build: adopt published QQQ RC.21 across scanner modules

Align the optional Record Files tests with BOM-managed JUnit engine and
parameterized support, avoiding the older API/newer engine mismatch.

Verified 182 scanner/demo/files/Echo tests with public QQQ dependencies,
179 Generation tests and 16 bridge tests with qualified owner inputs,
and all 15 real admin browser scenarios. Owner QBit release inputs and
physical acceptance remain open as documented.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

AGENTS.md

@@ -1,6 +1,6 @@
 # QQQ Mobile Scanners
 
-This is an application QBit and a separate local demo, using Java 21 and QQQ 4.1.0-RC.20.
+This is an application QBit and a separate local demo, using Java 21 and QQQ 4.1.0-RC.21.
 The Android host is maintained in [QRun-IO/qqq-android](https://github.com/QRun-IO/qqq-android).
 
 ## Build and verify

README.md

@@ -16,7 +16,7 @@ App discovery and process execution use the versioned semantic UI/UX API at `/qq
 
 ## Build
 
-Use Java 21 and Maven 3.9+. The implementation targets QQQ `4.1.0-RC.20`; QQQ `4.0.0` does not provide the password session exchange needed by this demo.
+Use Java 21 and Maven 3.9+. The implementation targets QQQ `4.1.0-RC.21`; QQQ `4.0.0` does not provide the password session exchange needed by this demo.
 
 ```powershell
 .\mvnw.cmd verify install

demo/pom.xml

@@ -7,7 +7,7 @@
    <properties>
       <maven.compiler.release>21</maven.compiler.release>
       <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-      <qqq.version>4.1.0-RC.20</qqq.version>
+      <qqq.version>4.1.0-RC.21</qqq.version>
    </properties>
    <dependencyManagement>
       <dependencies>

docs/SESSION-STATE.md

@@ -1,4 +1,15 @@
-## November 3 — publication preparation
+## November 3 — current checkpoint (supersedes everything below)
+
+- **Server source:** `45f9cbddb14999d28add02dd9a37e4ce018e282e` is signed and pushed on Gitea PR 7 (earlier "uncommitted" statements below are historical). The five `qqq.version` POM pins to public **QQQ 4.1.0-RC.21** (root, demo, Echo, Echo demo, record-files) and the record-files POM test fix below are included in this verified dependency update.
+- **Final RC.21 gate: PASS** (`C:/Users/james/.cache/qqq-rc21-copies-gate-076d059d8d0641d9a85874ec64008def/verified-summary.json`). 377 unique tests with zero failures, errors or skips and Checkstyle PASS: Generation 179 and Printing bridge 16 (`verify-recovery.log`); scanner 53, demo 8, mobile Record Files 18, Echo 68 and Echo demo 35 (`verify-consumers-junit-fixed.log`). Plus 15 real admin-browser E2E cases on public RC.21 (single, checked and query selection, first-N approve, revoke, end session, display name/description, location/online, screenshot widget). The three earlier MySQL network timeouts did not recur in the focused 31 or the full 179 runs; the original failure reports are retained.
+- **Owned source fix:** `integrations/record-files/pom.xml` drops the aggregate Jupiter 5.11.4 and uses the BOM-managed engine and params; the XML test classpath shows API, engine, params and platform all at 6.0.2.
+- **Dependency honesty:** the five owned scanner consumer modules resolve only public QQQ artifacts (core, rdbms, middleware, filesystem, openapi RC.21; frontend-next RC.35), and Generation's core is RC.21 too, so all 182 scanner-consumer tests use public QQQ modules. The 16 Printing-bridge owner tests still resolve three private `pu507` QQQ libraries (filesystem, Javalin, OpenAPI) transitively through the existing owner Printing POM, and the other owner qbits remain qualified private inputs. So: **377 pass with public core RC.21 plus qualified owner inputs; this is not a fully public or released cohort.** No normal-runtime core upgrade was performed.
+- **Generation copies:** canonical Git source is now `Website-Backend/third-party-src/qbit-document-generation`. Signed `aac68907e67906aeef4e0cd687d28bc98b738f8c` is pushed on `feature/echo-generation-copies`, based on the actual PR 343 head `8f473fa`. The isolated clone `C:/Users/james/.cache/qqq-generation-copies-git-20261103` has 13 paths (including the PostgreSQL migration and provenance); the 21/21 module manifest matches. Qualified: 179 Generation + 16 bridge tests (prior cohort) and a fresh real PostgreSQL 17 migration pass. Owner integration and public artifact publication are not acknowledged and remain pending. No peer active checkout was edited.
+- **Android:** `f72b90d08cf29d2785cef1d5c5e7eeaf75f9afd2` is signed and pushed to the existing AGit PR 10 head (read back independently over SSH). Gitea CI 3480 **succeeded** on it (unit-test, device-test, package, secrets, gate; root read the UI); root also verified a clean git merge-tree of f72b90d with actual `main` b75fdac and merged nothing. Pull requests #8 and #10 remain open; nothing is released. The updated normal APK (SHA-256 `4AAB6951D3B0ABDDD4F5A8DC6790DCD84233EE08179B68DB108BF77909AB850E`) is installed with the same signer and no data clear; Connected, Apps, Settings, portrait, location on and the system-wallpaper brand-only preview were verified. No wallpaper or profile was applied. Fresh: 222 JVM tests, lint 0 errors/0 warnings (2 info), APK builds, 23 Node tests, 255-file standards pass. A fresh disposable TC22 Echo ten-stage run passed 109/109 semantic requests (simulated inputs and printing).
+- **Authentik:** a fresh real desktop acceptance passed against the same isolated TLS fixture (nonce, A login, logout with old-cookie replay rejected, fresh B without clearing cookies, logout). The opt-in native harness is integrated and compiled and its 8 launcher guards pass. Native TC22 execution still needs the temporary CA and PIN interaction (pending); no trust bypass. The normal server on 57832 is unchanged and ready.
+- **Still open (not claimed):** Generation canonical owner integration and public reproducible inputs for the owner qbits; primary source CI, merge and release; the manual TC22 trigger, value/type, AIM, label count, rescan, photo, GPS, projection and profile checks (the operator is still remote); native Authentik CA, PIN and callback; and signing/distribution, deliberately last by user decision. The normal TC22 currently shows Echo setup, Copies 1, Connected.
+
+## November 3 — publication preparation (historical; superseded by the current checkpoint above)
 
 The scanner/Echo/demo sources for copies per scan, AIM/EAN/UPC fidelity and photo composition are in the working tree of `feature/echo-example`, ready for one signed commit and review (not yet committed). They declare no private artifact coordinates: Echo's POM states that copies need a Generation build with the print-copies change, and `integrations/record-files` now takes `qqq.version`, `mobile.version`, `recordfiles.version` and `collaboration.version` with the demo's defaults. The Generation copies change is ten hash-checked files; its eight existing files match the Kof22 release reactor's `third-party-src/qbit-document-generation` byte for byte (SHA-256 listed in `qqq-finish-server-ready-20261103.md`). No Git repository for Generation exists in these local directories: adoption belongs to the Kof22 release repository, so the change is a hash-verified file set, not a commit here. Nothing was built or pushed in this step.
 
@@ -213,7 +224,7 @@ Active plan: publish the companion Android checkpoint pinned to verified server
 
 ## Baseline and ownership
 
-- QQQ baseline: 4.1.0-RC.20. The local 4.0.0 middleware does not support Basic sign-in through `manageSession`; RC.20 does.
+- QQQ baseline: 4.1.0-RC.21 (public Maven Central; adopted 2026-11-03, gate pending). The local 4.0.0 middleware does not support Basic sign-in through `manageSession`; RC.20 and later do.
 - Backend agent: qbit main source, unit/integration tests and root POM.
 - Android agent: `qqq-android` source and scanner application module.
 - Toolchain agent: Android SDK installed after explicit user approval of required Google terms.

docs/TODO.md

@@ -1,6 +1,16 @@
 # QQQ Mobile Scanners TODO
 
-Latest checkpoint (November 2; supersedes older runtime/version and unrun-test notes):
+Current checkpoint (November 3; supersedes the notes below where they differ):
+
+- [x] Server `45f9cbd` is signed and pushed (Gitea PR 7). Android `f72b90d` is signed and pushed to the existing AGit PR 10 head and Gitea CI 3480 succeeded on it (pull requests #8 and #10 still open; not merged, not released). Updated normal APK installed without clearing data; fresh disposable TC22 Echo run passed 109/109 semantic requests (simulated inputs/printing).
+- [x] Final RC.21 gate PASS: 377 unique tests (Generation 179, Printing bridge 16, scanner 53, demo 8, mobile Record Files 18, Echo 68, Echo demo 35), zero failures/errors/skips, Checkstyle PASS, plus 15 real admin-browser E2E on public RC.21. The earlier MySQL timeouts did not recur (focused 31, full 179). Evidence: `C:/Users/james/.cache/qqq-rc21-copies-gate-076d059d8d0641d9a85874ec64008def/verified-summary.json`.
+- [x] Verified dependency update: five RC.21 POM pins and the record-files POM test fix (BOM-managed Jupiter engine/params, all 6.0.2).
+- [ ] This is public core RC.21 plus qualified owner inputs, not a fully public or released cohort: the 16 Printing-bridge tests still resolve three private `pu507` QQQ libraries through the owner Printing POM, and the other owner qbits remain qualified private inputs. Public reproducible owner inputs, primary source CI, merge and release remain open. No normal-runtime core upgrade was done.
+- [x] Generation copies: signed `aac68907e67906aeef4e0cd687d28bc98b738f8c` on `feature/echo-generation-copies` (base PR 343 head `8f473fa`) in `Website-Backend/third-party-src/qbit-document-generation`; 13 paths, 21/21 manifest match; real PostgreSQL 17 migration passes. [ ] Owner integration and public artifact publication not yet acknowledged.
+- [x] Fresh real Authentik desktop acceptance passes; native harness integrated (8 guards pass). [ ] Native TC22 run needs the temporary CA and PIN (pending); no trust bypass.
+- [ ] Manual physical checks: trigger, AIM, fidelity, label count, photo, GPS, projection. [ ] Signing and distribution last, by user decision.
+
+Previous checkpoint (November 2; historical, superseded by the current checkpoint above):
 
 - [x] Optional Copies per scan defaults to 1, accepts 1–100 and remains server-pinned for every scan/retry. Live on the original local server57832; normal TC22 setup shows 1.
 - [x] Verify 377 unique server/owner tests across the module runs, plus real TC22 ten-stage/116-request semantic acceptance with simulated scans/printing.

examples/echo/demo/pom.xml

@@ -16,7 +16,7 @@
    <properties>
       <maven.compiler.release>21</maven.compiler.release>
       <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-      <qqq.version>4.1.0-RC.20</qqq.version>
+      <qqq.version>4.1.0-RC.21</qqq.version>
       <mobile.version>0.1.0-SNAPSHOT</mobile.version>
       <echo.version>0.1.0-SNAPSHOT</echo.version>
       <generation.version>0.1.0-SNAPSHOT</generation.version>

examples/echo/pom.xml

@@ -16,7 +16,7 @@
    <properties>
       <maven.compiler.release>21</maven.compiler.release>
       <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-      <qqq.version>4.1.0-RC.20</qqq.version>
+      <qqq.version>4.1.0-RC.21</qqq.version>
       <mobile.version>0.1.0-SNAPSHOT</mobile.version>
       <!-- Echo's copies per scan needs a Generation build with the print-copies change (appended copies on
            DocumentGenerationService.Request and GenerationPorts.PrintRequest, supportsCopies on the printing bridge,

integrations/record-files/pom.xml

@@ -10,7 +10,7 @@
       <maven.compiler.release>21</maven.compiler.release>
       <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
       <!-- the same property names the root POM and the Echo demo use, with their defaults -->
-      <qqq.version>4.1.0-RC.20</qqq.version>
+      <qqq.version>4.1.0-RC.21</qqq.version>
       <mobile.version>0.1.0-SNAPSHOT</mobile.version>
       <recordfiles.version>0.1.0-SNAPSHOT</recordfiles.version>
       <collaboration.version>0.1.0-record-files-SNAPSHOT</collaboration.version>
@@ -29,7 +29,9 @@
       <dependency><groupId>com.kingsrook.qbits</groupId><artifactId>qbit-record-files</artifactId><version>${recordfiles.version}</version></dependency>
       <dependency><groupId>com.kingsrook.qbits</groupId><artifactId>qbit-record-files</artifactId><version>${recordfiles.version}</version><classifier>tests</classifier><type>test-jar</type><scope>test</scope></dependency>
       <dependency><groupId>com.h2database</groupId><artifactId>h2</artifactId><version>2.2.224</version><scope>test</scope></dependency>
-      <dependency><groupId>org.junit.jupiter</groupId><artifactId>junit-jupiter</artifactId><version>5.11.4</version><scope>test</scope></dependency>
+      <!-- no own version: the imported qqq BOM manages the Jupiter engine and params (6.0.2); the engine brings the matching API -->
+      <dependency><groupId>org.junit.jupiter</groupId><artifactId>junit-jupiter-engine</artifactId><scope>test</scope></dependency>
+      <dependency><groupId>org.junit.jupiter</groupId><artifactId>junit-jupiter-params</artifactId><scope>test</scope></dependency>
       <dependency><groupId>org.assertj</groupId><artifactId>assertj-core</artifactId><version>3.27.7</version><scope>test</scope></dependency>
    </dependencies>
    <build><directory>${project.basedir}/target/module</directory><plugins>

pom.xml

@@ -33,7 +33,7 @@
    <properties>
       <revision>0.1.0-SNAPSHOT</revision>
       <maven.compiler.release>21</maven.compiler.release>
-      <qqq.version>4.1.0-RC.20</qqq.version>
+      <qqq.version>4.1.0-RC.21</qqq.version>
    </properties>
    <dependencyManagement>
       <dependencies>