feat(files): file browser redesign on PC and phone, and RemEx 3.1.0 (versionCode 39)

[clindsay94]

Checklist

• Title includes the bead ID: no bead, by Connor's call for this work ("Skip beads for this work")
• scripts/verify.ps1 was run (-Scope all, Linux). Everything passes except 10 remex.agent.tests failures. The untouched base commit fails the same 10 in this container: headless capture, running as root, and a Remex.Agent vs remex.agent path-case bug. So -Check reports the receipt as FAIL for those 10 only.
• If Kotlin changed: built and verified with the release variant (testReleaseUnitTest, lintRelease, assembleRelease)
• If any user-facing string changed: all 9 locale files were updated on both platforms
• If touching capture, the stream, the decoder, SurfaceView, pairing, or the session guard: read docs/REGRESSION-GUARDS.md first. This PR touches none of those. It adds one guard (phone-only bookmarks never reach the PC), widens the phone-relay guard, and fixes two stale anchors.
• If any .axaml changed: looked at the result via the ui-verify skill. The skill needs a live Windows desktop, which this session doesn't have. The new File Transfer view was rendered headlessly instead, with PNG snapshots. The 13-cell ui-palette-sweep.ps1 still needs a run on Windows.

What changed and why

The redesigned file screens on both platforms, as specified in docs/specs/2026-10-08-file-browser-redesign.md (§7 says what was delivered and where it differs from the plan).

1. Protocol. Two additions, neither of which changes protocolVersion, and both gated behind capability flags so older peers are never asked:

   • A new file_read_range_request / file_read_range_response pair, answered by both the PC and the phone.
   • The phone now answers file_hash_request.

   The PC's phone relay forwards both, with paths and ranges checked before they leave the PC. Hashes display as lowercase hex, and the C# and Kotlin versions share one set of test vectors.

2. PC plumbing. Transfers say Verified only when a hash was really compared. This phase also adds the preview pipeline: classifier, text decoder, tokenizer, and image, text-head and live-tail loaders.

3. PC screen. An Explorer-style layout: a tree (This PC plus phones), contents with thumbnails, right-click menus, keyboard shortcuts and drag between devices, a live preview, and a SHA-256 panel. A transfer strip runs along the bottom.

4. Phone plumbing. Kotlin twins of the preview code, held to the C# rules by one shared vector file. Range reads, hashing and browsing against the PC; DocumentsContract listing on the phone; phone-only bookmarks; and Verified on phone transfers.

5. Phone screen.

   • One adaptive tree for This phone and PC.
   • Tapping a file previews it, with a live tail for logs.
   • The fingerprint card can compute, copy, compare and cross-check against the other device.
   • Send to PC and Save to phone.
   • The toolbar is one primary action plus More.
   • Older PCs get an "update RemEx" note rather than requests they can't answer.

6. Docs. FILE_SHARING.md, CHANGELOG.md, REGRESSION-GUARDS.md, API_CONTRACTS.md §3.

7. Release. 3.1.0, Android versionCode 39, set through build-remex.ps1 -Version 3.1.0 -VersionCode 39.

Testing

• .NET: core 1642/1642, desktop 3929 passed with 4 skipped, render 60/60, agent the 10 container-only failures above.
• Android: unit tests 2004/2004, and lintRelease passes.
• Defect injection: every new guard was broken on purpose and went red (more than 40 injections across C# and Kotlin), then green again once restored. Six tests turned out to be blind and were fixed before landing.
• Review: an independent review of the Kotlin code found 3 HIGH problems, all fixed:
  • Switching PC folders could leave the old listing on screen under the new folder.
  • Release lint failed.
  • The phone had no fallback for older PCs.
• Still to do on real hardware: the PC palette sweep on Windows, and the Android screen on the emulator across seed, dynamic and fallback colours × light/dark × contrast.

🤖 Generated with Claude Code

https://claude.ai/code/session_01E9cDSGibUBVRtkDqkLMk7V

---

Generated by Claude Code

[clindsay94]

CI: both red checks are already red on main, and neither comes from this PR.

• Linux - build, and test what is proven to run there. This fails at the build step with NETSDK1147: ... workloads must be installed: android for remex.core (net10.0-android). main fails at the same step (runs 39–44, most recently run 37728027340 on 2455dcd). This PR doesn't change remex.core's target frameworks or the workflow. Proposed fix, kept out of this PR: add a step before the build in the linux job of .github/workflows/dotnet.yml:

      - name: Install the Android workload (remex.core also targets net10.0-android)
        run: dotnet workload install android

• Windows - build and test. The only failures are the 4 WindowsUnelevatedLauncherIntegrationTests ([ElevatedWindowsOnlyFact]). They fail the same way on main (5 failures there; the 5th is ConnectionBecomesRegistryVisibleTests). The runner is elevated with UAC off, so Windows can't produce the medium-integrity token these tests check for. Everything this PR adds passed on the Windows runner:

  • Core 1642/1642, Desktop 3932/3933 (1 skipped), Render 60/60.
  • That includes the Windows-only tests that can't run in the Linux container where this was developed.

  Proposed fix, also kept out of this PR: have ElevatedWindowsOnlyFact skip when HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA is 0, because an unelevated launch can't happen without UAC.

I'm not re-running either job: both fail deterministically on main.

---

Generated by Claude Code