Updated sts_handle_capability to return FALSE after logging the no‑TLS warning, so the insecure upgrade path doesn’t stop capability negotiation; it still returns TRUE only when an STS upgrade/reconnect is initiated or already in progress.

Confirmed inbound_cap_ls only returns early when sts_upgrade_triggered is set by sts_handle_capability, which now only happens for real upgrade/reconnect initiation or in‑progress upgrades.

src/common/sts.c

@@ -588,12 +588,13 @@ sts_handle_capability (struct server *serv, const char *value)
 			serv->disconnect (serv->server_session, FALSE, -1);
 			serv->connect (serv, host_copy, (int) port, serv->no_login);
 		}
+		return TRUE;
 #else
 		PrintTextf (serv->server_session,
 					_("STS upgrade requested for %s, but TLS is not available.\n"),
 					hostname);
+		return FALSE;
 #endif
-		return TRUE;
 	}
 
 	if (!has_duration)