021},
+  url = {https://www.w3.org/TR/2021/REC-webrtc-20210126/},
+  urldate = {2026-09-07}
+}
+
+@misc{obsidiansync,
+  author = {{Dynalist Inc.}},
+  title = {Obsidian Sync: Secure, end-to-end encrypted synchronisation service},
+  year = {2026},
+  url = {https://obsidian.md/sync}
+}
+
+@misc{obsidiangit,
+  author = {Denis Olehov and {Obsidian Git Contributors}},
+  title = {Obsidian Git: Backup and synchronise your Obsidian vault with Git},
+  year = {2026},
+  url = {https://github.com/Vinzent03/obsidian-git}
+}
+
+@misc{syncthing,
+  author = {{The Syncthing Authors}},
+  title = {Syncthing: Open Source Continuous File Synchronization},
+  year = {2026},
+  url = {https://syncthing.net}
+}
+
+@misc{syncthingsync,
+  author = {{The Syncthing Authors}},
+  title = {Understanding Synchronization},
+  year = {2026},
+  url = {https://docs.syncthing.net/users/syncing.html},
+  urldate = {2026-09-07}
+}
+
+@misc{gitfetch,
+  author = {{Git Contributors}},
+  title = {git-fetch: Download objects and refs from another repository},
+  year = {2026},
+  url = {https://git-scm.com/docs/git-fetch},
+  urldate = {2026-09-07}
+}
+
+@misc{automergeconflicts,
+  author = {{Automerge Contributors}},
+  title = {Automerge: Conflicts},
+  year = {2026},
+  url = {https://automerge.org/docs/reference/documents/conflicts/},
+  urldate = {2026-09-07}
+}
+
+@misc{remotelysave,
+  author = {fyears and {Remotely Save Contributors}},
+  title = {Remotely Save: Sync non-official Obsidian plugin},
+  year = {2026},
+  url = {https://github.com/remotely-save/remotely-save}
+}
+
+@misc{trystero,
+  author = {Dan Motzenbecker},
+  title = {Trystero: Serverless WebRTC matchmaking and data channels},
+  year = {2026},
+  url = {https://github.com/dmotz/trystero}
+}
+
+@misc{obsidianplugin,
+  author = {{Obsidian Community Plugins}},
+  title = {Self-hosted LiveSync in the Obsidian Community Plugin Directory},
+  year = {2026},
+  url = {https://community.obsidian.md/plugins/obsidian-livesync},
+  urldate = {2026-09-02}
+}

paper/paper.ja.md

@@ -0,0 +1,76 @@
+# Summary
+
+Self-hosted LiveSync は、ローカルの Markdown ファイルとして文書を保存するノートアプリ Obsidian [@obsidian] 向けのオープンソース同期プラグインである。ユーザーが管理するストレージまたは直接のピアツーピア接続を介し、ノートや添付ファイルを収めたディレクトリー（Vault）をデスクトップとモバイルデバイス間で同期する。
+
+本プラグインにより、ユーザーはオフラインで編集を行い、再接続後に同期できる。2台のオフライン端末で同一ノートを別々に編集した場合のように編集の衝突が生じても、即座の解決を強制したり競合する変更を無条件に上書きしたりすることはない。ファイル形式や設定されたポリシーに応じて、重複しない変更箇所の自動マージや、競合する版を後から比較・解決するための保持が可能である。組み込みの検査ツールは、競合や内容の欠落の調査を支援し、コピーが残っている場合の復旧を支援する。
+
+本ソフトウエアは、データの保存先を自ら管理しながら複数デバイスで記録を継続する必要がある研究者、エンジニア、および実務者のワークフローに対応する。
+
+# Statement of Need
+
+研究やエンジニアリングのワークフローは、長期間蓄積されるノート、観察記録、設計上の決定事項、および関連ファイルに依存している。著者の業務では、管理下にある各デバイスの導入ソフトウエアを制御し、業務ファイルを自身の管理下にあるインフラで扱い、運用実績のあるサーバーソフトウエアを採用する必要があった。これらの制約から、デスクトップとモバイル双方の Obsidian 内で直接動作し、外部クライアントデーモンを必要としない同期エンジンを開発した。
+
+オフライン端末で別々に行った編集の競合は、変更を交換した際に認識される。意図しない編集や削除、並行した変更の乖離、あるいはデータベースの状態とは独立した外部ツールによるファイル変更も起こりうる。競合する版を保持せずに単一の版で上書きしてしまうと、ユーザーが変更を確認して判断する前に情報が失われるおそれがある。
+
+フィールドワークやモバイルでの作業中、研究者や実務者は、競合する編集内容をレビューする前であっても、観察の記録とデバイス間でのノート転送を続ける必要がある。Self-hosted LiveSync は、このように記録と競合解決を分けて進める作業を支援する。並行ブランチが未解決のままでも複製を継続でき、競合する編集は、レビューまたは設定されたポリシーによって解決されるまで保護される。
+
+# State of the Field
+
+ローカルファーストソフトウエアは、ユーザーデータの唯一の所有者としてのホスト型サービスへの依存を避けつつ、ローカルにおける可用性と、複数デバイス間での同期や協調を両立させる [@kleppmann2019localfirst]。Obsidian エコシステム内では、いくつかのツールが異なるアプローチから複数デバイス間の同期に対応している。Obsidian Sync は統合されたホスト型サービスを提供し [@obsidiansync]、Obsidian Git はバージョン管理指向の push/pull ワークフローを提供し [@obsidiangit]、Syncthing はファイルシステム層で動作し [@syncthing]、Remotely Save はクラウドやセルフホスト型ストレージの複数の API に Obsidian を接続する [@remotelysave]。
+
+これらのアプローチは、並行する変更の表現方法が異なる。Syncthing は競合コピーを通常のファイルとして他のデバイスへ転送し [@syncthingsync]、Git は分岐した履歴をマージ前に取得できる [@gitfetch]。Obsidian Git はデスクトップおよびモバイル上でこの操作を自動化している [@obsidiangit]。Conflict-free Replicated Data Types（CRDT）でも複数の選択肢を検査でき、Automerge は同じオブジェクトプロパティーへの並行した代入を保持する [@automergeconflicts]。Self-hosted LiveSync は、競合するファイルの各バージョンを、メタデータドキュメントのリビジョンツリー上の末端リビジョン（leaf、各分岐の現在の版）として保持し、設定されたポリシーまたはユーザーによる明示的な操作によって解決されるまで維持する。
+
+これらの既存ツールはそれぞれ異なる運用上の要請に応えている。ホスト型サービスは導入の平易さを重視し、外部のファイル同期ツールは任意のファイルシステムツリーを対象とし、バージョン管理ツールは明示的なコミットワークフローを前提としている。一方、著者の環境では管理対象デバイス上でバックグラウンドクライアントデーモンの実行が制限されており、かつ競合する版の保持と、その版に結び付いたファイル更新を扱うためには、複製処理とローカルファイル操作を直接統合する必要があった。そのため、Self-hosted LiveSync は外部デーモンを介さず Obsidian 内で直接動作するプラグインとして構築され、複数のバックエンドで同一のリビジョンセマンティクスを維持するために、中核ロジックをプラットホーム非依存のエンジンとして分離する構成が採用された。
+
+Self-hosted LiveSync は新しいデータベース複製アルゴリズムを導入するものではない。むしろその貢献は、リビジョン認識可能なデータベースのセマンティクスを、外部から編集できるファイル Vault へ適用した点にある。Content-addressed なチャンク、デバイスローカルな来歴情報、および組み込みの復旧ツールにより、通常のノート作成ワークフローを損なうことなく、競合のレビューを保留しながら編集を継続できるようにしている。
+
+# Software Design
+
+共通の複製サービスおよび競合処理サービスは `@vrtmrz/livesync-commonlib` [@commonlib021] として公開されており、Obsidian プラグイン、コマンドラインインターフェース（CLI）、Web アプリケーション、および Web Peer で利用されている。
+
+## Revision-aware Vault representation
+
+Vault の各ファイルは、ローカルの PouchDB [@pouchdb] 内で、パス、サイズ、更新日時、および分割されたチャンクドキュメントへの参照を含むメタデータドキュメントとして表現される。チャンクは Content-addressed であり、同一のコンテンツ領域を持つリビジョン間や異なるファイル間で再利用できる。複数デバイス間で並行して更新が行われると、メタデータドキュメントの周囲に競合する複数の leaf（子を持たない末端リビジョン）が形成される。PouchDB はデフォルトの取得対象として決定論的な winner（選出された leaf）を選出するが、この選択は内部的なタイブレークに過ぎず、その winner がより新しい、より安全である、あるいは特定のデバイスの Vault に表示されているバージョンであることを証明するものではない。
+
+並行する更新によってブランチ $\alpha$ と $\beta$ に分岐した場合、両方の leaf は解決前に他のデバイスへ複製される。自動3方向マージは、両方の leaf と最も近い利用可能な共通祖先についてメタデータ本文およびチャンクが読み取り可能である場合に、Markdown（`.md`）、Canvas（`.canvas`）、および JSON（`.json`）ファイルを対象として適用される（その他の形式は対象外である）。Markdown では、同一オフセットへの並行した挿入は即座に失敗とせず、更新日時に応じて順次連結して統合できる。CouchDB の複製プロトコルは祖先リビジョンの識別子を伝播するものの祖先の内容は取得しないため [@couchdbreplication]、祖先の履歴や内容が欠落している場合、あるいは互換性のない編集衝突が生じた場合、同期エンジンは自動マージを保留する。自動マージが無効または適用不能であり両方の版が読み取り可能である場合、JSON ファイルおよび内容の異なるバイナリーファイルは互換性のための動作として、「常に新しいファイルで上書きする」が無効であっても更新日時によって解決され、このオプションを有効にするとテキストの競合にも当該解決が拡張される。それ以外の場合、テキストの競合は手動解決のために保持され、両方の版が読み取り可能であれば2方向の差分（two-way diff）によって直接比較できる。
+
+## Device-local branch provenance
+
+データベースは競合する複数のブランチを同時に保持できるが、ローカルの Vault は任意のパスに対して単一の実体ファイルしか配置できない。ローカルファイルがどのブランチを表しているかを識別するため、本プラグインは正確なデータベースリビジョンと観測されたローカルの更新日時をデバイスローカルな Key-Value ストアに保存する。このリビジョンは当該パスの**ブランチアンカー**として機能し、データベースから Vault への実体化、または Vault からデータベースへの書き込みが成功した後に更新される。
+
+未解決の競合が存在する状態において、ローカルで行われた編集や論理削除はアンカーされたリビジョンの子となり、競合する leaf を損なうことなく、その特定のブランチを前進させる。パスをまたぐリネームでは、移動先を保存した上で、アンカーされた移動元のブランチのみを論理削除する。この状態で来歴情報が利用できない場合、本プラグインはファイルのバイト列が利用可能な既存の単一リビジョン本文と厳密に一致する場合に限り Vault 内のファイルをそのリビジョンにひもづけ、それ以外の場合はパスや日時から勝手に推測せず、手動解決すべき競合として保持する。競合が存在しない通常時は、通常の書き込みによって単に現在のデータベースリビジョンが前進する。
+
+組み込みのコンフリクトインスペクターは、現在の winner、すべての conflict leaf、および最も近い利用可能な共通祖先を検査する。インスペクターは欠落したチャンクやファイル／データベース間の差異を報告し、現在の leaf を明示的に選択して操作できるようにする。変更を伴う操作は実行前にリビジョンを再確認し、古い画面状態によってすでに末端ではなくなったリビジョンを誤って削除したり前進させたりするのを防止する。
+
+## Transport-independent replication
+
+CouchDB のリビジョンモデルを基準に、Self-hosted LiveSync はデータベースの表現を通信トランスポートから分離し、バックエンドにかかわらずファイルメタデータのリビジョン識別子と競合する leaf をそのまま複製する。CouchDB [@couchdb] ではネイティブなリビジョン複製を利用する。S3 互換オブジェクトストレージでは、メタデータドキュメントの末端リビジョンと祖先リビジョンの識別子をジャーナルに記録し、新しいローカルリビジョンを作成せずに適用する一方、チャンクドキュメントは内容由来の識別子を保持し、新しいローカルリビジョンとして保存される。WebRTC ピアツーピア（P2P）アダプター [@webrtc] は、Trystero [@trystero] の DataChannels と RPC ベースのレプリケーション shim によりドキュメント要求をバッチ処理し、同一のリビジョンセマンティクスをピア間で直接保持する。CouchDB およびジャーナル転送においては、Web Streams が転送をパイプライン処理し、転送中にメモリーへ保持されるデータ量を抑制する。
+
+これらのトランスポートは柔軟に組み合わせられる。P2P 同期は参加デバイスが同時にオンラインである必要があるが、中央の CouchDB やオブジェクトストレージを併用することで、オフライン期間を挟んだデバイス間でも同期できる。すべての通信方式でコンテンツのエンドツーエンド暗号化とパス難読化をサポートしている。P2P では接続交渉時のセッション記述が暗号化されるが、シグナリングリレーやネットワークサービスからは接続時刻やネットワークアドレスを観測できる。
+
+## Retention and recovery
+
+分岐した各ブランチは未変更のチャンクを共有するため、競合する leaf を保持するために生じるコストは主に新規チャンクとリビジョンメタデータに限られる。蓄積した保存領域はリモートデータベースの再構築によって回収できるほか、CouchDB 向けには、明示的に開始するベータ版のガベージコレクションにより、現在の winner、すべての conflict leaf、および未解決の競合を検査するために必要な、利用可能な祖先から到達可能なチャンクを保護しながらインプレースで回収できる。過去のリビジョンで置き換えられたチャンクは後から回収されうるため、過去のリビジョン本文は無条件のバックアップではない。
+
+必要なチャンクが欠落している場合でも、読み取り不能な現在のリビジョンはリビジョンツリーに残り、競合処理によって自動的に破棄されることはない。欠落したチャンクが他のデバイスに残っている場合があるため、それらの再接続と同期を待って復旧操作を保留できる。競合インスペクターは影響を受けるリビジョンを明示し、取得の再試行や明示的な復旧操作を支援する。復旧には、デバイス、リモートストレージ、またはバックアップに内容が残っている必要がある。
+
+# Research Impact Statement
+
+Self-hosted LiveSync は、著者が複数のデバイスやプラットホームを対象に行うソフトウエア開発業務から生まれた。この作業では、主たるデバイスを利用できない状況でも、各デバイスでスクリーンショットを取得し、観察記録を保存する必要があった。同じワークフローは、現在では著者の先行技術調査にも利用されており、先行文献の読解に伴うメモや考察を同期するために用いられている。競合する版が保持されることで、分岐した記録が即座に上書きされず、後から比較・確認することが可能になる。
+
+ユニットテストおよび結合テストは、リビジョンの系譜、チャンクの到達可能性、利用できない内容、およびホストの構成を対象とする。CLI および実環境の Obsidian によるシナリオでは、競合する leaf が残っている状態での編集、論理削除、およびリネームを含め、競合の伝播と解決を検証する。3ノードの P2P シナリオでは、未解決の leaf が解決前にデバイス間を移動できることを確認している。再利用可能なヘッドレステスト基盤は独立してアーカイブされている [@fancykit]。決定論的なフィクスチャーを用いて同一の生成データ上で P2P と CouchDB の経路を比較しているが、制御されたローカル測定値が普遍的な性能を示すわけではない。
+
+2026年9月2日時点で、Obsidian プラグインディレクトリーでは 90万回以上のダウンロード、デスクトップおよびモバイルのサポート、ならびに公式の Research カテゴリーへの配置が報告されている [@obsidianplugin]。GitHub リポジトリーでは 12,200件以上のスター、440件のフォーク、および広範なユーザーコミュニティーからの貢献が記録されている [@selfhostedlivesyncrepo]。これらの数値自体は研究上の直接的な影響を証明するものではないが、本ソフトウエアがコミュニティーに受容され、単一のプライベートなワークフローを超えて運用されている証拠を提供する。
+
+本稿で説明したソフトウエアは Self-hosted LiveSync 1.0.23 [@selfhostedlivesync] であり、MIT ライセンスの下でリリースされ、Commonlib 0.1.21 [@commonlib021] に固定されている。プラグイン、再利用可能なテストハーネス [@fancykit]、および以前の Commonlib 0.1.19 のスナップショット [@commonlib] は Zenodo に恒久的にアーカイブされており、プラットホーム非依存のロジックが独立したテストと再利用を可能にしている。
+
+# AI Usage Disclosure
+
+2026年7月から9月にかけて、コード探索、テストおよびベンチマークの足場作り、CI およびドキュメントの編集、原稿の推敲および校正、レビュー、引用の検証、ならびに結果の要約に GPT-5 を使用した OpenAI Codex が利用された。また、Codex を通じて GPT-6 も 9月の原稿レビューおよび改訂を支援した。本原稿の準備において、その他の生成 AI ツールは使用されていない。GitHub Copilot（モデルおよびバージョンは未記録）は、本リリースに含まれるコミットの実装、テスト、およびドキュメント作成を支援した。Google Gemini（Gemini Flash バージョン 3.5 から 3.8）は、リソースチェックおよび関連するコードベースの検証に使用された。人間の著者自身がすべての支援出力をレビュー、編集、および検証し、主要な設計判断を行い、関連する検証コマンドおよびベンチマークコマンドを実行した。著者は、提出された資料の正確性、独創性、ライセンス、および倫理的コンプライアンスについて引き続き全責任を負う。
+
+# Acknowledgements
+
+著者は、プロジェクトの貢献者、ユーザー、ならびに PouchDB、CouchDB、および Trystero のアップストリームメンテナーに感謝の意を表する。本プロジェクトは、GitHub Sponsors を通じたコミュニティーの支援、JetBrains からの開発ツールライセンス、および OpenAI の Codex for Open Source プログラムによる支援を受けている。
+
+# References
+

paper/paper.md

@@ -0,0 +1,97 @@
+---
+title: 'Self-hosted LiveSync: Inspectable and recoverable replication for local-first Obsidian vaults'
+tags:
+  - local-first software
+  - synchronisation
+  - CouchDB
+  - PouchDB
+  - WebRTC
+  - Obsidian
+  - TypeScript
+authors:
+  - name: 'vorotamoroz'
+    affiliation: 1
+    corresponding: true
+affiliations:
+  - name: 'Independent Researcher'
+    index: 1
+date: 5 September 2026
+bibliography: paper.bib
+---
+
+# Summary
+
+Self-hosted LiveSync is an open-source synchronisation plug-in for Obsidian [@obsidian], a note-taking application that stores documents as local Markdown files. It replicates a user's vault—a directory containing notes and attachments—across desktop and mobile devices using user-controlled storage or direct peer-to-peer connections.
+
+The plug-in allows users to continue editing offline and synchronise upon reconnection, even when conflicting edits arise—such as when two disconnected devices modify the same note concurrently. Rather than forcing immediate reconciliation or unconditionally overwriting competing changes, the system supports automatic merging of non-overlapping edits and preserves competing versions for deferred review, depending on file formats and configured policies. Built-in inspection tools help users investigate conflicts or missing content and recover files when surviving copies exist.
+
+The software serves researchers, engineers, and practitioners who require continued note-taking across multiple devices while controlling their data storage.
+
+# Statement of Need
+
+Research and engineering workflows depend on long-lived notes, observations, design decisions, and supporting files. The author's work required managing the software installed on each device, keeping files on infrastructure under personal control, and using server software with an established operational record. These constraints motivated a synchronisation engine running directly inside Obsidian across desktop and mobile platforms without external client daemons.
+
+Conflicts arising from concurrent edits on disconnected devices are recognised only after devices exchange updates. An edit or deletion may be unintended, concurrent modifications may diverge, or external tools may update files independently of database events. Overwriting with a single version without retaining competing revisions risks irreversibly discarding information before users can evaluate the divergence.
+
+During fieldwork and mobile operations, researchers and practitioners often need to continue recording observations and transferring notes between devices before reviewing competing edits. Self-hosted LiveSync supports this separation of recording and reconciliation: replication proceeds while concurrent branches remain unresolved, protecting competing edits until they can be reviewed or resolved according to configured policies.
+
+# State of the Field
+
+Local-first software combines local availability with multi-device synchronisation and collaboration while avoiding dependence on a hosted service as the sole owner of user data [@kleppmann2019localfirst]. Within the Obsidian ecosystem, Obsidian Sync provides an integrated hosted service [@obsidiansync]; Obsidian Git provides version-control-oriented push and pull workflows [@obsidiangit]; Syncthing operates at the filesystem layer [@syncthing]; and Remotely Save connects Obsidian to several cloud and self-hosted storage APIs [@remotelysave].
+
+These approaches differ in how they represent concurrent changes. Syncthing propagates conflict copies as ordinary files [@syncthingsync], while Git can fetch divergent histories into separate tracking branches before merging them [@gitfetch], an approach automated on desktop and mobile by Obsidian Git [@obsidiangit]. Conflict-free replicated data types (CRDTs) can also expose alternatives: Automerge retains concurrent assignments to an object property for inspection [@automergeconflicts]. Self-hosted LiveSync retains competing file versions as leaves—the current versions of divergent branches—in the metadata document's revision tree until resolved by configured policies or explicit user action.
+
+These existing tools address distinct operational needs: hosted services prioritise turnkey convenience, external file synchronisers manage arbitrary filesystem trees, and version-control tools introduce explicit commit workflows. In the author's environment, however, managed devices prohibited background client daemons, while retaining competing revisions alongside their associated file updates required integrating replication directly with local file operations. Self-hosted LiveSync was therefore implemented as an Obsidian plug-in running entirely within the application runtime, backed by a decoupled, platform-independent engine to maintain uniform revision semantics across backends.
+
+Self-hosted LiveSync does not introduce a new database replication algorithm; rather, its contribution lies in applying revision-aware database semantics to an externally editable file vault. Content-addressed chunks, device-local branch provenance, and built-in recovery tools support continued editing while conflict review is deferred, protecting divergent work without altering standard note-taking workflows.
+
+# Software Design
+
+The shared replication and conflict-handling services are published as `@vrtmrz/livesync-commonlib` [@commonlib021] and used by the Obsidian plug-in, command-line interface (CLI), web application, and web peer.
+
+## Revision-aware Vault representation
+
+Each Vault file is represented in local PouchDB [@pouchdb] by a metadata document containing its path, size, modification time, and references to separate chunk documents. Chunks are content-addressed and can therefore be reused across revisions and files with identical content regions. When concurrent updates occur across devices, they form multiple competing leaves around the metadata document. PouchDB selects a deterministic winner for default retrieval, but this choice is an internal tie-breaker rather than evidence that the winner is newer, safer, or the version represented by a particular device's Vault.
+
+When concurrent updates diverge into branches $\alpha$ and $\beta$, both leaves replicate to other devices before resolution. Automatic three-way merging applies to Markdown (`.md`), Canvas (`.canvas`), and JSON (`.json`) files when both leaves and their nearest available shared ancestor are readable; other formats are excluded. In Markdown, concurrent insertions at the same offset concatenate sequentially by modification time. Because CouchDB replication transfers ancestry identifiers without ancestor content [@couchdbreplication], missing ancestral history or conflicting edits defer automatic merging. When automatic merging is disabled or inapplicable and both versions are readable, JSON and differing binary files resolve by modification time as a compatibility fallback, even when 'Always overwrite with a newer file' is disabled; enabling that option extends modification-time resolution to text conflicts. Otherwise, competing text versions remain for manual resolution, and can be compared via a two-way diff when both leaves are readable.
+
+## Device-local branch provenance
+
+While the database can retain competing branches concurrently, a local Vault can instantiate only a single concrete file at any given path. To resolve which branch a local file represents, the plug-in stores an exact database revision and observed local modification time in a device-local key-value store. This revision serves as the path's **branch anchor**, updated after a successful database-to-Vault reflection or Vault-to-database write.
+
+During active conflicts, local edits or logical deletions become children of the anchored revision, advancing that branch while keeping competing leaves intact. Cross-path renames store the target before logically deleting only the anchored source branch. If provenance is unavailable, the plug-in binds a file to an existing revision only when its bytes match exactly one available revision body; otherwise, it retains the conflict for manual resolution rather than guessing from paths or timestamps. Without active conflicts, ordinary writes simply advance the database revision.
+
+The built-in conflict inspector examines the current winner, every conflict leaf, and the nearest available shared ancestor. It reports missing chunks and file/database differences, permitting operations on an explicitly selected current leaf. Mutating operations recheck the revision beforehand, preventing a stale inspection from deleting or extending a superseded branch.
+
+## Transport-independent replication
+
+Using CouchDB's revision model as a baseline, Self-hosted LiveSync decouples database representation from network transport, replicating file-metadata revision identifiers and competing leaves intact across backends. CouchDB [@couchdb] provides native revision-aware replication. S3-compatible storage journals metadata leaf revisions and ancestry identifiers without synthesising new revisions, while chunk documents are stored as new local revisions with content-derived identifiers. The WebRTC peer-to-peer (P2P) adapter [@webrtc] uses Trystero [@trystero] DataChannels and an RPC-based replication shim to batch document requests while preserving identical revision semantics directly between peers. In CouchDB and journal transfers, Web Streams pipeline data to limit the amount of data buffered in memory during transfer.
+
+Transports combine flexibly: while P2P requires concurrent online presence, pairing it with CouchDB or object storage bridges offline intervals. All transports support end-to-end content encryption and path obfuscation. P2P encrypts session descriptions during connection negotiation, though signalling relays and network services can still observe connection timing and network addresses.
+
+## Retention and recovery
+
+Because alternative branches share unchanged chunks, retaining competing leaves incurs storage and transfer costs primarily for new chunks and revision metadata. Remote database rebuilds reclaim space, while an explicitly initiated beta garbage-collection workflow provides in-place CouchDB cleanup by protecting chunks reachable from the current winner, every conflict leaf, and the available ancestry needed to inspect active conflicts. Because superseded chunks may be collected, historical revisions are not an unconditional backup.
+
+When chunks are missing, unreadable current revisions remain in the tree rather than being automatically discarded during conflict processing. Because missing chunks may still exist on other devices, users can defer recovery until they reconnect and synchronise. The conflict inspector identifies affected revisions and facilitates retrieval retries and explicit recovery actions. Recovery ultimately requires surviving content on a device, in remote storage, or in a backup.
+
+# Research Impact Statement
+
+Self-hosted LiveSync originated in the author's multi-platform software engineering workflows, capturing screenshots and recording observations across multiple devices, including when a primary device was unavailable. Today, the same workflow supports the author's patent prior-art investigations, synchronising notes and reflections made while reading prior patent literature. Retaining competing revisions allows divergent observations to be compared after the fact rather than overwritten immediately.
+
+Unit and integration tests cover revision ancestry, chunk reachability, unavailable content, and host composition. CLI and real-Obsidian scenarios exercise conflict propagation and resolution, including edits, logical deletions, and renames while competing leaves remain active. A three-node P2P scenario verifies that unresolved leaves move between devices before resolution. Reusable headless test infrastructure is archived independently [@fancykit]. Deterministic fixtures compare P2P and CouchDB paths over identical generated data; controlled local measurements do not establish universal performance.
+
+As of 2 September 2026, the Obsidian plug-in directory reported more than 900,000 downloads, desktop and mobile support, and placement in its Research category [@obsidianplugin]. The GitHub repository recorded over 12,200 stars, 440 forks, and contributions from a broad user community [@selfhostedlivesyncrepo]. These figures demonstrate community adoption rather than direct research impact, but they provide evidence that the software operates beyond a single private workflow.
+
+The software described here is Self-hosted LiveSync 1.0.23 [@selfhostedlivesync], released under the MIT licence and pinned to Commonlib 0.1.21 [@commonlib021]. Zenodo archives the plug-in, the reusable test harness [@fancykit], and an earlier Commonlib 0.1.19 snapshot [@commonlib]. Platform-independent logic supports independent testing and reuse.
+
+# AI Usage Disclosure
+
+OpenAI Codex using GPT-5 was used from July to September 2026 for code navigation, test and benchmark scaffolding, CI and documentation edits, manuscript editing, proofreading, review, citation verification, and result summarisation. GPT-6 assisted with September manuscript review and revision through Codex. No other generative AI tools prepared the manuscript. GitHub Copilot assisted with commits in this release, and Google Gemini (Flash versions 3.5 to 3.8) supported codebase verification. The human author validated all assisted outputs, made core design decisions, ran verification commands, and remains responsible for the accuracy, originality, licensing, and ethical compliance of the submitted materials.
+
+# Acknowledgements
+
+The author acknowledges project contributors, users, and upstream maintainers of PouchDB, CouchDB, and Trystero. The project has received community support through GitHub Sponsors, development-tool licensing from JetBrains, and support through OpenAI's Codex for Open Source programme.
+
+# References
+

src/LiveSyncBaseCore.ts

@@ -38,6 +38,11 @@ export interface LiveSyncCoreFeatureViews {
     readonly replicationScheduling: ReplicationSchedulingControl;
 }
 
+export interface StartupDatabaseOptions {
+    readonly ignoreSuspending?: boolean;
+    readonly continueOnFileFailure?: boolean;
+}
+
 type CompatibilityReplicatorView = ReplicatorInstance & Partial<LiveSyncAbstractReplicator>;
 
 export class LiveSyncBaseCore<
@@ -78,7 +83,8 @@ export class LiveSyncBaseCore<
         ) => ServiceModules,
         extraModuleInitialiser: (core: LiveSyncBaseCore<T, TCommands>) => AbstractModule[],
         addOnsInitialiser: (core: LiveSyncBaseCore<T, TCommands>) => TCommands[],
-        featuresInitialiser: (core: LiveSyncBaseCore<T, TCommands>, coreFeatureViews: LiveSyncCoreFeatureViews) => void
+        featuresInitialiser: (core: LiveSyncBaseCore<T, TCommands>, coreFeatureViews: LiveSyncCoreFeatureViews) => void,
+        readonly startupDatabaseOptions: StartupDatabaseOptions = {}
     ) {
         this._services = serviceHub;
         this.registerReplicatorProviders();

src/apps/browser/BrowserP2PTransportSettings.svelte

@@ -1,105 +1,67 @@
 <script lang="ts">
     import { onMount } from "svelte";
+    import { upsertRemoteConfigurationInPlace } from "@vrtmrz/livesync-commonlib/remote-configurations";
+    import { REMOTE_P2P } from "@vrtmrz/livesync-commonlib/compat/common/types";
     import type { P2PSyncSetting } from "@vrtmrz/livesync-commonlib/compat/common/types";
-
     import type { P2PReplicatorPaneHost } from "@/features/P2PSync/P2PReplicator/P2PReplicatorPaneHost";
+    import TurnConfiguration from "@/features/P2PSync/TurnConfiguration.svelte";
+    import { validateManagedTurnSettings } from "@/integrations/turnSettings";
 
-    interface Props {
-        host: P2PReplicatorPaneHost;
-    }
-
-    let { host }: Props = $props();
+    let { host }: { host: P2PReplicatorPaneHost } = $props();
     const currentSettings = () => host.services.setting.currentSettings() as P2PSyncSetting;
-    const initialSettings = currentSettings();
-
-    let savedTurnServers = $state(initialSettings.P2P_turnServers);
-    let savedTurnUsername = $state(initialSettings.P2P_turnUsername);
-    let savedTurnCredential = $state(initialSettings.P2P_turnCredential);
-    let turnServers = $state(initialSettings.P2P_turnServers);
-    let turnUsername = $state(initialSettings.P2P_turnUsername);
-    let turnCredential = $state(initialSettings.P2P_turnCredential);
-
-    const isTurnServersModified = $derived(turnServers !== savedTurnServers);
-    const isTurnUsernameModified = $derived(turnUsername !== savedTurnUsername);
-    const isTurnCredentialModified = $derived(turnCredential !== savedTurnCredential);
-    const isModified = $derived(
-        isTurnServersModified || isTurnUsernameModified || isTurnCredentialModified
-    );
+    function turnSettings(settings: P2PSyncSetting) {
+        return {
+            P2P_roomID: settings.P2P_roomID,
+            P2P_turnServers: settings.P2P_turnServers,
+            P2P_turnUsername: settings.P2P_turnUsername,
+            P2P_turnCredential: settings.P2P_turnCredential,
+            P2P_managedType: settings.P2P_managedType,
+            P2P_managedId: settings.P2P_managedId,
+            P2P_managedToken: settings.P2P_managedToken,
+        };
+    }
+    let draft = $state(turnSettings(currentSettings()));
+    let saved = $state(JSON.stringify(turnSettings(currentSettings())));
+    const isModified = $derived(JSON.stringify(draft) !== saved);
+    const sourceError = $derived(validateManagedTurnSettings(draft));
+    const sourceNeedsRoom = $derived(!!draft.P2P_managedType && (draft.P2P_roomID ?? "").trim() === "");
 
     function loadSettings(settings: P2PSyncSetting): void {
-        savedTurnServers = settings.P2P_turnServers;
-        savedTurnUsername = settings.P2P_turnUsername;
-        savedTurnCredential = settings.P2P_turnCredential;
-        turnServers = savedTurnServers;
-        turnUsername = savedTurnUsername;
-        turnCredential = savedTurnCredential;
+        const next = turnSettings(settings);
+        draft = next;
+        saved = JSON.stringify(next);
     }
-
-    onMount(() =>
-        host.services.context.events.onEvent("setting-saved", (settings) => {
-            loadSettings(settings as P2PSyncSetting);
-        })
-    );
+    onMount(() => host.services.context.events.onEvent("setting-saved", () => loadSettings(currentSettings())));
 
     async function save(): Promise<void> {
-        await host.services.setting.applyPartial(
-            {
-                P2P_turnServers: turnServers,
-                P2P_turnUsername: turnUsername,
-                P2P_turnCredential: turnCredential,
-            },
-            true
-        );
+        if (sourceError || sourceNeedsRoom) return;
+        const values = $state.snapshot(draft);
+        await host.services.setting.updateSettings((settings) => {
+            const next = { ...settings, ...values, remoteConfigurations: { ...settings.remoteConfigurations } };
+            const profileId = settings.P2P_ActiveRemoteConfigurationId ||
+                (settings.remoteType === REMOTE_P2P ? settings.activeConfigurationId : "");
+            const selected = next.remoteConfigurations[profileId];
+            if (selected?.uri.startsWith("sls+p2p://")) {
+                upsertRemoteConfigurationInPlace(next, "p2p", { id: profileId, activateForP2P: true });
+            } else if (values.P2P_managedType) {
+                upsertRemoteConfigurationInPlace(next, "p2p", { activateForP2P: true });
+            }
+            return next;
+        }, true);
         loadSettings(currentSettings());
     }
-
-    function revert(): void {
-        turnServers = savedTurnServers;
-        turnUsername = savedTurnUsername;
-        turnCredential = savedTurnCredential;
-    }
 </script>
 
 <section class="browser-p2p-transport-settings">
     <details>
         <summary>Optional TURN server settings</summary>
-        <p>
-            Configure TURN only when a direct peer-to-peer connection cannot be established.
-        </p>
-        <label class:is-dirty={isTurnServersModified}>
-            <span>TURN Server URLs (comma-separated)</span>
-            <input
-                type="text"
-                placeholder="turn:turn.example.com:3478"
-                bind:value={turnServers}
-                autocomplete="off"
-                spellcheck="false"
-                autocorrect="off"
-            />
-        </label>
-        <label class:is-dirty={isTurnUsernameModified}>
-            <span>TURN Username</span>
-            <input
-                type="text"
-                placeholder="Enter TURN username"
-                bind:value={turnUsername}
-                autocomplete="off"
-            />
-        </label>
-        <label class:is-dirty={isTurnCredentialModified}>
-            <span>TURN Credential</span>
-            <input
-                type="password"
-                placeholder="Enter TURN credential"
-                bind:value={turnCredential}
-                autocomplete="new-password"
-            />
-        </label>
+        <p>Configure TURN only when a direct peer-to-peer connection cannot be established.</p>
+        <TurnConfiguration bind:settings={draft} />
         <div class="actions">
-            <button type="button" class="button mod-cta" disabled={!isModified} onclick={save}>
+            <button type="button" class="button mod-cta" disabled={!isModified || !!sourceError || sourceNeedsRoom} onclick={save}>
                 Save TURN settings
             </button>
-            <button type="button" class="button" disabled={!isModified} onclick={revert}>
+            <button type="button" class="button" disabled={!isModified} onclick={() => loadSettings(currentSettings())}>
                 Revert TURN settings
             </button>
         </div>
@@ -107,27 +69,7 @@
 </section>
 
 <style>
-    .browser-p2p-transport-settings {
-        margin-bottom: 1rem;
-    }
-    p {
-        margin: 0.75rem 0;
-    }
-    label {
-        display: grid;
-        gap: 0.25rem;
-        margin: 0.75rem 0;
-    }
-    label.is-dirty {
-        background-color: var(--background-modifier-error);
-    }
-    input {
-        box-sizing: border-box;
-        width: 100%;
-    }
-    .actions {
-        display: flex;
-        flex-wrap: wrap;
-        gap: 0.5rem;
-    }
+    .browser-p2p-transport-settings { margin-bottom: 1rem; }
+    p { margin: 0.75rem 0; }
+    .actions { display: flex; flex-wrap: wrap; gap: 0.5rem; }
 </style>

src/apps/cli/Dockerfile

@@ -82,9 +82,11 @@ RUN apt-get update \
 
 WORKDIR /deps
 
-# package.json lists only the packages that the CLI requires
-COPY src/apps/cli/package.json ./package.json
-RUN npm install --omit=dev
+# Remove build-only dependencies before resolving the standalone runtime tree.
+# npm --omit=dev omits them from disk, but still resolves their peer graph.
+COPY src/apps/cli/package.json ./package.json
+RUN npm pkg delete devDependencies \
+    && npm install --omit=dev
 
 # ─────────────────────────────────────────────────────────────────────────────
 #  Stage 3 — runtime

src/apps/cli/adapters/NodeFileSystemAdapter.ts

@@ -92,10 +92,9 @@ export class NodeFileSystemAdapter implements IFileSystemAdapter<NodeFile, NodeF
     }
 
     async getFiles(): Promise<NodeFile[]> {
-        if (this.fileCache.size === 0) {
-            await this.scanDirectory();
-        }
-        return Array.from(this.fileCache.values());
+        const files = new Map<string, NodeFile>();
+        await this.scanDirectoryInto("", files);
+        return Array.from(files.values());
     }
 
     async renameFile(file: NodeFile, newPath: string): Promise<NodeFile> {
@@ -147,6 +146,10 @@ export class NodeFileSystemAdapter implements IFileSystemAdapter<NodeFile, NodeF
      * Helper method to recursively scan directory and populate file cache
      */
     async scanDirectory(relativePath: string = ""): Promise<void> {
+        await this.scanDirectoryInto(relativePath, this.fileCache);
+    }
+
+    private async scanDirectoryInto(relativePath: string, files: Map<string, NodeFile>): Promise<void> {
         const fullPath = this.resolvePath(relativePath);
         try {
             const directoryStat = await this.storage.stat(relativePath);
@@ -160,10 +163,10 @@ export class NodeFileSystemAdapter implements IFileSystemAdapter<NodeFile, NodeF
                     path: entryPath as FilePath,
                     stat,
                 };
-                this.fileCache.set(entryPath, file);
+                files.set(entryPath, file);
             }
             for (const entryPath of entries.folders) {
-                await this.scanDirectory(entryPath);
+                await this.scanDirectoryInto(entryPath, files);
             }
         } catch (error) {
             // Directory doesn't exist or is not readable

src/apps/cli/adapters/NodeFileSystemAdapter.unit.spec.ts

@@ -0,0 +1,118 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { fsPromises as fs, os, path } from "@vrtmrz/livesync-commonlib/node";
+import { NodeFileSystemAdapter } from "./NodeFileSystemAdapter";
+
+describe("NodeFileSystemAdapter file enumeration", () => {
+    const tempDirs: string[] = [];
+    const paths = ["a.md", "folder/b.md", "folder/sub/c.md"];
+
+    async function createVault() {
+        const directory = await fs.mkdtemp(path.join(os.tmpdir(), "livesync-cli-enumeration-"));
+        tempDirs.push(directory);
+        for (const file of paths) {
+            await fs.mkdir(path.dirname(path.join(directory, file)), { recursive: true });
+            await fs.writeFile(path.join(directory, file), `content of ${file}`);
+        }
+        return { directory, adapter: new NodeFileSystemAdapter(directory) };
+    }
+
+    afterEach(async () => {
+        await Promise.all(tempDirs.splice(0).map((directory) => fs.rm(directory, { recursive: true, force: true })));
+    });
+
+    it("lists every file when one file was refreshed before the first enumeration", async () => {
+        const { adapter } = await createVault();
+
+        expect(await adapter.refreshFile("folder/b.md")).not.toBeNull();
+
+        expect((await adapter.getFiles()).map((file) => file.path).sort()).toEqual(paths);
+    });
+
+    it("lists every file after a path lookup without any replication", async () => {
+        const { adapter } = await createVault();
+
+        expect((await adapter.getAbstractFileByPath("folder/b.md"))?.path).toBe("folder/b.md");
+
+        expect((await adapter.getFiles()).map((file) => file.path).sort()).toEqual(paths);
+    });
+
+    it("lists every file on the first enumeration without a prior path lookup", async () => {
+        const { adapter } = await createVault();
+
+        expect((await adapter.getFiles()).map((file) => file.path).sort()).toEqual(paths);
+    });
+
+    it("excludes a deleted file after its cache entry is refreshed", async () => {
+        const { directory, adapter } = await createVault();
+        await adapter.getFiles();
+
+        await fs.rm(path.join(directory, "folder/b.md"));
+        expect(await adapter.refreshFile("folder/b.md")).toBeNull();
+
+        expect((await adapter.getFiles()).map((file) => file.path).sort()).toEqual(["a.md", "folder/sub/c.md"]);
+    });
+
+    it("reflects files added and deleted between enumerations", async () => {
+        const { directory, adapter } = await createVault();
+
+        expect((await adapter.getFiles()).map((file) => file.path).sort()).toEqual(paths);
+
+        await fs.rm(path.join(directory, "folder/b.md"));
+        const updatedContent = "updated content of a.md";
+        await fs.writeFile(path.join(directory, "a.md"), updatedContent);
+        await fs.writeFile(path.join(directory, "later.md"), "content of later.md");
+
+        const files = await adapter.getFiles();
+        expect(files.map((file) => file.path).sort()).toEqual(["a.md", "folder/sub/c.md", "later.md"]);
+        expect(files.find((file) => file.path === "a.md")?.stat.size).toBe(updatedContent.length);
+    });
+
+    it("returns complete listings from simultaneous calls", async () => {
+        const { adapter } = await createVault();
+
+        const originalStat = adapter.storage.stat.bind(adapter.storage);
+        let releaseFolderStat!: () => void;
+        const folderStatReleased = new Promise<void>((resolve) => {
+            releaseFolderStat = resolve;
+        });
+        let folderStatStarted!: () => void;
+        const folderStatStartedPromise = new Promise<void>((resolve) => {
+            folderStatStarted = resolve;
+        });
+        let pauseFolderStat = true;
+        const statSpy = vi.spyOn(adapter.storage, "stat").mockImplementation(async (relativePath) => {
+            const stat = await originalStat(relativePath);
+            if (pauseFolderStat && relativePath === "folder") {
+                pauseFolderStat = false;
+                folderStatStarted();
+                await folderStatReleased;
+            }
+            return stat;
+        });
+
+        const firstListing = adapter.getFiles();
+        let listings: Awaited<ReturnType<typeof adapter.getFiles>>[] | undefined;
+        try {
+            await folderStatStartedPromise;
+            const secondListing = adapter.getFiles();
+            const secondFiles = await secondListing;
+            releaseFolderStat();
+            const firstFiles = await firstListing;
+            listings = [secondFiles, firstFiles];
+        } finally {
+            releaseFolderStat();
+            statSpy.mockRestore();
+        }
+
+        if (!listings) throw new Error("Expected both concurrent listings to complete");
+        expect(listings.map((files) => files.map((file) => file.path).sort())).toEqual([paths, paths]);
+    });
+
+    it("returns an empty listing for an empty vault", async () => {
+        const directory = await fs.mkdtemp(path.join(os.tmpdir(), "livesync-cli-enumeration-empty-"));
+        tempDirs.push(directory);
+        const adapter = new NodeFileSystemAdapter(directory);
+
+        await expect(adapter.getFiles()).resolves.toEqual([]);
+    });
+});

src/apps/cli/commands/daemonCommand.unit.spec.ts

@@ -4,7 +4,7 @@ import { NO_INTERACTION } from "@vrtmrz/livesync-commonlib/replication";
 import { runCommand } from "./runCommand";
 import type { CLIOptions } from "./types";
 
-// Mock performFullScan so daemon tests don't require a real CouchDB connection.
+// Track explicit scans: database preparation owns the daemon startup scan.
 vi.mock("@vrtmrz/livesync-commonlib/compat/serviceFeatures/offlineScanner", () => ({
     performFullScan: vi.fn(async () => true),
 }));
@@ -102,6 +102,7 @@ function createDaemonContext(core: ReturnType<typeof createCoreMock>) {
 describe("daemon command", () => {
     beforeEach(() => {
         vi.restoreAllMocks();
+        vi.mocked(offlineScanner.performFullScan).mockClear();
         vi.useFakeTimers();
     });
 
@@ -109,27 +110,16 @@ describe("daemon command", () => {
         vi.useRealTimers();
     });
 
-    it("calls performFullScan during startup", async () => {
+    it("does not repeat the startup scan after initial replication", async () => {
         const core = createCoreMock();
-        vi.mocked(offlineScanner.performFullScan).mockResolvedValue(true);
 
-        await runCommand(makeDaemonOptions(), createDaemonContext(core));
+        expect(await runCommand(makeDaemonOptions(), createDaemonContext(core))).toBe(true);
 
-        expect(offlineScanner.performFullScan).toHaveBeenCalledTimes(1);
-    });
-
-    it("returns false when performFullScan fails", async () => {
-        const core = createCoreMock();
-        vi.mocked(offlineScanner.performFullScan).mockResolvedValue(false);
-
-        const result = await runCommand(makeDaemonOptions(), createDaemonContext(core));
-
-        expect(result).toBe(false);
+        expect(offlineScanner.performFullScan).not.toHaveBeenCalled();
     });
 
     it("polling mode: calls setTimeout when interval option is set", async () => {
         const core = createCoreMock();
-        vi.mocked(offlineScanner.performFullScan).mockResolvedValue(true);
         const setTimeoutSpy = vi.spyOn(globalThis, "setTimeout");
 
         const context = createDaemonContext(core);
@@ -143,7 +133,6 @@ describe("daemon command", () => {
 
     it("polling mode: applies settings with suspendFileWatching=false before setting interval", async () => {
         const core = createCoreMock();
-        vi.mocked(offlineScanner.performFullScan).mockResolvedValue(true);
 
         await runCommand(makeDaemonOptions(10), createDaemonContext(core));
 
@@ -156,7 +145,6 @@ describe("daemon command", () => {
 
     it("liveSync mode: calls applyPartial and applySettings", async () => {
         const core = createCoreMock();
-        vi.mocked(offlineScanner.performFullScan).mockResolvedValue(true);
 
         await runCommand(makeDaemonOptions(), createDaemonContext(core));
 
@@ -176,7 +164,6 @@ describe("daemon command", () => {
             liveSync: false,
             syncOnStart: false,
         }));
-        vi.mocked(offlineScanner.performFullScan).mockResolvedValue(true);
 
         const result = await runCommand(makeDaemonOptions(), createDaemonContext(core));
 
@@ -194,7 +181,6 @@ describe("daemon command", () => {
             liveSync: true,
             syncOnStart: false,
         }));
-        vi.mocked(offlineScanner.performFullScan).mockResolvedValue(true);
 
         await runCommand(makeDaemonOptions(), createDaemonContext(core));
 
@@ -205,22 +191,21 @@ describe("daemon command", () => {
         expect(warningCalls.length).toBe(0);
     });
 
-    it("calls replicate before performFullScan", async () => {
+    it("completes initial replication before restoring automatic synchronisation", async () => {
         const core = createCoreMock();
         const callOrder: string[] = [];
         core.services.replication.replicateUnattended = vi.fn(async () => {
             callOrder.push("replicate");
             return { status: "completed" as const };
         });
-        vi.mocked(offlineScanner.performFullScan).mockImplementation(async () => {
-            callOrder.push("performFullScan");
-            return true;
+        core.services.control.applySettings.mockImplementation(async () => {
+            callOrder.push("restoreSettings");
         });
 
         const context = createDaemonContext(core);
         await runCommand(makeDaemonOptions(), context);
 
-        expect(callOrder).toEqual(["replicate", "performFullScan"]);
+        expect(callOrder).toEqual(["replicate", "restoreSettings"]);
         expect(core.services.replication.replicateUnattended).toHaveBeenCalledWith({
             trigger: "daemon",
             interaction: NO_INTERACTION,
@@ -234,12 +219,11 @@ describe("daemon command", () => {
             status: "failed" as const,
             error: new Error("initial replication failed"),
         }));
-        vi.mocked(offlineScanner.performFullScan).mockClear();
 
         const result = await runCommand(makeDaemonOptions(), createDaemonContext(core));
 
         expect(result).toBe(false);
-        // performFullScan should NOT have been called
+        expect(core.services.control.applySettings).not.toHaveBeenCalled();
         expect(offlineScanner.performFullScan).not.toHaveBeenCalled();
         expect(core.services.replication.replicateUnattended).toHaveBeenCalledWith({
             trigger: "daemon",
@@ -249,7 +233,6 @@ describe("daemon command", () => {
 
     it("polling mode: registers onUnload handler that clears timeout", async () => {
         const core = createCoreMock();
-        vi.mocked(offlineScanner.performFullScan).mockResolvedValue(true);
 
         await runCommand(makeDaemonOptions(10), createDaemonContext(core));
 
@@ -265,7 +248,6 @@ describe("daemon command", () => {
 
     it("polling backoff: interval escalates on failure, caps at 300000ms, then halves on recovery", async () => {
         const core = createCoreMock();
-        vi.mocked(offlineScanner.performFullScan).mockResolvedValue(true);
 
         // startup replicate (call 1) succeeds; poll calls 2–7 fail; call 8 succeeds.
         let callCount = 0;
@@ -320,7 +302,6 @@ describe("daemon command", () => {
 
     it("polling error handling: replicate rejection is caught and written to standard error", async () => {
         const core = createCoreMock();
-        vi.mocked(offlineScanner.performFullScan).mockResolvedValue(true);
 
         // Make replicate succeed on the initial call (startup), then fail on the poll.
         let callCount = 0;

src/apps/cli/commands/runCommand.ts

@@ -15,8 +15,6 @@ import { stripAllPrefixes } from "@vrtmrz/livesync-commonlib/compat/string_and_b
 import type { CLICommandContext, CLIOptions } from "./types";
 import { toArrayBuffer, toDatabaseRelativePath } from "./utils";
 import { collectPeers, openP2PHost, parseTimeoutSeconds, syncWithPeer } from "./p2p";
-import { performFullScan } from "@vrtmrz/livesync-commonlib/compat/serviceFeatures/offlineScanner";
-import { UnresolvedErrorManager } from "@vrtmrz/livesync-commonlib/compat/services/base/UnresolvedErrorManager";
 import { compatGlobal } from "@vrtmrz/livesync-commonlib/compat/common/coreEnvFunctions";
 import { fsPromises as fs, path } from "@vrtmrz/livesync-commonlib/node";
 import { writeStderrLine, writeStdoutLine } from "@/apps/cli/cliOutput";
@@ -56,9 +54,9 @@ export async function runCommand(options: CLIOptions, context: CLICommandContext
         // accept whatever configuration the remote has.
         await core.services.setting.applyPartial({ disableCheckingConfigMismatch: true }, true);
 
-        // 1. Replicate the configured remote into the local database so the
-        // mirror scan has content to work with.
-        log("Replicating from remote...");
+        // Database preparation has already reconciled the local database and Vault.
+        // Replicate before restoring automatic synchronisation.
+        log("Replicating with remote...");
         const replResult = await core.services.replication.replicateUnattended({
             trigger: "daemon",
             interaction: NO_INTERACTION,
@@ -70,17 +68,7 @@ export async function runCommand(options: CLIOptions, context: CLICommandContext
         replicationScheduling.markInitialOneShotSatisfied();
         log("Initial replication complete");
 
-        // 2. Mirror scan to reconcile PouchDB ↔ local filesystem.
-        const errorManager = new UnresolvedErrorManager(core.services.appLifecycle, core.services.context.events);
-        log("Running mirror scan...");
-        const scanOk = await performFullScan(core, log, errorManager, false, true);
-        if (!scanOk) {
-            writeStderrLine(standardIo, "[Daemon] Mirror scan failed, cannot continue");
-            return false;
-        }
-        log("Mirror scan complete");
-
-        // 3. Re-enable sync.
+        // Re-enable sync.
         const restoreSyncSettings = async () => {
             await core.services.setting.applyPartial(
                 {
@@ -527,9 +515,8 @@ export async function runCommand(options: CLIOptions, context: CLICommandContext
 
     if (options.command === "mirror") {
         writeStderrLine(standardIo, "[Command] mirror");
-        const log = (msg: unknown) => writeStderrLine(standardIo, `[Mirror] ${String(msg)}`);
-        const errorManager = new UnresolvedErrorManager(core.services.appLifecycle, core.services.context.events);
-        return await performFullScan(core, log, errorManager, false, true);
+        // Database preparation has already completed the mirror scan.
+        return true;
     }
 
     if (options.command === "remote-add") {

src/apps/cli/commands/runCommand.unit.spec.ts

@@ -419,6 +419,30 @@ describe("runCommand abnormal cases", () => {
         expect(appliedSettings.useIndexedDBAdapter).toBe(false);
     });
 
+    it("setup imports managed TURN through the existing encrypted URI", async () => {
+        const core = createCoreMock();
+        const profiles = {
+            turn: { id: "turn", name: "TURN", isEncrypted: false,
+                uri: "sls+p2p://room?managedType=CF&managedId=turn-key&token=private-token" },
+        };
+        const passphrase = "setup-passphrase";
+        const setupURI = await processSetting.encodeSettingsToSetupURI(
+            {
+                ...DEFAULT_SETTINGS,
+                remoteConfigurations: profiles,
+            },
+            passphrase
+        );
+        expect(setupURI.startsWith(configURIBase)).toBe(true);
+        expect(setupURI).not.toContain("private-token");
+        core.services.context.standardIo.prompt.mockResolvedValue(passphrase);
+        await runCommand(makeOptions("setup", [setupURI]), { ...context, core });
+        expect(core.services.setting.applyExternalSettings).toHaveBeenCalledWith(
+            expect.objectContaining({ remoteConfigurations: profiles }),
+            true
+        );
+    });
+
     it("setup rejects encoded URI when passphrase is wrong", async () => {
         const core = createCoreMock();
         const setupURI = await createSetupURI("correct-passphrase");

src/apps/cli/main.bootstrap.unit.spec.ts

@@ -0,0 +1,195 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import * as chokidar from "chokidar";
+import { ControlService } from "@vrtmrz/livesync-commonlib/compat/services/base/ControlService";
+import type { FilePathWithPrefix } from "@vrtmrz/livesync-commonlib/compat/common/types";
+import { ServiceFileHandler } from "@/serviceModules/FileHandler";
+import { ServiceFileAccessCLI } from "./serviceModules/ServiceFileAccessImpl";
+import { runCommand } from "./commands/runCommand";
+import { createDefaultCliSettings } from "./cliSettingsDefaults";
+import { main, type CliCommandRunner } from "./main";
+
+vi.mock("chokidar", { spy: true });
+
+function createStandardIoMock() {
+    return {
+        readStdin: vi.fn(async () => ""),
+        prompt: vi.fn(async () => ""),
+        writeStdout: vi.fn(),
+        writeStderr: vi.fn(),
+    };
+}
+
+describe("CLI database preparation", () => {
+    const originalArgv = process.argv.slice();
+    const originalExitCode = process.exitCode;
+    let directory: string;
+    let vaultPath: string;
+    let settingsPath: string;
+    let signalHandlers: Map<"SIGINT" | "SIGTERM", Set<NodeJS.SignalsListener>>;
+    let standardIo: ReturnType<typeof createStandardIoMock>;
+
+    beforeEach(async () => {
+        vi.mocked(chokidar.watch).mockClear();
+        directory = await mkdtemp(join(tmpdir(), "livesync-cli-bootstrap-"));
+        vaultPath = join(directory, "vault");
+        settingsPath = join(directory, "settings.json");
+        await mkdir(join(vaultPath, "notes"), { recursive: true });
+        await writeFile(join(vaultPath, "notes/local.md"), "local content");
+        await writeFile(settingsPath, JSON.stringify({ ...createDefaultCliSettings(), isConfigured: true }));
+        standardIo = createStandardIoMock();
+        signalHandlers = new Map(
+            (["SIGINT", "SIGTERM"] as const).map((signal) => [signal, new Set(process.listeners(signal))])
+        );
+        process.exitCode = undefined;
+        vi.spyOn(process, "exit").mockImplementation((code) => {
+            throw new Error(`__EXIT__:${code ?? 0}`);
+        });
+    });
+
+    afterEach(async () => {
+        for (const [signal, originalHandlers] of signalHandlers) {
+            for (const handler of process.listeners(signal)) {
+                if (!originalHandlers.has(handler)) process.removeListener(signal, handler);
+            }
+        }
+        process.argv = originalArgv.slice();
+        process.exitCode = originalExitCode;
+        vi.restoreAllMocks();
+        await rm(directory, { recursive: true, force: true });
+    });
+
+    async function start(command: "daemon" | "mirror" | "ls", runner: CliCommandRunner, exitCode = 1) {
+        process.argv = ["node", "livesync-cli", directory, "--vault", vaultPath, "--settings", settingsPath, command];
+        // Daemon probes return false so the real core unloads without keeping a daemon alive.
+        await expect(main(standardIo, runner)).rejects.toThrow(`__EXIT__:${exitCode}`);
+    }
+
+    it.each([
+        { command: "daemon" as const, suspendFileWatching: false },
+        { command: "mirror" as const, suspendFileWatching: false },
+        { command: "mirror" as const, suspendFileWatching: true },
+    ])(
+        "prepares the Vault before $command (watching suspended: $suspendFileWatching)",
+        async ({ command, suspendFileWatching }) => {
+            await writeFile(
+                settingsPath,
+                JSON.stringify({ ...createDefaultCliSettings(), isConfigured: true, suspendFileWatching })
+            );
+            await mkdir(join(vaultPath, ".livesync"));
+            await writeFile(join(vaultPath, ".livesync/ignore"), "*.tmp\n");
+            await writeFile(join(vaultPath, "notes/ignored.tmp"), "ignored");
+            const storedPaths: string[] = [];
+            let content: string | undefined;
+            const runner = vi.fn<CliCommandRunner>(async (_options, { core }) => {
+                for await (const doc of core.services.database.localDatabase.findAllNormalDocs()) {
+                    storedPaths.push(doc.path);
+                }
+                const file = await core.serviceModules.databaseFileAccess.fetch("notes/local.md" as FilePathWithPrefix);
+                content = file ? await file.body.text() : undefined;
+                return false;
+            });
+
+            await start(command, runner);
+
+            expect(runner).toHaveBeenCalledOnce();
+            expect(storedPaths).toEqual(["notes/local.md"]);
+            expect(content).toBe("local content");
+            expect(await readFile(join(vaultPath, "notes/local.md"), "utf-8")).toBe("local content");
+        }
+    );
+
+    it("runs the mirror scan once and exits without starting file watching", async () => {
+        const enumerate = vi.spyOn(ServiceFileAccessCLI.prototype, "getFiles");
+        const watch = vi.mocked(chokidar.watch);
+        const runner = vi.fn<CliCommandRunner>(runCommand);
+
+        await start("mirror", runner, 0);
+
+        expect(runner).toHaveBeenCalledOnce();
+        expect(enumerate).toHaveBeenCalledOnce();
+        expect(watch).not.toHaveBeenCalled();
+    });
+
+    it.each([
+        { command: "daemon" as const, commandRuns: true },
+        { command: "mirror" as const, commandRuns: false },
+    ])("handles an individual file failure during $command preparation", async ({ command, commandRuns }) => {
+        const store = vi
+            .spyOn(ServiceFileHandler.prototype, "storeFileToDB")
+            .mockRejectedValue(new Error("file failed"));
+        const unload = vi.spyOn(ControlService.prototype, "onUnload");
+        const runner = vi.fn<CliCommandRunner>(async () => false);
+
+        await start(command, runner);
+
+        expect(store).toHaveBeenCalledOnce();
+        expect(runner).toHaveBeenCalledTimes(commandRuns ? 1 : 0);
+        expect(unload).toHaveBeenCalledOnce();
+        expect(await readFile(join(vaultPath, "notes/local.md"), "utf-8")).toBe("local content");
+    });
+
+    it("does not import vault files for standalone database commands", async () => {
+        const storedPaths: string[] = [];
+        const runner = vi.fn<CliCommandRunner>(async (_options, { core }) => {
+            for await (const doc of core.services.database.localDatabase.findAllNormalDocs()) {
+                storedPaths.push(doc.path);
+            }
+            return false;
+        });
+
+        await start("ls", runner);
+
+        expect(runner).toHaveBeenCalledOnce();
+        expect(storedPaths).toEqual([]);
+    });
+
+    it("unloads without starting the command when database preparation fails", async () => {
+        vi.spyOn(ControlService.prototype, "onReady").mockResolvedValue(false);
+        const unload = vi.spyOn(ControlService.prototype, "onUnload");
+        const runner = vi.fn<CliCommandRunner>(async () => false);
+        const settingsBefore = await readFile(settingsPath, "utf-8");
+
+        await start("daemon", runner);
+
+        expect(runner).not.toHaveBeenCalled();
+        expect(unload).toHaveBeenCalledOnce();
+        expect(unload.mock.invocationCallOrder[0]).toBeLessThan(vi.mocked(process.exit).mock.invocationCallOrder[0]);
+        expect(process.exit).toHaveBeenCalledWith(1);
+        expect(await readFile(settingsPath, "utf-8")).toBe(settingsBefore);
+    });
+
+    it("stops the daemon when the startup scanner refuses a suspended Vault scan", async () => {
+        await writeFile(
+            settingsPath,
+            JSON.stringify({ ...createDefaultCliSettings(), isConfigured: true, suspendFileWatching: true })
+        );
+        const unload = vi.spyOn(ControlService.prototype, "onUnload");
+        const runner = vi.fn<CliCommandRunner>(async () => false);
+
+        await start("daemon", runner);
+
+        expect(runner).not.toHaveBeenCalled();
+        expect(unload).toHaveBeenCalledOnce();
+        expect(process.exit).toHaveBeenCalledWith(1);
+    });
+
+    it("unloads when database preparation throws", async () => {
+        const ready = vi.spyOn(ControlService.prototype, "onReady").mockRejectedValue(new Error("scan failed"));
+        const unload = vi.spyOn(ControlService.prototype, "onUnload");
+        const runner = vi.fn<CliCommandRunner>(async () => false);
+
+        try {
+            await start("daemon", runner);
+
+            expect(runner).not.toHaveBeenCalled();
+            expect(unload).toHaveBeenCalledOnce();
+            expect(standardIo.writeStderr.mock.calls.flat().join("")).toContain("scan failed");
+        } finally {
+            const control = ready.mock.contexts[0];
+            if (unload.mock.calls.length === 0 && control instanceof ControlService) await control.onUnload();
+        }
+    });
+});

src/apps/cli/main.ts

@@ -1,6 +1,7 @@
+import { useP2PSettingsPreparation } from "@/serviceFeatures/useP2PSettingsPreparation";
 import { NodeServiceContext, NodeServiceHub } from "./services/NodeServiceHub";
 import { configureNodeLocalStorage, ensureGlobalNodeLocalStorage } from "./services/NodeLocalStorage";
-import { LiveSyncBaseCore } from "@/LiveSyncBaseCore";
+import { LiveSyncBaseCore, type StartupDatabaseOptions } from "@/LiveSyncBaseCore";
 import { initialiseServiceModulesCLI } from "./serviceModules/CLIServiceModules";
 import {
     LOG_LEVEL_VERBOSE,
@@ -24,6 +25,7 @@ import { getPathFromUXFileInfo } from "@vrtmrz/livesync-commonlib/compat/common/
 import { stripAllPrefixes } from "@vrtmrz/livesync-commonlib/compat/string_and_binary/path";
 import { IgnoreRules } from "./serviceModules/IgnoreRules";
 import { useP2PReplicatorFeature, type UseP2PReplicatorResult } from "@vrtmrz/livesync-commonlib/p2p";
+import { useOfflineScanner } from "@vrtmrz/livesync-commonlib/compat/serviceFeatures/offlineScanner";
 import type { ReplicationSchedulingControl } from "@/serviceFeatures/replicationScheduling";
 import { createNodeStandardIo, fsPromises as fs, path } from "@vrtmrz/livesync-commonlib/node";
 import type { StandardIo } from "@vrtmrz/livesync-commonlib/context";
@@ -41,6 +43,27 @@ import {
 } from "./settingsPersistence";
 
 const SETTINGS_FILE = ".livesync/settings.json";
+
+interface CLIVaultSyncMode {
+    readonly watchFiles: boolean;
+    readonly reflectReplicationResults: boolean;
+    readonly startupDatabaseOptions: StartupDatabaseOptions;
+}
+
+// Commands which synchronise a physical Vault with the local database.
+const VAULT_SYNC_MODES: Readonly<Partial<Record<CLICommand, CLIVaultSyncMode>>> = {
+    daemon: {
+        watchFiles: true,
+        reflectReplicationResults: true,
+        startupDatabaseOptions: { ignoreSuspending: false, continueOnFileFailure: true },
+    },
+    mirror: {
+        watchFiles: false,
+        reflectReplicationResults: false,
+        startupDatabaseOptions: { ignoreSuspending: true, continueOnFileFailure: false },
+    },
+};
+
 ensureGlobalNodeLocalStorage();
 defaultLoggerEnv.minLogLevel = LOG_LEVEL_DEBUG;
 
@@ -296,6 +319,7 @@ export async function main(
     commandRunner: CliCommandRunner = runCommand
 ) {
     const options = parseArgs(standardIo);
+    const vaultSyncMode = VAULT_SYNC_MODES[options.command];
     if (options.interval && options.command !== "daemon") {
         writeStderrLine(
             standardIo,
@@ -357,9 +381,6 @@ export async function main(
 
     // Resolve vault path: mirror positional argument takes priority,
     // then --vault flag, otherwise fall back to databasePath.
-    // For daemon mode, enable chokidar file watching so the _changes feed picks up events.
-    // mirror runs a single full scan and doesn't need continuous watching.
-    const watchEnabled = options.command === "daemon";
     const vaultPath =
         options.command === "mirror" && options.commandArgs[0]
             ? path.resolve(options.commandArgs[0])
@@ -385,7 +406,7 @@ export async function main(
     infoLog(`Settings: ${settingsPath}`);
     infoLog("");
     let ignoreRules: IgnoreRules | undefined;
-    if (options.command === "daemon" || options.command === "mirror") {
+    if (vaultSyncMode) {
         ignoreRules = new IgnoreRules(vaultPath, (message, detail) => {
             if (detail === undefined) {
                 writeStderrLine(standardIo, message);
@@ -426,9 +447,8 @@ export async function main(
         }
         writeStderrLine(standardIo, prefix, message);
     }, true);
-    // Prevent replication result from being processed automatically in non-daemon commands.
-    // In daemon mode the default handler must run so changes are applied to the filesystem.
-    if (options.command !== "daemon") {
+    // Only modes which reflect replication results use the default filesystem handler.
+    if (!vaultSyncMode?.reflectReplicationResults) {
         serviceHubInstance.replication.processSynchroniseResult.addHandler(async () => {
             writeStderrLine(
                 standardIo,
@@ -489,14 +509,25 @@ export async function main(
     const core = new LiveSyncBaseCore(
         serviceHubInstance,
         (core: LiveSyncBaseCore<NodeServiceContext, never>, serviceHub: InjectableServiceHub<NodeServiceContext>) => {
-            return initialiseServiceModulesCLI(vaultPath, core, serviceHub, ignoreRules, watchEnabled);
+            return initialiseServiceModulesCLI(
+                vaultPath,
+                core,
+                serviceHub,
+                ignoreRules,
+                vaultSyncMode?.watchFiles ?? false
+            );
         },
         (core) => [],
         () => [], // No add-ons
         (core, coreFeatureViews) => {
             replicationScheduling = coreFeatureViews.replicationScheduling;
+            if (vaultSyncMode) {
+                useOfflineScanner(core);
+            }
             // Register P2P replicator feature.
-            p2pReplicator = useP2PReplicatorFeature(core);
+            p2pReplicator = useP2PReplicatorFeature(core, undefined, undefined, {
+                prepareP2PSettings: useP2PSettingsPreparation(core.services.API.webCompatFetch.bind(core.services.API)),
+            });
             // Add target filter to prevent internal files are handled
             core.services.vault.isTargetFile.addHandler(async (target) => {
                 const targetPath = stripAllPrefixes(getPathFromUXFileInfo(target));
@@ -512,7 +543,7 @@ export async function main(
                 return await Promise.resolve(true);
             }, -1 /* highest priority */);
 
-            // Apply user-defined ignore rules for daemon mode (lower priority, runs after dotfile check).
+            // Apply user-defined ignore rules after the dotfile check.
             if (ignoreRules) {
                 const rules = ignoreRules;
                 core.services.vault.isTargetFile.addHandler(async (target) => {
@@ -524,7 +555,8 @@ export async function main(
                     return true;
                 }, 0);
             }
-        }
+        },
+        vaultSyncMode?.startupDatabaseOptions
     );
     if (!replicationScheduling) {
         throw new Error("Replication scheduling was not provided during core feature composition.");
@@ -577,7 +609,7 @@ export async function main(
             : originalSettingsText;
 
         // Capture sync settings before suspendAllSync() clobbers them.
-        // Used by daemon mode to restore the correct sync behaviour after the mirror scan.
+        // Used by daemon mode to restore sync behaviour after initial replication.
         const settingsBeforeSuspend = cloneSettings(core.services.setting.currentSettings());
         const durableSettingsBeforeSuspend = cloneSettings(settingsBeforeSuspend);
         applyStoredSetting(durableSettingsBeforeSuspend, settingsAfterLoadText, "useIndexedDBAdapter");
@@ -592,7 +624,15 @@ export async function main(
         };
         await core.services.setting.suspendAllSync();
         const settingsAfterSuspend = cloneSettings(core.services.setting.currentSettings());
-        await core.services.control.onReady();
+        let readyResult = false;
+        try {
+            readyResult = await core.services.control.onReady();
+        } finally {
+            if (!readyResult) await core.services.control.onUnload();
+        }
+        if (!readyResult) {
+            throw new Error("Failed to initialise LiveSync.");
+        }
         const settingsBeforeCommand = cloneSettings(core.services.setting.currentSettings());
         const transientSettingKeys = changedSettingKeys(settingsBeforeSuspend, settingsAfterSuspend);
         for (const key of CLI_RUNTIME_ONLY_SETTING_KEYS) {

src/apps/cli/package.json

@@ -1,7 +1,7 @@
 {
     "name": "self-hosted-livesync-cli",
     "private": true,
-    "version": "1.0.24-cli",
+    "version": "1.0.29-cli",
     "main": "dist/index.cjs",
     "type": "module",
     "scripts": {
@@ -12,7 +12,7 @@
         "buildRun": "npm run build && npm run cli --",
         "build:docker": "docker build -f Dockerfile -t livesync-cli ../../..",
         "check": "tsc -p tsconfig.json",
-        "test:unit": "cd ../../.. && npx vitest run --config vitest.config.unit.ts src/apps/cli/main.unit.spec.ts src/apps/cli/settingsPersistence.unit.spec.ts src/apps/cli/commands/utils.unit.spec.ts src/apps/cli/commands/runCommand.unit.spec.ts src/apps/cli/commands/p2p.unit.spec.ts src/apps/cli/deploy/install.unit.spec.ts",
+        "test:unit": "cd ../../.. && npx vitest run --config vitest.config.unit.ts src/apps/cli/main.unit.spec.ts src/apps/cli/main.bootstrap.unit.spec.ts src/apps/cli/settingsPersistence.unit.spec.ts src/apps/cli/commands/utils.unit.spec.ts src/apps/cli/commands/runCommand.unit.spec.ts src/apps/cli/commands/daemonCommand.unit.spec.ts src/apps/cli/commands/p2p.unit.spec.ts src/apps/cli/deploy/install.unit.spec.ts src/apps/cli/adapters/NodeFileSystemAdapter.unit.spec.ts",
         "test:e2e:two-vaults": "bash test/test-e2e-two-vaults-with-docker-linux.sh",
         "test:e2e:two-vaults:common": "bash test/test-e2e-two-vaults-common.sh",
         "test:e2e:two-vaults:matrix": "bash test/test-e2e-two-vaults-matrix.sh",
@@ -37,7 +37,7 @@
     "dependencies": {
         "chokidar": "^4.0.0",
         "minimatch": "^10.2.5",
-        "octagonal-wheels": "^0.1.53",
+        "octagonal-wheels": "^0.1.54",
         "pouchdb-adapter-http": "^9.0.0",
         "pouchdb-adapter-leveldb": "^9.0.0",
         "pouchdb-core": "^9.0.0",
@@ -51,7 +51,7 @@
         "werift": "^0.24.4"
     },
     "devDependencies": {
-        "typescript": "5.9.3",
+        "typescript": "6.0.3",
         "vite": "^8.0.16",
         "vitest": "^4.1.8"
     }

src/apps/cli/test/test-helpers.sh

@@ -307,10 +307,19 @@ cli_test_wait_for_minio_bucket() {
     local delay_sec=2
     local i
     for ((i = 1; i <= retries; i++)); do
-        if docker run --rm --network host --entrypoint=/bin/sh minio/mc -c "mc alias set myminio $minio_endpoint $minio_access_key $minio_secret_key >/dev/null 2>&1 && mc ls myminio/$minio_bucket >/dev/null 2>&1"; then
+        if docker run --rm --network host --entrypoint=/bin/sh \
+            rustfs/rc:v0.1.35@sha256:adb45b56539006120f1d790bcc17ee5f9b4d93c1d7e71ed0a24f10267f9d6914 \
+            -c 'set -e
+rc alias set myminio "$1" "$2" "$3" >/dev/null 2>&1
+rc ls "myminio/$4" >/dev/null 2>&1
+' sh "$minio_endpoint" "$minio_access_key" "$minio_secret_key" "$minio_bucket"; then
             return 0
         fi
-        bucketName="$minio_bucket" bash "$CLI_DIR/util/minio-init.sh" >/dev/null 2>&1 || true
+        minioEndpoint="$minio_endpoint" \
+        accessKey="$minio_access_key" \
+        secretKey="$minio_secret_key" \
+        bucketName="$minio_bucket" \
+        bash "$CLI_DIR/util/minio-init.sh" >/dev/null 2>&1 || true
         sleep "$delay_sec"
     done
     return 1
@@ -323,26 +332,34 @@ cli_test_start_minio() {
     local minio_bucket="$4"
     local minio_init_ok=0
 
-    echo "[INFO] stopping leftover MinIO container if present"
+    echo "[INFO] stopping leftover RustFS container if present"
     cli_test_stop_minio
 
-    echo "[INFO] starting MinIO test container"
-    bucketName="$minio_bucket" bash "$CLI_DIR/util/minio-start.sh"
+    echo "[INFO] starting RustFS test container"
+    minioEndpoint="$minio_endpoint" \
+    accessKey="$minio_access_key" \
+    secretKey="$minio_secret_key" \
+    bucketName="$minio_bucket" \
+    bash "$CLI_DIR/util/minio-start.sh"
 
-    echo "[INFO] initialising MinIO test bucket: $minio_bucket"
+    echo "[INFO] initialising RustFS test bucket: $minio_bucket"
     for _ in 1 2 3 4 5; do
-        if bucketName="$minio_bucket" bash "$CLI_DIR/util/minio-init.sh"; then
+        if minioEndpoint="$minio_endpoint" \
+            accessKey="$minio_access_key" \
+            secretKey="$minio_secret_key" \
+            bucketName="$minio_bucket" \
+            bash "$CLI_DIR/util/minio-init.sh"; then
             minio_init_ok=1
             break
         fi
         sleep 2
     done
     if [[ "$minio_init_ok" != "1" ]]; then
-        echo "[FAIL] could not initialise MinIO bucket after retries: $minio_bucket" >&2
+        echo "[FAIL] could not initialise RustFS bucket after retries: $minio_bucket" >&2
         exit 1
     fi
     if ! cli_test_wait_for_minio_bucket "$minio_endpoint" "$minio_access_key" "$minio_secret_key" "$minio_bucket"; then
-        echo "[FAIL] MinIO bucket not ready: $minio_bucket" >&2
+        echo "[FAIL] RustFS bucket not ready: $minio_bucket" >&2
         exit 1
     fi
 }
@@ -359,4 +376,4 @@ display_test_info(){
 if [[ "${LIVESYNC_TEST_DOCKER:-0}" == "1" ]]; then
     # shellcheck source=/dev/null
     source "$(dirname "${BASH_SOURCE[0]}")/test-helpers-docker.sh"
-fi
+fi

src/apps/cli/testdeno/deno.json

@@ -5,6 +5,7 @@
         "test:p2p:compose": "deno run -A --no-check run-compose-p2p.ts",
         "test:local": "deno test --env-file=.test.env -A --no-check test-setup-put-cat.ts test-mirror.ts test-daemon.ts",
         "test:daemon": "deno test --env-file=.test.env -A --no-check test-daemon.ts",
+        "test:daemon-startup": "deno test --env-file=.test.env -A --no-check test-daemon-startup.ts",
         "test:decoupled-vault": "deno test --env-file=.test.env -A --no-check test-decoupled-vault.ts",
         "test:remote-commands": "deno test --env-file=.test.env -A --no-check test-remote-commands.ts",
         "test:settings-writeback": "deno test -A --no-check test-settings-writeback.ts",

src/apps/cli/testdeno/helpers/docker.ts

@@ -190,7 +190,7 @@ async function dockerOrFail(...args: string[]): Promise<string> {
 
 async function stopAndRemoveContainer(container: string): Promise<void> {
     await docker("stop", container).catch(() => {});
-    await docker("rm", container).catch(() => {});
+    await docker("rm", "-v", container).catch(() => {});
 }
 
 async function cleanupTrackedContainers(reason: string): Promise<void> {
@@ -327,8 +327,22 @@ const COUCHDB_CONTAINER = "couchdb-test";
 const COUCHDB_IMAGE = "couchdb:3.5.0";
 
 const MINIO_CONTAINER = "minio-test";
-const MINIO_IMAGE = "minio/minio";
-const MINIO_MC_IMAGE = "minio/mc";
+// RustFS provides the S3 backend for the existing MINIO test mode.
+const S3_IMAGE = "rustfs/rustfs:1.0.0-rc.6@sha256:97171b3d72cd47dc81000f92ea84de25608bfc35a94c965501afaeb5d99f6035";
+const S3_CLIENT_IMAGE = "rustfs/rc:v0.1.35@sha256:adb45b56539006120f1d790bcc17ee5f9b4d93c1d7e71ed0a24f10267f9d6914";
+const S3_BUCKET_CORS = `<CORSConfiguration>
+  <CORSRule>
+    <AllowedOrigin>*</AllowedOrigin>
+    <AllowedMethod>GET</AllowedMethod>
+    <AllowedMethod>PUT</AllowedMethod>
+    <AllowedMethod>POST</AllowedMethod>
+    <AllowedMethod>DELETE</AllowedMethod>
+    <AllowedMethod>HEAD</AllowedMethod>
+    <AllowedHeader>*</AllowedHeader>
+    <AllowedHeader>authorization</AllowedHeader>
+    <ExposeHeader>ETag</ExposeHeader>
+  </CORSRule>
+</CORSConfiguration>`;
 
 export async function stopCouchdb(): Promise<void> {
     await stopAndRemoveContainer(COUCHDB_CONTAINER);
@@ -454,7 +468,7 @@ export async function updateCouchdbDoc(
 }
 
 // ---------------------------------------------------------------------------
-// MinIO
+// S3 (RustFS)
 // ---------------------------------------------------------------------------
 
 function shQuote(value: string): string {
@@ -473,9 +487,10 @@ async function initMinioBucket(
     bucket: string
 ): Promise<boolean> {
     const cmd =
-        `mc alias set myminio ${shQuote(minioEndpoint)} ${shQuote(accessKey)} ${shQuote(secretKey)} >/dev/null 2>&1 && ` +
-        `mc mb --ignore-existing myminio/${shQuote(bucket)} >/dev/null 2>&1`;
-    const r = await docker("run", "--rm", "--network", "host", "--entrypoint", "/bin/sh", MINIO_MC_IMAGE, "-c", cmd);
+        `rc alias set myminio ${shQuote(minioEndpoint)} ${shQuote(accessKey)} ${shQuote(secretKey)} >/dev/null 2>&1 && ` +
+        `rc mb --ignore-existing myminio/${shQuote(bucket)} >/dev/null 2>&1 && ` +
+        `printf %s ${shQuote(S3_BUCKET_CORS)} | rc cors set myminio/${shQuote(bucket)} - >/dev/null 2>&1`;
+    const r = await docker("run", "--rm", "--network", "host", "--entrypoint", "/bin/sh", S3_CLIENT_IMAGE, "-c", cmd);
     return r.code === 0;
 }
 
@@ -487,8 +502,8 @@ async function waitForMinioBucket(
 ): Promise<void> {
     for (let i = 0; i < 30; i++) {
         const checkCmd =
-            `mc alias set myminio ${shQuote(minioEndpoint)} ${shQuote(accessKey)} ${shQuote(secretKey)} >/dev/null 2>&1 && ` +
-            `mc ls myminio/${shQuote(bucket)} >/dev/null 2>&1`;
+            `rc alias set myminio ${shQuote(minioEndpoint)} ${shQuote(accessKey)} ${shQuote(secretKey)} >/dev/null 2>&1 && ` +
+            `rc ls myminio/${shQuote(bucket)} >/dev/null 2>&1`;
         const check = await docker(
             "run",
             "--rm",
@@ -498,7 +513,7 @@ async function waitForMinioBucket(
             "host",
             "--entrypoint",
             "/bin/sh",
-            MINIO_MC_IMAGE,
+            S3_CLIENT_IMAGE,
             "-c",
             checkCmd
         );
@@ -508,7 +523,7 @@ async function waitForMinioBucket(
         await initMinioBucket(minioEndpoint, accessKey, secretKey, bucket);
         await sleep(2000);
     }
-    throw new Error(`MinIO bucket not ready: ${bucket}`);
+    throw new Error(`S3 bucket not ready: ${bucket}`);
 }
 
 export async function startMinio(
@@ -517,10 +532,10 @@ export async function startMinio(
     secretKey: string,
     bucket: string
 ): Promise<void> {
-    console.log("[INFO] stopping leftover MinIO container if present");
+    console.log("[INFO] stopping leftover S3 test container if present");
     await stopMinio().catch(() => {});
 
-    console.log("[INFO] starting MinIO test container");
+    console.log("[INFO] starting RustFS test container");
     await dockerOrFail(
         "run",
         "-d",
@@ -532,20 +547,19 @@ export async function startMinio(
         "-p",
         "9001:9001",
         "-e",
-        `MINIO_ROOT_USER=${accessKey}`,
+        `RUSTFS_ACCESS_KEY=${accessKey}`,
         "-e",
-        `MINIO_ROOT_PASSWORD=${secretKey}`,
+        `RUSTFS_SECRET_KEY=${secretKey}`,
         "-e",
-        `MINIO_SERVER_URL=${minioEndpoint}`,
-        MINIO_IMAGE,
-        "server",
-        "/data",
-        "--console-address",
-        ":9001"
+        "RUSTFS_CONSOLE_ENABLE=true",
+        "-e",
+        "RUSTFS_CORS_ALLOWED_ORIGINS=*",
+        S3_IMAGE,
+        "/data"
     );
     trackContainer(MINIO_CONTAINER);
 
-    console.log(`[INFO] initialising MinIO test bucket: ${bucket}`);
+    console.log(`[INFO] initialising S3 test bucket: ${bucket}`);
     let initialised = false;
     for (let i = 0; i < 5; i++) {
         if (await initMinioBucket(minioEndpoint, accessKey, secretKey, bucket)) {
@@ -555,7 +569,7 @@ export async function startMinio(
         await sleep(2000);
     }
     if (!initialised) {
-        throw new Error(`Could not initialise MinIO bucket after retries: ${bucket}`);
+        throw new Error(`Could not initialise S3 bucket after retries: ${bucket}`);
     }
 
     await waitForMinioBucket(minioEndpoint, accessKey, secretKey, bucket);

src/apps/cli/testdeno/run-ci-suite.ts

@@ -4,6 +4,7 @@ const TASKS = [
     "test:setup-put-cat",
     "test:mirror",
     "test:daemon",
+    "test:daemon-startup",
     "test:push-pull",
     "test:decoupled-vault",
     "test:sync-two-local",

src/apps/cli/testdeno/test-daemon-startup.ts

@@ -0,0 +1,152 @@
+import { assertEquals } from "@std/assert";
+import { join } from "@std/path";
+import { TempDir } from "./helpers/temp.ts";
+import { runCliOrFail, runCliWithInputOrFail } from "./helpers/cli.ts";
+import { applyCouchdbSettings, initSettingsFile } from "./helpers/settings.ts";
+import { startCliInBackground, type BackgroundCliProcess } from "./helpers/backgroundCli.ts";
+import { startCouchdb, stopCouchdb } from "./helpers/docker.ts";
+
+function envOrDefault(keys: string[], fallback: string): string {
+    for (const key of keys) {
+        const value = Deno.env.get(key)?.trim();
+        if (value) return value;
+    }
+    return fallback;
+}
+
+function waitForTick(): Promise<void> {
+    return new Promise((resolve) => setTimeout(resolve, 100));
+}
+
+async function waitForText(filePath: string, expected: string, timeoutMs = 45_000): Promise<void> {
+    const deadline = Date.now() + timeoutMs;
+    let actual = "";
+    while (Date.now() < deadline) {
+        try {
+            actual = await Deno.readTextFile(filePath);
+            if (actual === expected) return;
+        } catch (error) {
+            if (!(error instanceof Deno.errors.NotFound)) throw error;
+        }
+        await waitForTick();
+    }
+    throw new Error(
+        `Timed out waiting for ${filePath} to contain ${JSON.stringify(expected)}; actual=${JSON.stringify(actual)}`
+    );
+}
+
+async function waitForMissing(filePath: string, timeoutMs = 45_000): Promise<void> {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        try {
+            await Deno.stat(filePath);
+        } catch (error) {
+            if (error instanceof Deno.errors.NotFound) return;
+            throw error;
+        }
+        await waitForTick();
+    }
+    throw new Error(`Timed out waiting for ${filePath} to be removed`);
+}
+
+async function stopDaemon(daemon: BackgroundCliProcess | undefined): Promise<void> {
+    if (!daemon) return;
+    await daemon.stop().catch(() => {});
+}
+
+Deno.test("daemon: startup scan uploads, reconciles, and reflects CouchDB files", async () => {
+    await using workDir = await TempDir.create("livesync-cli-daemon-startup");
+
+    const couchdbUri = envOrDefault(["COUCHDB_URI", "hostname"], "http://127.0.0.1:5989").replace(/\/$/, "");
+    const couchdbUser = envOrDefault(["COUCHDB_USER", "username"], "admin");
+    const couchdbPassword = envOrDefault(["COUCHDB_PASSWORD", "password"], "testpassword");
+    const dbPrefix = envOrDefault(["COUCHDB_DBNAME", "dbname"], "livesync-test-db-ci");
+    const dbname = `${dbPrefix}-daemon-startup-${Date.now()}-${Math.floor(Math.random() * 1_000_000)}`.toLowerCase();
+
+    const databaseA = workDir.join("database-a");
+    const databaseB = workDir.join("database-b");
+    const databaseC = workDir.join("database-c");
+    const vaultA = workDir.join("vault-a");
+    const vaultB = workDir.join("vault-b");
+    const vaultC = workDir.join("vault-c");
+    const settingsA = workDir.join("settings-a.json");
+    const settingsB = workDir.join("settings-b.json");
+    const settingsC = workDir.join("settings-c.json");
+
+    await Promise.all([
+        Deno.mkdir(databaseA, { recursive: true }),
+        Deno.mkdir(databaseB, { recursive: true }),
+        Deno.mkdir(databaseC, { recursive: true }),
+        Deno.mkdir(vaultA, { recursive: true }),
+        Deno.mkdir(vaultB, { recursive: true }),
+        Deno.mkdir(vaultC, { recursive: true }),
+    ]);
+
+    const startupPath = "notes/present-before-start.md";
+    const deletePath = "notes/deleted-while-stopped.md";
+    const remoteOnlyPath = "notes/remote-only.md";
+    const startupFileA = join(vaultA, startupPath);
+    const deleteFileA = join(vaultA, deletePath);
+    const startupFileB = join(vaultB, startupPath);
+    const deleteFileB = join(vaultB, deletePath);
+    const remoteOnlyFileB = join(vaultB, remoteOnlyPath);
+
+    await Deno.mkdir(join(vaultA, "notes"), { recursive: true });
+    await Deno.writeTextFile(startupFileA, "created before daemon startup\n");
+    const initialTime = new Date(Date.now() - 10_000);
+    await Deno.utime(startupFileA, initialTime, initialTime);
+    await Deno.writeTextFile(deleteFileA, "delete this after the first run\n");
+
+    let daemonA: BackgroundCliProcess | undefined;
+    let daemonB: BackgroundCliProcess | undefined;
+    try {
+        await startCouchdb(couchdbUri, couchdbUser, couchdbPassword, dbname);
+        for (const settings of [settingsA, settingsB, settingsC]) {
+            await initSettingsFile(settings);
+            await applyCouchdbSettings(settings, couchdbUri, couchdbUser, couchdbPassword, dbname, true);
+        }
+
+        // A pre-existing local file must be uploaded by the daemon's startup scan.
+        daemonA = startCliInBackground(databaseA, "--vault", vaultA, "--settings", settingsA, "daemon");
+        await daemonA.waitUntilContains("[Daemon] Initial replication complete", 45_000);
+
+        // A separate daemon proves that the first startup replication reached CouchDB
+        // and that remote files are reflected into its filesystem.
+        daemonB = startCliInBackground(databaseB, "--vault", vaultB, "--settings", settingsB, "daemon");
+        await daemonB.waitUntilContains("[Daemon] Initial replication complete", 45_000);
+        await waitForText(startupFileB, "created before daemon startup\n");
+        await waitForText(deleteFileB, "delete this after the first run\n");
+
+        // Changes made while A is stopped must be found by its next startup scan.
+        assertEquals(await daemonA.stop(), 0, daemonA.combined);
+        daemonA = undefined;
+        await Deno.writeTextFile(startupFileA, "edited while daemon was stopped\n");
+        await Deno.remove(deleteFileA);
+
+        daemonA = startCliInBackground(databaseA, "--vault", vaultA, "--settings", settingsA, "daemon");
+        await daemonA.waitUntilContains("[Daemon] Initial replication complete", 45_000);
+        await waitForText(startupFileB, "edited while daemon was stopped\n");
+        await waitForMissing(deleteFileB);
+
+        // Seed a file into a third local database without creating it in vault C.
+        // After C's finite sync, it exists only remotely from B's point of view.
+        await runCliWithInputOrFail(
+            "created in a different local database\n",
+            databaseC,
+            "--vault",
+            vaultC,
+            "--settings",
+            settingsC,
+            "put",
+            remoteOnlyPath
+        );
+        await runCliOrFail(databaseC, "--vault", vaultC, "--settings", settingsC, "sync");
+        await waitForText(remoteOnlyFileB, "created in a different local database\n");
+        assertEquals(await Deno.readTextFile(startupFileB), "edited while daemon was stopped\n");
+        assertEquals((await Deno.stat(remoteOnlyFileB)).isFile, true);
+    } finally {
+        await stopDaemon(daemonB);
+        await stopDaemon(daemonA);
+        await stopCouchdb().catch(() => {});
+    }
+});

src/apps/cli/testdeno/test-e2e-two-vaults-couchdb.ts

@@ -60,6 +60,32 @@ export async function runScenario(remoteType: RemoteType, encrypt: boolean): Pro
     }
 
     try {
+        if (remoteType === "MINIO") {
+            // The shared S3 fixture also serves the browser and real Obsidian tests.
+            const origin = "app://obsidian.md";
+            const requestedHeaders = ["authorization", "content-type", "x-amz-date", "x-amz-content-sha256"];
+            const preflight = await fetch(`${minioEndpoint}/${minioBucket}`, {
+                method: "OPTIONS",
+                headers: {
+                    Origin: origin,
+                    "Access-Control-Request-Method": "PUT",
+                    "Access-Control-Request-Headers": requestedHeaders.join(","),
+                },
+            });
+            await preflight.body?.cancel();
+            assert(preflight.ok, "The S3 fixture must accept browser preflight requests");
+            const allowedOrigin = preflight.headers.get("access-control-allow-origin");
+            assert(allowedOrigin === "*" || allowedOrigin === origin, "The S3 fixture must allow the Obsidian origin");
+            const allowedHeaders = (preflight.headers.get("access-control-allow-headers") ?? "")
+                .toLowerCase()
+                .split(",")
+                .map((header) => header.trim());
+            assert(allowedHeaders.includes("authorization"), "S3 CORS must explicitly allow the Authorization header");
+            assert(
+                preflight.headers.get("access-control-allow-methods")?.split(/,\s*/).includes("PUT"),
+                "S3 CORS must allow browser uploads"
+            );
+        }
         await initSettingsFile(settingsA);
         await initSettingsFile(settingsB);
         await applyRemoteSyncSettings(settingsA, {

src/apps/cli/testdeno/test_dev_deno.md

@@ -99,11 +99,12 @@ This file corresponds to settings helpers in `test-helpers.sh`.
 
 ### `helpers/docker.ts`
 
-- Starts, stops, and initialises CouchDB directly from Deno.
+- Starts, stops, and initialises CouchDB and RustFS directly from Deno.
 - Configures CouchDB via `fetch + retry`.
+- Initialises S3 buckets using the RustFS `rc` client, including CORS for signed browser requests.
 - Starts and stops the P2P relay through the same Docker runner.
 
-Both CouchDB and P2P relay flows are bash-independent.
+These flows do not require Bash on the host. The S3 matrix tasks, environment variables, and container name retain their existing `minio` names for compatibility; RustFS provides the test backend. The RustFS server and `rc` client images are pinned by version and digest.
 
 ### `helpers/backgroundCli.ts`
 
@@ -328,7 +329,7 @@ The GitHub Actions workflow `.github/workflows/cli-deno-tests.yml` runs automati
 
 ## Current limitations
 
-- MinIO startup and matrix coverage are ported. Current limits are elsewhere, not setup URI generation.
+- S3 startup and matrix coverage use RustFS. Current limits are elsewhere, not setup URI generation.
 
 ---
 

src/apps/cli/util/minio-init.sh

@@ -1,47 +1,24 @@
 #!/bin/bash
 set -e
-cat >/tmp/mybucket-rw.json <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Action": ["s3:GetBucketLocation","s3:ListBucket"],
-      "Resource": ["arn:aws:s3:::$bucketName"]
-    },
-    {
-      "Effect": "Allow",
-      "Action": ["s3:GetObject","s3:PutObject","s3:DeleteObject"],
-      "Resource": ["arn:aws:s3:::$bucketName/*"]
-    }
-  ]
-}
-EOF
-# echo "<CORSConfiguration>
-#   <CORSRule>
-#     <AllowedOrigin>http://localhost:63315</AllowedOrigin>
-#     <AllowedOrigin>http://localhost:63316</AllowedOrigin>
-#     <AllowedOrigin>http://localhost</AllowedOrigin>
-#     <AllowedMethod>GET</AllowedMethod>
-#     <AllowedMethod>PUT</AllowedMethod>
-#     <AllowedMethod>POST</AllowedMethod>
-#     <AllowedMethod>DELETE</AllowedMethod>
-#     <AllowedMethod>HEAD</AllowedMethod>
-#     <AllowedHeader>*</AllowedHeader>
-#   </CORSRule>
-# </CORSConfiguration>" > /tmp/cors.xml
-# docker run --rm --network host -v /tmp/mybucket-rw.json:/tmp/mybucket-rw.json --entrypoint=/bin/sh minio/mc -c "
-#   mc alias set myminio $minioEndpoint $username $password 
-#   mc mb --ignore-existing myminio/$bucketName
-#   mc admin policy create myminio my-custom-policy /tmp/mybucket-rw.json 
-#   echo 'Creating service account for user $username with access key $accessKey'
-#   mc admin user svcacct add --access-key '$accessKey' --secret-key '$secretKey' myminio '$username' 
-#   mc admin policy attach myminio my-custom-policy --user '$accessKey'
-#   echo 'Verifying policy and user creation:'
-#   mc admin user svcacct info myminio '$accessKey'
-# "
 
-docker run --rm --network host -v /tmp/mybucket-rw.json:/tmp/mybucket-rw.json --entrypoint=/bin/sh minio/mc -c "
-  mc alias set myminio $minioEndpoint $accessKey $secretKey 
-  mc mb --ignore-existing myminio/$bucketName
-"
+docker run --rm --network host --entrypoint=/bin/sh \
+  rustfs/rc:v0.1.35@sha256:adb45b56539006120f1d790bcc17ee5f9b4d93c1d7e71ed0a24f10267f9d6914 \
+  -c 'set -e
+rc alias set myminio "$1" "$2" "$3"
+rc mb --ignore-existing "myminio/$4"
+rc cors set "myminio/$4" - <<CORS
+<CORSConfiguration>
+  <CORSRule>
+    <AllowedOrigin>*</AllowedOrigin>
+    <AllowedMethod>GET</AllowedMethod>
+    <AllowedMethod>PUT</AllowedMethod>
+    <AllowedMethod>POST</AllowedMethod>
+    <AllowedMethod>DELETE</AllowedMethod>
+    <AllowedMethod>HEAD</AllowedMethod>
+    <AllowedHeader>*</AllowedHeader>
+    <AllowedHeader>authorization</AllowedHeader>
+    <ExposeHeader>ETag</ExposeHeader>
+  </CORSRule>
+</CORSConfiguration>
+CORS
+' sh "$minioEndpoint" "$accessKey" "$secretKey" "$bucketName"

src/apps/cli/util/minio-start.sh

@@ -1,2 +1,8 @@
 #!/bin/bash
-docker run -d --name minio-test -p 9000:9000 -p 9001:9001 -e MINIO_ROOT_USER=$accessKey -e MINIO_ROOT_PASSWORD=$secretKey -e MINIO_SERVER_URL=$minioEndpoint minio/minio server /data --console-address ':9001'
+docker run -d --name minio-test \
+  -p 9000:9000 -p 9001:9001 \
+  -e "RUSTFS_ACCESS_KEY=$accessKey" \
+  -e "RUSTFS_SECRET_KEY=$secretKey" \
+  -e "RUSTFS_CONSOLE_ENABLE=true" \
+  -e 'RUSTFS_CORS_ALLOWED_ORIGINS=*' \
+  rustfs/rustfs:1.0.0-rc.6@sha256:97171b3d72cd47dc81000f92ea84de25608bfc35a94c965501afaeb5d99f6035 /data

src/apps/cli/util/minio-stop.sh

@@ -1,3 +1,3 @@
 #!/bin/bash
 docker stop minio-test
-docker rm minio-test
+docker rm -v minio-test

src/apps/webapp/WebAppRuntime.ts

@@ -1,3 +1,4 @@
+import { useP2PSettingsPreparation } from "@/serviceFeatures/useP2PSettingsPreparation";
 /** Browser runtime for Self-hosted LiveSync over the File System Access API. */
 
 import { LiveSyncBaseCore } from "@/LiveSyncBaseCore";
@@ -217,7 +218,9 @@ export class WebAppRuntime {
                 useRedFlagFeatures(core);
                 useCheckRemoteSize(core);
                 useRemoteConfiguration(core);
-                this.p2p = useP2PReplicatorFeature(core);
+                this.p2p = useP2PReplicatorFeature(core, undefined, undefined, {
+                    prepareP2PSettings: useP2PSettingsPreparation(core.services.API.webCompatFetch.bind(core.services.API)),
+                });
                 this.paneHost = {
                     services: core.services,
                     p2p: this.p2p,

src/apps/webapp/package.json

@@ -1,7 +1,7 @@
 {
     "name": "livesync-webapp",
     "private": true,
-    "version": "1.0.24-webapp",
+    "version": "1.0.29-webapp",
     "type": "module",
     "description": "Browser-based Self-hosted LiveSync using FileSystem API",
     "scripts": {
@@ -15,12 +15,12 @@
         "test:browser": "deno test -A --no-check --frozen --config ../../../test/browser-apps/deno.json --lock ../../../test/browser-apps/deno.lock ../../../test/browser-apps/webapp/browser-smoke.test.ts"
     },
     "dependencies": {
-        "octagonal-wheels": "^0.1.53"
+        "octagonal-wheels": "^0.1.54"
     },
     "devDependencies": {
         "@sveltejs/vite-plugin-svelte": "^7.1.2",
         "svelte": "5.56.3",
-        "typescript": "5.9.3",
+        "typescript": "6.0.3",
         "vite": "^8.0.16"
     }
 }

src/apps/webpeer/package.json

@@ -1,7 +1,7 @@
 {
     "name": "webpeer",
     "private": true,
-    "version": "1.0.24-webpeer",
+    "version": "1.0.29-webpeer",
     "type": "module",
     "scripts": {
         "dev": "vite",
@@ -15,7 +15,7 @@
         "test:browser": "deno test -A --no-check --frozen --config ../../../test/browser-apps/deno.json --lock ../../../test/browser-apps/deno.lock ../../../test/browser-apps/webpeer/browser-smoke.test.ts"
     },
     "dependencies": {
-        "octagonal-wheels": "^0.1.53"
+        "octagonal-wheels": "^0.1.54"
     },
     "devDependencies": {
         "eslint-plugin-svelte": "^3.19.0",
@@ -23,7 +23,7 @@
         "@tsconfig/svelte": "^5.0.8",
         "svelte": "5.56.3",
         "svelte-check": "^4.6.0",
-        "typescript": "5.9.3",
+        "typescript": "6.0.3",
         "vite": "^8.0.16"
     }
 }

src/apps/webpeer/src/WebPeerRuntime.ts

@@ -1,3 +1,4 @@
+import { useP2PSettingsPreparation } from "@/serviceFeatures/useP2PSettingsPreparation";
 import { type P2PSyncSetting, SETTING_KEY_P2P_DEVICE_NAME } from "@vrtmrz/livesync-commonlib/compat/common/types";
 import { compatGlobal } from "@vrtmrz/livesync-commonlib/compat/common/coreEnvFunctions";
 import { EVENT_LAYOUT_READY } from "@vrtmrz/livesync-commonlib/compat/events/coreEvents";
@@ -70,9 +71,8 @@ export class WebPeerRuntime {
                 isScheduled: () => this.restartScheduled,
             },
         });
-        this.p2p = useP2PReplicatorFeature({
-            services: this.services,
-            serviceModules: {},
+        this.p2p = useP2PReplicatorFeature({ services: this.services, serviceModules: {} }, undefined, undefined, {
+            prepareP2PSettings: useP2PSettingsPreparation(this.services.API.webCompatFetch.bind(this.services.API)),
         });
         this.p2pLogCollector = new P2PLogCollector(this.events);
         this.paneHost = {

src/common/messages/LiveSyncProvisionalMessages.ts

@@ -7,6 +7,26 @@
  * remove it from this map in the same change.
  */
 export const liveSyncProvisionalEnglishMessages = {
+    "Configure TURN when a direct connection cannot be established or when you select TURN relay only.":
+        "Configure TURN when a direct connection cannot be established or when you select TURN relay only.",
+    "TURN configuration": "TURN configuration",
+    Manual: "Manual",
+    "Managed (Cloudflare)": "Managed (Cloudflare)",
+    "TURN Key ID": "TURN Key ID",
+    "TURN Key API Token": "TURN Key API Token",
+    "Unsupported TURN configuration": "Unsupported TURN configuration",
+    "The API token is saved with this profile and included in Setup URI and QR code sharing. Temporary TURN credentials are kept in memory only.":
+        "The API token is saved with this profile and included in Setup URI and QR code sharing. Temporary TURN credentials are kept in memory only.",
+    "TURN relay only requires a TURN server or a configured credential source under Advanced Settings.":
+        "TURN relay only requires a TURN server or a configured credential source under Advanced Settings.",
+    "TURN relay only requires TURN configuration. Connection path has been restored to Automatic.":
+        "TURN relay only requires TURN configuration. Connection path has been restored to Automatic.",
+    "Enter a TURN Key ID.": "Enter a TURN Key ID.",
+    "TURN Key ID contains unsupported characters.": "TURN Key ID contains unsupported characters.",
+    "Enter a TURN Key API Token.": "Enter a TURN Key API Token.",
+    "TURN Key API Token must use Bearer token syntax.": "TURN Key API Token must use Bearer token syntax.",
+    "The selected TURN configuration is not supported.": "The selected TURN configuration is not supported.",
+
     "Setup Complete: Preparing to Fetch from Another Device": "Setup Complete: Preparing to Fetch from Another Device",
     "The P2P connection has been configured successfully. The initial synchronisation data must now be fetched from an online source device.":
         "The P2P connection has been configured successfully. The initial synchronisation data must now be fetched from an online source device.",
@@ -28,8 +48,8 @@ export const liveSyncProvisionalEnglishMessages = {
         "The project's public signalling relay is a best-effort convenience operated by the project author. It does not store Vault contents, but signalling metadata may be visible to the relay. Availability and log retention are not guaranteed. You can replace it with your own Nostr-compatible relay.",
     "Learn more about P2P connections": "Learn more about P2P connections",
     "Learn more about signalling and TURN": "Learn more about signalling and TURN",
-    "TURN relays the encrypted WebRTC connection only when a direct path cannot be established. A TURN provider cannot read encrypted Vault contents, but it can observe connection metadata and traffic volume. Use a provider you trust.":
-        "TURN relays the encrypted WebRTC connection only when a direct path cannot be established. A TURN provider cannot read encrypted Vault contents, but it can observe connection metadata and traffic volume. Use a provider you trust.",
+    "WebRTC encrypts data between your devices, including when it passes through TURN. The TURN provider cannot read the transferred data. It can see network addresses and traffic volume.":
+        "WebRTC encrypts data between your devices, including when it passes through TURN. The TURN provider cannot read the transferred data. It can see network addresses and traffic volume.",
     "Connection compatibility": "Connection compatibility",
     "P2P message size": "P2P message size",
     Standard: "Standard",

src/common/messages/combinedMessages.prod.ts

@@ -4212,6 +4212,9 @@ export const allMessages: Readonly<Record<string, Readonly<Record<string, string
         zh: "等待就绪...",
         "zh-tw": "正在等待就緒⋯",
     },
+    "moduleLog.pathComponentTooLong": {
+        def: "This path contains a file or folder name longer than ${maxBytes} UTF-8 bytes. It may not work on some Android and Linux file systems.",
+    },
     "moduleLog.showLog": {
         def: "Show Log",
         es: "Mostrar registro",
@@ -10414,6 +10417,9 @@ export const allMessages: Readonly<Record<string, Readonly<Record<string, string
         zh: "Use Remote Configuration",
         "zh-tw": "使用遠端設定",
     },
+    "Ui.Common.LocalDatabaseInitialisationFailed": {
+        def: "Self-hosted LiveSync cannot synchronise. Generate a report to review the detailed log.",
+    },
     "Ui.Common.Signal.Caution": {
         def: "CAUTION",
         es: "PRECAUCIÓN",
@@ -10442,6 +10448,9 @@ export const allMessages: Readonly<Record<string, Readonly<Record<string, string
         zh: "警告",
         "zh-tw": "警告",
     },
+    "Ui.Common.SomeFilesCouldNotBeSynchronised": {
+        def: "Not all files could be synchronised. Check the affected files. Generate a report to review the detailed log.",
+    },
     "Ui.Settings.Advanced.LocalDatabaseTweak": {
         def: "Local Database Tweak",
         es: "Ajuste fino de la base de datos local",

src/common/messagesJson/en.json

@@ -483,6 +483,7 @@
     "moduleLiveSyncMain.optionResumeAndRestart": "Resume and restart Obsidian",
     "moduleLiveSyncMain.titleScramEnabled": "Scram Enabled",
     "moduleLocalDatabase.logWaitingForReady": "Waiting for ready...",
+    "moduleLog.pathComponentTooLong": "This path contains a file or folder name longer than ${maxBytes} UTF-8 bytes. It may not work on some Android and Linux file systems.",
     "moduleLog.showLog": "Show Log",
     "moduleMigration.fix0256.buttons.checkItLater": "Check it later",
     "moduleMigration.fix0256.buttons.DismissForever": "I have fixed it, and do not ask again",
@@ -1142,10 +1143,12 @@
     "TweakMismatchResolve.Title.AutoAcceptCompatible": "Auto-Accept Available",
     "TweakMismatchResolve.Title.TweakResolving": "Configuration Mismatch Detected",
     "TweakMismatchResolve.Title.UseRemoteConfig": "Use Remote Configuration",
+    "Ui.Common.LocalDatabaseInitialisationFailed": "Self-hosted LiveSync cannot synchronise. Generate a report to review the detailed log.",
     "Ui.Common.Signal.Caution": "CAUTION",
     "Ui.Common.Signal.Danger": "DANGER",
     "Ui.Common.Signal.Notice": "NOTICE",
     "Ui.Common.Signal.Warning": "WARNING",
+    "Ui.Common.SomeFilesCouldNotBeSynchronised": "Not all files could be synchronised. Check the affected files. Generate a report to review the detailed log.",
     "Ui.Settings.Advanced.LocalDatabaseTweak": "Local Database Tweak",
     "Ui.Settings.Advanced.MemoryCache": "Memory Cache",
     "Ui.Settings.Advanced.TransferTweak": "Transfer Tweak",

src/common/messagesYAML/en.yaml

@@ -732,6 +732,9 @@ moduleLiveSyncMain:
 moduleLocalDatabase:
     logWaitingForReady: Waiting for ready...
 moduleLog:
+    pathComponentTooLong: >-
+        This path contains a file or folder name longer than ${maxBytes} UTF-8
+        bytes. It may not work on some Android and Linux file systems.
     showLog: Show Log
 moduleMigration:
     fix0256:
@@ -2126,6 +2129,8 @@ xxhash64 (Fastest): xxhash64 (Fastest)
 "This feature enables direct synchronisation between devices. No server is required, but both devices must be online at the same time for synchronisation to occur, and some features may be limited. Internet connection is only required to signalling (detecting peers) and not for data transfer.": "This feature enables direct synchronisation between devices. No server is required, but both devices must be online at the same time for synchronisation to occur, and some features may be limited. Internet connection is only required to signalling (detecting peers) and not for data transfer."
 Ui:
     Common:
+        LocalDatabaseInitialisationFailed: Self-hosted LiveSync cannot synchronise. Generate a report to review the detailed log.
+        SomeFilesCouldNotBeSynchronised: Not all files could be synchronised. Check the affected files. Generate a report to review the detailed log.
         Signal:
             Caution: CAUTION
             Danger: DANGER

src/common/pathCompatibility.ts

@@ -0,0 +1,26 @@
+export const ANDROID_LINUX_PATH_COMPONENT_UTF8_WARNING_BOUNDARY = 255;
+
+export interface OversizedPathComponent {
+    component: string;
+    utf8Bytes: number;
+}
+
+const utf8Encoder = new TextEncoder();
+
+/**
+ * Return path components which exceed the conservative Android/Linux
+ * compatibility boundary.
+ *
+ * Obsidian paths use forward slashes. The limit applies to each file or
+ * folder name, not to the combined Vault-relative path.
+ */
+export function findPathComponentsExceedingUtf8Limit(
+    path: string,
+    maxBytes: number = ANDROID_LINUX_PATH_COMPONENT_UTF8_WARNING_BOUNDARY
+): OversizedPathComponent[] {
+    return path
+        .split("/")
+        .filter((component) => component.length > 0)
+        .map((component) => ({ component, utf8Bytes: utf8Encoder.encode(component).byteLength }))
+        .filter(({ utf8Bytes }) => utf8Bytes > maxBytes);
+}

src/common/pathCompatibility.unit.spec.ts

@@ -0,0 +1,46 @@
+import { describe, expect, it } from "vitest";
+import {
+    ANDROID_LINUX_PATH_COMPONENT_UTF8_WARNING_BOUNDARY,
+    findPathComponentsExceedingUtf8Limit,
+} from "./pathCompatibility.ts";
+
+describe("findPathComponentsExceedingUtf8Limit", () => {
+    it("accepts 255 UTF-8 bytes and reports 256 UTF-8 bytes", () => {
+        expect(findPathComponentsExceedingUtf8Limit("a".repeat(255))).toEqual([]);
+        expect(findPathComponentsExceedingUtf8Limit("a".repeat(256))).toEqual([
+            {
+                component: "a".repeat(256),
+                utf8Bytes: 256,
+            },
+        ]);
+    });
+
+    it("counts UTF-8 bytes rather than JavaScript characters", () => {
+        expect(findPathComponentsExceedingUtf8Limit("界".repeat(85))).toEqual([]);
+        expect(findPathComponentsExceedingUtf8Limit(`${"界".repeat(85)}a`)).toEqual([
+            {
+                component: `${"界".repeat(85)}a`,
+                utf8Bytes: 256,
+            },
+        ]);
+    });
+
+    it("does not apply the component limit to the whole path", () => {
+        const path = `${"a".repeat(200)}/${"b".repeat(200)}`;
+
+        expect(new TextEncoder().encode(path).byteLength).toBeGreaterThan(
+            ANDROID_LINUX_PATH_COMPONENT_UTF8_WARNING_BOUNDARY
+        );
+        expect(findPathComponentsExceedingUtf8Limit(path)).toEqual([]);
+    });
+
+    it("reports an oversized folder component as well as an oversized file name", () => {
+        const folder = "界".repeat(86);
+        const file = `${"b".repeat(256)}.md`;
+
+        expect(findPathComponentsExceedingUtf8Limit(`parent/${folder}/${file}`)).toEqual([
+            { component: folder, utf8Bytes: 258 },
+            { component: file, utf8Bytes: 259 },
+        ]);
+    });
+});

src/common/reportTool.ts

@@ -1,3 +1,4 @@
+import { redactTurnSettingsForReport } from "./turnSettingsPrivacy";
 import { REMOTE_COUCHDB, REMOTE_MINIO } from "@vrtmrz/livesync-commonlib/compat/common/models/setting.const";
 import { DEFAULT_SETTINGS, type ObsidianLiveSyncSettings } from "@vrtmrz/livesync-commonlib/settings";
 import { generateCredentialObject } from "@vrtmrz/livesync-commonlib/compat/replication/httplib";
@@ -67,6 +68,7 @@ export async function generateReport(settings: ObsidianLiveSyncSettings, core: L
         delete pluginConfig[key as keyof ObsidianLiveSyncSettings];
     }
 
+    redactTurnSettingsForReport(pluginConfig);
     pluginConfig.couchDB_DBNAME = REDACTED;
     pluginConfig.couchDB_PASSWORD = REDACTED;
     const scheme = pluginConfig.couchDB_URI.startsWith("http:")

src/common/reportTool.unit.spec.ts

@@ -0,0 +1,41 @@
+import { describe, expect, it, vi } from "vitest";
+import { DEFAULT_SETTINGS } from "@vrtmrz/livesync-commonlib/settings";
+import { REMOTE_P2P } from "@vrtmrz/livesync-commonlib/compat/common/types";
+import type { LiveSyncBaseCore } from "@/LiveSyncBaseCore";
+import { generateReport } from "./reportTool";
+
+vi.mock("./utils", () => ({ requestToCouchDBWithCredentials: vi.fn() }));
+vi.mock("@vrtmrz/livesync-commonlib/compat/common/coreEnvFunctions", () => ({
+    compatGlobal: { origin: "test", navigator: { userAgent: "test" } },
+}));
+
+describe("TURN credentials in diagnostic reports", () => {
+    it("redacts provider tokens in all profiles and runtime credentials", async () => {
+        const token = "private+token/with=symbols";
+        const provider = { P2P_managedType: "CF", P2P_managedId: "private-key", P2P_managedToken: token };
+        const settings = {
+            ...DEFAULT_SETTINGS,
+            remoteType: REMOTE_P2P,
+            ...provider,
+            P2P_iceServers: [{ urls: "turn:example.test", username: "issued-user", credential: "issued-password" }],
+            P2P_iceServersExpiresAt: 123456789,
+            remoteConfigurations: {
+                inactive: {
+                    id: "inactive",
+                    name: "Inactive TURN",
+                    isEncrypted: false,
+                    uri: `sls+p2p://room?managedType=CF&managedId=private-key&token=${encodeURIComponent(token)}`,
+                },
+            },
+        };
+        const core = { services: { vault: { isStorageInsensitive: () => false } } } as unknown as LiveSyncBaseCore;
+        const report = await generateReport(settings, core);
+        const text = JSON.stringify(report);
+        expect(text).not.toContain(token);
+        expect(text).not.toContain(encodeURIComponent(token));
+        expect(text).not.toContain("private-key");
+        expect(report.pluginConfig.remoteConfigurations.inactive.uri).toBe("sls+p2p://");
+        expect(settings.P2P_managedToken).toBe(token);
+        expect(text).not.toMatch(/issued-user|issued-password|P2P_iceServers/);
+    });
+});

src/common/translation.unit.spec.ts

@@ -21,6 +21,23 @@ describe("LiveSync-owned translation catalogue", () => {
         expect($msg("moduleCheckRemoteSize.optionIncreaseLimit", { newMax: "800" }, "def")).toBe("increase to 800MB");
     });
 
+    it("keeps the active-file path compatibility warning concise", () => {
+        const oversizedComponent = `${"界".repeat(86)} (258 bytes)`;
+
+        expect(
+            $msg(
+                "moduleLog.pathComponentTooLong",
+                {
+                    maxBytes: "255",
+                    components: oversizedComponent,
+                },
+                "def"
+            )
+        ).toBe(
+            "This path contains a file or folder name longer than 255 UTF-8 bytes. It may not work on some Android and Linux file systems."
+        );
+    });
+
     it("uses Commonlib's canonical English when the application catalogue has no translation", () => {
         setLang("es");
 

src/common/turnSettingsPrivacy.ts

@@ -0,0 +1,63 @@
+import {
+    hasManagedP2PTurnConfiguration,
+    type ObsidianLiveSyncSettings,
+} from "@vrtmrz/livesync-commonlib/compat/common/types";
+import { pickP2PSyncSettings } from "@vrtmrz/livesync-commonlib/compat/common/utils";
+import { CLOUDFLARE_TURN_TYPE } from "@/integrations/cloudflare/settings";
+
+/** Include inactive profiles when deciding whether Markdown would disclose provider settings. */
+export function hasManagedTurnSettings(settings: Partial<ObsidianLiveSyncSettings>): boolean {
+    return (
+        hasManagedP2PTurnConfiguration(settings) ||
+        Object.values(settings.remoteConfigurations ?? {}).some(({ uri }) => {
+            if (!uri.startsWith("sls+p2p://")) return false;
+            const queryStart = uri.indexOf("?");
+            return (
+                queryStart >= 0 && new URLSearchParams(uri.slice(queryStart + 1).split("#", 1)[0]).has("managedType")
+            );
+        })
+    );
+}
+
+/** Reports retain a recognised provider label and omit issued credentials. */
+export function redactTurnSettingsForReport(settings: Partial<ObsidianLiveSyncSettings>): void {
+    if (settings.P2P_managedType) {
+        settings.P2P_managedType =
+            settings.P2P_managedType === CLOUDFLARE_TURN_TYPE ? CLOUDFLARE_TURN_TYPE : "redacted";
+    }
+    if (settings.P2P_managedId !== undefined) settings.P2P_managedId = "redacted";
+    if (settings.P2P_managedToken !== undefined) settings.P2P_managedToken = "redacted";
+    delete settings.P2P_iceServers;
+    delete settings.P2P_iceServersExpiresAt;
+}
+
+/** Managed connection profiles are shared through Setup URIs and QR codes. */
+export function omitManagedTurnProfilesFromMarkdown(settings: Partial<ObsidianLiveSyncSettings>): void {
+    delete settings.P2P_iceServers;
+    delete settings.P2P_iceServersExpiresAt;
+    if (!hasManagedTurnSettings(settings)) return;
+    delete settings.P2P_managedType;
+    delete settings.P2P_managedId;
+    delete settings.P2P_managedToken;
+    delete settings.remoteConfigurations;
+    delete settings.activeConfigurationId;
+    delete settings.P2P_ActiveRemoteConfigurationId;
+}
+
+/** Preserve the complete connection when Markdown omits its profile group. */
+export function preserveManagedTurnProfilesOnMarkdownImport(
+    incoming: Partial<ObsidianLiveSyncSettings>,
+    current: ObsidianLiveSyncSettings,
+    merged: ObsidianLiveSyncSettings
+): void {
+    if (
+        !hasManagedTurnSettings(current) ||
+        incoming.remoteConfigurations !== undefined ||
+        incoming.P2P_managedType !== undefined
+    )
+        return;
+    merged.remoteConfigurations = structuredClone(current.remoteConfigurations);
+    merged.activeConfigurationId = current.activeConfigurationId;
+    merged.P2P_ActiveRemoteConfigurationId = current.P2P_ActiveRemoteConfigurationId;
+    Object.assign(merged, pickP2PSyncSettings(current));
+}

src/common/turnSettingsPrivacy.unit.spec.ts

@@ -0,0 +1,139 @@
+import { describe, expect, it } from "vitest";
+import {
+    DEFAULT_SETTINGS,
+    REMOTE_P2P,
+    type ObsidianLiveSyncSettings,
+} from "@vrtmrz/livesync-commonlib/compat/common/types";
+import {
+    SettingService,
+    type SettingServiceDependencies,
+} from "@vrtmrz/livesync-commonlib/compat/services/base/SettingService";
+import { ServiceContext } from "@vrtmrz/livesync-commonlib/compat/services/base/ServiceBase";
+import { ConnectionStringParser } from "@vrtmrz/livesync-commonlib/compat/common/ConnectionString";
+import {
+    hasManagedTurnSettings,
+    omitManagedTurnProfilesFromMarkdown,
+    preserveManagedTurnProfilesOnMarkdownImport,
+    redactTurnSettingsForReport,
+} from "./turnSettingsPrivacy";
+
+class MemorySettingService extends SettingService {
+    readonly items = new Map<string, string>();
+    saved?: ObsidianLiveSyncSettings;
+    protected setItem(key: string, value: string) {
+        this.items.set(key, value);
+    }
+    protected getItem(key: string) {
+        return this.items.get(key) ?? "";
+    }
+    protected deleteItem(key: string) {
+        this.items.delete(key);
+    }
+    protected saveData(settings: ObsidianLiveSyncSettings) {
+        this.saved = structuredClone(settings);
+        return Promise.resolve();
+    }
+    protected loadData() {
+        return Promise.resolve(this.saved);
+    }
+}
+
+function configuredSettings() {
+    return {
+        ...DEFAULT_SETTINGS,
+        P2P_managedType: "CF",
+        P2P_managedId: "private-key-id",
+        P2P_managedToken: "private-token",
+        remoteConfigurations: {
+            managed: {
+                id: "managed",
+                name: "Managed TURN",
+                isEncrypted: false,
+                uri: "sls+p2p://room?managedType=CF&managedId=private-key-id&token=private-token",
+            },
+        },
+        activeConfigurationId: "central",
+        P2P_ActiveRemoteConfigurationId: "managed",
+    };
+}
+
+describe("managed TURN settings privacy", () => {
+    it("preserves the active managed room through Markdown import, save, and reload", async () => {
+        const current = {
+            ...configuredSettings(),
+            remoteType: REMOTE_P2P,
+            activeConfigurationId: "managed",
+            P2P_roomID: "local-room",
+            P2P_relays: "wss://local-relay.example.test",
+            P2P_passphrase: "local-passphrase",
+        };
+        const originalURI = ConnectionStringParser.serialize({ type: "p2p", settings: current });
+        current.remoteConfigurations.managed.uri = originalURI;
+        const service = new MemorySettingService(new ServiceContext(), {
+            APIService: {
+                getSystemVaultName: () => "test-vault",
+                getAppID: () => "test-app",
+                addLog: () => undefined,
+                confirm: { askString: async () => "" },
+            } as unknown as SettingServiceDependencies["APIService"],
+        });
+        service.settings = structuredClone(current);
+        const incoming: Partial<ObsidianLiveSyncSettings> = {
+            P2P_roomID: "imported-room",
+            P2P_relays: "wss://imported-relay.example.test",
+            P2P_passphrase: "imported-passphrase",
+        };
+        const merged = { ...structuredClone(DEFAULT_SETTINGS), ...incoming };
+        preserveManagedTurnProfilesOnMarkdownImport(incoming, current, merged);
+        await service.applyExternalSettings(merged, true);
+        const saved = service.saved!.remoteConfigurations.managed;
+        const uri = saved.isEncrypted ? await service.decryptConfigurationItem(saved.uri, "*") : saved.uri;
+        expect(uri).toBe(originalURI);
+        expect(service.settings.P2P_roomID).toBe("local-room");
+        await service.loadSettings();
+        expect(service.settings.P2P_roomID).toBe("local-room");
+    });
+
+    it("redacts provider fields and issued credentials, including unknown integrations", () => {
+        const settings = configuredSettings();
+        settings.P2P_managedType = "private-token";
+        redactTurnSettingsForReport(settings);
+        expect([settings.P2P_managedType, settings.P2P_managedId, settings.P2P_managedToken]).toEqual([
+            "redacted",
+            "redacted",
+            "redacted",
+        ]);
+    });
+
+    it("omits the whole managed profile group from Markdown, including inactive sources", () => {
+        const settings = configuredSettings();
+        settings.P2P_managedType = "";
+        expect(hasManagedTurnSettings(settings)).toBe(true);
+        omitManagedTurnProfilesFromMarkdown(settings);
+        expect(JSON.stringify(settings)).not.toMatch(/private-token|private-key-id|sls\+p2p/);
+        expect(settings).not.toHaveProperty("remoteConfigurations");
+        expect(settings).not.toHaveProperty("activeConfigurationId");
+        expect(settings).not.toHaveProperty("P2P_ActiveRemoteConfigurationId");
+    });
+
+    it("preserves existing profiles and both selections when Markdown omits the group", () => {
+        const current = configuredSettings();
+        const incoming = { ...DEFAULT_SETTINGS };
+        delete (incoming as Partial<typeof incoming>).remoteConfigurations;
+        delete (incoming as Partial<typeof incoming>).P2P_managedType;
+        const merged = { ...DEFAULT_SETTINGS, ...incoming };
+        preserveManagedTurnProfilesOnMarkdownImport(incoming, current, merged);
+        expect(merged.remoteConfigurations).toEqual(current.remoteConfigurations);
+        expect(merged.remoteConfigurations).not.toBe(current.remoteConfigurations);
+        expect(merged.P2P_managedToken).toEqual(current.P2P_managedToken);
+        expect(merged.activeConfigurationId).toBe("central");
+        expect(merged.P2P_ActiveRemoteConfigurationId).toBe("managed");
+    });
+
+    it("retains the manual-only Markdown contract", () => {
+        const settings = { ...DEFAULT_SETTINGS };
+        const before = structuredClone(settings);
+        omitManagedTurnProfilesFromMarkdown(settings);
+        expect(settings).toEqual(before);
+    });
+});

src/features/P2PSync/TurnConfiguration.svelte

@@ -0,0 +1,69 @@
+<script lang="ts">
+    import type { P2PConnectionInfo } from "@vrtmrz/livesync-commonlib/compat/common/types";
+    import { CLOUDFLARE_TURN_TYPE } from "@/integrations/cloudflare/settings";
+    import { validateManagedTurnSettings } from "@/integrations/turnSettings";
+    import { translateLiveSyncMessage as translate, translateIfAvailable } from "@/common/translation";
+
+    type TurnSettings = Pick<P2PConnectionInfo, "P2P_turnServers" | "P2P_turnUsername" | "P2P_turnCredential" | "P2P_managedType" | "P2P_managedId" | "P2P_managedToken">;
+    let { settings = $bindable() }: { settings: TurnSettings } = $props();
+    const managedType = $derived(settings.P2P_managedType ?? "");
+    const error = $derived(validateManagedTurnSettings(settings));
+
+    function selectProvider(type: string) {
+        settings.P2P_managedType = type || undefined;
+        settings.P2P_managedId = type ? "" : undefined;
+        settings.P2P_managedToken = type ? "" : undefined;
+    }
+</script>
+
+<div class="turn-configuration">
+    <label>
+        <span>{translate("TURN configuration")}</span>
+        <select aria-label={translate("TURN configuration")} name="p2p-turn-source" value={managedType} onchange={(event) => selectProvider(event.currentTarget.value)}>
+            <option value="">{translate("Manual")}</option>
+            <option value={CLOUDFLARE_TURN_TYPE}>{translate("Managed (Cloudflare)")}</option>
+            {#if managedType !== "" && managedType !== CLOUDFLARE_TURN_TYPE}
+                <option value={managedType} disabled>{translate("Unsupported TURN configuration")}</option>
+            {/if}
+        </select>
+    </label>
+    {#if managedType === ""}
+        <label>
+            <span>{translate("TURN Server URLs (comma-separated)")}</span>
+            <textarea name="p2p-turn-servers" rows="3" placeholder="turn:turn.example.com:3478"
+                bind:value={settings.P2P_turnServers} autocapitalize="off" spellcheck="false"></textarea>
+        </label>
+        <label>
+            <span>{translate("TURN Username")}</span>
+            <input type="text" name="p2p-turn-username" placeholder={translate("Enter TURN username")} bind:value={settings.P2P_turnUsername}
+                autocomplete="off" autocapitalize="off" spellcheck="false" />
+        </label>
+        <label>
+            <span>{translate("TURN Credential")}</span>
+            <input type="password" name="p2p-turn-credential" placeholder={translate("Enter TURN credential")} bind:value={settings.P2P_turnCredential}
+                autocomplete="new-password" />
+        </label>
+    {:else if managedType === CLOUDFLARE_TURN_TYPE}
+        <label>
+            <span>{translate("TURN Key ID")}</span>
+            <input type="text" name="p2p-turn-turnKeyId" bind:value={settings.P2P_managedId}
+                autocomplete="off" autocapitalize="off" spellcheck="false" />
+        </label>
+        <label>
+            <span>{translate("TURN Key API Token")}</span>
+            <input type="password" name="p2p-turn-apiToken" bind:value={settings.P2P_managedToken}
+                autocomplete="new-password" autocapitalize="off" spellcheck="false" />
+        </label>
+        <p>{translate("The API token is saved with this profile and included in Setup URI and QR code sharing. Temporary TURN credentials are kept in memory only.")}</p>
+    {/if}
+    {#if error}
+        <p role="status" class="turn-error">{translateIfAvailable(error)}</p>
+    {/if}
+</div>
+
+<style>
+    label { display: grid; gap: 0.25rem; margin: 0.75rem 0; }
+    input, textarea, select { box-sizing: border-box; width: 100%; }
+    p { font-size: var(--font-ui-small, 0.9rem); }
+    .turn-error { color: var(--text-error, #b33); }
+</style>

src/integrations/cloudflare/settings.ts

@@ -0,0 +1,49 @@
+/** The provider identifier persisted in a P2P profile for Cloudflare TURN. */
+export const CLOUDFLARE_TURN_TYPE = "CF" as const;
+
+/** The lifetime requested from Cloudflare for each issued credential set. */
+export const CLOUDFLARE_TURN_CREDENTIAL_TTL_SECONDS = 86_400 as const;
+
+/** The Cloudflare TURN credential-generation endpoint. */
+export const CLOUDFLARE_TURN_CREDENTIAL_ENDPOINT = "https://rtc.live.cloudflare.com/v1/turn/keys" as const;
+
+/** A Cloudflare TURN configuration. */
+export interface CloudflareTurnConfiguration {
+    readonly turnKeyId: string;
+    readonly apiToken: string;
+}
+
+// TURN Key IDs are inserted into one fixed URL path. Keep the accepted set
+// deliberately narrower than URI escaping so a configuration cannot alter
+// the request path or add a query string.
+const TURN_KEY_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._~-]{0,255}$/;
+
+// RFC 6750's b64token grammar, including optional trailing padding. This
+// also excludes whitespace and control characters from the Authorization
+// header without exposing the token in a validation message.
+const BEARER_TOKEN_PATTERN = /^[A-Za-z0-9._~+/-]+={0,2}$/;
+const MAX_BEARER_TOKEN_LENGTH = 4_096;
+
+/**
+ * Returns a safe validation message for a Cloudflare TURN configuration.
+ * The result never includes the supplied Key ID or API token.
+ */
+export function validateCloudflareTurnConfiguration(value: CloudflareTurnConfiguration): string | undefined {
+    const turnKeyId = value.turnKeyId;
+    if (typeof turnKeyId !== "string" || turnKeyId.length === 0) {
+        return "Enter a TURN Key ID.";
+    }
+    if (!TURN_KEY_ID_PATTERN.test(turnKeyId)) {
+        return "TURN Key ID contains unsupported characters.";
+    }
+
+    const apiToken = value.apiToken;
+    if (typeof apiToken !== "string" || apiToken.length === 0) {
+        return "Enter a TURN Key API Token.";
+    }
+    if (apiToken.length > MAX_BEARER_TOKEN_LENGTH || !BEARER_TOKEN_PATTERN.test(apiToken)) {
+        return "TURN Key API Token must use Bearer token syntax.";
+    }
+
+    return undefined;
+}

src/integrations/cloudflare/turnCredentials.ts

@@ -0,0 +1,363 @@
+import {
+    CLOUDFLARE_TURN_CREDENTIAL_ENDPOINT,
+    CLOUDFLARE_TURN_CREDENTIAL_TTL_SECONDS,
+    type CloudflareTurnConfiguration,
+    validateCloudflareTurnConfiguration,
+} from "./settings";
+
+/** Fetch-compatible function supplied by the host composition. */
+export type CloudflareTurnFetch = (input: string | Request, init?: RequestInit) => Promise<Response>;
+
+export interface CloudflareTurnDependencies {
+    readonly fetch: CloudflareTurnFetch;
+    readonly now?: () => number;
+    readonly requestDeadlineMs?: number;
+}
+
+export const CLOUDFLARE_TURN_REQUEST_DEADLINE_MS = 15_000 as const;
+export const CLOUDFLARE_TURN_MAX_RESPONSE_BYTES = 32 * 1024;
+export const CLOUDFLARE_TURN_MAX_ICE_SERVER_ENTRIES = 16 as const;
+export const CLOUDFLARE_TURN_MAX_ICE_SERVER_URLS = 32 as const;
+export const CLOUDFLARE_TURN_MIN_REMAINING_LIFETIME_MS = 30_000 as const;
+
+type TurnFailureCode = "configuration" | "authentication" | "unavailable" | "invalid-response";
+
+const FAILURE_MESSAGES: Record<TurnFailureCode, string> = {
+    configuration: "The Cloudflare TURN configuration is invalid.",
+    authentication: "The Cloudflare TURN credential request was not authorised.",
+    unavailable: "The Cloudflare TURN service is unavailable.",
+    "invalid-response": "The Cloudflare TURN service returned an invalid response.",
+};
+
+function credentialFailure(code: TurnFailureCode, retryable: boolean): Error {
+    return Object.assign(new Error(FAILURE_MESSAGES[code]), { code, retryable });
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function abortError(): Error {
+    try {
+        return new DOMException("The operation was aborted.", "AbortError");
+    } catch {
+        const error = new Error("The operation was aborted.");
+        error.name = "AbortError";
+        return error;
+    }
+}
+
+function throwIfAborted(signal: AbortSignal): void {
+    if (signal.aborted) {
+        throw abortError();
+    }
+}
+
+function isControlCharacter(value: string): boolean {
+    return Array.from(value).some((character) => {
+        const code = character.charCodeAt(0);
+        return code <= 0x1f || code === 0x7f;
+    });
+}
+
+function isPort(value: string): boolean {
+    if (!/^\d{1,5}$/.test(value)) return false;
+    const port = Number(value);
+    return port >= 1 && port <= 65_535;
+}
+
+function isHost(value: string): boolean {
+    return value.length > 0 && /^[A-Za-z0-9._-]+$/.test(value);
+}
+
+/**
+ * Validates the URL forms accepted by WebRTC's ICE server configuration.
+ * TURN URLs may carry only the standard transport query parameter; userinfo,
+ * paths, fragments, and arbitrary query values are not accepted.
+ */
+export function isSupportedIceServerUrl(value: string): boolean {
+    if (value.length === 0 || value.length > 2_048 || isControlCharacter(value)) return false;
+    const schemeMatch = /^(stun|stuns|turn|turns):(.+)$/i.exec(value);
+    if (!schemeMatch) return false;
+
+    const remainder = schemeMatch[2];
+    const queryIndex = remainder.indexOf("?");
+    const authority = queryIndex >= 0 ? remainder.slice(0, queryIndex) : remainder;
+    const query = queryIndex >= 0 ? remainder.slice(queryIndex + 1) : "";
+    if (authority.length === 0 || authority.includes("/") || authority.includes("#") || authority.includes("@")) {
+        return false;
+    }
+    if (authority.includes("%")) return false;
+
+    if (authority.startsWith("[")) {
+        const closingBracket = authority.indexOf("]");
+        if (closingBracket < 0) return false;
+        const host = authority.slice(1, closingBracket);
+        if (!/^[0-9A-Fa-f:.]+$/.test(host) || !host.includes(":")) return false;
+        const suffix = authority.slice(closingBracket + 1);
+        if (suffix !== "" && (!suffix.startsWith(":") || !isPort(suffix.slice(1)))) return false;
+    } else {
+        const colonIndex = authority.lastIndexOf(":");
+        const host = colonIndex >= 0 ? authority.slice(0, colonIndex) : authority;
+        if (!isHost(host) || (colonIndex >= 0 && !isPort(authority.slice(colonIndex + 1)))) return false;
+        // IPv6 literals must use brackets so a colon cannot be interpreted as
+        // an ambiguous port separator.
+        if (colonIndex >= 0 && host.includes(":")) return false;
+    }
+
+    if (query.length === 0) return true;
+    const queryParts = query.split("&");
+    return queryParts.length === 1 && /^transport=(udp|tcp)$/i.test(queryParts[0]);
+}
+
+function isTurnUrl(value: string): boolean {
+    return /^(turn|turns):/i.test(value);
+}
+
+function isCredential(value: unknown): value is string {
+    return typeof value === "string" && value.length > 0 && value.length <= 4_096 && !isControlCharacter(value);
+}
+
+function normaliseIceServers(value: unknown): readonly RTCIceServer[] {
+    if (!isRecord(value) || !Array.isArray(value.iceServers)) {
+        throw credentialFailure("invalid-response", false);
+    }
+    if (value.iceServers.length === 0 || value.iceServers.length > CLOUDFLARE_TURN_MAX_ICE_SERVER_ENTRIES) {
+        throw credentialFailure("invalid-response", false);
+    }
+
+    const servers: RTCIceServer[] = [];
+    let urlCount = 0;
+    let hasTurnServer = false;
+
+    for (const candidate of value.iceServers) {
+        if (!isRecord(candidate)) throw credentialFailure("invalid-response", false);
+        const rawUrls = candidate.urls;
+        const urls =
+            typeof rawUrls === "string"
+                ? [rawUrls]
+                : Array.isArray(rawUrls) && rawUrls.every((url): url is string => typeof url === "string")
+                  ? [...rawUrls]
+                  : undefined;
+        if (!urls || urls.length === 0) throw credentialFailure("invalid-response", false);
+
+        urlCount += urls.length;
+        if (urlCount > CLOUDFLARE_TURN_MAX_ICE_SERVER_URLS || urls.some((url) => !isSupportedIceServerUrl(url))) {
+            throw credentialFailure("invalid-response", false);
+        }
+
+        const turnEntry = urls.some(isTurnUrl);
+        hasTurnServer ||= turnEntry;
+        const normalised: RTCIceServer = { urls };
+        if (turnEntry) {
+            if (!isCredential(candidate.username) || !isCredential(candidate.credential)) {
+                throw credentialFailure("invalid-response", false);
+            }
+            normalised.username = candidate.username;
+            normalised.credential = candidate.credential;
+        }
+        servers.push(normalised);
+    }
+
+    if (!hasTurnServer) throw credentialFailure("invalid-response", false);
+    return Object.freeze(servers);
+}
+
+class BoundedResponseError extends Error {
+    constructor(readonly kind: "too-large" | "invalid-length" | "read-failed") {
+        super(kind);
+    }
+}
+
+async function readResponseBody(response: Response): Promise<string> {
+    const contentLength = response.headers.get("content-length");
+    if (contentLength !== null) {
+        const declaredLength = Number(contentLength);
+        if (!Number.isFinite(declaredLength) || declaredLength < 0) {
+            throw new BoundedResponseError("invalid-length");
+        }
+        if (declaredLength > CLOUDFLARE_TURN_MAX_RESPONSE_BYTES) {
+            throw new BoundedResponseError("too-large");
+        }
+    }
+
+    if (!response.body) {
+        try {
+            const text = await response.text();
+            if (new TextEncoder().encode(text).byteLength > CLOUDFLARE_TURN_MAX_RESPONSE_BYTES) {
+                throw new BoundedResponseError("too-large");
+            }
+            return text;
+        } catch (error) {
+            if (error instanceof BoundedResponseError) throw error;
+            throw new BoundedResponseError("read-failed");
+        }
+    }
+
+    const reader = response.body.getReader();
+    const chunks: Uint8Array[] = [];
+    let totalBytes = 0;
+    try {
+        while (true) {
+            const result = await reader.read();
+            if (result.done) break;
+            totalBytes += result.value.byteLength;
+            if (totalBytes > CLOUDFLARE_TURN_MAX_RESPONSE_BYTES) {
+                try {
+                    await reader.cancel();
+                } catch {
+                    // The response is already invalid because it exceeded the
+                    // bound; cancellation failure must not change the safe
+                    // classification or expose a host-specific error.
+                }
+                throw new BoundedResponseError("too-large");
+            }
+            chunks.push(result.value);
+        }
+    } catch (error) {
+        if (error instanceof BoundedResponseError) throw error;
+        throw new BoundedResponseError("read-failed");
+    } finally {
+        reader.releaseLock();
+    }
+
+    const bytes = new Uint8Array(totalBytes);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return new TextDecoder().decode(bytes);
+}
+
+function classifyHttpFailure(status: number): Error {
+    if (status === 401 || status === 403) {
+        return credentialFailure("authentication", false);
+    }
+    if (status === 408 || status === 429 || status >= 500) {
+        return credentialFailure("unavailable", true);
+    }
+    return credentialFailure("unavailable", false);
+}
+
+function parseResponseBody(body: string): readonly RTCIceServer[] {
+    let value: unknown;
+    try {
+        value = JSON.parse(body) as unknown;
+    } catch {
+        throw credentialFailure("invalid-response", false);
+    }
+    return normaliseIceServers(value);
+}
+
+/** Acquire one temporary ICE configuration for a new room connection. */
+export async function acquireCloudflareTurnCredentials(
+    configuration: CloudflareTurnConfiguration,
+    dependencies: CloudflareTurnDependencies,
+    signal: AbortSignal
+): Promise<{ iceServers: readonly RTCIceServer[]; expiresAt: number }> {
+    if (validateCloudflareTurnConfiguration(configuration)) throw credentialFailure("configuration", false);
+    const now = dependencies.now ?? Date.now;
+    const requestDeadlineMs = dependencies.requestDeadlineMs ?? CLOUDFLARE_TURN_REQUEST_DEADLINE_MS;
+    throwIfAborted(signal);
+    const requestStartedAt = now();
+    if (!Number.isFinite(requestStartedAt)) {
+        throw credentialFailure("unavailable", true);
+    }
+
+    const requestController = new AbortController();
+    let cancelledByCaller = false;
+    let rejectCaller: ((reason?: unknown) => void) | undefined;
+    const callerAbort = new Promise<never>((_resolve, reject) => {
+        rejectCaller = reject;
+    });
+    let timedOut = false;
+    const onAbort = () => {
+        cancelledByCaller = true;
+        requestController.abort();
+        rejectCaller?.(abortError());
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    if (signal.aborted) {
+        signal.removeEventListener("abort", onAbort);
+        requestController.abort();
+        throw abortError();
+    }
+    let timeoutId: ReturnType<typeof setTimeout> | undefined;
+    const deadline = new Promise<never>((_resolve, reject) => {
+        timeoutId = globalThis.setTimeout(() => {
+            timedOut = true;
+            requestController.abort();
+            reject(credentialFailure("unavailable", true));
+        }, requestDeadlineMs);
+    });
+
+    const cleanup = () => {
+        if (timeoutId !== undefined) globalThis.clearTimeout(timeoutId);
+        signal.removeEventListener("abort", onAbort);
+    };
+
+    const endpoint = `${CLOUDFLARE_TURN_CREDENTIAL_ENDPOINT}/${configuration.turnKeyId}/credentials/generate-ice-servers`;
+    let response: Response;
+    try {
+        response = await Promise.race([
+            dependencies.fetch(endpoint, {
+                method: "POST",
+                headers: {
+                    Authorization: `Bearer ${configuration.apiToken}`,
+                    "Content-Type": "application/json",
+                },
+                body: JSON.stringify({ ttl: CLOUDFLARE_TURN_CREDENTIAL_TTL_SECONDS }),
+                signal: requestController.signal,
+                redirect: "error",
+                credentials: "omit",
+                cache: "no-store",
+            }),
+            callerAbort,
+            deadline,
+        ]);
+    } catch {
+        cleanup();
+        if (cancelledByCaller || signal.aborted) throw abortError();
+        if (timedOut) throw credentialFailure("unavailable", true);
+        throw credentialFailure("unavailable", true);
+    }
+
+    if (cancelledByCaller || signal.aborted) {
+        cleanup();
+        throw abortError();
+    }
+    if (timedOut || requestController.signal.aborted) {
+        cleanup();
+        throw credentialFailure("unavailable", true);
+    }
+    if (response.status !== 201) {
+        cleanup();
+        throw classifyHttpFailure(response.status);
+    }
+
+    let body: string;
+    try {
+        body = await Promise.race([readResponseBody(response), callerAbort, deadline]);
+    } catch (error) {
+        cleanup();
+        if (cancelledByCaller || signal.aborted) throw abortError();
+        if (timedOut) throw credentialFailure("unavailable", true);
+        if (error instanceof BoundedResponseError && error.kind === "read-failed") {
+            throw credentialFailure("unavailable", true);
+        }
+        throw credentialFailure("invalid-response", false);
+    }
+
+    try {
+        throwIfAborted(signal);
+        const iceServers = parseResponseBody(body);
+        const expiresAt = requestStartedAt + CLOUDFLARE_TURN_CREDENTIAL_TTL_SECONDS * 1_000;
+        if (!Number.isFinite(expiresAt) || expiresAt <= now() + CLOUDFLARE_TURN_MIN_REMAINING_LIFETIME_MS) {
+            throw credentialFailure("invalid-response", false);
+        }
+        return { iceServers, expiresAt };
+    } finally {
+        cleanup();
+    }
+}

src/integrations/cloudflare/turnCredentials.unit.spec.ts

@@ -0,0 +1,179 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import {
+    CLOUDFLARE_TURN_MAX_RESPONSE_BYTES,
+    CLOUDFLARE_TURN_REQUEST_DEADLINE_MS,
+    acquireCloudflareTurnCredentials,
+} from "./turnCredentials";
+import {
+    CLOUDFLARE_TURN_CREDENTIAL_ENDPOINT,
+    CLOUDFLARE_TURN_CREDENTIAL_TTL_SECONDS,
+    validateCloudflareTurnConfiguration,
+} from "./settings";
+
+const configuration = {
+    turnKeyId: "key-123",
+    apiToken: "token_abc-123",
+} as const;
+
+function response(body: unknown, status = 201): Response {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { "content-type": "application/json" },
+    });
+}
+
+function validBody() {
+    return {
+        iceServers: [
+            {
+                urls: ["turn:relay.example.test:3478?transport=udp", "turns:relay.example.test:5349"],
+                username: "turn-user",
+                credential: "turn-password",
+            },
+            { urls: "stun:stun.example.test:3478" },
+        ],
+    };
+}
+
+afterEach(() => {
+    vi.useRealTimers();
+});
+
+describe("Cloudflare TURN credentials", () => {
+    it("requests the fixed endpoint with the bearer token and TTL", async () => {
+        const now = 1_000_000;
+        let requestUrl: string | Request | undefined;
+        let requestInit: RequestInit | undefined;
+        const fetch = vi.fn(async (input: string | Request, init?: RequestInit) => {
+            requestUrl = input;
+            requestInit = init;
+            return response(validBody());
+        });
+        const dependencies = { fetch, now: () => now };
+
+        const result = await acquireCloudflareTurnCredentials(
+            configuration,
+            dependencies,
+            new AbortController().signal
+        );
+
+        expect(requestUrl).toBe(`${CLOUDFLARE_TURN_CREDENTIAL_ENDPOINT}/key-123/credentials/generate-ice-servers`);
+        expect(requestInit).toMatchObject({
+            method: "POST",
+            redirect: "error",
+            credentials: "omit",
+            cache: "no-store",
+            body: JSON.stringify({ ttl: CLOUDFLARE_TURN_CREDENTIAL_TTL_SECONDS }),
+        });
+        expect(new Headers(requestInit?.headers).get("authorization")).toBe("Bearer token_abc-123");
+        expect(new Headers(requestInit?.headers).get("content-type")).toBe("application/json");
+        expect(requestInit?.signal).toBeInstanceOf(AbortSignal);
+        expect(result.iceServers).toHaveLength(2);
+        expect(result.expiresAt).toBe(now + CLOUDFLARE_TURN_CREDENTIAL_TTL_SECONDS * 1_000);
+    });
+
+    it("rejects malformed, oversized, and STUN-only responses without exposing secrets", async () => {
+        const cases: Array<{ body: unknown; expectedCode: string }> = [
+            { body: { iceServers: [] }, expectedCode: "invalid-response" },
+            { body: { iceServers: [{ urls: "turn:relay.example.test:3478" }] }, expectedCode: "invalid-response" },
+            { body: { iceServers: [{ urls: "stun:stun.example.test:3478" }] }, expectedCode: "invalid-response" },
+        ];
+        for (const testCase of cases) {
+            const dependencies = {
+                fetch: vi.fn(async () => response(testCase.body)),
+                now: () => 1_000_000,
+            };
+            const error = await acquireCloudflareTurnCredentials(
+                configuration,
+                dependencies,
+                new AbortController().signal
+            ).catch((reason: unknown) => reason);
+            expect(error).toMatchObject({ code: testCase.expectedCode });
+            expect(String(error)).not.toContain(configuration.apiToken);
+            expect(String(error)).not.toContain(configuration.turnKeyId);
+        }
+
+        const oversized = "x".repeat(CLOUDFLARE_TURN_MAX_RESPONSE_BYTES + 1);
+        const dependencies = {
+            fetch: vi.fn(async () => new Response(oversized, { status: 201 })),
+            now: () => 1_000_000,
+        };
+        const error = await acquireCloudflareTurnCredentials(
+            configuration,
+            dependencies,
+            new AbortController().signal
+        ).catch((reason: unknown) => reason);
+        expect(error).toMatchObject({ code: "invalid-response" });
+    });
+
+    it("classifies authentication and transient provider failures", async () => {
+        const authDependencies = {
+            fetch: vi.fn(async () => response({}, 401)),
+        };
+        await expect(
+            acquireCloudflareTurnCredentials(configuration, authDependencies, new AbortController().signal)
+        ).rejects.toMatchObject({
+            code: "authentication",
+            retryable: false,
+        });
+
+        const transientDependencies = {
+            fetch: vi.fn(async () => response({}, 503)),
+        };
+        await expect(
+            acquireCloudflareTurnCredentials(configuration, transientDependencies, new AbortController().signal)
+        ).rejects.toMatchObject({
+            code: "unavailable",
+            retryable: true,
+        });
+    });
+
+    it("propagates caller cancellation and turns a deadline into an unavailable failure", async () => {
+        const controller = new AbortController();
+        const fetch = vi.fn((_input: string | Request, init?: RequestInit) => {
+            return new Promise<Response>((_resolve, reject) => {
+                init?.signal?.addEventListener("abort", () => reject(new DOMException("aborted", "AbortError")), {
+                    once: true,
+                });
+            });
+        });
+        const dependencies = { fetch };
+        const cancelled = acquireCloudflareTurnCredentials(configuration, dependencies, controller.signal);
+        controller.abort();
+        await expect(cancelled).rejects.toMatchObject({ name: "AbortError" });
+
+        vi.useFakeTimers();
+        const timedDependencies = { fetch };
+        const timed = acquireCloudflareTurnCredentials(configuration, timedDependencies, new AbortController().signal);
+        const assertion = expect(timed).rejects.toMatchObject({ code: "unavailable", retryable: true });
+        await vi.advanceTimersByTimeAsync(CLOUDFLARE_TURN_REQUEST_DEADLINE_MS);
+        await assertion;
+    });
+
+    it("rejects an issuance which has no usable remaining lifetime", async () => {
+        let now = 1_000_000;
+        const dependencies = {
+            fetch: vi.fn(async () => {
+                now += CLOUDFLARE_TURN_CREDENTIAL_TTL_SECONDS * 1_000;
+                return response(validBody());
+            }),
+            now: () => now,
+        };
+        await expect(
+            acquireCloudflareTurnCredentials(configuration, dependencies, new AbortController().signal)
+        ).rejects.toMatchObject({
+            code: "invalid-response",
+        });
+    });
+});
+
+describe("Cloudflare TURN input validation", () => {
+    it("rejects unsafe key IDs and malformed bearer credentials", () => {
+        expect(
+            validateCloudflareTurnConfiguration({ turnKeyId: "key/id", apiToken: configuration.apiToken })
+        ).toContain("unsupported characters");
+        expect(validateCloudflareTurnConfiguration({ ...configuration, apiToken: "token with spaces" })).toContain(
+            "Bearer token syntax"
+        );
+    });
+});

src/integrations/turnSettings.ts

@@ -0,0 +1,14 @@
+import type { P2PConnectionInfo } from "@vrtmrz/livesync-commonlib/compat/common/types";
+import { CLOUDFLARE_TURN_TYPE, validateCloudflareTurnConfiguration } from "./cloudflare/settings";
+
+/** Validate provider inputs without requesting credentials. */
+export function validateManagedTurnSettings(settings: Partial<P2PConnectionInfo>): string | undefined {
+    if (settings.P2P_managedType === undefined || settings.P2P_managedType === "") return undefined;
+    if (settings.P2P_managedType !== CLOUDFLARE_TURN_TYPE) {
+        return "The selected TURN configuration is not supported.";
+    }
+    return validateCloudflareTurnConfiguration({
+        turnKeyId: settings.P2P_managedId ?? "",
+        apiToken: settings.P2P_managedToken ?? "",
+    });
+}

src/main.ts

@@ -1,3 +1,4 @@
+import { useP2PSettingsPreparation } from "@/serviceFeatures/useP2PSettingsPreparation";
 import { getLanguage, Notice, Plugin, type App, type PluginManifest } from "./deps";
 import { setGetLanguage } from "@vrtmrz/livesync-commonlib/compat/common/coreEnvFunctions";
 setGetLanguage(getLanguage);
@@ -182,7 +183,8 @@ export default class ObsidianLiveSyncPlugin extends Plugin {
                 const replicator = useP2PReplicatorFeature(
                     core,
                     (_compatibilityReplicator, p2p) => createInteractiveP2PReplication(p2p),
-                    createOpenRebuildUI(this.app)
+                    createOpenRebuildUI(this.app),
+                    { prepareP2PSettings: useP2PSettingsPreparation(core.services.API.webCompatFetch.bind(core.services.API)) }
                 );
                 setupManager.registerP2PSetupConnectionProbe(replicator.connectionProbe);
                 useP2PReplicatorCommands(core, replicator);

src/modules/coreFeatures/ModuleResolveMismatchedTweaks.ts

@@ -1,19 +1,16 @@
 import { Logger, LOG_LEVEL_NOTICE } from "octagonal-wheels/common/logger";
 import { extractObject } from "octagonal-wheels/object";
 import {
-    TweakValuesShouldMatchedTemplate,
     TweakValuesTemplate,
-    IncompatibleChanges,
     configurationNames,
     statusDisplay,
     type TweakValues,
     type ObsidianLiveSyncSettings,
     type RemoteDBSettings,
-    IncompatibleChangesInSpecificPattern,
-    CompatibleButLossyChanges,
     type RemotePreferredTweakResult,
     RemotePreferredTweakStatuses,
 } from "@vrtmrz/livesync-commonlib/compat/common/types";
+import { assessTweakCompatibility, type TweakAssessment } from "@vrtmrz/livesync-commonlib/settings";
 import { escapeMarkdownValue } from "@vrtmrz/livesync-commonlib/compat/common/utils";
 import { AbstractModule } from "@/modules/AbstractModule.ts";
 import { $msg, translateIfAvailable } from "@/common/translation";
@@ -59,14 +56,49 @@ function valueToString(value: string | number | boolean | object | undefined): s
     return `${value}`;
 }
 
-export class ModuleResolvingMismatchedTweaks extends AbstractModule {
-    private _collectMismatchedTweakKeys(current: TweakValues, preferred: Partial<TweakValues>) {
-        const items = Object.keys(
-            TweakValuesShouldMatchedTemplate
-        ) as (keyof typeof TweakValuesShouldMatchedTemplate)[];
-        return items.filter((key) => current[key] !== preferred[key]);
-    }
+function definedTweaks(values: TweakValues): TweakValues {
+    return Object.fromEntries(
+        Object.entries(values).filter(([key, value]) => key in TweakValuesTemplate && value !== undefined)
+    );
+}
 
+function settingsAfterAdoption(assessment: TweakAssessment, direction: "adoptPreferred" | "adoptCurrent"): TweakValues {
+    const comparedKeys = new Set<string>(assessment.entries.map((entry) => entry.key));
+    const source = direction === "adoptPreferred" ? assessment.preferredValues : assessment.currentValues;
+    const target = direction === "adoptPreferred" ? assessment.currentValues : assessment.preferredValues;
+    const recommendations = Object.fromEntries(
+        Object.entries(source).filter(([key, value]) => !comparedKeys.has(key) && value !== undefined)
+    );
+    return {
+        ...definedTweaks(target),
+        ...recommendations,
+        ...assessment[direction].changes,
+    };
+}
+
+function mismatchTable(assessment: TweakAssessment, direction?: "adoptPreferred" | "adoptCurrent"): string {
+    const reasons = direction
+        ? assessment[direction].reasons
+        : [...assessment.adoptPreferred.reasons, ...assessment.adoptCurrent.reasons];
+    const consequenceKeys = new Set(reasons.map((reason) => reason.key));
+    const rows = assessment.entries
+        .filter((entry) => entry.relation === "different" || consequenceKeys.has(entry.key))
+        .map((entry) =>
+            $msg("TweakMismatchResolve.Table.Row", {
+                name: localisedConfName(entry.key),
+                self: valueToString(escapeMarkdownValue(entry.current.effectiveValue)),
+                remote: valueToString(escapeMarkdownValue(entry.preferred.effectiveValue)),
+            })
+        );
+    return $msg("TweakMismatchResolve.Table", { rows: rows.join("\n") });
+}
+
+/** Kept only while resolving a decision; this can contain credentials and must never be logged. */
+function resolutionSettingsSignature(settings: ObsidianLiveSyncSettings): string {
+    return JSON.stringify({ ...settings, autoAcceptCompatibleTweak: settings.autoAcceptCompatibleTweak ?? true });
+}
+
+export class ModuleResolvingMismatchedTweaks extends AbstractModule {
     private _selectNewerTweakSide(current: TweakValues, preferred: Partial<TweakValues>): "REMOTE" | "CURRENT" {
         Logger(`Modified: ${current.tweakModified} (current) vs ${preferred.tweakModified} (preferred)`);
         const currentModified = current.tweakModified;
@@ -83,15 +115,9 @@ export class ModuleResolvingMismatchedTweaks extends AbstractModule {
     }
 
     private async _shouldAutoAcceptCompatibleLossy(
-        current: TweakValues,
-        preferred: Partial<TweakValues>,
-        mismatchedKeys: (keyof typeof TweakValuesShouldMatchedTemplate)[]
+        assessment: TweakAssessment
     ): Promise<"REMOTE" | "CURRENT" | undefined> {
-        if (mismatchedKeys.length === 0) return undefined;
-        const hasOnlyCompatibleLossyMismatches = mismatchedKeys.every(
-            (key) => CompatibleButLossyChanges.indexOf(key) !== -1
-        );
-        if (!hasOnlyCompatibleLossyMismatches) return undefined;
+        if (!assessment.onlyCompatibleLossyDifferences) return undefined;
 
         let autoAcceptCompatibleTweak = this.settings.autoAcceptCompatibleTweak;
         if (this.settings.autoAcceptCompatibleTweak === undefined) {
@@ -104,7 +130,7 @@ export class ModuleResolvingMismatchedTweaks extends AbstractModule {
         }
 
         if (autoAcceptCompatibleTweak !== true) return undefined;
-        return this._selectNewerTweakSide(current, preferred);
+        return this._selectNewerTweakSide(assessment.currentValues, assessment.preferredValues);
     }
 
     /**
@@ -138,6 +164,14 @@ export class ModuleResolvingMismatchedTweaks extends AbstractModule {
         ) {
             return false;
         }
+        const isCurrent = await this.services.replicator.runWithActiveReplicatorContext(
+            (activeContext) => activeContext === failure.context
+        );
+        if (!isCurrent || resolutionSettingsSignature(failure.setting) !== resolutionSettingsSignature(this.settings)) {
+            return true;
+        }
+        const assessment =
+            recovery.tweakAssessment ?? assessTweakCompatibility(failure.setting, recovery.preferredTweakValue);
         const ret = await this.services.tweakValue.askResolvingMismatched(
             { ...recovery.preferredTweakValue },
             async (setting) => {
@@ -149,138 +183,119 @@ export class ModuleResolvingMismatchedTweaks extends AbstractModule {
                     updated = true;
                 });
                 return updated;
-            }
+            },
+            assessment
         );
         if (ret == "OK") return false;
         if (ret == "CHECKAGAIN") return "CHECKAGAIN";
         if (ret == "IGNORE") return true;
     }
 
-    async _checkAndAskResolvingMismatchedTweaks(preferred: TweakValues): Promise<[TweakValues | boolean, boolean]> {
-        const mine = extractObject(TweakValuesTemplate, this.settings) as TweakValues;
-        const mismatchedKeys = this._collectMismatchedTweakKeys(mine, preferred);
-        const autoAcceptSide = await this._shouldAutoAcceptCompatibleLossy(mine, preferred, mismatchedKeys);
-        if (autoAcceptSide === "REMOTE") {
-            return [{ ...mine, ...preferred }, false];
-        }
-        if (autoAcceptSide === "CURRENT") {
-            return [true, false];
-        }
-        const items = Object.entries(TweakValuesShouldMatchedTemplate);
-        let rebuildRequired = false;
-        let rebuildRecommended = false;
-        // Making tables:
-        // let table = `| Value name | This device | Configured | \n` + `|: --- |: --- :|: ---- :| \n`;
-        const tableRows = [];
-        // const items = [mine,preferred]
-        for (const v of items) {
-            const key = v[0] as keyof typeof TweakValuesShouldMatchedTemplate;
-            const valueMine = escapeMarkdownValue(mine[key]);
-            const valuePreferred = escapeMarkdownValue(preferred[key]);
-            if (valueMine == valuePreferred) continue;
-            if (IncompatibleChanges.indexOf(key) !== -1) {
-                rebuildRequired = true;
-            }
-            for (const pattern of IncompatibleChangesInSpecificPattern) {
-                if (pattern.key !== key) continue;
-                // if from value supplied, check if current value have been violated : in other words, if the current value is the same as the from value, it should require a rebuild.
-                const isFromConditionMet = "from" in pattern ? pattern.from === mine[key] : false;
-                // and, if to value supplied, same as above.
-                const isToConditionMet = "to" in pattern ? pattern.to === preferred[key] : false;
-                // if either of them is true, it should require a rebuild, if the pattern is not a recommendation.
-                if (isFromConditionMet || isToConditionMet) {
-                    if (pattern.isRecommendation) {
-                        rebuildRecommended = true;
-                    } else {
-                        rebuildRequired = true;
-                    }
-                }
-            }
-            if (CompatibleButLossyChanges.indexOf(key) !== -1) {
-                rebuildRecommended = true;
-            }
-
-            // table += `| ${confName(key)} | ${valueMine} | ${valuePreferred} | \n`;
-            tableRows.push(
-                $msg("TweakMismatchResolve.Table.Row", {
-                    name: localisedConfName(key),
-                    self: valueToString(valueMine),
-                    remote: valueToString(valuePreferred),
-                })
-            );
-        }
+    async _checkAndAskResolvingMismatchedTweaks(
+        preferred: TweakValues,
+        assessment = assessTweakCompatibility(this.settings, preferred)
+    ): Promise<[TweakValues | boolean, boolean]> {
+        if (assessment.alignment === "matched") return [false, false];
+        const acceptedSettings = settingsAfterAdoption(assessment, "adoptPreferred");
+        const autoAcceptSide = await this._shouldAutoAcceptCompatibleLossy(assessment);
+        if (autoAcceptSide === "REMOTE") return [acceptedSettings, false];
+        if (autoAcceptSide === "CURRENT") return [true, false];
 
+        const localImpact = assessment.adoptPreferred.reconstruction;
+        const remoteImpact = assessment.adoptCurrent.reconstruction;
+        const requiresRebuild = localImpact === "required" || remoteImpact === "required";
+        const recommendsRebuild = localImpact === "recommended" || remoteImpact === "recommended";
         const additionalMessage =
-            rebuildRequired && this.core.settings.isConfigured
+            requiresRebuild && this.settings.isConfigured
                 ? $msg("TweakMismatchResolve.Message.WarningIncompatibleRebuildRequired")
                 : "";
         const additionalMessage2 =
-            rebuildRecommended && this.core.settings.isConfigured
+            recommendsRebuild && this.settings.isConfigured
                 ? $msg("TweakMismatchResolve.Message.WarningIncompatibleRebuildRecommended")
                 : "";
-
-        const table = $msg("TweakMismatchResolve.Table", { rows: tableRows.join("\n") });
-
         const message = $msg("TweakMismatchResolve.Message.MainTweakResolving", {
-            table: table,
-            additionalMessage: [additionalMessage, additionalMessage2].filter((v) => v).join("\n"),
+            table: mismatchTable(assessment),
+            additionalMessage: [additionalMessage, additionalMessage2].filter(Boolean).join("\n"),
         });
-
-        const CHOICE_USE_REMOTE = $msg("TweakMismatchResolve.Action.UseRemote");
-        const CHOICE_USE_REMOTE_WITH_REBUILD = $msg("TweakMismatchResolve.Action.UseRemoteWithRebuild");
-        const CHOICE_USE_REMOTE_PREVENT_REBUILD = $msg("TweakMismatchResolve.Action.UseRemoteAcceptIncompatible");
-        const CHOICE_USE_MINE = $msg("TweakMismatchResolve.Action.UseMine");
-        const CHOICE_USE_MINE_WITH_REBUILD = $msg("TweakMismatchResolve.Action.UseMineWithRebuild");
-        const CHOICE_USE_MINE_PREVENT_REBUILD = $msg("TweakMismatchResolve.Action.UseMineAcceptIncompatible");
-        const CHOICE_DISMISS = $msg("TweakMismatchResolve.Action.Dismiss");
-
-        const CHOICE_AND_VALUES = [] as [string, [result: TweakValues | boolean, rebuild: boolean]][];
-
-        if (rebuildRequired) {
-            CHOICE_AND_VALUES.push([CHOICE_USE_REMOTE_WITH_REBUILD, [preferred, true]]);
-            CHOICE_AND_VALUES.push([CHOICE_USE_MINE_WITH_REBUILD, [true, true]]);
-            CHOICE_AND_VALUES.push([CHOICE_USE_REMOTE_PREVENT_REBUILD, [preferred, false]]);
-            CHOICE_AND_VALUES.push([CHOICE_USE_MINE_PREVENT_REBUILD, [true, false]]);
-        } else if (rebuildRecommended) {
-            CHOICE_AND_VALUES.push([CHOICE_USE_REMOTE, [preferred, false]]);
-            CHOICE_AND_VALUES.push([CHOICE_USE_MINE, [true, false]]);
-            CHOICE_AND_VALUES.push([CHOICE_USE_REMOTE_WITH_REBUILD, [preferred, true]]);
-            CHOICE_AND_VALUES.push([CHOICE_USE_MINE_WITH_REBUILD, [true, true]]);
-        } else {
-            CHOICE_AND_VALUES.push([CHOICE_USE_REMOTE, [preferred, false]]);
-            CHOICE_AND_VALUES.push([CHOICE_USE_MINE, [true, false]]);
+        const choices: Record<string, [TweakValues | boolean, boolean]> = {};
+        const remoteChoices = {
+            ordinary: $msg("TweakMismatchResolve.Action.UseRemote"),
+            rebuild: $msg("TweakMismatchResolve.Action.UseRemoteWithRebuild"),
+            accept: $msg("TweakMismatchResolve.Action.UseRemoteAcceptIncompatible"),
+        };
+        const localChoices = {
+            ordinary: $msg("TweakMismatchResolve.Action.UseMine"),
+            rebuild: $msg("TweakMismatchResolve.Action.UseMineWithRebuild"),
+            accept: $msg("TweakMismatchResolve.Action.UseMineAcceptIncompatible"),
+        };
+        // Each direction owns its consequence; a rebuild on one side does not require one on the other.
+        choices[localImpact === "required" ? remoteChoices.rebuild : remoteChoices.ordinary] = [
+            acceptedSettings,
+            localImpact === "required",
+        ];
+        choices[remoteImpact === "required" ? localChoices.rebuild : localChoices.ordinary] = [
+            true,
+            remoteImpact === "required",
+        ];
+        if (localImpact !== "none") {
+            choices[localImpact === "required" ? remoteChoices.accept : remoteChoices.rebuild] = [
+                acceptedSettings,
+                localImpact !== "required",
+            ];
         }
-        CHOICE_AND_VALUES.push([CHOICE_DISMISS, [false, false]]);
-        const CHOICES = Object.fromEntries(CHOICE_AND_VALUES) as Record<
-            string,
-            [TweakValues | boolean, performRebuild: boolean]
-        >;
-        const retKey = await this.core.confirm.askSelectStringDialogue(message, Object.keys(CHOICES), {
+        if (remoteImpact !== "none") {
+            choices[remoteImpact === "required" ? localChoices.accept : localChoices.rebuild] = [
+                true,
+                remoteImpact !== "required",
+            ];
+        }
+        const dismiss = $msg("TweakMismatchResolve.Action.Dismiss");
+        choices[dismiss] = [false, false];
+        const retKey = await this.core.confirm.askSelectStringDialogue(message, Object.keys(choices), {
             title: $msg("TweakMismatchResolve.Title.TweakResolving"),
             timeout: 60,
-            defaultAction: CHOICE_DISMISS,
+            defaultAction: dismiss,
         });
-        if (!retKey) return [false, false];
-        return CHOICES[retKey];
+        return (retKey && choices[retKey]) || [false, false];
     }
 
     async _askResolvingMismatchedTweaks(
         preferredSource: TweakValues,
-        updatePreferredRemote?: (setting: ObsidianLiveSyncSettings) => Promise<boolean>
+        updatePreferredRemote?: (setting: ObsidianLiveSyncSettings) => Promise<boolean>,
+        assessment = assessTweakCompatibility(this.settings, preferredSource)
     ): Promise<"OK" | "CHECKAGAIN" | "IGNORE"> {
-        const [conf, rebuildRequired] = await this.services.tweakValue.checkAndAskResolvingMismatched(preferredSource);
+        const signature = resolutionSettingsSignature(this.settings);
+        const publication = await this.services.replicator.acquireActiveReplicatorContext();
+        if (resolutionSettingsSignature(this.settings) !== signature) return "IGNORE";
+        const currentTweaks = JSON.stringify(extractObject(TweakValuesTemplate, this.settings));
+        if (JSON.stringify(extractObject(TweakValuesTemplate, assessment.currentValues)) !== currentTweaks) {
+            return "IGNORE";
+        }
+        const [conf, rebuildRequired] = await this.services.tweakValue.checkAndAskResolvingMismatched(
+            preferredSource,
+            assessment
+        );
         if (!conf) return "IGNORE";
+        const currentPublication = await this.services.replicator.acquireActiveReplicatorContext();
+        if (currentPublication !== publication || resolutionSettingsSignature(this.settings) !== signature) {
+            return "IGNORE";
+        }
 
-        const updateRemote = async () => {
-            if (updatePreferredRemote) return await updatePreferredRemote(this.settings);
+        const updateRemote = async (tweaks: TweakValues) => {
+            const setting = {
+                ...this.settings,
+                ...definedTweaks(assessment.preferredValues),
+                ...definedTweaks(tweaks),
+            };
+            if (updatePreferredRemote) return await updatePreferredRemote(setting);
             const candidate = this.core.replicator;
             if (typeof candidate.setPreferredRemoteTweakSettings !== "function") return false;
-            await candidate.setPreferredRemoteTweakSettings(this.settings);
+            await candidate.setPreferredRemoteTweakSettings(setting);
             return true;
         };
 
         if (conf === true) {
-            if (!(await updateRemote())) return "IGNORE";
+            if (!(await updateRemote(settingsAfterAdoption(assessment, "adoptCurrent")))) return "IGNORE";
             if (rebuildRequired) {
                 await this.core.rebuilder.$rebuildRemote();
             }
@@ -288,16 +303,15 @@ export class ModuleResolvingMismatchedTweaks extends AbstractModule {
             return "CHECKAGAIN";
         }
         if (conf) {
-            // ReplicationService retains the current settings object while it performs the immediate
-            // CHECKAGAIN retry. Update that object in place so the retry observes the accepted values.
-            Object.assign(this.settings, extractObject(TweakValuesTemplate, conf));
+            // Keep existing consumers' settings reference stable, and never erase a value omitted by an older peer.
+            Object.assign(this.settings, definedTweaks(conf));
             await this.services.setting.saveSettingData();
             if (!rebuildRequired) {
                 // The failed replication has settled before mismatch resolution runs. Reinitialise the
                 // chunk-generation managers now so hash and splitter changes take effect before retrying.
                 await this.localDatabase.managers.reinitialise();
             }
-            if (!(await updateRemote())) return "IGNORE";
+            if (!(await updateRemote(this.settings))) return "IGNORE";
             if (rebuildRequired) {
                 await this.core.rebuilder.$fetchLocal();
             }
@@ -333,7 +347,9 @@ export class ModuleResolvingMismatchedTweaks extends AbstractModule {
         if (trialSetting.remoteType === REMOTE_P2P) {
             return { result: false, requireFetch: false };
         }
+        const signature = JSON.stringify(trialSetting);
         const preferred = await this.services.tweakValue.fetchRemotePreferred(trialSetting);
+        if (JSON.stringify(trialSetting) !== signature) return { result: false, requireFetch: false };
         if (preferred.status === RemotePreferredTweakStatuses.AVAILABLE) {
             return await this.services.tweakValue.askUseRemoteConfiguration(trialSetting, preferred.values);
         }
@@ -344,101 +360,48 @@ export class ModuleResolvingMismatchedTweaks extends AbstractModule {
         trialSetting: RemoteDBSettings,
         preferred: TweakValues
     ): Promise<{ result: false | TweakValues; requireFetch: boolean }> {
-        const localTweaks = extractObject(TweakValuesTemplate, this.settings) as TweakValues;
-        const mismatchedKeys = this._collectMismatchedTweakKeys(localTweaks, preferred);
-        const autoAcceptSide = await this._shouldAutoAcceptCompatibleLossy(localTweaks, preferred, mismatchedKeys);
-        if (autoAcceptSide === "REMOTE") {
-            return { result: { ...trialSetting, ...preferred }, requireFetch: false };
-        }
-        if (autoAcceptSide === "CURRENT") {
-            return { result: false, requireFetch: false };
-        }
-
-        const items = Object.entries(TweakValuesShouldMatchedTemplate);
-        let rebuildRequired = false;
-        let rebuildRecommended = false;
-        // Making tables:
-        // let table = `| Value name | This device | On Remote | \n` + `|: --- |: ---- :|: ---- :| \n`;
-        let differenceCount = 0;
-        const tableRows = [] as string[];
-        // const items = [mine,preferred]
-        for (const v of items) {
-            const key = v[0] as keyof typeof TweakValuesShouldMatchedTemplate;
-            const remoteValueForDisplay = escapeMarkdownValue(valueToString(preferred[key]));
-            const currentValueForDisplay = escapeMarkdownValue(valueToString((trialSetting as TweakValues)?.[key]));
-            if ((trialSetting as TweakValues)?.[key] !== preferred[key]) {
-                if (IncompatibleChanges.indexOf(key) !== -1) {
-                    rebuildRequired = true;
-                }
-                for (const pattern of IncompatibleChangesInSpecificPattern) {
-                    if (pattern.key !== key) continue;
-                    // if from value supplied, check if current value have been violated : in other words, if the current value is the same as the from value, it should require a rebuild.
-                    const isFromConditionMet =
-                        "from" in pattern ? pattern.from === (trialSetting as TweakValues)?.[key] : false;
-                    // and, if to value supplied, same as above.
-                    const isToConditionMet = "to" in pattern ? pattern.to === preferred[key] : false;
-                    // if either of them is true, it should require a rebuild, if the pattern is not a recommendation.
-                    if (isFromConditionMet || isToConditionMet) {
-                        if (pattern.isRecommendation) {
-                            rebuildRecommended = true;
-                        } else {
-                            rebuildRequired = true;
-                        }
-                    }
-                }
-                if (CompatibleButLossyChanges.indexOf(key) !== -1) {
-                    rebuildRecommended = true;
-                }
-            } else {
-                continue;
-            }
-            tableRows.push(
-                $msg("TweakMismatchResolve.Table.Row", {
-                    name: localisedConfName(key),
-                    self: currentValueForDisplay,
-                    remote: remoteValueForDisplay,
-                })
-            );
-            differenceCount++;
-        }
-
-        if (differenceCount === 0) {
+        const trialSignature = JSON.stringify(trialSetting);
+        const currentSignature = resolutionSettingsSignature(this.settings);
+        const assessment = assessTweakCompatibility(trialSetting, preferred);
+        if (assessment.alignment === "matched") {
             this._log("The settings in the remote database are the same as the local database.", LOG_LEVEL_NOTICE);
             return { result: false, requireFetch: false };
         }
+        const publication = await this.services.replicator.acquireActiveReplicatorContext();
+        const settingsStillCurrent = () =>
+            JSON.stringify(trialSetting) === trialSignature &&
+            resolutionSettingsSignature(this.settings) === currentSignature;
+        if (!settingsStillCurrent()) return { result: false, requireFetch: false };
+        const stillCurrent = async () =>
+            (await this.services.replicator.acquireActiveReplicatorContext()) === publication && settingsStillCurrent();
+        const acceptedSettings = { ...trialSetting, ...settingsAfterAdoption(assessment, "adoptPreferred") };
+        const autoAcceptSide = await this._shouldAutoAcceptCompatibleLossy(assessment);
+        if (!(await stillCurrent())) return { result: false, requireFetch: false };
+        if (autoAcceptSide === "REMOTE") return { result: acceptedSettings, requireFetch: false };
+        if (autoAcceptSide === "CURRENT") return { result: false, requireFetch: false };
+
+        const impact = assessment.adoptPreferred.reconstruction;
         const additionalMessage =
-            rebuildRequired && this.core.settings.isConfigured
+            impact === "required" && this.settings.isConfigured
                 ? $msg("TweakMismatchResolve.Message.UseRemote.WarningRebuildRequired")
                 : "";
         const additionalMessage2 =
-            rebuildRecommended && this.core.settings.isConfigured
+            impact === "recommended" && this.settings.isConfigured
                 ? $msg("TweakMismatchResolve.Message.UseRemote.WarningRebuildRecommended")
                 : "";
-
-        const table = $msg("TweakMismatchResolve.Table", { rows: tableRows.join("\n") });
-
         const message = $msg("TweakMismatchResolve.Message.Main", {
-            table: table,
-            additionalMessage: [additionalMessage, additionalMessage2].filter((v) => v).join("\n"),
+            table: mismatchTable(assessment, "adoptPreferred"),
+            additionalMessage: [additionalMessage, additionalMessage2].filter(Boolean).join("\n"),
         });
-
-        const CHOICE_USE_REMOTE = $msg("TweakMismatchResolve.Action.UseConfigured");
-        const CHOICE_DISMISS = $msg("TweakMismatchResolve.Action.Dismiss");
-        // const CHOICE_AND_VALUES = [
-        //     [CHOICE_USE_REMOTE, preferred],
-        //     [CHOICE_DISMISS, false]]
-        const CHOICES = [CHOICE_USE_REMOTE, CHOICE_DISMISS];
-        const retKey = await this.core.confirm.askSelectStringDialogue(message, CHOICES, {
+        const useRemote = $msg("TweakMismatchResolve.Action.UseConfigured");
+        const dismiss = $msg("TweakMismatchResolve.Action.Dismiss");
+        const retKey = await this.core.confirm.askSelectStringDialogue(message, [useRemote, dismiss], {
             title: $msg("TweakMismatchResolve.Title.UseRemoteConfig"),
             timeout: 0,
-            defaultAction: CHOICE_DISMISS,
+            defaultAction: dismiss,
         });
-        if (!retKey) return { result: false, requireFetch: false };
-        if (retKey === CHOICE_DISMISS) return { result: false, requireFetch: false };
-        if (retKey === CHOICE_USE_REMOTE) {
-            return { result: { ...trialSetting, ...preferred }, requireFetch: rebuildRequired };
-        }
-        return { result: false, requireFetch: false };
+        if (retKey !== useRemote || !(await stillCurrent())) return { result: false, requireFetch: false };
+        return { result: acceptedSettings, requireFetch: impact === "required" };
     }
 
     override onBindFunction(core: LiveSyncCore, services: InjectableServiceHub): void {

src/modules/coreFeatures/ModuleResolveMismatchedTweaks.unit.spec.ts

@@ -2,9 +2,12 @@ import { afterEach, describe, expect, it, vi } from "vitest";
 import {
     DEFAULT_SETTINGS,
     REMOTE_COUCHDB,
+    TweakValuesTemplate,
     type RemoteDBSettings,
     type TweakValues,
 } from "@vrtmrz/livesync-commonlib/compat/common/types";
+import { extractObject } from "octagonal-wheels/object";
+import { assessTweakCompatibility } from "@vrtmrz/livesync-commonlib/settings";
 import { ModuleResolvingMismatchedTweaks } from "./ModuleResolveMismatchedTweaks";
 import { setLang } from "@/common/translation";
 import {
@@ -14,10 +17,16 @@ import {
     type ReplicationAttemptFailure,
 } from "@vrtmrz/livesync-commonlib/replication";
 
+const BASE_TWEAKS = {
+    ...extractObject(TweakValuesTemplate, DEFAULT_SETTINGS),
+    handleFilenameCaseSensitive: false,
+};
+
 function createModule(settingsOverride: Partial<typeof DEFAULT_SETTINGS> = {}) {
     const askSelectStringDialogue = vi.fn(async (..._args: unknown[]): Promise<string | undefined> => undefined);
     const applyPartial = vi.fn(async (_partial: Record<string, unknown>): Promise<void> => undefined);
     const reinitialise = vi.fn(async () => undefined);
+    const publication = {};
     const core = {
         _services: {
             API: {
@@ -31,6 +40,9 @@ function createModule(settingsOverride: Partial<typeof DEFAULT_SETTINGS> = {}) {
                 saveSettingData: vi.fn(async () => undefined),
                 applyPartial,
             },
+            replicator: {
+                acquireActiveReplicatorContext: vi.fn(async () => publication),
+            },
         },
         localDatabase: {
             managers: {
@@ -39,6 +51,7 @@ function createModule(settingsOverride: Partial<typeof DEFAULT_SETTINGS> = {}) {
         },
         settings: {
             ...DEFAULT_SETTINGS,
+            handleFilenameCaseSensitive: false,
             remoteType: REMOTE_COUCHDB,
             ...settingsOverride,
         },
@@ -61,14 +74,170 @@ function createModule(settingsOverride: Partial<typeof DEFAULT_SETTINGS> = {}) {
 }
 
 describe("ModuleResolvingMismatchedTweaks", () => {
+    it("compatibility: offers ordinary application for a missing legacy filename-case setting", async () => {
+        const { module, askSelectStringDialogue } = createModule({
+            autoAcceptCompatibleTweak: false,
+            customChunkSize: 60,
+            usePluginSyncV2: true,
+            handleFilenameCaseSensitive: false,
+        });
+        const preferred: TweakValues = {
+            ...DEFAULT_SETTINGS,
+            customChunkSize: 0,
+            usePluginSyncV2: false,
+        };
+        delete preferred.handleFilenameCaseSensitive;
+
+        await module._checkAndAskResolvingMismatchedTweaks(preferred);
+
+        expect(askSelectStringDialogue.mock.calls[0][1]).toContain("Apply settings to this device");
+        expect(askSelectStringDialogue.mock.calls[0][0]).not.toContain("Handle files as Case-Sensitive");
+    });
+
+    it("compares the trial configuration when deciding whether to accept compatible remote values", async () => {
+        const { module, askSelectStringDialogue } = createModule({
+            autoAcceptCompatibleTweak: true,
+            hashAlg: "xxhash32",
+            tweakModified: 300,
+        });
+        const trial = {
+            ...DEFAULT_SETTINGS,
+            hashAlg: "xxhash64",
+            tweakModified: 100,
+        } as RemoteDBSettings;
+        const preferred = { ...trial, hashAlg: "xxhash32", tweakModified: 200 } as TweakValues;
+
+        const result = await module._askUseRemoteConfiguration(trial, preferred);
+
+        expect(result).toEqual({ result: { ...trial, ...preferred }, requireFetch: false });
+        expect(askSelectStringDialogue).not.toHaveBeenCalled();
+    });
+
+    it("discards remote profile adoption if the active publication changed while awaiting it", async () => {
+        const { module, core, askSelectStringDialogue } = createModule({
+            autoAcceptCompatibleTweak: false,
+            usePluginSyncV2: true,
+        });
+        let publication = {};
+        core._services.replicator.acquireActiveReplicatorContext.mockImplementation(async () => publication);
+        askSelectStringDialogue.mockImplementation(async () => {
+            publication = {};
+            return "Use configured settings";
+        });
+        const trial = { ...core.settings } as RemoteDBSettings;
+        const preferred = { ...trial, usePluginSyncV2: false };
+
+        const result = await module._askUseRemoteConfiguration(trial, preferred);
+
+        expect(askSelectStringDialogue).toHaveBeenCalled();
+        expect(result).toEqual({ result: false, requireFetch: false });
+    });
+
+    it("discards a decision if the connection settings changed while awaiting it", async () => {
+        const { module, core, reinitialise } = createModule({ hashAlg: "xxhash64" });
+        const preferred = { ...DEFAULT_SETTINGS, hashAlg: "xxhash32" } as TweakValues;
+        core._services.tweakValue = {
+            checkAndAskResolvingMismatched: vi.fn(async () => {
+                core.settings.couchDB_DBNAME = "another-database";
+                return [preferred, false];
+            }),
+        };
+        const updatePreferredRemote = vi.fn(async () => true);
+
+        const result = await module._askResolvingMismatchedTweaks(preferred, updatePreferredRemote);
+
+        expect(result).toBe("IGNORE");
+        expect(core.settings.hashAlg).toBe("xxhash64");
+        expect(core._services.setting.saveSettingData).not.toHaveBeenCalled();
+        expect(reinitialise).not.toHaveBeenCalled();
+        expect(updatePreferredRemote).not.toHaveBeenCalled();
+    });
+
+    it("discards a decision if its active publication was replaced while awaiting it", async () => {
+        const { module, core, reinitialise } = createModule({ hashAlg: "xxhash64" });
+        const preferred = { ...BASE_TWEAKS, hashAlg: "xxhash32" } as TweakValues;
+        core._services.tweakValue = {
+            checkAndAskResolvingMismatched: vi.fn(async () => [preferred, false]),
+        };
+        core._services.replicator.acquireActiveReplicatorContext.mockResolvedValueOnce({}).mockResolvedValueOnce({});
+        const updatePreferredRemote = vi.fn(async () => true);
+
+        await expect(module._askResolvingMismatchedTweaks(preferred, updatePreferredRemote)).resolves.toBe("IGNORE");
+
+        expect(core._services.setting.saveSettingData).not.toHaveBeenCalled();
+        expect(reinitialise).not.toHaveBeenCalled();
+        expect(updatePreferredRemote).not.toHaveBeenCalled();
+    });
+
+    it("uses each direction's assessed reconstruction consequence in the available choices", async () => {
+        const { module, core, askSelectStringDialogue } = createModule({ autoAcceptCompatibleTweak: false });
+        const preferred = { ...BASE_TWEAKS, encrypt: true };
+        const assessment = assessTweakCompatibility(core.settings, preferred);
+        const directionalAssessment = {
+            ...assessment,
+            adoptCurrent: { ...assessment.adoptCurrent, reconstruction: "none" as const },
+        };
+        askSelectStringDialogue.mockResolvedValueOnce("Update remote database settings");
+
+        const result = await module._checkAndAskResolvingMismatchedTweaks(preferred, directionalAssessment);
+
+        expect(result).toEqual([true, false]);
+        expect(askSelectStringDialogue.mock.calls[0][1]).toContain("Apply settings to this device, and fetch again");
+        expect(askSelectStringDialogue.mock.calls[0][1]).not.toContain("Apply settings to this device");
+    });
+
+    it("keeps explicitly chosen Fetch failures from becoming a successful retry", async () => {
+        const { module, core } = createModule({ hashAlg: "xxhash64" });
+        const preferred = { ...BASE_TWEAKS, hashAlg: "xxhash32" } as TweakValues;
+        core._services.tweakValue = {
+            checkAndAskResolvingMismatched: vi.fn(async () => [preferred, true]),
+        };
+        const failure = new Error("Fetch failed");
+        core.rebuilder = {
+            $fetchLocal: vi.fn(async () => {
+                throw failure;
+            }),
+        };
+
+        await expect(module._askResolvingMismatchedTweaks(preferred, async () => true)).rejects.toBe(failure);
+    });
+
+    it("does not erase an explicit local setting when accepting a partial remote configuration", async () => {
+        const { module, core } = createModule({ handleFilenameCaseSensitive: false });
+        core._services.tweakValue = {
+            checkAndAskResolvingMismatched: vi.fn(async () => [{ customChunkSize: 30 }, false]),
+        };
+
+        await expect(module._askResolvingMismatchedTweaks({ customChunkSize: 30 }, async () => true)).resolves.toBe(
+            "CHECKAGAIN"
+        );
+        expect(core.settings.handleFilenameCaseSensitive).toBe(false);
+        expect(core.settings.customChunkSize).toBe(30);
+    });
+
+    it("preserves a remote recommendation which this device has not advertised", async () => {
+        const { module, core } = createModule({ hashAlg: "xxhash64" });
+        delete core.settings.readChunksOnline;
+        const preferred = { ...BASE_TWEAKS, hashAlg: "xxhash32", readChunksOnline: false } as TweakValues;
+        core._services.tweakValue = {
+            checkAndAskResolvingMismatched: vi.fn(async () => [true, false]),
+        };
+        const updateRemote = vi.fn(async () => true);
+
+        await expect(module._askResolvingMismatchedTweaks(preferred, updateRemote)).resolves.toBe("CHECKAGAIN");
+        expect(updateRemote).toHaveBeenCalledWith(
+            expect.objectContaining({ hashAlg: "xxhash64", readChunksOnline: false })
+        );
+    });
+
     it("uses the failed attempt hint and writes only through that exact active publication", async () => {
         const { module, core } = createModule();
         const attemptPreferred = {
-            ...(DEFAULT_SETTINGS as unknown as TweakValues),
+            ...BASE_TWEAKS,
             customChunkSize: 60,
         };
         const replacementPreferred = {
-            ...(DEFAULT_SETTINGS as unknown as TweakValues),
+            ...BASE_TWEAKS,
             customChunkSize: 99,
         };
         let updatePreferredRemote: ((setting: typeof core.settings) => Promise<boolean>) | undefined;
@@ -118,7 +287,11 @@ describe("ModuleResolvingMismatchedTweaks", () => {
 
         await expect(module._anyAfterConnectCheckFailed(request)).resolves.toBe(true);
 
-        expect(askResolvingMismatched).toHaveBeenCalledWith(attemptPreferred, expect.any(Function));
+        expect(askResolvingMismatched).toHaveBeenCalledWith(
+            attemptPreferred,
+            expect.any(Function),
+            expect.objectContaining({ alignment: "mismatched" })
+        );
         const effectiveSetting = { ...core.settings, customChunkSize: 64 };
         await expect(updatePreferredRemote?.(effectiveSetting)).resolves.toBe(true);
         expect(failedSetPreferred).toHaveBeenCalledWith(effectiveSetting);
@@ -193,7 +366,7 @@ describe("ModuleResolvingMismatchedTweaks", () => {
         const initialSettings = core.settings;
 
         const preferred = {
-            ...(DEFAULT_SETTINGS as unknown as TweakValues),
+            ...BASE_TWEAKS,
             hashAlg: "xxhash32",
             tweakModified: 200,
         } as Partial<TweakValues>;
@@ -217,7 +390,7 @@ describe("ModuleResolvingMismatchedTweaks", () => {
         });
 
         const preferred = {
-            ...(DEFAULT_SETTINGS as unknown as TweakValues),
+            ...BASE_TWEAKS,
             hashAlg: "xxhash32",
             tweakModified: 200,
         } as Partial<TweakValues>;
@@ -239,7 +412,7 @@ describe("ModuleResolvingMismatchedTweaks", () => {
             tweakModified: currentModified,
         });
         const preferred = {
-            ...(DEFAULT_SETTINGS as unknown as TweakValues),
+            ...BASE_TWEAKS,
             hashAlg: "xxhash32",
             tweakModified: preferredModified,
         } as Partial<TweakValues>;
@@ -260,7 +433,7 @@ describe("ModuleResolvingMismatchedTweaks", () => {
         });
 
         const preferred = {
-            ...(DEFAULT_SETTINGS as unknown as TweakValues),
+            ...BASE_TWEAKS,
             hashAlg: "xxhash32",
             encrypt: true,
             tweakModified: 200,
@@ -281,7 +454,7 @@ describe("ModuleResolvingMismatchedTweaks", () => {
         askSelectStringDialogue.mockResolvedValueOnce("Apply settings to this device, and fetch again");
 
         const preferred = {
-            ...(DEFAULT_SETTINGS as unknown as TweakValues),
+            ...BASE_TWEAKS,
             hashAlg: "xxhash32",
         } as TweakValues;
 
@@ -325,7 +498,7 @@ describe("ModuleResolvingMismatchedTweaks", () => {
         });
         const initialSettings = core.settings;
         const preferred = {
-            ...(DEFAULT_SETTINGS as unknown as TweakValues),
+            ...BASE_TWEAKS,
             hashAlg: "xxhash32",
             tweakModified: 200,
         } as TweakValues;
@@ -372,7 +545,7 @@ describe("ModuleResolvingMismatchedTweaks setting labels", () => {
             tweakModified: 100,
         });
         const preferred = {
-            ...(DEFAULT_SETTINGS as unknown as TweakValues),
+            ...BASE_TWEAKS,
             hashAlg: "xxhash32",
             encrypt: true,
             tweakModified: 200,

src/modules/essentialObsidian/APILib/ObsHttpHandler.ts

@@ -1,7 +1,7 @@
-// This file is based on a file that was published by the @remotely-save, under the Apache 2 License.
-// I would love to express my deepest gratitude to the original authors for their hard work and dedication. Without their contributions, this project would not have been possible.
+// This file was originally based on code published by @remotely-save under the Apache License 2.0.
+// I would like to express my gratitude to the original authors for their work.
 //
-// Original Implementation is here: https://github.com/remotely-save/remotely-save/blob/28b99557a864ef59c19d2ad96101196e401718f0/src/remoteForS3.ts
+// Original implementation: https://github.com/remotely-save/remotely-save/blob/28b99557a864ef59c19d2ad96101196e401718f0/src/remoteForS3.ts
 
 import { FetchHttpHandler, type FetchHttpHandlerOptions } from "@smithy/fetch-http-handler";
 import { HttpRequest, HttpResponse } from "@smithy/protocol-http";
@@ -102,6 +102,7 @@ export class ObsHttpHandler extends FetchHttpHandler {
             method: method,
             url: url,
             contentType: contentType,
+            throw: false,
         };
 
         const raceOfPromises = [

src/modules/essentialObsidian/APILib/ObsHttpHandler.unit.spec.ts

@@ -1,9 +1,10 @@
+import { GetObjectCommand, S3Client } from "@aws-sdk/client-s3";
 import { HttpRequest } from "@smithy/protocol-http";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 const requestUrlMock = vi.hoisted(() =>
     vi.fn<
-        (param: { body?: string | ArrayBuffer }) => Promise<{
+        (param: { body?: string | ArrayBuffer; throw?: boolean }) => Promise<{
             headers: Record<string, string>;
             status: number;
             arrayBuffer: ArrayBuffer;
@@ -28,6 +29,42 @@ function requestWithBody(body: unknown) {
     });
 }
 
+function mockS3ErrorResponse(status: number, code?: string) {
+    requestUrlMock.mockImplementation(async (param) => {
+        if (param.throw !== false) {
+            throw new Error(`Request failed, status ${status}`);
+        }
+        return {
+            headers: { "content-type": "application/xml" },
+            status,
+            arrayBuffer: new TextEncoder().encode(code ? `<Error><Code>${code}</Code></Error>` : "").buffer,
+        };
+    });
+}
+
+function createS3Client() {
+    return new S3Client({
+        region: "us-east-1",
+        credentials: {
+            accessKeyId: "access-key",
+            secretAccessKey: "secret-key",
+        },
+        endpoint: "https://objects.example.com",
+        forcePathStyle: true,
+        maxAttempts: 1,
+        requestHandler: new ObsHttpHandler(),
+    });
+}
+
+function getMissingObject(client: S3Client) {
+    return client.send(
+        new GetObjectCommand({
+            Bucket: "bucket",
+            Key: "missing.json",
+        })
+    );
+}
+
 describe("ObsHttpHandler request bodies", () => {
     beforeEach(() => {
         requestUrlMock.mockReset();
@@ -58,3 +95,56 @@ describe("ObsHttpHandler request bodies", () => {
         expect(requestUrlMock).not.toHaveBeenCalled();
     });
 });
+
+describe("ObsHttpHandler response handling", () => {
+    beforeEach(() => {
+        requestUrlMock.mockReset();
+    });
+
+    it("returns an HTTP error response to the Smithy client", async () => {
+        mockS3ErrorResponse(404, "NoSuchKey");
+        const request = new HttpRequest({
+            protocol: "https:",
+            hostname: "objects.example.com",
+            method: "GET",
+            path: "/bucket/missing.json",
+            headers: {},
+        });
+
+        const result = await new ObsHttpHandler().handle(request);
+
+        expect(requestUrlMock).toHaveBeenCalledWith(expect.objectContaining({ throw: false }));
+        expect(result.response.statusCode).toBe(404);
+    });
+
+    it.each([
+        { code: "NoSuchKey", name: "NoSuchKey" },
+        { code: undefined, name: "NotFound" },
+    ])("lets the S3 client classify a missing object as $name", async ({ code, name }) => {
+        mockS3ErrorResponse(404, code);
+
+        await expect(getMissingObject(createS3Client())).rejects.toMatchObject({
+            name,
+            $metadata: { httpStatusCode: 404 },
+        });
+    });
+
+    it.each([
+        { status: 403, code: "AccessDenied" },
+        { status: 500, code: "InternalError" },
+    ])("keeps an S3 $status response distinct from a missing object", async ({ status, code }) => {
+        mockS3ErrorResponse(status, code);
+
+        await expect(getMissingObject(createS3Client())).rejects.toMatchObject({
+            name: code,
+            $metadata: { httpStatusCode: status },
+        });
+    });
+
+    it("preserves a transport failure", async () => {
+        const failure = new Error("network failed");
+        requestUrlMock.mockRejectedValue(failure);
+
+        await expect(new ObsHttpHandler().handle(requestWithBody(new ArrayBuffer(0)))).rejects.toBe(failure);
+    });
+});

src/modules/features/ModuleLog.ts

@@ -49,6 +49,10 @@ import { MARK_LOG_NETWORK_ERROR, MARK_LOG_SEPARATOR } from "@vrtmrz/livesync-com
 import { NetworkWarningStyles } from "@vrtmrz/livesync-commonlib/compat/common/models/setting.const";
 import { compatGlobal } from "@vrtmrz/livesync-commonlib/compat/common/coreEnvFunctions";
 import { generateReport } from "@/common/reportTool.ts";
+import {
+    ANDROID_LINUX_PATH_COMPONENT_UTF8_WARNING_BOUNDARY,
+    findPathComponentsExceedingUtf8Limit,
+} from "@/common/pathCompatibility.ts";
 
 // This module cannot be a core module because it depends on the Obsidian UI.
 
@@ -293,6 +297,14 @@ export class ModuleLog extends AbstractObsidianModule {
                 reasonWarn.push("Some platforms may be unable to process this file correctly: " + labels.join(" "));
             }
         }
+        const oversizedPathComponents = findPathComponentsExceedingUtf8Limit(thisFile.path);
+        if (oversizedPathComponents.length > 0) {
+            reasonWarn.push(
+                $msg("moduleLog.pathComponentTooLong", {
+                    maxBytes: `${ANDROID_LINUX_PATH_COMPONENT_UTF8_WARNING_BOUNDARY}`,
+                })
+            );
+        }
         // Case Sensitivity
         if (this.services.vault.shouldCheckCaseInsensitively()) {
             const f = (await this.core.storageAccess.getFiles())

src/modules/features/ModuleObsidianSettingAsMarkdown.ts

@@ -1,3 +1,8 @@
+import {
+    hasManagedTurnSettings,
+    omitManagedTurnProfilesFromMarkdown,
+    preserveManagedTurnProfilesOnMarkdownImport,
+} from "@/common/turnSettingsPrivacy";
 // import { PouchDB } from "../../lib/src/pouchdb/pouchdb-browser";
 import { isObjectDifferent } from "octagonal-wheels/object";
 import { EVENT_SETTING_SAVED, eventHub } from "@/common/events";
@@ -129,6 +134,7 @@ export class ModuleObsidianSettingsAsMarkdown extends AbstractModule {
 
         let settingToApply = { ...DEFAULT_SETTINGS } as ObsidianLiveSyncSettings;
         settingToApply = { ...settingToApply, ...newSetting };
+        preserveManagedTurnProfilesOnMarkdownImport(newSetting, this.settings, settingToApply);
         if (!settingToApply?.writeCredentialsForSettingSync) {
             //New setting does not contains credentials.
             settingToApply.couchDB_USER = this.settings.couchDB_USER;
@@ -208,11 +214,18 @@ export class ModuleObsidianSettingsAsMarkdown extends AbstractModule {
             delete saveData.couchDB_CustomHeaders;
             delete saveData.bucketCustomHeaders;
         }
+        omitManagedTurnProfilesFromMarkdown(saveData);
         return saveData;
     }
 
     async saveSettingToMarkdown(filename: string) {
         const saveData = this.generateSettingForMarkdown();
+        if (hasManagedTurnSettings(this.settings)) {
+            this._log(
+                "Share TURN provider credentials through an encrypted Setup URI. Connection profiles are omitted from Markdown settings.",
+                LOG_LEVEL_INFO
+            );
+        }
         const file = await this.core.storageAccess.isExists(filename);
 
         if (!file) {

src/modules/features/SettingDialogue/PaneHatch.ts

@@ -50,6 +50,7 @@ import {
     MetadataDocumentRepairResults,
     OfflineScanUnresolvedReasons,
     repairMetadataDocumentIdentity,
+    VaultScanResults,
     type MetadataDocumentIdentityIssue,
 } from "@vrtmrz/livesync-commonlib/compat/serviceFeatures/offlineScanner";
 import {
@@ -292,7 +293,8 @@ export function paneHatch(this: ObsidianLiveSyncSettingTab, paneEl: HTMLElement,
                                 )) === repairAction,
                             repair: async (repairRequest) =>
                                 await repairMetadataDocumentIdentity(this.core, repairRequest),
-                            requestOrdinaryScan: async () => await this.services.vault.scanVault(true, false),
+                            requestOrdinaryScan: async () =>
+                                (await this.services.vault.scanVault(true, false)) === VaultScanResults.COMPLETED,
                         });
 
                         if (execution.status === MetadataIdentityRepairExecutions.CANCELLED) return;

src/modules/features/SettingDialogue/PaneMaintenance.ts

@@ -412,7 +412,9 @@ export function paneMaintenance(
                     .setDisabled(false)
                     .onClick(async () => {
                         await this.services.database.resetDatabase();
-                        await this.services.databaseEvents.initialiseDatabase();
+                        if (!(await this.services.databaseEvents.initialiseDatabase())) {
+                            Logger($msg("Ui.Common.LocalDatabaseInitialisationFailed"), LOG_LEVEL_NOTICE);
+                        }
                     })
             );
     });

src/modules/features/SettingDialogue/PaneMaintenance.unit.spec.ts

@@ -93,7 +93,7 @@ afterEach(() => {
     vi.clearAllMocks();
 });
 
-describe("paneMaintenance Fresh Start Wipe", () => {
+describe("paneMaintenance", () => {
     it("does not announce success when the remote wipe reports failure", async () => {
         const updateCheckPointInfo = vi.fn(async () => undefined);
         const resetRemoteBucket = vi.fn(async () => false);
@@ -140,4 +140,49 @@ describe("paneMaintenance Fresh Start Wipe", () => {
         );
         expect(maintenanceHarness.logger).not.toHaveBeenCalledWith("Deleted all data on remote server", "notice");
     });
+
+    it("reports when database initialisation after a local reset does not complete", async () => {
+        const resetDatabase = vi.fn(async () => undefined);
+        const initialiseDatabase = vi.fn(async () => false);
+        const addPanel = vi.fn((_parent: HTMLElement, heading: string) => ({
+            then(callback: (paneEl: HTMLElement) => void) {
+                if (heading === "Reset") {
+                    callback({} as HTMLElement);
+                }
+                return Promise.resolve();
+            },
+        }));
+        const host = {
+            core: {},
+            createEl: vi.fn(),
+            editingSettings: {},
+            isConfiguredAs: vi.fn(),
+            onlyOnCouchDB: vi.fn(),
+            onlyOnCouchDBOrMinIO: vi.fn(),
+            onlyOnMinIO: vi.fn(),
+            services: {
+                appLifecycle: { askRestart: vi.fn() },
+                database: { resetDatabase },
+                databaseEvents: { initialiseDatabase },
+                setting: { saveSettingData: vi.fn() },
+            },
+        };
+
+        paneMaintenance.call(host as never, {} as HTMLElement, { addPanel } as never);
+        const deleteLocalDatabase = maintenanceHarness.createdSettings.find(
+            ({ name }) => name === "Delete local database to reset or uninstall Self-hosted LiveSync"
+        );
+        if (!deleteLocalDatabase?.click) {
+            throw new Error("Delete local database action was not registered");
+        }
+
+        await deleteLocalDatabase.click();
+
+        expect(resetDatabase).toHaveBeenCalledOnce();
+        expect(initialiseDatabase).toHaveBeenCalledOnce();
+        expect(maintenanceHarness.logger).toHaveBeenCalledWith(
+            "Ui.Common.LocalDatabaseInitialisationFailed",
+            "notice"
+        );
+    });
 });

src/modules/features/SettingDialogue/PanePatches.ts

@@ -15,6 +15,7 @@ import { PouchDB } from "@vrtmrz/livesync-commonlib/compat/pouchdb/pouchdb-brows
 import { ExtraSuffixIndexedDB } from "@vrtmrz/livesync-commonlib/compat/common/types";
 import { migrateDatabases } from "./settingUtils.ts";
 import { usesLegacyIndexedDBAdapter } from "@/common/compatibilitySettings.ts";
+import { $msg } from "@/common/translation";
 
 export function panePatches(this: ObsidianLiveSyncSettingTab, paneEl: HTMLElement, { addPanel }: PageFunctions): void {
     void addPanel(paneEl, "Compatibility (Metadata)").then((paneEl) => {
@@ -142,7 +143,9 @@ export function panePatches(this: ObsidianLiveSyncSettingTab, paneEl: HTMLElemen
 
         this.addOnSaved("additionalSuffixOfDatabaseName", async (key) => {
             Logger("Suffix has been changed. Reopening database...", LOG_LEVEL_NOTICE);
-            await this.services.databaseEvents.initialiseDatabase();
+            if (!(await this.services.databaseEvents.initialiseDatabase())) {
+                Logger($msg("Ui.Common.LocalDatabaseInitialisationFailed"), LOG_LEVEL_NOTICE);
+            }
         });
 
         new Setting(paneEl).autoWireDropDown("hashAlg", {

src/modules/features/SettingDialogue/PanePatches.unit.spec.ts

@@ -1,4 +1,5 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
+import { LOG_LEVEL_NOTICE } from "@vrtmrz/livesync-commonlib/compat/common/types";
 import { panePatches } from "./PanePatches.ts";
 
 const remediationHarness = vi.hoisted(() => {
@@ -14,11 +15,13 @@ const remediationHarness = vi.hoisted(() => {
     };
     const setButtonClassState = vi.fn();
     const setSettingClassState = vi.fn();
+    const logger = vi.fn();
 
     return {
         createSpan,
         dateElement,
         inputEl,
+        logger,
         setButtonClassState,
         setSettingClassState,
         textComponent,
@@ -59,9 +62,25 @@ vi.mock("./LiveSyncSetting.ts", () => ({
         autoWireToggle(): this {
             return this;
         }
+
+        autoWireText(): this {
+            return this;
+        }
+
+        autoWireDropDown(): this {
+            return this;
+        }
     },
 }));
 
+vi.mock("@/common/translation", () => ({
+    $msg: (message: string) => message,
+}));
+
+vi.mock("@vrtmrz/livesync-commonlib/compat/common/logger", () => ({
+    Logger: remediationHarness.logger,
+}));
+
 afterEach(() => {
     Reflect.deleteProperty(globalThis, "activeDocument");
     vi.clearAllMocks();
@@ -69,7 +88,7 @@ afterEach(() => {
     remediationHarness.inputEl.type = "";
 });
 
-describe("panePatches remediation setting", () => {
+describe("panePatches", () => {
     it("creates the status element in the setting control instead of the document", () => {
         const hierarchyError = new DOMException(
             "Failed to execute 'appendChild' on 'Node': Only one element on document allowed.",
@@ -115,4 +134,36 @@ describe("panePatches remediation setting", () => {
         );
         expect(remediationHarness.setButtonClassState).toHaveBeenCalledWith("sls-setting-additional-action", true);
     });
+
+    it("reports when database reinitialisation after a suffix change does not complete", async () => {
+        const initialiseDatabase = vi.fn(async () => false);
+        let onSuffixSaved: (() => Promise<void>) | undefined;
+        const host = {
+            addOnSaved: vi.fn((key: string, callback: () => Promise<void>) => {
+                if (key === "additionalSuffixOfDatabaseName") onSuffixSaved = callback;
+            }),
+            services: {
+                databaseEvents: { initialiseDatabase },
+            },
+        };
+        const addPanel = vi.fn((_paneEl: HTMLElement, title: string) => ({
+            then(callback: (paneEl: HTMLElement) => void) {
+                if (title === "Edge case addressing (Database)") {
+                    callback({} as HTMLElement);
+                }
+                return Promise.resolve();
+            },
+        }));
+
+        panePatches.call(host as never, {} as HTMLElement, { addPanel } as never);
+        if (!onSuffixSaved) throw new Error("Database suffix save handler was not registered");
+
+        await onSuffixSaved();
+
+        expect(initialiseDatabase).toHaveBeenCalledOnce();
+        expect(remediationHarness.logger).toHaveBeenCalledWith(
+            "Ui.Common.LocalDatabaseInitialisationFailed",
+            LOG_LEVEL_NOTICE
+        );
+    });
 });

src/modules/features/SetupWizard/dialogs/SetupRemoteP2P.svelte

@@ -1,4 +1,6 @@
 <script lang="ts">
+    import TurnConfiguration from "@/features/P2PSync/TurnConfiguration.svelte";
+    import { validateManagedTurnSettings } from "@/integrations/turnSettings";
     // import { delay } from "octagonal-wheels/promises";
     import DialogHeader from "@/modules/services/LiveSyncUI/components/DialogHeader.svelte";
     import Guidance from "@/modules/services/LiveSyncUI/components/Guidance.svelte";
@@ -15,7 +17,7 @@
         P2PMessageSizePresets,
         PREFERRED_BASE,
         RemoteTypes,
-        hasValidP2PTurnServerUrl,
+        hasP2PTurnConfiguration,
         normaliseP2PConnectionPath,
         normaliseP2PMaxWirePayloadBytes,
         type EntryDoc,
@@ -27,7 +29,6 @@
     import { TrysteroReplicator } from "@vrtmrz/livesync-commonlib/compat/replication/trystero/TrysteroReplicator";
     import type { ReplicatorHostEnv } from "@vrtmrz/livesync-commonlib/compat/replication/trystero/types";
     import {
-        copyTo,
         generateP2PRoomId,
         pickP2PSyncSettings,
         type SimpleStore,
@@ -51,7 +52,7 @@
     const context = getDialogContext();
     let error = $state("");
     let connectionPathResetNotice = $state(false);
-    const hasValidTurnServer = $derived(hasValidP2PTurnServerUrl(syncSetting.P2P_turnServers ?? ""));
+    const hasValidTurnServer = $derived(hasP2PTurnConfiguration(syncSetting));
     type Props = GuestDialogProps<SetupRemoteP2PResultType, SetupRemoteP2PInitialData>;
 
     const { setResult, getInitialData }: Props = $props();
@@ -61,7 +62,7 @@
         connectionProbe = initialData?.connectionProbe;
         const initialSettings = initialData?.settings;
         if (initialSettings) {
-            copyTo(initialSettings, syncSetting);
+            syncSetting = pickP2PSyncSettings(initialSettings);
         }
         const initialPeerName = (initialSettings?.P2P_DevicePeerName ?? "").trim();
         if (initialPeerName !== "") {
@@ -100,12 +101,14 @@
     async function checkConnection() {
         try {
             processing = true;
+            const sourceError = validateManagedTurnSettings(syncSetting);
+            if (sourceError) return sourceError;
             const trialRemoteSetting = generateSetting();
             const admission = connectionProbe;
             if (!admission) {
                 throw new Error("The P2P Setup connection probe is not available.");
             }
-            const result = await coordinateP2PSetupConnectionProbe(admission, trialRemoteSetting, async () => {
+            const result = await coordinateP2PSetupConnectionProbe(admission, trialRemoteSetting, async (signallingSettings) => {
                 const map = new Map<string, unknown>();
                 const store = {
                     get: (key: string) => {
@@ -133,7 +136,7 @@
                     const env: ReplicatorHostEnv = {
                         events: context.context.events,
                         translate: context.context.translate,
-                        settings: trialRemoteSetting,
+                        settings: signallingSettings,
                         processReplicatedDocs: async (_docs: PouchDB.Core.ExistingDocument<EntryDoc>[]) => {
                             return;
                         },
@@ -204,6 +207,8 @@
         }
     }
     function commit() {
+        error = validateManagedTurnSettings(syncSetting) ?? "";
+        if (error) return;
         const setting = pickP2PSyncSettings(generateSetting());
         setResult(setting);
     }
@@ -215,7 +220,8 @@
             syncSetting.P2P_relays.trim() !== "" &&
             syncSetting.P2P_roomID.trim() !== "" &&
             syncSetting.P2P_passphrase.trim() !== "" &&
-            (syncSetting.P2P_DevicePeerName ?? "").trim() !== ""
+            (syncSetting.P2P_DevicePeerName ?? "").trim() !== "" &&
+            validateManagedTurnSettings(syncSetting) === undefined
         );
     });
 </script>
@@ -339,24 +345,24 @@
     </InputRow>
     <InfoNote>
         {translateMessage(
-            "TURN relay only is available when at least one valid TURN server URL is configured under Advanced Settings."
+            "TURN relay only requires a TURN server or a configured credential source under Advanced Settings."
         )}
     </InfoNote>
     <InfoNote notice visible={connectionPathResetNotice}>
         {translateMessage(
-            "TURN relay only requires at least one valid TURN server URL. Connection path has been restored to Automatic."
+            "TURN relay only requires TURN configuration. Connection path has been restored to Automatic."
         )}
     </InfoNote>
 </ExtraItems>
 <ExtraItems title={translateMessage("Advanced Settings")}>
     <InfoNote>
         {translateMessage(
-            "TURN server settings are only necessary if you are behind a strict NAT or firewall that prevents direct P2P connections. In most cases, you can leave these fields blank."
+            "Configure TURN when a direct connection cannot be established or when you select TURN relay only."
         )}
     </InfoNote>
-    <InfoNote warning>
+    <InfoNote>
         {translateMessage(
-            "TURN relays the encrypted WebRTC connection only when a direct path cannot be established. A TURN provider cannot read encrypted Vault contents, but it can observe connection metadata and traffic volume. Use a provider you trust."
+            "WebRTC encrypts data between your devices, including when it passes through TURN. The TURN provider cannot read the transferred data. It can see network addresses and traffic volume."
         )}
         <a
             href="https://github.com/vrtmrz/obsidian-livesync/blob/main/docs/p2p.md#signalling-relay-and-turn-server"
@@ -364,34 +370,7 @@
             rel="noopener noreferrer">{translateMessage("Learn more about signalling and TURN")}</a
         >.
     </InfoNote>
-    <InputRow label={translateMessage("TURN Server URLs (comma-separated)")}>
-        <textarea
-            name="p2p-turn-servers"
-            placeholder="turn:turn.example.com:3478,turn:turn.example.com:443"
-            autocapitalize="off"
-            spellcheck="false"
-            bind:value={syncSetting.P2P_turnServers}
-            rows="5"
-        ></textarea>
-    </InputRow>
-    <InputRow label={translateMessage("TURN Username")}>
-        <input
-            type="text"
-            name="p2p-turn-username"
-            placeholder={translateMessage("Enter TURN username")}
-            autocorrect="off"
-            autocapitalize="off"
-            spellcheck="false"
-            bind:value={syncSetting.P2P_turnUsername}
-        />
-    </InputRow>
-    <InputRow label={translateMessage("TURN Credential")}>
-        <Password
-            name="p2p-turn-credential"
-            placeholder={translateMessage("Enter TURN credential")}
-            bind:value={syncSetting.P2P_turnCredential}
-        />
-    </InputRow>
+    <TurnConfiguration bind:settings={syncSetting} />
 </ExtraItems>
 <InfoNote error visible={error !== ""}>
     {error}

src/modules/features/SetupWizard/dialogs/UseSetupURI.svelte

@@ -1,6 +1,5 @@
 <script lang="ts">
     import { configURIBase } from "@/common/types";
-    import type { ObsidianLiveSyncSettings } from "@vrtmrz/livesync-commonlib/compat/common/types";
     import DialogHeader from "@/modules/services/LiveSyncUI/components/DialogHeader.svelte";
     import Guidance from "@/modules/services/LiveSyncUI/components/Guidance.svelte";
     import Decision from "@/modules/services/LiveSyncUI/components/Decision.svelte";
@@ -10,7 +9,7 @@
     import Password from "@/modules/services/LiveSyncUI/components/Password.svelte";
 
     import { onMount } from "svelte";
-    import { decryptString } from "@vrtmrz/livesync-commonlib/compat/encryption/stringEncryption";
+    import { decodeSettingsFromSetupURI } from "@vrtmrz/livesync-commonlib/compat/API/processSetting";
     import type { GuestDialogProps } from "@/modules/services/LiveSyncUI/svelteDialog";
     import { TYPE_CANCELLED, type UseSetupURIResultType } from "./setupDialogTypes";
     import { $msg as translateMessage } from "@/common/translation";
@@ -30,7 +29,7 @@
         }
     });
 
-    const seemsValid = $derived.by(() => setupURI.startsWith(configURIBase));
+    const seemsValid = $derived(setupURI.startsWith(configURIBase));
     async function processSetupURI() {
         error = "";
         if (!seemsValid) return;
@@ -39,11 +38,8 @@
             return;
         }
         try {
-            const settingPieces = setupURI.substring(configURIBase.length);
-            const encodedConfig = decodeURIComponent(settingPieces);
-            const newConf = (await JSON.parse(
-                await decryptString(encodedConfig, passphrase)
-            )) as ObsidianLiveSyncSettings;
+            const newConf = await decodeSettingsFromSetupURI(setupURI.trim(), passphrase);
+            if (!newConf) throw new Error("Invalid Setup URI settings");
             setResult(newConf);
             // Logger("Settings imported successfully", LOG_LEVEL_NOTICE);
             return;

src/modules/features/SetupWizard/dialogs/p2pSetupConnectionProbe.ts

@@ -3,6 +3,7 @@ import {
     type P2PConnectionProbeAdmission,
     type P2PConnectionProbeSettings,
 } from "@vrtmrz/livesync-commonlib/p2p";
+import { P2PConnectionPaths, type P2PSyncSetting } from "@vrtmrz/livesync-commonlib/compat/common/types";
 
 export type P2PSetupConnectionProbeResult =
     | { readonly ok: true }
@@ -20,12 +21,25 @@ export interface P2PSetupConnectionProbe {
 }
 
 /** Interpret the stable P2P owner's admission without constructing transport eagerly. */
-export async function coordinateP2PSetupConnectionProbe(
+export async function coordinateP2PSetupConnectionProbe<T extends P2PConnectionProbeSettings>(
     admission: P2PConnectionProbeAdmission,
-    trialSettings: P2PConnectionProbeSettings,
-    runOwnedTrial: () => Promise<P2PSetupConnectionProbeResult>
+    trialSettings: T,
+    runOwnedTrial: (settings: T) => Promise<P2PSetupConnectionProbeResult>
 ): Promise<P2PSetupConnectionProbeResult> {
-    const settlement = await admission.run(trialSettings, runOwnedTrial);
+    const settlement = await admission.run(trialSettings, () => {
+        // This trial checks signalling only; TURN allocation belongs to an actual connection.
+        const settings: T & Partial<P2PSyncSetting> = { ...trialSettings };
+        delete settings.P2P_managedType;
+        delete settings.P2P_managedId;
+        delete settings.P2P_managedToken;
+        delete settings.P2P_iceServers;
+        delete settings.P2P_iceServersExpiresAt;
+        settings.P2P_turnServers = "";
+        settings.P2P_turnUsername = "";
+        settings.P2P_turnCredential = "";
+        settings.P2P_connectionPath = P2PConnectionPaths.Automatic;
+        return runOwnedTrial(settings);
+    });
     if (settlement.status === "observed-active") return { ok: true };
     if (settlement.status === "blocked") {
         return {

src/modules/features/SetupWizard/dialogs/p2pSetupConnectionProbe.unit.spec.ts

@@ -1,5 +1,6 @@
 import { describe, expect, it, vi } from "vitest";
 import { ACTIVE_P2P_RELAY_BINDING_CONFLICT, type P2PConnectionProbeAdmission } from "@vrtmrz/livesync-commonlib/p2p";
+import { DEFAULT_SETTINGS, P2PConnectionPaths } from "@vrtmrz/livesync-commonlib/compat/common/types";
 import {
     coordinateP2PSetupConnectionProbe,
     probeP2PSetupConnection,
@@ -7,6 +8,40 @@ import {
 } from "./p2pSetupConnectionProbe";
 
 describe("P2P setup connection probe", () => {
+    it("constructs a signalling-only trial when the draft selects managed TURN", async () => {
+        const settings = {
+            ...DEFAULT_SETTINGS,
+            P2P_managedType: "CF",
+            P2P_managedId: "test-key",
+            P2P_managedToken: "test-token",
+            P2P_iceServers: [
+                { urls: "turn:temporary.example.test", username: "issued-user", credential: "issued-password" },
+            ],
+            P2P_iceServersExpiresAt: 123456789,
+            P2P_turnServers: "turn:unused.example.test:3478",
+            P2P_turnUsername: "unused-user",
+            P2P_turnCredential: "unused-password",
+            P2P_connectionPath: P2PConnectionPaths.Relay,
+        };
+        const admission: P2PConnectionProbeAdmission = {
+            run: async (_settings, trial) => ({ status: "trial", result: await trial() }),
+        };
+        const result = await coordinateP2PSetupConnectionProbe(admission, settings, async (trial = settings) => {
+            expect(trial.P2P_managedType).toBeUndefined();
+            expect(trial.P2P_managedToken).toBeUndefined();
+            expect(trial.P2P_iceServers).toBeUndefined();
+            expect(trial.P2P_iceServersExpiresAt).toBeUndefined();
+            expect(trial.P2P_turnServers).toBe("");
+            expect(trial.P2P_turnUsername).toBe("");
+            expect(trial.P2P_turnCredential).toBe("");
+            expect(trial.P2P_connectionPath).toBe(P2PConnectionPaths.Automatic);
+            return { ok: true };
+        });
+        expect(result).toEqual({ ok: true });
+        expect(settings.P2P_managedToken).toBe("test-token");
+        expect(settings.P2P_connectionPath).toBe(P2PConnectionPaths.Relay);
+    });
+
     it("uses a compatible active signalling connection without constructing a trial", async () => {
         const runOwnedTrial = vi.fn(async (): Promise<P2PSetupConnectionProbeResult> => ({ ok: true }));
         const admission: P2PConnectionProbeAdmission = {

src/modules/main/ModuleLiveSyncMain.ts

@@ -17,6 +17,7 @@ import type { InjectableServiceHub } from "@vrtmrz/livesync-commonlib/compat/ser
 import type { LiveSyncCore } from "@/main.ts";
 import { initialiseWorkerModule } from "@vrtmrz/livesync-commonlib/compat/worker/bgWorker";
 import { manifestVersion, packageVersion } from "@vrtmrz/livesync-commonlib/compat/common/coreEnvVars";
+import { VaultScanResults } from "@vrtmrz/livesync-commonlib/compat/serviceFeatures/offlineScanner";
 
 export class ModuleLiveSyncMain extends AbstractModule {
     async _onLiveSyncReady() {
@@ -42,11 +43,23 @@ export class ModuleLiveSyncMain extends AbstractModule {
                 return false;
             }
         }
-        const isInitialized = await this.services.databaseEvents.initialiseDatabase(false, false);
-        if (!isInitialized) {
+        // Ordinary start-up may continue when individual files could not be
+        // processed. Explicit Fetch and Rebuild flows retain the strict default.
+        const { ignoreSuspending = false, continueOnFileFailure = true } = this.core.startupDatabaseOptions;
+        const initialisationResult = await this.services.databaseEvents.initialiseDatabase(
+            false,
+            false,
+            ignoreSuspending,
+            continueOnFileFailure
+        );
+        if (initialisationResult === VaultScanResults.FAILED) {
+            this._log($msg("Ui.Common.LocalDatabaseInitialisationFailed"), LOG_LEVEL_NOTICE);
             //TODO:stop all sync.
             return false;
         }
+        if (initialisationResult === VaultScanResults.COMPLETED_WITH_FILE_FAILURES) {
+            this._log($msg("Ui.Common.SomeFilesCouldNotBeSynchronised"), LOG_LEVEL_NOTICE);
+        }
         if (!(await this.core.services.appLifecycle.onFirstInitialise())) return false;
         // await this.core.$$realizeSettingSyncMode();
         await this.services.control.applySettings();

src/modules/main/ModuleLiveSyncMain.unit.spec.ts

@@ -0,0 +1,111 @@
+import { describe, expect, it, vi } from "vitest";
+import { LOG_LEVEL_NOTICE } from "@vrtmrz/livesync-commonlib/compat/common/types";
+
+vi.mock("@/common/events.ts", () => ({
+    EVENT_LAYOUT_READY: "layout-ready",
+    EVENT_PLUGIN_LOADED: "plugin-loaded",
+    EVENT_REQUEST_RELOAD_SETTING_TAB: "reload-setting-tab",
+    EVENT_SETTING_SAVED: "setting-saved",
+    eventHub: {
+        emitEvent: vi.fn(),
+        onEvent: vi.fn(),
+    },
+}));
+
+vi.mock("@/common/translation", () => ({
+    $msg: (message: string) => message,
+    setLang: vi.fn(),
+}));
+
+import { ModuleLiveSyncMain } from "./ModuleLiveSyncMain.ts";
+
+describe("ModuleLiveSyncMain", () => {
+    it("reports a database preparation failure at the application boundary", async () => {
+        const initialiseDatabase = vi.fn(async () => false);
+        const log = vi.fn();
+        const host = {
+            core: {
+                startupDatabaseOptions: {},
+                services: {
+                    appLifecycle: {
+                        onLayoutReady: vi.fn(async () => true),
+                    },
+                },
+            },
+            services: {
+                databaseEvents: { initialiseDatabase },
+            },
+            settings: {
+                suspendFileWatching: false,
+                suspendParseReplicationResult: false,
+            },
+            _log: log,
+        };
+
+        const result = await ModuleLiveSyncMain.prototype._onLiveSyncReady.call(host as never);
+
+        expect(result).toBe(false);
+        expect(initialiseDatabase).toHaveBeenCalledWith(false, false, false, true);
+        expect(log).toHaveBeenCalledWith("Ui.Common.LocalDatabaseInitialisationFailed", LOG_LEVEL_NOTICE);
+    });
+
+    it("warns when start-up continues with individual file failures", async () => {
+        const initialiseDatabase = vi.fn(async () => "completed-with-file-failures");
+        const log = vi.fn();
+        const appLifecycle = {
+            onLayoutReady: vi.fn(async () => true),
+            onFirstInitialise: vi.fn(async () => true),
+            onScanningStartupIssues: vi.fn(async () => true),
+        };
+        const host = {
+            core: {
+                startupDatabaseOptions: {},
+                services: { appLifecycle },
+            },
+            services: {
+                appLifecycle,
+                control: { applySettings: vi.fn(async () => undefined) },
+                databaseEvents: { initialiseDatabase },
+            },
+            settings: {
+                suspendFileWatching: false,
+                suspendParseReplicationResult: false,
+            },
+            _log: log,
+        };
+
+        const result = await ModuleLiveSyncMain.prototype._onLiveSyncReady.call(host as never);
+
+        expect(result).toBe(true);
+        expect(log).toHaveBeenCalledWith("Ui.Common.SomeFilesCouldNotBeSynchronised", LOG_LEVEL_NOTICE);
+    });
+
+    it("passes strict startup database options to initialisation", async () => {
+        const initialiseDatabase = vi.fn(async () => false);
+        const host = {
+            core: {
+                startupDatabaseOptions: {
+                    ignoreSuspending: true,
+                    continueOnFileFailure: false,
+                },
+                services: {
+                    appLifecycle: {
+                        onLayoutReady: vi.fn(async () => true),
+                    },
+                },
+            },
+            services: {
+                databaseEvents: { initialiseDatabase },
+            },
+            settings: {
+                suspendFileWatching: false,
+                suspendParseReplicationResult: false,
+            },
+            _log: vi.fn(),
+        };
+
+        await ModuleLiveSyncMain.prototype._onLiveSyncReady.call(host as never);
+
+        expect(initialiseDatabase).toHaveBeenCalledWith(false, false, true, false);
+    });
+});

src/serviceFeatures/redFlag.ts

@@ -7,13 +7,9 @@ import {
 } from "@vrtmrz/livesync-commonlib/compat/common/models/redflag.const";
 import FetchEverything from "@/modules/features/SetupWizard/dialogs/FetchEverything.svelte";
 import RebuildEverything from "@/modules/features/SetupWizard/dialogs/RebuildEverything.svelte";
-import { extractObject } from "octagonal-wheels/object";
 import { REMOTE_MINIO, REMOTE_P2P } from "@vrtmrz/livesync-commonlib/compat/common/models/setting.const";
-import type { ObsidianLiveSyncSettings } from "@vrtmrz/livesync-commonlib/settings";
-import {
-    RemotePreferredTweakStatuses,
-    TweakValuesShouldMatchedTemplate,
-} from "@vrtmrz/livesync-commonlib/compat/common/models/tweak.definition";
+import { assessTweakCompatibility, type ObsidianLiveSyncSettings } from "@vrtmrz/livesync-commonlib/settings";
+import { RemotePreferredTweakStatuses } from "@vrtmrz/livesync-commonlib/compat/common/models/tweak.definition";
 import type {
     FetchEverythingResult,
     RebuildEverythingResult,
@@ -301,12 +297,8 @@ export async function adjustSettingToRemote(
         }
 
         const remoteTweaks = remoteResult.values;
-        const necessary = extractObject(TweakValuesShouldMatchedTemplate, remoteTweaks);
-        // Check if any necessary tweak value is different from current config.
-        const differentItems = Object.entries(necessary).filter(([key, value]) => {
-            return config[key as keyof ObsidianLiveSyncSettings] !== value;
-        });
-        if (differentItems.length === 0) {
+        const assessment = assessTweakCompatibility(config, remoteTweaks);
+        if (assessment.alignment === "matched") {
             log("Remote configuration matches local configuration. No changes applied.", LOG_LEVEL_NOTICE);
         } else {
             await host.services.UI.confirm.askSelectStringDialogue(
@@ -321,7 +313,7 @@ export async function adjustSettingToRemote(
 
         config = {
             ...config,
-            ...(Object.fromEntries(differentItems) as Partial<ObsidianLiveSyncSettings>),
+            ...assessment.adoptPreferred.changes,
         } satisfies ObsidianLiveSyncSettings;
         await host.services.setting.applyExternalSettings(config, true);
         log("Remote configuration applied.", LOG_LEVEL_NOTICE);

src/serviceFeatures/redFlag.unit.spec.ts

@@ -19,9 +19,11 @@ import {
     flagHandlerToEventHandler,
 } from "./redFlag";
 import {
+    DEFAULT_SETTINGS,
     TweakValuesRecommendedTemplate,
     TweakValuesShouldMatchedTemplate,
     TweakValuesTemplate,
+    type TweakValues,
 } from "@vrtmrz/livesync-commonlib/compat/common/types";
 import {
     ExtraOnLocal,
@@ -1149,6 +1151,26 @@ describe("Red Flag Feature", () => {
     });
 
     describe("Remote configuration adjustment", () => {
+        it("compatibility: preserves the local filename-case value when the remote omits it", async () => {
+            const host = createHostMock();
+            const config = {
+                ...DEFAULT_SETTINGS,
+                ...TweakValuesShouldMatchedTemplate,
+                handleFilenameCaseSensitive: false,
+            };
+            const remote: TweakValues = { ...TweakValuesShouldMatchedTemplate };
+            delete remote.handleFilenameCaseSensitive;
+            host.mocks.tweakValue.fetchRemotePreferred.mockResolvedValueOnce(availableRemoteTweaks(remote));
+
+            await adjustSettingToRemote(host as any, createLoggerMock(), config);
+
+            expect(host.mocks.ui.confirm.askSelectStringDialogue).not.toHaveBeenCalled();
+            expect(host.mocks.setting.applyExternalSettings).toHaveBeenCalledWith(
+                expect.objectContaining({ handleFilenameCaseSensitive: false }),
+                true
+            );
+        });
+
         it("keeps this device's E2EE settings when preparing to overwrite the remote", async () => {
             const host = createHostMock();
             Object.assign(host.mocks.setting.settings, TweakValuesShouldMatchedTemplate, {

src/serviceFeatures/replication/ReplicateResultProcessor.ts

@@ -25,6 +25,7 @@ import type { LiveSyncBaseCore } from "@/LiveSyncBaseCore";
 import { isNotFoundError } from "@vrtmrz/livesync-commonlib/compat/common/utils.doc";
 import type PouchDB from "pouchdb-core";
 import { promiseWithResolvers, type PromiseWithResolvers } from "octagonal-wheels/promises";
+import { $msg } from "@/common/translation";
 
 const KV_KEY_REPLICATION_RESULT_PROCESSOR_SNAPSHOT = "replicationResultProcessorSnapshot";
 const REPROCESS_BATCH_SIZE = 100;
@@ -79,6 +80,14 @@ export class ReplicateResultProcessor {
     private logError(e: unknown) {
         Logger(e, LOG_LEVEL_VERBOSE);
     }
+    private reportVaultReflectionFailure(entry: MetaEntry, cause?: unknown) {
+        this.log(
+            `Live replication could not reflect ${this.getPath(entry)} from the local database to the Vault; this path remains eligible for a later Vault scan.`,
+            LOG_LEVEL_VERBOSE
+        );
+        if (cause !== undefined) this.logError(cause);
+        Logger($msg("Ui.Common.SomeFilesCouldNotBeSynchronised"), LOG_LEVEL_NOTICE);
+    }
     constructor(private readonly context: ReplicateResultProcessorContext) {}
 
     private get localDatabase() {
@@ -510,8 +519,16 @@ export class ReplicateResultProcessor {
                 this.log(`Processed by other processor: ${docNote}`, LOG_LEVEL_DEBUG);
             } else if (this.services.vault.isValidPath(this.getPath(doc))) {
                 // Apply to storage if the path is valid
-                await this.applyToStorage(doc as MetaEntry);
-                this.log(`Processed: ${docNote}`, LOG_LEVEL_DEBUG);
+                try {
+                    const reflected = await this.applyToStorage(doc as MetaEntry);
+                    if (!reflected) {
+                        this.reportVaultReflectionFailure(doc as MetaEntry);
+                        return;
+                    }
+                    this.log(`Processed: ${docNote}`, LOG_LEVEL_DEBUG);
+                } catch (error) {
+                    this.reportVaultReflectionFailure(doc as MetaEntry, error);
+                }
             } else {
                 // Should process, but have an invalid path
                 this.log(`Unprocessed (Invalid path): ${docNote}`, LOG_LEVEL_VERBOSE);
@@ -525,9 +542,10 @@ export class ReplicateResultProcessor {
      * @returns
      */
     protected applyToStorage(entry: MetaEntry) {
-        return this.withCounting(async () => {
-            await this.services.replication.processSynchroniseResult(entry);
-        }, this.services.replication.storageApplyingCount);
+        return this.withCounting(
+            () => this.services.replication.processSynchroniseResult(entry),
+            this.services.replication.storageApplyingCount
+        );
     }
 
     /**

src/serviceFeatures/replication/ReplicateResultProcessor.unit.spec.ts

@@ -2,6 +2,13 @@ import { promiseWithResolvers } from "octagonal-wheels/promises";
 import { reactiveSource } from "octagonal-wheels/dataobject/reactive";
 import { describe, expect, it, vi } from "vitest";
 import { VER, type EntryDoc } from "@vrtmrz/livesync-commonlib/compat/common/types";
+import {
+    defaultLogger,
+    LOG_LEVEL_DEBUG,
+    LOG_LEVEL_NOTICE,
+    LOG_LEVEL_VERBOSE,
+    setGlobalLogFunction,
+} from "octagonal-wheels/common/logger";
 import { ReplicateResultProcessor } from "./ReplicateResultProcessor";
 
 function note(id: string): PouchDB.Core.ExistingDocument<EntryDoc> {
@@ -21,12 +28,12 @@ function note(id: string): PouchDB.Core.ExistingDocument<EntryDoc> {
 
 type SetupOptions = {
     applicationReady?: boolean;
-    processSynchroniseResult?: (entry: unknown) => Promise<void>;
+    processSynchroniseResult?: (entry: unknown) => Promise<boolean>;
     setSnapshot?: (key: string, value: unknown) => Promise<unknown>;
 };
 
 function setup(options: SetupOptions = {}) {
-    const processSynchroniseResult = vi.fn(options.processSynchroniseResult ?? (async () => undefined));
+    const processSynchroniseResult = vi.fn(options.processSynchroniseResult ?? (async () => true));
     const setSnapshot = vi.fn(options.setSnapshot ?? (async () => undefined));
     const runBoundedLocalApplicationActivity = vi.fn(async (task: () => Promise<void>) => await task());
     const onCloseActiveReplication = vi.fn(async () => true);
@@ -120,7 +127,7 @@ describe("ReplicateResultProcessor", () => {
     });
 
     it("keeps one local application activity until every replicated document has been applied", async () => {
-        const applying = promiseWithResolvers<void>();
+        const applying = promiseWithResolvers<boolean>();
         let activityFinished = false;
         const { processor, processSynchroniseResult, runBoundedLocalApplicationActivity } = setup({
             processSynchroniseResult: async () => applying.promise,
@@ -139,7 +146,7 @@ describe("ReplicateResultProcessor", () => {
         });
         expect(activityFinished).toBe(false);
 
-        applying.resolve();
+        applying.resolve(true);
 
         await vi.waitFor(() => expect(activityFinished).toBe(true));
     });
@@ -160,7 +167,7 @@ describe("ReplicateResultProcessor", () => {
     });
 
     it("releases and reacquires local application activity around processing suspension", async () => {
-        const applying = promiseWithResolvers<void>();
+        const applying = promiseWithResolvers<boolean>();
         let completedActivities = 0;
         const { processor, processSynchroniseResult, runBoundedLocalApplicationActivity } = setup({
             processSynchroniseResult: async () => applying.promise,
@@ -178,7 +185,47 @@ describe("ReplicateResultProcessor", () => {
         processor.resume();
         await vi.waitFor(() => expect(runBoundedLocalApplicationActivity).toHaveBeenCalledTimes(2));
 
-        applying.resolve();
+        applying.resolve(true);
         await vi.waitFor(() => expect(completedActivities).toBe(2));
     });
+
+    it.each([
+        ["returns false", async () => false, undefined],
+        ["throws", async () => Promise.reject(new Error("File name too long")), "File name too long"],
+    ])("reports when Vault reflection %s", async (_description, processSynchroniseResult, errorMessage) => {
+        const log = vi.fn((_message: unknown, _level?: number) => undefined);
+        setGlobalLogFunction(log);
+        try {
+            const { processor } = setup({ processSynchroniseResult });
+
+            processor.enqueueAll([note("unreflectable")]);
+
+            await vi.waitFor(() =>
+                expect(log).toHaveBeenCalledWith(
+                    "Not all files could be synchronised. Check the affected files. Generate a report to review the detailed log.",
+                    LOG_LEVEL_NOTICE,
+                    undefined
+                )
+            );
+            expect(log).toHaveBeenCalledWith(
+                "[ReplicateResultProcessor] Live replication could not reflect unreflectable.md from the local database to the Vault; this path remains eligible for a later Vault scan.",
+                LOG_LEVEL_VERBOSE,
+                undefined
+            );
+            if (errorMessage !== undefined) {
+                expect(log).toHaveBeenCalledWith(
+                    expect.objectContaining({ message: errorMessage }),
+                    LOG_LEVEL_VERBOSE,
+                    undefined
+                );
+            }
+            expect(log).not.toHaveBeenCalledWith(
+                expect.stringContaining("Processed: unreflectable.md"),
+                LOG_LEVEL_DEBUG,
+                undefined
+            );
+        } finally {
+            setGlobalLogFunction(defaultLogger);
+        }
+    });
 });

src/serviceFeatures/replication/centralCompatibilityRecovery.ts

@@ -1,4 +1,5 @@
 import type { ObsidianLiveSyncSettings } from "@vrtmrz/livesync-commonlib/compat/common/types";
+import { assessTweakCompatibility } from "@vrtmrz/livesync-commonlib/settings";
 import { LOG_LEVEL_INFO, LOG_LEVEL_NOTICE, Logger } from "octagonal-wheels/common/logger";
 import { skipIfDuplicated } from "octagonal-wheels/concurrency/lock";
 import { balanceChunkPurgedDBs, purgeUnreferencedChunks } from "@vrtmrz/livesync-commonlib/compat/pouchdb/chunks";
@@ -15,7 +16,7 @@ import type { LiveSyncBaseCore } from "@/LiveSyncBaseCore";
 
 type CentralCompatibilityRecoveryServices = Pick<
     LiveSyncBaseCore["services"],
-    "API" | "appLifecycle" | "replicator" | "tweakValue"
+    "API" | "appLifecycle" | "replicator" | "setting" | "tweakValue"
 >;
 
 /** Collaborators for applying a compatibility decision to its failed publication. */
@@ -145,6 +146,15 @@ Even if you choose to clean up, you will see this option again if you exit Obsid
             recovery.reason === CENTRAL_COMPATIBILITY_REJECTION_REASONS.TWEAK_MISMATCH &&
             recovery.preferredTweakValue
         ) {
+            const isCurrent = await context.services.replicator.runWithActiveReplicatorContext(
+                (activeContext) => activeContext === failedContext
+            );
+            // Compare in memory only: these snapshots can contain connection credentials.
+            if (!isCurrent || JSON.stringify(setting) !== JSON.stringify(context.services.setting.currentSettings())) {
+                return false;
+            }
+            const assessment =
+                recovery.tweakAssessment ?? assessTweakCompatibility(setting, recovery.preferredTweakValue);
             await context.services.tweakValue.askResolvingMismatched(
                 recovery.preferredTweakValue,
                 async (effectiveSetting) => {
@@ -156,7 +166,8 @@ Even if you choose to clean up, you will see this option again if you exit Obsid
                         updated = true;
                     });
                     return updated;
-                }
+                },
+                assessment
             );
             return false;
         }

src/serviceFeatures/replication/centralCompatibilityRecovery.unit.spec.ts

@@ -1,5 +1,6 @@
 import { describe, expect, it, vi } from "vitest";
 import type { ObsidianLiveSyncSettings } from "@vrtmrz/livesync-commonlib/compat/common/types";
+import { assessTweakCompatibility } from "@vrtmrz/livesync-commonlib/settings";
 import { defaultLogger, LOG_LEVEL_INFO, LOG_LEVEL_NOTICE, setGlobalLogFunction } from "octagonal-wheels/common/logger";
 import {
     CENTRAL_COMPATIBILITY_REJECTION_REASONS,
@@ -23,6 +24,72 @@ import { LiveSyncCouchDBReplicator } from "@vrtmrz/livesync-commonlib/compat/rep
 import { createCentralCompatibilityRecovery } from "./centralCompatibilityRecovery";
 
 describe("central compatibility recovery", () => {
+    it("passes the failed attempt's exact tweak assessment to mismatch resolution", async () => {
+        const setting = { customChunkSize: 0 };
+        const preferredTweakValue = { customChunkSize: 60 };
+        const tweakAssessment = assessTweakCompatibility(setting, preferredTweakValue);
+        const failedContext = { provider: {}, replicator: {} };
+        const askResolvingMismatched = vi.fn(async (..._args: unknown[]) => "CHECKAGAIN");
+        const recovery = createCentralCompatibilityRecovery({
+            services: {
+                setting: { currentSettings: () => setting },
+                replicator: {
+                    runWithActiveReplicatorContext: async (task: (context: unknown) => unknown) => task(failedContext),
+                },
+                tweakValue: { askResolvingMismatched },
+            },
+        } as never);
+
+        const result = await recovery.handleReplicationFailure({
+            context: failedContext,
+            setting,
+            outcome: replicationFailed(new Error("mismatched"), {
+                reason: CENTRAL_COMPATIBILITY_REJECTION_REASONS.TWEAK_MISMATCH,
+                preferredTweakValue,
+                tweakAssessment,
+            }),
+            progressPresentation: REPLICATION_PROGRESS_PRESENTATIONS.QUIET,
+            interaction: USER_INITIATED_REPLICATION_AUTHORITY,
+        } as never);
+
+        expect(askResolvingMismatched.mock.calls[0][2]).toBe(tweakAssessment);
+        expect(result).toBe(false);
+    });
+
+    it.each(["settings", "publication"])(
+        "discards a mismatch after its %s changed before recovery",
+        async (changed) => {
+            const setting = { customChunkSize: 0, couchDB_DBNAME: "original" };
+            const failedContext = { provider: {}, replicator: {} };
+            const currentContext = changed === "publication" ? { provider: {}, replicator: {} } : failedContext;
+            const currentSetting = changed === "settings" ? { ...setting, couchDB_DBNAME: "replacement" } : setting;
+            const askResolvingMismatched = vi.fn(async () => "CHECKAGAIN");
+            const recovery = createCentralCompatibilityRecovery({
+                services: {
+                    setting: { currentSettings: () => currentSetting },
+                    replicator: {
+                        runWithActiveReplicatorContext: async (task: (context: unknown) => unknown) =>
+                            task(currentContext),
+                    },
+                    tweakValue: { askResolvingMismatched },
+                },
+            } as never);
+
+            await recovery.handleReplicationFailure({
+                context: failedContext,
+                setting,
+                outcome: replicationFailed(new Error("mismatched"), {
+                    reason: CENTRAL_COMPATIBILITY_REJECTION_REASONS.TWEAK_MISMATCH,
+                    preferredTweakValue: { customChunkSize: 60 },
+                }),
+                progressPresentation: REPLICATION_PROGRESS_PRESENTATIONS.QUIET,
+                interaction: USER_INITIATED_REPLICATION_AUTHORITY,
+            } as never);
+
+            expect(askResolvingMismatched).not.toHaveBeenCalled();
+        }
+    );
+
     it("characterises unattended central failure handling as one INFO log without a NOTICE", async () => {
         const log = vi.fn((_message: unknown, _level?: number, _key?: string) => undefined);
         setGlobalLogFunction(log);
@@ -69,6 +136,7 @@ describe("central compatibility recovery", () => {
         };
         const failedContext = { provider: {}, replicator: failedReplicator };
         const replacementContext = { provider: {}, replicator: replacementReplicator };
+        let activeContext = failedContext;
         const preferredTweakValue = { customChunkSize: 60 };
         const outcome = replicationFailed(new Error("mismatched"), {
             reason: CENTRAL_COMPATIBILITY_REJECTION_REASONS.TWEAK_MISMATCH,
@@ -81,9 +149,10 @@ describe("central compatibility recovery", () => {
             services: {
                 appLifecycle: {},
                 API: {},
+                setting: { currentSettings: () => ({}) },
                 replicator: {
                     runWithActiveReplicatorContext: vi.fn(async (task: (context: unknown) => unknown) =>
-                        task(replacementContext)
+                        task(activeContext)
                     ),
                 },
                 tweakValue: { askResolvingMismatched },
@@ -118,10 +187,15 @@ describe("central compatibility recovery", () => {
             progressPresentation: REPLICATION_PROGRESS_PRESENTATIONS.QUIET,
             interaction: USER_INITIATED_REPLICATION_AUTHORITY,
         } as never);
-        expect(askResolvingMismatched).toHaveBeenCalledWith(preferredTweakValue, expect.any(Function));
+        expect(askResolvingMismatched).toHaveBeenCalledWith(
+            preferredTweakValue,
+            expect.any(Function),
+            assessTweakCompatibility({}, preferredTweakValue)
+        );
         const updatePreferredRemote = askResolvingMismatched.mock.calls[0][1] as (
             setting: Record<string, unknown>
         ) => Promise<boolean>;
+        activeContext = replacementContext;
         await expect(updatePreferredRemote({ customChunkSize: 64 })).resolves.toBe(false);
         expect(failedSetPreferred).not.toHaveBeenCalled();
         expect(replacementSetPreferred).not.toHaveBeenCalled();
@@ -143,6 +217,7 @@ describe("central compatibility recovery", () => {
             services: {
                 appLifecycle: {},
                 API: {},
+                setting: { currentSettings: () => ({}) },
                 replicator: {
                     runWithActiveReplicatorContext: vi.fn(async (task: (context: unknown) => unknown) =>
                         task(failedContext)

src/serviceFeatures/replication/index.ts

@@ -86,6 +86,7 @@ export function useReplicationFeature<TContext extends ServiceContext, TCommands
             API: services.API,
             appLifecycle: services.appLifecycle,
             replicator: services.replicator,
+            setting: services.setting,
             tweakValue: services.tweakValue,
         },
     });

src/serviceFeatures/setupObsidian/qrCode.ts

@@ -9,7 +9,8 @@ import { fireAndForget } from "@vrtmrz/livesync-commonlib/compat/common/utils";
 import type { SetupFeatureHost } from "./types";
 
 export async function encodeSetupSettingsAsQR(host: SetupFeatureHost) {
-    const settingString = encodeSettingsToQRCodeData(host.services.setting.currentSettings());
+    const settings = host.services.setting.currentSettings();
+    const settingString = encodeSettingsToQRCodeData(settings);
     const result = encodeQR(settingString, OutputFormat.SVG);
     if (result === "") {
         return "";

src/serviceFeatures/setupObsidian/qrCode.unit.spec.ts

@@ -3,6 +3,9 @@ import { EVENT_REQUEST_SHOW_SETUP_QR } from "@vrtmrz/livesync-commonlib/compat/e
 import { createServiceContext } from "@vrtmrz/livesync-commonlib/context";
 import { encodeSetupSettingsAsQR, useSetupQRCodeFeature } from "./qrCode";
 import { encodeQR, encodeSettingsToQRCodeData } from "@vrtmrz/livesync-commonlib/compat/API/processSetting";
+import { copySetupURI } from "./setupUri";
+
+vi.mock("./setupUri", () => ({ copySetupURI: vi.fn() }));
 
 vi.mock("@vrtmrz/livesync-commonlib/compat/API/processSetting", () => {
     return {
@@ -15,6 +18,32 @@ vi.mock("@vrtmrz/livesync-commonlib/compat/API/processSetting", () => {
 });
 
 describe("setupObsidian/qrCode", () => {
+    it("shows managed TURN settings and inactive profiles through the ordinary QR dialogue", async () => {
+        const settings = {
+            remoteConfigurations: {
+                managed: { uri: "sls+p2p://room?managedType=CF&managedId=turn-key&token=private-token" },
+            },
+        };
+        const confirmWithMessage = vi.fn();
+        const translate = vi.fn(() => "qr-message");
+        const host = {
+            services: {
+                API: { addLog: vi.fn() },
+                context: createServiceContext({ translate }),
+                setting: { currentSettings: () => settings },
+                UI: { confirm: { confirmWithMessage } },
+            },
+        } as any;
+        vi.mocked(encodeSettingsToQRCodeData).mockReturnValue("encoded-settings");
+        vi.mocked(encodeQR).mockReturnValue("<svg/>");
+
+        expect(await encodeSetupSettingsAsQR(host)).toBe("<svg/>");
+        expect(encodeSettingsToQRCodeData).toHaveBeenCalledWith(settings);
+        expect(translate).toHaveBeenCalledWith("Setup.QRCode", { qr_image: "<svg/>" });
+        expect(confirmWithMessage).toHaveBeenCalledWith("Settings QR Code", "qr-message", ["OK"], "OK");
+        expect(copySetupURI).not.toHaveBeenCalled();
+    });
+
     afterEach(() => {
         vi.restoreAllMocks();
         vi.clearAllMocks();

src/serviceFeatures/useP2PSettingsPreparation.ts

@@ -0,0 +1,18 @@
+import type { P2PSyncSetting } from "@vrtmrz/livesync-commonlib/compat/common/types";
+import { acquireCloudflareTurnCredentials, type CloudflareTurnFetch } from "@/integrations/cloudflare/turnCredentials";
+import { validateManagedTurnSettings } from "@/integrations/turnSettings";
+
+/** Prepare a connection copy using the host's HTTP adapter. */
+export function useP2PSettingsPreparation(fetch: CloudflareTurnFetch) {
+    return async (settings: Readonly<P2PSyncSetting>, signal: AbortSignal): Promise<P2PSyncSetting> => {
+        const error = validateManagedTurnSettings(settings);
+        if (error) throw new Error(error);
+        if (!settings.P2P_managedType) return { ...settings };
+        const { iceServers, expiresAt } = await acquireCloudflareTurnCredentials(
+            { turnKeyId: settings.P2P_managedId ?? "", apiToken: settings.P2P_managedToken ?? "" },
+            { fetch },
+            signal
+        );
+        return { ...settings, P2P_iceServers: iceServers, P2P_iceServersExpiresAt: expiresAt };
+    };
+}

src/serviceFeatures/useP2PSettingsPreparation.unit.spec.ts

@@ -0,0 +1,48 @@
+import { describe, expect, it, vi } from "vitest";
+import { DEFAULT_SETTINGS } from "@vrtmrz/livesync-commonlib/compat/common/types";
+import { useP2PSettingsPreparation } from "./useP2PSettingsPreparation";
+
+const managed = {
+    ...DEFAULT_SETTINGS,
+    P2P_managedType: "CF",
+    P2P_managedId: "key-123",
+    P2P_managedToken: "test-token",
+};
+
+describe("host preparation of P2P settings", () => {
+    it("puts issued ICE credentials on a connection copy without changing saved inputs", async () => {
+        const iceServers = [
+            { urls: ["turn:relay.example.test:3478"], username: "issued-user", credential: "issued-password" },
+        ];
+        const fetch = vi.fn(async () => new Response(JSON.stringify({ iceServers }), { status: 201 }));
+        const before = structuredClone(managed);
+        const settings = await useP2PSettingsPreparation(fetch)(managed, new AbortController().signal);
+        expect(settings.P2P_iceServers).toEqual(iceServers);
+        expect(settings.P2P_iceServersExpiresAt).toBeGreaterThan(Date.now());
+        expect(managed).toEqual(before);
+        expect(settings).not.toBe(managed);
+        expect(fetch).toHaveBeenCalledOnce();
+    });
+
+    it("keeps manual settings and rejects an unsupported provider without HTTP requests", async () => {
+        const fetch = vi.fn();
+        const prepare = useP2PSettingsPreparation(fetch);
+        await expect(prepare(DEFAULT_SETTINGS, new AbortController().signal)).resolves.toEqual(DEFAULT_SETTINGS);
+        await expect(prepare({ ...managed, P2P_managedType: "unknown" }, new AbortController().signal)).rejects.toThrow(
+            "not supported"
+        );
+        await expect(
+            prepare({ ...managed, P2P_managedToken: "invalid token" }, new AbortController().signal)
+        ).rejects.toThrow("Bearer token syntax");
+        expect(fetch).not.toHaveBeenCalled();
+    });
+
+    it("propagates a safe acquisition failure without using the manual TURN fields", async () => {
+        const fetch = vi.fn(async () => new Response(null, { status: 401 }));
+        const prepare = useP2PSettingsPreparation(fetch);
+        await expect(
+            prepare({ ...managed, P2P_turnServers: "turn:manual.example.test" }, new AbortController().signal)
+        ).rejects.toThrow("not authorised");
+        expect(fetch).toHaveBeenCalledOnce();
+    });
+});

test/apps/webapp/WebAppRuntime.unit.spec.ts

@@ -27,7 +27,7 @@ const runtimeMocks = vi.hoisted(() => {
     };
 
     const serviceHub = {
-        API: { addLog },
+        API: { addLog, webCompatFetch: vi.fn() },
         appLifecycle: { isReady, markIsReady },
         control: { onLoad, onReady, onUnload },
         databaseEvents: { onDatabaseInitialised },