- A remote name went straight into Path.Combine. A POSIX name may hold backslashes, a colon or a drive
letter, and an S3 key may hold "../", so a name chosen by whoever could write to the host decided
where on this machine a download landed. LocalDirectory.ChildPath cleans the name and requires the
resolved parent to be the target folder; every download path and EDIT use it, and a name that cannot
be a file there is left on the host and reported.
- EDIT handed the copy to the shell's default action, which for .bat, .hta, .js and friends is to run
it. LocalEditor opens such a file with its own "edit" verb or Notepad on Windows and `open -t` on
macOS, and refuses a .desktop launcher on Linux.
- A failed bucket upload leaves its part object, and a retry asked for an offset no bucket accepts, so
the row could never finish. IRemoteFileStore.CanWriteFromAnOffset is false for buckets and the queue
starts those over.
- The SFTP host picker re-found its selection from the empty moment of every vault reload and landed
on the first host once a minute; the chosen host is now remembered, and a typed password is only
sent to the host it was typed for.
