Type a path on the SFTP pane, and put a file right without deleting it

Three things the file browser could not do. Somewhere to go had to be walked
to, a file that landed under the wrong name could only be removed and sent
again, and the listing went on showing the directory as it was before this
application put something in it.

◆ THE PATH IS A BOX NOW, not a TextBlock printing where the pane was. A
breadcrumb only reaches what is under the directory already listed, so crossing
a host's filesystem cost a click and a round trip a level, and a path somebody
already knew could not be entered at all. Enter goes; Escape puts back what the
pane is really showing.

What is typed may be absolute, relative to the directory showing, or start at
~ — the four shapes a shell takes, because somebody typing into a box is typing
what they would type into a shell. SftpPath.Resolve turns all of them into one
absolute path, and it resolves them here rather than handing a relative path to
the server: the server would resolve it against the session's own working
directory, which is not necessarily the directory the breadcrumb above the box
is showing. `..` is collapsed textually, which differs from cd through a
symbolic link; the alternative is a realpath round trip before anything lists.

The box holds its own value rather than RemotePath itself. Binding it straight
to the path would navigate on every keystroke — `/`, then `/v`, then `/va` — a
round trip and a failed listing per character. Every other way of moving writes
the real path back into it; a refused listing deliberately does not, because
the path that did not resolve is the one worth having in front of you.

◆ RENAME AND MOVE, and DELETE moves to join them. It had been sitting in the
pane header beside UP and REFRESH — two things that move the pane and one that
destroys a file, in one row — and the three that act on the selected row are
now together in a row of their own, under the name of the row they are about.

One SFTP rename underneath both new operations and two separate questions on
the screen, because the answer is a different kind of thing each time: a rename
takes a name and must not take a path, a move takes a directory and must not
take a name. One box asking for a destination path would be fewer controls and
a worse question — the two mistakes it invites are exactly the ones the split
makes impossible. Each form opens on the answer that changes nothing, so what
gets edited is the half somebody came to change.

Three refusals are made here, and they are the ones a server's message would
not explain: a separator in a name (no such file, about a directory nobody
meant to name), a destination equal to the source (success, and a file that did
not move), and a directory into itself (EINVAL, true and useless). Everything
else is the server's — a name already taken, a path that is not there, a mount
that cannot be crossed — and arrives in the status line in its own words.
Neither is painted in the deletion card's red: a rename is undone by renaming
back, and spending that red twice makes it stop meaning anything.

◆ THE LISTING REFRESHES ITSELF when a transfer lands in it. Both panes, since
an upload lands on the host and a download lands here and either leaves the
pane that is showing that directory a step behind. Only the directory actually
on screen: a queue moving a hundred files elsewhere must not be a round trip
per file for a listing nobody is looking at.

It waits rather than interrupting. Another operation running would have two
listings racing for one collection, and re-listing under an open question is
how the row somebody answered about stops being the row that gets acted on — so
the staleness is remembered and settled at the end of the operation or when the
question is dismissed. It says nothing either way: nobody asked for it, and the
status line at that moment is carrying the news about the transfer. The
selection survives, re-found by path, which is what makes an unasked-for
refresh safe to run under somebody's pointer at all.

◆ THE LAYOUT SUITE FOUND A REAL FAULT and the fix is where the height goes. The
rename form did not fit the 204 pixels the session shell's own sidebar leaves
this pane — MKDIR and the listing were pushed off the bottom. The form is
shorter now (the placeholder says what the box wants, so there is no field
label above it), and the item row and the breadcrumb step aside while any of
the three questions is up, which is what the phone head already did with its
own buttons.

Measuring also settled something the markup had been claiming and is not true:
at that width the listing collapses to nothing under any of the three cards,
the deletion card included, and has done since the sidebar arrived. So "the row
it is about is still on screen" is retired from the deletion card's remark, and
the full path each card carries is what identifies the row instead. Recorded
where it is drawn rather than left to be rediscovered.

TESTS. SftpPath.Resolve gets the four shapes, ~ with and without a home to
expand it to, a blank box, and climbing past the root. ShellFlowTests gets nine
against a session that records what it was asked to do — which path was
renamed, which directories were listed — rather than against the sentence this
code writes about itself: the path box absolute and relative, rename in place,
the separator refusal, a move by relative path, the no-op refusal, the three
questions displacing each other, and the three rules the automatic refresh
follows. The local half is in TransferQueueingTests, where a real folder
answers. Two new shapes are measured, and the deletion card's own measurement
moves to the connected state — the only state it can be asked in, and the
narrow one.

What the tests cannot reach is in docs/manual-checks.md as phase 2b: a real
server's cross-device and name-taken refusals, and a soft keyboard, which is
why the phone's path box has a GO button rather than trusting whatever the IME
decided to draw on its return key.

tests/DodoSSH.Client.App.Tests/ShellFlowTests.cs

@@ -11,6 +11,7 @@ using DodoSSH.Client.Shell.ViewModels;
 using DodoSSH.Client.Ssh;
 using DodoSSH.Client.Storage;
 using DodoSSH.Client.Sync;
+using DodoSSH.Client.Transfer;
 using DodoSSH.Client.Terminal;
 using DodoSSH.Crypto;
 
@@ -8549,6 +8550,233 @@ public sealed class ShellFlowTests : IAsyncLifetime
         raised.ShouldBeGreaterThan(0);
     }
 
+    // ---- ◆ The path box, and the three things that can be done to a row ----
+
+    /// <remarks>
+    /// The way out of the breadcrumb's own reach. It can only offer what is under the directory already
+    /// listed, so before this box existed a path on the other side of the filesystem cost a walk to the
+    /// common ancestor and back down — a round trip a level — and one somebody already knew could not be
+    /// entered at all.
+    /// </remarks>
+    [Fact]
+    public async Task TypingAnAbsolutePathOnTheTransfersScreen_ListsIt()
+    {
+        var sftp = await ConnectedTransfersAsync();
+
+        shell.Transfers.RemotePathDraft = "/etc/nginx";
+
+        await shell.Transfers.GoToTypedRemotePathCommand.ExecuteAsync(null);
+
+        shell.Transfers.RemotePath.ShouldBe("/etc/nginx");
+        sftp.Listed[^1].ShouldBe("/etc/nginx");
+    }
+
+    /// <remarks>
+    /// Relative to the pane rather than to the session's own working directory, which is the distinction
+    /// <see cref="SftpPath.Resolve"/> exists for: handing the server a relative path would resolve it
+    /// somewhere the breadcrumb above the box did not predict.
+    /// </remarks>
+    [Theory]
+    [InlineData("logs", "/home/deploy/logs")]
+    [InlineData("../shared", "/home/shared")]
+    [InlineData("~/.ssh", "/home/deploy/.ssh")]
+    public async Task TypingARelativePathOnTheTransfersScreen_TakesItFromWhereThePaneIs(
+        string typed, string expected)
+    {
+        await ConnectedTransfersAsync();
+
+        shell.Transfers.RemotePath.ShouldBe("/home/deploy", "the fake opens on the account's home");
+        shell.Transfers.RemotePathDraft = typed;
+
+        await shell.Transfers.GoToTypedRemotePathCommand.ExecuteAsync(null);
+
+        shell.Transfers.RemotePath.ShouldBe(expected);
+    }
+
+    /// <remarks>
+    /// Somebody who cleared the box and pressed Enter has not asked for anything, and the root is a long way
+    /// from where they were standing.
+    /// </remarks>
+    [Fact]
+    public async Task ClearingThePathBox_PutsThePathBackRatherThanGoingToTheRoot()
+    {
+        await ConnectedTransfersAsync();
+
+        shell.Transfers.RemotePathDraft = "  ";
+
+        await shell.Transfers.GoToTypedRemotePathCommand.ExecuteAsync(null);
+
+        shell.Transfers.RemotePath.ShouldBe("/home/deploy");
+        shell.Transfers.RemotePathDraft.ShouldBe("/home/deploy");
+    }
+
+    /// <remarks>
+    /// Renaming asks first and then acts on the path the question named, not on the selection — the promise
+    /// <c>ConfirmDeleteRemoteAsync</c> already makes, kept here for the same reason: nothing between opening
+    /// the form and pressing its button may re-point it at another file.
+    /// </remarks>
+    [Fact]
+    public async Task RenamingARemoteEntry_KeepsItInPlaceUnderTheNewName()
+    {
+        var sftp = await ConnectedTransfersAsync();
+
+        shell.Transfers.SelectedRemoteEntry = shell.Transfers.RemoteEntries[0];
+        shell.Transfers.RenameRemoteCommand.Execute(null);
+
+        shell.Transfers.IsMovingRemote.ShouldBeTrue();
+        shell.Transfers.RemoteMoveTarget.ShouldBe("notes.txt", "it opens on the name that changes nothing");
+
+        shell.Transfers.RemoteMoveTarget = "notes.md";
+
+        await shell.Transfers.ConfirmMoveRemoteCommand.ExecuteAsync(null);
+
+        sftp.Renamed.ShouldHaveSingleItem().ShouldBe(("/home/deploy/notes.txt", "/home/deploy/notes.md"));
+        shell.Transfers.IsMovingRemote.ShouldBeFalse();
+    }
+
+    /// <remarks>
+    /// A separator in a name is a move wearing a rename's clothing, and the server would answer it with "no
+    /// such file" about a directory nobody meant to name. The form stays open, because what has to be
+    /// corrected is what was typed into it.
+    /// </remarks>
+    [Fact]
+    public async Task RenamingToANameWithASeparatorInIt_IsRefusedAndTheFormStaysOpen()
+    {
+        var sftp = await ConnectedTransfersAsync();
+
+        shell.Transfers.SelectedRemoteEntry = shell.Transfers.RemoteEntries[0];
+        shell.Transfers.RenameRemoteCommand.Execute(null);
+        shell.Transfers.RemoteMoveTarget = "archive/notes.txt";
+
+        await shell.Transfers.ConfirmMoveRemoteCommand.ExecuteAsync(null);
+
+        sftp.Renamed.ShouldBeEmpty();
+        shell.Transfers.IsMovingRemote.ShouldBeTrue();
+        shell.Transfers.Status.ShouldContain("cannot contain");
+    }
+
+    /// <remarks>
+    /// A move keeps the name and changes the directory, which is the half of the pair a rename cannot do.
+    /// The destination is resolved the way the path box's is, so <c>../shared</c> means what it would mean
+    /// in a shell rather than being handed to the server as typed.
+    /// </remarks>
+    [Fact]
+    public async Task MovingARemoteEntry_KeepsItsNameAndTakesTheTypedDirectory()
+    {
+        var sftp = await ConnectedTransfersAsync();
+
+        shell.Transfers.SelectedRemoteEntry = shell.Transfers.RemoteEntries[0];
+        shell.Transfers.MoveRemoteCommand.Execute(null);
+
+        shell.Transfers.RemoteMoveTarget.ShouldBe("/home/deploy", "it opens on the directory it is in");
+
+        shell.Transfers.RemoteMoveTarget = "../shared";
+
+        await shell.Transfers.ConfirmMoveRemoteCommand.ExecuteAsync(null);
+
+        sftp.Renamed.ShouldHaveSingleItem().ShouldBe(("/home/deploy/notes.txt", "/home/shared/notes.txt"));
+    }
+
+    /// <remarks>
+    /// The destination that changes nothing. SFTP would answer it with success and a file that had not
+    /// moved, which reads as a move that silently did not happen.
+    /// </remarks>
+    [Fact]
+    public async Task MovingARemoteEntryIntoTheDirectoryItIsAlreadyIn_IsRefused()
+    {
+        var sftp = await ConnectedTransfersAsync();
+
+        shell.Transfers.SelectedRemoteEntry = shell.Transfers.RemoteEntries[0];
+        shell.Transfers.MoveRemoteCommand.Execute(null);
+
+        await shell.Transfers.ConfirmMoveRemoteCommand.ExecuteAsync(null);
+
+        sftp.Renamed.ShouldBeEmpty();
+        shell.Transfers.Status.ShouldContain("already there");
+    }
+
+    /// <remarks>
+    /// The three questions are one at a time by construction — each one's own opening clears the others — so
+    /// that no row can have two forms open over it and no button can arm a second question behind the first.
+    /// </remarks>
+    [Fact]
+    public async Task OpeningTheRenameForm_TakesAwayADeletionThatWasBeingAskedAbout()
+    {
+        await ConnectedTransfersAsync();
+
+        shell.Transfers.SelectedRemoteEntry = shell.Transfers.RemoteEntries[0];
+        shell.Transfers.DeleteRemoteCommand.Execute(null);
+        shell.Transfers.IsConfirmingRemoteDeletion.ShouldBeTrue();
+
+        shell.Transfers.RenameRemoteCommand.Execute(null);
+
+        shell.Transfers.IsConfirmingRemoteDeletion.ShouldBeFalse();
+        shell.Transfers.IsMovingRemote.ShouldBeTrue();
+        shell.Transfers.CanDeleteRemote.ShouldBeFalse("a question is on screen");
+    }
+
+    /// <remarks>
+    /// The pane used to go on showing the directory as it was before the file arrived, so the only way to
+    /// see something this application had just sent was to press REFRESH — the application asking to be
+    /// told about what it had done itself.
+    /// </remarks>
+    [Fact]
+    public async Task AnUploadThatLandsInTheDirectoryShowing_ReReadsItWithoutBeingAsked()
+    {
+        var sftp = await ConnectedTransfersAsync();
+
+        var before = sftp.Listed.Count;
+
+        shell.Transfers.NoteTransferLanded(Landed("/home/deploy/build.tar.gz"));
+
+        sftp.Listed.Count.ShouldBe(before + 1);
+        sftp.Listed[^1].ShouldBe("/home/deploy");
+        shell.Transfers.RemoteListingIsStale.ShouldBeFalse();
+    }
+
+    /// <remarks>
+    /// Only the directory on screen. A queue moving a hundred files into somewhere nobody is looking at
+    /// would otherwise be a round trip per file for a listing that changed nothing anybody can see.
+    /// </remarks>
+    [Fact]
+    public async Task AnUploadThatLandsSomewhereElse_ChangesNothingOnScreen()
+    {
+        var sftp = await ConnectedTransfersAsync();
+
+        var before = sftp.Listed.Count;
+
+        shell.Transfers.NoteTransferLanded(Landed("/srv/releases/build.tar.gz"));
+
+        sftp.Listed.Count.ShouldBe(before);
+        shell.Transfers.RemoteListingIsStale.ShouldBeFalse();
+    }
+
+    /// <remarks>
+    /// The refresh waits rather than interrupting. Re-listing under an open question is how the row somebody
+    /// answered about stops being the row that gets acted on — so the staleness is remembered and settled
+    /// when the question goes.
+    /// </remarks>
+    [Fact]
+    public async Task AnUploadThatLandsWhileAQuestionIsOpen_WaitsForItToBeAnswered()
+    {
+        var sftp = await ConnectedTransfersAsync();
+
+        shell.Transfers.SelectedRemoteEntry = shell.Transfers.RemoteEntries[0];
+        shell.Transfers.DeleteRemoteCommand.Execute(null);
+
+        var before = sftp.Listed.Count;
+
+        shell.Transfers.NoteTransferLanded(Landed("/home/deploy/build.tar.gz"));
+
+        sftp.Listed.Count.ShouldBe(before, "nothing may pull the listing out from under an open question");
+        shell.Transfers.RemoteListingIsStale.ShouldBeTrue();
+
+        await shell.Transfers.CancelDeleteRemoteCommand.ExecuteAsync(null);
+
+        sftp.Listed.Count.ShouldBe(before + 1);
+        shell.Transfers.RemoteListingIsStale.ShouldBeFalse();
+    }
+
     /// <remarks>
     /// A bucket is an <c>IRemoteFileStore</c> with no <c>HostSecret</c> underneath it, so there is no
     /// <c>PinnedPaths</c> to read at all — see <see cref="TransfersViewModel.OpenBucketAsync"/>'s own remark.
@@ -9154,4 +9382,39 @@ public sealed class ShellFlowTests : IAsyncLifetime
 
         return vault;
     }
+
+    /// <summary>A transfers screen connected to the fixture's host, and the session it opened.</summary>
+    private async Task<FakeSftpSession> ConnectedTransfersAsync()
+    {
+        var vault = await ReadyToConnectAsync();
+
+        shell.Transfers.Attach(vault, knownHosts);
+        shell.Transfers.SelectedHost = shell.Transfers.Hosts[0];
+
+        await shell.Transfers.ConnectCommand.ExecuteAsync(null);
+
+        shell.Transfers.IsConnected.ShouldBeTrue(shell.Transfers.Status);
+
+        return ssh.OpenedSftp.ShouldNotBeNull();
+    }
+
+    /// <summary>An upload that has just finished, as the queue would report it.</summary>
+    /// <remarks>
+    /// Built here rather than run through <c>FileTransferQueue</c>, because what is asserted is what the
+    /// screen does when a transfer lands and not that a transfer can land: the queue's own path from
+    /// enqueued to completed is covered against a fuller fake in <c>DodoSSH.Client.Transfer.Tests</c>, and
+    /// running one here would put a thread-pool hand-off and this fixture's own dispatcher-less posting
+    /// between the event and the assertion.
+    /// </remarks>
+    private static TransferSnapshot Landed(string remotePath) => new(
+        Guid.CreateVersion7(),
+        TransferDirection.Upload,
+        SftpPath.Name(remotePath),
+        Path.Combine(Path.GetTempPath(), SftpPath.Name(remotePath)),
+        remotePath,
+        128,
+        128,
+        TransferState.Completed,
+        BytesPerSecond: 0,
+        Failure: null);
 }