Transfer: Unify entry paths behind one guard + source resolver

- New `pane/transfer-entry.ts` is the shared seam every transfer entry path runs through, so F5/F6, drag-and-drop, and clipboard paste prepare a transfer identically:
  - `checkTransferDestinationGuard(destVolumeId, volumes)`: the shared destination guard chain (search-results not-a-folder toast, then read-only "Read-only device" alert). Copy strings unchanged — they're the E2E-asserted contract. An unknown destination id is allowed through (can't prove read-only; the backend still rejects a genuinely read-only write).
  - `resolveSourceVolumeId(paths, volumes, resolvePathVolume)`: resolves the REAL source volume for dropped/pasted paths — frontend `findVolumeIdForPath` longest-prefix (handles MTP-shaped paths), backend `resolve_path_volume` fallback for the common parent, honest-unknown `root` default. Never ships a knowingly-wrong id: sources spanning volumes or a failed resolve return `root`.
- F5/F6 (`file-operation-commands.ts`): the inline read-only / search-results guards now call `checkTransferDestinationGuard`. Behavior-preserving; the 37 existing specs stay green.
- Drag-and-drop (`drag-drop-controller.svelte.ts`): runs the shared guard before opening the dialog (field bug 2: dropping onto a read-only volume now shows the same "Read-only device" alert F5 shows, instead of silently opening a copy dialog), and resolves the real source volume id instead of the old `sourceVolumeId = destVolumeId` placeholder (field bug 4: an MTP→local / local→MTP drop now stats the right volume, so the dialog's byte/file/dir counters fill instead of reading 0). `buildTransferPropsFromDroppedPaths` takes the resolved `sourceVolumeId` explicitly.
- Clipboard paste (`clipboard-operations.ts`): runs the shared guard for a read-only destination. The MTP-specific "Use F5…" refusal stays separate and ahead of it (it points the user at the F5/F6 flow paste lacks).
- Tests (red-first for the bug-targeting ones): `transfer-entry.test.ts` (guard + resolver matrix: local / MTP-shaped / spanning / BE-fallback / honest-unknown); drag-drop component tests for the read-only guard (bug 2) and the resolved cross-volume source id (bug 4); a `TransferDialog` test pinning that the dialog forwards the source volume id to `startScanPreview` (the bug-4 seam); a read-only paste guard test. Existing F5/F6 + drag + clipboard + dialog specs unchanged.
- Docs: updated the transfer FE, pane, and drag `CLAUDE.md`s for the new shared-seam architecture.

Author: vdavid

apps/desktop/src/lib/file-explorer/drag/CLAUDE.md

@@ -58,14 +58,27 @@ Key files:
 - `drag-position.ts`: Corrects Tauri coords for docked DevTools (dev-only, zero overhead in prod)
 - Integration in `DualPaneExplorer.svelte`
 
-Drop count split: on drop, `pane/drag-drop-controller.svelte.ts::handleFileDrop` fetches each dropped path's top-level
-kind (file vs. folder) in one batched `stat_paths_kinds` IPC before opening the confirmation dialog, so both the dialog
-and the completion toast report the real "N files and M folders" split. The stat runs under the backend read timeout (2
-s) and falls back to all-unknown on a hung mount, so it never blocks the drop. The split is all-or-nothing: if ANY
-path's kind is unknown (a virtual MTP/SMB path that landed on the pasteboard, a vanished entry, a stat timeout, or a
-length mismatch), `buildTransferPropsFromDroppedPaths` reverts the whole batch to the legacy approximate shape
-(`fileCount = count`, `folderCount = 0`), which makes the toast composer fall back to flattened file-count wording.
-Honest beats half-right — a partial split would misreport.
+Drop preparation runs through the shared transfer entry seam (`pane/transfer-entry.ts`), the SAME path F5/F6 and
+clipboard paste use, so all three entry points prepare a transfer identically. On drop,
+`pane/drag-drop-controller.svelte.ts::handleFileDrop`:
+
+- **Runs the shared destination guard** (`checkTransferDestinationGuard`) FIRST. Dropping onto a read-only volume shows
+  the same "Read-only device" alert F5 shows (not a copy dialog the backend would later reject); dropping onto a
+  search-results pane shows the not-a-folder toast. The guard short-circuits before any stat / volume-resolution work.
+- **Resolves the REAL source volume** via `resolveSourceVolumeId` (frontend `findVolumeIdForPath` longest-prefix →
+  backend `resolve_path_volume` for the common parent → honest-unknown `root` default) and passes it to
+  `buildTransferPropsFromDroppedPaths`. This is what feeds the dialog's byte scan (`startScanPreview`'s `sourceVolumeId`
+  arg), so an MTP→local / local→MTP drop stats the right volume and the counters fill. The old hardcoded
+  `sourceVolumeId = destVolumeId` placeholder stat'd the source paths as the wrong shape and reported 0 bytes / 0 files.
+  `resolveSourceVolumeId` NEVER ships a knowingly-wrong id — when sources span volumes or resolution fails, it returns
+  `root` (the honest unknown, today's degraded-but-correct behavior).
+- **Fetches each dropped path's top-level kind** (file vs. folder) in one batched `stat_paths_kinds` IPC before opening
+  the confirmation dialog, so both the dialog and the completion toast report the real "N files and M folders" split.
+  The stat runs under the backend read timeout (2 s) and falls back to all-unknown on a hung mount, so it never blocks
+  the drop. The split is all-or-nothing: if ANY path's kind is unknown (a virtual MTP/SMB path that landed on the
+  pasteboard, a vanished entry, a stat timeout, or a length mismatch), `buildTransferPropsFromDroppedPaths` reverts the
+  whole batch to the legacy approximate shape (`fileCount = count`, `folderCount = 0`), which makes the toast composer
+  fall back to flattened file-count wording. Honest beats half-right — a partial split would misreport.
 
 ### Drag image detection (macOS-specific hack)
 

apps/desktop/src/lib/file-explorer/pane/CLAUDE.md

@@ -56,7 +56,8 @@ list).
 | `type-to-jump-keys.ts`        | Pure `isTypeToJumpChar` / `isTypeToJumpResetKey` shared by both jump intercepts                |
 | `initialization.ts`           | Load persisted tabs + status + settings; resolve volumes; apply E2E overrides                  |
 | `tab-operations.ts`           | Tab CRUD + context menu + persistence wired to `tabs/tab-state-manager`                        |
-| `transfer-operations.ts`      | Build `TransferDialogPropsData` (and snapshot variant) from a focused pane                     |
+| `transfer-operations.ts`      | Build `TransferDialogPropsData` (and snapshot/dropped variants) from a focused pane            |
+| `transfer-entry.ts`           | Shared transfer entry seam: `checkTransferDestinationGuard` + `resolveSourceVolumeId`          |
 | `sorting-handlers.ts`         | `getNewSortOrder` (column click cycle), `toFrontendIndices` (`..` offset)                      |
 | `index-events.ts`             | Throttled `index-dir-updated` handler with `/private/` symlink resolution                      |
 | `navigate.ts`                 | `navigate(intent, deps)` transaction: the single coordinator-level pane-nav entry              |
@@ -129,11 +130,12 @@ string. The guards:
   system clipboard, and an MTP-worded toast on a reachable network paste would be a new, mis-worded toast (PR3). On the
   live clipboard-time pane id set this is byte-equivalent to the old `startsWith('mtp-')` gate, pinned by the
   equivalence test in `clipboard-operations.test.ts`.
-- **Transfer / delete** (`file-operation-commands.ts`): source routing (snapshot builder) off `!hasBackendListing`; the
-  dest-paste block off `!canPasteInto` SCOPED to the `search-results` kind (so the toast wording stays correct — a
-  network dest has the same `false` cap but historically fell through silently; the capability decides the block, the
-  kind decides the toast, same split as dispatch). The `isReadOnly` alerts stay per-`VolumeInfo` (Q4), and the
-  `search-results://` URL parses stay (namespace mechanics).
+- **Transfer / delete** (`file-operation-commands.ts`): source routing (snapshot builder) off `!hasBackendListing`. The
+  destination guards (search-results dest-paste block off `!canPasteInto` scoped to the `search-results` kind so the
+  toast wording stays correct; the `isReadOnly` alert per-`VolumeInfo`, Q4) live in `transfer-entry.ts`'s
+  `checkTransferDestinationGuard` so F5/F6, drag-and-drop, AND paste run the identical chain — see
+  `file-operations/transfer/CLAUDE.md` § "One transfer entry seam". The `search-results://` URL parses stay (namespace
+  mechanics).
 - **`pane-commands.ts`**: `isSnapshotPane` (the Selection-dialog banner flag) off `!hasBackendListing`.
 - **MCP sync** (`pane-mcp-sync.svelte.ts`): the network/search skip off `!syncsToMcp`. The deps interface carries a
   single `getSyncsToMcp()` accessor (FilePane supplies it from its derived caps); the two `getIs*View()` deps retired.

apps/desktop/src/lib/file-explorer/pane/clipboard-operations.test.ts

@@ -41,7 +41,17 @@ vi.mock('$lib/ui/toast', () => ({ addToast: addToastSpy }))
 
 vi.mock('$lib/search/snapshot-store.svelte', () => ({ resolveSnapshotPaths: resolveSnapshotPathsSpy }))
 
-vi.mock('./transfer-operations', () => ({ getCommonParentPath: getCommonParentPathSpy }))
+// `transfer-entry` (the shared guard chain) imports `getDestinationVolumeInfo`
+// from here too, so the mock must export it. Keep it a thin lookup matching the
+// real one so the read-only paste guard exercises real behavior off the
+// per-test volumes list.
+vi.mock('./transfer-operations', () => ({
+  getCommonParentPath: getCommonParentPathSpy,
+  getDestinationVolumeInfo: (volumeId: string, volumes: { id: string; name: string; isReadOnly?: boolean }[]) => {
+    const v = volumes.find((vol) => vol.id === volumeId)
+    return v ? { name: v.name, isReadOnly: v.isReadOnly ?? false } : undefined
+  },
+}))
 
 // The MTP / snapshot refusals read the capability table via `capabilitiesFor`,
 // which resolves fsType/category from the volume store for real ids. The two
@@ -85,6 +95,7 @@ interface AccessConfig {
   volumeId?: string
   path?: string
   showHiddenFiles?: boolean
+  volumes?: { id: string; name: string; isReadOnly?: boolean }[]
 }
 
 function buildAccess(config: AccessConfig = {}): PaneAccess {
@@ -97,12 +108,15 @@ function buildAccess(config: AccessConfig = {}): PaneAccess {
     getFocusedPane: () => config.focusedPane ?? 'left',
     otherPane: (pane) => (pane === 'left' ? 'right' : 'left'),
     getShowHiddenFiles: () => config.showHiddenFiles ?? true,
-    getVolumes: () => [],
+    getVolumes: () => (config.volumes ?? []) as unknown as ReturnType<PaneAccess['getVolumes']>,
     focusContainer: () => {},
   }
 }
 
-const dialogsStub = { startTransferProgress: vi.fn<(props: TransferProgressPropsData) => void>() }
+const dialogsStub = {
+  startTransferProgress: vi.fn<(props: TransferProgressPropsData) => void>(),
+  showAlert: vi.fn<(title: string, message: string) => void>(),
+}
 
 function buildDialogs() {
   return dialogsStub as unknown as Parameters<typeof createClipboardOperations>[1]
@@ -223,6 +237,23 @@ describe('pasteFromClipboard', () => {
     expect(dialogsStub.startTransferProgress).not.toHaveBeenCalled()
   })
 
+  it('refuses pasting into a read-only destination with the shared "Read-only device" alert', async () => {
+    const access = buildAccess({
+      volumeId: 'ext-ro',
+      volumes: [{ id: 'ext-ro', name: 'Backup', isReadOnly: true }],
+    })
+
+    await createClipboardOperations(access, buildDialogs()).pasteFromClipboard(false)
+
+    expect(dialogsStub.showAlert).toHaveBeenCalledWith(
+      'Read-only device',
+      '"Backup" is read-only. You can copy files from it, but not to it.',
+    )
+    // The shared guard fires before reading the clipboard or queueing anything.
+    expect(readClipboardFilesSpy).not.toHaveBeenCalled()
+    expect(dialogsStub.startTransferProgress).not.toHaveBeenCalled()
+  })
+
   it('warns and bails when the clipboard is empty', async () => {
     readClipboardFilesSpy.mockResolvedValue({ paths: [], isCut: false })
     const access = buildAccess({ volumeId: 'root' })

apps/desktop/src/lib/file-explorer/pane/clipboard-operations.ts

@@ -13,6 +13,7 @@ import { getAppLogger } from '$lib/logging/logger'
 import { formatNumber } from '$lib/file-explorer/selection/selection-info-utils'
 import type { TransferOperationType } from '../types'
 import { getCommonParentPath } from './transfer-operations'
+import { checkTransferDestinationGuard } from './transfer-entry'
 import { capabilitiesFor } from './volume-capabilities'
 import type { createDialogState } from './dialog-state.svelte'
 import type { PaneAccess } from './pane-access'
@@ -192,13 +193,26 @@ export function createClipboardOperations(access: PaneAccess, dialogs: DialogSta
     try {
       // Check MTP before reading clipboard; MTP paste is always rejected,
       // no point reading the system clipboard just to reject it. The capability
-      // decides the refusal, not a `startsWith('mtp-')` string (A6).
+      // decides the refusal, not a `startsWith('mtp-')` string (A6). The
+      // MTP-specific copy ("Use F5…") stays separate from the shared guard
+      // because it points the user at the F5/F6 flow MTP paste lacks.
       const volumeId = access.getPaneVolumeId(access.getFocusedPane())
       if (isMtpClipboardRefusal(volumeId)) {
         addToast('Use F5 to copy files to MTP devices', { level: 'info' })
         return
       }
 
+      // Shared destination guard (read-only alert + search-results refusal) —
+      // the same chain F5/F6 and drag-and-drop run, so pasting into a read-only
+      // destination gets the same "Read-only device" alert instead of silently
+      // queueing a transfer the backend would reject.
+      const guard = checkTransferDestinationGuard(volumeId, access.getVolumes())
+      if (!guard.ok) {
+        if (guard.toast) addToast(guard.toast.message, { level: guard.toast.level })
+        else dialogs.showAlert(guard.alert.title, guard.alert.message)
+        return
+      }
+
       const result = await readClipboardFiles()
 
       if (result.paths.length === 0) {