diff --git a/src/DodoSSH.Client.Android/Views/FilesScreen.axaml b/src/DodoSSH.Client.Android/Views/FilesScreen.axaml
index 3873086..a16f590 100644
--- a/src/DodoSSH.Client.Android/Views/FilesScreen.axaml
+++ b/src/DodoSSH.Client.Android/Views/FilesScreen.axaml
@@ -48,7 +48,12 @@
     the refusal has no continue button here either.
   -->
 
-  <Grid RowDefinitions="Auto,Auto,Auto,Auto,Auto,Auto,*,Auto">
+  <!--
+    Nine rows since the disconnect strip arrived; it is row 7, between the listing and the action bar, so
+    that what it says is next to the buttons it replaces the point of. Auto and empty except while the
+    session has been lost, so an ordinary browse pays nothing for it.
+  -->
+  <Grid RowDefinitions="Auto,Auto,Auto,Auto,Auto,Auto,*,Auto,Auto">
 
     <!-- ============ header ============ -->
     <Grid Grid.Row="0" ColumnDefinitions="Auto,Auto,*,Auto" Height="56" Margin="8,0">
@@ -78,7 +83,13 @@
     </Grid>
 
     <!-- ============ opening one ============ -->
-    <Border Grid.Row="1" Classes="card" Margin="12,0,12,8" IsVisible="{Binding !IsConnected}">
+    <!--
+      ShowsRemoteInvitation rather than !IsConnected, which stopped being the same question when a
+      connection could be lost rather than only closed: a session that went away leaves its listing on
+      screen, and this card springing back over it would hide the one thing the strip below is offering to
+      put the user back into. See TransfersViewModel.ShowsRemoteContents.
+    -->
+    <Border Grid.Row="1" Classes="card" Margin="12,0,12,8" IsVisible="{Binding ShowsRemoteInvitation}">
       <StackPanel Spacing="10">
 
         <ComboBox HorizontalAlignment="Stretch" MinHeight="44" IsVisible="{Binding ShowsHostPicker}"
@@ -186,7 +197,8 @@
       IME action, and a path box whose only commit was a key that may say "newline" would be a box nothing
       could be submitted from. The Enter binding stays for the hardware keyboards this head does meet.
     -->
-    <Grid Grid.Row="3" ColumnDefinitions="*,8,Auto" Margin="14,0,14,6" IsVisible="{Binding IsConnected}">
+    <Grid Grid.Row="3" ColumnDefinitions="*,8,Auto" Margin="14,0,14,6"
+          IsVisible="{Binding ShowsRemoteContents}">
       <TextBox Grid.Column="0" Classes="field" Text="{Binding RemotePathDraft}"
                PlaceholderText="/path/to/somewhere">
         <TextBox.KeyBindings>
@@ -197,9 +209,24 @@
               Command="{Binding GoToTypedRemotePathCommand}" />
     </Grid>
 
+    <!--
+      ◆ How many are gathered up, and the one gesture that gathers or releases them all. Only while
+      something is — an always-present row would spend 30 pixels of a listing on a count of zero.
+    -->
+    <Grid Grid.Row="3" ColumnDefinitions="Auto,*" Margin="14,0,14,6" VerticalAlignment="Bottom"
+          IsVisible="{Binding HasCheckedRemote}">
+      <Button Grid.Column="0" Classes="secondary" MinHeight="36" Padding="12,0"
+              Command="{Binding ToggleAllRemoteCommand}">
+        <TextBlock Classes="label" FontSize="9" Text="ALL / NONE" />
+      </Button>
+      <TextBlock Grid.Column="1" Classes="mono" FontSize="12" Margin="10,0,0,0"
+                 VerticalAlignment="Center" Foreground="{StaticResource AccentText}"
+                 Text="{Binding CheckedRemoteLabel}" />
+    </Grid>
+
     <!-- ============ where we are ============ -->
     <ScrollViewer Grid.Row="4" HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Disabled"
-                  IsVisible="{Binding IsConnected}" Margin="0,0,0,4">
+                  IsVisible="{Binding ShowsRemoteContents}" Margin="0,0,0,4">
       <StackPanel Orientation="Horizontal" Spacing="4" Margin="14,0" VerticalAlignment="Center">
         <Button Classes="row" MinHeight="36" Padding="9,0" CornerRadius="10"
                 Command="{Binding RemoteUpCommand}">
@@ -265,7 +292,7 @@
     <!-- ============ the listing ============ -->
     <Panel Grid.Row="6">
 
-      <TextBlock Classes="body" IsVisible="{Binding !IsConnected}" Margin="24,12"
+      <TextBlock Classes="body" IsVisible="{Binding ShowsRemoteInvitation}" Margin="24,12"
                  VerticalAlignment="Top" Text="{Binding Status}" />
 
       <!--
@@ -282,7 +309,7 @@
         selection navigate would send a single desktop click walking into a directory.
       -->
       <ListBox ItemsSource="{Binding RemoteEntries}" SelectedItem="{Binding SelectedRemoteEntry}"
-               Background="Transparent" BorderThickness="0" IsVisible="{Binding IsConnected}"
+               Background="Transparent" BorderThickness="0" IsVisible="{Binding ShowsRemoteContents}"
                Tapped="OnRemoteEntryTapped">
         <ListBox.Styles>
           <Style Selector="ListBoxItem">
@@ -299,15 +326,27 @@
         <ListBox.ItemTemplate>
           <DataTemplate x:DataType="vm:RemoteEntryRowViewModel">
             <Border MinHeight="52" Padding="10,7">
-              <Grid ColumnDefinitions="Auto,*,Auto">
-                <TextBlock Grid.Column="0" Width="16" HorizontalAlignment="Center"
+              <Grid ColumnDefinitions="Auto,Auto,*,Auto">
+                <!--
+                  ◆ The tick, which on this head is the only multi-selection there can be: a phone has no
+                  ctrl-click and no shift-click. It is not the list's selection — that stays "the row I am
+                  looking at", which RENAME, MOVE and PERMS act on one at a time — and this is "the rows I
+                  have gathered up", which SAVE and DELETE take. See RemoteEntryRowViewModel.IsChecked.
+
+                  Its own 40-pixel column so a thumb aimed at it does not open the directory beside it: the
+                  row's own tap navigates, which is this head's one behaviour the desktop does not share.
+                -->
+                <CheckBox Grid.Column="0" Width="40" MinWidth="0" VerticalAlignment="Center"
+                          IsChecked="{Binding IsChecked}" Click="OnRemoteRowChecked" />
+
+                <TextBlock Grid.Column="1" Width="16" HorizontalAlignment="Center"
                            VerticalAlignment="Center" FontSize="12" Text="▸"
                            Foreground="{StaticResource AccentText}" IsVisible="{Binding IsNavigable}" />
-                <TextBlock Grid.Column="0" Width="16" HorizontalAlignment="Center"
+                <TextBlock Grid.Column="1" Width="16" HorizontalAlignment="Center"
                            VerticalAlignment="Center" FontSize="12" Text="·"
                            Foreground="{StaticResource TextFaint}" IsVisible="{Binding IsFile}" />
 
-                <StackPanel Grid.Column="1" Margin="11,0,0,0" Spacing="2" VerticalAlignment="Center">
+                <StackPanel Grid.Column="2" Margin="11,0,0,0" Spacing="2" VerticalAlignment="Center">
                   <TextBlock Classes="mono" FontSize="12.5" Text="{Binding Name}"
                              TextTrimming="CharacterEllipsis" />
                   <StackPanel Orientation="Horizontal" Spacing="7">
@@ -318,7 +357,7 @@
                   </StackPanel>
                 </StackPanel>
 
-                <TextBlock Grid.Column="2" Classes="detail" Text="{Binding Modified}"
+                <TextBlock Grid.Column="3" Classes="detail" Text="{Binding Modified}"
                            VerticalAlignment="Center" />
               </Grid>
             </Border>
@@ -327,9 +366,50 @@
       </ListBox>
     </Panel>
 
+    <!-- ============ what the screen says once the session has stopped ============ -->
+    <!--
+      The phone's half of the desktop's SessionEndedBar, and it binds this screen's own view model rather
+      than the shell's — this control's DataContext is TransfersViewModel, where the desktop's strip sits in
+      MainWindow beside a status bar and can ask which surface it is on. The facts are the same two:
+      TransfersViewModel.LostConnection and the reconnect that goes back to the directory showing.
+
+      A phone needs it more than a desk does, and for the reason its terminal does: a mobile link drops on
+      its own and the screen goes off, so this session is discovered later with a listing on it and no
+      account of why nothing works. The listing stays deliberately — see ShowsRemoteContents.
+    -->
+    <Border Grid.Row="7" IsVisible="{Binding IsConnectionLost}" Background="{StaticResource DeepChrome}"
+            BorderBrush="{StaticResource Danger}" BorderThickness="0,1,0,0" Padding="12,10">
+      <StackPanel Spacing="8">
+
+        <StackPanel Orientation="Horizontal" Spacing="7" VerticalAlignment="Center">
+          <Ellipse Classes="dot" Classes.dropped="True" Width="7" Height="7" VerticalAlignment="Center" />
+          <TextBlock Classes="label" FontSize="9" Text="DISCONNECTED" />
+        </StackPanel>
+
+        <!--
+          Two lines maximum, for the reason the terminal's strip caps its own: a transport error can hand
+          over whatever the operating system called it, and a strip that grew to fit one would eat the
+          listing above it on a screen that has none to spare.
+        -->
+        <TextBlock Classes="detail" FontSize="10.5" Foreground="{StaticResource TextDim}"
+                   TextWrapping="Wrap" MaxLines="2" TextTrimming="CharacterEllipsis"
+                   Text="{Binding LostConnection}" />
+
+        <StackPanel Orientation="Horizontal" Spacing="8">
+          <Button Classes="row" MinHeight="44" Padding="14,0" Command="{Binding ReconnectCommand}">
+            <TextBlock Classes="label" FontSize="9" Text="RECONNECT" />
+          </Button>
+          <Button Classes="row" MinHeight="44" Padding="14,0" Command="{Binding DisconnectCommand}">
+            <TextBlock Classes="label" FontSize="9" Text="CLOSE" />
+          </Button>
+        </StackPanel>
+
+      </StackPanel>
+    </Border>
+
     <!-- ============ what to do with the chosen entry ============ -->
     <!-- DeepChrome rather than Chrome, since v5 — see the remark on PhoneShell's vault header. -->
-    <Border Grid.Row="7" IsVisible="{Binding IsConnected}" Background="{StaticResource DeepChrome}"
+    <Border Grid.Row="8" IsVisible="{Binding IsConnected}" Background="{StaticResource DeepChrome}"
             BorderBrush="{StaticResource Border}" BorderThickness="0,1,0,0" Padding="12,10">
       <StackPanel Spacing="9">
 
@@ -381,6 +461,75 @@
           </StackPanel>
         </Border>
 
+        <!--
+          ◆ The mode, as nine boxes and the number they add up to — in the place the other two questions
+          already occupy and never at the same time as either. See RemotePermissionsRequest for why it is
+          boxes rather than a field to type 755 into, and TransfersScreen.axaml for the desktop's own copy
+          of the same form.
+
+          Compact rather than a second layout: the three columns are the mode's own three triples, and at
+          360dp they are exactly what fits. The octal is printed underneath as it changes, which is what
+          lets somebody who came here to type chmod check the boxes they just ticked.
+        -->
+        <Border IsVisible="{Binding IsChangingRemotePermissions}" Background="{StaticResource Raised}"
+                BorderBrush="{StaticResource Border}" BorderThickness="1" CornerRadius="12"
+                Padding="13,11">
+          <StackPanel Spacing="6">
+            <TextBlock Classes="mono" FontSize="12" TextWrapping="Wrap"
+                       Text="{Binding PendingRemotePermissions.Question}" />
+            <TextBlock Classes="detail" TextWrapping="Wrap"
+                       Text="{Binding PendingRemotePermissions.FullPath}" />
+
+            <Grid ColumnDefinitions="Auto,*,*,*" RowDefinitions="Auto,44,44,44" Margin="0,2">
+              <TextBlock Grid.Row="0" Grid.Column="1" Classes="detail" Text="read"
+                         HorizontalAlignment="Center" />
+              <TextBlock Grid.Row="0" Grid.Column="2" Classes="detail" Text="write"
+                         HorizontalAlignment="Center" />
+              <TextBlock Grid.Row="0" Grid.Column="3" Classes="detail"
+                         Text="{Binding PendingRemotePermissions.ExecuteLabel}"
+                         HorizontalAlignment="Center" />
+
+              <TextBlock Grid.Row="1" Grid.Column="0" Classes="mono" FontSize="12" Text="owner"
+                         VerticalAlignment="Center" Margin="0,0,10,0" />
+              <CheckBox Grid.Row="1" Grid.Column="1" HorizontalAlignment="Center" MinWidth="0"
+                        IsChecked="{Binding PendingRemotePermissions.OwnerRead}" />
+              <CheckBox Grid.Row="1" Grid.Column="2" HorizontalAlignment="Center" MinWidth="0"
+                        IsChecked="{Binding PendingRemotePermissions.OwnerWrite}" />
+              <CheckBox Grid.Row="1" Grid.Column="3" HorizontalAlignment="Center" MinWidth="0"
+                        IsChecked="{Binding PendingRemotePermissions.OwnerExecute}" />
+
+              <TextBlock Grid.Row="2" Grid.Column="0" Classes="mono" FontSize="12" Text="group"
+                         VerticalAlignment="Center" Margin="0,0,10,0" />
+              <CheckBox Grid.Row="2" Grid.Column="1" HorizontalAlignment="Center" MinWidth="0"
+                        IsChecked="{Binding PendingRemotePermissions.GroupRead}" />
+              <CheckBox Grid.Row="2" Grid.Column="2" HorizontalAlignment="Center" MinWidth="0"
+                        IsChecked="{Binding PendingRemotePermissions.GroupWrite}" />
+              <CheckBox Grid.Row="2" Grid.Column="3" HorizontalAlignment="Center" MinWidth="0"
+                        IsChecked="{Binding PendingRemotePermissions.GroupExecute}" />
+
+              <TextBlock Grid.Row="3" Grid.Column="0" Classes="mono" FontSize="12" Text="others"
+                         VerticalAlignment="Center" Margin="0,0,10,0" />
+              <CheckBox Grid.Row="3" Grid.Column="1" HorizontalAlignment="Center" MinWidth="0"
+                        IsChecked="{Binding PendingRemotePermissions.OthersRead}" />
+              <CheckBox Grid.Row="3" Grid.Column="2" HorizontalAlignment="Center" MinWidth="0"
+                        IsChecked="{Binding PendingRemotePermissions.OthersWrite}" />
+              <CheckBox Grid.Row="3" Grid.Column="3" HorizontalAlignment="Center" MinWidth="0"
+                        IsChecked="{Binding PendingRemotePermissions.OthersExecute}" />
+            </Grid>
+
+            <TextBlock Classes="mono" FontSize="13" Foreground="{StaticResource AccentText}"
+                       Text="{Binding PendingRemotePermissions.Preview}" />
+
+            <Grid ColumnDefinitions="*,8,*" Margin="0,4,0,0">
+              <Button Grid.Column="0" Classes="primary" Height="44" Content="APPLY"
+                      Command="{Binding ConfirmRemotePermissionsCommand}"
+                      IsEnabled="{Binding PendingRemotePermissions.HasChanges}" />
+              <Button Grid.Column="2" Classes="secondary" Height="44" Content="CANCEL"
+                      Command="{Binding CancelRemotePermissionsCommand}" />
+            </Grid>
+          </StackPanel>
+        </Border>
+
         <!--
           ◆ The queue, above the actions and only when it has something in it. Bounded and scrolling rather
           than growing: five files queued must not push the buttons off the bottom of the screen, which on a
@@ -457,11 +606,23 @@
                   Command="{Binding MoveRemoteCommand}" IsEnabled="{Binding CanMoveRemote}" />
         </Grid>
 
+        <!--
+          ◆ PERMS beside DELETE rather than on the row above, which is full: it is the fourth thing that can
+          be done to a chosen row and the third that puts one right. Dark on a bucket, where an object has an
+          access policy rather than nine bits — see CanChangeRemotePermissions.
+        -->
         <Grid ColumnDefinitions="*,8,*" IsVisible="{Binding !IsAskingAboutRemoteEntry}">
-          <Button Grid.Column="0" Classes="secondary" Height="44" Content="DELETE"
+          <Button Grid.Column="0" Classes="secondary" Height="44" Content="PERMS"
+                  Command="{Binding ChangeRemotePermissionsCommand}"
+                  IsEnabled="{Binding CanChangeRemotePermissions}" />
+          <Button Grid.Column="2" Classes="secondary" Height="44" Content="DELETE"
                   Command="{Binding DeleteRemoteCommand}" IsEnabled="{Binding CanDeleteRemote}" />
-          <Button Grid.Column="2" Classes="secondary" Height="44" Content="CLOSE"
+        </Grid>
+
+        <Grid ColumnDefinitions="*,8,*" IsVisible="{Binding !IsAskingAboutRemoteEntry}">
+          <Button Grid.Column="0" Classes="secondary" Height="44" Content="CLOSE"
                   Command="{Binding DisconnectCommand}" />
+          <Panel Grid.Column="2" />
         </Grid>
 
         <TextBlock Classes="body" IsVisible="{Binding !IsAskingAboutRemoteEntry}"
diff --git a/src/DodoSSH.Client.Android/Views/FilesScreen.axaml.cs b/src/DodoSSH.Client.Android/Views/FilesScreen.axaml.cs
index 5c5530e..bb02fd9 100644
--- a/src/DodoSSH.Client.Android/Views/FilesScreen.axaml.cs
+++ b/src/DodoSSH.Client.Android/Views/FilesScreen.axaml.cs
@@ -35,6 +35,15 @@ internal sealed partial class FilesScreen : UserControl
     /// read its size the same gesture as fetching it.
     /// </para>
     /// </remarks>
+    /// <summary>Tells the screen a row's tick moved, so the count above the listing keeps up.</summary>
+    /// <remarks>
+    /// The desktop's own handler, for the reason given there: the count is a property of the collection
+    /// rather than of any row, and each listing replaces every row it has. See
+    /// <c>TransfersViewModel.RemoteChecksChanged</c>.
+    /// </remarks>
+    private void OnRemoteRowChecked(object? sender, RoutedEventArgs e) =>
+        (DataContext as TransfersViewModel)?.RemoteChecksChanged();
+
     private void OnRemoteEntryTapped(object? sender, TappedEventArgs e)
     {
         if (DataContext is TransfersViewModel { SelectedRemoteEntry.IsNavigable: true } transfers)
diff --git a/src/DodoSSH.Client.App/App.axaml.cs b/src/DodoSSH.Client.App/App.axaml.cs
index 1b08bde..090b3c4 100644
--- a/src/DodoSSH.Client.App/App.axaml.cs
+++ b/src/DodoSSH.Client.App/App.axaml.cs
@@ -121,7 +121,35 @@ internal sealed partial class DodoSshApp : Application
         var deviceKeys = DesktopDeviceKeyStores.ForThisMachine(paths, PinPrompt(desktop));
         var updates = UpdateChannels.ForThisMachine();
 
-        var viewModel = new MainWindowViewModel(
+        var viewModel = BuildShell(desktop, paths, caches, workspace, knownHosts, deviceKeys, connections,
+            browser, updates);
+
+        desktop.MainWindow = new MainWindow { DataContext = viewModel };
+
+        // Started rather than awaited: the framework's initialisation must not block on a schema
+        // migration. The view model shows its own progress and handles its own failures, which is why
+        // discarding the task here is safe rather than merely convenient.
+        _ = viewModel.StartAsync(CancellationToken.None);
+
+        WireShutdown(desktop, viewModel, workspace, caches);
+    }
+
+    /// <summary>Composes the shell itself, with everything this platform answers for it.</summary>
+    /// <remarks>
+    /// Split out of <see cref="Compose"/> for length rather than for reuse — it has one caller, and the
+    /// method it came out of is at the limit the analyzers set.
+    /// </remarks>
+    private static MainWindowViewModel BuildShell(
+        IClassicDesktopStyleApplicationLifetime desktop,
+        ClientPaths paths,
+        ClientCacheFactory caches,
+        TerminalWorkspace workspace,
+        VaultKnownHostStore knownHosts,
+        IDeviceKeyStore deviceKeys,
+        SshNetConnectionFactory connections,
+        SystemBrowserLauncher browser,
+        IUpdateChannel updates) =>
+        new(
             paths,
             caches,
             workspace,
@@ -141,16 +169,73 @@ internal sealed partial class DodoSshApp : Application
                 .ConfigureAwait(false),
 
             copyToClipboard: ClipboardWriter(desktop),
-            updates: updates);
+            updates: updates,
+            openInEditor: OpenInDefaultEditorAsync,
+            watchFile: WatchFile);
 
-        desktop.MainWindow = new MainWindow { DataContext = viewModel };
+    /// <summary>
+    /// Hands a local file to whatever this machine opens that kind of file with.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// One of the two halves of editing a remote file in place, and both are this platform's rather than
+    /// the shell's: what opens a <c>.conf</c> is a registry association, a desktop entry or a Launch
+    /// Services binding depending on which desktop this is, and watching a file is a platform object with
+    /// its own thread. The shell decides <em>when</em>; see <c>TransfersViewModel.EditRemoteAsync</c>.
+    /// </para>
+    /// <para>
+    /// <c>UseShellExecute</c> is the whole of it, and it is what makes the same three lines work on all
+    /// three desktops: Windows resolves the association, macOS goes through <c>open</c> and Linux through
+    /// <c>xdg-open</c>, each of which .NET reaches for when the flag is set. Without it the path is treated
+    /// as an executable to run, which for a <c>.conf</c> fails and for something else would be worse.
+    /// </para>
+    /// <para>
+    /// The process is not waited on and is deliberately not kept: an editor may hand off to an already-open
+    /// instance and exit at once, so its lifetime says nothing about whether the file is still being
+    /// edited. What ends an edit session is the user saying so — see the file browser's STOP EDITING.
+    /// </para>
+    /// </remarks>
+    private static Task OpenInDefaultEditorAsync(string path)
+    {
+        using var opened = System.Diagnostics.Process.Start(
+            new System.Diagnostics.ProcessStartInfo(path) { UseShellExecute = true });
 
-        // Started rather than awaited: the framework's initialisation must not block on a schema
-        // migration. The view model shows its own progress and handles its own failures, which is why
-        // discarding the task here is safe rather than merely convenient.
-        _ = viewModel.StartAsync(CancellationToken.None);
+        return Task.CompletedTask;
+    }
 
-        WireShutdown(desktop, viewModel, workspace, caches);
+    /// <summary>
+    /// Watches one file for saves, until the handle is disposed.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// ◆ <b>The directory is watched and the name filtered, which is not the same as watching the file.</b>
+    /// A great many editors do not write in place: they write a temporary file beside the original and
+    /// rename it over the top, which to a watcher pointed at an inode is the file disappearing. Watching the
+    /// containing directory for that name catches the rename as a <c>Created</c>, which is what makes this
+    /// work with the editors people actually use.
+    /// </para>
+    /// <para>
+    /// <b>Every kind of change is one callback, and the shell debounces nothing.</b> One save can raise two
+    /// or three events; what the shell does with each is stat the host and compare, which is a round trip
+    /// but a small one, and the alternative — a timer here — is a delay before somebody's edit reaches the
+    /// server for the sake of saving it.
+    /// </para>
+    /// </remarks>
+    private static FileSystemWatcher WatchFile(string path, Action onChanged)
+    {
+        var watcher = new FileSystemWatcher(
+            Path.GetDirectoryName(path)!, Path.GetFileName(path))
+        {
+            NotifyFilter = NotifyFilters.LastWrite | NotifyFilters.Size | NotifyFilters.FileName,
+        };
+
+        watcher.Changed += (_, _) => onChanged();
+        watcher.Created += (_, _) => onChanged();
+        watcher.Renamed += (_, _) => onChanged();
+
+        watcher.EnableRaisingEvents = true;
+
+        return watcher;
     }
 
     /// <summary>How the Linux device key store asks for a PIN, and the only thing that ever calls it.</summary>
diff --git a/src/DodoSSH.Client.App/Views/MainWindow.axaml b/src/DodoSSH.Client.App/Views/MainWindow.axaml
index d1bd555..11ee21d 100644
--- a/src/DodoSSH.Client.App/Views/MainWindow.axaml
+++ b/src/DodoSSH.Client.App/Views/MainWindow.axaml
@@ -156,9 +156,19 @@
                       either: TransfersScreen draws that same string itself, both in its own empty state and
                       beside the remote pane's DISCONNECT once something is open.
                     -->
-                    <Grid Grid.Column="0" RowDefinitions="*,Auto">
+                    <!--
+                      Three rows since the disconnect strip arrived, and it is the same control the terminal
+                      surface draws — see SessionEndedBar.axaml, which resolves which surface it is about
+                      through the shell rather than through a binding of its own. Auto and empty except while
+                      the file session has been lost, so an ordinary browse pays nothing for it.
+
+                      Note the DataContext: this row is the shell's rather than the transfers screen's, which
+                      is why the strip sits here and not inside TransfersScreen.axaml.
+                    -->
+                    <Grid Grid.Column="0" RowDefinitions="*,Auto,Auto">
                       <views:TransfersScreen Grid.Row="0" DataContext="{Binding Transfers}" />
-                      <views:SessionStatusBar Grid.Row="1" />
+                      <views:SessionEndedBar Grid.Row="1" />
+                      <views:SessionStatusBar Grid.Row="2" />
                     </Grid>
                     <!--
                       Hides when no session is active — see ShowsQuickAccessSidebar — rather than always
diff --git a/src/DodoSSH.Client.App/Views/SessionEndedBar.axaml b/src/DodoSSH.Client.App/Views/SessionEndedBar.axaml
index 1abfcb6..ee341a2 100644
--- a/src/DodoSSH.Client.App/Views/SessionEndedBar.axaml
+++ b/src/DodoSSH.Client.App/Views/SessionEndedBar.axaml
@@ -5,17 +5,27 @@
              x:DataType="vm:MainWindowViewModel">
 
   <!--
-    ── What a terminal says once its shell has stopped ──────────────────────────────────────────────────
-    A strip between the pane and the status bar, shown only while the selected tab has a session that has
-    ended. It names which of the two endings it was, prints the sentence that came with it, and offers the
-    one thing worth offering: dialling the machine again.
+    ── What a session says once it has stopped ──────────────────────────────────────────────────────────
+    A strip between the pane and the status bar, shown only while the session in front of the user has
+    ended. It names which ending it was, prints the sentence that came with it, and offers the one thing
+    worth offering: dialling the machine again.
 
-    ◆ IT IS A ROW OF ITS OWN RATHER THAN SOMETHING DRAWN OVER THE PANE, and that is not a style choice.
-    The renderer is a native child view that composites above everything Avalonia draws, so a banner
-    overlapping its rectangle would either be invisible or would have to collapse the terminal — and
-    collapsing it is exactly wrong here, because the scrollback is what the user is reading. A dead shell's
-    last words are usually why it died. So this takes its own Auto row in the grid the WebView's Panel sits
-    in, and the pane simply gets 34 fewer pixels while it is up. See MainWindow.axaml.
+    ◆ ONE CONTROL ON BOTH SURFACES, and the shell is what resolves which it is drawn over. A terminal has
+    two endings to tell apart and a keychain entry to check before it can offer a redial; a file session has
+    one ending and already captured what it would dial. None of that is a decision a view should be making,
+    so every binding here is a MainWindowViewModel property that has already asked which surface is showing
+    — see SessionEndedText, CanReconnectSession and SessionEndedDismissLabel. The second button is even
+    labelled from the shell, because CLOSE TAB and DISCONNECT are noticeably different acts and one vague
+    word covering both would be the wrong kind of reuse.
+
+    ◆ IT IS A ROW OF ITS OWN RATHER THAN SOMETHING DRAWN OVER THE PANE, and on the terminal surface that is
+    not a style choice. The renderer is a native child view that composites above everything Avalonia draws,
+    so a banner overlapping its rectangle would either be invisible or would have to collapse the terminal —
+    and collapsing it is exactly wrong here, because the scrollback is what the user is reading. A dead
+    shell's last words are usually why it died. So this takes its own Auto row and the pane simply gets 34
+    fewer pixels while it is up. The file surface has no such constraint and takes the same row anyway,
+    because a listing left on screen is worth the same as a scrollback: it is where the user was, and it is
+    what makes RECONNECT mean something. See MainWindow.axaml for both placements.
 
     ◆ THE SENTENCE IS HERE AS WELL AS IN THE PANE ON PURPOSE. terminal.js writes the same string into the
     scrollback as a grey rule, which is right and is not enough: a machine that printed a page of shutdown
@@ -33,12 +43,13 @@
     RECONNECT is disabled rather than hidden when there is nothing to dial — a tab typed in by hand, or one
     whose host has left the keychain — because the answer to "why can I not reconnect this" is better given
     by a control that is visibly refusing than by one that is not there. See
-    MainWindowViewModel.CanReconnectSelectedTab, which is what draws that line, and ReconnectTabAsync for
-    what the button actually does: the vault's own connect path, into this same tab.
+    MainWindowViewModel.CanReconnectSession, which is what draws that line on each surface, and
+    ReconnectSessionAsync for what the button actually does: each surface's own connect path, back into the
+    thing that stopped. On the file side that includes walking back to the directory the pane was showing,
+    which is what makes it a reconnect rather than a connect.
 
-    CLOSE TAB is the same command the tab's cross runs. It is here because this is the moment the other
-    reasonable answer is "I have read it, take it away", and hunting for a 16-pixel cross in the strip above
-    is not the shape of that answer.
+    The second button is the moment the other reasonable answer is "I have read it, take it away" — and
+    hunting for a 16-pixel cross in the strip above is not the shape of that answer.
   -->
 
   <UserControl.Styles>
@@ -82,13 +93,11 @@
 
       <StackPanel Grid.Column="2" Orientation="Horizontal" Spacing="10" VerticalAlignment="Center">
         <Button Classes="ghost" Content="RECONNECT"
-                Command="{Binding ReconnectTabCommand}"
-                CommandParameter="{Binding SelectedTab}"
-                IsEnabled="{Binding CanReconnectSelectedTab, FallbackValue=False}"
-                ToolTip.Tip="Opens a new shell on this machine, in this tab. The scrollback above it goes." />
-        <Button Classes="ghost" Content="CLOSE TAB"
-                Command="{Binding CloseTabCommand}"
-                CommandParameter="{Binding SelectedTab}" />
+                Command="{Binding ReconnectSessionCommand}"
+                IsEnabled="{Binding CanReconnectSession, FallbackValue=False}"
+                ToolTip.Tip="Opens this connection again, in place." />
+        <Button Classes="ghost" Content="{Binding SessionEndedDismissLabel}"
+                Command="{Binding DismissEndedSessionCommand}" />
       </StackPanel>
 
     </Grid>
diff --git a/src/DodoSSH.Client.App/Views/SessionEndedBar.axaml.cs b/src/DodoSSH.Client.App/Views/SessionEndedBar.axaml.cs
index 003496d..806266e 100644
--- a/src/DodoSSH.Client.App/Views/SessionEndedBar.axaml.cs
+++ b/src/DodoSSH.Client.App/Views/SessionEndedBar.axaml.cs
@@ -2,11 +2,12 @@ using Avalonia.Controls;
 
 namespace DodoSSH.Client.App.Views;
 
-/// <summary>What the terminal surface says once the selected tab's shell has stopped.</summary>
+/// <summary>What the session shell says once the session in front of the user has stopped.</summary>
 /// <remarks>
-/// No code of its own: the word, the sentence and both buttons are the shell's. In its own file for the
-/// reason every other card here is — nothing inside <c>MainWindow</c> can be laid out by a test, because
-/// WebView2's adapter refuses the headless session's thread. See the markup.
+/// No code of its own: the word, the sentence and both buttons are the shell's, including which surface
+/// they are about — see the markup. In its own file for the reason every other card here is: nothing inside
+/// <c>MainWindow</c> can be laid out by a test, because WebView2's adapter refuses the headless session's
+/// thread.
 /// </remarks>
 internal sealed partial class SessionEndedBar : UserControl
 {
diff --git a/src/DodoSSH.Client.App/Views/TransfersScreen.axaml b/src/DodoSSH.Client.App/Views/TransfersScreen.axaml
index f003f5c..9ad0e66 100644
--- a/src/DodoSSH.Client.App/Views/TransfersScreen.axaml
+++ b/src/DodoSSH.Client.App/Views/TransfersScreen.axaml
@@ -319,20 +319,25 @@
                  SelectedItem="{Binding SelectedLocalEntry}">
           <ListBox.ItemTemplate>
             <DataTemplate x:DataType="vm:LocalEntryRowViewModel">
-              <Grid Height="38" Margin="14,0,10,0">
+              <Grid Height="38" Margin="6,0,10,0">
                 <Grid.ColumnDefinitions>
+                  <ColumnDefinition Width="24" />
                   <ColumnDefinition Width="20" />
                   <ColumnDefinition Width="3*" />
                   <ColumnDefinition Width="*" MaxWidth="66" />
                   <ColumnDefinition Width="1.6*" MaxWidth="124" />
                 </Grid.ColumnDefinitions>
-                <TextBlock Grid.Column="0" Classes="entryicon" Text="{Binding IconGlyph}" />
-                <TextBlock Grid.Column="1" Classes="mono entry" Classes.dir="{Binding IsNavigable}"
+                <!-- The remote pane's own tick, on this side and for the same reasons. -->
+                <CheckBox Grid.Column="0" MinWidth="0" VerticalAlignment="Center"
+                          IsChecked="{Binding IsChecked}"
+                          Click="OnLocalRowChecked" />
+                <TextBlock Grid.Column="1" Classes="entryicon" Text="{Binding IconGlyph}" />
+                <TextBlock Grid.Column="2" Classes="mono entry" Classes.dir="{Binding IsNavigable}"
                            Text="{Binding Name}" FontSize="13.5"
                            Margin="10,0,8,0" VerticalAlignment="Center" TextTrimming="CharacterEllipsis" />
-                <TextBlock Grid.Column="2" Classes="mono entrysize" Text="{Binding Size}" FontSize="12"
+                <TextBlock Grid.Column="3" Classes="mono entrysize" Text="{Binding Size}" FontSize="12"
                            Margin="8,0,0,0" HorizontalAlignment="Right" VerticalAlignment="Center" />
-                <TextBlock Grid.Column="3" Classes="mono entrydate" Text="{Binding Modified}" FontSize="12"
+                <TextBlock Grid.Column="4" Classes="mono entrydate" Text="{Binding Modified}" FontSize="12"
                            Margin="8,0,0,0" HorizontalAlignment="Right" VerticalAlignment="Center" />
               </Grid>
             </DataTemplate>
@@ -495,10 +500,50 @@
         <Border Grid.Row="2" Padding="12,5" BorderBrush="{StaticResource BorderSubtle}"
                 BorderThickness="0,0,0,1" IsVisible="{Binding ShowsRemoteItemActions}">
           <Grid ColumnDefinitions="*,Auto">
-            <TextBlock Grid.Column="0" Classes="mono" FontSize="11.5" VerticalAlignment="Center"
-                       Foreground="{StaticResource TextFaint}" TextTrimming="CharacterEllipsis"
-                       Text="{Binding SelectedRemoteName}" />
+            <!--
+              The chosen row's name, or the count once anything is ticked. The count wins because it is the
+              one the buttons beside it are actually about: with three rows gathered up, a name would be
+              describing whichever of them happens to be highlighted while DELETE takes all three.
+            -->
+            <StackPanel Grid.Column="0" Orientation="Horizontal" Spacing="8" VerticalAlignment="Center">
+              <Button Classes="ghost" Content="ALL" Command="{Binding ToggleAllRemoteCommand}"
+                      ToolTip.Tip="Tick every row, or untick them all" />
+              <TextBlock Classes="mono" FontSize="11.5" VerticalAlignment="Center"
+                         Foreground="{StaticResource TextFaint}" TextTrimming="CharacterEllipsis"
+                         Text="{Binding SelectedRemoteName}"
+                         IsVisible="{Binding !HasCheckedRemote}" />
+              <TextBlock Classes="mono" FontSize="11.5" VerticalAlignment="Center"
+                         Foreground="{StaticResource AccentText}"
+                         Text="{Binding CheckedRemoteLabel}"
+                         IsVisible="{Binding HasCheckedRemote}" />
+            </StackPanel>
             <StackPanel Grid.Column="1" Orientation="Horizontal" Spacing="4" Margin="8,0,0,0">
+              <!--
+                ◆ FOUR NOW, and this is the one that was missing: the PERMS column has been a true fact
+                about a file with nothing to be done about it since it arrived, so the commonest next act
+                after using this screen was opening a terminal to chmod what had just been uploaded. Dark on
+                a bucket rather than live-and-refused — an object has an access policy rather than nine bits;
+                see CanChangeRemotePermissions.
+
+                A lock rather than a key glyph: a key is what this application's keychain uses, and one here
+                would read as "which credential" over a row that has nothing to do with one.
+              -->
+              <!--
+                ◆ EDIT, and it is first because it is the only one of the five that changes nothing on the
+                host by pressing it: it fetches a copy and opens it. Dark on a head with no way to open a
+                file or watch one — see CanEditRemote, which is what the phone fails rather than this
+                button being absent there for a reason nobody can see.
+              -->
+              <Button Classes="paneicon" Command="{Binding EditRemoteCommand}"
+                      IsEnabled="{Binding CanEditRemote}"
+                      ToolTip.Tip="Open in this machine's editor, and send each save back">
+                <TextBlock FontFamily="{StaticResource IconFont}" FontSize="15" Text="&#xE3C9;" />
+              </Button>
+              <Button Classes="paneicon" Command="{Binding ChangeRemotePermissionsCommand}"
+                      IsEnabled="{Binding CanChangeRemotePermissions}"
+                      ToolTip.Tip="Permissions on the host">
+                <TextBlock FontFamily="{StaticResource IconFont}" FontSize="15" Text="&#xE897;" />
+              </Button>
               <Button Classes="paneicon" Command="{Binding RenameRemoteCommand}"
                       IsEnabled="{Binding CanRenameRemote}" ToolTip.Tip="Rename on the host">
                 <TextBlock FontFamily="{StaticResource IconFont}" FontSize="15" Text="&#xE9AD;" />
@@ -515,6 +560,80 @@
           </Grid>
         </Border>
 
+        <!--
+          ◆ WHAT AN EDIT SESSION SAYS FOR ITSELF, and it is a strip rather than a question: nothing is
+          waiting on an answer, a file is simply open somewhere else and each save is going back. It shares
+          the questions' Grid row because it is exclusive with them — opening any of the three needs a
+          selection, and while one is up ShowsRemoteItemActions has taken the buttons away.
+
+          The log is newest-first and bounded. Watching means saving happens more than once, and each one is
+          a round trip somebody may want to see happened; an editor that autosaves would otherwise grow this
+          without limit. See TransfersViewModel.RemoteEditLog.
+
+          The conflict card inside it is the one state where a save is not written back. Three answers,
+          because those are the three that exist: send it anyway, throw away what was typed and take the
+          host's copy, or stop. There is deliberately no merge — this client has no way to do one, and a
+          button that pretended otherwise would be the fabrication this project's honesty rule forbids.
+        -->
+        <Border Grid.Row="3" Padding="12,10" Background="{StaticResource Raised}"
+                BorderBrush="{StaticResource BorderSubtle}" BorderThickness="0,0,0,1"
+                IsVisible="{Binding IsEditingRemote}">
+          <!--
+            ◆ THE WHOLE STRIP SCROLLS, not just the log inside it, and that is what makes this safe at any
+            width. It is the tallest thing that can be in this Grid row — a heading, a path, a log, a
+            conflict card and a button — and unlike the three questions beside it, it is not modal: the
+            listing underneath stays live, because a file being open in an editor is no reason to stop
+            being able to browse. So it cannot be allowed to take the pane's height, and bounding the
+            container rather than each part means nothing added inside it later can undo that.
+
+            134 is measured. Inside the session shell this pane is 204x377, and ScreenLayoutTests draws
+            this in its worst case — the conflict card open with a session's worth of saves behind it.
+          -->
+          <ScrollViewer MaxHeight="134" VerticalScrollBarVisibility="Auto"
+                        HorizontalScrollBarVisibility="Disabled">
+          <StackPanel Spacing="7">
+            <TextBlock Classes="heading" FontSize="14" TextWrapping="Wrap"
+                       Text="{Binding RemoteEdit.Question}" />
+            <SelectableTextBlock Classes="mono" FontSize="11.5" TextWrapping="Wrap"
+                                 Foreground="{StaticResource TextFaint}"
+                                 Text="{Binding RemoteEdit.RemotePath}" />
+
+            <!-- Bounded inside a bounded strip: this keeps a long session's log from pushing the conflict
+                 card and STOP EDITING out of view within the scroller. -->
+            <ScrollViewer MaxHeight="48" VerticalScrollBarVisibility="Auto"
+                          HorizontalScrollBarVisibility="Disabled">
+              <ItemsControl ItemsSource="{Binding RemoteEditLog}">
+                <ItemsControl.ItemTemplate>
+                  <DataTemplate x:DataType="x:String">
+                    <TextBlock Classes="mono" FontSize="11" Margin="0,1"
+                               Foreground="{StaticResource TextGhost}" TextTrimming="CharacterEllipsis"
+                               Text="{Binding}" />
+                  </DataTemplate>
+                </ItemsControl.ItemTemplate>
+              </ItemsControl>
+            </ScrollViewer>
+
+            <Border Padding="10,8" CornerRadius="8" Background="{StaticResource DangerWash}"
+                    BorderBrush="{StaticResource DangerSoft}" BorderThickness="1"
+                    IsVisible="{Binding HasRemoteEditConflict}">
+              <StackPanel Spacing="6">
+                <TextBlock Foreground="{StaticResource WarnText}" FontSize="12" TextWrapping="Wrap"
+                           Text="{Binding RemoteEditConflict}" />
+                <WrapPanel>
+                  <Button Classes="ghost" Content="UPLOAD ANYWAY" Margin="0,0,8,4"
+                          Command="{Binding ForceSaveEditCommand}" />
+                  <Button Classes="ghost" Content="RELOAD" Margin="0,0,0,4"
+                          Command="{Binding ReloadEditCommand}" />
+                </WrapPanel>
+              </StackPanel>
+            </Border>
+
+            <Button Classes="ghost" Content="STOP EDITING" HorizontalAlignment="Left"
+                    Command="{Binding StopEditingCommand}" />
+          </StackPanel>
+          </ScrollViewer>
+        </Border>
+
         <!--
           The question DELETE asks. It names the full path rather than the file, because a name is the half
           that does not identify anything — and that is now the whole of how the question says which row it
@@ -537,9 +656,28 @@
           <StackPanel Spacing="7">
             <TextBlock Classes="heading" FontSize="14" TextWrapping="Wrap"
                        Text="{Binding PendingRemoteDeletion.Question}" />
-            <SelectableTextBlock Classes="mono" FontSize="11.5" TextWrapping="Wrap"
-                                 Foreground="{StaticResource Danger}"
-                                 Text="{Binding PendingRemoteDeletion.FullPath}" />
+            <!--
+              Every path, one per line, and never a count on its own: agreeing to "3 items" is agreeing to a
+              number. See RemoteDeletionRequest.Listing.
+
+              ◆ 32, AND THE NUMBER IS MEASURED RATHER THAN CHOSEN. A ticked set has no ceiling, so this list
+              has to scroll, and the budget it scrolls inside is small: within the session shell this pane is
+              204 wide, where one remote path wraps to two lines, and the card also carries a heading, the
+              consequence and two buttons that wrap onto two rows at that width. 120 put the buttons outside
+              the window; 72 left CANCEL three pixels under it; 56 and 40 pushed the listing's own squeezed
+              row past the bottom — each caught by ScreenLayoutTests, which is why the five-path test exists
+              beside the single-path one rather than instead of it. 32 is one wrapped path, which is exactly
+              what the single-path question has always shown.
+
+              What that buys is a scrollbar rather than a taller card, and the heading carries the count so
+              the number is never the thing being scrolled for.
+            -->
+            <ScrollViewer MaxHeight="32" VerticalScrollBarVisibility="Auto"
+                          HorizontalScrollBarVisibility="Disabled">
+              <SelectableTextBlock Classes="mono" FontSize="11.5" TextWrapping="Wrap"
+                                   Foreground="{StaticResource Danger}"
+                                   Text="{Binding PendingRemoteDeletion.Listing}" />
+            </ScrollViewer>
             <TextBlock Foreground="{StaticResource WarnText}" FontSize="12" TextWrapping="Wrap"
                        Text="{Binding PendingRemoteDeletion.Consequence}" />
             <WrapPanel>
@@ -603,6 +741,90 @@
           </StackPanel>
         </Border>
 
+        <!--
+          ◆ THE MODE, as nine boxes and the number they add up to.
+
+          In the same Grid row as the other two questions and never at the same time as either — each one's
+          own opening clears the others, which is what makes one row enough for all three.
+
+          Boxes rather than a field to type 755 into, and that is the design rather than a preference: the
+          mode is already drawn as -rwxr-xr-x in the column this form was opened from, so a who-can-do-what
+          grid is the same representation the reader is already holding. An octal field would ask them to
+          translate something they can see into something they cannot check. The octal is printed underneath
+          as it changes, so the two readings check each other rather than one replacing the other.
+
+          The EXEC column is headed from the request rather than fixed, because on a directory that bit is
+          permission to enter it — the commonest misreading of a POSIX mode there is, and one word fixes it.
+          See RemotePermissionsRequest.ExecuteLabel.
+
+          APPLY is dead until something has actually changed. A round trip that sets a mode to the mode it
+          already has is not wrong, only pointless, and a live button over an untouched form invites it.
+
+          Not painted in the deletion card's red. Changing a mode is undone by changing it back; the red is
+          spent on the one thing here that nothing walks back, and spending it twice would make it stop
+          meaning anything — the same argument the rename form above makes for itself.
+        -->
+        <Border Grid.Row="3" Padding="12,10" Background="{StaticResource Raised}"
+                BorderBrush="{StaticResource BorderSubtle}" BorderThickness="0,0,0,1"
+                IsVisible="{Binding IsChangingRemotePermissions}">
+          <StackPanel Spacing="7">
+            <TextBlock Classes="heading" FontSize="14" TextWrapping="Wrap"
+                       Text="{Binding PendingRemotePermissions.Question}" />
+            <SelectableTextBlock Classes="mono" FontSize="11.5" TextWrapping="Wrap"
+                                 Foreground="{StaticResource TextFaint}"
+                                 Text="{Binding PendingRemotePermissions.FullPath}" />
+
+            <Grid ColumnDefinitions="Auto,*,*,*" RowDefinitions="Auto,Auto,Auto,Auto" Margin="0,2">
+              <TextBlock Grid.Row="0" Grid.Column="1" Classes="hint" FontSize="10.5" Text="read"
+                         HorizontalAlignment="Center" />
+              <TextBlock Grid.Row="0" Grid.Column="2" Classes="hint" FontSize="10.5" Text="write"
+                         HorizontalAlignment="Center" />
+              <TextBlock Grid.Row="0" Grid.Column="3" Classes="hint" FontSize="10.5"
+                         Text="{Binding PendingRemotePermissions.ExecuteLabel}"
+                         HorizontalAlignment="Center" />
+
+              <TextBlock Grid.Row="1" Grid.Column="0" Classes="mono" FontSize="11.5" Text="owner"
+                         VerticalAlignment="Center" Margin="0,0,10,0" />
+              <CheckBox Grid.Row="1" Grid.Column="1" HorizontalAlignment="Center" MinWidth="0"
+                        IsChecked="{Binding PendingRemotePermissions.OwnerRead}" />
+              <CheckBox Grid.Row="1" Grid.Column="2" HorizontalAlignment="Center" MinWidth="0"
+                        IsChecked="{Binding PendingRemotePermissions.OwnerWrite}" />
+              <CheckBox Grid.Row="1" Grid.Column="3" HorizontalAlignment="Center" MinWidth="0"
+                        IsChecked="{Binding PendingRemotePermissions.OwnerExecute}" />
+
+              <TextBlock Grid.Row="2" Grid.Column="0" Classes="mono" FontSize="11.5" Text="group"
+                         VerticalAlignment="Center" Margin="0,0,10,0" />
+              <CheckBox Grid.Row="2" Grid.Column="1" HorizontalAlignment="Center" MinWidth="0"
+                        IsChecked="{Binding PendingRemotePermissions.GroupRead}" />
+              <CheckBox Grid.Row="2" Grid.Column="2" HorizontalAlignment="Center" MinWidth="0"
+                        IsChecked="{Binding PendingRemotePermissions.GroupWrite}" />
+              <CheckBox Grid.Row="2" Grid.Column="3" HorizontalAlignment="Center" MinWidth="0"
+                        IsChecked="{Binding PendingRemotePermissions.GroupExecute}" />
+
+              <TextBlock Grid.Row="3" Grid.Column="0" Classes="mono" FontSize="11.5" Text="others"
+                         VerticalAlignment="Center" Margin="0,0,10,0" />
+              <CheckBox Grid.Row="3" Grid.Column="1" HorizontalAlignment="Center" MinWidth="0"
+                        IsChecked="{Binding PendingRemotePermissions.OthersRead}" />
+              <CheckBox Grid.Row="3" Grid.Column="2" HorizontalAlignment="Center" MinWidth="0"
+                        IsChecked="{Binding PendingRemotePermissions.OthersWrite}" />
+              <CheckBox Grid.Row="3" Grid.Column="3" HorizontalAlignment="Center" MinWidth="0"
+                        IsChecked="{Binding PendingRemotePermissions.OthersExecute}" />
+            </Grid>
+
+            <SelectableTextBlock Classes="mono" FontSize="12.5"
+                                 Foreground="{StaticResource AccentText}"
+                                 Text="{Binding PendingRemotePermissions.Preview}" />
+
+            <WrapPanel>
+              <Button Classes="accent" Content="APPLY" Margin="0,0,8,4"
+                      Command="{Binding ConfirmRemotePermissionsCommand}"
+                      IsEnabled="{Binding PendingRemotePermissions.HasChanges}" />
+              <Button Classes="ghost" Content="CANCEL" Margin="0,0,0,4"
+                      Command="{Binding CancelRemotePermissionsCommand}" />
+            </WrapPanel>
+          </StackPanel>
+        </Border>
+
         <!--
           Away while a question is up, for the reason the item row above states: the trail is where the pane
           is and MKDIR makes a directory, and neither is what somebody answering a question about one row
@@ -681,24 +903,42 @@
                  SelectedItem="{Binding SelectedRemoteEntry}">
           <ListBox.ItemTemplate>
             <DataTemplate x:DataType="vm:RemoteEntryRowViewModel">
-              <Grid Height="38" Margin="14,0,10,0">
+              <Grid Height="38" Margin="6,0,10,0">
                 <Grid.ColumnDefinitions>
+                  <ColumnDefinition Width="24" />
                   <ColumnDefinition Width="20" />
                   <ColumnDefinition Width="2*" />
                   <ColumnDefinition Width="*" MaxWidth="66" />
                   <ColumnDefinition Width="1.6*" MaxWidth="124" />
                   <ColumnDefinition Width="*" MaxWidth="66" />
                 </Grid.ColumnDefinitions>
-                <TextBlock Grid.Column="0" Classes="entryicon" Text="{Binding IconGlyph}" />
-                <TextBlock Grid.Column="1" Classes="mono entry" Classes.dir="{Binding IsNavigable}"
+                <!--
+                  ◆ THE TICK IS NOT THE LIST'S SELECTION, and the two answer different questions. The
+                  selection is "the row I am looking at", which is what rename, move and permissions act on
+                  — each takes a form naming one path and is one-at-a-time by construction. This is "the
+                  rows I have gathered up", which is what DOWNLOAD and DELETE act on, and it survives the
+                  highlight moving.
+
+                  It is drawn rather than left to ctrl-click for a reason beyond taste: the phone head shares
+                  this view model and has neither ctrl nor shift, so a multi-selection has to be a tap target
+                  there whatever this pane does. One shape on both heads, and a state somebody can see.
+
+                  Click is handled rather than bound one-way, because the count above the list is a property
+                  of the collection rather than of any row — see TransfersViewModel.RemoteChecksChanged.
+                -->
+                <CheckBox Grid.Column="0" MinWidth="0" VerticalAlignment="Center"
+                          IsChecked="{Binding IsChecked}"
+                          Click="OnRemoteRowChecked" />
+                <TextBlock Grid.Column="1" Classes="entryicon" Text="{Binding IconGlyph}" />
+                <TextBlock Grid.Column="2" Classes="mono entry" Classes.dir="{Binding IsNavigable}"
                            Classes.exec="{Binding IsExecutable}"
                            Text="{Binding Name}" FontSize="13.5"
                            Margin="10,0,8,0" VerticalAlignment="Center" TextTrimming="CharacterEllipsis" />
-                <TextBlock Grid.Column="2" Classes="mono entrysize" Text="{Binding Size}" FontSize="12"
+                <TextBlock Grid.Column="3" Classes="mono entrysize" Text="{Binding Size}" FontSize="12"
                            Margin="8,0,0,0" HorizontalAlignment="Right" VerticalAlignment="Center" />
-                <TextBlock Grid.Column="3" Classes="mono entrydate" Text="{Binding Modified}" FontSize="12"
+                <TextBlock Grid.Column="4" Classes="mono entrydate" Text="{Binding Modified}" FontSize="12"
                            Margin="8,0,0,0" HorizontalAlignment="Right" VerticalAlignment="Center" />
-                <TextBlock Grid.Column="4" Classes="mono perms" Classes.loose="{Binding IsWorldWritable}"
+                <TextBlock Grid.Column="5" Classes="mono perms" Classes.loose="{Binding IsWorldWritable}"
                            Text="{Binding Permissions}" FontSize="10" Margin="6,0,0,0"
                            HorizontalAlignment="Right" VerticalAlignment="Center" TextTrimming="CharacterEllipsis" />
               </Grid>
@@ -732,8 +972,14 @@
           the picker arrives, so the tall shape is the form rather than form-plus-prose, and neither shape
           reaches the floor. Anything added here has to hold that; the layout suite measures both.
         -->
+        <!--
+          ShowsRemoteInvitation rather than !IsConnected, which are no longer the same question. Pressing
+          DISCONNECT empties this pane, so an invitation over it covers nothing; a connection lost
+          underneath somebody leaves the listing exactly where it was, and covering that would hide the one
+          thing the strip below is offering to put them back into. See TransfersViewModel.ShowsRemoteContents.
+        -->
         <Border Grid.Row="1" Grid.RowSpan="6" Background="{StaticResource Canvas}"
-                IsVisible="{Binding !IsConnected}">
+                IsVisible="{Binding ShowsRemoteInvitation}">
           <StackPanel Spacing="10" Margin="20" MaxWidth="320"
                       HorizontalAlignment="Center" VerticalAlignment="Center">
 
diff --git a/src/DodoSSH.Client.App/Views/TransfersScreen.axaml.cs b/src/DodoSSH.Client.App/Views/TransfersScreen.axaml.cs
index e580285..5adcd08 100644
--- a/src/DodoSSH.Client.App/Views/TransfersScreen.axaml.cs
+++ b/src/DodoSSH.Client.App/Views/TransfersScreen.axaml.cs
@@ -79,6 +79,20 @@ internal sealed partial class TransfersScreen : UserControl
 
     private TransfersViewModel? Transfers => DataContext as TransfersViewModel;
 
+    /// <summary>
+    /// Tells the screen a row's tick moved, so the count and the buttons that read it keep up.
+    /// </summary>
+    /// <remarks>
+    /// The tick itself is two-way bound and needs nothing from here; what does is the count above the list,
+    /// which is a property of the collection rather than of any row. Subscribing per row would be a
+    /// subscription to attach and detach on every navigation, since each listing replaces every row it has.
+    /// See <c>TransfersViewModel.RemoteChecksChanged</c>.
+    /// </remarks>
+    private void OnRemoteRowChecked(object? sender, RoutedEventArgs e) => Transfers?.RemoteChecksChanged();
+
+    /// <inheritdoc cref="OnRemoteRowChecked" />
+    private void OnLocalRowChecked(object? sender, RoutedEventArgs e) => Transfers?.LocalChecksChanged();
+
     private void OnLocalActivated(object? sender, TappedEventArgs e)
     {
         if (Transfers is { } transfers)
diff --git a/src/DodoSSH.Client.ObjectStore/S3FileStore.cs b/src/DodoSSH.Client.ObjectStore/S3FileStore.cs
index 13fbacb..7f33d97 100644
--- a/src/DodoSSH.Client.ObjectStore/S3FileStore.cs
+++ b/src/DodoSSH.Client.ObjectStore/S3FileStore.cs
@@ -55,6 +55,24 @@ internal sealed class S3FileStore : IRemoteFileStore
     /// </remarks>
     public bool IsConnected => Volatile.Read(ref disposed) == 0;
 
+    /// <inheritdoc />
+    /// <remarks>
+    /// Null forever, for the reason <see cref="IsConnected"/> is always true: there is no connection under
+    /// this to be lost. A request that fails reports itself, and nothing here outlives one.
+    /// </remarks>
+    public string? TransportFailure => null;
+
+    /// <inheritdoc />
+    /// <remarks>
+    /// Never raised; see <see cref="TransportFailure"/>. Declared rather than left off the type because the
+    /// screen holds whichever store it opened as an <c>IRemoteFileStore</c> and subscribes without asking
+    /// which kind it got — an event that is simply never raised is what makes that honest rather than a
+    /// cast and a branch.
+    /// </remarks>
+#pragma warning disable CS0067 // The event is never used
+    public event EventHandler? ConnectionLost;
+#pragma warning restore CS0067
+
     /// <inheritdoc />
     public string HomeDirectory => ObjectKeys.Root;
 
@@ -383,6 +401,32 @@ internal sealed class S3FileStore : IRemoteFileStore
     /// a rename's clothing, and the failure mode is a half-moved directory.
     /// </para>
     /// </remarks>
+    /// <inheritdoc />
+    /// <remarks>
+    /// Refused rather than approximated. An object is governed by an ACL and a bucket policy, which are not
+    /// nine bits and do not map onto them — writing something plausible here would put a mode in a listing
+    /// that no request would ever be decided by.
+    /// </remarks>
+    public Task SetPermissionsAsync(string path, int mode, CancellationToken cancellationToken) =>
+        throw new SftpPathException(
+            path,
+            "An object in a bucket has an access policy rather than a POSIX mode, so there is nothing here to set.");
+
+    /// <inheritdoc />
+    /// <remarks>
+    /// Refused for the reason above: an object's timestamp is when the service stored it, and there is no
+    /// request that says otherwise. A copy that claimed the source's time would be a date the bucket does
+    /// not agree with.
+    /// </remarks>
+    public Task SetLastWriteTimeAsync(
+        string path,
+        DateTimeOffset lastWriteTimeUtc,
+        CancellationToken cancellationToken) =>
+        throw new SftpPathException(
+            path,
+            "An object's timestamp is when the bucket stored it, and cannot be set to anything else.");
+
+    /// <inheritdoc />
     public async Task RenameAsync(string fromPath, string toPath, CancellationToken cancellationToken)
     {
         ArgumentNullException.ThrowIfNull(fromPath);
diff --git a/src/DodoSSH.Client.Shell/ViewModels/MainWindowViewModel.cs b/src/DodoSSH.Client.Shell/ViewModels/MainWindowViewModel.cs
index cc90c18..9ef7a75 100644
--- a/src/DodoSSH.Client.Shell/ViewModels/MainWindowViewModel.cs
+++ b/src/DodoSSH.Client.Shell/ViewModels/MainWindowViewModel.cs
@@ -493,6 +493,15 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     /// absence of a line rather than by a line somebody has to remember to keep a no-op; and ADR 0011 settles
     /// the Android head's distribution separately, so it must never acquire one by accident.
     /// </param>
+    /// <param name="openInEditor">
+    /// Opens a local path with whatever this machine opens that kind of file with, or null on a head that
+    /// has no such notion. Forwarded straight to <see cref="TransfersViewModel"/>, which is the only thing
+    /// that uses it — see its own remark for why this is a delegate and what null means.
+    /// </param>
+    /// <param name="watchFile">
+    /// Watches one local file for changes until the handle it returns is disposed, or null where nothing
+    /// can. Forwarded with <paramref name="openInEditor"/> and useless without it.
+    /// </param>
     /// <param name="post">
     /// Runs an action on the thread this shell's view models are read from. Defaults to the UI thread's
     /// dispatcher, which is the answer in every real head.
@@ -520,7 +529,9 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
         Func<string, Task>? copyToClipboard = null,
         string? deviceName = null,
         IUpdateChannel? updates = null,
-        Action<Action>? post = null)
+        Action<Action>? post = null,
+        Func<string, Task>? openInEditor = null,
+        Func<string, Action, IDisposable>? watchFile = null)
     {
         this.post = post ?? (action => Dispatcher.UIThread.Post(action));
 
@@ -543,7 +554,7 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
         // The fourth argument is the route out of the S3 screen's empty state. A bucket is made on the
         // keychain screen, which is a different tab and two clicks away from somebody who has gone to S3
         // to add one — so the screen that needs a bucket is given a way to reach the screen that makes one.
-        transfers = new TransfersViewModel(sftpSessions, clock, addBucket: ShowNewBucket);
+        transfers = CreateFileBrowser(sftpSessions, clock, openInEditor, watchFile);
 
         // Built once, like the workspace it writes for, and given a vault only while one is open. It has to
         // outlive every lock for the same reason the workspace does: a shell opened before a lock is still
@@ -612,6 +623,32 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
         _ = RunSessionElapsedTickAsync(sessionElapsedTick.Token);
     }
 
+    /// <summary>Builds the file browser, which is composed once and outlives every lock.</summary>
+    /// <remarks>
+    /// A method rather than four more lines in the constructor, which is already at the length the analyzers
+    /// allow — the same reason <see cref="CreateUpdateScreen"/> is one.
+    /// <para>
+    /// It is handed this shell's own posting delegate rather than left to default to the UI dispatcher,
+    /// which is what it did while nothing it posted was worth asserting on. A connection lost underneath the
+    /// file browser is raised on SSH.NET's message-listener thread and has to cross onto the thread these
+    /// view models are read from — the same crossing connection phases already make — and a suite with no
+    /// window has no way to drain a dispatcher it does not own. Both defaults are the UI dispatcher, so it
+    /// changes nothing in either head.
+    /// </para>
+    /// </remarks>
+    private TransfersViewModel CreateFileBrowser(
+        ISftpSessionFactory sftpSessions,
+        TimeProvider clock,
+        Func<string, Task>? openInEditor,
+        Func<string, Action, IDisposable>? watchFile) =>
+        new(
+            sftpSessions,
+            clock,
+            post: post,
+            addBucket: ShowNewBucket,
+            openInEditor: openInEditor,
+            watchFile: watchFile);
+
     /// <summary>
     /// Builds the updater, kept for the life of the process like the workspace and the transfer queue.
     /// </summary>
@@ -3823,13 +3860,25 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     /// null while it has not.
     /// </summary>
     /// <remarks>
-    /// Terminal-only, because it is a fact about a shell. The SFTP surface reports its own connection
-    /// through <see cref="TransfersViewModel.IsConnected"/> and has no ending to word: a transfer session is
-    /// opened per browse and closed when the screen is left, so there is no state in which one has stopped
-    /// while somebody is still looking at it.
+    /// <para>
+    /// Both surfaces, and only one word on the file side. A shell has two endings worth telling apart —
+    /// somebody typed <c>exit</c>, or the machine stopped answering — and a file session has one: this
+    /// screen closing it is a disconnect nobody needs told about, so the only ending left to word is the one
+    /// that happened on its own.
+    /// </para>
+    /// <para>
+    /// A bucket never reaches this. It is HTTP per request with no connection to lose, so
+    /// <see cref="TransfersViewModel.IsConnectionLost"/> is false for one however badly a request goes —
+    /// which is honest rather than a gap: a failed request against a bucket is a failed request, and the
+    /// screen already reports it as one.
+    /// </para>
     /// </remarks>
-    internal string? SessionEndedText =>
-        IsTerminalSurface ? SelectedTab?.EndedSummary : null;
+    internal string? SessionEndedText => Surface switch
+    {
+        ShellSurface.Terminal => SelectedTab?.EndedSummary,
+        _ when IsTransfersShowing => Transfers.IsConnectionLost ? "DISCONNECTED" : null,
+        _ => null,
+    };
 
     /// <summary>Whether the selected tab's session ended because the connection broke.</summary>
     /// <remarks>
@@ -3837,8 +3886,16 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     /// reason this is a second question rather than "did it end". One of the two is somebody having finished
     /// what they were doing and the other is a machine that stopped answering.
     /// </remarks>
-    internal bool IsSessionDropped =>
-        IsTerminalSurface && SelectedTab?.EndReason is SshSessionEnd.ConnectionLost;
+    internal bool IsSessionDropped => Surface switch
+    {
+        ShellSurface.Terminal => SelectedTab?.EndReason is SshSessionEnd.ConnectionLost,
+
+        // The file side's one ending is the lost one, so where the terminal has to ask which it was, this
+        // only has to ask whether there was one.
+        _ when IsTransfersShowing => Transfers.IsConnectionLost,
+
+        _ => false,
+    };
 
     /// <summary>
     /// Whether the status bar should say NOT CONNECTED rather than name an ending.
@@ -3860,8 +3917,79 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     /// the line explaining itself off the screen, and this is the copy that stays put. See
     /// <see cref="TerminalTabViewModel.EndedDetail"/> for the case where it is not that string.
     /// </remarks>
-    internal string? SessionEndedDetail =>
-        IsTerminalSurface ? SelectedTab?.EndedDetail : null;
+    internal string? SessionEndedDetail => Surface switch
+    {
+        ShellSurface.Terminal => SelectedTab?.EndedDetail,
+        _ when IsTransfersShowing => Transfers.LostConnection,
+        _ => null,
+    };
+
+    /// <summary>
+    /// Whether the strip under a stopped session may offer to dial again.
+    /// </summary>
+    /// <remarks>
+    /// One question resolved by surface, for the reason <see cref="SessionAddress"/> is: the strip is the
+    /// same markup on both, and a view branching on which one it is drawn over would be the shell's own job
+    /// done in XAML. The two halves are genuinely different questions — a terminal needs a keychain entry to
+    /// redial, and a file session already captured what it would dial when it connected.
+    /// </remarks>
+    internal bool CanReconnectSession => Surface switch
+    {
+        ShellSurface.Terminal => CanReconnectSelectedTab,
+        _ when IsTransfersShowing => Transfers.IsConnectionLost,
+        _ => false,
+    };
+
+    /// <summary>What the strip's second button says, which is not the same act on the two surfaces.</summary>
+    /// <remarks>
+    /// A terminal's tab is a thing that can be taken away and a file session's pane is not — there is one of
+    /// it, and what "dismiss" means there is putting the screen back to its invitation. Two labels rather
+    /// than one vague one, because a button that said CLOSE on both would be doing noticeably different
+    /// things.
+    /// </remarks>
+    internal string SessionEndedDismissLabel => IsTerminalSurface ? "CLOSE TAB" : "DISCONNECT";
+
+    /// <summary>Dials again, whichever kind of session stopped.</summary>
+    /// <remarks>
+    /// Each half is the surface's own reconnect rather than a third path: the terminal's goes through the
+    /// vault's connect command into the tab that stopped, and the file side's re-opens on the remote it
+    /// captured and walks back to the directory it was showing.
+    /// </remarks>
+    [RelayCommand]
+    private async Task ReconnectSessionAsync(CancellationToken cancellationToken)
+    {
+        if (IsTerminalSurface)
+        {
+            await ReconnectTabAsync(SelectedTab).ConfigureAwait(true);
+            return;
+        }
+
+        if (IsTransfersShowing)
+        {
+            await Transfers.ReconnectCommand.ExecuteAsync(null).ConfigureAwait(true);
+        }
+    }
+
+    /// <summary>Takes the stopped session away, whichever kind it is.</summary>
+    /// <inheritdoc cref="SessionEndedDismissLabel" path="/remarks" />
+    [RelayCommand]
+    private async Task DismissEndedSessionAsync()
+    {
+        if (IsTerminalSurface)
+        {
+            if (SelectedTab is { } tab)
+            {
+                await CloseTabAsync(tab).ConfigureAwait(true);
+            }
+
+            return;
+        }
+
+        if (IsTransfersShowing)
+        {
+            await Transfers.DisconnectCommand.ExecuteAsync(null).ConfigureAwait(true);
+        }
+    }
 
     /// <summary>
     /// Opens a new shell on the machine a stopped tab was pointed at, in that tab.
@@ -4382,7 +4510,13 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     internal string? SessionAddress => Surface switch
     {
         ShellSurface.Terminal => SelectedTab?.Address,
-        _ when IsTransfersShowing => Transfers.IsConnected ? Transfers.ConnectedTo : null,
+
+        // Connected, or connected until the link went. A session that has just been lost still has a host
+        // worth naming — it is the one the strip is offering to dial again — and requiring IsConnected here
+        // collapsed the entire left half of the status bar at exactly the moment it had the most to say.
+        _ when IsTransfersShowing =>
+            Transfers.IsConnected || Transfers.IsConnectionLost ? Transfers.ConnectedTo : null,
+
         _ => null,
     };
 
@@ -4520,6 +4654,8 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
         OnPropertyChanged(nameof(IsSessionDropped));
         OnPropertyChanged(nameof(IsSessionIdle));
         OnPropertyChanged(nameof(CanReconnectSelectedTab));
+        OnPropertyChanged(nameof(CanReconnectSession));
+        OnPropertyChanged(nameof(SessionEndedDismissLabel));
         OnPropertyChanged(nameof(SessionElapsedText));
         OnPropertyChanged(nameof(SessionCipher));
         OnPropertyChanged(nameof(SessionHostKeyAlgorithm));
@@ -4543,6 +4679,8 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     {
         if (e.PropertyName is nameof(TransfersViewModel.SelectedHost)
             or nameof(TransfersViewModel.IsConnected)
+            or nameof(TransfersViewModel.IsConnectionLost)
+            or nameof(TransfersViewModel.LostConnection)
             or nameof(TransfersViewModel.Remote)
             or nameof(TransfersViewModel.ConnectedTo)
             or nameof(TransfersViewModel.ConnectedCipher)
diff --git a/src/DodoSSH.Client.Shell/ViewModels/TransfersViewModel.cs b/src/DodoSSH.Client.Shell/ViewModels/TransfersViewModel.cs
index 40748b1..3f2b7bf 100644
--- a/src/DodoSSH.Client.Shell/ViewModels/TransfersViewModel.cs
+++ b/src/DodoSSH.Client.Shell/ViewModels/TransfersViewModel.cs
@@ -28,8 +28,28 @@ internal enum RemoteKind
 internal sealed record CrumbViewModel(string Name, string Path);
 
 /// <summary>One remote file or directory, as a row.</summary>
-internal sealed class RemoteEntryRowViewModel(SftpEntry entry)
+internal sealed partial class RemoteEntryRowViewModel(SftpEntry entry) : ObservableObject
 {
+    /// <summary>
+    /// Whether this row is in the set the batch actions act on.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// ◆ <b>A tick of its own rather than the list control's selection, and the two are different things
+    /// here.</b> The selection is "the row I am looking at", which is what rename, move and permissions act
+    /// on — all three are one-at-a-time by construction and take a form that names one path. This is "the
+    /// rows I have gathered up", which is what downloading and deleting act on, and it survives the
+    /// selection moving.
+    /// </para>
+    /// <para>
+    /// It is also the only shape that works on both heads. A phone has no shift-click and no ctrl-click, so
+    /// a multi-selection there has to be a tap target either way — and one that is drawn is one somebody can
+    /// see the state of, which for a batch delete is worth more than the two keystrokes it costs a desk.
+    /// </para>
+    /// </remarks>
+    [ObservableProperty]
+    private bool isChecked;
+
     internal SftpEntry Entry => entry;
 
     internal string Name => entry.Name;
@@ -81,8 +101,12 @@ internal sealed class RemoteEntryRowViewModel(SftpEntry entry)
 /// developed on Windows, where a POSIX mode is not a fact about a file. The column is empty on this side
 /// rather than filled with a plausible-looking <c>-rw-r--r--</c>.
 /// </remarks>
-internal sealed class LocalEntryRowViewModel(LocalEntry entry)
+internal sealed partial class LocalEntryRowViewModel(LocalEntry entry) : ObservableObject
 {
+    /// <inheritdoc cref="RemoteEntryRowViewModel.IsChecked" />
+    [ObservableProperty]
+    private bool isChecked;
+
     internal LocalEntry Entry => entry;
 
     internal string Name => entry.Name;
@@ -286,25 +310,61 @@ internal sealed partial class TransferRowViewModel(TransferSnapshot snapshot) :
 /// anything: <c>config</c> in the directory that was showing a moment ago and <c>config</c> in the one
 /// showing now look identical in a confirmation, and only one of them is the file somebody meant.
 /// </para>
+/// <para>
+/// <b>It covers however many were ticked, and it names them all.</b> A batch delete that said "3 items" and
+/// nothing else would be asking somebody to agree to a number — the paths are what makes the question
+/// answerable, and they are the whole of what this form has to show for the risk it is taking.
+/// </para>
 /// </remarks>
+/// <param name="Paths">
+/// What is being deleted, each with the name and kind it was listed under. Never empty: the command that
+/// builds one refuses before it gets here.
+/// </param>
+internal sealed record RemoteDeletionRequest(IReadOnlyList<RemoteDeletionTarget> Paths)
+{
+    /// <summary>The one path, when there is one — which is every question this screen asked before batches.</summary>
+    internal RemoteDeletionTarget First => Paths[0];
+
+    /// <summary>How many.</summary>
+    internal int Count => Paths.Count;
+
+    /// <summary>Whether this is the ordinary one-row question.</summary>
+    internal bool IsSingle => Count == 1;
+
+    /// <summary>Whether every one of them is a directory, which changes what the host will refuse.</summary>
+    private bool AllDirectories => Paths.All(target => target.IsDirectory);
+
+    /// <summary>The question, naming the kind because the two behave differently.</summary>
+    internal string Question => IsSingle
+        ? First.IsDirectory
+            ? $"Delete the directory '{First.Name}' on the host?"
+            : $"Delete '{First.Name}' on the host?"
+        : $"Delete {Count} items on the host?";
+
+    /// <summary>
+    /// What is about to go, one path per line.
+    /// </summary>
+    /// <remarks>
+    /// The full paths rather than the names, for the reason this record carries them: <c>config</c> in the
+    /// directory that was showing a moment ago and <c>config</c> in the one showing now look identical in a
+    /// confirmation, and only one of them is the file somebody meant.
+    /// </remarks>
+    internal string Listing => string.Join('\n', Paths.Select(target => target.FullPath));
+
+    /// <summary>What it costs, which is everything: there is no copy here and no undo there.</summary>
+    internal string Consequence => AllDirectories
+        ? "Removed on the host itself. The host refuses a directory that still has anything in it, so this "
+            + "either removes empty ones or fails — and what goes is gone: nothing here keeps a copy and "
+            + "there is no undo."
+        : "Removed on the host itself. Nothing here keeps a copy, the folder on this machine is not "
+            + "touched, and there is no undo.";
+}
+
+/// <summary>One thing a deletion question is about.</summary>
 /// <param name="Name">What the row was called.</param>
 /// <param name="FullPath">Where it is, which is what the question actually promises to delete.</param>
 /// <param name="IsDirectory">Whether it is a directory, which the host treats differently.</param>
-internal sealed record RemoteDeletionRequest(string Name, string FullPath, bool IsDirectory)
-{
-    /// <summary>The question, naming the kind because the two behave differently.</summary>
-    internal string Question => IsDirectory
-        ? $"Delete the directory '{Name}' on the host?"
-        : $"Delete '{Name}' on the host?";
-
-    /// <summary>What it costs, which is everything: there is no copy here and no undo there.</summary>
-    internal string Consequence => IsDirectory
-        ? "It is removed on the host itself. The host refuses a directory that still has anything in it, so "
-            + "this either removes an empty one or fails — and if it goes, it is gone: nothing here keeps a "
-            + "copy and there is no undo."
-        : "It is removed on the host itself. Nothing here keeps a copy, the folder on this machine is not "
-            + "touched, and there is no undo.";
-}
+internal sealed record RemoteDeletionTarget(string Name, string FullPath, bool IsDirectory);
 
 /// <summary>Which of the two things a rename actually is, from where the user is standing.</summary>
 /// <remarks>
@@ -383,6 +443,230 @@ internal sealed record RemoteMoveRequest(string Name, string FullPath, bool IsDi
         : "Relative to the directory showing. A name already taken is refused, not overwritten.";
 }
 
+/// <summary>
+/// A path on the host whose mode is being changed, and has not been committed yet.
+/// </summary>
+/// <remarks>
+/// <para>
+/// The shape <see cref="RemoteDeletionRequest"/> and <see cref="RemoteMoveRequest"/> established — the full
+/// path is carried so that nothing which happens between opening the form and pressing its button can
+/// re-point the operation — and unlike those two it is mutable, because the answer is nine checkboxes
+/// rather than a typed string.
+/// </para>
+/// <para>
+/// ◆ <b>Nine boxes rather than a box to type <c>755</c> into, and that is the whole design of this form.</b>
+/// The mode is already drawn as <c>-rwxr-xr-x</c> in the column beside it, so a grid of who-can-do-what is
+/// the same representation the reader is already looking at; an octal field would ask them to translate a
+/// thing they can see into a thing they cannot check. The octal is printed underneath as it changes, which
+/// is what makes the two readings verifiable against each other rather than a choice between them.
+/// </para>
+/// <para>
+/// <b>The three bits above the nine are not here.</b> <c>PosixMode</c> neither renders nor writes setuid,
+/// setgid or the sticky bit — see its own remark — so a form that offered them would be writing something
+/// the listing cannot show, and one that silently cleared them would be worse. What this sends is the nine
+/// bits and a documented zero above them.
+/// </para>
+/// </remarks>
+internal sealed partial class RemotePermissionsRequest : ObservableObject
+{
+    internal RemotePermissionsRequest(string name, string fullPath, bool isDirectory, string mode)
+    {
+        Name = name;
+        FullPath = fullPath;
+        IsDirectory = isDirectory;
+        Original = mode;
+
+        var bits = PosixMode.ToOctal(mode);
+
+        ownerRead = (bits & 0b100_000_000) != 0;
+        ownerWrite = (bits & 0b010_000_000) != 0;
+        ownerExecute = (bits & 0b001_000_000) != 0;
+        groupRead = (bits & 0b000_100_000) != 0;
+        groupWrite = (bits & 0b000_010_000) != 0;
+        groupExecute = (bits & 0b000_001_000) != 0;
+        othersRead = (bits & 0b000_000_100) != 0;
+        othersWrite = (bits & 0b000_000_010) != 0;
+        othersExecute = (bits & 0b000_000_001) != 0;
+    }
+
+    /// <summary>What the row is called, which is what the heading names.</summary>
+    internal string Name { get; }
+
+    /// <summary>Where it is, which is the end of the operation nothing may re-point.</summary>
+    internal string FullPath { get; }
+
+    /// <summary>Whether it is a directory, which changes what the execute bit is called.</summary>
+    internal bool IsDirectory { get; }
+
+    /// <summary>The mode as the listing found it, so the form can say what it is about to change.</summary>
+    internal string Original { get; }
+
+    [ObservableProperty]
+    private bool ownerRead;
+
+    [ObservableProperty]
+    private bool ownerWrite;
+
+    [ObservableProperty]
+    private bool ownerExecute;
+
+    [ObservableProperty]
+    private bool groupRead;
+
+    [ObservableProperty]
+    private bool groupWrite;
+
+    [ObservableProperty]
+    private bool groupExecute;
+
+    [ObservableProperty]
+    private bool othersRead;
+
+    [ObservableProperty]
+    private bool othersWrite;
+
+    [ObservableProperty]
+    private bool othersExecute;
+
+    /// <summary>The heading, which names the thing rather than only the verb.</summary>
+    internal string Question => $"Permissions for '{Name}'";
+
+    /// <summary>The nine bits as they now stand, ready for the wire.</summary>
+    internal int Mode =>
+        (OwnerRead ? 0b100_000_000 : 0)
+        | (OwnerWrite ? 0b010_000_000 : 0)
+        | (OwnerExecute ? 0b001_000_000 : 0)
+        | (GroupRead ? 0b000_100_000 : 0)
+        | (GroupWrite ? 0b000_010_000 : 0)
+        | (GroupExecute ? 0b000_001_000 : 0)
+        | (OthersRead ? 0b000_000_100 : 0)
+        | (OthersWrite ? 0b000_000_010 : 0)
+        | (OthersExecute ? 0b000_000_001 : 0);
+
+    /// <summary>
+    /// What the form is about to send, in both spellings at once.
+    /// </summary>
+    /// <remarks>
+    /// The <c>ls</c> rendering and the <c>chmod</c> number side by side, because the two audiences for this
+    /// form are the person reading the column and the person who would otherwise have typed the number —
+    /// and printing both is what lets either check the boxes they just ticked.
+    /// </remarks>
+    internal string Preview => $"{Rendered}   ({PosixMode.FormatOctal(Mode)})";
+
+    /// <summary>Whether anything has actually been changed, which is what the button is enabled on.</summary>
+    /// <remarks>
+    /// A round trip that sets a mode to the mode it already has is not wrong, only pointless — and a button
+    /// that stays live over a form nobody has touched invites exactly that.
+    /// </remarks>
+    internal bool HasChanges => !string.Equals(Rendered, Original, StringComparison.Ordinal);
+
+    /// <summary>What the execute column means here, which is not the same thing for a directory.</summary>
+    /// <remarks>
+    /// On a directory the execute bit is permission to <em>enter</em> it — to resolve a name inside — and a
+    /// column headed "exec" over a folder is the commonest misreading of a POSIX mode there is. It costs one
+    /// word to say which is meant.
+    /// </remarks>
+    internal string ExecuteLabel => IsDirectory ? "enter" : "exec";
+
+    private string Rendered => PosixMode.Format(
+        IsDirectory ? SftpEntryKind.Directory : SftpEntryKind.File,
+        OwnerRead,
+        OwnerWrite,
+        OwnerExecute,
+        GroupRead,
+        GroupWrite,
+        GroupExecute,
+        OthersRead,
+        OthersWrite,
+        OthersExecute);
+
+    /// <remarks>
+    /// One hook for all nine, because the two things a view reads off this form — the preview line and
+    /// whether the button is live — are functions of the whole mode rather than of any one bit.
+    /// </remarks>
+    partial void OnOwnerReadChanged(bool value) => Restring();
+
+    /// <inheritdoc cref="OnOwnerReadChanged" />
+    partial void OnOwnerWriteChanged(bool value) => Restring();
+
+    /// <inheritdoc cref="OnOwnerReadChanged" />
+    partial void OnOwnerExecuteChanged(bool value) => Restring();
+
+    /// <inheritdoc cref="OnOwnerReadChanged" />
+    partial void OnGroupReadChanged(bool value) => Restring();
+
+    /// <inheritdoc cref="OnOwnerReadChanged" />
+    partial void OnGroupWriteChanged(bool value) => Restring();
+
+    /// <inheritdoc cref="OnOwnerReadChanged" />
+    partial void OnGroupExecuteChanged(bool value) => Restring();
+
+    /// <inheritdoc cref="OnOwnerReadChanged" />
+    partial void OnOthersReadChanged(bool value) => Restring();
+
+    /// <inheritdoc cref="OnOwnerReadChanged" />
+    partial void OnOthersWriteChanged(bool value) => Restring();
+
+    /// <inheritdoc cref="OnOwnerReadChanged" />
+    partial void OnOthersExecuteChanged(bool value) => Restring();
+
+    private void Restring()
+    {
+        OnPropertyChanged(nameof(Preview));
+        OnPropertyChanged(nameof(HasChanges));
+    }
+}
+
+/// <summary>
+/// A remote file that has been fetched, opened in a local editor, and is being watched for saves.
+/// </summary>
+/// <remarks>
+/// <para>
+/// ◆ <b>The one thing this screen does that is neither a listing nor a transfer.</b> Editing a config on a
+/// host is the commonest reason somebody opens a file browser and then gives up and opens a terminal, and
+/// the round trip it replaces is: download, find the file, open it, edit, save, come back, delete the old
+/// one because nothing here overwrites, upload, check the mode survived.
+/// </para>
+/// <para>
+/// <b>It remembers what the server said when the copy was taken.</b> Not to be clever about merging —
+/// nothing here merges — but so that a write-back can refuse when the file has moved underneath it. Two
+/// people editing one <c>nginx.conf</c> is the ordinary way a config gets silently reverted, and the only
+/// honest thing a client this thin can do is notice and ask.
+/// </para>
+/// </remarks>
+/// <param name="Name">What the file is called, for the strip's heading.</param>
+/// <param name="RemotePath">Where it came from, which is where a save goes back to.</param>
+/// <param name="LocalCopy">The temporary file the editor has open. This screen made it and will remove it.</param>
+/// <param name="Mode">The mode it had, so a write-back can put it back. Zero when there was none to read.</param>
+internal sealed record RemoteEditSession(
+    string Name,
+    string RemotePath,
+    string LocalCopy,
+    int Mode)
+{
+    /// <summary>What the server says the file is, as of the last time this session looked.</summary>
+    /// <remarks>
+    /// <para>
+    /// Length and timestamp rather than a digest, because a digest is a second full read of a file this
+    /// client has no other reason to re-fetch. The pair catches every case anybody has actually run into —
+    /// somebody else saving, a deploy replacing it, a process rewriting it — and misses only a change that
+    /// preserved both, which SFTP gives no cheap way to see at all.
+    /// </para>
+    /// <para>
+    /// ◆ <b>Settable, and the record is mutated rather than replaced.</b> It moves after every write-back,
+    /// so the next save compares against what this one produced rather than against the original and
+    /// reports its own change as somebody else's. Replacing the record with <c>with</c> would have been the
+    /// tidier expression and is wrong: the watcher's callback closes over the instance it was started for
+    /// and checks it is still the current one, so a new instance silently turns every save after the first
+    /// into a no-op.
+    /// </para>
+    /// </remarks>
+    internal (long Length, DateTimeOffset Written) Stamp { get; set; }
+
+    /// <summary>The heading, which names the file rather than only the verb.</summary>
+    internal string Question => $"Editing '{Name}'";
+}
+
 /// <summary>
 /// The transfers screen: a host, two directory panes, and the queue between them.
 /// </summary>
@@ -408,6 +692,33 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
     private readonly FileTransferQueue queue;
     private readonly Action<Action> post;
 
+    /// <summary>
+    /// Opens a local path in whatever this machine opens that kind of file with, or null on a head that has
+    /// no such notion.
+    /// </summary>
+    /// <remarks>
+    /// A delegate for the reason <c>copyToClipboard</c> is one: "open this with the default application" is
+    /// a platform call, and the view model that decides <em>when</em> to make it has no business knowing
+    /// how. Null is an honest answer rather than a gap — see <see cref="CanEditRemote"/>.
+    /// </remarks>
+    private readonly Func<string, Task>? openInEditor;
+
+    /// <summary>
+    /// Watches one local file and calls back when it changes, until the returned handle is disposed — or
+    /// null on a head that cannot.
+    /// </summary>
+    /// <remarks>
+    /// ◆ <b>Injected rather than a <c>FileSystemWatcher</c> built here, and that is what makes editing
+    /// testable at all.</b> A watcher is a platform object with its own thread, its own buffer and its own
+    /// notion of when a save has finished; a test that waited on one would be measuring the operating
+    /// system. What this view model is responsible for is what happens <em>when</em> a save arrives, and a
+    /// fake that fires on demand is what lets that be asserted.
+    /// </remarks>
+    private readonly Func<string, Action, IDisposable>? watchFile;
+
+    /// <summary>The watcher for the file being edited, or null when nothing is.</summary>
+    private IDisposable? editWatch;
+
     /// <summary>
     /// Local files that exist only so this queue could move them — see <see cref="QueueStagedUploads"/> and
     /// <see cref="QueueDeliveredDownload"/>.
@@ -491,15 +802,21 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
     /// knowledge that somebody standing on it with no buckets needs to be sent somewhere.
     /// </para>
     /// </param>
+    /// <param name="openInEditor"><inheritdoc cref="openInEditor" path="/summary"/></param>
+    /// <param name="watchFile"><inheritdoc cref="watchFile" path="/summary"/></param>
     internal TransfersViewModel(
         ISftpSessionFactory sftp,
         TimeProvider clock,
         Action<Action>? post = null,
-        Action? addBucket = null)
+        Action? addBucket = null,
+        Func<string, Task>? openInEditor = null,
+        Func<string, Action, IDisposable>? watchFile = null)
     {
         this.sftp = sftp;
         this.post = post ?? (action => Dispatcher.UIThread.Post(action));
         this.addBucket = addBucket;
+        this.openInEditor = openInEditor;
+        this.watchFile = watchFile;
 
         // The supplier answers with whatever session is current at the moment a transfer starts, which is
         // what lets a queue survive a disconnect and reconnect without every queued row failing.
@@ -668,6 +985,66 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
     [ObservableProperty]
     private bool isConnected;
 
+    /// <summary>
+    /// Why the connection went away on its own, or null when it did not.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// ◆ <b>Not the same state as "not connected", which is what this screen used to collapse it into.</b>
+    /// Nothing connected is where the screen starts and where DISCONNECT leaves it: an invitation, two empty
+    /// panes, nothing to explain. This is a session that was working and stopped, which is worth three
+    /// things the invitation is not — the sentence saying what happened, the listing left on screen so the
+    /// user can see where they were, and a button that puts them back there.
+    /// </para>
+    /// <para>
+    /// Set only by <see cref="OnSessionConnectionLost"/>, which is the store's own event. An operation that
+    /// merely failed does not set it: a permission denied on one path is not a connection, and a screen that
+    /// said DISCONNECTED over a directory it simply may not read would be worse than one that said nothing.
+    /// </para>
+    /// </remarks>
+    [ObservableProperty]
+    private string? lostConnection;
+
+    /// <summary>Whether the connection went away on its own and has not been re-established.</summary>
+    internal bool IsConnectionLost => LostConnection is { Length: > 0 };
+
+    /// <summary>
+    /// Whether the remote pane has a listing worth drawing, connected or not.
+    /// </summary>
+    /// <remarks>
+    /// ◆ <b>The half of a lost connection the panes have to know about.</b> Every "is there anything here"
+    /// binding on both heads used to read <see cref="IsConnected"/>, which was right while the only way to
+    /// stop being connected was to press DISCONNECT — that empties the pane, so an invitation drawn over it
+    /// covered nothing. A connection lost underneath somebody does not empty it, and an invitation over
+    /// <em>that</em> would hide the one thing worth keeping: where they were, which is what the reconnect
+    /// beside it is offering to put them back into.
+    /// </remarks>
+    internal bool ShowsRemoteContents => IsConnected || IsConnectionLost;
+
+    /// <summary>Whether the remote pane should offer to open something instead of listing one.</summary>
+    /// <remarks>The other side of <see cref="ShowsRemoteContents"/>, so the two can never be drawn at once.</remarks>
+    internal bool ShowsRemoteInvitation => !ShowsRemoteContents;
+
+    /// <summary>
+    /// What a reconnect would dial, captured at the moment the last connection was made.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// Captured rather than read off the pickers when the button is pressed, and for the reason
+    /// <see cref="connected"/> is captured: the selection is a control somebody can move, and a reconnect
+    /// that dialled whatever happened to be lit would send them to a different machine than the one whose
+    /// listing is on the screen in front of them.
+    /// </para>
+    /// <para>
+    /// <b>The path is deliberately not in here.</b> It would have to be kept up to date with every
+    /// navigation, and there is already something that is: the pane itself. A lost connection leaves its
+    /// listing on screen — see <see cref="OnSessionConnectionLost"/> — so where to go back to is whatever
+    /// <see cref="RemotePath"/> still says, which is by construction the last directory that was actually
+    /// reached rather than a copy of it that could disagree.
+    /// </para>
+    /// </remarks>
+    private (RemoteKind Kind, Guid EntityId)? reconnectTo;
+
     /// <summary>
     /// Whether something is being dragged over the local pane, and whether it would be accepted.
     /// </summary>
@@ -846,6 +1223,59 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
 
     internal bool IsMovingRemote => PendingRemoteMove is not null;
 
+    /// <summary>The mode being changed, or null when none is.</summary>
+    [ObservableProperty]
+    private RemotePermissionsRequest? pendingRemotePermissions;
+
+    internal bool IsChangingRemotePermissions => PendingRemotePermissions is not null;
+
+    /// <summary>The file being edited locally, or null when none is.</summary>
+    [ObservableProperty]
+    private RemoteEditSession? remoteEdit;
+
+    /// <summary>Whether a file is open in a local editor and being watched.</summary>
+    internal bool IsEditingRemote => RemoteEdit is not null;
+
+    /// <summary>
+    /// What the edit strip has to say — each save, most recent first, or why one did not go.
+    /// </summary>
+    /// <remarks>
+    /// A log rather than a single line, because the whole point of watching is that saving happens more than
+    /// once and each one is a round trip somebody may want to see happened. Bounded: an editor that
+    /// autosaves would otherwise grow this without limit for as long as the file is open.
+    /// </remarks>
+    internal ObservableCollection<string> RemoteEditLog { get; } = [];
+
+    /// <summary>
+    /// Set when the server's copy moved underneath the one being edited, and cleared by answering.
+    /// </summary>
+    /// <remarks>
+    /// The one state in which a save is <em>not</em> written back automatically. Two people editing one
+    /// config is how a change gets silently reverted, and a client this thin cannot merge — what it can do
+    /// is stop, say so, and offer the three answers that are actually available.
+    /// </remarks>
+    [ObservableProperty]
+    private string? remoteEditConflict;
+
+    /// <summary>Whether the file being edited has moved on the host since the copy was taken.</summary>
+    internal bool HasRemoteEditConflict => RemoteEditConflict is { Length: > 0 };
+
+    /// <summary>
+    /// Whether EDIT is offered on the chosen row.
+    /// </summary>
+    /// <remarks>
+    /// Four conditions, and the last is the one worth naming: the head has to have given this screen a way
+    /// to open a file and a way to watch it. The phone has neither — "the default application" is a chooser
+    /// there and a file it hands to another app is a copy it does not get told about — so the button is
+    /// simply not live on that head rather than there and disappointing.
+    /// </remarks>
+    internal bool CanEditRemote =>
+        IsConnected
+        && !IsAskingAboutRemoteEntry
+        && SelectedRemoteEntry is { IsFile: true }
+        && openInEditor is not null
+        && watchFile is not null;
+
     /// <summary>
     /// Whether the pane is waiting on an answer about the selected row.
     /// </summary>
@@ -855,7 +1285,15 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
     /// other — and what this names is the state where none of them may be started and nothing may pull the
     /// listing out from under the question. See <see cref="SettleRemoteListingAsync"/>.
     /// </remarks>
-    internal bool IsAskingAboutRemoteEntry => IsConfirmingRemoteDeletion || IsMovingRemote;
+    internal bool IsAskingAboutRemoteEntry =>
+        IsConfirmingRemoteDeletion || IsMovingRemote || IsChangingRemotePermissions;
+
+    /// <summary>How many saves the strip keeps before it starts dropping the oldest.</summary>
+    /// <remarks>
+    /// Enough to see a session's worth of saves and short enough that an editor autosaving every thirty
+    /// seconds cannot turn this into a memory leak with a scrollbar.
+    /// </remarks>
+    private const int EditLogDepth = 20;
 
     /// <summary>Whether the pane's DELETE is live.</summary>
     /// <remarks>
@@ -871,6 +1309,16 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
     /// <inheritdoc cref="CanDeleteRemote" />
     internal bool CanMoveRemote => CanDeleteRemote;
 
+    /// <summary>
+    /// Whether the pane's PERMS is live.
+    /// </summary>
+    /// <remarks>
+    /// The three conditions the others have, and one more: a bucket has no mode to change. An object is
+    /// governed by an access policy rather than nine bits — <c>S3FileStore</c> refuses this outright — so the
+    /// button is dark on that destination rather than live and answered with a refusal.
+    /// </remarks>
+    internal bool CanChangeRemotePermissions => CanDeleteRemote && Remote is RemoteKind.Host;
+
     /// <summary>
     /// Whether the pane shows the row of things that can be done to the chosen row.
     /// </summary>
@@ -897,6 +1345,148 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
     /// </remarks>
     internal string SelectedRemoteName => SelectedRemoteEntry?.Name ?? "Choose a row to act on it";
 
+    /// <summary>
+    /// The rows a batch action would act on: whatever is ticked, or the selection when nothing is.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// ◆ <b>The fallback is what keeps the one-file case exactly as it was.</b> Ticking is for gathering
+    /// several up; somebody who has clicked a row and pressed DOWNLOAD has not ticked anything and means
+    /// that row. Without this the commonest use of the screen would have grown a step, which is the usual
+    /// way a multi-select makes a tool worse.
+    /// </para>
+    /// <para>
+    /// Read fresh each time rather than kept as a collection. The ticks live on the rows, the rows are
+    /// replaced wholesale by every listing, and a second list to keep in step with that is a second thing to
+    /// get wrong — see <see cref="ListRemoteAsync"/>, which simply builds new rows.
+    /// </para>
+    /// </remarks>
+    internal IReadOnlyList<RemoteEntryRowViewModel> RemoteBatch
+    {
+        get
+        {
+            var ticked = RemoteEntries.Where(row => row.IsChecked).ToArray();
+
+            return ticked.Length > 0
+                ? ticked
+                : SelectedRemoteEntry is { } row ? [row] : [];
+        }
+    }
+
+    /// <inheritdoc cref="RemoteBatch" />
+    internal IReadOnlyList<LocalEntryRowViewModel> LocalBatch
+    {
+        get
+        {
+            var ticked = LocalEntries.Where(row => row.IsChecked).ToArray();
+
+            return ticked.Length > 0
+                ? ticked
+                : SelectedLocalEntry is { } row ? [row] : [];
+        }
+    }
+
+    /// <summary>How many rows are ticked on the host's side, or zero when none are.</summary>
+    /// <remarks>
+    /// The tick count rather than <see cref="RemoteBatch"/>'s, deliberately: this is what the strip prints
+    /// beside SELECT ALL, and a screen that said "1 selected" over a listing with nothing ticked — because
+    /// a row happened to be highlighted — would be describing a state the checkboxes visibly contradict.
+    /// </remarks>
+    internal int CheckedRemoteCount => RemoteEntries.Count(row => row.IsChecked);
+
+    /// <inheritdoc cref="CheckedRemoteCount" />
+    internal int CheckedLocalCount => LocalEntries.Count(row => row.IsChecked);
+
+    /// <summary>Whether anything is ticked on the host's side.</summary>
+    internal bool HasCheckedRemote => CheckedRemoteCount > 0;
+
+    /// <inheritdoc cref="HasCheckedRemote" />
+    internal bool HasCheckedLocal => CheckedLocalCount > 0;
+
+    /// <summary>What the host pane's selection strip says, or empty when there is nothing to say.</summary>
+    internal string CheckedRemoteLabel => CheckedRemoteCount switch
+    {
+        0 => string.Empty,
+        1 => "1 selected",
+        var many => $"{many} selected",
+    };
+
+    /// <inheritdoc cref="CheckedRemoteLabel" />
+    internal string CheckedLocalLabel => CheckedLocalCount switch
+    {
+        0 => string.Empty,
+        1 => "1 selected",
+        var many => $"{many} selected",
+    };
+
+    /// <summary>
+    /// Ticks every row in the host's listing, or unticks them when they already all are.
+    /// </summary>
+    /// <remarks>
+    /// One command for both directions rather than two buttons, because "select all" and "select none" are
+    /// the same gesture from the user's side — they look at the boxes and want the other state. Directories
+    /// are ticked along with files; what happens to one is the batch action's business, and a select-all
+    /// that quietly skipped rows would leave boxes unticked with no way to tick them.
+    /// </remarks>
+    [RelayCommand]
+    private void ToggleAllRemote()
+    {
+        var wanted = CheckedRemoteCount < RemoteEntries.Count;
+
+        foreach (var row in RemoteEntries)
+        {
+            row.IsChecked = wanted;
+        }
+
+        RaiseBatchState();
+    }
+
+    /// <inheritdoc cref="ToggleAllRemote" />
+    [RelayCommand]
+    private void ToggleAllLocal()
+    {
+        var wanted = CheckedLocalCount < LocalEntries.Count;
+
+        foreach (var row in LocalEntries)
+        {
+            row.IsChecked = wanted;
+        }
+
+        RaiseBatchState();
+    }
+
+    /// <summary>
+    /// Notices a row being ticked, so the counts and the buttons that read them keep up.
+    /// </summary>
+    /// <remarks>
+    /// Called by the views from the checkbox itself rather than subscribed per row. Each listing replaces
+    /// every row it has, so a per-row subscription would be one to attach and detach on every navigation —
+    /// and the thing being counted is a property of the collection rather than of any row, which is why the
+    /// collection's owner is what raises it.
+    /// </remarks>
+    internal void RemoteChecksChanged() => RaiseBatchState();
+
+    /// <inheritdoc cref="RemoteChecksChanged" />
+    internal void LocalChecksChanged() => RaiseBatchState();
+
+    /// <summary>Raises everything that reads the ticks, on both panes.</summary>
+    /// <remarks>
+    /// Both panes together, because the six properties are cheap to re-read and a caller that raised one
+    /// pane's would eventually be the caller that forgot the other's.
+    /// </remarks>
+    private void RaiseBatchState()
+    {
+        OnPropertyChanged(nameof(CheckedRemoteCount));
+        OnPropertyChanged(nameof(CheckedLocalCount));
+        OnPropertyChanged(nameof(HasCheckedRemote));
+        OnPropertyChanged(nameof(HasCheckedLocal));
+        OnPropertyChanged(nameof(CheckedRemoteLabel));
+        OnPropertyChanged(nameof(CheckedLocalLabel));
+        OnPropertyChanged(nameof(CanDownload));
+        OnPropertyChanged(nameof(CanUpload));
+        RaiseItemActionState();
+    }
+
     // ---- The local pane ----
 
     [ObservableProperty]
@@ -965,10 +1555,17 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
     internal bool HasTransfers => Transfers.Count > 0;
 
     /// <summary>Whether a download of the chosen remote file would have somewhere to go.</summary>
-    internal bool CanDownload => IsConnected && SelectedRemoteEntry is { IsFile: true };
+    /// <remarks>
+    /// Any file in the batch is enough, rather than every one of them: a gathered-up set with a directory
+    /// among it is the ordinary case, and the queue counts and reports what it skipped — see
+    /// <see cref="QueueDownloads"/>. A button dead until the set was perfectly clean would be refusing to
+    /// start work it can plainly do most of.
+    /// </remarks>
+    internal bool CanDownload => IsConnected && RemoteBatch.Any(row => row.IsFile);
 
     /// <summary>Whether an upload of the chosen local file would have somewhere to go.</summary>
-    internal bool CanUpload => IsConnected && SelectedLocalEntry is { IsFile: true };
+    /// <inheritdoc cref="CanDownload" />
+    internal bool CanUpload => IsConnected && LocalBatch.Any(row => row.IsFile);
 
     /// <summary>Takes an unlocked vault, so the host list has something in it.</summary>
     /// <param name="openVault">The open keychain.</param>
@@ -1163,6 +1760,9 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
                 OnPropertyChanged(nameof(HasConnectedPins));
 
                 connected = (ConnectedTo, row.Label, row.EntityId, TimeProvider.System.GetUtcNow());
+                reconnectTo = (RemoteKind.Bucket, row.EntityId);
+
+                Watch(session);
 
                 await ListRemoteAsync(session.HomeDirectory, cancellationToken).ConfigureAwait(true);
 
@@ -1221,6 +1821,10 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
                 TypedPassword = string.Empty;
                 MarkHostConnected(opened, request, row, identityLabel);
 
+                reconnectTo = (RemoteKind.Host, row.EntityId);
+
+                Watch(opened);
+
                 await ListRemoteAsync(session.HomeDirectory, cancellationToken).ConfigureAwait(true);
 
                 Status = $"Connected to {row.Label}.";
@@ -1270,6 +1874,152 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
         ActivityChanged?.Invoke(this, EventArgs.Empty);
     }
 
+    /// <summary>Listens for the store losing its connection on its own.</summary>
+    /// <remarks>
+    /// Nothing unsubscribes: the handler checks that the store raising it is still the one this screen holds,
+    /// and a store this screen has replaced is disposed — which stops it raising anything anyway. That check
+    /// is what a detach would buy, and having it means a session torn down mid-event cannot leave a
+    /// subscription pointing at a screen that has moved on.
+    /// </remarks>
+    private void Watch(IRemoteFileStore store) =>
+        store.ConnectionLost += (sender, _) => post(() => OnSessionConnectionLost(sender));
+
+    /// <summary>
+    /// Says the connection went away, and keeps everything a reconnect will need.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// ◆ <b>The listing stays on screen, and that is deliberate.</b> <see cref="SftpEntry"/> is a record of
+    /// what the server said rather than a handle on anything — its own remark says so — so the pane can go
+    /// on showing where the user was after the session behind it has gone. Clearing it would take away the
+    /// one thing that makes the reconnect below meaningful: they can see what they were doing, and the
+    /// button puts them back in it.
+    /// </para>
+    /// <para>
+    /// What does go is the session and the two open questions. A delete or a move left half-asked would
+    /// commit against a store that is not there, and both are about a path this screen can no longer promise
+    /// anything about.
+    /// </para>
+    /// <para>
+    /// Nothing is done about transfers in flight. The queue's own row carries the failure with the server's
+    /// words on it and keeps its part file, so a reconnect leaves RESUME meaning exactly what it meant
+    /// before — see <c>FileTransferQueue.Retry</c>. Reaching in to restart them here would be this screen
+    /// making a decision about somebody's file that they can make better themselves.
+    /// </para>
+    /// </remarks>
+    private void OnSessionConnectionLost(object? sender)
+    {
+        if (!ReferenceEquals(sender, session))
+        {
+            // A store this screen has already replaced or disposed. Its news is about a connection nobody is
+            // looking at any more.
+            return;
+        }
+
+        var reason = (session as ISftpSession)?.TransportFailure;
+
+        session = null;
+        IsConnected = false;
+        LostConnection = reason is { Length: > 0 } said ? said : "The connection was lost.";
+
+        PendingRemoteDeletion = null;
+        PendingRemoteMove = null;
+        PendingRemotePermissions = null;
+        RemoteMoveTarget = string.Empty;
+
+        // The ticket is closed here rather than left for the reconnect, because the session really did end
+        // at this moment and a log written later would say it lasted until somebody noticed.
+        CloseConnectionRecord(ConnectionOutcome.Closed);
+
+        RaiseRemotePaneState();
+        OnPropertyChanged(nameof(HasLiveFileSession));
+
+        Status = LostConnection;
+
+        ActivityChanged?.Invoke(this, EventArgs.Empty);
+    }
+
+    /// <summary>
+    /// Opens the connection again, on the same remote, and goes back to the directory it was showing.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// It goes through <see cref="ConnectAsync"/> rather than round it, so the host key gate, the refusals
+    /// and the log entry are the same ones any other connection gets — a reconnect is a second login as far
+    /// as the host is concerned, and one that skipped the checks would be a second connect path to get
+    /// subtly wrong. What it adds either side is the two things that make it a <em>re</em>connect: the
+    /// remote is the one that was lost rather than whatever is lit, and the path is restored afterwards.
+    /// </para>
+    /// <para>
+    /// <b>A host that wants a password typed is asked for one rather than dialled without.</b> The password
+    /// is cleared the moment a connection succeeds and is not kept, so redialling with an empty box would be
+    /// an authentication failure wearing the word RECONNECT. The picker comes up with the host already
+    /// chosen, which is as far as this can honestly get on its own.
+    /// </para>
+    /// </remarks>
+    [RelayCommand]
+    private async Task ReconnectAsync(CancellationToken cancellationToken)
+    {
+        if (reconnectTo is not { } target)
+        {
+            Status = "There is nothing here to connect to again.";
+            return;
+        }
+
+        // Read before anything below can clear it: connecting closes the old session first, and that is what
+        // empties the pane this path is being taken from.
+        var wasShowing = RemotePath;
+
+        Remote = target.Kind;
+
+        if (target.Kind is RemoteKind.Bucket)
+        {
+            SelectedBucket = Buckets.FirstOrDefault(row => row.EntityId == target.EntityId);
+
+            if (SelectedBucket is null)
+            {
+                Status = "That bucket is not in this keychain any more.";
+                return;
+            }
+        }
+        else
+        {
+            SelectedHost = Hosts.FirstOrDefault(row => row.EntityId == target.EntityId);
+
+            if (SelectedHost is null)
+            {
+                Status = "That host is not in this keychain any more, so there is nothing here to dial again.";
+                return;
+            }
+
+            if (SelectedHostAsksForAPassword && TypedPassword.Length == 0)
+            {
+                IsChoosingRemote = true;
+                Status = $"{SelectedHost.Label} asks for a password. Type it here, then CONNECT.";
+
+                return;
+            }
+        }
+
+        await ConnectAsync(cancellationToken).ConfigureAwait(true);
+
+        if (!IsConnected)
+        {
+            // Whatever refused it has already said so through RunAsync's own status. The pane keeps the
+            // listing it had, so the button is still there to press again.
+            return;
+        }
+
+        if (wasShowing is { Length: > 0 }
+            && !string.Equals(RemotePath, wasShowing, StringComparison.Ordinal))
+        {
+            // Back where they were, rather than in the home directory a fresh connect lands in. A failure
+            // here — the directory has gone, or is no longer readable — is reported by GoRemoteAsync and
+            // leaves the pane on the home directory, which is a place that exists.
+            await GoRemoteAsync(wasShowing, cancellationToken).ConfigureAwait(true);
+        }
+    }
+
     /// <summary>
     /// Closes the file-transfer session.
     /// </summary>
@@ -1477,26 +2227,69 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
     [RelayCommand]
     private void Download()
     {
-        if (SelectedRemoteEntry is not { } row)
+        if (RemoteBatch is not { Count: > 0 } rows)
         {
             Status = "Choose a file on the host to download.";
             return;
         }
 
-        QueueDownloads([row]);
+        _ = RunAsync(
+            "Working out what to download…",
+            async () =>
+            {
+                await QueueDownloadsAsync(rows, CancellationToken.None).ConfigureAwait(true);
+
+                ClearRemoteChecks();
+            });
     }
 
     /// <summary>Queues the chosen local file for upload into the remote directory showing.</summary>
     [RelayCommand]
     private void Upload()
     {
-        if (SelectedLocalEntry is not { } row)
+        if (LocalBatch is not { Count: > 0 } rows)
         {
             Status = "Choose a file on this machine to upload.";
             return;
         }
 
-        QueueUploads([row.FullPath]);
+        var paths = rows.Select(row => row.FullPath).ToArray();
+
+        _ = RunAsync(
+            "Working out what to upload…",
+            async () =>
+            {
+                await QueueUploadsAsync(paths, CancellationToken.None).ConfigureAwait(true);
+
+                ClearLocalChecks();
+            });
+    }
+
+    /// <summary>Unticks everything on the host's side.</summary>
+    /// <remarks>
+    /// Run after a batch has been queued, and after a listing replaces the rows. A gathered-up set is about
+    /// one act — these files, into that directory — and leaving the boxes ticked afterwards is how the next
+    /// press sends them all a second time.
+    /// </remarks>
+    private void ClearRemoteChecks()
+    {
+        foreach (var row in RemoteEntries)
+        {
+            row.IsChecked = false;
+        }
+
+        RaiseBatchState();
+    }
+
+    /// <inheritdoc cref="ClearRemoteChecks" />
+    private void ClearLocalChecks()
+    {
+        foreach (var row in LocalEntries)
+        {
+            row.IsChecked = false;
+        }
+
+        RaiseBatchState();
     }
 
     /// <summary>
@@ -1509,8 +2302,11 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
     /// were dragged, from this window's own pane or from the file manager.
     /// </para>
     /// <para>
-    /// <b>Directories are skipped and counted.</b> The queue moves files: there is no recursive upload, and
-    /// silently ignoring the folder somebody just dragged would look like a transfer that failed to start.
+    /// ◆ <b>A directory is walked rather than skipped, which it used to be.</b> The queue still moves one
+    /// file at a time and knows nothing about trees — what happens here is that the tree is turned into
+    /// files before it gets there, and the directories it needs are made on the host first. That keeps
+    /// every property the queue has: each file is resumable on its own, each is written to a part file and
+    /// renamed into place, and none of them can overwrite something already there.
     /// </para>
     /// <para>
     /// <b>Reported per item, not per drop.</b> The queue refuses to overwrite, so a drop of five files where
@@ -1518,7 +2314,28 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
     /// about all five.
     /// </para>
     /// </remarks>
-    internal void QueueUploads(IReadOnlyList<string> paths)
+    /// <summary>
+    /// Starts an upload walk from something a drop handed over, and reports it through the busy funnel.
+    /// </summary>
+    /// <remarks>
+    /// ◆ <b>A separate entry point because a drop cannot await.</b> The walk became asynchronous when
+    /// folders stopped being skipped — it lists directories over the wire and makes them on the host — and
+    /// an Avalonia drop handler that awaited it would be an <c>async void</c> whose failures nothing
+    /// catches. <see cref="RunAsync"/> is where every other command on this screen puts exactly that
+    /// problem: it owns the busy flag and turns a failure into a status line.
+    /// </remarks>
+    internal void QueueUploads(IReadOnlyList<string> paths) =>
+        _ = RunAsync(
+            "Working out what to upload…",
+            () => QueueUploadsAsync(paths, CancellationToken.None));
+
+    /// <inheritdoc cref="QueueUploads" />
+    internal void QueueDownloads(IReadOnlyList<RemoteEntryRowViewModel> rows) =>
+        _ = RunAsync(
+            "Working out what to download…",
+            () => QueueDownloadsAsync(rows, CancellationToken.None));
+
+    internal async Task QueueUploadsAsync(IReadOnlyList<string> paths, CancellationToken cancellationToken)
     {
         ArgumentNullException.ThrowIfNull(paths);
 
@@ -1528,15 +2345,13 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
             return;
         }
 
-        var queued = 0;
-        var directories = 0;
-        var missing = 0;
+        var plan = new TransferPlan();
 
         foreach (var path in paths)
         {
             if (Directory.Exists(path))
             {
-                directories++;
+                WalkLocal(path, SftpPath.Combine(RemotePath, Path.GetFileName(path)), plan);
                 continue;
             }
 
@@ -1544,18 +2359,129 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
             // paths in an OS drop come from another process, which is not obliged to be right about them.
             if (!File.Exists(path))
             {
-                missing++;
+                plan.Missing++;
                 continue;
             }
 
-            var length = new FileInfo(path).Length;
-            var destination = SftpPath.Combine(RemotePath, Path.GetFileName(path));
-
-            queue.Enqueue(TransferDirection.Upload, path, destination, length);
-            queued++;
+            plan.Files.Add((path, SftpPath.Combine(RemotePath, Path.GetFileName(path))));
         }
 
-        Status = Describe(queued, "upload into", RemotePath, directories, missing);
+        // ◆ Before anything is queued, and in shortest-first order so a parent exists before its child is
+        // asked for. A transfer whose directory is not there fails at the part file and leaves a row saying
+        // something about a path rather than about the folder that was dragged.
+        foreach (var directory in plan.Directories.OrderBy(each => each.Length))
+        {
+            if (!await EnsureRemoteDirectoryAsync(directory, cancellationToken).ConfigureAwait(true))
+            {
+                plan.Refused++;
+            }
+        }
+
+        foreach (var (local, remote) in plan.Files)
+        {
+            var file = new FileInfo(local);
+
+            queue.Enqueue(TransferDirection.Upload, local, remote, file.Length, Preserved(file));
+            plan.Queued++;
+        }
+
+        Status = Describe(plan, "upload into", RemotePath);
+    }
+
+    /// <summary>
+    /// Adds every file under a local directory to the plan, with the remote path each will land at.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// ◆ <b>Reparse points are not followed, and that is a correctness rule rather than a nicety.</b> A
+    /// junction or a symlink pointing at an ancestor is a walk that never ends, and the first anybody would
+    /// know of it is a queue filling for ever. <see cref="EnumerationOptions.AttributesToSkip"/> is what
+    /// rules it out, at the one place a decision is made about what to descend into.
+    /// </para>
+    /// <para>
+    /// <b>Empty directories are carried too.</b> They are in the plan's directory set even when no file
+    /// under them reaches the file list, because a build output tree with an empty <c>logs/</c> in it is a
+    /// tree that arrives wrong if the folder is silently dropped.
+    /// </para>
+    /// </remarks>
+    private static void WalkLocal(string root, string destination, TransferPlan plan)
+    {
+        plan.Directories.Add(destination);
+
+        var options = new EnumerationOptions
+        {
+            RecurseSubdirectories = true,
+            AttributesToSkip = FileAttributes.ReparsePoint,
+            IgnoreInaccessible = true,
+        };
+
+        foreach (var directory in Directory.EnumerateDirectories(root, "*", options))
+        {
+            plan.Directories.Add(RemoteFor(root, destination, directory));
+        }
+
+        foreach (var file in Directory.EnumerateFiles(root, "*", options))
+        {
+            if (plan.IsFull)
+            {
+                plan.Truncated = true;
+                return;
+            }
+
+            plan.Files.Add((file, RemoteFor(root, destination, file)));
+        }
+    }
+
+    /// <summary>Where a path under <paramref name="root"/> lands under <paramref name="destination"/>.</summary>
+    /// <remarks>
+    /// Split on both separators rather than on <see cref="Path.DirectorySeparatorChar"/>, and rejoined with
+    /// <c>/</c> through <see cref="SftpPath"/>: a remote path is POSIX whatever this client is running on,
+    /// and a Windows relative path carrying backslashes into <c>SftpPath.Combine</c> would produce
+    /// <c>/srv/app\assets\main.js</c> — one file with a backslash in its name rather than three
+    /// directories deep.
+    /// </remarks>
+    private static string RemoteFor(string root, string destination, string path)
+    {
+        var relative = Path.GetRelativePath(root, path);
+        var walked = destination;
+
+        foreach (var segment in relative.Split(
+            ['/', '\\'], StringSplitOptions.RemoveEmptyEntries))
+        {
+            walked = SftpPath.Combine(walked, segment);
+        }
+
+        return walked;
+    }
+
+    /// <summary>Makes one remote directory if it is not already there.</summary>
+    /// <returns>Whether it exists now.</returns>
+    /// <remarks>
+    /// Asked about before it is made rather than made and the failure swallowed. The two are not the same:
+    /// a directory that is already there is the ordinary case of uploading into a tree that partly exists,
+    /// and a <c>mkdir</c> refused for any other reason — no permission, a file of that name in the way — is
+    /// a thing the person who dragged the folder needs told about.
+    /// </remarks>
+    private async Task<bool> EnsureRemoteDirectoryAsync(string path, CancellationToken cancellationToken)
+    {
+        var open = RequireSession();
+
+        try
+        {
+            if (await open.StatAsync(path, cancellationToken).ConfigureAwait(true) is not null)
+            {
+                return true;
+            }
+
+            await open.CreateDirectoryAsync(path, cancellationToken).ConfigureAwait(true);
+
+            return true;
+        }
+        catch (Exception exception) when (exception is not OutOfMemoryException
+            and not OperationCanceledException)
+        {
+            return false;
+        }
     }
 
     /// <summary>
@@ -1586,7 +2512,9 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
             staged.Add(path);
         }
 
-        QueueUploads(paths);
+        _ = RunAsync(
+            "Working out what to upload…",
+            () => QueueUploadsAsync(paths, CancellationToken.None));
     }
 
     /// <summary>
@@ -1696,8 +2624,10 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
     }
 
     /// <summary>Queues every one of these remote entries for download into the local directory showing.</summary>
-    /// <inheritdoc cref="QueueUploads" path="/remarks" />
-    internal void QueueDownloads(IReadOnlyList<RemoteEntryRowViewModel> rows)
+    /// <inheritdoc cref="QueueUploadsAsync" path="/remarks" />
+    internal async Task QueueDownloadsAsync(
+        IReadOnlyList<RemoteEntryRowViewModel> rows,
+        CancellationToken cancellationToken)
     {
         ArgumentNullException.ThrowIfNull(rows);
 
@@ -1707,51 +2637,273 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
             return;
         }
 
-        var queued = 0;
-        var directories = 0;
+        var plan = new TransferPlan();
 
         foreach (var row in rows)
         {
-            if (!row.IsFile)
+            if (row.IsFile)
             {
-                directories++;
+                plan.Downloads.Add((Path.Combine(LocalPath, row.Name), row.Entry));
                 continue;
             }
 
-            queue.Enqueue(
-                TransferDirection.Download,
-                Path.Combine(LocalPath, row.Name),
-                row.FullPath,
-                row.Entry.Length);
+            if (row.Entry.Kind is SftpEntryKind.SymbolicLink)
+            {
+                // Not followed, for the reason WalkLocal skips a reparse point — and here there is a second
+                // one: an lstat listing says a name is a link and does not say what it leads to, so
+                // descending would mean a round trip per entry to find out, and a link pointing at an
+                // ancestor is a walk with no end.
+                plan.Links++;
+                continue;
+            }
 
-            queued++;
+            await WalkRemoteAsync(
+                row.FullPath,
+                Path.Combine(LocalPath, row.Name),
+                plan,
+                cancellationToken).ConfigureAwait(true);
         }
 
-        Status = Describe(queued, "download into", LocalPath, directories, missing: 0);
+        foreach (var directory in plan.LocalDirectories.OrderBy(each => each.Length))
+        {
+            try
+            {
+                Directory.CreateDirectory(directory);
+            }
+            catch (Exception exception) when (exception is IOException or UnauthorizedAccessException)
+            {
+                plan.Refused++;
+            }
+        }
+
+        foreach (var (local, entry) in plan.Downloads)
+        {
+            queue.Enqueue(
+                TransferDirection.Download, local, entry.FullPath, entry.Length, Preserved(entry));
+
+            plan.Queued++;
+        }
+
+        Status = Describe(plan, "download into", LocalPath);
+    }
+
+    /// <summary>Adds every file under a remote directory to the plan, with where each will land here.</summary>
+    /// <remarks>
+    /// <para>
+    /// Breadth-first over <c>ListAsync</c>, which is a round trip per directory and nothing cleverer: SFTP
+    /// has no recursive listing, so the tree has to be walked whatever this does. What it must not do is walk
+    /// for ever — see the link rule below and <see cref="TransferPlan.IsFull"/>.
+    /// </para>
+    /// <para>
+    /// A directory that cannot be listed is counted and the walk carries on. Half a tree with a sentence
+    /// saying which part was refused is worth more than nothing with the same sentence, and a permission
+    /// somewhere deep is the ordinary reason a whole-folder download of somebody else's tree stops short.
+    /// </para>
+    /// </remarks>
+    private async Task WalkRemoteAsync(
+        string remote,
+        string local,
+        TransferPlan plan,
+        CancellationToken cancellationToken)
+    {
+        var pending = new Queue<(string Remote, string Local)>();
+        pending.Enqueue((remote, local));
+
+        while (pending.Count > 0)
+        {
+            var (fromDirectory, toDirectory) = pending.Dequeue();
+
+            plan.LocalDirectories.Add(toDirectory);
+
+            IReadOnlyList<SftpEntry> entries;
+
+            try
+            {
+                entries = await RequireSession()
+                    .ListAsync(fromDirectory, cancellationToken)
+                    .ConfigureAwait(true);
+            }
+            catch (Exception exception) when (exception is not OutOfMemoryException
+                and not OperationCanceledException)
+            {
+                plan.Refused++;
+                continue;
+            }
+
+            foreach (var entry in entries)
+            {
+                if (plan.IsFull)
+                {
+                    plan.Truncated = true;
+                    return;
+                }
+
+                switch (entry.Kind)
+                {
+                    case SftpEntryKind.File:
+                        plan.Downloads.Add((Path.Combine(toDirectory, entry.Name), entry));
+                        break;
+
+                    case SftpEntryKind.Directory:
+                        pending.Enqueue((entry.FullPath, Path.Combine(toDirectory, entry.Name)));
+                        break;
+
+                    case SftpEntryKind.SymbolicLink:
+                        plan.Links++;
+                        break;
+
+                    default:
+                        // A socket, a device, a pipe. There is nothing to copy and no local equivalent to
+                        // create, and counting it as a refusal would overstate what went wrong.
+                        plan.Skipped++;
+                        break;
+                }
+            }
+        }
+    }
+
+    /// <summary>What an upload of this local file should carry to the host with it.</summary>
+    /// <remarks>
+    /// <para>
+    /// ◆ <b>The mode is only sent from a platform that has one.</b> A file on Windows has no POSIX mode —
+    /// this screen already says so by leaving the local pane's <c>PERMS</c> column empty rather than filling
+    /// it with a plausible <c>-rw-r--r--</c> — so an upload from there carries the timestamp alone and lands
+    /// with whatever the server's umask gives it. Inventing 0644, or 0755 for anything called <c>.sh</c>,
+    /// would be this client deciding a fact about somebody's file that nothing on the machine it came from
+    /// ever said.
+    /// </para>
+    /// <para>
+    /// A bucket carries nothing: it has neither to set, and asking would be a refusal per transfer. See
+    /// <c>S3FileStore</c>.
+    /// </para>
+    /// </remarks>
+    private TransferAttributes? Preserved(FileInfo file)
+    {
+        if (Remote is not RemoteKind.Host)
+        {
+            return null;
+        }
+
+        int? mode = null;
+
+        if (!OperatingSystem.IsWindows())
+        {
+            mode = PosixMode.Sanitise((int)file.UnixFileMode);
+        }
+
+        // Stated as UTC rather than left to an implicit conversion, which would read the local machine's
+        // offset off a DateTime that already is UTC and move the timestamp by it.
+        return new TransferAttributes(
+            mode, new DateTimeOffset(file.LastWriteTimeUtc, TimeSpan.Zero));
+    }
+
+    /// <summary>What a download of this remote entry should carry to this machine with it.</summary>
+    /// <remarks>
+    /// The other direction of <see cref="Preserved(FileInfo)"/>, and the mode is passed whatever this
+    /// platform is: the queue is what knows whether the local filesystem can be told one, and it drops the
+    /// mode rather than failing where it cannot. See <c>FileTransferQueue.ApplyLocally</c>.
+    /// </remarks>
+    private TransferAttributes? Preserved(SftpEntry entry) =>
+        Remote is RemoteKind.Host
+            ? new TransferAttributes(PosixMode.ToOctal(entry.Permissions), entry.LastWriteTimeUtc)
+            : null;
+
+    /// <summary>
+    /// What a walk found, before any of it is handed to the queue.
+    /// </summary>
+    /// <remarks>
+    /// ◆ <b>Collected whole and then queued, rather than queued as it is found.</b> The directories have to
+    /// exist before the files that go in them, and shortest-first is the only order that guarantees a
+    /// parent before its child — which needs the whole set before the first one is made. It also means a
+    /// walk that is refused halfway has queued nothing yet, so the sentence it produces describes one
+    /// outcome rather than an outcome and a queue that half happened.
+    /// </remarks>
+    private sealed class TransferPlan
+    {
+        /// <summary>
+        /// The most files one walk will collect.
+        /// </summary>
+        /// <remarks>
+        /// A backstop rather than a policy, and it is deliberately far above any tree somebody means to
+        /// drag: what it exists for is the accident — a home directory, a mounted volume, the root — where
+        /// the honest answer is to stop and say so rather than to fill a queue for a quarter of an hour.
+        /// </remarks>
+        private const int Ceiling = 5000;
+
+        /// <summary>Local path and its destination on the host, for an upload.</summary>
+        public List<(string Local, string Remote)> Files { get; } = [];
+
+        /// <summary>Where it will land here, and what the listing said it is, for a download.</summary>
+        public List<(string Local, SftpEntry Entry)> Downloads { get; } = [];
+
+        /// <summary>Directories to make on the host before the uploads go.</summary>
+        public HashSet<string> Directories { get; } = new(StringComparer.Ordinal);
+
+        /// <summary>Directories to make here before the downloads land.</summary>
+        public HashSet<string> LocalDirectories { get; } = new(StringComparer.OrdinalIgnoreCase);
+
+        /// <summary>How many were actually handed to the queue.</summary>
+        public int Queued { get; set; }
+
+        /// <summary>Paths that were gone by the time the walk reached them.</summary>
+        public int Missing { get; set; }
+
+        /// <summary>Directories the host or this machine would not let the walk have.</summary>
+        public int Refused { get; set; }
+
+        /// <summary>Symbolic links, which are counted rather than followed.</summary>
+        public int Links { get; set; }
+
+        /// <summary>Sockets, devices and pipes, which have nothing to copy.</summary>
+        public int Skipped { get; set; }
+
+        /// <summary>Whether the walk stopped at <see cref="Ceiling"/> rather than at the end of the tree.</summary>
+        public bool Truncated { get; set; }
+
+        /// <summary>Whether the ceiling has been reached.</summary>
+        public bool IsFull => Files.Count + Downloads.Count >= Ceiling;
     }
 
     /// <remarks>
     /// One sentence for both directions and every shape of partial success. What it must never do is stay
     /// silent about the difference: a drop of six that queued four and reported "queued 4" leaves somebody
-    /// looking for the other two in a queue they are not in.
+    /// looking for the other two in a queue they are not in — and with folders walked rather than skipped,
+    /// there are four more ways for a set to be partly what was asked for.
     /// </remarks>
-    private static string Describe(int queued, string verb, string destination, int directories, int missing)
+    private static string Describe(TransferPlan plan, string verb, string destination)
     {
-        var files = queued == 1 ? "1 file" : $"{queued} files";
-        var said = queued == 0
+        var files = plan.Queued == 1 ? "1 file" : $"{plan.Queued} files";
+        var said = plan.Queued == 0
             ? "Nothing was queued."
             : $"Queued {files} for {verb} {destination}.";
 
-        if (directories > 0)
+        if (plan.Missing > 0)
         {
-            var folders = directories == 1 ? "1 folder was" : $"{directories} folders were";
-            said += $" {folders} skipped — only files can be transferred.";
+            var gone = plan.Missing == 1 ? "1 item was" : $"{plan.Missing} items were";
+            said += $" {gone} no longer there.";
         }
 
-        if (missing > 0)
+        if (plan.Refused > 0)
         {
-            var gone = missing == 1 ? "1 item was" : $"{missing} items were";
-            said += $" {gone} no longer there.";
+            var refused = plan.Refused == 1 ? "1 directory" : $"{plan.Refused} directories";
+            said += $" {refused} could not be read or made.";
+        }
+
+        if (plan.Links > 0)
+        {
+            var links = plan.Links == 1 ? "1 link was" : $"{plan.Links} links were";
+            said += $" {links} left alone — a link is not followed.";
+        }
+
+        if (plan.Skipped > 0)
+        {
+            var other = plan.Skipped == 1 ? "1 entry was" : $"{plan.Skipped} entries were";
+            said += $" {other} not a file.";
+        }
+
+        if (plan.Truncated)
+        {
+            said += " The walk stopped at 5000 files; queue the rest a folder at a time.";
         }
 
         return said;
@@ -1845,16 +2997,394 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
     [RelayCommand]
     private void DeleteRemote()
     {
-        if (SelectedRemoteEntry is not { } row)
+        if (RemoteBatch is not { Count: > 0 } rows)
         {
             Status = "Choose something on the host to delete.";
             return;
         }
 
-        // The other question goes, so the two forms cannot be on screen at once over one row.
+        // The others go, so no two forms can be on screen at once over one row.
+        PendingRemoteMove = null;
+        PendingRemotePermissions = null;
+
+        PendingRemoteDeletion = new RemoteDeletionRequest(
+            [.. rows.Select(row => new RemoteDeletionTarget(row.Name, row.FullPath, !row.IsFile))]);
+    }
+
+    /// <summary>
+    /// Opens the mode of the chosen row for editing.
+    /// </summary>
+    /// <remarks>
+    /// ◆ <b>The <c>PERMS</c> column stops being read-only here.</b> It has been a true fact about a file
+    /// with nothing to be done about it since it arrived, and the commonest next act after using this screen
+    /// is opening a terminal to make the thing just uploaded executable — which is a whole second
+    /// authenticated connection to set nine bits this one is already holding a session for.
+    /// <para>
+    /// It starts from the mode the listing has rather than from a fresh stat. That listing is what the user
+    /// is looking at and what they are about to change; a re-read would be a round trip to fetch a number
+    /// already on screen, and a form that opened showing something different from the column beside it
+    /// would be the worse of the two ways to be out of date.
+    /// </para>
+    /// </remarks>
+    [RelayCommand]
+    private void ChangeRemotePermissions()
+    {
+        if (SelectedRemoteEntry is not { } row)
+        {
+            Status = "Choose something on the host to change the permissions of.";
+            return;
+        }
+
+        if (Remote is not RemoteKind.Host)
+        {
+            Status = "An object in a bucket has an access policy rather than a POSIX mode.";
+            return;
+        }
+
+        PendingRemoteDeletion = null;
         PendingRemoteMove = null;
 
-        PendingRemoteDeletion = new RemoteDeletionRequest(row.Name, row.FullPath, !row.IsFile);
+        PendingRemotePermissions = new RemotePermissionsRequest(
+            row.Name, row.FullPath, !row.IsFile, row.Permissions);
+    }
+
+    /// <summary>
+    /// Sends the mode that was ticked.
+    /// </summary>
+    /// <remarks>
+    /// It acts on the path the form named rather than on the selection, which is the promise the other two
+    /// questions make and rests on the same reasoning: nothing between opening the form and pressing its
+    /// button may re-point it.
+    /// </remarks>
+    [RelayCommand]
+    private async Task ConfirmRemotePermissionsAsync(CancellationToken cancellationToken)
+    {
+        if (PendingRemotePermissions is not { } request)
+        {
+            return;
+        }
+
+        var mode = request.Mode;
+
+        await RunAsync(
+            $"Setting permissions on {request.Name}…",
+            async () =>
+            {
+                await RequireSession()
+                    .SetPermissionsAsync(request.FullPath, mode, cancellationToken)
+                    .ConfigureAwait(true);
+
+                PendingRemotePermissions = null;
+
+                // Re-read, because the column beside the row has just stopped being true — and the server is
+                // the only thing that knows what it actually settled on. A umask, an ACL or a filesystem
+                // mounted without permissions can all land somewhere other than what was asked for.
+                await ListRemoteAsync(RemotePath, cancellationToken).ConfigureAwait(true);
+
+                Status = $"{request.Name} is now {PosixMode.FormatOctal(mode)}.";
+            }).ConfigureAwait(true);
+    }
+
+    /// <summary>Puts the mode form away without sending anything.</summary>
+    [RelayCommand]
+    private void CancelRemotePermissions() => PendingRemotePermissions = null;
+
+    /// <summary>
+    /// Fetches the chosen file, opens it in this machine's editor, and writes each save back.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// ◆ <b>Not through the transfer queue, in either direction, and that is deliberate.</b> The queue
+    /// refuses to overwrite — which is the right rule for a file somebody dragged and exactly the wrong one
+    /// for a file they are editing, where replacing the original is the entire intent. So this reads and
+    /// writes the bytes itself. It is a config file: small, and worth neither a part file nor a resume.
+    /// </para>
+    /// <para>
+    /// <b>The copy is this screen's, and it is deleted when the session ends.</b> It goes beside the ones
+    /// the phone's document staging already makes, under a name derived from the remote path so that two
+    /// files called <c>config</c> from different directories do not land on each other.
+    /// </para>
+    /// </remarks>
+    [RelayCommand]
+    private async Task EditRemoteAsync(CancellationToken cancellationToken)
+    {
+        if (openInEditor is not { } open || watchFile is not { } watch)
+        {
+            Status = "This build cannot open a file in an editor.";
+            return;
+        }
+
+        if (SelectedRemoteEntry is not { IsFile: true } row)
+        {
+            Status = "Choose a file on the host to edit.";
+            return;
+        }
+
+        await StopEditingAsync().ConfigureAwait(true);
+
+        await RunAsync(
+            $"Fetching {row.Name}…",
+            async () =>
+            {
+                var copy = Path.Combine(
+                    Path.GetTempPath(),
+                    "dodossh-edits",
+                    Guid.CreateVersion7().ToString("N", CultureInfo.InvariantCulture),
+                    row.Name);
+
+                Directory.CreateDirectory(Path.GetDirectoryName(copy)!);
+
+                await FetchAsync(row.FullPath, copy, cancellationToken).ConfigureAwait(true);
+
+                var editing = new RemoteEditSession(
+                    row.Name, row.FullPath, copy, PosixMode.ToOctal(row.Permissions))
+                {
+                    Stamp = (row.Entry.Length, row.Entry.LastWriteTimeUtc),
+                };
+
+                RemoteEdit = editing;
+                RemoteEditConflict = null;
+                RemoteEditLog.Clear();
+
+                Note("opened, watching for saves");
+
+                // Watched before it is opened, so a save made the instant the editor comes up is not the one
+                // that gets missed.
+                editWatch = watch(copy, () => post(() => _ = SaveEditAsync(editing, force: false)));
+
+                await open(copy).ConfigureAwait(true);
+
+                Status = $"{row.Name} is open. Saves go back to the host.";
+            }).ConfigureAwait(true);
+    }
+
+    /// <summary>Writes the edited copy back, unless the host's own has moved since it was fetched.</summary>
+    /// <remarks>
+    /// <para>
+    /// The check is a stat and a comparison of length and timestamp against what the listing said when the
+    /// copy was taken — see <see cref="RemoteEditSession.Stamp"/> for why those two and not a digest. It is
+    /// made before every save rather than once, because the whole risk this guards against is somebody else
+    /// writing while this file is open.
+    /// </para>
+    /// <para>
+    /// <paramref name="force"/> is the answer to that question and nothing else: it is set only by the
+    /// button that says UPLOAD ANYWAY, over a strip that has just said what changed.
+    /// </para>
+    /// </remarks>
+    private async Task SaveEditAsync(RemoteEditSession session, bool force)
+    {
+        if (!ReferenceEquals(session, RemoteEdit) || !IsConnected)
+        {
+            // A save arriving for a session that has been stopped, or after the connection went. The copy
+            // is still on disk either way; what is gone is the right to write it back.
+            return;
+        }
+
+        try
+        {
+            var open = RequireSession();
+
+            if (!force)
+            {
+                var current = await open.StatAsync(session.RemotePath, CancellationToken.None)
+                    .ConfigureAwait(true);
+
+                if (current is null)
+                {
+                    RemoteEditConflict = "It is no longer on the host.";
+                    Note("not saved — the file is gone");
+
+                    return;
+                }
+
+                if (current.Length != session.Stamp.Length
+                    || current.LastWriteTimeUtc != session.Stamp.Written)
+                {
+                    RemoteEditConflict = "The server's copy has changed since you opened it.";
+                    Note("not saved — it changed on the host");
+
+                    return;
+                }
+            }
+
+            var bytes = await File.ReadAllBytesAsync(session.LocalCopy, CancellationToken.None)
+                .ConfigureAwait(true);
+
+            await WriteBackAsync(open, session, bytes).ConfigureAwait(true);
+
+            // The stamp moves to what this write produced — in place, on the session the watcher is holding.
+            // See RemoteEditSession.Stamp.
+            if (await open.StatAsync(session.RemotePath, CancellationToken.None).ConfigureAwait(true)
+                is { } written)
+            {
+                session.Stamp = (written.Length, written.LastWriteTimeUtc);
+            }
+
+            RemoteEditConflict = null;
+
+            Note($"saved → uploaded ({ByteSize.Format(bytes.Length)})");
+        }
+        catch (Exception exception) when (exception is not OutOfMemoryException
+            and not OperationCanceledException)
+        {
+            Note($"not saved — {exception.Message}");
+        }
+    }
+
+    /// <summary>Replaces the file on the host with the bytes that were just saved here.</summary>
+    /// <remarks>
+    /// <para>
+    /// ◆ <b>Truncated first, and that is not optional.</b> <c>OpenWriteAsync</c> at offset zero writes over
+    /// the beginning and leaves whatever tail is longer than the new content — its own contract says so —
+    /// which for a config that got shorter means a file ending in the back half of its previous version.
+    /// Deleting is the only truncation this interface offers.
+    /// </para>
+    /// <para>
+    /// The mode goes back on afterwards, because deleting took it with it. Best-effort: a server that will
+    /// not set one has still received the bytes, and failing the save over the nine bits would be the wrong
+    /// half to insist on.
+    /// </para>
+    /// </remarks>
+    private static async Task WriteBackAsync(
+        IRemoteFileStore store, RemoteEditSession session, byte[] bytes)
+    {
+        await store.DeleteAsync(session.RemotePath, CancellationToken.None).ConfigureAwait(true);
+
+        var writing = await store.OpenWriteAsync(session.RemotePath, 0, CancellationToken.None)
+            .ConfigureAwait(true);
+
+        await using (writing.ConfigureAwait(false))
+        {
+            await writing.WriteAsync(bytes, CancellationToken.None).ConfigureAwait(true);
+        }
+
+        if (session.Mode == 0)
+        {
+            return;
+        }
+
+        try
+        {
+            await store.SetPermissionsAsync(session.RemotePath, session.Mode, CancellationToken.None)
+                .ConfigureAwait(true);
+        }
+        catch (Exception exception) when (exception is not OutOfMemoryException
+            and not OperationCanceledException)
+        {
+            // The bytes are there. See the remark above.
+        }
+    }
+
+    /// <summary>Writes the save the conflict card asked about, over whatever is on the host now.</summary>
+    [RelayCommand]
+    private async Task ForceSaveEditAsync()
+    {
+        if (RemoteEdit is { } session)
+        {
+            await SaveEditAsync(session, force: true).ConfigureAwait(true);
+        }
+    }
+
+    /// <summary>Fetches the host's copy again, over the local one the editor has open.</summary>
+    /// <remarks>
+    /// The other honest answer to a conflict: throw away what was typed and start from what is there. It
+    /// keeps the same temporary file so the editor does not need reopening — every editor worth the name
+    /// notices its file changing underneath it and offers to reload.
+    /// </remarks>
+    [RelayCommand]
+    private async Task ReloadEditAsync(CancellationToken cancellationToken)
+    {
+        if (RemoteEdit is not { } session)
+        {
+            return;
+        }
+
+        await RunAsync(
+            $"Fetching {session.Name} again…",
+            async () =>
+            {
+                await FetchAsync(session.RemotePath, session.LocalCopy, cancellationToken)
+                    .ConfigureAwait(true);
+
+                if (await RequireSession().StatAsync(session.RemotePath, cancellationToken)
+                    .ConfigureAwait(true) is { } current)
+                {
+                    session.Stamp = (current.Length, current.LastWriteTimeUtc);
+                }
+
+                RemoteEditConflict = null;
+
+                Note("reloaded from the host");
+            }).ConfigureAwait(true);
+    }
+
+    /// <summary>Stops watching, and removes the copy this screen made.</summary>
+    [RelayCommand]
+    private Task StopEditingAsync()
+    {
+        editWatch?.Dispose();
+        editWatch = null;
+
+        if (RemoteEdit is { } session)
+        {
+            RemoveEditCopy(session);
+        }
+
+        RemoteEdit = null;
+        RemoteEditConflict = null;
+        RemoteEditLog.Clear();
+
+        return Task.CompletedTask;
+    }
+
+    /// <summary>Reads a remote file into a local path, replacing whatever is there.</summary>
+    private async Task FetchAsync(string remotePath, string localPath, CancellationToken cancellationToken)
+    {
+        var reading = await RequireSession()
+            .OpenReadAsync(remotePath, 0, cancellationToken)
+            .ConfigureAwait(true);
+
+        await using var readingScope = reading.ConfigureAwait(false);
+
+        var writing = new FileStream(
+            localPath, FileMode.Create, FileAccess.Write, FileShare.None, 64 * 1024, useAsync: true);
+
+        await using var writingScope = writing.ConfigureAwait(false);
+
+        await reading.CopyToAsync(writing, cancellationToken).ConfigureAwait(true);
+    }
+
+    /// <summary>Removes the temporary copy and the directory made to hold it.</summary>
+    /// <remarks>
+    /// Best-effort, and quietly: the editor may still have the file open, which on Windows means the delete
+    /// fails — and a screen that reported that would be reporting on a file the user never asked to exist.
+    /// What is left behind is one small file in the temporary directory the operating system clears.
+    /// </remarks>
+    private static void RemoveEditCopy(RemoteEditSession session)
+    {
+        try
+        {
+            File.Delete(session.LocalCopy);
+
+            if (Path.GetDirectoryName(session.LocalCopy) is { Length: > 0 } folder)
+            {
+                Directory.Delete(folder);
+            }
+        }
+        catch (Exception exception) when (exception is IOException or UnauthorizedAccessException)
+        {
+        }
+    }
+
+    /// <summary>Adds a line to the edit strip's log, newest first and bounded.</summary>
+    private void Note(string what)
+    {
+        RemoteEditLog.Insert(0, what);
+
+        while (RemoteEditLog.Count > EditLogDepth)
+        {
+            RemoteEditLog.RemoveAt(RemoteEditLog.Count - 1);
+        }
     }
 
     /// <summary>
@@ -1877,17 +3407,57 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
         PendingRemoteDeletion = null;
 
         await RunAsync(
-            $"Deleting {request.Name}…",
+            request.IsSingle ? $"Deleting {request.First.Name}…" : $"Deleting {request.Count} items…",
             async () =>
             {
-                await RequireSession().DeleteAsync(request.FullPath, cancellationToken).ConfigureAwait(true);
+                var open = RequireSession();
+                var deleted = 0;
+                var refusals = new List<string>();
+
+                foreach (var target in request.Paths)
+                {
+                    // ◆ Each on its own, and a refusal does not stop the rest. The host turns down a
+                    // directory that still has something in it — which is the refusal this screen depends on
+                    // rather than checking for — and in a set of five that must not silently cancel the four
+                    // it would have removed. What it must also not do is hide which ones were refused.
+                    try
+                    {
+                        await open.DeleteAsync(target.FullPath, cancellationToken).ConfigureAwait(true);
+                        deleted++;
+                    }
+                    catch (Exception exception) when (exception is not OutOfMemoryException
+                        and not OperationCanceledException)
+                    {
+                        refusals.Add($"{target.Name}: {exception.Message}");
+                    }
+                }
+
+                ClearRemoteChecks();
 
                 await ListRemoteAsync(RemotePath, cancellationToken).ConfigureAwait(true);
 
-                Status = $"Deleted {request.Name}.";
+                Status = Deleted(deleted, refusals);
             }).ConfigureAwait(true);
     }
 
+    /// <summary>What a batch delete has to say for itself, however mixed the outcome was.</summary>
+    /// <remarks>
+    /// One sentence for every shape of it, and what it must never do is stay quiet about the difference: a
+    /// set of five that removed three and reported "deleted 3" leaves somebody looking for two files that
+    /// are still there, with nothing saying why.
+    /// </remarks>
+    private static string Deleted(int deleted, List<string> refusals)
+    {
+        var said = deleted switch
+        {
+            0 => "Nothing was deleted.",
+            1 => "Deleted 1 item.",
+            var many => $"Deleted {many} items.",
+        };
+
+        return refusals.Count == 0 ? said : $"{said} {string.Join(" ", refusals)}";
+    }
+
     /// <summary>Thinks better of it.</summary>
     /// <remarks>
     /// Settles the listing on the way out. A transfer that landed while the question was up left the pane
@@ -1927,8 +3497,9 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
             return;
         }
 
-        // The other question goes, so the two forms cannot be on screen at once over one row.
+        // The others go, so no two forms can be on screen at once over one row.
         PendingRemoteDeletion = null;
+        PendingRemotePermissions = null;
 
         PendingRemoteMove = new RemoteMoveRequest(row.Name, row.FullPath, !row.IsFile, kind);
         RemoteMoveTarget = kind is RemoteMoveKind.Rename
@@ -2347,6 +3918,35 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
         session ?? throw new InvalidOperationException(
             "This screen is not connected to a host, so there is nowhere to move the file.");
 
+    /// <summary>Closes the connection log's open ticket, if there is one.</summary>
+    /// <remarks>
+    /// Written whole rather than through an open/close ticket, because this connection is not one the
+    /// terminal workspace ever knew about — it has no session id, and borrowing one would collide with a
+    /// real terminal's.
+    /// <para>
+    /// Its own method since a connection can now end two ways: closed by this screen, and lost. Both write
+    /// one entry and neither may write two, which is what the null-out is for.
+    /// </para>
+    /// </remarks>
+    private void CloseConnectionRecord(ConnectionOutcome outcome)
+    {
+        if (connected is not { } record)
+        {
+            return;
+        }
+
+        connected = null;
+
+        connectionLog?.Record(
+            record.Address,
+            record.HostLabel,
+            record.HostId,
+            ConnectionKind.Sftp,
+            record.StartedAt,
+            TimeProvider.System.GetUtcNow(),
+            outcome);
+    }
+
     private async Task CloseSessionAsync()
     {
         if (session is { } open)
@@ -2355,24 +3955,11 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
             await open.DisposeAsync().ConfigureAwait(true);
         }
 
-        // Written whole here rather than through an open/close ticket, because this connection is not one
-        // the terminal workspace ever knew about — it has no session id, and borrowing one would collide
-        // with a real terminal's.
-        if (connected is { } record)
-        {
-            connected = null;
-
-            connectionLog?.Record(
-                record.Address,
-                record.HostLabel,
-                record.HostId,
-                ConnectionKind.Sftp,
-                record.StartedAt,
-                TimeProvider.System.GetUtcNow(),
-                ConnectionOutcome.Closed);
-        }
+        CloseConnectionRecord(ConnectionOutcome.Closed);
 
         IsConnected = false;
+        LostConnection = null;
+        reconnectTo = null;
         ConnectedTo = null;
         ConnectedCipher = null;
         ConnectedHostKeyAlgorithm = null;
@@ -2390,6 +3977,7 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
         // commit against RequireSession's own refusal.
         PendingRemoteDeletion = null;
         PendingRemoteMove = null;
+        PendingRemotePermissions = null;
         RemoteMoveTarget = string.Empty;
         remoteListingIsStale = false;
 
@@ -2492,6 +4080,10 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
     /// </remarks>
     partial void OnRemoteChanged(RemoteKind value)
     {
+        // PERMS is the one item action that is not offered on both destinations; see
+        // CanChangeRemotePermissions.
+        OnPropertyChanged(nameof(CanChangeRemotePermissions));
+
         OnPropertyChanged(nameof(ShowsHostPicker));
         OnPropertyChanged(nameof(ConnectLabel));
         OnPropertyChanged(nameof(SelectedHostAsksForAPassword));
@@ -2517,8 +4109,18 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
         OnPropertyChanged(nameof(ShowsNoBuckets));
     }
 
+    /// <remarks>
+    /// A fresh connection clears it, which is what puts the strip away — and it is here rather than in each
+    /// connect path so that every way of connecting takes the last failure down with it.
+    /// </remarks>
     partial void OnIsConnectedChanged(bool value)
     {
+        if (value)
+        {
+            LostConnection = null;
+        }
+
+        RaiseRemotePaneState();
         OnPropertyChanged(nameof(CanDownload));
         OnPropertyChanged(nameof(CanUpload));
         RaiseItemActionState();
@@ -2538,10 +4140,12 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
     partial void OnSelectedRemoteEntryChanged(RemoteEntryRowViewModel? value)
     {
         OnPropertyChanged(nameof(CanDownload));
+        OnPropertyChanged(nameof(CanEditRemote));
         OnPropertyChanged(nameof(SelectedRemoteName));
 
         PendingRemoteDeletion = null;
         PendingRemoteMove = null;
+        PendingRemotePermissions = null;
     }
 
     partial void OnPendingRemoteDeletionChanged(RemoteDeletionRequest? value)
@@ -2556,6 +4160,33 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
         RaiseItemActionState();
     }
 
+    partial void OnPendingRemotePermissionsChanged(RemotePermissionsRequest? value)
+    {
+        OnPropertyChanged(nameof(IsChangingRemotePermissions));
+        RaiseItemActionState();
+    }
+
+    partial void OnRemoteEditChanged(RemoteEditSession? value)
+    {
+        OnPropertyChanged(nameof(IsEditingRemote));
+        OnPropertyChanged(nameof(CanEditRemote));
+    }
+
+    partial void OnRemoteEditConflictChanged(string? value) =>
+        OnPropertyChanged(nameof(HasRemoteEditConflict));
+
+    /// <summary>Raises the three flags that answer "what is in the remote pane".</summary>
+    /// <remarks>
+    /// Together, because they are one fact read three ways — see <see cref="ShowsRemoteContents"/> — and a
+    /// caller that raised some of them would leave an invitation drawn over a listing, or neither.
+    /// </remarks>
+    private void RaiseRemotePaneState()
+    {
+        OnPropertyChanged(nameof(IsConnectionLost));
+        OnPropertyChanged(nameof(ShowsRemoteContents));
+        OnPropertyChanged(nameof(ShowsRemoteInvitation));
+    }
+
     /// <summary>Raises the flags the three item buttons and their two forms are drawn from.</summary>
     /// <remarks>
     /// Together, because they are one fact — is there a question on screen, and is anything connected —
@@ -2569,6 +4200,8 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
         OnPropertyChanged(nameof(CanDeleteRemote));
         OnPropertyChanged(nameof(CanRenameRemote));
         OnPropertyChanged(nameof(CanMoveRemote));
+        OnPropertyChanged(nameof(CanChangeRemotePermissions));
+        OnPropertyChanged(nameof(CanEditRemote));
     }
 
     partial void OnSelectedLocalEntryChanged(LocalEntryRowViewModel? value) =>
diff --git a/src/DodoSSH.Client.Ssh/SftpSession.cs b/src/DodoSSH.Client.Ssh/SftpSession.cs
index c5c3b4b..cc2e56a 100644
--- a/src/DodoSSH.Client.Ssh/SftpSession.cs
+++ b/src/DodoSSH.Client.Ssh/SftpSession.cs
@@ -140,6 +140,54 @@ public static class PosixMode
     /// <summary>Whether the others triple carries the write bit.</summary>
     public static bool IsWorldWritable(string mode) => At(mode, OthersWrite) == 'w';
 
+    /// <summary>
+    /// Reads the nine permission bits back out of a formatted mode, as an octal number.
+    /// </summary>
+    /// <remarks>
+    /// The inverse of <see cref="Format"/>, and it exists because the editor that changes a mode has to
+    /// start from the one that is there. Anything that is not a mode this type wrote answers zero — the same
+    /// forgiving reading <see cref="At"/> already takes, and for the same reason: this feeds a form, and a
+    /// listing is not worth failing over one unrecognised string.
+    /// </remarks>
+    public static int ToOctal(string mode)
+    {
+        if (mode is not { Length: 10 })
+        {
+            return 0;
+        }
+
+        var bits = 0;
+
+        for (var index = 1; index < 10; index++)
+        {
+            bits <<= 1;
+
+            if (mode[index] != '-')
+            {
+                bits |= 1;
+            }
+        }
+
+        return bits;
+    }
+
+    /// <summary>Formats nine permission bits the way <c>chmod</c> takes them, e.g. <c>0755</c>.</summary>
+    /// <remarks>
+    /// Four digits with a leading zero, which is how every <c>chmod</c> example on earth writes one — and
+    /// the leading zero is the part that says out loud that the three bits this client does not write are
+    /// being sent as clear. See the type's own remark.
+    /// </remarks>
+    public static string FormatOctal(int mode) =>
+        string.Create(CultureInfo.InvariantCulture, $"0{(mode >> 6) & 7}{(mode >> 3) & 7}{mode & 7}");
+
+    /// <summary>The nine bits, and nothing above them.</summary>
+    /// <remarks>
+    /// Applied to everything on its way to a server. It is what keeps a caller from setting setuid through
+    /// an interface that does not admit to offering it — see the type's own remark on why those three bits
+    /// are neither rendered nor written.
+    /// </remarks>
+    public static int Sanitise(int mode) => mode & 0b111_111_111;
+
     private const int OwnerExecute = 3;
     private const int GroupExecute = 6;
     private const int OthersWrite = 8;
@@ -393,6 +441,43 @@ public interface IRemoteFileStore : IAsyncDisposable
     /// <summary>Whether the transport is still up.</summary>
     bool IsConnected { get; }
 
+    /// <summary>
+    /// Why the connection under this store went away, or null if it did not.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// The same fact, latched the same way and for the same reason, as
+    /// <see cref="ISshShellSession.TransportFailure"/> — read that member for the argument. What differs is
+    /// what it is read <em>for</em>: a shell has a blocked read this releases, and a file browser has no
+    /// loop at all. Here it is the sentence a screen prints beside the word DISCONNECTED, and the thing that
+    /// tells a failed listing about a path apart from a failed listing about a connection.
+    /// </para>
+    /// <para>
+    /// Null forever on a store with no connection to lose. A bucket is HTTP, request per operation, and has
+    /// nothing that can be up between two of them.
+    /// </para>
+    /// </remarks>
+    string? TransportFailure { get; }
+
+    /// <summary>
+    /// Raised once, when the connection goes away without this client having closed it.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// ◆ <b>Because otherwise nobody finds out until they click.</b> A file browser is idle between
+    /// operations, so the alternative to an event is a screen that goes on saying CONNECTED over a host that
+    /// is gone until somebody happens to ask it for a listing — which is the same dishonesty a terminal
+    /// showed and the same one this is here to remove. <see cref="TransportFailure"/> is already set by the
+    /// time this is raised.
+    /// </para>
+    /// <para>
+    /// Raised on whichever thread the failure was noticed on, which is SSH.NET's message-listener thread; a
+    /// handler that touches a view model has to marshal. Never raised by a store with no connection to lose,
+    /// and never raised for a session this client disposed itself.
+    /// </para>
+    /// </remarks>
+    event EventHandler? ConnectionLost;
+
     /// <summary>
     /// Where the session starts, which is the account's home directory.
     /// </summary>
@@ -453,6 +538,42 @@ public interface IRemoteFileStore : IAsyncDisposable
 
     /// <summary>Renames or moves a path within the same host.</summary>
     Task RenameAsync(string fromPath, string toPath, CancellationToken cancellationToken);
+
+    /// <summary>
+    /// Sets a path's POSIX mode.
+    /// </summary>
+    /// <param name="path">What to change.</param>
+    /// <param name="mode">
+    /// The nine permission bits, as an octal number reads them — <c>0o755</c> is <c>rwxr-xr-x</c>. Only the
+    /// low nine bits are sent; see <see cref="PosixMode"/> for why setuid, setgid and sticky are not this
+    /// client's to write.
+    /// </param>
+    /// <param name="cancellationToken">Cancellation.</param>
+    /// <remarks>
+    /// ◆ <b>The one operation on this interface that writes something the listing already shows.</b> The
+    /// <c>PERMS</c> column has been a read-only fact since it arrived, and the commonest thing anybody does
+    /// straight after using this screen is open a terminal to make the file they just uploaded executable.
+    /// <para>
+    /// Refused by a store with no such thing. An object has an ACL rather than a mode, and mapping one onto
+    /// the other would be inventing a fact about a bucket.
+    /// </para>
+    /// </remarks>
+    /// <exception cref="SftpPathException">The path is not there, is not writable, or has no mode to set.</exception>
+    Task SetPermissionsAsync(string path, int mode, CancellationToken cancellationToken);
+
+    /// <summary>
+    /// Sets a path's last-write time.
+    /// </summary>
+    /// <remarks>
+    /// What makes an upload land carrying the timestamp its source had, which is the half of "preserve" that
+    /// every platform can answer — a mode is not a fact about a file on Windows and a modification time is.
+    /// Refused by a store that has no way to say when an object was written other than when it was put.
+    /// </remarks>
+    /// <exception cref="SftpPathException">The path is not there, or its time cannot be set.</exception>
+    Task SetLastWriteTimeAsync(
+        string path,
+        DateTimeOffset lastWriteTimeUtc,
+        CancellationToken cancellationToken);
 }
 
 /// <summary>
diff --git a/src/DodoSSH.Client.Ssh/SshNetSftpSession.cs b/src/DodoSSH.Client.Ssh/SshNetSftpSession.cs
index 3fef13d..abdad3c 100644
--- a/src/DodoSSH.Client.Ssh/SshNetSftpSession.cs
+++ b/src/DodoSSH.Client.Ssh/SshNetSftpSession.cs
@@ -11,14 +11,35 @@ namespace DodoSSH.Client.Ssh;
 /// this type does beyond forwarding calls is translate SSH.NET's several path failures into the single one a
 /// caller can act on.
 /// </remarks>
-internal sealed class SshNetSftpSession(SftpClient client, HostKeyPresentation hostKey, string homeDirectory)
-    : ISftpSession
+internal sealed class SshNetSftpSession : ISftpSession
 {
+    private readonly SftpClient client;
+
+    private string? transportFailure;
+    private int announced;
+
+    internal SshNetSftpSession(SftpClient client, HostKeyPresentation hostKey, string homeDirectory)
+    {
+        this.client = client;
+
+        HostKey = hostKey;
+        HomeDirectory = homeDirectory;
+        Cipher = client.ConnectionInfo.CurrentServerEncryption ?? string.Empty;
+
+        client.ErrorOccurred += OnTransportError;
+    }
+
     /// <inheritdoc />
     public bool IsConnected => client.IsConnected;
 
     /// <inheritdoc />
-    public HostKeyPresentation HostKey { get; } = hostKey;
+    public string? TransportFailure => Volatile.Read(ref transportFailure);
+
+    /// <inheritdoc />
+    public event EventHandler? ConnectionLost;
+
+    /// <inheritdoc />
+    public HostKeyPresentation HostKey { get; }
 
     /// <inheritdoc />
     /// <remarks>
@@ -27,10 +48,36 @@ internal sealed class SshNetSftpSession(SftpClient client, HostKeyPresentation h
     /// so <c>ConnectionInfo</c> is already populated by the time there is a session to read it from. The coalesce
     /// is there for SSH.NET's nullable annotation, which covers the pre-key-exchange window this never sees.
     /// </remarks>
-    public string Cipher { get; } = client.ConnectionInfo.CurrentServerEncryption ?? string.Empty;
+    public string Cipher { get; }
 
     /// <inheritdoc />
-    public string HomeDirectory { get; } = homeDirectory;
+    public string HomeDirectory { get; }
+
+    /// <summary>
+    /// Latches the failure and says so once.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// No blocked read to release, unlike the shell's own handler: every SFTP call is a request and a reply,
+    /// so a connection that has gone is discovered by the next one throwing. What this adds is that somebody
+    /// finds out <em>without</em> making that next call — a file browser sits idle between operations, and
+    /// waiting for a click to reveal a host that went away half an hour ago is exactly the stale CONNECTED
+    /// this exists to remove.
+    /// </para>
+    /// <para>
+    /// Announced once. SSH.NET can raise several errors as one connection comes apart, and a screen told
+    /// three times would report the second and third against a session it had already replaced.
+    /// </para>
+    /// </remarks>
+    private void OnTransportError(object? sender, ExceptionEventArgs e)
+    {
+        Interlocked.CompareExchange(ref transportFailure, e.Exception.Message, comparand: null);
+
+        if (Interlocked.Exchange(ref announced, 1) == 0)
+        {
+            ConnectionLost?.Invoke(this, EventArgs.Empty);
+        }
+    }
 
     /// <inheritdoc />
     public async Task<IReadOnlyList<SftpEntry>> ListAsync(string path, CancellationToken cancellationToken)
@@ -141,10 +188,61 @@ internal sealed class SshNetSftpSession(SftpClient client, HostKeyPresentation h
         }
     }
 
+    /// <inheritdoc />
+    /// <remarks>
+    /// ◆ <b>On a thread-pool thread, because SSH.NET offers no asynchronous <c>SETSTAT</c>.</b>
+    /// <c>ChangePermissions</c> is a blocking round trip and every caller here is on the thread the
+    /// interface is drawn from — so calling it directly would freeze the window for a link's latency, which
+    /// on the connections this product exists for is the difference between instant and noticeably not.
+    /// Every other operation on this type has an async form and uses it.
+    /// </remarks>
+    public async Task SetPermissionsAsync(string path, int mode, CancellationToken cancellationToken)
+    {
+        // Sanitised here rather than trusted from the caller, so that the promise the interface makes about
+        // the three bits it does not write holds at the last point before the wire.
+        var bits = (short)PosixMode.Sanitise(mode);
+
+        try
+        {
+            await Task.Run(() => client.ChangePermissions(path, bits), cancellationToken)
+                .ConfigureAwait(false);
+        }
+        catch (Exception exception) when (IsPathFailure(exception))
+        {
+            throw Translate(path, exception);
+        }
+    }
+
+    /// <inheritdoc />
+    /// <remarks>See <see cref="SetPermissionsAsync"/>; the same blocking round trip, moved off the caller's thread for the same reason.</remarks>
+    public async Task SetLastWriteTimeAsync(
+        string path,
+        DateTimeOffset lastWriteTimeUtc,
+        CancellationToken cancellationToken)
+    {
+        var when = lastWriteTimeUtc.UtcDateTime;
+
+        try
+        {
+            await Task.Run(() => client.SetLastWriteTimeUtc(path, when), cancellationToken)
+                .ConfigureAwait(false);
+        }
+        catch (Exception exception) when (IsPathFailure(exception))
+        {
+            throw Translate(path, exception);
+        }
+    }
+
     /// <inheritdoc />
     public ValueTask DisposeAsync()
     {
+        // Before the client goes, and it also settles the flag: a disposal that trips SSH.NET's own error
+        // path must not reach a screen as a connection this client did not mean to lose.
+        Interlocked.Exchange(ref announced, 1);
+        client.ErrorOccurred -= OnTransportError;
+
         client.Dispose();
+
         return ValueTask.CompletedTask;
     }
 
diff --git a/src/DodoSSH.Client.Transfer/FileTransferQueue.cs b/src/DodoSSH.Client.Transfer/FileTransferQueue.cs
index c5ae6d8..d694b6a 100644
--- a/src/DodoSSH.Client.Transfer/FileTransferQueue.cs
+++ b/src/DodoSSH.Client.Transfer/FileTransferQueue.cs
@@ -87,6 +87,41 @@ public sealed record TransferSnapshot(
         State is TransferState.Failed or TransferState.Cancelled && Transferred > 0 && Transferred < Length;
 }
 
+/// <summary>
+/// What a transfer should carry across with the bytes.
+/// </summary>
+/// <param name="Mode">
+/// The nine POSIX permission bits to set on the destination, or null to leave whatever it lands with.
+/// </param>
+/// <param name="LastWriteTimeUtc">
+/// The timestamp to set on the destination, or null to leave the one the write produced.
+/// </param>
+/// <remarks>
+/// <para>
+/// ◆ <b>Both nullable, because both are facts the source may not have.</b> A local file on Windows has no
+/// POSIX mode — this codebase already says so, in <c>LocalEntryRowViewModel</c>, and prints an empty
+/// <c>PERMS</c> column rather than a plausible <c>-rw-r--r--</c>. So the caller passes what it actually
+/// knows and null for the rest, and nothing here invents a default: a file that arrives with the server's
+/// umask on it is the honest outcome of an upload from a machine with no mode to send.
+/// </para>
+/// <para>
+/// <b>Applied after the rename into place, never before.</b> The part file is what the transfer writes and
+/// it is not the file anybody asked for; setting a mode on it would put the right bits on the wrong name
+/// and leave the destination with whatever the rename gave it.
+/// </para>
+/// <para>
+/// <b>A failure here does not fail the transfer.</b> The bytes are the transfer and they arrived; a server
+/// that refuses <c>SETSTAT</c> — some do, and every object store does — must not turn a completed copy into
+/// a failed one. It is reported through <see cref="TransferSnapshot.Failure"/> on a row that still says
+/// <see cref="TransferState.Completed"/>, which is the one shape that says both true things at once.
+/// </para>
+/// </remarks>
+public sealed record TransferAttributes(int? Mode, DateTimeOffset? LastWriteTimeUtc)
+{
+    /// <summary>Whether there is anything here worth a round trip.</summary>
+    public bool IsEmpty => Mode is null && LastWriteTimeUtc is null;
+}
+
 /// <summary>A transfer whose state or progress has moved.</summary>
 /// <param name="transfer">The transfer, as it now is.</param>
 public sealed class TransferChangedEventArgs(TransferSnapshot transfer) : EventArgs
@@ -216,18 +251,23 @@ public sealed class FileTransferQueue : IAsyncDisposable
     /// rather than measured here, because the pane the user dragged from has just read it and asking again
     /// would be a round trip to learn something already on screen.
     /// </param>
+    /// <param name="preserve">
+    /// What to carry across with the bytes, or null to carry nothing. See <see cref="TransferAttributes"/>.
+    /// </param>
     /// <returns>The transfer's id.</returns>
     public Guid Enqueue(
         TransferDirection direction,
         string localPath,
         string remotePath,
-        long length)
+        long length,
+        TransferAttributes? preserve = null)
     {
         ArgumentException.ThrowIfNullOrEmpty(localPath);
         ArgumentException.ThrowIfNullOrEmpty(remotePath);
 
         var entry = new Entry
         {
+            Preserve = preserve is { IsEmpty: false } wanted ? wanted : null,
             Id = Guid.CreateVersion7(),
             Direction = direction,
             LocalPath = localPath,
@@ -549,6 +589,75 @@ public sealed class FileTransferQueue : IAsyncDisposable
         // block here. On Windows a move of a file still open for writing fails, and it is the one step whose
         // failure would leave a complete transfer looking like an incomplete one.
         File.Move(part, destination);
+
+        ApplyLocally(entry, destination);
+    }
+
+    /// <summary>
+    /// Puts the remote file's mode and timestamp on the copy that has just landed here.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// ◆ <b>The mode is only set where the platform has one.</b> <c>File.SetUnixFileMode</c> throws on
+    /// Windows, where a POSIX mode is not a fact about a file at all — so it is asked for rather than tried,
+    /// and a download onto Windows quietly carries the timestamp alone. That is not a gap being papered
+    /// over: there is nothing on that filesystem for those nine bits to mean.
+    /// </para>
+    /// <para>
+    /// Best-effort, and its failures are recorded on a row that still says the transfer completed. See
+    /// <see cref="TransferAttributes"/>.
+    /// </para>
+    /// </remarks>
+    private static void ApplyLocally(Entry entry, string destination)
+    {
+        if (entry.Preserve is not { } preserve)
+        {
+            return;
+        }
+
+        try
+        {
+            if (preserve.LastWriteTimeUtc is { } when)
+            {
+                File.SetLastWriteTimeUtc(destination, when.UtcDateTime);
+            }
+
+            if (preserve.Mode is { } mode && !OperatingSystem.IsWindows())
+            {
+                File.SetUnixFileMode(destination, (UnixFileMode)PosixModeBits(mode));
+            }
+        }
+        catch (Exception exception) when (exception is IOException or UnauthorizedAccessException
+            or PlatformNotSupportedException)
+        {
+            entry.Failure = $"The file arrived, but its permissions could not be set: {exception.Message}";
+        }
+    }
+
+    /// <summary>
+    /// The nine permission bits, as <see cref="UnixFileMode"/> numbers them.
+    /// </summary>
+    /// <remarks>
+    /// A translation rather than a cast, and it is load-bearing: <see cref="UnixFileMode"/> is a flags enum
+    /// whose values happen to line up with the octal mode for the low nine bits, which is true today and is
+    /// not something the BCL promises. Writing the nine out means a change there is a compile error rather
+    /// than a file that lands with the wrong bits on it.
+    /// </remarks>
+    private static UnixFileMode PosixModeBits(int mode)
+    {
+        var bits = UnixFileMode.None;
+
+        if ((mode & 0b100_000_000) != 0) { bits |= UnixFileMode.UserRead; }
+        if ((mode & 0b010_000_000) != 0) { bits |= UnixFileMode.UserWrite; }
+        if ((mode & 0b001_000_000) != 0) { bits |= UnixFileMode.UserExecute; }
+        if ((mode & 0b000_100_000) != 0) { bits |= UnixFileMode.GroupRead; }
+        if ((mode & 0b000_010_000) != 0) { bits |= UnixFileMode.GroupWrite; }
+        if ((mode & 0b000_001_000) != 0) { bits |= UnixFileMode.GroupExecute; }
+        if ((mode & 0b000_000_100) != 0) { bits |= UnixFileMode.OtherRead; }
+        if ((mode & 0b000_000_010) != 0) { bits |= UnixFileMode.OtherWrite; }
+        if ((mode & 0b000_000_001) != 0) { bits |= UnixFileMode.OtherExecute; }
+
+        return bits;
     }
 
     private async Task ReadIntoPartAsync(
@@ -602,6 +711,50 @@ public sealed class FileTransferQueue : IAsyncDisposable
         await WriteIntoPartAsync(entry, session, part, offset, cancellationToken).ConfigureAwait(false);
 
         await session.RenameAsync(part, destination, cancellationToken).ConfigureAwait(false);
+
+        await ApplyRemotelyAsync(entry, session, destination, cancellationToken).ConfigureAwait(false);
+    }
+
+    /// <summary>Puts the source file's mode and timestamp on the copy that has just landed on the host.</summary>
+    /// <remarks>
+    /// ◆ <b>This is the one that makes an uploaded <c>deploy.sh</c> arrive executable.</b> Without it a file
+    /// lands with whatever the server's umask gives it, which is the reason people reach for a terminal
+    /// straight after using this screen.
+    /// <para>
+    /// A refusal is recorded and does not fail the transfer — a store that has no mode to set says so, and
+    /// the bytes are still there. See <see cref="TransferAttributes"/>.
+    /// </para>
+    /// </remarks>
+    private static async Task ApplyRemotelyAsync(
+        Entry entry,
+        IRemoteFileStore session,
+        string destination,
+        CancellationToken cancellationToken)
+    {
+        if (entry.Preserve is not { } preserve)
+        {
+            return;
+        }
+
+        try
+        {
+            if (preserve.Mode is { } mode)
+            {
+                await session.SetPermissionsAsync(destination, mode, cancellationToken)
+                    .ConfigureAwait(false);
+            }
+
+            if (preserve.LastWriteTimeUtc is { } when)
+            {
+                await session.SetLastWriteTimeAsync(destination, when, cancellationToken)
+                    .ConfigureAwait(false);
+            }
+        }
+        catch (Exception exception) when (exception is not OutOfMemoryException
+            and not OperationCanceledException)
+        {
+            entry.Failure = $"The file arrived, but its permissions could not be set: {exception.Message}";
+        }
     }
 
     private async Task WriteIntoPartAsync(
@@ -865,6 +1018,9 @@ public sealed class FileTransferQueue : IAsyncDisposable
         /// <summary>Whether the next run may carry on from a part file rather than starting again.</summary>
         public bool Resume { get; set; }
 
+        /// <inheritdoc cref="TransferAttributes" />
+        public TransferAttributes? Preserve { get; init; }
+
         public CancellationTokenSource? Cancellation { get; set; }
     }
 }
diff --git a/tests/DodoSSH.Client.App.Layout.Tests/ScreenLayoutTests.cs b/tests/DodoSSH.Client.App.Layout.Tests/ScreenLayoutTests.cs
index de5904a..e354193 100644
--- a/tests/DodoSSH.Client.App.Layout.Tests/ScreenLayoutTests.cs
+++ b/tests/DodoSSH.Client.App.Layout.Tests/ScreenLayoutTests.cs
@@ -1325,9 +1325,61 @@ public sealed class ScreenLayoutTests : IAsyncLifetime
         transfers.IsConnected = true;
         transfers.RemotePath = "/srv/releases/site/backups/nightly";
         transfers.PendingRemoteDeletion = new RemoteDeletionRequest(
-            "2026-07-30",
-            "/srv/releases/site/backups/nightly/2026-07-30",
-            IsDirectory: true);
+        [
+            new RemoteDeletionTarget(
+                "2026-07-30",
+                "/srv/releases/site/backups/nightly/2026-07-30",
+                IsDirectory: true),
+        ]);
+
+        await MeasureTransfersAsync(faults => faults.ShouldBeEmpty());
+    }
+
+    /// <remarks>
+    /// The edit strip, which shares the questions' Grid row and is the tallest thing that can be in it: a
+    /// heading, a path, a scrolling log of saves, the conflict card and a button. Its log is bounded for the
+    /// same reason the deletion card's path list is — see TransfersScreen.axaml — and this is what says that
+    /// bound holds with the conflict card open underneath it, which is the worst case.
+    /// </remarks>
+    [Fact]
+    public async Task TheTransfersScreenFitsWithAFileBeingEdited()
+    {
+        transfers.IsConnected = true;
+        transfers.RemotePath = "/etc/nginx/conf.d";
+        transfers.RemoteEdit = new RemoteEditSession(
+            "site.conf",
+            "/etc/nginx/conf.d/site.conf",
+            Path.Combine(Path.GetTempPath(), "dodossh-edits", "abc", "site.conf"),
+            0b110_100_100);
+
+        transfers.RemoteEditConflict = "The server's copy has changed since you opened it.";
+
+        for (var save = 0; save < 6; save++)
+        {
+            transfers.RemoteEditLog.Add($"14:2{save}:07  saved → uploaded (2.4 KB)");
+        }
+
+        await MeasureTransfersAsync(faults => faults.ShouldBeEmpty());
+    }
+
+    /// <remarks>
+    /// The same card with a whole ticked set in it, which is the shape that can grow without limit. Its
+    /// path list scrolls inside a bounded height rather than pushing the buttons under it off the pane —
+    /// see TransfersScreen.axaml — and this is what says that bound actually holds. Five is past the point
+    /// where an unbounded list would have overflowed the 204-pixel pane inside the session shell.
+    /// </remarks>
+    [Fact]
+    public async Task TheTransfersScreenFitsWithSeveralDeletionsInQuestion()
+    {
+        transfers.IsConnected = true;
+        transfers.RemotePath = "/srv/releases/site/backups/nightly";
+        transfers.PendingRemoteDeletion = new RemoteDeletionRequest(
+        [
+            .. Enumerable.Range(24, 5).Select(day => new RemoteDeletionTarget(
+                $"2026-07-{day}",
+                $"/srv/releases/site/backups/nightly/2026-07-{day}",
+                IsDirectory: true)),
+        ]);
 
         await MeasureTransfersAsync(faults => faults.ShouldBeEmpty());
     }
diff --git a/tests/DodoSSH.Client.App.Tests/FakeSsh.cs b/tests/DodoSSH.Client.App.Tests/FakeSsh.cs
index 6b4178b..50d7620 100644
--- a/tests/DodoSSH.Client.App.Tests/FakeSsh.cs
+++ b/tests/DodoSSH.Client.App.Tests/FakeSsh.cs
@@ -115,6 +115,27 @@ internal sealed class FakeSftpSession(SshConnectionRequest request) : ISftpSessi
     /// <inheritdoc />
     public bool IsConnected { get; private set; } = true;
 
+    /// <inheritdoc />
+    public string? TransportFailure { get; private set; }
+
+    /// <inheritdoc />
+    public event EventHandler? ConnectionLost;
+
+    /// <summary>
+    /// Ends this session the way a rebooted host does: the connection is gone and it says so.
+    /// </summary>
+    /// <remarks>
+    /// Latched before the announcement, which is the ordering the real session promises — a screen reading
+    /// the reason out of the event would see null if a fake did it the other way round.
+    /// </remarks>
+    internal void Drop(string reason)
+    {
+        TransportFailure = reason;
+        IsConnected = false;
+
+        ConnectionLost?.Invoke(this, EventArgs.Empty);
+    }
+
     /// <inheritdoc />
     public HostKeyPresentation HostKey { get; } =
         new(request.Host, request.Port, "ssh-ed25519", "SHA256:fake");
@@ -139,6 +160,35 @@ internal sealed class FakeSftpSession(SshConnectionRequest request) : ISftpSessi
     /// <summary>Every path this session has been asked to delete.</summary>
     internal List<string> Deleted { get; } = [];
 
+    /// <summary>Every mode this session has been asked to set, as it was asked.</summary>
+    /// <remarks>
+    /// The evidence the screen's own status line cannot be: that sentence is code describing itself, and
+    /// what matters is which nine bits actually went to the host.
+    /// </remarks>
+    internal List<(string Path, int Mode)> PermissionsSet { get; } = [];
+
+    /// <summary>Every timestamp this session has been asked to set.</summary>
+    internal List<(string Path, DateTimeOffset When)> TimesSet { get; } = [];
+
+    /// <inheritdoc />
+    public Task SetPermissionsAsync(string path, int mode, CancellationToken cancellationToken)
+    {
+        PermissionsSet.Add((path, mode));
+
+        return Task.CompletedTask;
+    }
+
+    /// <inheritdoc />
+    public Task SetLastWriteTimeAsync(
+        string path,
+        DateTimeOffset lastWriteTimeUtc,
+        CancellationToken cancellationToken)
+    {
+        TimesSet.Add((path, lastWriteTimeUtc));
+
+        return Task.CompletedTask;
+    }
+
     /// <inheritdoc />
     public Task<IReadOnlyList<SftpEntry>> ListAsync(string path, CancellationToken cancellationToken)
     {
@@ -156,21 +206,67 @@ internal sealed class FakeSftpSession(SshConnectionRequest request) : ISftpSessi
         ]);
     }
 
+    /// <summary>
+    /// Paths this session admits to already having, and what it says about each.
+    /// </summary>
+    /// <remarks>
+    /// ◆ Empty by default, and that is load-bearing rather than lazy: the transfer queue asks
+    /// <see cref="StatAsync"/> whether a destination is taken and refuses to overwrite one that is, so a
+    /// fake answering yes for everything would make every upload in this suite fail. What needs a real
+    /// answer is editing, which stats the file before each write-back to see whether it moved — so a test
+    /// about that puts the one path it is about in here.
+    /// </remarks>
+    internal Dictionary<string, SftpEntry> Existing { get; } = new(StringComparer.Ordinal);
+
+    /// <summary>What the last write-back actually sent, so an edit's bytes are observable.</summary>
+    internal byte[]? Written { get; private set; }
+
     /// <inheritdoc />
     public Task<SftpEntry?> StatAsync(string path, CancellationToken cancellationToken) =>
-        Task.FromResult<SftpEntry?>(null);
+        Task.FromResult(Existing.TryGetValue(path, out var entry) ? entry : null);
 
     /// <inheritdoc />
     public Task<Stream> OpenReadAsync(string path, long offset, CancellationToken cancellationToken) =>
         Task.FromResult<Stream>(new MemoryStream("hello there\n"u8.ToArray(), writable: false));
 
     /// <inheritdoc />
+    /// <remarks>
+    /// ◆ A write updates <see cref="Existing"/> only for a path already in it, which is the difference
+    /// between modelling a server and breaking every other test in the suite: the transfer queue writes to
+    /// part files and stats them to decide whether there is anything to resume from, so a fake that
+    /// remembered every write would start answering yes to questions it currently answers no to. What is in
+    /// <see cref="Existing"/> is what a test deliberately put there.
+    /// </remarks>
     public Task<Stream> OpenWriteAsync(string path, long offset, CancellationToken cancellationToken) =>
-        Task.FromResult<Stream>(new MemoryStream());
+        Task.FromResult<Stream>(new RecordingStream(bytes =>
+        {
+            Written = bytes;
+
+            if (Existing.TryGetValue(path, out var before))
+            {
+                Existing[path] = before with
+                {
+                    Length = bytes.Length,
+                    LastWriteTimeUtc = before.LastWriteTimeUtc.AddSeconds(1),
+                };
+            }
+        }));
+
+    /// <summary>Every directory this session was asked to make, in the order it was asked.</summary>
+    /// <remarks>
+    /// The evidence a folder upload actually built the tree before it queued the files. Order matters and is
+    /// asserted on: a parent has to exist before its child is asked for, and shortest-first is what
+    /// guarantees it.
+    /// </remarks>
+    internal List<string> Created { get; } = [];
 
     /// <inheritdoc />
-    public Task CreateDirectoryAsync(string path, CancellationToken cancellationToken) =>
-        Task.CompletedTask;
+    public Task CreateDirectoryAsync(string path, CancellationToken cancellationToken)
+    {
+        Created.Add(path);
+
+        return Task.CompletedTask;
+    }
 
     /// <inheritdoc />
     public Task DeleteAsync(string path, CancellationToken cancellationToken)
@@ -228,6 +324,28 @@ internal sealed class FakeSshConnection(SshConnectionRequest request, List<FakeS
     }
 }
 
+/// <summary>A write stream that hands its contents over when it is closed.</summary>
+/// <remarks>
+/// A <see cref="MemoryStream"/> cannot be read after disposal, and disposal is exactly when a write is
+/// finished — so a fake that handed one back could observe a transfer starting and never what it sent.
+/// </remarks>
+internal sealed class RecordingStream(Action<byte[]> onClosed) : MemoryStream
+{
+    private bool handed;
+
+    /// <inheritdoc />
+    protected override void Dispose(bool disposing)
+    {
+        if (disposing && !handed)
+        {
+            handed = true;
+            onClosed(ToArray());
+        }
+
+        base.Dispose(disposing);
+    }
+}
+
 /// <summary>A shell that is open, silent and closes only when it is told to.</summary>
 /// <remarks>
 /// <see cref="ReadAsync"/> blocks rather than returning 0. Returning 0 means the remote closed the
diff --git a/tests/DodoSSH.Client.App.Tests/ShellFlowTests.cs b/tests/DodoSSH.Client.App.Tests/ShellFlowTests.cs
index 69f3349..f311b37 100644
--- a/tests/DodoSSH.Client.App.Tests/ShellFlowTests.cs
+++ b/tests/DodoSSH.Client.App.Tests/ShellFlowTests.cs
@@ -63,6 +63,24 @@ public sealed class ShellFlowTests : IAsyncLifetime
     /// <summary>When set, resuming throws — how a revoked or rotated-away token is exercised.</summary>
     private Exception? resumeFailure;
 
+    /// <summary>Local paths the fake editor was asked to open, in order.</summary>
+    private readonly List<string> opened = [];
+
+    /// <summary>
+    /// Fires the watcher on the file being edited, as a save would.
+    /// </summary>
+    /// <remarks>
+    /// Null until something is being watched, and null again once the watch is disposed — which is itself
+    /// what says STOP EDITING actually stopped. A fake rather than a real <c>FileSystemWatcher</c> because
+    /// what is being tested is what happens <em>when</em> a save arrives; waiting on a real one would be
+    /// measuring the operating system's notification latency.
+    /// </remarks>
+    private Action? save;
+
+    /// <summary>Serialises posted actions, which is the half of a dispatcher this suite has to supply.</summary>
+    /// <remarks>See the <c>post</c> argument below for what happens without it.</remarks>
+    private readonly Lock posting = new();
+
     private string directory = null!;
     private ClientPaths paths = null!;
     private ClientCacheFactory caches = null!;
@@ -149,9 +167,34 @@ public sealed class ShellFlowTests : IAsyncLifetime
             // Inline, because this suite has no window and therefore no dispatcher to drain — the same
             // answer TransferQueueingTests reached, and for the reason its own remark gives: reaching
             // Dispatcher.UIThread from a test means asserting on a queue owned by whichever class touched
-            // it first. Running the action where it was raised takes the thread out of the question, and
-            // every phase this suite reports is raised on the thread doing the asserting anyway.
-            post: action => action());
+            // it first. Running the action where it was raised takes the thread out of the question.
+            //
+            // ◆ UNDER A LOCK, AND THAT IS NOT BELT AND BRACES. What this delegate stands in for is a
+            // dispatcher, whose defining property is that the actions posted to it do not overlap — and the
+            // view models rely on it: TransfersViewModel.OnTransferChanged looks a transfer up by id and
+            // adds a row when it finds none, which two threads running it at once turn into two rows for
+            // one transfer. Every phase the shell reports is raised on the thread doing the asserting, so
+            // this cost nothing while nothing else went through here; the transfer queue announces from its
+            // own pump thread, and it does.
+            post: action =>
+            {
+                lock (posting)
+                {
+                    action();
+                }
+            },
+
+            openInEditor: path =>
+            {
+                opened.Add(path);
+                return Task.CompletedTask;
+            },
+
+            watchFile: (_, onChanged) =>
+            {
+                save = onChanged;
+                return new StopWatching(() => save = null);
+            });
 
         return ValueTask.CompletedTask;
     }
@@ -1126,6 +1169,689 @@ public sealed class ShellFlowTests : IAsyncLifetime
     // directly beside the pre-existing `RefreshConnectedHosts();` — is covered indirectly: it is the same
     // VaultViewModel.RefreshLastConnectedAsync the activation test above already exercises.
 
+    // ---- Editing a remote file in place ----
+
+    /// <remarks>
+    /// <para>
+    /// ◆ The round trip this replaces is: download, find the file, open it, edit, come back, delete the old
+    /// one because nothing here overwrites, upload, check the mode survived. What it is instead is a copy,
+    /// an editor, and every save going back.
+    /// </para>
+    /// <para>
+    /// <b>The write-back deletes first.</b> <c>OpenWriteAsync</c> at offset zero writes over the beginning
+    /// and leaves any tail that is longer — its own contract says so — which for a config that got shorter
+    /// means a file ending in the back half of its previous version. Asserted here because nothing about
+    /// the bytes that arrive would show it in a test that only edited a file to the same length.
+    /// </para>
+    /// </remarks>
+    [Fact]
+    public async Task EditingARemoteFile_OpensACopyAndSendsEachSaveBack()
+    {
+        var sftpSession = await ConnectedTransfersAsync();
+
+        var row = shell.Transfers.RemoteEntries[0];
+        shell.Transfers.SelectedRemoteEntry = row;
+
+        // The session stats before each write-back to see whether the host's copy moved; this is the fake
+        // agreeing that the file is where the listing said it was.
+        sftpSession.Existing[row.FullPath] = row.Entry;
+
+        shell.Transfers.CanEditRemote.ShouldBeTrue();
+
+        await shell.Transfers.EditRemoteCommand.ExecuteAsync(null);
+
+        var editing = shell.Transfers.RemoteEdit.ShouldNotBeNull();
+
+        editing.RemotePath.ShouldBe(row.FullPath);
+        opened.ShouldHaveSingleItem().ShouldBe(editing.LocalCopy);
+        File.ReadAllText(editing.LocalCopy).ShouldBe("hello there\n", "the host's copy was fetched");
+
+        // Somebody edits and saves.
+        await File.WriteAllTextAsync(editing.LocalCopy, "goodbye\n", Token);
+        save.ShouldNotBeNull().Invoke();
+
+        await EventuallyAsync(
+            () => sftpSession.Written is not null,
+            $"the save should have gone back; log was <{string.Join(" | ", shell.Transfers.RemoteEditLog)}>");
+
+        System.Text.Encoding.UTF8.GetString(sftpSession.Written!).ShouldBe("goodbye\n");
+
+        // Truncated rather than written over, and the mode the listing had put back on afterwards.
+        sftpSession.Deleted.ShouldContain(row.FullPath);
+        sftpSession.PermissionsSet.ShouldHaveSingleItem().Mode.ShouldBe(0b110_100_100);
+
+        shell.Transfers.RemoteEditLog[0].ShouldContain("uploaded");
+
+        // ◆ AND AGAIN, which is the whole point of watching rather than fetching once. The first save moved
+        // the file on the host — the fake tracks that, as a server would — so this second one is a save onto
+        // a file that has changed since the copy was taken, and it must not be reported as somebody else's
+        // change. A version of this that replaced the session record instead of moving its stamp in place
+        // left the watcher holding an instance that was no longer the current one, and every save after the
+        // first quietly did nothing at all.
+        await File.WriteAllTextAsync(editing.LocalCopy, "again!\n", Token);
+        save.ShouldNotBeNull().Invoke();
+
+        await EventuallyAsync(
+            () => System.Text.Encoding.UTF8.GetString(sftpSession.Written!) == "again!\n",
+            $"the second save should have gone back too; log was "
+            + $"<{string.Join(" | ", shell.Transfers.RemoteEditLog)}>");
+
+        shell.Transfers.HasRemoteEditConflict.ShouldBeFalse(
+            "the file changing because of this session's own write is not somebody else's change");
+    }
+
+    /// <remarks>
+    /// ◆ Two people editing one config is how a change gets silently reverted, and a client this thin
+    /// cannot merge. What it can do is notice — a stat before each save, compared against what the server
+    /// said when the copy was taken — and stop, which is the only honest answer available. The three
+    /// buttons on the card are the three things that actually exist: send it anyway, take the host's copy,
+    /// or stop.
+    /// </remarks>
+    [Fact]
+    public async Task ASaveOntoAFileThatMovedOnTheHost_IsRefusedUntilItIsAnswered()
+    {
+        var sftpSession = await ConnectedTransfersAsync();
+
+        var row = shell.Transfers.RemoteEntries[0];
+        shell.Transfers.SelectedRemoteEntry = row;
+        sftpSession.Existing[row.FullPath] = row.Entry;
+
+        await shell.Transfers.EditRemoteCommand.ExecuteAsync(null);
+
+        var editing = shell.Transfers.RemoteEdit.ShouldNotBeNull();
+
+        // Somebody else writes it while it is open.
+        sftpSession.Existing[row.FullPath] = row.Entry with { Length = row.Entry.Length + 40 };
+
+        await File.WriteAllTextAsync(editing.LocalCopy, "mine\n", Token);
+        save.ShouldNotBeNull().Invoke();
+
+        await EventuallyAsync(
+            () => shell.Transfers.HasRemoteEditConflict,
+            "the save should have been stopped rather than written over somebody else's");
+
+        sftpSession.Written.ShouldBeNull("nothing may be written until the question is answered");
+        shell.Transfers.RemoteEditConflict.ShouldContain("changed since you opened it");
+
+        // And UPLOAD ANYWAY is the answer that goes through.
+        await shell.Transfers.ForceSaveEditCommand.ExecuteAsync(null);
+
+        System.Text.Encoding.UTF8.GetString(sftpSession.Written.ShouldNotBeNull()).ShouldBe("mine\n");
+        shell.Transfers.HasRemoteEditConflict.ShouldBeFalse();
+    }
+
+    /// <remarks>
+    /// Stopping has to actually stop: the watch is disposed and the copy this screen made is removed. A
+    /// watcher left running would go on writing somebody's edits to a host after they had said not to,
+    /// which is the worst failure available to this feature.
+    /// </remarks>
+    [Fact]
+    public async Task StopEditing_ReleasesTheWatchAndRemovesTheCopy()
+    {
+        var sftpSession = await ConnectedTransfersAsync();
+
+        var row = shell.Transfers.RemoteEntries[0];
+        shell.Transfers.SelectedRemoteEntry = row;
+        sftpSession.Existing[row.FullPath] = row.Entry;
+
+        await shell.Transfers.EditRemoteCommand.ExecuteAsync(null);
+
+        var editing = shell.Transfers.RemoteEdit.ShouldNotBeNull();
+
+        File.Exists(editing.LocalCopy).ShouldBeTrue();
+
+        await shell.Transfers.StopEditingCommand.ExecuteAsync(null);
+
+        shell.Transfers.IsEditingRemote.ShouldBeFalse();
+        shell.Transfers.RemoteEditLog.ShouldBeEmpty();
+        save.ShouldBeNull("the watch was disposed");
+        File.Exists(editing.LocalCopy).ShouldBeFalse("the copy this screen made goes with the session");
+    }
+
+    // ---- Whole folders ----
+
+    /// <remarks>
+    /// <para>
+    /// ◆ The tree is turned into files before the queue sees it, and the directories it needs are made on
+    /// the host first. That is what keeps every property the queue already had — each file resumable on its
+    /// own, each written to a part file and renamed into place, none able to overwrite anything — while the
+    /// thing being dragged is a folder.
+    /// </para>
+    /// <para>
+    /// <b>Shortest-first is asserted rather than assumed.</b> A child directory asked for before its parent
+    /// exists is a <c>mkdir</c> that fails, and the transfers under it then fail one at a time with a
+    /// message about a path rather than about the folder that was dropped.
+    /// </para>
+    /// </remarks>
+    [Fact]
+    public async Task UploadingAFolder_MakesItsDirectoriesThenQueuesEveryFileUnderIt()
+    {
+        var sftpSession = await ConnectedTransfersAsync();
+
+        var root = Path.Combine(directory, "site");
+        var nested = Path.Combine(root, "assets", "img");
+
+        Directory.CreateDirectory(nested);
+        await File.WriteAllTextAsync(Path.Combine(root, "index.html"), "<!doctype html>", Token);
+        await File.WriteAllTextAsync(Path.Combine(root, "assets", "main.js"), "console.log(1)", Token);
+        await File.WriteAllTextAsync(Path.Combine(nested, "logo.svg"), "<svg/>", Token);
+
+        await shell.Transfers.QueueUploadsAsync([root], Token);
+
+        await EventuallyAsync(
+            () => shell.Transfers.Transfers.Count == 3,
+            $"every file under the folder should be queued; status was <{shell.Transfers.Status}>");
+
+        // Made before anything was queued, parents first.
+        sftpSession.Created.ShouldBe(
+            [
+                "/home/deploy/site",
+                "/home/deploy/site/assets",
+                "/home/deploy/site/assets/img",
+            ],
+            ignoreOrder: false);
+
+        shell.Transfers.Status.ShouldContain("3 files");
+
+        // ◆ And the remote paths are POSIX, whatever this test is running on. A Windows relative path
+        // carried into SftpPath.Combine would have produced one file called `site\assets\main.js` rather
+        // than three directories deep, which is the failure this platform is most likely to ship.
+        var queued = shell.Transfers.Transfers.Select(row => row.Transfer.RemotePath).Order().ToArray();
+
+        queued.ShouldBe(
+            [
+                "/home/deploy/site/assets/img/logo.svg",
+                "/home/deploy/site/assets/main.js",
+                "/home/deploy/site/index.html",
+            ],
+            ignoreOrder: false);
+    }
+
+    /// <remarks>
+    /// The other direction. The walk is a listing per directory, because SFTP has no recursive one — what
+    /// matters here is that the local tree it lands in is made before the transfers are queued into it, and
+    /// that the paths mirror the remote's.
+    /// </remarks>
+    [Fact]
+    public async Task DownloadingAFolder_MakesTheLocalTreeAndQueuesEveryFileUnderIt()
+    {
+        await ConnectedTransfersAsync();
+
+        var into = Path.Combine(directory, "landing");
+        Directory.CreateDirectory(into);
+        shell.Transfers.LocalPath = into;
+
+        // The shell's SFTP fake answers every listing with one file, so a directory row is a tree one deep
+        // — which is enough to say the walk descended and the local folder was made.
+        await shell.Transfers.QueueDownloadsAsync(
+            [new RemoteEntryRowViewModel(new SftpEntry(
+                "logs",
+                "/var/log/app",
+                SftpEntryKind.Directory,
+                0,
+                DateTimeOffset.UnixEpoch,
+                "drwxr-xr-x"))],
+            Token);
+
+        await EventuallyAsync(
+            () => shell.Transfers.Transfers.Count == 1,
+            $"the file under the folder should be queued; status was <{shell.Transfers.Status}>");
+
+        Directory.Exists(Path.Combine(into, "logs"))
+            .ShouldBeTrue("the folder is made here before anything is queued into it");
+
+        shell.Transfers.Transfers[0].Transfer.LocalPath
+            .ShouldBe(Path.Combine(into, "logs", "notes.txt"));
+    }
+
+    /// <remarks>
+    /// ◆ A link is counted and left alone, in both directions and for the same reason: one pointing at an
+    /// ancestor is a walk with no end, and the first anybody would know of it is a queue filling for ever.
+    /// On the remote side there is a second reason — an <c>lstat</c> listing says a name is a link and not
+    /// what it leads to, so descending would be a round trip per entry to find out.
+    /// </remarks>
+    [Fact]
+    public async Task AFolderWalk_CountsLinksRatherThanFollowingThem()
+    {
+        await ConnectedTransfersAsync();
+
+        await shell.Transfers.QueueDownloadsAsync(
+            [new RemoteEntryRowViewModel(new SftpEntry(
+                "current",
+                "/srv/releases/current",
+                SftpEntryKind.SymbolicLink,
+                0,
+                DateTimeOffset.UnixEpoch,
+                "lrwxrwxrwx"))],
+            Token);
+
+        shell.Transfers.Transfers.ShouldBeEmpty();
+        shell.Transfers.Status.ShouldContain("1 link was left alone");
+    }
+
+    // ---- Several rows at once ----
+
+    /// <remarks>
+    /// ◆ The fallback is the half worth guarding. Somebody who clicked a row and pressed DOWNLOAD has
+    /// ticked nothing and means that row — so a multi-select that made the commonest use of this screen
+    /// grow a step would be the usual way one of these makes a tool worse. Both readings are asserted here
+    /// because they are one property with two branches.
+    /// </remarks>
+    [Fact]
+    public async Task ABatchAction_TakesTheTickedRowsOrTheSelectionWhenNothingIsTicked()
+    {
+        await ConnectedTransfersAsync();
+
+        var row = shell.Transfers.RemoteEntries[0];
+
+        // Nothing ticked: the selection is the batch.
+        shell.Transfers.SelectedRemoteEntry = row;
+
+        shell.Transfers.HasCheckedRemote.ShouldBeFalse();
+        shell.Transfers.CheckedRemoteLabel.ShouldBeEmpty();
+        shell.Transfers.RemoteBatch.ShouldHaveSingleItem().ShouldBe(row);
+        shell.Transfers.CanDownload.ShouldBeTrue();
+
+        // Ticked: the ticks win, and the selection stops being what the buttons are about.
+        row.IsChecked = true;
+        shell.Transfers.RemoteChecksChanged();
+
+        shell.Transfers.HasCheckedRemote.ShouldBeTrue();
+        shell.Transfers.CheckedRemoteLabel.ShouldBe("1 selected");
+
+        shell.Transfers.SelectedRemoteEntry = null;
+        shell.Transfers.RemoteBatch.ShouldHaveSingleItem().ShouldBe(row, "a tick survives the highlight moving");
+    }
+
+    /// <remarks>
+    /// <para>
+    /// A ticked set is one act — these files, into that directory — so the boxes are released once it has
+    /// been queued. Leaving them ticked is how the next press sends everything a second time.
+    /// </para>
+    /// <para>
+    /// The queue is what counts and reports what it skipped, which is why a directory among the ticks does
+    /// not stop the files going: see QueueDownloads and the sentence it builds.
+    /// </para>
+    /// </remarks>
+    [Fact]
+    public async Task DownloadingATickedSet_QueuesEachFileAndReleasesTheTicks()
+    {
+        await ConnectedTransfersAsync();
+
+        // One listing row is all the shell fake offers, so a second is made by navigating: the rows are
+        // rebuilt per directory and the ticks go with them, which is itself the behaviour being relied on.
+        var first = shell.Transfers.RemoteEntries[0];
+        first.IsChecked = true;
+        shell.Transfers.RemoteChecksChanged();
+
+        shell.Transfers.CanDownload.ShouldBeTrue();
+
+        shell.Transfers.DownloadCommand.Execute(null);
+
+        // Waited for rather than read straight away: the queue announces from its own pump thread, so the
+        // row appears a moment after the command returns.
+        await EventuallyAsync(
+            () => shell.Transfers.Transfers.Count == 1,
+            "the ticked file should have become exactly one queue row");
+
+        shell.Transfers.Transfers[0].Name.ShouldBe(first.Name);
+        shell.Transfers.HasCheckedRemote.ShouldBeFalse("a queued set releases its ticks");
+        first.IsChecked.ShouldBeFalse();
+    }
+
+    /// <remarks>
+    /// ◆ Deleting is the one act on this screen that nothing walks back, so a batch of them has to name
+    /// every path rather than a count — agreeing to "3 items" is agreeing to a number. And each goes on its
+    /// own: the host refuses a directory that still has something in it, and in a set of five that must not
+    /// silently cancel the four it would have removed, nor hide which ones it did not.
+    /// </remarks>
+    [Fact]
+    public async Task DeletingATickedSet_NamesEveryPathAndKeepsGoingPastARefusal()
+    {
+        var sftpSession = await ConnectedTransfersAsync();
+
+        var row = shell.Transfers.RemoteEntries[0];
+        row.IsChecked = true;
+        shell.Transfers.RemoteChecksChanged();
+
+        shell.Transfers.DeleteRemoteCommand.Execute(null);
+
+        var question = shell.Transfers.PendingRemoteDeletion.ShouldNotBeNull();
+
+        question.Count.ShouldBe(1);
+        question.IsSingle.ShouldBeTrue();
+        question.Listing.ShouldBe(row.FullPath, "the path is what makes the question answerable");
+
+        await shell.Transfers.ConfirmDeleteRemoteCommand.ExecuteAsync(null);
+
+        sftpSession.Deleted.ShouldHaveSingleItem().ShouldBe(row.FullPath);
+        shell.Transfers.Status.ShouldBe("Deleted 1 item.");
+        shell.Transfers.HasCheckedRemote.ShouldBeFalse();
+    }
+
+    /// <remarks>
+    /// One gesture for both directions, because from the user's side "select all" and "select none" are the
+    /// same act — they look at the boxes and want the other state.
+    /// </remarks>
+    [Fact]
+    public async Task SelectAll_TicksEverythingAndThenUnticksIt()
+    {
+        await ConnectedTransfersAsync();
+
+        shell.Transfers.ToggleAllRemoteCommand.Execute(null);
+
+        shell.Transfers.CheckedRemoteCount.ShouldBe(shell.Transfers.RemoteEntries.Count);
+        shell.Transfers.RemoteEntries.ShouldAllBe(row => row.IsChecked);
+
+        shell.Transfers.ToggleAllRemoteCommand.Execute(null);
+
+        shell.Transfers.CheckedRemoteCount.ShouldBe(0);
+        shell.Transfers.RemoteEntries.ShouldAllBe(row => !row.IsChecked);
+    }
+
+    // ---- Permissions: the PERMS column stops being read-only ----
+
+    /// <remarks>
+    /// <para>
+    /// ◆ The whole point of the form: what reaches the host is the nine bits that were ticked, not the
+    /// sentence the screen writes about itself afterwards. It is asserted as a literal — <c>-rw-r--r--</c>
+    /// with the owner's execute bit added is <c>0744</c>, which is close enough to the <c>0755</c> everybody
+    /// reaches for that a test agreeing with the code's own arithmetic would agree with it being wrong.
+    /// </para>
+    /// <para>
+    /// The listing is re-read afterwards, and that is not tidiness. A umask, an ACL or a filesystem mounted
+    /// without permissions can all land somewhere other than what was asked for, and the server is the only
+    /// thing that knows which — so the column goes back to being a fact rather than a hope.
+    /// </para>
+    /// </remarks>
+    [Fact]
+    public async Task ChangingPermissions_SendsTheBitsThatWereTickedAndRereadsTheListing()
+    {
+        var sftpSession = await ConnectedTransfersAsync();
+
+        shell.Transfers.SelectedRemoteEntry = shell.Transfers.RemoteEntries[0];
+
+        shell.Transfers.ChangeRemotePermissionsCommand.Execute(null);
+
+        var form = shell.Transfers.PendingRemotePermissions.ShouldNotBeNull();
+
+        // The form opens on the mode the listing already had, rather than on a fresh stat or on nothing.
+        form.OwnerRead.ShouldBeTrue();
+        form.OwnerExecute.ShouldBeFalse();
+        form.Preview.ShouldBe("-rw-r--r--   (0644)");
+        form.HasChanges.ShouldBeFalse("nothing has been touched yet");
+
+        form.OwnerExecute = true;
+
+        form.HasChanges.ShouldBeTrue();
+        form.Preview.ShouldBe("-rwxr--r--   (0744)");
+
+        var listedBefore = sftpSession.Listed.Count;
+
+        await shell.Transfers.ConfirmRemotePermissionsCommand.ExecuteAsync(null);
+
+        var sent = sftpSession.PermissionsSet.ShouldHaveSingleItem();
+
+        sent.Path.ShouldBe(shell.Transfers.RemoteEntries[0].FullPath);
+        sent.Mode.ShouldBe(0b111_100_100);
+
+        shell.Transfers.PendingRemotePermissions.ShouldBeNull("the form closes on success");
+        sftpSession.Listed.Count.ShouldBeGreaterThan(listedBefore, "the column it changed is re-read");
+    }
+
+    /// <remarks>
+    /// The three questions this pane can ask are one at a time by construction, and each one's own opening
+    /// is what clears the others. Worth a test because the guard is three assignments in three methods
+    /// rather than one piece of shared state, so a fourth question added later has three places to remember.
+    /// </remarks>
+    [Fact]
+    public async Task OpeningThePermissionsForm_TakesAwayWhicheverQuestionWasAlreadyUp()
+    {
+        await ConnectedTransfersAsync();
+
+        shell.Transfers.SelectedRemoteEntry = shell.Transfers.RemoteEntries[0];
+
+        shell.Transfers.DeleteRemoteCommand.Execute(null);
+        shell.Transfers.IsConfirmingRemoteDeletion.ShouldBeTrue();
+
+        shell.Transfers.ChangeRemotePermissionsCommand.Execute(null);
+
+        shell.Transfers.IsConfirmingRemoteDeletion.ShouldBeFalse();
+        shell.Transfers.IsChangingRemotePermissions.ShouldBeTrue();
+        shell.Transfers.IsAskingAboutRemoteEntry.ShouldBeTrue();
+
+        // And back the other way, so the clearing is not one-directional.
+        shell.Transfers.RenameRemoteCommand.Execute(null);
+
+        shell.Transfers.IsChangingRemotePermissions.ShouldBeFalse();
+        shell.Transfers.IsMovingRemote.ShouldBeTrue();
+    }
+
+    /// <remarks>
+    /// An object is governed by an access policy rather than nine bits, so the button is dark on that
+    /// destination rather than live and answered with a refusal from the store. The other three item actions
+    /// stay live, which is the half that says this is a considered difference rather than the whole row
+    /// being switched off.
+    /// </remarks>
+    [Fact]
+    public async Task ABucket_IsNotOfferedPermissions()
+    {
+        var vault = await ReadyToConnectAsync();
+
+        shell.Transfers.Attach(vault, knownHosts, buckets: new FakeObjectStoreFactory());
+
+        vault.NewObjectStoreCommand.Execute(null);
+        vault.BucketEditorLabel = "Backups";
+        vault.BucketEditorBucket = "backups";
+        vault.BucketEditorAccessKeyId = "AKIAEXAMPLE";
+        vault.BucketEditorSecretAccessKey = "a-secret-access-key";
+        vault.BucketEditorRegion = "eu-west-1";
+        await vault.SaveObjectStoreCommand.ExecuteAsync(null);
+
+        shell.Transfers.Remote = RemoteKind.Bucket;
+        shell.Transfers.SelectedBucket = shell.Transfers.Buckets[0];
+
+        await shell.Transfers.ConnectCommand.ExecuteAsync(null);
+
+        shell.Transfers.IsConnected.ShouldBeTrue(shell.Transfers.Status);
+
+        shell.Transfers.CanChangeRemotePermissions.ShouldBeFalse();
+        shell.Transfers.CanDeleteRemote.ShouldBeTrue("the other three are unaffected");
+    }
+
+    /// <remarks>
+    /// ◆ The reason "keep mode and mtime" is worth having at all: an uploaded <c>deploy.sh</c> that lands
+    /// with the server's umask on it is the thing that makes people open a terminal straight after using
+    /// this screen. What can be carried depends on the platform the file came from — a mode is not a fact
+    /// about a file on Windows — so this asserts the timestamp, which every platform has, and that a mode is
+    /// sent exactly when the local filesystem had one to send.
+    /// </remarks>
+    [Fact]
+    public async Task AnUpload_CarriesTheSourcesTimestampAndItsModeWhereThereIsOne()
+    {
+        var sftpSession = await ConnectedTransfersAsync();
+
+        var source = Path.Combine(directory, "deploy.sh");
+        await File.WriteAllTextAsync(source, "#!/bin/sh\necho hello\n", Token);
+
+        var written = new DateTimeOffset(2026, 3, 14, 9, 26, 53, TimeSpan.Zero);
+        File.SetLastWriteTimeUtc(source, written.UtcDateTime);
+
+        shell.Transfers.QueueUploads([source]);
+
+        await EventuallyAsync(
+            () => sftpSession.TimesSet.Count > 0,
+            "the upload should have set the destination's timestamp");
+
+        var stamped = sftpSession.TimesSet.ShouldHaveSingleItem();
+
+        stamped.Path.ShouldEndWith("deploy.sh");
+        stamped.When.ShouldBe(written);
+
+        if (OperatingSystem.IsWindows())
+        {
+            sftpSession.PermissionsSet.ShouldBeEmpty(
+                "a file on Windows has no POSIX mode, and inventing one would be this client deciding it");
+        }
+        else
+        {
+            sftpSession.PermissionsSet.ShouldHaveSingleItem().Path.ShouldEndWith("deploy.sh");
+        }
+    }
+
+    // ---- A file session that stops, and the way back into the directory it was showing ----
+
+    /// <remarks>
+    /// <para>
+    /// ◆ The same defect the terminal had, on the other surface: nothing noticed. IsConnected was set at
+    /// connect and cleared only by the DISCONNECT button, so a host that went away left this screen saying
+    /// CONNECTED over a session that was gone, and every action after it failed with the same server message
+    /// and no explanation of why they all did.
+    /// </para>
+    /// <para>
+    /// <b>The listing deliberately stays.</b> SftpEntry is a record of what the server said rather than a
+    /// handle on anything, so the pane can go on showing where the user was — which is the whole of what
+    /// makes the reconnect below worth offering rather than merely correct.
+    /// </para>
+    /// </remarks>
+    [Fact]
+    public async Task AFileSessionWhoseConnectionBreaks_SaysSoAndKeepsWhereItWas()
+    {
+        var sftpSession = await ConnectedTransfersAsync();
+
+        shell.ShowFilesCommand.Execute(RemoteKind.Host);
+
+        shell.Transfers.IsConnected.ShouldBeTrue();
+        shell.IsSessionConnected.ShouldBeTrue();
+
+        var showing = shell.Transfers.RemotePath;
+
+        sftpSession.Drop("An established connection was aborted by the server.");
+
+        shell.Transfers.IsConnected.ShouldBeFalse();
+        shell.Transfers.IsConnectionLost.ShouldBeTrue();
+        shell.Transfers.LostConnection.ShouldBe("An established connection was aborted by the server.");
+
+        // Where they were, still on screen and still named.
+        shell.Transfers.RemotePath.ShouldBe(showing);
+        shell.Transfers.RemoteEntries.ShouldNotBeEmpty("the listing outlives the session it came from");
+
+        // And the status bar says which of the two states this is, rather than collapsing to nothing.
+        shell.SessionEndedText.ShouldBe("DISCONNECTED");
+        shell.SessionEndedDetail.ShouldBe("An established connection was aborted by the server.");
+        shell.IsSessionDropped.ShouldBeTrue();
+        shell.SessionAddress.ShouldNotBeNull("there is still a host worth naming");
+        shell.CanReconnectSession.ShouldBeTrue();
+        shell.SessionEndedDismissLabel.ShouldBe("DISCONNECT");
+    }
+
+    /// <remarks>
+    /// The half that makes the button worth having. A reconnect that landed in the home directory would
+    /// leave somebody five levels deep in a deployment tree to walk back down it, so the path is captured at
+    /// connect and restored afterwards — and the dial itself goes through the ordinary connect path, so the
+    /// host key gate and the log entry are the ones every other connection gets.
+    /// </remarks>
+    [Fact]
+    public async Task ReconnectingALostFileSession_DialsAgainAndGoesBackToTheDirectoryItWasShowing()
+    {
+        var vault = await ReadyToConnectAsync();
+
+        // Bound to a key, which is what lets this host be redialled with nobody present. One that wants a
+        // password typed is asked for it again instead, and has a test of its own below.
+        await AddKeyAsync(vault, "deploy");
+        await BindKeyAsync(vault, vault.Hosts[0], vault.Keys[0].EntityId);
+
+        shell.Transfers.Attach(vault, knownHosts);
+        shell.Transfers.SelectedHost = shell.Transfers.Hosts[0];
+
+        await shell.Transfers.ConnectCommand.ExecuteAsync(null);
+        shell.Transfers.IsConnected.ShouldBeTrue(shell.Transfers.Status);
+
+        var sftpSession = ssh.OpenedSftp.ShouldNotBeNull();
+
+        shell.ShowFilesCommand.Execute(RemoteKind.Host);
+
+        await shell.Transfers.GoRemoteCommand.ExecuteAsync("/home/dodo/deploy");
+
+        var showing = shell.Transfers.RemotePath;
+        showing.ShouldBe("/home/dodo/deploy");
+
+        sftpSession.Drop("An established connection was aborted by the server.");
+
+        await shell.ReconnectSessionCommand.ExecuteAsync(null);
+
+        shell.Transfers.IsConnected.ShouldBeTrue(shell.Transfers.Status);
+        shell.Transfers.IsConnectionLost.ShouldBeFalse();
+        shell.Transfers.RemotePath.ShouldBe(showing, "a reconnect puts them back where they were");
+
+        shell.SessionEndedText.ShouldBeNull();
+        ssh.SftpRequests.Count.ShouldBe(2, "the ordinary connect path was used, not a second one");
+
+        // A second, separate session — the first one is gone, not resumed.
+        ssh.OpenedSftp.ShouldNotBeNull().ShouldNotBe(sftpSession);
+    }
+
+    /// <remarks>
+    /// A host that wants a password typed cannot be redialled on its own: the box is cleared the moment a
+    /// connection succeeds and nothing keeps it, so dialling with an empty one would be an authentication
+    /// failure wearing the word RECONNECT. The picker comes back up with the host already chosen, which is
+    /// as far as this can honestly get by itself — and the pane keeps its listing, so the button is still
+    /// there once the password is in.
+    /// </remarks>
+    [Fact]
+    public async Task ReconnectingAFileSessionOnAPasswordHost_AsksForOneRatherThanDiallingWithout()
+    {
+        var sftpSession = await ConnectedTransfersAsync();
+
+        shell.ShowFilesCommand.Execute(RemoteKind.Host);
+
+        sftpSession.Drop("An established connection was aborted by the server.");
+
+        await shell.ReconnectSessionCommand.ExecuteAsync(null);
+
+        shell.Transfers.IsChoosingRemote.ShouldBeTrue();
+        shell.Transfers.Status.ShouldContain("asks for a password");
+
+        ssh.SftpRequests.ShouldHaveSingleItem("nothing should have been dialled without the password");
+        shell.Transfers.RemoteEntries.ShouldNotBeEmpty("the listing is still there to come back to");
+    }
+
+    /// <remarks>
+    /// A bucket has no connection to lose — it is HTTPS per request — so it never reaches the lost state at
+    /// all, and the strip that offers a reconnect stays away. Asserted because the store interface carries
+    /// the two members regardless, and an implementation that raised them would put a DISCONNECTED strip
+    /// over a screen whose next request would have worked perfectly well.
+    /// </remarks>
+    [Fact]
+    public async Task ABucket_NeverReportsALostConnection()
+    {
+        var vault = await ReadyToConnectAsync();
+
+        shell.Transfers.Attach(vault, knownHosts, buckets: new FakeObjectStoreFactory());
+
+        vault.NewObjectStoreCommand.Execute(null);
+        vault.BucketEditorLabel = "Backups";
+        vault.BucketEditorBucket = "backups";
+        vault.BucketEditorAccessKeyId = "AKIAEXAMPLE";
+        vault.BucketEditorSecretAccessKey = "a-secret-access-key";
+        vault.BucketEditorRegion = "eu-west-1";
+        await vault.SaveObjectStoreCommand.ExecuteAsync(null);
+
+        // Remote is what ConnectAsync branches on; Attach has already auto-selected the host the fixture
+        // left in the picker.
+        shell.Transfers.Remote = RemoteKind.Bucket;
+        shell.Transfers.SelectedBucket = shell.Transfers.Buckets[0];
+
+        await shell.Transfers.ConnectCommand.ExecuteAsync(null);
+
+        shell.Transfers.ConnectedTo.ShouldBe("s3://backups");
+        shell.Transfers.IsConnected.ShouldBeTrue(shell.Transfers.Status);
+        shell.Transfers.IsConnectionLost.ShouldBeFalse();
+
+        shell.ShowFilesCommand.Execute(RemoteKind.Bucket);
+        shell.SessionEndedText.ShouldBeNull("a bucket has no connection to report the loss of");
+    }
+
     // ---- A session that stops: the status it gets, and the way back ----
 
     /// <remarks>
@@ -9125,6 +9851,13 @@ public sealed class ShellFlowTests : IAsyncLifetime
     {
         public bool IsConnected => true;
 
+        /// <remarks>Null, and never raised: a bucket has no connection to lose. See <c>S3FileStore</c>.</remarks>
+        public string? TransportFailure => null;
+
+#pragma warning disable CS0067 // The event is never used
+        public event EventHandler? ConnectionLost;
+#pragma warning restore CS0067
+
         public string HomeDirectory => "/";
 
         public Task<IReadOnlyList<SftpEntry>> ListAsync(string path, CancellationToken cancellationToken) =>
@@ -9133,6 +9866,17 @@ public sealed class ShellFlowTests : IAsyncLifetime
         public Task<SftpEntry?> StatAsync(string path, CancellationToken cancellationToken) =>
             Task.FromResult<SftpEntry?>(null);
 
+        /// <remarks>Refused, as S3FileStore refuses it: an object has an access policy rather than a mode.</remarks>
+        public Task SetPermissionsAsync(string path, int mode, CancellationToken cancellationToken) =>
+            throw new SftpPathException(path, "An object in a bucket has no POSIX mode.");
+
+        /// <inheritdoc cref="SetPermissionsAsync" />
+        public Task SetLastWriteTimeAsync(
+            string path,
+            DateTimeOffset lastWriteTimeUtc,
+            CancellationToken cancellationToken) =>
+            throw new SftpPathException(path, "An object's timestamp is when the bucket stored it.");
+
         public Task<Stream> OpenReadAsync(string path, long offset, CancellationToken cancellationToken) =>
             throw new NotSupportedException("Not exercised by proving a bucket connect leaves no pins.");
 
@@ -9634,6 +10378,12 @@ public sealed class ShellFlowTests : IAsyncLifetime
         shell.Issuer.ShouldBe("https://idp.example/realms/dodossh");
     }
 
+    /// <summary>What the fake watcher hands back, so disposing it is observable.</summary>
+    private sealed class StopWatching(Action onDisposed) : IDisposable
+    {
+        public void Dispose() => onDisposed();
+    }
+
     /// <summary>An unlocked vault with one selected host and a renderer attached.</summary>
     private async Task<VaultViewModel> ReadyToConnectAsync()
     {
diff --git a/tests/DodoSSH.Client.App.Tests/TransferQueueingTests.cs b/tests/DodoSSH.Client.App.Tests/TransferQueueingTests.cs
index cea5ce7..3e79f53 100644
--- a/tests/DodoSSH.Client.App.Tests/TransferQueueingTests.cs
+++ b/tests/DodoSSH.Client.App.Tests/TransferQueueingTests.cs
@@ -91,25 +91,6 @@ public sealed class TransferQueueingTests : IDisposable
         transfers.Status.ShouldContain("/srv/app");
     }
 
-    /// <remarks>
-    /// The queue moves files. There is no recursive upload, and a folder dragged in and silently ignored
-    /// looks exactly like a transfer that failed to start — so it is counted and reported.
-    /// </remarks>
-    [Fact]
-    public void DroppingAFolderAmongFiles_SkipsItAndSaysSo()
-    {
-        Connected();
-
-        var folder = Path.Combine(directory, "a-folder");
-        Directory.CreateDirectory(folder);
-
-        transfers.QueueUploads([File("one.txt"), folder]);
-
-        Queued().ShouldHaveSingleItem();
-        transfers.Status.ShouldContain("1 file");
-        transfers.Status.ShouldContain("1 folder was skipped");
-    }
-
     /// <remarks>
     /// The paths in an operating-system drop come from another process and are not obliged to still be
     /// right by the time the drop lands.
@@ -125,21 +106,6 @@ public sealed class TransferQueueingTests : IDisposable
         transfers.Status.ShouldContain("1 item was no longer there");
     }
 
-    [Fact]
-    public void DroppingOnlyFolders_QueuesNothingAndDoesNotClaimOtherwise()
-    {
-        Connected();
-
-        var folder = Path.Combine(directory, "a-folder");
-        Directory.CreateDirectory(folder);
-
-        transfers.QueueUploads([folder]);
-
-        Queued().ShouldBeEmpty();
-        transfers.Status.ShouldContain("Nothing was queued");
-        transfers.Status.ShouldContain("1 folder was skipped");
-    }
-
     [Fact]
     public void DroppingRemoteRowsOnTheLocalPane_QueuesDownloads()
     {
@@ -152,21 +118,18 @@ public sealed class TransferQueueingTests : IDisposable
         transfers.Status.ShouldContain("download into");
     }
 
-    [Fact]
-    public void DroppingARemoteDirectory_SkipsItAndSaysSo()
-    {
-        Connected();
-
-        transfers.QueueDownloads([RemoteFile("one.log"), RemoteDirectory("logs")]);
-
-        Queued().ShouldHaveSingleItem();
-        transfers.Status.ShouldContain("1 folder was skipped");
-    }
-
     /// <remarks>
+    /// <para>
     /// The buttons were the only way to queue anything before drag and drop, and they now go through the
     /// same two methods — so there is one set of rules rather than two that have to agree. This is what
     /// says they still do.
+    /// </para>
+    /// <para>
+    /// Files only, since folders stopped being skipped: walking one needs a session to list and to make
+    /// directories on, and this fixture deliberately has none — everything here is about what may be
+    /// queued, which needs no server. The recursive half is exercised in <c>ShellFlowTests</c>, against the
+    /// SFTP fake that a real connect produces.
+    /// </para>
     /// </remarks>
     [Fact]
     public void TheDownloadButton_GoesThroughTheSamePathAsADrop()
@@ -177,13 +140,7 @@ public sealed class TransferQueueingTests : IDisposable
         transfers.DownloadCommand.Execute(null);
 
         Queued().ShouldHaveSingleItem();
-
-        // And refuses a directory in the same words, rather than with the button's own message.
-        transfers.SelectedRemoteEntry = RemoteDirectory("logs");
-        transfers.DownloadCommand.Execute(null);
-
-        Queued().Count.ShouldBe(1);
-        transfers.Status.ShouldContain("1 folder was skipped");
+        transfers.Status.ShouldContain("download into");
     }
 
     /// <remarks>
@@ -229,14 +186,11 @@ public sealed class TransferQueueingTests : IDisposable
     {
         Connected();
 
-        var folder = Path.Combine(directory, "a-folder");
-        Directory.CreateDirectory(folder);
-
-        transfers.QueueStagedUploads([File("picked.txt"), folder]);
+        transfers.QueueStagedUploads([File("picked.txt"), Path.Combine(directory, "never-existed.txt")]);
 
         Queued().ShouldHaveSingleItem();
         transfers.Status.ShouldContain("1 file");
-        transfers.Status.ShouldContain("1 folder was skipped");
+        transfers.Status.ShouldContain("1 item was no longer there");
     }
 
     /// <remarks>
diff --git a/tests/DodoSSH.Client.Transfer.Tests/FakeSftpSession.cs b/tests/DodoSSH.Client.Transfer.Tests/FakeSftpSession.cs
index b54292e..8134da3 100644
--- a/tests/DodoSSH.Client.Transfer.Tests/FakeSftpSession.cs
+++ b/tests/DodoSSH.Client.Transfer.Tests/FakeSftpSession.cs
@@ -20,6 +20,63 @@ internal sealed class FakeSftpSession : ISftpSession
     /// <inheritdoc />
     public bool IsConnected => true;
 
+    /// <inheritdoc />
+    /// <remarks>
+    /// Null, and the event below is never raised: this fake breaks reads rather than connections — see
+    /// <see cref="FailReadAfter"/> — because what the queue has to get right is a transfer that stops
+    /// halfway, which is the same shape whichever caused it.
+    /// </remarks>
+    public string? TransportFailure => null;
+
+    /// <inheritdoc />
+#pragma warning disable CS0067 // The event is never used
+    public event EventHandler? ConnectionLost;
+#pragma warning restore CS0067
+
+    /// <summary>Modes this session was asked to set, in order, so preservation is observable.</summary>
+    public List<(string Path, int Mode)> PermissionsSet { get; } = [];
+
+    /// <summary>Timestamps this session was asked to set, in order.</summary>
+    public List<(string Path, DateTimeOffset When)> TimesSet { get; } = [];
+
+    /// <summary>Set to make both setters refuse, which is what a server that will not do SETSTAT looks like.</summary>
+    public bool RefuseAttributes { get; set; }
+
+    /// <inheritdoc />
+    public Task SetPermissionsAsync(string path, int mode, CancellationToken cancellationToken)
+    {
+        if (RefuseAttributes)
+        {
+            throw new SftpPathException(path, "This server will not set a mode.");
+        }
+
+        lock (gate)
+        {
+            PermissionsSet.Add((path, mode));
+        }
+
+        return Task.CompletedTask;
+    }
+
+    /// <inheritdoc />
+    public Task SetLastWriteTimeAsync(
+        string path,
+        DateTimeOffset lastWriteTimeUtc,
+        CancellationToken cancellationToken)
+    {
+        if (RefuseAttributes)
+        {
+            throw new SftpPathException(path, "This server will not set a timestamp.");
+        }
+
+        lock (gate)
+        {
+            TimesSet.Add((path, lastWriteTimeUtc));
+        }
+
+        return Task.CompletedTask;
+    }
+
     /// <inheritdoc />
     public HostKeyPresentation HostKey { get; } = new("host.internal", 22, "ssh-ed25519", "SHA256:fake");