Implement confirmed Android tree mutation workflows (#108)

docs/android/mutations.md

@@ -0,0 +1,61 @@
+# Android move, copy and delete
+
+Issue [#108](https://git.rfc1437.de/hugo/IronStorage/issues/108) exposes entry and
+folder mutations from row action buttons, long press, TalkBack actions, swipe and
+the normal entry viewer's More menu. Swiping right selects Move; swiping left
+selects Delete. The row resets and opens the action dialog. A swipe never applies
+a mutation. Every action requires explicit confirmation of the Rust-provided
+target, and deletion also identifies the folder's contents.
+
+The dialog works from locked rows. Its metadata is read without decryption; its
+Unlock action authenticates through the shared Rust lease before confirmation can
+execute. Folder authentication uses an in-memory encryption probe for its actual
+recipient policy, including empty folders. This creates no password-store entry.
+
+Rust provides destination hierarchy depth, labels, validation, collisions and
+the exact replacement targets. Unavailable destinations are disabled. Replacing
+entries requires a separate checkbox, as does discarding open editors or unsaved
+edits. Changing destination resets overwrite consent. Pending dialogs and their
+confirmation flags are never saved across process recreation and are cancelled
+by background, relock or presentation revocation.
+
+## Transaction and revision ownership
+
+`crates/storage` validates typed row IDs against their filesystem revisions,
+then binds plans to the managed tree's ciphertext, recipient policies and object
+identities. Changes anywhere in that tree conservatively require a fresh plan;
+an existing target replaced after preparation cannot inherit prior overwrite
+consent. The transaction engine checks the revision and authentication lease
+again after any reencryption and immediately before applying changes.
+
+The existing pass-compatible `TreeMutator` owns selective reencryption, policy
+preservation, recursive deletion, rollback, empty-directory cleanup and automatic
+Git commits. Unsupported auxiliary files or nested Git repositories remain
+protected by its validation. Mobile reservations block overlapping repository
+actions and entry/editor mutation while a transaction is applying.
+
+Editor coordination includes encrypted checkpoints left after background or
+relock. Failure retains recoverable edits while an expired lease drops plaintext.
+Confirmed success removes only affected editors and checkpoints and reports their
+typed identities to the Android presentation owner. It cannot resurrect a
+discarded draft. Rust also returns navigation following the copied/moved object
+or the nearest surviving folder after deletion; rejected transactions refresh the
+current tree. Kotlin renders those results and performs no repository I/O,
+recipient selection, target-path construction or commit policy.
+
+## Validation
+
+Upstream-compatible encrypted fixtures prove folder copy's selective reencryption,
+policy/ciphertext preservation on move, recursive delete confirmation, explicit
+overwrite, replacement-target rejection, a source changing during reencryption,
+commit rollback, pre-apply lease revocation and checkpoint retention/discard.
+NativeTreeMutationTest runs real encrypted stores through the Kotlin facade and
+checks locked preparation, dirty editor consent, navigation, stale rows and
+background interruption. MutationWorkflowTest checks full swipes, cancellation,
+separate overwrite/discard consent and folder TalkBack/menu actions. Its optional
+inspection mode supplies disposable presentation fixtures for computer use.
+
+Emulator updates use `install -r` and preserve retained app data and enrollment.
+The deterministic native tests supply OS capability callbacks; this issue changes
+no real Keystore/biometric adapter. Release ABIs are arm64-v8a and armeabi-v7a.
+Physical devices and x86_64 are excluded by the milestone's support scope.