Explain and fix a Filee that Explorer can't reach (#99)

[KnifeLemon]

Summary

Background (#99): a user found every GUI path dead after installing: the gesture, the shortcut, Explorer's "Convert with Filee", and dropping files on the main window (red no-entry cursor). The CLI worked and the log was empty. The likely cause is Filee running elevated while Explorer isn't, so UIPI blocks drag-drop, the selection read and the second instance's mutex and pipe. Nothing detected or logged this.

Elevation

• On Windows, Filee compares its integrity level with Explorer's (Elevation.Probe, ElevationState).
• When Filee is higher, it logs a warning and shows a banner on Home plus a one-time card. Both offer "Restart without administrator rights": release the mutex, relaunch through Explorer's shell (FindWindowSW(SWC_DESKTOP) → IShellDispatch2.ShellExecute), then quit. If the relaunch fails, Filee keeps running and says so.

Second instance

• If acquiring the mutex fails with access denied (an elevated Filee owns it), Filee logs it and shows a native message box.
• Forward reports Delivered, NoAnswer or AccessDenied. On failure it logs and tells the user once, using the shared mutex, instead of exiting silently.

Diagnostics

• Startup line: version, exe path, installed or portable, integrity levels, OS and argument count.
• Global unhandled exceptions are logged, through an early logger before Avalonia starts.
• A UI watchdog logs "blocked for N s" and "responsive again".
• Rate-limited logs for:
  • forwarded requests
  • drags that never reached the donut
  • empty selection shortcuts, with the foreground window class and process
  • the first drop-zone drag

Robustness

• ffmpeg -version and -encoders timeouts now really apply: async reads, and the process is killed on timeout.
• Engine statuses are computed in the background at startup.
• Unreachable UNC entries on PATH are skipped after 2 s.

Test plan

• Core 220, Engines 832, Cli 21, Platform 18 and App 288 passed. dotnet format is clean.
• New tests cover:
  • the watchdog (manual clock) and rate limiting
  • startup log format and the early logger
  • the restart sequence and its failure handling
  • the Home banner
  • SingleInstance NoAnswer, and AccessDenied (Windows, using a pipe ACL)
  • the integrity decision
  • background catalog checks, UNC detection and process timeout/kill
• Not verified for real: an actually elevated Filee, and the Explorer relaunch (ShellExecute). They need UAC.

Note: FfmpegConverter.VersionOf/EncodersOf overlap slightly with the hardware-encoding branch (#100).

🤖 Generated with Claude Code