fix(remote-transfer): keep file transfers running instead of timing out

OpenBitFun-Installer/src-tauri/Cargo.toml

@@ -15,10 +15,16 @@ path = "src/main.rs"
 
 [build-dependencies]
 tauri-build = { version = "=2.6.3", features = [] }
+# This standalone app does not commit a Cargo.lock. Keep the Tauri build-time
+# crates aligned with the patched 2.11 runtime instead of resolving 2.7/2.10.
+tauri-codegen = "=2.6.3"
 zip = "0.6"
 
 [dependencies]
 tauri = { version = "=2.11.5", features = [] }
+tauri-macros = "=2.6.3"
+tauri-plugin = "=2.6.3"
+tauri-utils = "=2.9.3"
 tauri-plugin-dialog = "=2.7.3"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

docs/architecture/remote-workspace-transport.md

@@ -183,6 +183,29 @@ through the destination to preserve existing links and permissions. The final
 write is not an atomic transaction against other writers; interruption during
 that phase can have a partial or unknown outcome.
 
+Both providers publish an upload only after the transfer completed: the SFTP
+path streams into a same-directory `<hidden data dir>-upload-<id>.tmp` sibling
+and renames it over the destination, the container command does the same after
+its size check, and a downloaded file is staged beside its local destination
+the same way. A failed or cancelled transfer therefore leaves any previous
+destination unchanged, and staging temporaries are removed when the owning side
+can still reach the path. For directory transfers, files already published and
+directories already created remain when a later entry fails or is stopped.
+Because a published upload replaces its destination
+rather than writing through it, the result takes the staging file's mode and
+ownership, and a replaced symlink or hard link is not followed; that is what
+distinguishes a transfer from a workspace tool write above. A hard kill between
+staging and commit can leave one orphaned temporary, which the container
+commands sweep by age and the SFTP path leaves to the user.
+
+The desktop upload and download commands opt out of the shared 30-second
+controller deadline when their caller provides a progress and stop surface.
+Every SFTP request retains its own response timeout, the SSH transport drops a
+stalled connection, and the transfer ends when it completes, fails, or is
+stopped. File reads, writes, listings, and transfers without a stop surface keep
+the default controller deadline. A short deadline on a stoppable transfer only
+reported a slow-but-healthy operation as failed while the host kept working.
+
 Directory and stat records use NUL-separated fields. File names containing
 newlines or the delimiters used by older implementations remain round-trippable.
 The records are decoded only after the full byte stream is assembled; invalid