Bring the release documents back in line with what the app now does

The checklist still recorded the first artefacts (aab 4 682 814, apk 2 081 955); re-measured at 4 836 490 and 2 155 563 and noted why they moved, that the permission set did not change, and that a stale hash is worse than no hash because it looks checked.

PRIVACY.md said the app keeps no copies of your files and deletes what you select directly. Both stopped being true when deletes started staging into the trash: the item is moved, not erased, and stays on the volume for 24 hours. A privacy policy that misdescribes deletion is not a small thing on a paid listing, so the deleting and retention sections now describe the trash, the index it keeps, and the one caveat that clearing app storage forgets the trash without emptying it.

Also flags that the screenshots show none of search, undo, trash or receiving a share.

docs/PLAY_RELEASE_CHECKLIST.md

@@ -40,14 +40,21 @@ rest are things you must do in the Play Console or with your own accounts.
 ./gradlew :app:lintDebug          # Android Lint
 ```
 
-- [x] **[code] verified 2026-10-14.** `bundleRelease` and `assembleRelease` both succeed
+- [x] **[code] re-verified 2026-10-15.** `bundleRelease` and `assembleRelease` both succeed
       with R8 minification and resource shrinking on.
-      - `app-release.aab` is **4 682 814 bytes**
-        (`sha256 9014627a8596397623404cb9d986af5019c5e33cf331c5d363427c140f121788`).
-      - `app-release.apk` is **2 081 955 bytes**, signed by the upload key above.
+      - `app-release.aab` is **4 836 490 bytes**
+        (`sha256 0c0702d3917e9b94f42dabfce8002cae6b9377ee4b25d054bf97f73b4c3a8652`).
+      - `app-release.apk` is **2 155 563 bytes**, signed by the upload key above.
       - Both report `versionCode=1 versionName=1.0.0 targetSdk=36` and exactly the
         permission set in step 4 — **no `INTERNET`**, so "nothing leaves the device" holds
         in the shipped artefact and not just in the source manifest.
+      - The figures moved from the first measurement (4 682 814 / 2 081 955) because of the
+        LZMA library behind `.xz` and 7z. The permission set did **not** change: the share
+        target, the file picker and the trash index all arrived without a single new
+        permission, which is the point of having designed them that way.
+      - ⚠️ **Re-measure after any further change.** These numbers are a record of a verified
+        artefact, not a constant — a stale hash here is worse than no hash, because it looks
+        checked.
 - [ ] Upload the **`.aab`** (not the APK) to the Play Console.
       ⚠️ **Expect a native-debug-symbols warning and ignore it.** Play finds
       `base/lib/<abi>/libandroidx.graphics.path.so`, which arrives transitively through
@@ -108,6 +115,11 @@ POST_NOTIFICATIONS
 - [ ] **Data safety** form: the app collects **nothing** and shares **nothing**. Answer "No"
       to collection, "No" to sharing, and state that data is not transmitted off the device.
 - [ ] Confirm the answers match [PRIVACY.md](../PRIVACY.md).
+- [ ] The app now keeps a small local SQLite index of staged deletes (the trash), so that a
+      deletion can be undone after a restart. It never leaves the device, so **"collects
+      nothing" is still the honest answer** — but if a form asks whether the app *stores*
+      anything, the truthful answer is "on the device only, and it is the user's own file
+      paths". [PRIVACY.md](../PRIVACY.md) should say so explicitly.
 - [ ] Content rating questionnaire: utility, no user-generated content, no ads.
 - [ ] Target audience: not directed at children.
 
@@ -125,6 +137,11 @@ graphic 1024×500, and the screenshots.
       whose app area is blank.
 - [ ] Expect the 7-inch set to be single-pane and the 10-inch set two-pane. That is the
       adaptive layout working, not an inconsistency — see the CHANGELOG.
+- [ ] The committed sets show browsing, a folder list, an image preview and storage usage.
+      **None of them show search, undo, the trash or receiving a share** — four features the
+      app now has. The existing shots stay accurate (no layout changed), so this is an
+      opportunity rather than a defect: two or three more captures would let the listing
+      advertise them. See `tools/make-store-screenshots.sh`.
 
 ## 7. Release tracks and pricing