test: select explicit scan-probe package targets

Map accepted control values to compile-time QA/E2E package literals
before constructing broadcasts. Unknown targets still return before any
send, and marker validation/actions/permissions/counts remain unchanged.
This makes the existing allowlist boundary explicit to static analysis
without suppressing CodeQL or forwarding the caller's target string.

Probe build/lint and the distinct-signer ordinary-UID device acceptance
pass: eight forged broadcasts create no extra process steps or records,
and the manual positive control saves. Production APKs are unchanged.
Static triage and fresh hosted analysis remain separate evidence.

Co-Authored-By: OpenAI GPT-6.1 (Codex) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

docs/SESSION-STATE.md

@@ -1,5 +1,9 @@
 # Session state
 
+## October 31 — published client checkpoint and probe target clarity
+
+Signed client checkpoint `d316567` is published to existing draftPR8 and the clean canonical feature checkout is fast-forwarded to it. Fresh hosted checks found two CodeQL intent-redirection annotations in the separate permissionless test probe. Inline static triage at that exact revision classified both as not actionable: the exact QA/E2E package allowlist dominates both fixed-action broadcast sends, no arbitrary activity/service is launched, and the probe adds no sender authority. No alert was dismissed or completed audit rewritten. The probe now maps accepted requests to explicit final package literals rather than forwarding even the validated caller string. Probe-only build/lint and repeated ordinary-UID eight-forgery/manual-positive acceptance pass; production APK hashes are unchanged. Publish this source clarity follow-up and inspect fresh CodeQL/client checks before release. Physical trigger and whole-handheld viewing scope questions remain pending.
+
 ## October 31 — final SDK/navigation candidate verified for publication
 
 All three Android Back handlers and the toolbar arrow now use one live Main-owned drawer-first action, preserving standalone fallbacks. The native regression first proved a real process-level bypass opening Leave behind the drawer; the corrected case passes with one actual Android Back, preserved process/draft and zero cancellations. It also covers seven other overlay/focus gates. Current source passes127 JVM tests,34 TC22 shared cases in115.717s and the additional overlay case in17.948s. A distinct-signer ordinary-UID test passes against the exact current QA APK: eight forged broadcasts cause zero extra process steps/records, while a manual positive control saves through the real API. Actual physical trigger proof is still false/pending; the barcode-visibility question is unanswered.

scanner-security-probe/README.md

@@ -2,6 +2,8 @@
 
 This test application has no network permission, target permissions, Activity, shared UID or external runtime dependency. Its exported control receiver creates new DataWedge-shaped intents under its own ordinary Android UID. It only accepts the disposable `.qa` and `.e2e` scanner package names and synthetic `probe-...` markers. It cannot target the normal scanner package.
 
+Accepted target requests select explicit compile-time package literals before any intent is constructed. The caller's package string is never forwarded to `setPackage`; every other target returns without sending.
+
 Build the QA target against the production factory, its test APK, and the probe:
 
 ```text

scanner-security-probe/src/main/java/io/qrun/mobile/scanner/probe/ScanProbeReceiver.java

@@ -17,10 +17,23 @@ public final class ScanProbeReceiver extends BroadcastReceiver
       {
          return;
       }
-      String target = control.getStringExtra("targetPackage");
+      String requestedTarget = control.getStringExtra("targetPackage");
+      final String target;
+      if("io.qrun.mobile.scanner.qa".equals(requestedTarget))
+      {
+         target = "io.qrun.mobile.scanner.qa";
+      }
+      else if("io.qrun.mobile.scanner.e2e".equals(requestedTarget))
+      {
+         target = "io.qrun.mobile.scanner.e2e";
+      }
+      else
+      {
+         setResultCode(2);
+         return;
+      }
       String marker = control.getStringExtra("marker");
-      if(!("io.qrun.mobile.scanner.qa".equals(target) || "io.qrun.mobile.scanner.e2e".equals(target)) ||
-         marker == null || !marker.matches("probe-[A-Za-z0-9-]{1,80}"))
+      if(marker == null || !marker.matches("probe-[A-Za-z0-9-]{1,80}"))
       {
          setResultCode(2);
          return;