Merge branch 'main' into claude/vault-unlock-logout-autosync-a84c35

Four files needed a hand, and all four were two branches adding something in
the same place rather than either changing what the other did.

The shell's constructor now takes both new parameters: main's SFTP session
factory, which it must have because it builds the transfers view model, and
this branch's optional resume handler, which stays last so every existing test
that constructs a shell without one still gets a shell that can only be online
because somebody signed in during this run. App.axaml.cs, ShellFlowTests and
QuickConnectTests pass the pair; the layout suite keeps both of its new fields.

Signing out now detaches the transfers screen exactly as locking does, and the
confirmation says that an open transfer session survives it. That is the same
policy both sides already argue for their own case: signing out destroys this
machine's copy of the vault, not work that authenticated before it.

QuickConnectTests did not compile on main — the SFTP commit added a constructor
parameter and the quick-connect suite, merged from a parallel branch just
before it, was still calling the old one. Fixed here rather than worked around,
since the merged tree has to build.

dotnet build, dotnet test and dotnet format --verify-no-changes are all clean:
980 tests, including the end-to-end suite against real containers.

docs/design-import-gaps.md

@@ -18,9 +18,13 @@ M2 and M3 arriving in a design before it arrives in the code.
 Three facts explain nearly every row below.
 
 **An SSH connection here opens exactly one channel.** `ISshConnection` offers `OpenShellAsync` and nothing
-else (`src/DodoSSH.Client.Ssh/SshConnection.cs`). No SFTP subsystem, no port forwarding, no ProxyJump. That
-one fact removes the whole file-transfer screen, the `FORWARDS` chip, the status bar's port list, and every
-`via bastion-eu` in the design.
+else (`src/DodoSSH.Client.Ssh/SshConnection.cs`). No port forwarding, no ProxyJump. That one fact removes
+the `FORWARDS` chip, the status bar's port list, and every `via bastion-eu` in the design.
+
+It used to remove the file-transfer screen too. M2 did not lift the restriction — it worked around it:
+file transfer is a *separate connection* rather than a second channel, because SSH.NET's `SftpClient` owns
+its own transport. See [File transfer](#file-transfer-the-designs-sftp-screen), which is the one place in
+this document where what shipped differs from what the row predicted.
 
 **Teams are schema and nothing else.** The `team` and `team_membership` tables exist from the first
 migration, with entities in `DodoSSH.Domain/Teams.cs` and a `TeamRole` enum — and no endpoint reads or
@@ -50,7 +54,7 @@ protocol rather than a protocol change.
 | `⌘K` command palette running commands | client-domain | A snippet or saved-command item type (`SyncEntityType.Snippet = 8` is reserved). | Ctrl+K opens a real host search that connects on Enter. The box says "search hosts", not "search hosts · run command". |
 | Status bar `· via bastion-eu` | client-ssh | Jump-host execution. See below. | Omitted. |
 | Status bar port forwards | client-ssh | Port forwarding. See below. | Omitted. |
-| Status bar `sftp · 2 transfers` | client-ssh | File transfer. See below. | Omitted. |
+| Status bar `sftp · 2 transfers` | client-app | Nothing now — file transfer is built. What is missing is the count reaching the status bar, which is a screen away from where the queue lives. | Omitted from the status bar. The queue itself is on the FILES screen, with a row per transfer. |
 | Status bar `locks in 09:41` | client-app | An idle auto-lock. See preferences below. | Omitted. |
 | IBM Plex Mono / IBM Plex Sans | ui | Shipping the font files as `AvaloniaResource` and registering them. The design loads them from Google Fonts, which a desktop app cannot. | Inter (already embedded) for prose, and the system monospace stack the terminal already names. Named once in `App.axaml` as `MonoFont`, so the substitution is reversible in one place. |
 | `⌘K`, `⌥↵` | ui | Nothing; the design is Mac-flavoured. | `CTRL K`. Development is Windows-only today (`docs/platform-flags.md`). |
@@ -86,18 +90,36 @@ caption buttons and window title drawn on top of the application's own — two s
 
 ## File transfer (the design's SFTP screen)
 
-Nothing on this screen exists. It is listed in the nav rail and reaches a screen that says so, naming the
-milestone and what is missing — see `ShellScreen` for why it is not simply dropped from the rail.
+**Built in M2.** The screen ships: two directory panes, a breadcrumb trail on each, and a queue that moves
+one file at a time with progress, throughput and resume. What follows is what it does *not* do, and one
+thing this document got wrong before it was built.
 
-| Design element | Layer | What it would take |
+**The correction.** The row below used to say an SFTP subsystem channel on `ISshConnection` was what it
+would take. SSH.NET does not offer that: `SftpClient` derives from `BaseClient` and owns its own transport,
+and there is no supported way to hand it a session an `SshClient` already has. So the transfers screen
+**opens a second authenticated connection** to the host rather than a second channel on the terminal's. That
+is visible to a user — the host records a second login, and a host whose password is typed each time asks
+for it again on this screen — so it is named for what it is: `ISftpSessionFactory.OpenSftpAsync` is a
+connect, and it goes through the same host key gate, the same pin and the same two refusals a shell does.
+
+| Design element | Layer | What ships |
 | --- | --- | --- |
-| SFTP itself | client-ssh | An SFTP subsystem channel on `ISshConnection`. There is no `SftpClient`, `ScpClient` or transfer type anywhere in `src/`. |
-| Remote listing with `NAME/SIZE/MODIFIED/PERMS` | client-ssh | The channel, plus a listing record and a POSIX mode formatter — nothing in the repo formats a `drwxr-xr-x`. |
-| Local listing | client-app | The App project contains no `System.IO` usage at all. The only paths this client knows are its own two files. |
-| Path breadcrumbs, per-host last directory | client-storage | Navigation state for two panes, and somewhere to persist it. There is no settings table. |
-| Transfer queue, progress, throughput | client-ssh | A transfer engine. **Do not reach for `CreditWindow`** — that is a 256 KiB flow-control window for terminal output, not a transfer primitive. |
-| `resume supported` | client-ssh | Offset-based reads and writes, plus partial-transfer bookkeeping that survives a restart. |
-| `sftp over bastion-eu` | client-ssh | Jump hosts, as above. |
+| SFTP itself | client-ssh | `ISftpSession` over SSH.NET's `SftpClient`: listing, stat, offset-based read and write, mkdir, delete and rename. Delete is deliberately **not** recursive. |
+| Remote listing with `NAME/SIZE/MODIFIED/PERMS` | client-ssh | All four. `PosixMode` renders `drwxr-xr-x` from the bits SFTP hands over; setuid, setgid and sticky are not shown, because SSH.NET does not surface them and `rwx` where `rws` is true would be worse than nothing. |
+| Local listing | client-transfer | `LocalDirectory`, which is where this client's `System.IO` now lives. `PERMS` is blank on the local side rather than filled with a plausible-looking POSIX mode that is not a fact about a file on Windows. |
+| Transfer queue, progress, throughput | client-transfer | `FileTransferQueue`. One transfer at a time, so the rate on a row is the rate of the link rather than a share of it. Throughput is measured over a half-second window, not averaged since the start. |
+| `resume supported` | client-transfer | **Within a run of the application.** Every transfer writes to a `.dodossh-part` file beside its destination and is renamed into place at the end, so an interrupted one can never be mistaken for a finished one, and `RESUME` carries on from the part file's own length. A part file found at startup is *not* resumed: nothing records what wrote it, and resuming on the strength of a name matching is how a corrupt artefact gets delivered with nothing reporting a failure. Making it survive a restart needs the preferences store this client has not got — see below. |
+
+| Design element | Layer | What it would take | What ships instead |
+| --- | --- | --- | --- |
+| Per-host last directory | client-storage | Somewhere to persist two panes' navigation state. There is still no settings table. | The remote pane opens on the account's home directory, which the server canonicalises during the handshake; the local pane opens on the user profile. |
+| `sftp over bastion-eu` | client-ssh | Jump hosts, as above. `HostSecret.JumpHostIds` is still stored, synced, merged and read by nothing. | Omitted. |
+| Overwriting a file that is already there | ui | A prompt, which means a modal this window has no idiom for. | Refused, with the name that is in the way. The remote pane has DELETE and MKDIR so the refusal is not a dead end. |
+| Dragging between the panes | ui | Drag-and-drop between two `ListBox`es, plus a drop target that is a directory rather than a row. | Two arrow buttons between the panes, pointing at the pane the file is going to. |
+| Transferring a directory | client-transfer | Recursive enumeration on both sides, and a policy for what a partial directory means. | One file at a time. A directory cannot be selected as a transfer source. |
+
+**Not to be reached for:** `CreditWindow` is a 256 KiB flow-control window for terminal output, not a
+transfer primitive. The queue does its own 64 KiB copy loop and shares nothing with the terminal data plane.
 
 ---