Expose storage-owned tree mutations through discoverable Material interactions without unsafe stale or destructive actions.
Scope
Provide swipe actions where appropriate plus overflow/context and TalkBack accessibility actions for Move, Copy, and Delete.
A full/destructive swipe may select Delete but must always stop at an explicit confirmation naming the storage-provided target.
Present storage-provided destination hierarchy, validation, collision, overwrite requirement, revision, and typed result for Move/Copy.
Invoke only typed Rust mutations and refresh affected panes while preserving the nearest valid navigation/selection state.
Coordinate with dirty/open editors, authentication, Git conflicts, concurrent repository operations, and stale row/revision identities.
Handle cancellation, destination disappearance, existing target, overwrite confirmation, partial I/O failure, relock, and process/background interruption without applying to the wrong item.
Keep all rollback, reencryption, recipient, filesystem, and commit-message semantics in crates/storage.
Acceptance criteria
Move, Copy, and Delete are available without relying solely on gestures.
Delete always requires confirmation; overwrite is explicit and cannot be inferred from a display string.
Stale rows/revisions cannot mutate a replacement entry.
Cancellation/failure leaves the repository, editor sessions, and navigation coherent.
Upstream-compatible encrypted fixtures prove selective reencryption and rollback behavior while Compose tests verify interaction/accessibility.
Depends on hierarchical navigation, entry editing, and lifecycle security. Part of #87.
Android support update (2026-10-08)
User-directed scope: Android release and CI targets are arm64-v8a and armeabi-v7a. x86_64 Android is excluded for now. Validation for every Android milestone issue uses emulator devices only; physical-device testing and physical-device checklists are excluded. Record the limits of available ARM emulator/API images without claiming physical-device coverage.
## Goal
Expose storage-owned tree mutations through discoverable Material interactions without unsafe stale or destructive actions.
## Scope
- Provide swipe actions where appropriate plus overflow/context and TalkBack accessibility actions for Move, Copy, and Delete.
- A full/destructive swipe may select Delete but must always stop at an explicit confirmation naming the storage-provided target.
- Present storage-provided destination hierarchy, validation, collision, overwrite requirement, revision, and typed result for Move/Copy.
- Invoke only typed Rust mutations and refresh affected panes while preserving the nearest valid navigation/selection state.
- Coordinate with dirty/open editors, authentication, Git conflicts, concurrent repository operations, and stale row/revision identities.
- Handle cancellation, destination disappearance, existing target, overwrite confirmation, partial I/O failure, relock, and process/background interruption without applying to the wrong item.
- Keep all rollback, reencryption, recipient, filesystem, and commit-message semantics in `crates/storage`.
## Acceptance criteria
- Move, Copy, and Delete are available without relying solely on gestures.
- Delete always requires confirmation; overwrite is explicit and cannot be inferred from a display string.
- Stale rows/revisions cannot mutate a replacement entry.
- Cancellation/failure leaves the repository, editor sessions, and navigation coherent.
- Upstream-compatible encrypted fixtures prove selective reencryption and rollback behavior while Compose tests verify interaction/accessibility.
Depends on hierarchical navigation, entry editing, and lifecycle security. Part of #87.
## Android support update (2026-10-08)
User-directed scope: Android release and CI targets are **arm64-v8a** and **armeabi-v7a**. x86_64 Android is excluded for now. Validation for every Android milestone issue uses emulator devices only; physical-device testing and physical-device checklists are excluded. Record the limits of available ARM emulator/API images without claiming physical-device coverage.
hugo
added this to the 06 - Implement an Android version of the software milestone 2026-08-17 19:15:15 +00:00
Implemented complete Android Move, Copy and Delete workflows for entries and folders.
Actions are discoverable from row buttons, long press/context menus, the unlocked entry viewer, and direct TalkBack actions. Right swipe selects Move; left/full destructive swipe selects Delete, resets the row, and stops at a named-target confirmation. A swipe never executes a mutation.
Locked rows can prepare metadata without decrypting. The confirmation dialog authenticates through the shared Rust lease before execution. Folder authentication uses a transient encryption probe for the actual recipient policy and creates no store entry.
Rust supplies hierarchy depth, unavailable destinations, collision/replacement targets, overwrite requirements, revision and typed outcome/navigation. Overwrite and discarding open/dirty editors require separate explicit consent; destination changes reset overwrite consent.
Rust checks row identity/revision, binds plans to ciphertext/policies/filesystem object identities, and rechecks both revision and lease after reencryption immediately before applying. Replacing a source/target or changing a recipient policy invalidates prior consent. Mobile editor saves and tree/repository actions hold reservations for their full duration.
The existing pass-compatible TreeMutator performs selective reencryption, folder/policy preservation, recursive delete, rollback, cleanup and configured-identity Git commits. Checkpoints left after relock/background remain subject to editor coordination. Failure retains encrypted recoverable edits; successful explicit discard removes only affected editor/checkpoint IDs and closes their Kotlin presentation. Navigation follows the storage result or nearest surviving folder; failed transactions refresh the tree. Pending actions/consents are never saved, and background/relock cancels them.
Validation:
Required Rust fmt, workspace check with warnings denied, workspace clippy with warnings denied, and cargo test --workspace passed on Rust 1.97.1. Local SSH/socket fixtures ran with normal host process access.
Android androidVerification and release lint passed, including JVM/architecture/ktlint/Lint gates, both ARM ABI builds, native/16 KB packaging, dependencies and test APKs. Actual final APK manifest/backup exclusions, release stripping/FULL symbols and CycloneDX/license audits passed.
All 14 encrypted upstream-compatible tree mutation tests passed, including new folder selective-reencryption/policy preservation, recursive confirmation, explicit overwrite, identical-byte replacement target rejection, source replacement during reencryption and failed-commit rollback fixtures. Rust owner tests cover pre-apply lease revocation and dirty checkpoint retention on failure versus removal only after success.
NativeTreeMutationTest passed on API 26 ARM64 and strict API 37 ARM64 (16384-byte pages, compatibility flags disabled). It runs real encrypted stores through the Kotlin facade and covers locked preparation, explicit dirty-editor discard, saved-content preservation, folder/entry navigation, copy, stale rows, cancellation/background and confirmed delete. The full native viewer/editor/OTP/mutation suite passed on strict 16 KB ARM64.
MutationWorkflowTest passed: full destructive swipe only selects an action, cancel performs zero mutations, confirmation requires unlock, overwrite and discard are separate consents, and folder Move/Copy/Delete are available to TalkBack without gestures. The final app regression suite reported OK (42 tests); opt-in interactive/strong-biometry tests are skipped unless enabled.
Computer use validated named-target confirmation after a full delete swipe, cancel leaving the action count at zero, entry action buttons, locked Copy, destination and exact replacement target, separately checked overwrite/discard consent, and one action only after Confirm, using disposable presentation fixtures. All app updates used install -r. Existing AVDs were resumed without erasing data or enrollment. Deterministic native tests use OS capability callbacks; no new real-Keystore biometric coverage is claimed. Physical devices and x86_64 are excluded by milestone scope.
Reviewed the final code against every #108 acceptance criterion. Behavior, boundaries and evidence are documented in docs/android/mutations.md.
Commit: [316a875](https://git.rfc1437.de/hugo/IronStorage/commit/316a875d637942ba24d58c318f41c7edbb028f35), pushed to main.
Implemented complete Android Move, Copy and Delete workflows for entries and folders.
- Actions are discoverable from row buttons, long press/context menus, the unlocked entry viewer, and direct TalkBack actions. Right swipe selects Move; left/full destructive swipe selects Delete, resets the row, and stops at a named-target confirmation. A swipe never executes a mutation.
- Locked rows can prepare metadata without decrypting. The confirmation dialog authenticates through the shared Rust lease before execution. Folder authentication uses a transient encryption probe for the actual recipient policy and creates no store entry.
- Rust supplies hierarchy depth, unavailable destinations, collision/replacement targets, overwrite requirements, revision and typed outcome/navigation. Overwrite and discarding open/dirty editors require separate explicit consent; destination changes reset overwrite consent.
- Rust checks row identity/revision, binds plans to ciphertext/policies/filesystem object identities, and rechecks both revision and lease after reencryption immediately before applying. Replacing a source/target or changing a recipient policy invalidates prior consent. Mobile editor saves and tree/repository actions hold reservations for their full duration.
- The existing pass-compatible TreeMutator performs selective reencryption, folder/policy preservation, recursive delete, rollback, cleanup and configured-identity Git commits. Checkpoints left after relock/background remain subject to editor coordination. Failure retains encrypted recoverable edits; successful explicit discard removes only affected editor/checkpoint IDs and closes their Kotlin presentation. Navigation follows the storage result or nearest surviving folder; failed transactions refresh the tree. Pending actions/consents are never saved, and background/relock cancels them.
Validation:
- Required Rust fmt, workspace check with warnings denied, workspace clippy with warnings denied, and cargo test --workspace passed on Rust 1.97.1. Local SSH/socket fixtures ran with normal host process access.
- Android androidVerification and release lint passed, including JVM/architecture/ktlint/Lint gates, both ARM ABI builds, native/16 KB packaging, dependencies and test APKs. Actual final APK manifest/backup exclusions, release stripping/FULL symbols and CycloneDX/license audits passed.
- All 14 encrypted upstream-compatible tree mutation tests passed, including new folder selective-reencryption/policy preservation, recursive confirmation, explicit overwrite, identical-byte replacement target rejection, source replacement during reencryption and failed-commit rollback fixtures. Rust owner tests cover pre-apply lease revocation and dirty checkpoint retention on failure versus removal only after success.
- NativeTreeMutationTest passed on API 26 ARM64 and strict API 37 ARM64 (16384-byte pages, compatibility flags disabled). It runs real encrypted stores through the Kotlin facade and covers locked preparation, explicit dirty-editor discard, saved-content preservation, folder/entry navigation, copy, stale rows, cancellation/background and confirmed delete. The full native viewer/editor/OTP/mutation suite passed on strict 16 KB ARM64.
- MutationWorkflowTest passed: full destructive swipe only selects an action, cancel performs zero mutations, confirmation requires unlock, overwrite and discard are separate consents, and folder Move/Copy/Delete are available to TalkBack without gestures. The final app regression suite reported OK (42 tests); opt-in interactive/strong-biometry tests are skipped unless enabled.
- Computer use validated named-target confirmation after a full delete swipe, cancel leaving the action count at zero, entry action buttons, locked Copy, destination and exact replacement target, separately checked overwrite/discard consent, and one action only after Confirm, using disposable presentation fixtures. All app updates used install -r. Existing AVDs were resumed without erasing data or enrollment. Deterministic native tests use OS capability callbacks; no new real-Keystore biometric coverage is claimed. Physical devices and x86_64 are excluded by milestone scope.
Reviewed the final code against every #108 acceptance criterion. Behavior, boundaries and evidence are documented in docs/android/mutations.md.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Goal
Expose storage-owned tree mutations through discoverable Material interactions without unsafe stale or destructive actions.
Scope
crates/storage.Acceptance criteria
Depends on hierarchical navigation, entry editing, and lifecycle security. Part of #87.
Android support update (2026-10-08)
User-directed scope: Android release and CI targets are arm64-v8a and armeabi-v7a. x86_64 Android is excluded for now. Validation for every Android milestone issue uses emulator devices only; physical-device testing and physical-device checklists are excluded. Record the limits of available ARM emulator/API images without claiming physical-device coverage.
Commit: 316a875, pushed to main.
Implemented complete Android Move, Copy and Delete workflows for entries and folders.
Validation:
Reviewed the final code against every #108 acceptance criterion. Behavior, boundaries and evidence are documented in docs/android/mutations.md.