Fleet client: native Explorer shows host files via an amico-host:// FileSystemProvider (with honest capability label) #1267

Acceptance Criteria

• In fleet-client posture, a workspace folder under the amico-host scheme lists the host's directory tree in the native Explorer.
• Opening a file from that folder shows host content; saving writes back to the host and an independent re-read reflects the change.
• Create / rename / delete within that folder mutate the host filesystem.
• A persistent, visible label discloses that the Explorer shows host files while the integrated terminal, language features, source control, and search operate on the local machine, and points to Remote-SSH for full host-native tooling.
• With no reachable host, the mount surfaces the honest hub-down posture — never a silent fallback to local files.
• ssh-default fleet clients show no regression when the provider is absent/unmounted (standalone and server postures are unaffected).

Testing Decisions

Extend the existing fleet client-relay and /amicode/*-proxy suites (the stub-hub harness) with provider-conformance cases: list / read / write / rename / delete against the stub host, auth injection on the proxied file requests, and the honest-down posture with no upstream. Reuse the stub-hub support rather than standing up a new fixture.

Key Decisions

• A dedicated amico-host:// scheme, not an override of file: — keeps the local workspace intact and avoids fighting VS Code's real-filesystem assumptions.
• The provider mounts only in fleet-client posture; standalone/server postures are untouched.
• The capability label is mandatory and part of this slice — a hollow host Explorer with terminal/LSP/git/search silently still on the client is a worse failure than the reported split, so disclosure ships with the mount, not later.
• Window-mode is not modeled on the link-health posture (single-writer, transition-only); if a window-mode indicator is ever needed it takes its own field.

Constraints & Invariants

• Loopback-only engine bind preserved (ADR 0002/0005) — the provider consumes the already-proxied data plane, never opens a new bind.
• No silent fallback — an unreachable host is the honest degraded posture, not a switch to local files.
• One topology reader / single posture writer preserved (ADR 0023 / the posture-state contract) — the provider reads posture, never writes it.
• Reuse the unified transport health/outcome stream — no per-provider liveness fork.

Prior Art

• The client relay + /amicode/* proxy + the host proxy (host data plane + fleet-auth injection).
• The pluggable transport provider seam (resolved base URL + health).
• The engine file route group (directory list / read / status / write).
• The posture state + feed for the honest hub-down render.
• The stub-hub test harness introduced by the relay/proxy suites.

Source

• Part of the PRD: Fleet thin client — local shell, remote data #792 thin-client program.
• Relates to Fleet thin client — Slice 2: proxy /amicode/* to the host (host owns all state) #1262 (host owns /amicode/*) — the same "host owns state" principle applied to the file plane.
• Durable record: the fleet file-surface deliberation (spec-20260919-fleet-file-surface-and-posture-switch), which reviewed and rejected making Remote-SSH the default and auto-switch in favor of shipping this slice first.

Notes

Remote-SSH remains the path for full host-native tooling (LSP, terminal, debug, git, search). Making it a first-class opt-in posture, or the default, is a separate decision — the latter would supersede ADR 0005 — tracked outside this slice. A native search provider (FileSearchProvider / TextSearchProvider) over the mount is a possible follow-up.