v0.3.1-preview.1

0.3.1-preview.1

Android 8.0 / API 26+. Download assetlib-android-0.3.1-preview.1.aar, verify it against SHA256SUMS (SHA-256 d3f725c1270987ae06da4f5f9cf0673e165f2b2fd7449537adfff367460a1bc3), and add the exact dependencies listed in the README; no Maven Central publication is claimed. Public configurations from the hosted console are unaffected.

• Rejects public configuration JSON over 4096 UTF-8 bytes, including unknown fields; the previous limit was 8192 bytes.
• Rejects duplicate exact-PEM pins and sets outside 1–16 keys. Every pin remains an Ed25519 SPKI PEM of at most 256 UTF-8 bytes.
• Rejects keyId without an explicit pinnedPublicKey, including when the ID matches the first set member. Known fields reject explicit nulls; optional keyIds must match the pin IDs in length and order. A single pin supplied alongside a set must belong to that set.
• Runs all 43 generated shared public-config cases and 39 pinned-envelope expectations, including a trusted set member other than the single pin and an untrusted signer. Set-only configurations remain supported.
• Keeps accepted configurations within the JSON bound when serialized again. Near the limit, toJson() omits redundant derived IDs and the duplicate first pin while preserving every ordered trusted pin and any explicit non-first single pin.
• Restores the instrumented AccessibilitySemanticsTest, its debug-only host activity and manifest, and the instrumentation targetSdk setting, which were missing from main when 0.3.0-preview.1 was tagged. Test-only; release sources are unchanged.
• The CI artifact is named assetlib-android-release instead of carrying a stale version.

Validation on October 9, 2026: codegen tests (2), 98 JVM unit tests with the optional hosted test skipped, lint, and the release build passed. See VERIFICATION.md.

No emulator or device run is claimed for this patch; the configuration changes are covered by the JVM tests.