feat(files): transfers that outlive the page, and selection instead of per-row menus

Downloads and uploads were state inside GroupPage. Leaving a group
unmounted the component, its cleanup closed the DataChannel, and a
half-written file was all you had — which is also why only one thing
could be in flight at a time.

They live in a module-level store now. A group page hands its transport
over on the way out rather than closing it, and the last transfer using
it closes it; signing out is the one thing that cancels everything,
because those transfers are moving data on a token about to stop being
ours. The store is plain JavaScript with no browser globals, so
test_transfers.py runs it under Node and pins the parts that are timing
and lifetime rather than markup: that a cancel stops the work instead of
greying out a row, that a stalled transfer reads as stalled rather than
reporting its own historical average, and that a released transport is
closed by the last transfer and not before.

The widget by the bell shows each transfer with its rate and a cancel
button, so the Files panel no longer carries progress bars — you can
watch a 40 GB archive from the chat, or from another group.

Selection replaces the per-row menu: a Select toggle puts checkboxes on
files and folders, and ⋮ Actions acts on what is ticked. Ticks survive
walking into another folder, so a selection can span directories.
Downloads start together and run together. Videos offer Play only — View
did the same thing, which is the sort of duplication that makes people
wonder what the difference is.

Uploads had to become parallel-safe for any of this to mean anything:
their acks were matched by arrival order, so two at once credited each
other's progress. The node names the file in every ack, so they are keyed
by name now — with the same file twice refused, since the node keys its
own upload state that way too.

Two mistakes worth recording. The selection column went into the body
rows and not the header, because that edit matched nothing and I had not
made it assert; the columns were misaligned until a screenshot showed it.
And the Actions menu opened leftwards from a button at the right edge of
the toolbar, half of it off-screen.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 23 insertions, 0 deletions

diff --git a/docs/USERGUIDE.md b/docs/USERGUIDE.md
index 7f69712..eec61d9 100644
--- a/docs/USERGUIDE.md
+++ b/docs/USERGUIDE.md
@@ -529,6 +529,29 @@ look at what was sent, move it, or empty it without hunting through the tree.
 - Uploads are attributed to the identity the node pinned for that member, and that is what
   decides who may delete the file later — not anything the hub says.
 
+### Selecting files, and where transfers live
+
+The Files panel has a **Select** button. Turning it on puts a checkbox on every
+row — files and folders — and the **⋮ Actions** button next to it acts on what is
+ticked: download, play, view, download folders as a zip, delete. There is no
+per-row menu: several transfers at once is the normal case, and starting them one
+context menu at a time was the thing that made it awkward.
+
+Selection is remembered as you walk into folders, so you can tick something in
+one and something else in another before choosing an action.
+
+**Transfers run outside the page.** They are listed in the widget next to the
+bell, with a progress bar, the current rate, and a cancel button each:
+
+- Leaving the group, or the group page, does not stop them. The connection stays
+  open until the last transfer using it is finished.
+- **Signing out cancels them all** — they are moving data on a token that is about
+  to stop being yours.
+- Cancelling stops the work, not just the display; a partly written file is left
+  where you told the browser to put it.
+- Rates are measured over the last few seconds, so a stalled transfer reads as
+  stalled rather than reporting the average it once managed.
+
 ### Downloading a folder as a zip
 
 Any member can take a whole folder: **⋮ → Download as zip** on the folder's row.