controller: .fab browser download — the existing export pipeline staged under the data dir + a guarded streaming exit (estimate-first, io.Copy, post-stream cleanup, 1h TTL sweep); portability framing (decision 3); traversal guard red-proven, export→import round-trip + corrupt-bundle refusal unit-proven

Claude-Session: https://claude.ai/code/session_01GzammAMzsJTgpQHqxwM2bC

controller/internal/web/server.go

@@ -157,6 +157,12 @@ func NewServer(cfg *config.Config, stackMgr *stacks.Manager, cpuCollector *syste
 
 	s.loadTemplates()
 	go s.cleanupSessions()
+	// .fab download staging (v0.124.0): sweep aged bundles left by a crash/abandoned download.
+	if cfg.Paths.DataDir != "" {
+		if n := sweepFabDownloads(s.fabDownloadDir(), time.Now(), fabDownloadTTL, logger); n > 0 {
+			logger.Printf("[INFO] [web] download-export startup sweep removed %d staged bundle(s)", n)
+		}
+	}
 	// Drive-absent gate reconcile (intermediary-mount model): the periodic absent/return detector that
 	// replaced the retired slice-8C watchdog. Stops+blocks apps whose drive vanished, auto-restarts them
 	// when it returns. No-op when the agent is unreachable.