@@ -13,6 +13,7 @@ function result(overrides: Partial<BrowseResult> = {}): BrowseResult {
     parent: '/',
     directories: ['sub1', 'sub2'],
     errorMessage: null,
+    badPath: false,
     ...overrides,
   };
 }
@@ -112,8 +113,8 @@ describe('DirectoryPickerComponent', () => {
     expect(cancelled).toBe(true);
   });
 
-  function failure(errorMessage: string): BrowseResult {
-    return { success: false, path: null, parent: null, directories: [], errorMessage };
+  function failure(errorMessage: string, badPath = true): BrowseResult {
+    return { success: false, path: null, parent: null, directories: [], errorMessage, badPath };
   }
 
   it('falls back to the nearest listable ancestor when the initial path fails, keeping the error', () => {
@@ -138,17 +139,26 @@ describe('DirectoryPickerComponent', () => {
   });
 
   it('stops at "/" and disables Select when nothing lists', () => {
-    mockBrowserService.browseRemote.mockReturnValue(of(failure('Connection refused')));
+    mockBrowserService.browseRemote.mockReturnValue(of(failure('No such file or directory')));
     const fixture = createFixture('remote', '~/gone');
 
     expect(mockBrowserService.browseRemote.mock.calls.map((c) => c[0])).toEqual(['~/gone', '~', '/']);
-    expect(fixture.componentInstance.errorMessage).toBe('Connection refused');
+    expect(fixture.componentInstance.errorMessage).toBe('No such file or directory');
     const select = Array.from(fixture.nativeElement.querySelectorAll('button') as NodeListOf<HTMLButtonElement>).find(
       (b) => b.textContent?.includes('Select This Folder'),
     );
     expect(select?.disabled).toBe(true);
   });
 
+  it('does not walk up on a connection failure, which would be one more SSH login per ancestor', () => {
+    mockBrowserService.browseRemote.mockReturnValue(of(failure('Connection refused', false)));
+    const component = createComponent('remote', '/downloads/a/b/c');
+
+    expect(mockBrowserService.browseRemote).toHaveBeenCalledTimes(1);
+    expect(component.errorMessage).toBe('Connection refused');
+    expect(component.loaded).toBe(false);
+  });
+
   it('does not walk up when a later navigation fails', () => {
     const component = createComponent('local', '/downloads');
     mockBrowserService.browseLocal.mockClear();
@@ -165,7 +175,7 @@ describe('DirectoryPickerComponent', () => {
       of(result({ success: true, errorMessage: null })).pipe(),
     );
     mockBrowserService.browseLocal.mockReturnValue(
-      of({ success: false, path: null, parent: null, directories: [], errorMessage: 'Permission denied' }),
+      of(failure('Permission denied')),
     );
 
     component.onEnterDirectory('locked');
 
@@ -72,8 +72,10 @@ export class DirectoryPickerComponent implements OnInit {
   }
 
   /** @param fallBackToParent Initial load only: if the configured path no longer
-   * lists (renamed, now a file), walk up its ancestors to the first one that
-   * does, keeping the original error visible, so the picker isn't a dead end. */
+   * exists (renamed, now a file), walk up its ancestors to the first one that
+   * lists, keeping the original error visible, so the picker isn't a dead end.
+   * Connection-level failures stop immediately: each remote step is a fresh
+   * SSH login, and retrying one that just failed is what the lockout avoids. */
   private load(path: string, options?: { fallBackToParent?: boolean; keepError?: string }): void {
     this.loading = true;
     this.errorMessage = options?.keepError ?? null;
@@ -88,7 +90,7 @@ export class DirectoryPickerComponent implements OnInit {
         this.directories = result.directories;
       } else {
         const error = options?.keepError ?? result.errorMessage;
-        const parent = options?.fallBackToParent ? parentPathOf(path) : null;
+        const parent = options?.fallBackToParent && result.badPath ? parentPathOf(path) : null;
         if (parent !== null) {
           this.load(parent, { fallBackToParent: true, keepError: error ?? undefined });
           return;
 
@@ -1,16 +1,16 @@
 import '@angular/compiler';
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { Subject, Subscription } from 'rxjs';
-import { debounceTime, distinctUntilChanged } from 'rxjs/operators';
+import { debounceTime } from 'rxjs/operators';
 import { TestBed } from '@angular/core/testing';
 import { ComponentFixture } from '@angular/core/testing';
 
 import { OptionComponent, OptionType, OptionValue, DEBOUNCE_TIME_MS } from './option.component';
 import { REDACTED_SENTINEL } from '../../models/config';
 
 /**
- * Test the debounce/distinctUntilChanged pipe logic directly using the same
- * operators as OptionComponent, avoiding Angular component lifecycle timing issues.
+ * Test the debounce pipe logic directly using the same operator as
+ * OptionComponent, avoiding Angular component lifecycle timing issues.
  */
 describe('OptionComponent — debounce pipe logic', () => {
   let newValue: Subject<OptionValue>;
@@ -22,7 +22,7 @@ describe('OptionComponent — debounce pipe logic', () => {
     newValue = new Subject<OptionValue>();
     emitted = [];
     subscription = newValue
-      .pipe(debounceTime(DEBOUNCE_TIME_MS), distinctUntilChanged())
+      .pipe(debounceTime(DEBOUNCE_TIME_MS))
       .subscribe((val) => emitted.push(val));
   });
 
@@ -52,16 +52,6 @@ describe('OptionComponent — debounce pipe logic', () => {
     expect(emitted).toEqual(['c']);
   });
 
-  it('should not re-emit same value after full debounce period (distinctUntilChanged)', () => {
-    newValue.next('same');
-    vi.advanceTimersByTime(DEBOUNCE_TIME_MS);
-    expect(emitted).toEqual(['same']);
-
-    newValue.next('same');
-    vi.advanceTimersByTime(DEBOUNCE_TIME_MS);
-    expect(emitted).toEqual(['same']);
-  });
-
   it('should emit different values after each debounce period', () => {
     newValue.next('first');
     vi.advanceTimersByTime(DEBOUNCE_TIME_MS);
@@ -92,6 +82,30 @@ describe('OptionComponent — onChange and effectiveChoices', () => {
     vi.useRealTimers();
   });
 
+  it('emits only when the typed value differs from the bound value, even after an external change', () => {
+    vi.useFakeTimers();
+    fixture.componentRef.setInput('value', '/a');
+    fixture.detectChanges();
+    const emitted: OptionValue[] = [];
+    component.changeEvent.subscribe((v) => emitted.push(v));
+
+    component.onChange('/a');
+    vi.advanceTimersByTime(DEBOUNCE_TIME_MS);
+    expect(emitted).toEqual([]);
+
+    component.onChange('/b');
+    vi.advanceTimersByTime(DEBOUNCE_TIME_MS);
+    expect(emitted).toEqual(['/b']);
+
+    // The directory picker saves '/x' through a different path; typing '/b'
+    // again is a real change now and must not be swallowed.
+    fixture.componentRef.setInput('value', '/x');
+    fixture.detectChanges();
+    component.onChange('/b');
+    vi.advanceTimersByTime(DEBOUNCE_TIME_MS);
+    expect(emitted).toEqual(['/b', '/b']);
+  });
+
   it('should suppress REDACTED_SENTINEL for password type', () => {
     fixture.componentRef.setInput('type', OptionType.Password);
     fixture.detectChanges();
 
@@ -1,6 +1,6 @@
 import { Component, ChangeDetectionStrategy, OnInit, OnDestroy, input, output, computed } from '@angular/core';
 import { FormsModule } from '@angular/forms';
-import { Subject, Subscription, debounceTime, distinctUntilChanged } from 'rxjs';
+import { Subject, Subscription, debounceTime, filter } from 'rxjs';
 import { REDACTED_SENTINEL } from '../../models/config';
 
 export enum OptionType {
@@ -63,8 +63,11 @@ export class OptionComponent implements OnInit, OnDestroy {
   private subscription?: Subscription;
 
   ngOnInit(): void {
+    // Compare against the bound value, not the last emission: the value can
+    // also change from outside (e.g. the directory picker), after which
+    // re-typing the previously emitted value is a real change again.
     this.subscription = this.newValue
-      .pipe(debounceTime(DEBOUNCE_TIME_MS), distinctUntilChanged())
+      .pipe(debounceTime(DEBOUNCE_TIME_MS), filter((val) => val !== this.value()))
       .subscribe({ next: (val) => this.changeEvent.emit(val) });
   }
 
 
@@ -185,6 +185,25 @@ describe('SettingsPageComponent connection-field changes invalidate a verified c
 
     expect(component.connectionVerified).toBe(true);
   });
+
+  it('discards a Test Connection result that was in flight when a connection field changed', () => {
+    const resultSubject = new Subject<ConnectionTestResult>();
+    const testConnection = TestBed.inject(ConnectionTestService).testConnection as ReturnType<typeof vi.fn>;
+    testConnection.mockReturnValue(resultSubject.asObservable());
+    component.connectionVerified = false;
+    component.connectionLockedOut = false;
+
+    component.onTestConnection();
+    component.onSetConfig('lftp', 'remote_password', 'new-password');
+    setSubject.next({ success: true, data: 'lftp.remote_password updated', errorMessage: null });
+    resultSubject.next({ success: false, message: 'Incorrect password', credentialError: true });
+
+    expect(component.connectionLockedOut).toBe(false);
+    expect(component.connectionVerified).toBe(false);
+    expect(component.connectionResult).toBeNull();
+    expect(component.testingConnection).toBe(false);
+    expect(component.connectionTestInFlight).toBe(false);
+  });
 });
 
 describe('SettingsPageComponent directory picker', () => {
 
@@ -109,6 +109,9 @@ export class SettingsPageComponent implements OnInit {
   /** Set for both manual tests and the silent page-load probe, so a click
    * can't start a second SSH login while one is still running. */
   connectionTestInFlight = false;
+  /** Bumped when a connection field changes so a test started against
+   * the old credentials can't mark the new ones verified (or locked out). */
+  private connectionTestSeq = 0;
   connectionResult: TestResult | null = null;
   /** True once a Test Connection call has succeeded against the currently
    * saved lftp connection fields. Gates the Server Directory picker. */
@@ -137,6 +140,15 @@ export class SettingsPageComponent implements OnInit {
   private badValueNotifs = new Map<string, Notification>();
 
   ngOnInit(): void {
+    // Seed from the shared flag so a revisit doesn't re-lock the Server
+    // Directory picker (and re-probe) when the connection is already verified.
+    this.connectionStatusService.verified$.pipe(
+      takeUntilDestroyed(this.destroyRef),
+    ).subscribe((verified) => {
+      this.connectionVerified = verified;
+      this.cdr.markForCheck();
+    });
+
     this.connectedService.connected$.pipe(
       takeUntilDestroyed(this.destroyRef),
     ).subscribe({
@@ -185,7 +197,8 @@ export class SettingsPageComponent implements OnInit {
       take(1),
       takeUntilDestroyed(this.destroyRef),
     ).subscribe(([config]) => {
-      if (config.lftp?.remote_address && config.lftp?.remote_username && config.lftp?.remote_port) {
+      const configured = config.lftp?.remote_address && config.lftp?.remote_username && config.lftp?.remote_port;
+      if (configured && !this.connectionVerified) {
         this.onTestConnection({ silent: true });
       }
     });
@@ -231,6 +244,9 @@ export class SettingsPageComponent implements OnInit {
           // and clears a credential-error lockout since the credentials are
           // no longer what caused it.
           if (section === 'lftp' && CONNECTION_FIELDS.has(option)) {
+            this.connectionTestSeq++;
+            this.connectionTestInFlight = false;
+            this.testingConnection = false;
             this.setConnectionVerified(false);
             this.connectionResult = null;
             this.connectionLockedOut = false;
@@ -249,6 +265,7 @@ export class SettingsPageComponent implements OnInit {
 
           this.logger.error(reaction.errorMessage);
         }
+        this.cdr.markForCheck();
       },
     });
   }
@@ -302,9 +319,14 @@ export class SettingsPageComponent implements OnInit {
     if (!silent) {
       this.connectionResult = null;
     }
+    this.cdr.markForCheck();
+    const seq = ++this.connectionTestSeq;
     this.connectionTestService.testConnection().pipe(
       takeUntilDestroyed(this.destroyRef),
     ).subscribe((result) => {
+      if (seq !== this.connectionTestSeq) {
+        return; // credentials changed mid-flight; result is for the old ones
+      }
       this.connectionTestInFlight = false;
       this.testingConnection = false;
       if (!silent) {
 
@@ -40,6 +40,7 @@ describe('DirectoryBrowserService', () => {
       parent: '/',
       directories: ['a', 'b'],
       errorMessage: null,
+      badPath: false,
     });
   });
 
@@ -69,6 +70,19 @@ describe('DirectoryBrowserService', () => {
     expect(result!.success).toBe(false);
     expect(result!.errorMessage).toBe('Connection refused');
     expect(result!.directories).toEqual([]);
+    expect(result!.badPath).toBe(false);
+  });
+
+  it('flags a 400 as a bad path so the picker can walk up to a parent', () => {
+    let result: BrowseResult | undefined;
+    service.browseRemote('/gone').subscribe((r) => (result = r));
+
+    httpMock.expectOne((r) => r.url === '/server/browse/remote').flush(
+      { error: 'find: /gone: No such file or directory' },
+      { status: 400, statusText: 'Bad Request' },
+    );
+
+    expect(result!.badPath).toBe(true);
   });
 
   it('falls back to a generic message when the error body is unparsable', () => {
 
@@ -10,6 +10,9 @@ export interface BrowseResult {
   readonly parent: string | null;
   readonly directories: string[];
   readonly errorMessage: string | null;
+  /** True when the server rejected the path itself (400) rather than failing
+   * to reach the filesystem (502) — the picker only walks up on the former. */
+  readonly badPath: boolean;
 }
 
 interface BrowseResponse {
@@ -42,6 +45,7 @@ export class DirectoryBrowserService {
         parent: body.parent,
         directories: body.directories,
         errorMessage: null,
+        badPath: false,
       })),
       catchError((err: HttpErrorResponse) =>
         of({
@@ -50,6 +54,7 @@ export class DirectoryBrowserService {
           parent: null,
           directories: [],
           errorMessage: failureFromHttpError(err, 'Failed to browse directory').message,
+          badPath: err.status === 400,
         }),
       ),
     );
 
@@ -300,18 +300,18 @@ def _handle_controller_failure(self, controller_job: ControllerJob, e: Exception
         set up before the loop starts: status.server.up/error_msg surface the
         error in the UI, and the controller only restarts via an explicit
         restart request (same as any other change requiring one), not
-        automatically. controller_job's own thread has already run its
-        cleanup (see Job.run()/ControllerJob.cleanup(), which calls
-        Controller.exit()) by the time propagate_exception() has something to
-        raise, so terminate()/join() here just formally reap it.
+        automatically. controller_job's thread records the exception before
+        running its cleanup (see Job.run()/ControllerJob.cleanup(), which
+        calls Controller.exit()), so join() here waits for that teardown.
         """
         if isinstance(e, (ServiceExit, ServiceRestart)) or self.context.args.exit or not is_credential_error(str(e)):
             raise e
         self.context.logger.exception("Controller stopped due to a credential error; web app remains available")
-        controller_job.terminate()
-        controller_job.join()
+        # Publish the error first: join() waits for Controller.exit() to finish.
         self.context.status.server.up = False
         self.context.status.server.error_msg = str(e)
+        controller_job.terminate()
+        controller_job.join()
 
     def persist(self):
         # Save the persists
 
@@ -67,6 +67,12 @@ def test_nonexistent_path_is_rejected(self):
         )
         self.assertEqual(400, resp.status_int)
 
+    def test_tilde_expands_to_home(self):
+        with patch.dict(os.environ, {"HOME": self.browse_root}):
+            resp = self.test_app.get("/server/browse/local", {"path": "~"})
+        self.assertEqual(200, resp.status_int)
+        self.assertEqual(self.browse_root, json.loads(resp.text)["path"])
+
 
 class TestBrowseHandlerRemote(BaseTestWebApp):
     def _configure_remote(self):
@@ -123,6 +129,20 @@ def test_ssh_failure_surfaces_error(self):
         body = json.loads(resp.text)
         self.assertEqual("Connection refused", body["error"])
 
+    def test_missing_remote_directory_is_a_bad_request_not_a_gateway_error(self):
+        self._configure_remote()
+        error = SshcpError("find: /remote/gone: No such file or directory")
+        with patch("ssh.lftp_ssh.Sshcp.shell", side_effect=error):
+            resp = self.test_app.get("/server/browse/remote", {"path": "/remote/gone"}, expect_errors=True)
+        self.assertEqual(400, resp.status_int)
+        self.assertIn("No such file or directory", json.loads(resp.text)["error"])
+
+    def test_directory_names_are_split_on_newline_only(self):
+        self._configure_remote()
+        with patch("ssh.lftp_ssh.Sshcp.shell", return_value=b"/remote/dir/Foo\x0bBar\n"):
+            resp = self.test_app.get("/server/browse/remote", {"path": "/remote/dir"})
+        self.assertEqual(["Foo\x0bBar"], json.loads(resp.text)["directories"])
+
     def test_path_with_spaces_is_shell_quoted(self):
         self._configure_remote()
         with patch("ssh.lftp_ssh.Sshcp.shell", return_value=b"") as mock_shell: