Merge branch 'main' into claude/vault-unlock-logout-autosync-a84c35

Four files needed a hand, and all four were two branches adding something in
the same place rather than either changing what the other did.

The shell's constructor now takes both new parameters: main's SFTP session
factory, which it must have because it builds the transfers view model, and
this branch's optional resume handler, which stays last so every existing test
that constructs a shell without one still gets a shell that can only be online
because somebody signed in during this run. App.axaml.cs, ShellFlowTests and
QuickConnectTests pass the pair; the layout suite keeps both of its new fields.

Signing out now detaches the transfers screen exactly as locking does, and the
confirmation says that an open transfer session survives it. That is the same
policy both sides already argue for their own case: signing out destroys this
machine's copy of the vault, not work that authenticated before it.

QuickConnectTests did not compile on main — the SFTP commit added a constructor
parameter and the quick-connect suite, merged from a parallel branch just
before it, was still calling the old one. Fixed here rather than worked around,
since the merged tree has to build.

dotnet build, dotnet test and dotnet format --verify-no-changes are all clean:
980 tests, including the end-to-end suite against real containers.

src/DodoSSH.Client.App/Views/MainWindow.axaml

@@ -184,20 +184,15 @@
           </Grid>
 
           <!-- ============ FILES ============ -->
-          <views:NotBuiltScreen IsVisible="{Binding IsTransfersScreen}"
-                                Title="FILE TRANSFER"
-                                Milestone="MILESTONE M2"
-                                Summary="The design shows a two-pane file browser over SFTP with a transfer queue. None of it is here: an SSH connection in this build opens exactly one interactive shell channel and nothing else, so there is no file transfer to show the state of."
-                                Instead="Until this lands, move files the way you would from any terminal — scp or rsync from a shell on this machine, or a shell open on the host itself.">
-            <views:NotBuiltScreen.Missing>
-              <sys:List x:TypeArguments="x:String">
-                <x:String>An SFTP subsystem channel on ISshConnection, which today offers OpenShellAsync and nothing more (DodoSSH.Client.Ssh).</x:String>
-                <x:String>Remote directory listing — names, sizes, modification times and permission bits (DodoSSH.Client.Ssh).</x:String>
-                <x:String>A transfer queue with progress, throughput and resume, and somewhere for it to live across a lock (DodoSSH.Client.Ssh, DodoSSH.Client.Session).</x:String>
-                <x:String>Routing a transfer through a bastion, which needs jump-host support the connection layer does not have — the host model already records the chain.</x:String>
-              </sys:List>
-            </views:NotBuiltScreen.Missing>
-          </views:NotBuiltScreen>
+          <!--
+            Wrapped rather than bound directly, for the same reason the vault screen is: this element's
+            visibility is the shell's business and its data context is the transfers view model, and putting
+            both on one element resolves IsVisible against that view model, where IsTransfersScreen does not
+            exist.
+          -->
+          <Panel IsVisible="{Binding IsTransfersScreen}">
+            <views:TransfersScreen DataContext="{Binding Transfers}" />
+          </Panel>
 
           <!-- ============ VAULT ============ -->
           <!--

src/DodoSSH.Client.App/Views/MainWindow.axaml.cs

@@ -96,9 +96,15 @@ internal sealed partial class MainWindow : Window
     /// </summary>
     /// <remarks>
     /// <para>
-    /// A tunnelled handler rather than <c>KeyBindings</c>, because three of these four keys have to be
-    /// intercepted before the control under the pointer sees them: Escape and the arrows belong to the
-    /// palette while it is open, and the palette's own text box would otherwise eat them.
+    /// Ctrl+K is here rather than on the palette because it has to work when the palette is not showing, and
+    /// it is a plain handler rather than a <c>KeyBinding</c> so that toggling stays one code path with the
+    /// rest of the chord set.
+    /// </para>
+    /// <para>
+    /// The palette's own keys are forwarded rather than answered: <see cref="QuickConnect"/> intercepts them
+    /// on their way down while the focus is inside it, and this is the net for when it is not — a press that
+    /// arrives with nothing focused, or from a control on the screen behind, still has to close the palette
+    /// rather than fall through to whatever is underneath it.
     /// </para>
     /// <para>
     /// None of this reaches the terminal, and it does not need to. Once the WebView's child window holds
@@ -121,61 +127,12 @@ internal sealed partial class MainWindow : Window
         }
         else if (viewModel.IsSearching)
         {
-            HandlePaletteKey(viewModel, e);
+            Palette.HandleKey(e);
         }
 
         base.OnKeyDown(e);
     }
 
-    /// <remarks>
-    /// The selection is moved here rather than by letting the list take focus, because the list taking
-    /// focus is exactly what would stop the query box receiving the next character typed.
-    /// </remarks>
-    private static void HandlePaletteKey(MainWindowViewModel viewModel, KeyEventArgs e)
-    {
-        switch (e.Key)
-        {
-            case Key.Escape:
-                viewModel.CloseSearchCommand.Execute(null);
-                e.Handled = true;
-                break;
-
-            case Key.Enter:
-                viewModel.ConnectToSearchResultCommand.Execute(null);
-                e.Handled = true;
-                break;
-
-            case Key.Down:
-                Move(viewModel, 1);
-                e.Handled = true;
-                break;
-
-            case Key.Up:
-                Move(viewModel, -1);
-                e.Handled = true;
-                break;
-
-            default:
-                break;
-        }
-    }
-
-    /// <remarks>Clamped rather than wrapped: a list that jumps from the last row to the first loses people.</remarks>
-    private static void Move(MainWindowViewModel viewModel, int delta)
-    {
-        if (viewModel.SearchResults.Count == 0)
-        {
-            return;
-        }
-
-        var current = viewModel.SelectedSearchResult is { } selected
-            ? viewModel.SearchResults.IndexOf(selected)
-            : -1;
-
-        viewModel.SelectedSearchResult =
-            viewModel.SearchResults[Math.Clamp(current + delta, 0, viewModel.SearchResults.Count - 1)];
-    }
-
     private void Attach(MainWindowViewModel? viewModel)
     {
         if (shell is { } previous)
@@ -233,11 +190,18 @@ internal sealed partial class MainWindow : Window
             return;
         }
 
-        // The palette is a text box somebody is expected to start typing into immediately, so opening it
-        // has to move the caret there — including out of the terminal, which needs the Win32 half as well.
+        // Closing only. Opening also has to move the keyboard — the palette is a text box somebody is
+        // expected to start typing into immediately — but the palette does that for itself when it becomes
+        // visible, which is a moment this handler is measurably ahead of: it runs from the view model's
+        // PropertyChanged, before the binding that reveals the control, and Focus() on a control that is
+        // still collapsed is a no-op that is not replayed when it is revealed.
         if (string.Equals(e.PropertyName, nameof(MainWindowViewModel.IsSearching), StringComparison.Ordinal))
         {
-            ReleaseKeyboardTo(viewModel.IsSearching ? Palette.QueryBox : KeyboardHome);
+            if (!viewModel.IsSearching)
+            {
+                ReleaseKeyboardTo(KeyboardHome);
+            }
+
             return;
         }
 

src/DodoSSH.Client.App/Views/NavRail.axaml

@@ -7,11 +7,11 @@
   <!--
     Five destinations down the left edge.
 
-    Two of them — TRANSFERS and TEAM — reach screens that say they are not built. They are in the rail
-    anyway rather than dropped, and the reasoning is in ShellScreen: the milestones are public, the screens
-    behind these two say plainly what is missing, and a rail that quietly had three entries would make file
-    transfer and sharing look like a change of product rather than the next two milestones. Both are
-    recorded in docs/design-import-gaps.md.
+    One of them — TEAM — reaches a screen that says it is not built. It is in the rail anyway rather than
+    dropped, and the reasoning is in ShellScreen: the milestones are public, the screen behind it says
+    plainly what is missing, and a rail that quietly had four entries would make sharing look like a change
+    of product rather than the next milestone. It is recorded in docs/design-import-gaps.md. FILES was the
+    other one until M2 built it.
 
     Buttons rather than a TabStrip or a ListBox, for the same reason the vault's category rail is: all three
     of those hold the selection themselves, so a click moves the highlight before the shell can decide
@@ -30,7 +30,7 @@
         <Button Classes="flat nav" Content="FILES" Classes.active="{Binding IsTransfersScreen}"
                 Command="{Binding ShowScreenCommand}"
                 CommandParameter="{x:Static vm:ShellScreen.Transfers}"
-                ToolTip.Tip="File transfer over SSH. Not built yet — see the screen for what is missing." />
+                ToolTip.Tip="Move files to and from a host over SFTP" />
         <Button Classes="flat nav" Content="VAULT" Classes.active="{Binding IsVaultScreen}"
                 Command="{Binding ShowScreenCommand}"
                 CommandParameter="{x:Static vm:ShellScreen.Vault}"

src/DodoSSH.Client.App/Views/QuickConnect.axaml

@@ -21,7 +21,13 @@
     an overlay across the middle of this window would be painted underneath it and take no clicks.
   -->
 
-  <Border Background="#CC0A0C0B">
+  <!--
+    The wash is named and takes a press, because clicking away from a palette is how every palette closes.
+    The handler answers only for presses whose source is the wash itself, which is what separates "outside"
+    from "inside": a press anywhere on the card below reports that control as its source and bubbles through
+    here on its way to the window.
+  -->
+  <Border x:Name="Backdrop" Background="#CC0A0C0B" PointerPressed="OnBackdropPressed">
     <Border Width="520" VerticalAlignment="Top" Margin="0,90,0,0"
             Background="{StaticResource Chrome}" BorderBrush="{StaticResource BorderMid}"
             BorderThickness="1" CornerRadius="6">
@@ -39,8 +45,8 @@
         </Border>
 
         <!--
-          Arrow keys move the selection and Enter takes it; the window's key handler owns both, because a
-          ListBox that took focus would take the arrow keys away from the box being typed into.
+          Arrow keys move the selection and Enter takes it; the code-behind owns both, because a ListBox that
+          took focus would take the arrow keys away from the box being typed into.
         -->
         <ListBox x:Name="Results" MaxHeight="280" Focusable="False"
                  ItemsSource="{Binding SearchResults}"

src/DodoSSH.Client.App/Views/QuickConnect.axaml.cs

@@ -1,17 +1,174 @@
+using Avalonia;
 using Avalonia.Controls;
+using Avalonia.Input;
+using Avalonia.Interactivity;
+using Avalonia.Threading;
+using DodoSSH.Client.App.ViewModels;
 
 namespace DodoSSH.Client.App.Views;
 
 /// <summary>The Ctrl+K host search, overlaid on the window.</summary>
 /// <remarks>
-/// The keys it responds to are handled by <see cref="MainWindow"/> rather than here, because two of them —
-/// Ctrl+K to open and Escape to close — have to work when this control does not exist yet or has just
-/// stopped existing. Handling the arrows in the same place keeps the whole chord set in one method.
+/// <para>
+/// Everything a palette does once it is open belongs here rather than in <see cref="MainWindow"/>: the four
+/// keys it answers to, the press outside it that dismisses it, and taking the keyboard the moment it appears.
+/// Opening it is the window's business, because Ctrl+K has to work when this control is not showing.
+/// </para>
+/// <para>
+/// The split used to fall the other way, and the cost was that none of it could be tested. Showing
+/// <see cref="MainWindow"/> initialises WebView2, which refuses the headless dispatcher's thread — see
+/// <c>LayoutHarnessTests.WhyTheWindowItselfIsNeverShown</c> — so behaviour that lived on the window could only
+/// be checked by hand. A <see cref="UserControl"/> hosts in a bare window and takes real key and pointer
+/// input.
+/// </para>
 /// </remarks>
 internal sealed partial class QuickConnect : UserControl
 {
-    public QuickConnect() => InitializeComponent();
+    public QuickConnect()
+    {
+        InitializeComponent();
 
-    /// <summary>The box, so the window can put the caret in it the moment the palette opens.</summary>
+        // Tunnelled, and deliberately: the query box below is on the route these keys take, and a text box
+        // that grows a use for Enter or the arrows — a multi-line box, a completion list — would take them
+        // before a bubbling handler here ever ran. The palette owns them while it is open, so it says so at
+        // the point on the route where nothing else has had a chance yet.
+        AddHandler(KeyDownEvent, OnPaletteKey, RoutingStrategies.Tunnel);
+    }
+
+    /// <summary>The box, so the caret can be put in it the moment the palette opens.</summary>
     internal TextBox QueryBox => Query;
+
+    private MainWindowViewModel? Shell => DataContext as MainWindowViewModel;
+
+    /// <summary>
+    /// Answers one of the palette's keys, wherever in the window it was pressed.
+    /// </summary>
+    /// <remarks>
+    /// Internal because <see cref="MainWindow"/> calls it too, for the case this control's own tunnelled
+    /// handler cannot see: a key routes through here only while the focus is inside the palette, and the
+    /// window is what catches Escape when it is not.
+    /// </remarks>
+    internal void HandleKey(KeyEventArgs e)
+    {
+        ArgumentNullException.ThrowIfNull(e);
+
+        if (Shell is not { IsSearching: true } shell)
+        {
+            return;
+        }
+
+        switch (e.Key)
+        {
+            case Key.Escape:
+                shell.CloseSearchCommand.Execute(null);
+                e.Handled = true;
+                break;
+
+            case Key.Enter:
+                shell.ConnectToSearchResultCommand.Execute(null);
+                e.Handled = true;
+                break;
+
+            case Key.Down:
+                Move(shell, 1);
+                e.Handled = true;
+                break;
+
+            case Key.Up:
+                Move(shell, -1);
+                e.Handled = true;
+                break;
+
+            default:
+                break;
+        }
+    }
+
+    /// <summary>
+    /// Takes the keyboard, so the palette can be typed into the instant it appears.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// Both halves, for the reason <see cref="NativeKeyboardFocus"/> gives: the terminal's WebView is a native
+    /// child window that keeps Win32 focus even after it is collapsed, so focusing an Avalonia control without
+    /// the Win32 call produces a box with a caret in it that silently receives nothing.
+    /// </para>
+    /// <para>
+    /// Done here rather than by the window, and that is the fix rather than a tidying. <c>Focus()</c> on a
+    /// collapsed control is measurably a no-op that is not replayed when the control is revealed, and the
+    /// window's own attempt ran from the view model's <c>PropertyChanged</c> — ahead of the binding that makes
+    /// this control visible, so it focused a control that was still collapsed and the keyboard stayed wherever
+    /// it was.
+    /// </para>
+    /// <para>
+    /// Becoming visible is still too early on its own, which is why this is posted rather than called. A
+    /// control that has never been laid out has no visual children — measured: at the instant
+    /// <c>IsVisible</c> turns true the query box reports <c>IsAttachedToVisualTree() == false</c>, and focus is
+    /// refused to anything not in the tree. Layout runs at a higher priority than this callback, so by the
+    /// time it is picked up the box exists.
+    /// </para>
+    /// </remarks>
+    private void TakeKeyboard()
+    {
+        // The palette can have been dismissed between the post and the callback — a press on the wash, or a
+        // second Ctrl+K — and stealing the keyboard back into a control nobody can see would be worse than
+        // arriving late.
+        if (!IsVisible)
+        {
+            return;
+        }
+
+        if (TopLevel.GetTopLevel(this) is Window window)
+        {
+            NativeKeyboardFocus.ReturnTo(window);
+        }
+
+        Query.Focus();
+    }
+
+    /// <remarks>Clamped rather than wrapped: a list that jumps from the last row to the first loses people.</remarks>
+    private static void Move(MainWindowViewModel shell, int delta)
+    {
+        if (shell.SearchResults.Count == 0)
+        {
+            return;
+        }
+
+        var current = shell.SelectedSearchResult is { } selected
+            ? shell.SearchResults.IndexOf(selected)
+            : -1;
+
+        shell.SelectedSearchResult =
+            shell.SearchResults[Math.Clamp(current + delta, 0, shell.SearchResults.Count - 1)];
+    }
+
+    /// <inheritdoc />
+    protected override void OnPropertyChanged(AvaloniaPropertyChangedEventArgs change)
+    {
+        // Base first, so the visibility this control has just been given has already reached its descendants:
+        // focus is refused to anything not effectively visible, and the box below is a descendant.
+        base.OnPropertyChanged(change);
+
+        if (change.Property == IsVisibleProperty && change.GetNewValue<bool>())
+        {
+            Dispatcher.UIThread.Post(TakeKeyboard, DispatcherPriority.Loaded);
+        }
+    }
+
+    private void OnPaletteKey(object? sender, KeyEventArgs e) => HandleKey(e);
+
+    /// <remarks>
+    /// Only a press on the wash itself. Presses on the card bubble through here as well, and closing on those
+    /// would make the palette impossible to click into.
+    /// </remarks>
+    private void OnBackdropPressed(object? sender, PointerPressedEventArgs e)
+    {
+        if (!ReferenceEquals(e.Source, Backdrop) || Shell is not { IsSearching: true } shell)
+        {
+            return;
+        }
+
+        shell.CloseSearchCommand.Execute(null);
+        e.Handled = true;
+    }
 }

src/DodoSSH.Client.App/Views/SignOutCard.axaml

@@ -41,6 +41,15 @@
       </StackPanel>
     </Border>
 
+    <!--
+      The other thing that outlives signing out, on the same reasoning and worth its own line because it is
+      a connection this machine holds rather than a window it shows: a transfer in flight authenticated
+      before any of this and keeps writing into its part file afterwards.
+    -->
+    <TextBlock Classes="hint" FontSize="11" TextWrapping="Wrap"
+               IsVisible="{Binding Transfers.IsConnected, FallbackValue=False}"
+               Text="A file-transfer session is open on this machine. Signing out does not close it either — it goes when DodoSSH does." />
+
     <StackPanel Orientation="Horizontal" Spacing="8">
       <Button Classes="danger" Content="SIGN OUT AND DELETE"
               Command="{Binding ConfirmSignOutCommand}" IsEnabled="{Binding !IsBusy}" />

src/DodoSSH.Client.App/Views/TransfersScreen.axaml

@@ -0,0 +1,404 @@
+<UserControl xmlns="https://github.com/avaloniaui"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             xmlns:vm="using:DodoSSH.Client.App.ViewModels"
+             x:Class="DodoSSH.Client.App.Views.TransfersScreen"
+             x:DataType="vm:TransfersViewModel">
+
+  <!--
+    File transfer: this machine on the left, the host on the right, and the queue underneath.
+
+    Two things about this screen are worth knowing before reading the markup. It has its own CONNECT
+    button, because SSH.NET cannot open an SFTP subsystem on a transport that is already carrying a shell —
+    so browsing a host's files is a second authenticated connection rather than a second channel, and
+    pretending otherwise would hide a second login from the person whose audit log it appears in. And the
+    panes are symmetrical apart from one column: PERMS is remote-only, because a POSIX mode is not a fact
+    about a file on the machine this client is developed on.
+
+    What the design has and this does not: `sftp over bastion-eu`, which needs jump hosts the connection
+    layer has not got. See docs/design-import-gaps.md.
+  -->
+
+  <UserControl.Styles>
+    <!--
+      A directory is marked by colour rather than by an icon: this application ships no icon set, and the
+      palette already reserves blue for "a directory, a distinct scope" — see App.axaml, where it is
+      described as deliberately rare. This is the one place it is spent.
+    -->
+    <Style Selector="TextBlock.entry">
+      <Setter Property="Foreground" Value="{StaticResource Text}" />
+    </Style>
+    <Style Selector="TextBlock.entry.dir">
+      <Setter Property="Foreground" Value="{StaticResource Info}" />
+    </Style>
+  </UserControl.Styles>
+
+  <Grid RowDefinitions="44,*,Auto">
+
+    <!-- ============ The host, and the connection ============ -->
+    <Border Grid.Row="0" Padding="14,0" BorderBrush="{StaticResource Border}" BorderThickness="0,0,0,1">
+      <Grid ColumnDefinitions="Auto,180,Auto,Auto,Auto,*" VerticalAlignment="Center">
+
+        <TextBlock Grid.Column="0" Classes="mono" Text="FILES" FontSize="11" FontWeight="SemiBold"
+                   LetterSpacing="1" Foreground="{StaticResource Text}" VerticalAlignment="Center"
+                   Margin="0,0,12,0" />
+
+        <ComboBox Grid.Column="1" ItemsSource="{Binding Hosts}"
+                  SelectedItem="{Binding SelectedHost}"
+                  IsEnabled="{Binding !IsConnected}"
+                  PlaceholderText="choose a host">
+          <ComboBox.ItemTemplate>
+            <DataTemplate x:DataType="vm:HostRowViewModel">
+              <StackPanel>
+                <TextBlock Classes="mono" Text="{Binding Label}" FontSize="11"
+                           Foreground="{StaticResource Text}" />
+                <TextBlock Classes="mono" Text="{Binding Address}" FontSize="9"
+                           Foreground="{StaticResource TextFaint}" />
+              </StackPanel>
+            </DataTemplate>
+          </ComboBox.ItemTemplate>
+        </ComboBox>
+
+        <!--
+          Only for a host bound to nothing, exactly as the hosts screen's box is — and it is a different box
+          holding a different value. This connection authenticates separately, so a password typed to open a
+          terminal was never offered here.
+        -->
+        <TextBox Grid.Column="2" Width="150" Margin="6,0,0,0" PasswordChar="•"
+                 Text="{Binding TypedPassword}" PlaceholderText="password"
+                 IsVisible="{Binding SelectedHostAsksForAPassword}"
+                 IsEnabled="{Binding !IsConnected}" />
+
+        <Button Grid.Column="3" Classes="accent" Content="CONNECT" Margin="6,0,0,0"
+                Command="{Binding ConnectCommand}"
+                IsVisible="{Binding !IsConnected}"
+                IsEnabled="{Binding !IsBusy}" />
+
+        <Button Grid.Column="3" Classes="ghost" Content="DISCONNECT" Margin="6,0,0,0"
+                Command="{Binding DisconnectCommand}"
+                IsVisible="{Binding IsConnected}" />
+
+        <Border Grid.Column="4" Classes="chip accent" Margin="8,0,0,0"
+                IsVisible="{Binding IsConnected}">
+          <TextBlock Text="{Binding ConnectedTo}" />
+        </Border>
+
+        <TextBlock Grid.Column="5" Classes="hint" Text="{Binding Status}" FontSize="10.5"
+                   Margin="12,0,0,0" VerticalAlignment="Center" TextTrimming="CharacterEllipsis"
+                   TextWrapping="NoWrap" />
+
+      </Grid>
+    </Border>
+
+    <!-- ============ The two panes ============ -->
+    <Grid Grid.Row="1" ColumnDefinitions="*,64,*">
+
+      <!-- ==== This machine ==== -->
+      <Grid Grid.Column="0" RowDefinitions="Auto,Auto,Auto,*">
+
+        <Border Grid.Row="0" Padding="12,7" BorderBrush="{StaticResource BorderSubtle}"
+                BorderThickness="0,0,0,1">
+          <Grid ColumnDefinitions="Auto,*,Auto">
+            <TextBlock Grid.Column="0" Classes="label" Text="THIS MACHINE" VerticalAlignment="Center" />
+            <StackPanel Grid.Column="2" Orientation="Horizontal" Spacing="6">
+              <!--
+                The drives, because the breadcrumb cannot reach them: above C:\ is a list rather than a
+                directory. Without this the pane is stuck on whichever drive the user profile is on.
+              -->
+              <ItemsControl ItemsSource="{Binding LocalRoots}" VerticalAlignment="Center">
+                <ItemsControl.ItemsPanel>
+                  <ItemsPanelTemplate>
+                    <StackPanel Orientation="Horizontal" Spacing="4" />
+                  </ItemsPanelTemplate>
+                </ItemsControl.ItemsPanel>
+                <ItemsControl.ItemTemplate>
+                  <DataTemplate x:DataType="vm:CrumbViewModel">
+                    <Button Classes="ghost" Content="{Binding Name}"
+                            Command="{Binding $parent[ItemsControl].((vm:TransfersViewModel)DataContext).GoLocalCommand}"
+                            CommandParameter="{Binding Path}" />
+                  </DataTemplate>
+                </ItemsControl.ItemTemplate>
+              </ItemsControl>
+              <Button Classes="ghost" Content="UP" Command="{Binding LocalUpCommand}" />
+              <Button Classes="ghost" Content="REFRESH" Command="{Binding RefreshLocalCommand}" />
+            </StackPanel>
+          </Grid>
+        </Border>
+
+        <ItemsControl Grid.Row="1" ItemsSource="{Binding LocalTrail}" Margin="12,6,12,4">
+          <ItemsControl.ItemsPanel>
+            <ItemsPanelTemplate>
+              <WrapPanel Orientation="Horizontal" />
+            </ItemsPanelTemplate>
+          </ItemsControl.ItemsPanel>
+          <ItemsControl.ItemTemplate>
+            <DataTemplate x:DataType="vm:CrumbViewModel">
+              <StackPanel Orientation="Horizontal">
+                <Button Classes="flat" Padding="3,1"
+                        Command="{Binding $parent[ItemsControl].((vm:TransfersViewModel)DataContext).GoLocalCommand}"
+                        CommandParameter="{Binding Path}">
+                  <TextBlock Classes="mono" Text="{Binding Name}" FontSize="10"
+                             Foreground="{StaticResource TextDim}" />
+                </Button>
+                <TextBlock Classes="mono" Text="›" FontSize="10"
+                           Foreground="{StaticResource TextFaint}" VerticalAlignment="Center" />
+              </StackPanel>
+            </DataTemplate>
+          </ItemsControl.ItemTemplate>
+        </ItemsControl>
+
+        <Grid Grid.Row="2" ColumnDefinitions="2,*,84,110" Margin="0,2,12,4">
+          <TextBlock Grid.Column="1" Classes="label" Text="NAME" FontSize="8.5" Margin="12,0,8,0" />
+          <TextBlock Grid.Column="2" Classes="label" Text="SIZE" FontSize="8.5" />
+          <TextBlock Grid.Column="3" Classes="label" Text="MODIFIED" FontSize="8.5" />
+        </Grid>
+
+        <ListBox Grid.Row="3" x:Name="LocalList" ItemsSource="{Binding LocalEntries}"
+                 SelectedItem="{Binding SelectedLocalEntry}">
+          <ListBox.ItemTemplate>
+            <DataTemplate x:DataType="vm:LocalEntryRowViewModel">
+              <Grid ColumnDefinitions="2,*,84,110" Margin="0,5,12,5">
+                <Border Grid.Column="0" Classes="rowmark" />
+                <TextBlock Grid.Column="1" Classes="mono entry" Classes.dir="{Binding IsNavigable}"
+                           Text="{Binding Name}" FontSize="11"
+                           Margin="12,0,8,0" TextTrimming="CharacterEllipsis" />
+                <TextBlock Grid.Column="2" Classes="mono" Text="{Binding Size}" FontSize="9.5"
+                           Foreground="{StaticResource TextDim}" VerticalAlignment="Center" />
+                <TextBlock Grid.Column="3" Classes="mono" Text="{Binding Modified}" FontSize="9.5"
+                           Foreground="{StaticResource TextFaint}" VerticalAlignment="Center" />
+              </Grid>
+            </DataTemplate>
+          </ListBox.ItemTemplate>
+        </ListBox>
+
+        <TextBlock Grid.Row="3" Classes="hint" FontSize="11" Margin="24" MaxWidth="260"
+                   HorizontalAlignment="Center" VerticalAlignment="Center" TextAlignment="Center"
+                   Text="Nothing in this folder. Use the trail above to go somewhere else."
+                   IsVisible="{Binding !HasLocalEntries}" />
+
+      </Grid>
+
+      <!-- ==== The two directions ==== -->
+      <Border Grid.Column="1" Background="{StaticResource Sidebar}"
+              BorderBrush="{StaticResource Border}" BorderThickness="1,0">
+        <StackPanel VerticalAlignment="Center" Spacing="10" Margin="6">
+          <!--
+            Pointing at the pane the file is going to, which is the only reading that survives the panes
+            being side by side: the left-hand pane is this machine, so an upload points right.
+          -->
+          <Button Classes="ghost" Content="→" HorizontalAlignment="Stretch"
+                  HorizontalContentAlignment="Center"
+                  Command="{Binding UploadCommand}" IsEnabled="{Binding CanUpload}"
+                  ToolTip.Tip="Upload the selected file to the directory showing on the host" />
+          <Button Classes="ghost" Content="←" HorizontalAlignment="Stretch"
+                  HorizontalContentAlignment="Center"
+                  Command="{Binding DownloadCommand}" IsEnabled="{Binding CanDownload}"
+                  ToolTip.Tip="Download the selected file into the folder showing on this machine" />
+        </StackPanel>
+      </Border>
+
+      <!-- ==== The host ==== -->
+      <Grid Grid.Column="2" RowDefinitions="Auto,Auto,Auto,*">
+
+        <Border Grid.Row="0" Padding="12,7" BorderBrush="{StaticResource BorderSubtle}"
+                BorderThickness="0,0,0,1">
+          <Grid ColumnDefinitions="Auto,*,Auto">
+            <TextBlock Grid.Column="0" Classes="label" Text="HOST" VerticalAlignment="Center" />
+            <StackPanel Grid.Column="2" Orientation="Horizontal" Spacing="6">
+              <Button Classes="ghost" Content="UP" Command="{Binding RemoteUpCommand}"
+                      IsEnabled="{Binding IsConnected}" />
+              <Button Classes="ghost" Content="REFRESH" Command="{Binding RefreshRemoteCommand}"
+                      IsEnabled="{Binding IsConnected}" />
+              <Button Classes="danger" Content="DELETE" Command="{Binding DeleteRemoteCommand}"
+                      IsEnabled="{Binding IsConnected}" />
+            </StackPanel>
+          </Grid>
+        </Border>
+
+        <Grid Grid.Row="1" ColumnDefinitions="*,Auto" Margin="12,6,12,4">
+          <ItemsControl Grid.Column="0" ItemsSource="{Binding RemoteTrail}" VerticalAlignment="Center">
+            <ItemsControl.ItemsPanel>
+              <ItemsPanelTemplate>
+                <WrapPanel Orientation="Horizontal" />
+              </ItemsPanelTemplate>
+            </ItemsControl.ItemsPanel>
+            <ItemsControl.ItemTemplate>
+              <DataTemplate x:DataType="vm:CrumbViewModel">
+                <StackPanel Orientation="Horizontal">
+                  <TextBlock Classes="mono" Text="/" FontSize="10"
+                             Foreground="{StaticResource TextFaint}" VerticalAlignment="Center" />
+                  <Button Classes="flat" Padding="3,1"
+                          Command="{Binding $parent[ItemsControl].((vm:TransfersViewModel)DataContext).GoRemoteCommand}"
+                          CommandParameter="{Binding Path}">
+                    <TextBlock Classes="mono" Text="{Binding Name}" FontSize="10"
+                               Foreground="{StaticResource TextDim}" />
+                  </Button>
+                </StackPanel>
+              </DataTemplate>
+            </ItemsControl.ItemTemplate>
+          </ItemsControl>
+
+          <!--
+            Making a directory sits here, beside the path it would be made in, rather than with the queue's
+            controls. It exists because the queue refuses to overwrite: without somewhere else to put a file,
+            "that name is already taken" is a dead end.
+          -->
+          <StackPanel Grid.Column="1" Orientation="Horizontal" Spacing="6"
+                      IsVisible="{Binding IsConnected}">
+            <TextBox Width="140" Text="{Binding NewRemoteFolder}" PlaceholderText="new directory" />
+            <Button Classes="ghost" Content="MKDIR" Command="{Binding CreateRemoteFolderCommand}" />
+          </StackPanel>
+        </Grid>
+
+        <Grid Grid.Row="2" ColumnDefinitions="2,*,84,110,92" Margin="0,2,12,4">
+          <TextBlock Grid.Column="1" Classes="label" Text="NAME" FontSize="8.5" Margin="12,0,8,0" />
+          <TextBlock Grid.Column="2" Classes="label" Text="SIZE" FontSize="8.5" />
+          <TextBlock Grid.Column="3" Classes="label" Text="MODIFIED" FontSize="8.5" />
+          <TextBlock Grid.Column="4" Classes="label" Text="PERMS" FontSize="8.5" />
+        </Grid>
+
+        <ListBox Grid.Row="3" x:Name="RemoteList" ItemsSource="{Binding RemoteEntries}"
+                 SelectedItem="{Binding SelectedRemoteEntry}">
+          <ListBox.ItemTemplate>
+            <DataTemplate x:DataType="vm:RemoteEntryRowViewModel">
+              <Grid ColumnDefinitions="2,*,84,110,92" Margin="0,5,12,5">
+                <Border Grid.Column="0" Classes="rowmark" />
+                <TextBlock Grid.Column="1" Classes="mono entry" Classes.dir="{Binding IsNavigable}"
+                           Text="{Binding Name}" FontSize="11"
+                           Margin="12,0,8,0" TextTrimming="CharacterEllipsis" />
+                <TextBlock Grid.Column="2" Classes="mono" Text="{Binding Size}" FontSize="9.5"
+                           Foreground="{StaticResource TextDim}" VerticalAlignment="Center" />
+                <TextBlock Grid.Column="3" Classes="mono" Text="{Binding Modified}" FontSize="9.5"
+                           Foreground="{StaticResource TextFaint}" VerticalAlignment="Center" />
+                <TextBlock Grid.Column="4" Classes="mono" Text="{Binding Permissions}" FontSize="9.5"
+                           Foreground="{StaticResource TextFaint}" VerticalAlignment="Center" />
+              </Grid>
+            </DataTemplate>
+          </ListBox.ItemTemplate>
+        </ListBox>
+
+        <StackPanel Grid.Row="3" Spacing="10" Margin="24" MaxWidth="300"
+                    HorizontalAlignment="Center" VerticalAlignment="Center"
+                    IsVisible="{Binding !HasRemoteEntries}">
+          <TextBlock Classes="hint" FontSize="11" TextAlignment="Center"
+                     Text="Connect to a host to browse its files. This opens its own SFTP connection, so the host records a second login — it is not the same channel as a terminal."
+                     IsVisible="{Binding !IsConnected}" />
+          <TextBlock Classes="hint" FontSize="11" TextAlignment="Center"
+                     Text="Nothing in this directory."
+                     IsVisible="{Binding IsConnected}" />
+        </StackPanel>
+
+      </Grid>
+
+    </Grid>
+
+    <!-- ============ The queue ============ -->
+    <Border Grid.Row="2" Background="{StaticResource Sidebar}" BorderBrush="{StaticResource Border}"
+            BorderThickness="0,1,0,0" MaxHeight="196">
+      <Grid RowDefinitions="Auto,*">
+
+        <Border Grid.Row="0" Padding="12,7">
+          <Grid ColumnDefinitions="Auto,Auto,*,Auto,Auto">
+            <TextBlock Grid.Column="0" Classes="label" Text="TRANSFERS" VerticalAlignment="Center" />
+            <TextBlock Grid.Column="1" Classes="mono" FontSize="9.5" Margin="10,0,0,0"
+                       Foreground="{StaticResource TextFaint}" VerticalAlignment="Center"
+                       Text="one at a time · nothing lands at its final name until it is complete" />
+          </Grid>
+        </Border>
+
+        <ScrollViewer Grid.Row="1">
+          <StackPanel>
+            <TextBlock Classes="hint" FontSize="10.5" Margin="12,4,12,14"
+                       IsVisible="{Binding !HasTransfers}"
+                       Text="Nothing queued. Choose a file in either pane and press the arrow pointing the way you want it to go." />
+
+            <ItemsControl ItemsSource="{Binding Transfers}">
+              <ItemsControl.ItemTemplate>
+                <DataTemplate x:DataType="vm:TransferRowViewModel">
+                  <Grid ColumnDefinitions="16,150,*,190,Auto" Margin="12,4">
+                    <TextBlock Grid.Column="0" Classes="mono" Text="{Binding Arrow}" FontSize="11"
+                               Foreground="{StaticResource Accent}" VerticalAlignment="Center" />
+                    <StackPanel Grid.Column="1" Margin="0,0,8,0">
+                      <TextBlock Classes="mono" Text="{Binding Name}" FontSize="10.5"
+                                 Foreground="{StaticResource Text}" TextTrimming="CharacterEllipsis" />
+                      <TextBlock Classes="mono" Text="{Binding Path}" FontSize="9"
+                                 Foreground="{StaticResource TextFaint}"
+                                 TextTrimming="CharacterEllipsis" />
+                    </StackPanel>
+
+                    <ProgressBar Grid.Column="2" Height="4" Minimum="0" Maximum="100"
+                                 Value="{Binding Percent}" VerticalAlignment="Center"
+                                 Foreground="{StaticResource Accent}"
+                                 Background="{StaticResource Raised}" />
+
+                    <TextBlock Grid.Column="3" Classes="mono" Text="{Binding Progress}" FontSize="9.5"
+                               Margin="10,0" VerticalAlignment="Center"
+                               TextTrimming="CharacterEllipsis"
+                               Foreground="{StaticResource TextDim}" />
+
+                    <StackPanel Grid.Column="4" Orientation="Horizontal" Spacing="6">
+                      <Border Classes="chip">
+                        <TextBlock Text="{Binding StateLabel}" />
+                      </Border>
+                      <Button Classes="ghost" Content="STOP" IsVisible="{Binding IsRunning}"
+                              Command="{Binding $parent[ItemsControl].((vm:TransfersViewModel)DataContext).CancelTransferCommand}"
+                              CommandParameter="{Binding}" />
+                      <Button Classes="ghost" Content="{Binding RetryLabel}" IsVisible="{Binding CanRetry}"
+                              Command="{Binding $parent[ItemsControl].((vm:TransfersViewModel)DataContext).RetryTransferCommand}"
+                              CommandParameter="{Binding}" />
+                      <Button Classes="danger" Content="DISCARD" IsVisible="{Binding IsFinished}"
+                              Command="{Binding $parent[ItemsControl].((vm:TransfersViewModel)DataContext).DiscardTransferCommand}"
+                              CommandParameter="{Binding}" />
+                    </StackPanel>
+                  </Grid>
+                </DataTemplate>
+              </ItemsControl.ItemTemplate>
+            </ItemsControl>
+
+            <Button Classes="ghost" Content="CLEAR FINISHED" Margin="12,6,12,12"
+                    HorizontalAlignment="Left" Command="{Binding ClearCompletedCommand}"
+                    IsVisible="{Binding HasTransfers}" />
+          </StackPanel>
+        </ScrollViewer>
+
+      </Grid>
+    </Border>
+
+    <!--
+      First contact and a changed key, over the whole screen. The same two refusals a terminal makes, and
+      they arrive here on their own because this is a separate connection — a host trusted for a shell is
+      trusted for this too, but a host nobody has connected to at all is met here first.
+    -->
+    <Border Grid.Row="0" Grid.RowSpan="3" Background="{StaticResource Canvas}"
+            IsVisible="{Binding HasPendingHostKey}">
+      <Border Classes="card">
+        <StackPanel Spacing="12">
+          <TextBlock Classes="heading" Text="Check this host's fingerprint" />
+          <TextBlock Classes="hint"
+                     Text="This host has not been seen before. Compare the fingerprint with what the operator published. Trusting it here also trusts it for terminals, and on your other machines." />
+          <SelectableTextBlock Classes="mono" FontSize="11" Foreground="{StaticResource Text}"
+                               TextWrapping="Wrap" Text="{Binding PendingHostKey.Fingerprint}" />
+          <StackPanel Orientation="Horizontal" Spacing="8">
+            <Button Classes="accent" Content="TRUST AND CONNECT" Command="{Binding TrustHostKeyCommand}" />
+            <Button Classes="ghost" Content="CANCEL" Command="{Binding RejectHostKeyCommand}" />
+          </StackPanel>
+        </StackPanel>
+      </Border>
+    </Border>
+
+    <Border Grid.Row="0" Grid.RowSpan="3" Background="{StaticResource Canvas}"
+            IsVisible="{Binding HasHostKeyMismatch}">
+      <Border Classes="card" BorderBrush="{StaticResource DangerSoft}">
+        <StackPanel Spacing="12">
+          <TextBlock Classes="heading" Text="The host key has changed" Foreground="{StaticResource Danger}" />
+          <TextBlock Classes="hint" Text="{Binding HostKeyMismatch}" />
+          <TextBlock Classes="hint"
+                     Text="Nothing was connected, and there is no way to continue from here. If the server was legitimately rebuilt, edit the host on the Hosts screen and choose Forget host key." />
+          <Button Classes="ghost" Content="CLOSE" Command="{Binding RejectHostKeyCommand}"
+                  HorizontalAlignment="Left" />
+        </StackPanel>
+      </Border>
+    </Border>
+
+  </Grid>
+
+</UserControl>

src/DodoSSH.Client.App/Views/TransfersScreen.axaml.cs

@@ -0,0 +1,48 @@
+using Avalonia.Controls;
+using Avalonia.Input;
+using DodoSSH.Client.App.ViewModels;
+
+namespace DodoSSH.Client.App.Views;
+
+/// <summary>
+/// The two-pane file browser and the transfer queue.
+/// </summary>
+/// <remarks>
+/// Its data context is the <c>TransfersViewModel</c>, which the shell owns for the life of the process — a
+/// transfer in flight has to survive a lock, the same policy that keeps shells running. See
+/// <c>MainWindowViewModel.LockAsync</c>.
+/// </remarks>
+internal sealed partial class TransfersScreen : UserControl
+{
+    public TransfersScreen()
+    {
+        InitializeComponent();
+
+        // Wired here rather than in the markup because it is a gesture rather than a binding, and because
+        // opening a directory has to be reachable without the mouse as well: both lists are ListBoxes, so
+        // Enter on a keyboard-navigated row goes through the same commands from the buttons above them.
+        LocalList.DoubleTapped += OnLocalActivated;
+        RemoteList.DoubleTapped += OnRemoteActivated;
+    }
+
+    private void OnLocalActivated(object? sender, TappedEventArgs e)
+    {
+        if (DataContext is TransfersViewModel transfers)
+        {
+            transfers.OpenLocalCommand.Execute(null);
+        }
+    }
+
+    /// <remarks>
+    /// Fire-and-forget, which is what a double-click on a directory can be: the command reports its own
+    /// failures onto the screen's status line, and awaiting it here would mean an event handler that returns
+    /// a task nothing observes — the same thing with a warning suppressed.
+    /// </remarks>
+    private void OnRemoteActivated(object? sender, TappedEventArgs e)
+    {
+        if (DataContext is TransfersViewModel transfers)
+        {
+            _ = transfers.OpenRemoteCommand.ExecuteAsync(null);
+        }
+    }
+}