docs: publish signed mobile preview installation details

Record the byte-verified Gitea preview assets while retaining the outstanding production HTTPS qualification.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

README.md

@@ -59,7 +59,7 @@ See [emulator testing](docs/EMULATOR.md) for an emulator demo, synthetic scans a
 
 ### Signed APK (direct install / MDM)
 
-For real devices. Requires an **HTTPS** server URL and the production-signed APK built with the QRun-owned key. Follow the [installation guide](docs/INSTALLATION.md) and [release readiness](docs/RELEASING.md). A signed 1.0.0 (versionCode 2) APK exists and was installed and launched on one MC9400, but it has not been qualified end to end, distributed or published, and no release exists. The development-signed and production-signed builds cannot update each other in place.
+For real devices. Requires an **HTTPS** server URL and the production-signed APK built with the QRun-owned key. Follow the [installation guide](docs/INSTALLATION.md) and [release readiness](docs/RELEASING.md). A signed 1.0.0 (versionCode 2) APK is published as a [signed preview release](https://git.kof22.com/QRun-IO/qqq-android/releases/tag/scanner-v1.0.0) (prerelease, forge sign-in required). It was installed and launched on one MC9400, but production HTTPS enrollment, physical scanning and in-place update have not been qualified, so it is not a stable release. The development-signed and production-signed builds cannot update each other in place.
 
 ## Build and test
 

docs/FINISH-1.0.md

@@ -1,6 +1,6 @@
 # Finish ledger for 1.0
 
-As of 2026-11-04. This is not a release and no 1.0 is published. Older ledgers are in [docs/history](history/README.md); the checklist is [TODO](TODO.md).
+As of 2026-11-04. A signed 1.0.0 preview is published (prerelease `scanner-v1.0.0`); there is no stable or fully qualified 1.0. Older ledgers are in [docs/history](history/README.md); the checklist is [TODO](TODO.md).
 
 | Area | State | Evidence / limit |
 | --- | --- | --- |
@@ -8,8 +8,8 @@ As of 2026-11-04. This is not a release and no 1.0 is published. Older ledgers a
 | Local demo | Accepted | Server on port 57832; TC22 development APK; operator-reported manual acceptance ALL PASS 2026-11-04 incl. label count/fidelity, camera, GPS, screen viewing (not instrumented, no per-case artifacts) |
 | Echo | Local semantic flow qualified | Printing and inputs simulated in disposable runs; physical label count/fidelity operator-reported pass (not instrumented) |
 | MC9400 | Demo-configured and approved | Physical trigger scan to backend not yet verified |
-| Signed APK | Built and verified locally, not distributed | 1.0.0 / versionCode 2; installed and launched once on an MC9400 before the demo switch; no end-to-end qualification |
-| Release | Not done | Needs HTTPS server, device qualification and distribution; no tag, no publication, no signing CI |
+| Signed APK | Published as signed preview | [scanner-v1.0.0](https://git.kof22.com/QRun-IO/qqq-android/releases/tag/scanner-v1.0.0), 1.0.0 / versionCode 2; APK and `SHA256SUMS` only, download-verified; installed and launched once on an MC9400 before the demo switch; no end-to-end qualification |
+| Release | Preview only, not stable | Needs HTTPS server and device qualification (enrollment, scanning, in-place update) before stable; no signing CI |
 | Authentik | Desktop passes; on-device callback unverified | No separate native provider/callback evidence |
 | Dependencies | Qualified inputs, not a public cohort | Generation, Record Files, Scripting owner inputs behind the local server |
 | MDM / company profile | Prepared, unverified | Nothing applied on a device |

docs/INSTALLATION.md

@@ -6,12 +6,14 @@ This guide is not the local demo. The demo uses the development-signed debug APK
 
 | Item | Value |
 | --- | --- |
-| File | `QQQ-Mobile-1.0.0.apk` (locally signed) |
+| Source | [Signed preview release scanner-v1.0.0](https://git.kof22.com/QRun-IO/qqq-android/releases/tag/scanner-v1.0.0) (prerelease; forge sign-in required) |
+| File | `QQQ-Mobile-1.0.0.apk`, with `SHA256SUMS` on the same release page |
 | Application ID | `io.qrun.mobile.scanner` |
 | Version | 1.0.0, versionCode 2 |
 | APK SHA-256 | `EE5AC896B8985AF6F11B2E883955925D6571A2913D74A4AACCDB564B79394D51` |
+| Signing certificate SHA-256 | `BDDB2D2F45A5925C643A83ABAF616C1EAB2387DC5CDA7B645A6F4C0D5B17A9FF` |
 
-The same APK is used for every customer; branding comes from the server at runtime. Compare the SHA-256 before installing. The checksum shows the file is intact, not who signed it.
+The same APK is used for every customer; branding comes from the server at runtime. Download the APK and `SHA256SUMS` from the release page and compare the SHA-256 before installing, then verify the signing certificate matches the value above. The checksum shows the file is intact, not who signed it. This is a preview, not a stable release. Only the APK and `SHA256SUMS` are hosted; there is no hosted install kit.
 
 This APK was installed and launched once on a fresh Zebra MC9400 (Android 13): install succeeded, the Connect screen appeared and the installed bytes matched the hash above. It has **not** been enrolled, scanned or navigated, because no HTTPS server was available, so these steps are not hardware-qualified until the first install is confirmed (below). That MC9400 now runs the development demo build instead.
 
@@ -23,7 +25,7 @@ This APK was installed and launched once on a fresh Zebra MC9400 (Android 13): i
 
 ## Install: copy the file (recommended)
 
-1. Copy `QQQ-Mobile-1.0.0.apk` to the device's **Downloads** folder.
+1. Copy the verified `QQQ-Mobile-1.0.0.apk` to the device's **Downloads** folder.
 2. Open **Files**, go to Downloads, and tap the APK.
 3. If Android asks, allow that Files app to install apps, then continue. You can turn the permission off again afterward.
 

docs/RELEASING.md

@@ -1,6 +1,6 @@
 # Scanner APK release readiness
 
-Status (November 4, 2026): **a QRun-owned production signing key exists with a verified backup, and a locally signed, verified 1.0.0 (versionCode 2) APK exists. It was installed and launched once on a fresh MC9400, but it has not been qualified end to end, distributed or published, and no release exists.** The owner selected direct signed-APK / MDM distribution. Current local demo devices (TC22 and, by the user's later choice, the MC9400) run the development-signed debug APK (0.1.0, versionCode 1) against the local HTTP server; that is not a production release. Manual TC22 acceptance was reported all-pass by the operator on November 4 (operator report, no per-case artifacts) for the development-signed build; it does not qualify the production signer and is not requested again for that build.
+Status (November 4, 2026): **a QRun-owned production signing key exists with a verified backup, and the signed 1.0.0 (versionCode 2) APK is published as a signed preview (Gitea prerelease, not a stable release): [scanner-v1.0.0](https://git.kof22.com/QRun-IO/qqq-android/releases/tag/scanner-v1.0.0), release ID 1361, tag on protected `main` `3eef6431ca39b6450cf764424d921a02b2afb9ab`. It was installed and launched once on a fresh MC9400, but production HTTPS enrollment, physical scanning and in-place update qualification are still pending.** The owner selected direct signed-APK / MDM distribution. Current local demo devices (TC22 and, by the user's later choice, the MC9400) run the development-signed debug APK (0.1.0, versionCode 1) against the local HTTP server; that is not a production release. Manual TC22 acceptance was reported all-pass by the operator on November 4 (operator report, no per-case artifacts) for the development-signed build; it does not qualify the production signer and is not requested again for that build.
 
 ## Decisions (made)
 
@@ -28,7 +28,9 @@ Status (November 4, 2026): **a QRun-owned production signing key exists with a v
 
 Version `1.0.0`, `versionCode` 2 was built unsigned (`lintRelease` and `assembleRelease`: 0 errors, 0 warnings, 2 information) from source matching protected `main` `0ae2101f082c241ca6a70462dc9ec3057aa6c906`; only documentation differs. It was then signed in isolation with `apksigner` on 2026-11-04 (16:22:05 UTC).
 
-**Signed artifact (local, complete):** `QQQ-Mobile-1.0.0.apk`, application ID `io.qrun.mobile.scanner`, SHA-256 `EE5AC896B8985AF6F11B2E883955925D6571A2913D74A4AACCDB564B79394D51`. Verification passed: signature schemes v2 and v3, exactly one signer whose certificate SHA-256 is `BDDB2D2F...5B17A9FF` (the fingerprint above), 16 KiB alignment, non-debuggable. The checksum shows integrity only, not signer correctness. The APK is not published or distributed and is kept outside this repository.
+**Signed artifact (local, complete):** `QQQ-Mobile-1.0.0.apk`, application ID `io.qrun.mobile.scanner`, SHA-256 `EE5AC896B8985AF6F11B2E883955925D6571A2913D74A4AACCDB564B79394D51`. Verification passed: signature schemes v2 and v3, exactly one signer whose certificate SHA-256 is `BDDB2D2F...5B17A9FF` (the fingerprint above), 16 KiB alignment, non-debuggable. The checksum shows integrity only, not signer correctness.
+
+**Published preview (2026-11-04):** release [scanner-v1.0.0](https://git.kof22.com/QRun-IO/qqq-android/releases/tag/scanner-v1.0.0) (Gitea ID 1361, prerelease, signed Git tag at `3eef6431`; the tag adds documentation only over app source `0ae2101f`) hosts exactly two assets: `QQQ-Mobile-1.0.0.apk` (14933499 bytes) and `SHA256SUMS` (88 bytes). Both were downloaded back and matched the same SHA-256. The forge requires sign-in to download. The local installation kit ZIP was **not** published and no bundle is hosted. Link the release page, not an individual asset URL. The APK is kept outside this repository.
 
 **Device evidence (MC9400, November 4):** the signed APK was installed on a fresh MC9400 (Android 13, EMDK present), launched without a startup crash, showed the Connect screen, and its installed bytes read back with the exact hash above. It was not enrolled: release builds require HTTPS and the only server available was the local HTTP demo. The same key and signer are unchanged. The user then chose to run the MC9400 in demo mode like the TC22, so that fresh, unenrolled production install was replaced with the development debug APK and port forwarding to the local server. No signed-build enrollment, scan or navigation was tested. The TC22 and its data were untouched throughout.
 
@@ -37,7 +39,7 @@ Remaining steps:
 1. Qualify the **actual production-signed APK** on a device: install, enrollment, scanner path ([Zebra scanning](ZEBRA-SCANNING.md)), Back/Apps navigation, and update over a prior production build. Use a planned device migration or a spare device; do not use a demo device implicitly, and note that moving a demo device to the signed build removes its development install and enrollment.
 2. Provide an **HTTPS** server. Source release builds disallow cleartext; HTTP is limited to debug builds. The local demo does not need HTTPS.
 3. Use the first direct installation to confirm the device flow, then distribute the same APK to the remaining devices. MDM can be introduced later.
-4. Automated scanner-APK signing/release workflow is not configured and is separate from manual distribution; create no tags or releases without current authorization.
+4. Automated scanner-APK signing/release workflow is not configured and is separate from manual distribution. The preview release exists; create no further tags or releases (including a stable promotion) without current authorization. A stable release needs the qualification in step 1.
 
 ## Release requirements
 
@@ -53,4 +55,4 @@ Development-signed demo installations (TC22, and the MC9400 in demo mode) cannot
 
 ## Not yet established
 
-Production-signed-APK device qualification, first distribution, an HTTPS production server, an automated scanner release workflow and its secret handling, and key-rotation planning. SDK publication by the central workflow is done and its completed audits are not reopened here. Other pending items are in [TODO](TODO.md).
+Production-signed-APK device qualification (the preview is published, but production HTTPS enrollment, scanning and in-place update are unqualified), stable-release promotion, an HTTPS production server, an automated scanner release workflow and its secret handling, and key-rotation planning. SDK publication by the central workflow is done and its completed audits are not reopened here. Other pending items are in [TODO](TODO.md).

docs/SESSION-STATE.md

@@ -1,6 +1,6 @@
 # Current status
 
-As of 2026-11-04. Scope: the scanner host and the local Echo workflow only. This is the authoritative current view; earlier rolling notes are historical and kept in [docs/history](history/README.md). Nothing here claims a finished or released 1.0. Checklist: [TODO](TODO.md). Ledger: [FINISH-1.0](FINISH-1.0.md).
+As of 2026-11-04. Scope: the scanner host and the local Echo workflow only. This is the authoritative current view; earlier rolling notes are historical and kept in [docs/history](history/README.md). Nothing here claims a stable or fully qualified 1.0; a signed preview is published. Checklist: [TODO](TODO.md). Ledger: [FINISH-1.0](FINISH-1.0.md).
 
 ## Source
 
@@ -25,8 +25,8 @@ As of 2026-11-04. Scope: the scanner host and the local Echo workflow only. This
 
 - Direct signed-APK / MDM distribution was chosen. A QRun-owned key exists (alias `qqq-mobile-release`, certificate SHA-256 `BDDB2D2F45A5925C643A83ABAF616C1EAB2387DC5CDA7B645A6F4C0D5B17A9FF`) with a verified backup. Key, passwords and vault details are not in this repository.
 - Signed `QQQ-Mobile-1.0.0.apk` (versionCode 2, SHA-256 `EE5AC896B8985AF6F11B2E883955925D6571A2913D74A4AACCDB564B79394D51`) exists locally, built from `main` application source: lint 0 errors/0 warnings, v2/v3 signature with the exact certificate, alignment and non-debuggable verified.
-- It is **not** published, tagged or distributed, and no production release exists. No automatic signing CI is configured. The signed artifact is kept outside the repository.
-- Production qualification needs an HTTPS server and a full device pass of the signed build ([RELEASING](RELEASING.md), [INSTALLATION](INSTALLATION.md)). The local demo does not need HTTPS; release builds reject HTTP.
+- It is published as a **signed preview**: Gitea prerelease [scanner-v1.0.0](https://git.kof22.com/QRun-IO/qqq-android/releases/tag/scanner-v1.0.0) (ID 1361, signed tag on protected `main` `3eef6431ca39b6450cf764424d921a02b2afb9ab`; app source matches `0ae2101f`, the tag adds documentation only). Hosted assets are the APK (14933499 bytes) and `SHA256SUMS` (88 bytes), both downloaded back and matching the hash above. The local installation kit ZIP was not published. Forge sign-in is required. This is not a stable release. No automatic signing CI is configured, and SDK CI publication is a separate path.
+- Production qualification (still pending) needs an HTTPS server and a full device pass of the signed build ([RELEASING](RELEASING.md), [INSTALLATION](INSTALLATION.md)). The local demo does not need HTTPS; release builds reject HTTP.
 
 ## Open (not claimed)
 

docs/TODO.md

@@ -21,7 +21,8 @@ As of 2026-11-04, scanner host and local Echo scope only. Narrative: [SESSION-ST
 - [x] Signed-APK/MDM channel chosen; QRun-owned key created with verified backup; signed 1.0.0 (versionCode 2) built and verified locally.
 - [x] Direct-install guide written ([INSTALLATION](INSTALLATION.md)).
 - [ ] Qualify the production-signed APK on a device against an HTTPS server (enrollment, scanner path, navigation, update).
-- [ ] First distribution to the remaining devices; MDM later. No tag or release exists.
+- [x] Signed preview published: Gitea prerelease `scanner-v1.0.0` (APK and `SHA256SUMS` only; local install kit not hosted).
+- [ ] Distribution to the remaining devices after qualification; MDM later. Promotion to a stable release needs the qualification above.
 - [ ] Automatic signing/publication pipeline: not configured; owned by the shared CI design, not needed for manual distribution.
 - [ ] Actual on-device Authentik callback (unverified; no separate evidence).