Notice when a file session stops, and give the file browser the four things it was short of

The commit before this one taught a terminal to notice its machine going away.
The file browser had the same defect and three of the same symptoms, and it is
also the screen people leave soonest — so the disconnect work and four things it
was missing arrive together, because they are the same complaint: this screen
knows less about the host than the host does.

◆ THE DISCONNECT HALF, WHICH IS THE OTHER SURFACE OF THE LAST COMMIT.

IsConnected was set at connect and cleared only by the DISCONNECT button. A host
that went away therefore left this screen saying CONNECTED over a session that
was gone, and every action after it failing with the same server message and
nothing saying why they all did.

IRemoteFileStore now carries a latched TransportFailure and a ConnectionLost
event. The latch is the shell's own — read ISshShellSession.TransportFailure for
the argument, which is unchanged. The event is not, and it is the part this
surface needs: a file browser is idle between operations, so without something
raised at the moment the transport fails, nobody finds out until they click. A
bucket implements both and raises neither, which is honest rather than a gap:
S3 is request-per-operation with no connection to lose.

  - THE LISTING STAYS ON SCREEN, and that is the half that makes the rest worth
    having. SftpEntry is a record of what the server said rather than a handle,
    so the pane can go on showing where the user was — which is what RECONNECT
    is offering to put them back into. That needed a new ShowsRemoteContents on
    both heads: every "is there anything here" binding read IsConnected, which
    was right while the only way to stop being connected was to press a button
    that empties the pane, and wrong the moment a session could be lost.

  - RECONNECT re-dials through the ordinary connect path — same host key gate,
    same refusals, same log entry — and then walks back to the directory the
    pane was showing. The path is read off RemotePath rather than captured,
    because the pane already keeps it up to date and a copy is a second thing to
    get wrong. A host wanting a typed password is asked for one rather than
    dialled with an empty box.

  - SessionEndedBar is now one control on both surfaces, with the shell
    resolving which it is drawn over: a terminal has two endings to tell apart
    and a keychain entry to check, a file session has one ending and already
    captured what it would dial. The phone's Files screen has its own copy,
    bound to TransfersViewModel directly, because its DataContext is that rather
    than the shell.

◆ PERMISSIONS: THE PERMS COLUMN STOPS BEING READ-ONLY.

It has been a true fact about a file with nothing to be done about it since it
arrived, and the commonest next act after using this screen was opening a
terminal — a whole second authenticated connection — to chmod what had just been
uploaded.

Nine checkboxes rather than a box to type 755 into, because the mode is already
drawn as -rwxr-xr-x in the column the form was opened from: a who-can-do-what
grid is the same representation the reader is holding, where an octal field asks
them to translate something they can see into something they cannot check. The
octal is printed underneath as it changes, so the two readings check each other.
The EXEC column is headed "enter" over a directory, which is what that bit means
there and the commonest misreading of a POSIX mode. The listing is re-read after
APPLY, because a umask, an ACL or a filesystem mounted without permissions can
all land somewhere other than what was asked for.

Beside it, mode and mtime carried across a transfer — which is what makes an
uploaded deploy.sh arrive executable instead of with the server's umask on it.
THE MODE IS ONLY SENT FROM A PLATFORM THAT HAS ONE. A file on Windows has no
POSIX mode; this screen already says so by leaving the local pane's PERMS column
empty rather than filling it with a plausible -rw-r--r--, and inventing 0644, or
0755 for anything called .sh, would be this client deciding a fact about
somebody's file that nothing on the machine it came from ever said. The
timestamp goes either way, because every platform has one. A store with neither
refuses in its own words and is never asked.

◆ MULTI-SELECT: A TICK IS NOT THE LIST'S SELECTION.

The two answer different questions and the split is the whole design. The
selection is "the row I am looking at", which rename, move and permissions act
on — each takes a form naming one path and is one-at-a-time by construction. The
tick is "the rows I have gathered up", which download, upload and delete take,
and it survives the highlight moving.

With nothing ticked the batch falls back to the selection, which is what keeps
the commonest use of this screen from growing a step — the usual way a
multi-select makes a tool worse. Ticks are released once a set is queued, or a
second press sends everything again.

Deleting several names every path rather than a count, because agreeing to "3
items" is agreeing to a number, and this is the one act on this screen that
nothing walks back. Each goes on its own and a refusal does not stop the rest:
the host turns down a directory that still has something in it, and in a set of
five that must not silently cancel the four it would have removed — nor hide
which ones it did not.

A drawn checkbox rather than ctrl-click, and not for taste: the phone shares
this view model and has neither ctrl nor shift, so a multi-selection has to be a
tap target there whatever the desktop does. One shape on both heads, and a state
somebody can see.

◆ RECURSIVE FOLDERS: THE TREE BECOMES FILES BEFORE THE QUEUE SEES IT.

A directory used to be counted and skipped. It is now walked, and the queue
still knows nothing about trees — which is what keeps every property it has:
each file resumable on its own, each written to a part file and renamed into
place, none able to overwrite anything already there.

The plan is collected whole and then queued, because directories have to exist
before the files that go in them and shortest-first is the only order that
guarantees a parent before its child. It also means a walk refused halfway has
queued nothing yet, so the sentence it produces describes one outcome rather
than an outcome and a queue that half happened.

Links are counted, not followed, in both directions. One pointing at an ancestor
is a walk with no end, and on the remote side there is a second reason: an lstat
listing says a name is a link and not what it leads to, so descending would be a
round trip per entry to find out. Locally that is AttributesToSkip on the one
enumeration that decides what to descend into. A 5000-file ceiling is a backstop
for the accidental drag of a home directory, and it says so rather than
truncating quietly.

The status line grew four more ways to be partly what was asked for, and states
each: gone, refused, left alone, not a file.

◆ EDITING IN PLACE: FETCH, OPEN, WATCH, PUSH BACK.

The round trip this replaces is download, find it, open it, edit, come back,
delete the old one because nothing here overwrites, upload, check the mode
survived.

DELIBERATELY NOT THROUGH THE TRANSFER QUEUE, in either direction. The queue
refuses to overwrite, which is the right rule for a file somebody dragged and
exactly the wrong one for a file they are editing, where replacing the original
is the entire intent. The write-back deletes first: OpenWriteAsync at offset
zero writes over the beginning and leaves any tail that is longer — its own
contract says so — which for a config that got shorter means a file ending in
the back half of its previous version. Deleting is the only truncation this
interface offers, and the mode goes back on afterwards because deleting took it.

A stat before every save, compared against what the server said when the copy
was taken, catches somebody else writing while the file is open — which is how a
config gets silently reverted. There is no merge and no button pretending
otherwise; the three answers offered are the three that exist. Length and
timestamp rather than a digest, because a digest is a second full read of a file
there is otherwise no reason to fetch.

Both platform halves are injected: what opens a .conf is a registry
association, a desktop entry or a Launch Services binding depending on the
desktop, and watching a file is a platform object with its own thread. The
watcher watches the directory and filters the name, because a great many editors
write a temporary file and rename it over the top — which to a watcher pointed
at an inode is the file disappearing. The phone gets neither delegate, so the
button is not live there rather than there and disappointing.

◆ TWO THINGS FOUND ON THE WAY, BOTH WORTH STATING.

The shell suite's inline `post` was not serialising the way a dispatcher does.
Routing TransfersViewModel through it exposed a check-then-add in
OnTransferChanged that two threads turn into two rows for one transfer. Harmless
in production, where the UI thread serialises — the fixture was under-specifying
what it stood in for, and now posts under a lock.

And the edit session replaced its own record with `with` on each save, which
left the watcher holding an instance that was no longer the current one: every
save after the first quietly did nothing. The stamp moves in place now, and the
test saves twice.

◆ WHAT IS VERIFIED.

901 across the five suites this touches, 19 of them new. The layout suite earned
its keep three times over: the batch deletion card's path list overflowed the
204-pixel pane at 120, at 72 and at 56 before 32 held, and the edit strip
overflowed by 131 until the whole strip — rather than the log inside it — was
bounded. Each number in those files is measured and says which failure it came
from, because the next person to add a line to either card will move them again.

What no suite covers is the platform halves of editing: Process.Start with
UseShellExecute and a live FileSystemWatcher are the operating system, and a test
waiting on one would be measuring it. The shell's own half — when a save is
written back, when it is refused, what stopping releases — is covered against a
watcher that fires on demand.

src/DodoSSH.Client.Ssh/SftpSession.cs

@@ -140,6 +140,54 @@ public static class PosixMode
     /// <summary>Whether the others triple carries the write bit.</summary>
     public static bool IsWorldWritable(string mode) => At(mode, OthersWrite) == 'w';
 
+    /// <summary>
+    /// Reads the nine permission bits back out of a formatted mode, as an octal number.
+    /// </summary>
+    /// <remarks>
+    /// The inverse of <see cref="Format"/>, and it exists because the editor that changes a mode has to
+    /// start from the one that is there. Anything that is not a mode this type wrote answers zero — the same
+    /// forgiving reading <see cref="At"/> already takes, and for the same reason: this feeds a form, and a
+    /// listing is not worth failing over one unrecognised string.
+    /// </remarks>
+    public static int ToOctal(string mode)
+    {
+        if (mode is not { Length: 10 })
+        {
+            return 0;
+        }
+
+        var bits = 0;
+
+        for (var index = 1; index < 10; index++)
+        {
+            bits <<= 1;
+
+            if (mode[index] != '-')
+            {
+                bits |= 1;
+            }
+        }
+
+        return bits;
+    }
+
+    /// <summary>Formats nine permission bits the way <c>chmod</c> takes them, e.g. <c>0755</c>.</summary>
+    /// <remarks>
+    /// Four digits with a leading zero, which is how every <c>chmod</c> example on earth writes one — and
+    /// the leading zero is the part that says out loud that the three bits this client does not write are
+    /// being sent as clear. See the type's own remark.
+    /// </remarks>
+    public static string FormatOctal(int mode) =>
+        string.Create(CultureInfo.InvariantCulture, $"0{(mode >> 6) & 7}{(mode >> 3) & 7}{mode & 7}");
+
+    /// <summary>The nine bits, and nothing above them.</summary>
+    /// <remarks>
+    /// Applied to everything on its way to a server. It is what keeps a caller from setting setuid through
+    /// an interface that does not admit to offering it — see the type's own remark on why those three bits
+    /// are neither rendered nor written.
+    /// </remarks>
+    public static int Sanitise(int mode) => mode & 0b111_111_111;
+
     private const int OwnerExecute = 3;
     private const int GroupExecute = 6;
     private const int OthersWrite = 8;
@@ -393,6 +441,43 @@ public interface IRemoteFileStore : IAsyncDisposable
     /// <summary>Whether the transport is still up.</summary>
     bool IsConnected { get; }
 
+    /// <summary>
+    /// Why the connection under this store went away, or null if it did not.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// The same fact, latched the same way and for the same reason, as
+    /// <see cref="ISshShellSession.TransportFailure"/> — read that member for the argument. What differs is
+    /// what it is read <em>for</em>: a shell has a blocked read this releases, and a file browser has no
+    /// loop at all. Here it is the sentence a screen prints beside the word DISCONNECTED, and the thing that
+    /// tells a failed listing about a path apart from a failed listing about a connection.
+    /// </para>
+    /// <para>
+    /// Null forever on a store with no connection to lose. A bucket is HTTP, request per operation, and has
+    /// nothing that can be up between two of them.
+    /// </para>
+    /// </remarks>
+    string? TransportFailure { get; }
+
+    /// <summary>
+    /// Raised once, when the connection goes away without this client having closed it.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// ◆ <b>Because otherwise nobody finds out until they click.</b> A file browser is idle between
+    /// operations, so the alternative to an event is a screen that goes on saying CONNECTED over a host that
+    /// is gone until somebody happens to ask it for a listing — which is the same dishonesty a terminal
+    /// showed and the same one this is here to remove. <see cref="TransportFailure"/> is already set by the
+    /// time this is raised.
+    /// </para>
+    /// <para>
+    /// Raised on whichever thread the failure was noticed on, which is SSH.NET's message-listener thread; a
+    /// handler that touches a view model has to marshal. Never raised by a store with no connection to lose,
+    /// and never raised for a session this client disposed itself.
+    /// </para>
+    /// </remarks>
+    event EventHandler? ConnectionLost;
+
     /// <summary>
     /// Where the session starts, which is the account's home directory.
     /// </summary>
@@ -453,6 +538,42 @@ public interface IRemoteFileStore : IAsyncDisposable
 
     /// <summary>Renames or moves a path within the same host.</summary>
     Task RenameAsync(string fromPath, string toPath, CancellationToken cancellationToken);
+
+    /// <summary>
+    /// Sets a path's POSIX mode.
+    /// </summary>
+    /// <param name="path">What to change.</param>
+    /// <param name="mode">
+    /// The nine permission bits, as an octal number reads them — <c>0o755</c> is <c>rwxr-xr-x</c>. Only the
+    /// low nine bits are sent; see <see cref="PosixMode"/> for why setuid, setgid and sticky are not this
+    /// client's to write.
+    /// </param>
+    /// <param name="cancellationToken">Cancellation.</param>
+    /// <remarks>
+    /// ◆ <b>The one operation on this interface that writes something the listing already shows.</b> The
+    /// <c>PERMS</c> column has been a read-only fact since it arrived, and the commonest thing anybody does
+    /// straight after using this screen is open a terminal to make the file they just uploaded executable.
+    /// <para>
+    /// Refused by a store with no such thing. An object has an ACL rather than a mode, and mapping one onto
+    /// the other would be inventing a fact about a bucket.
+    /// </para>
+    /// </remarks>
+    /// <exception cref="SftpPathException">The path is not there, is not writable, or has no mode to set.</exception>
+    Task SetPermissionsAsync(string path, int mode, CancellationToken cancellationToken);
+
+    /// <summary>
+    /// Sets a path's last-write time.
+    /// </summary>
+    /// <remarks>
+    /// What makes an upload land carrying the timestamp its source had, which is the half of "preserve" that
+    /// every platform can answer — a mode is not a fact about a file on Windows and a modification time is.
+    /// Refused by a store that has no way to say when an object was written other than when it was put.
+    /// </remarks>
+    /// <exception cref="SftpPathException">The path is not there, or its time cannot be set.</exception>
+    Task SetLastWriteTimeAsync(
+        string path,
+        DateTimeOffset lastWriteTimeUtc,
+        CancellationToken cancellationToken);
 }
 
 /// <summary>

src/DodoSSH.Client.Ssh/SshNetSftpSession.cs

@@ -11,14 +11,35 @@ namespace DodoSSH.Client.Ssh;
 /// this type does beyond forwarding calls is translate SSH.NET's several path failures into the single one a
 /// caller can act on.
 /// </remarks>
-internal sealed class SshNetSftpSession(SftpClient client, HostKeyPresentation hostKey, string homeDirectory)
-    : ISftpSession
+internal sealed class SshNetSftpSession : ISftpSession
 {
+    private readonly SftpClient client;
+
+    private string? transportFailure;
+    private int announced;
+
+    internal SshNetSftpSession(SftpClient client, HostKeyPresentation hostKey, string homeDirectory)
+    {
+        this.client = client;
+
+        HostKey = hostKey;
+        HomeDirectory = homeDirectory;
+        Cipher = client.ConnectionInfo.CurrentServerEncryption ?? string.Empty;
+
+        client.ErrorOccurred += OnTransportError;
+    }
+
     /// <inheritdoc />
     public bool IsConnected => client.IsConnected;
 
     /// <inheritdoc />
-    public HostKeyPresentation HostKey { get; } = hostKey;
+    public string? TransportFailure => Volatile.Read(ref transportFailure);
+
+    /// <inheritdoc />
+    public event EventHandler? ConnectionLost;
+
+    /// <inheritdoc />
+    public HostKeyPresentation HostKey { get; }
 
     /// <inheritdoc />
     /// <remarks>
@@ -27,10 +48,36 @@ internal sealed class SshNetSftpSession(SftpClient client, HostKeyPresentation h
     /// so <c>ConnectionInfo</c> is already populated by the time there is a session to read it from. The coalesce
     /// is there for SSH.NET's nullable annotation, which covers the pre-key-exchange window this never sees.
     /// </remarks>
-    public string Cipher { get; } = client.ConnectionInfo.CurrentServerEncryption ?? string.Empty;
+    public string Cipher { get; }
 
     /// <inheritdoc />
-    public string HomeDirectory { get; } = homeDirectory;
+    public string HomeDirectory { get; }
+
+    /// <summary>
+    /// Latches the failure and says so once.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// No blocked read to release, unlike the shell's own handler: every SFTP call is a request and a reply,
+    /// so a connection that has gone is discovered by the next one throwing. What this adds is that somebody
+    /// finds out <em>without</em> making that next call — a file browser sits idle between operations, and
+    /// waiting for a click to reveal a host that went away half an hour ago is exactly the stale CONNECTED
+    /// this exists to remove.
+    /// </para>
+    /// <para>
+    /// Announced once. SSH.NET can raise several errors as one connection comes apart, and a screen told
+    /// three times would report the second and third against a session it had already replaced.
+    /// </para>
+    /// </remarks>
+    private void OnTransportError(object? sender, ExceptionEventArgs e)
+    {
+        Interlocked.CompareExchange(ref transportFailure, e.Exception.Message, comparand: null);
+
+        if (Interlocked.Exchange(ref announced, 1) == 0)
+        {
+            ConnectionLost?.Invoke(this, EventArgs.Empty);
+        }
+    }
 
     /// <inheritdoc />
     public async Task<IReadOnlyList<SftpEntry>> ListAsync(string path, CancellationToken cancellationToken)
@@ -141,10 +188,61 @@ internal sealed class SshNetSftpSession(SftpClient client, HostKeyPresentation h
         }
     }
 
+    /// <inheritdoc />
+    /// <remarks>
+    /// ◆ <b>On a thread-pool thread, because SSH.NET offers no asynchronous <c>SETSTAT</c>.</b>
+    /// <c>ChangePermissions</c> is a blocking round trip and every caller here is on the thread the
+    /// interface is drawn from — so calling it directly would freeze the window for a link's latency, which
+    /// on the connections this product exists for is the difference between instant and noticeably not.
+    /// Every other operation on this type has an async form and uses it.
+    /// </remarks>
+    public async Task SetPermissionsAsync(string path, int mode, CancellationToken cancellationToken)
+    {
+        // Sanitised here rather than trusted from the caller, so that the promise the interface makes about
+        // the three bits it does not write holds at the last point before the wire.
+        var bits = (short)PosixMode.Sanitise(mode);
+
+        try
+        {
+            await Task.Run(() => client.ChangePermissions(path, bits), cancellationToken)
+                .ConfigureAwait(false);
+        }
+        catch (Exception exception) when (IsPathFailure(exception))
+        {
+            throw Translate(path, exception);
+        }
+    }
+
+    /// <inheritdoc />
+    /// <remarks>See <see cref="SetPermissionsAsync"/>; the same blocking round trip, moved off the caller's thread for the same reason.</remarks>
+    public async Task SetLastWriteTimeAsync(
+        string path,
+        DateTimeOffset lastWriteTimeUtc,
+        CancellationToken cancellationToken)
+    {
+        var when = lastWriteTimeUtc.UtcDateTime;
+
+        try
+        {
+            await Task.Run(() => client.SetLastWriteTimeUtc(path, when), cancellationToken)
+                .ConfigureAwait(false);
+        }
+        catch (Exception exception) when (IsPathFailure(exception))
+        {
+            throw Translate(path, exception);
+        }
+    }
+
     /// <inheritdoc />
     public ValueTask DisposeAsync()
     {
+        // Before the client goes, and it also settles the flag: a disposal that trips SSH.NET's own error
+        // path must not reach a screen as a connection this client did not mean to lose.
+        Interlocked.Exchange(ref announced, 1);
+        client.ErrorOccurred -= OnTransportError;
+
         client.Dispose();
+
         return ValueTask.CompletedTask;
     }