[masarray]

Scope

• Port client-side FileDirectory [77], FileOpen [72], FileRead [73], and FileClose [74] from the C# behavioral oracle.
• Preserve the full signed Integer32 FRSM range, bounded diagnostics, and exact Confirmed-Error class/value evidence.
• Add bounded pagination, caller-owned streaming sinks, best-effort cleanup, and the precise rooted-backslash fallback.
• Add a host list/download CLI plus a dedicated decoder fuzz target/corpus.

Architecture and safety

• Portable core reuses the existing BER, MMS PDU, Presentation, invoke router, and association runtime.
• No filesystem, native socket, background thread, or remote mutation dependency exists in the portable file-service source; a source audit and embedded no-RTTI full-link gate enforce the boundary.
• Traversal/ambiguous paths, malformed/trailing BER, invoke mismatch, empty-progress reads, block/byte/read/page bounds, positive advertised-size overrun, and repeated pagination fail closed.
• FileClose is best-effort after FileOpen and never replaces an earlier primary failure.
• Adaptive retry occurs only for FileOpen file/file-non-existent before any FileRead and only after a successful sink reset.

Validation

• C# oracle suites: 27/27 passing.
• Dedicated C++ file-service suite: 14/14 passing.
• Full local MSVC /W4 /WX build and CTest: 25/25 passing.
• Embedded MSVC /GR- /WX full-link CTest: 1/1 passing.
• Deterministic decoder mutation smoke: 1,748 cases.
• Controlled lab: root FileDirectory succeeded; a small file downloaded in one FileRead with FileClose success; adaptive rooted-backslash and FileOpen size=0 interoperability were observed; a forced block-limit failure wrote zero bytes and still closed the FRSM.

Exact endpoint, remote names/content/hash, and JSON traces remain local and ignored.

Acceptance boundary

• Read/download only; upload, delete, and rename are not implemented.
• Current target returned one directory page, so physical multi-page continuation remains pending.
• Multi-vendor and ESP32 device validation remain pending; embedded host-sim is not a hardware claim.