feat(scanner): complete device UX and Authentik acceptance harness

Add scan value and symbology feedback, optional status wallpaper and managed server/orientation configuration, proven AIM profile readback, and administrator-controlled viewing UI. Extend native Echo acceptance for per-scan copies and add an opt-in real-provider Authentik harness isolated to the disposable test package.

Verified: 222 JVM tests, lint with zero errors/warnings, debug/E2E/test APK builds, 23 Node tests and source standards. Updated TC22 Echo acceptance passes ten stages with simulated input/printing. Actual Authentik desktop acceptance passes; native Authentik and physical trigger/print validation remain pending. Normal TC22 updated with the matching signer and data preserved.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

README.md

@@ -42,7 +42,7 @@ The persistent footer shows **Checking**, **Connected**, or **Disconnected** wit
 
 ## Online-only behavior
 
-QQQ administrators can inspect session activity, end sessions, and request live viewing of the QQQ app from a session record. Viewing displays an indicator with **Stop viewing** on the handheld. Password/login screens and background apps cannot be mirrored. Foreground location reporting defaults on and can be disabled in Settings. It requires Android permission and enabled device location providers; scanning works without it. See [session behavior and limits](docs/UI-API.md#session-activity-and-screen-viewing).
+QQQ administrators can inspect session activity, end sessions, and request live viewing of the QQQ app from a session record. Viewing displays an informational indicator on the handheld; the app has no operator pause or stop control. Password/login screens and background apps cannot be mirrored. Optional whole-device sharing still requires Android consent and honors Android's system stop controls. Foreground location reporting defaults on and can be disabled in Settings. It requires Android permission and enabled device location providers; scanning works without it. See [session behavior and limits](docs/UI-API.md#session-activity-and-screen-viewing).
 
 Open **Settings → About QQQ Mobile** for the app version, Query mascot, [Dogfooding](https://www.qrun.io/dogfooding), [Query](https://www.qrun.io/query) and bundled open-source licenses. Public website links open in the external browser without adding session or device information.
 

deployment/company-profile/DEVICE-OWNER-ENROLLMENT.md

@@ -0,0 +1,12 @@
+# Device Owner enrollment (destructive, separate from the safe profile)
+
+Not generated and not part of `generate-company-profile.mjs`. Fully managed (Device Owner) provisioning is intended for a new or factory-reset handheld (`docs/DEVICE-PROVISIONING.md`, Android device management). Doing it wipes the device's data and settings, including the current scanner and printing setup.
+
+Do not start unless all of these are recorded and approved by the owner of the device fleet:
+
+1. The customer EMM/MDM, its enrollment method and Zebra OEMConfig package (`com.zebra.oemconfig.release` on Android 13+).
+2. A spare device, not the development TC22, with the ordinary safe profile already reviewed.
+3. The recovery route if the EMM or EHS locks the device out, and the factory-reset authority.
+4. Confirmation that the QQQ device approval and Android management states stay separate.
+
+Enrollment credentials, tokens and QR payloads belong in the EMM, never in this repository.

deployment/company-profile/generate-company-profile.mjs

@@ -0,0 +1,230 @@
+#!/usr/bin/env node
+/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
+// Renders a reviewable Zebra Enterprise Home Screen (EHS) config and, when the device is measured, a StageNow/MX
+// AppMgr document from one non-secret JSON profile. Only elements documented by Zebra are emitted; see
+// docs/COMPANY-PROFILE.md for the page citations. Nothing here installs, pushes or changes a device.
+//
+// Usage: node generate-company-profile.mjs <profile.json> <output-dir> [--require-ready]
+
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs"
+import { join } from "node:path"
+import { pathToFileURL } from "node:url"
+
+export const EHS_PACKAGE = "com.zebra.mdna.enterprisehomescreen"
+export const EHS_ACTIVITY = "com.zebra.mdna.enterprisehomescreen.HomeScreenActivity"
+const PACKAGE = /^[A-Za-z][A-Za-z0-9_]*(\.[A-Za-z][A-Za-z0-9_]*)+$/
+const TITLE_TOKENS = new Set(["bluetooth_address", "bluetooth_name", "imei_number", "mac_address", "network_host_name", "serial_number", "device_name"])
+const LOGO_EXTENSIONS = [".bmp", ".gif", ".jpg", ".png", ".webp"]
+const APP_ICON_EXTENSIONS = [".bmp", ".jpg", ".png"]
+const COLOR_NAMES = new Set(["red", "blue", "green", "black", "white", "gray", "cyan", "magenta", "yellow", "lightgray", "darkgray"])
+// Keys and values consumed by the app's RestrictionsManager reader (scanner-host res/xml/app_restrictions.xml).
+export const MANAGED_SERVER_KEY = "qqq_server_url"
+export const MANAGED_ORIENTATION_KEY = "qqq_orientation"
+export const MANAGED_ORIENTATIONS = ["SYSTEM", "PORTRAIT", "LANDSCAPE", "REVERSE_PORTRAIT", "REVERSE_LANDSCAPE"]
+const BLOCKED_WILDCARDS =/^com\.(a|an|and|andr|andro|androi|android)\*?$/
+
+/*******************************************************************************
+ ** Mirror the app's normalizeServerUrl for managed values: HTTPS origin only. Returns the normalized origin or null.
+ *******************************************************************************/
+export function managedServerUrl(value) {
+   if (typeof value !== "string" || value.length > 2048) return null
+   try {
+      const url = new URL(value.trim())
+      if (url.protocol !== "https:" || !url.hostname || url.username || url.password || url.search || url.hash || url.pathname !== "/") return null
+      return `https://${url.host}/`
+   } catch { return null }
+}
+
+/*******************************************************************************
+ ** Escape the five characters EHS's XML parser requires to be escaped.
+ *******************************************************************************/
+export function xml(value) {
+   return String(value).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;")
+}
+
+function devicePath(value, extensions, label, errors) {
+   if (value == null) return null
+   if (typeof value !== "string" || !value.startsWith("/enterprise/usr/") || value.split("/").includes("..") || !extensions.some((e) => value.toLowerCase().endsWith(e))) {
+      errors.push(`${label} must be an absolute /enterprise/usr/ path (persists across Enterprise Reset) ending in ${extensions.join(", ")}`)
+      return null
+   }
+   return value
+}
+
+function color(value, label, errors) {
+   if (value == null) return null
+   if (typeof value !== "string" || !(/^#([0-9A-Fa-f]{6}|[0-9A-Fa-f]{8})$/.test(value) || COLOR_NAMES.has(value))) errors.push(`${label} must be #RRGGBB, #AARRGGBB or a documented color name`)
+   return value
+}
+
+function validateTitle(title, errors) {
+   if (typeof title !== "string" || title.trim() === "") { errors.push("launcher.title is required"); return { text: "", dynamic: false } }
+   const tokens = [...title.matchAll(/\[([^\]]*)\]/g)].map((m) => m[1])
+   for (const token of tokens) if (!TITLE_TOKENS.has(token)) errors.push(`launcher.title token [${token}] is not a documented device ID`)
+   if (new Set(tokens).size > 1 || tokens.length > 1) errors.push("launcher.title may contain at most one device ID token")
+   if (title.replace(/\[[^\]]*\]/g, "").match(/[\[\]]/)) errors.push("launcher.title square brackets are only allowed around a documented device ID")
+   return { text: title, dynamic: tokens.length === 1 }
+}
+
+function validateApp(app, index, list, errors, { icons }) {
+   const where = `${list}[${index}]`
+   if (!app || typeof app !== "object") { errors.push(`${where} must be an object`); return null }
+   const pkg = app.package
+   if (typeof pkg !== "string" || !PACKAGE.test(pkg)) {
+      errors.push(`${where}.package must be an exact package name (wildcards are rejected: least privilege)`)
+      if (typeof pkg === "string" && (pkg.includes("*") && BLOCKED_WILDCARDS.test(pkg))) errors.push(`${where}.package wildcard is blocked by EHS`)
+      return null
+   }
+   if (pkg === EHS_PACKAGE) errors.push(`${where} must not list EHS itself`)
+   if (typeof app.label !== "string" || app.label.trim() === "") errors.push(`${where}.label is required`)
+   else if (app.label.length > 18) errors.push(`${where}.label is longer than 18 characters; EHS truncates it`)
+   if (app.activity != null && (typeof app.activity !== "string" || !PACKAGE.test(app.activity))) errors.push(`${where}.activity must be a class name`)
+   const icon = icons ? devicePath(app.icon, APP_ICON_EXTENSIONS, `${where}.icon`, errors) : null
+   return { label: app.label, package: pkg, activity: app.activity ?? "", icon }
+}
+
+function applicationTag(app, indent) {
+   const icon = app.icon ? ` icon="${xml(app.icon)}"` : ""
+   return `${indent}<application label="${xml(app.label)}" package="${xml(app.package)}" activity="${xml(app.activity)}"${icon}/>`
+}
+
+/*******************************************************************************
+ ** Validate a profile. Returns normalized values plus the inputs that are still missing before it can be installed.
+ *******************************************************************************/
+export function validate(profile) {
+   const errors = []
+   const missing = []
+   const warnings = []
+   const p = profile ?? {}
+   if (typeof p.profileId !== "string" || !/^[a-z0-9][a-z0-9-]{1,62}$/.test(p.profileId)) errors.push("profileId must be lowercase letters, digits and hyphens")
+   if (!Number.isInteger(p.revision) || p.revision < 1) errors.push("revision must be a positive integer")
+
+   const device = p.device ?? {}
+   for (const key of ["androidVersion", "mxVersion", "osBuild"]) if (!device[key]) missing.push(`device.${key}: measure on the target device before generating installable MX output`)
+   if (!p.ehs?.installedVersion) missing.push("ehs.installedVersion: select an EHS build supported on the measured firmware (docs checked: 8.0)")
+
+   const q = p.qqq ?? {}
+   if (typeof q.package !== "string" || !PACKAGE.test(q.package)) errors.push("qqq.package must be the existing QQQ package name")
+   if (typeof q.activity !== "string" || !PACKAGE.test(q.activity)) errors.push("qqq.activity must be a fully qualified activity class")
+   if (typeof q.label !== "string" || q.label === "" || q.label.length > 18) errors.push("qqq.label is required (18 characters or fewer)")
+   const endpoint = managedServerUrl(q.endpoint)
+   if (endpoint === null) errors.push("qqq.endpoint must be an https origin with no credentials, path, query or fragment (the app rejects anything else)")
+   else if (new URL(endpoint).hostname.endsWith(".invalid")) missing.push("qqq.endpoint: replace the placeholder with the company QQQ server URL")
+   if (q.orientation != null && !MANAGED_ORIENTATIONS.includes(q.orientation)) errors.push(`qqq.orientation must be one of ${MANAGED_ORIENTATIONS.join(", ")} or omitted`)
+
+   const l = p.launcher ?? {}
+   const title = validateTitle(l.title, errors)
+   const logo = devicePath(l.titleBarLogo, LOGO_EXTENSIONS, "launcher.titleBarLogo", errors)
+   const wallpaper = devicePath(l.wallpaper, LOGO_EXTENSIONS, "launcher.wallpaper", errors)
+   if (!logo) missing.push("launcher.titleBarLogo: company logo file and its /enterprise/usr path")
+   if (!wallpaper) missing.push("launcher.wallpaper: company wallpaper file and its /enterprise/usr path")
+   const textColor = color(l.iconLabelTextColor ?? "#FFFFFFFF", "launcher.iconLabelTextColor", errors)
+   const backgroundColor = color(l.iconLabelBackgroundColor ?? "#00FFFFFF", "launcher.iconLabelBackgroundColor", errors)
+   if (l.iconSize != null) errors.push("launcher.iconSize is unsupported: Zebra's snippet does not show where user_options sits in the config file")
+
+   const apps = []
+   if (!Array.isArray(p.permittedApps) || p.permittedApps.length === 0) errors.push("permittedApps must list at least the QQQ application")
+   else p.permittedApps.forEach((a, i) => { const v = validateApp(a, i, "permittedApps", errors, { icons: true }); if (v) apps.push(v) })
+   if (!apps.some((a) => a.package === q.package)) errors.push("permittedApps must include the qqq.package application")
+   if (new Set(apps.map((a) => a.package)).size !== apps.length) errors.push("permittedApps contains a duplicate package")
+   if (apps.length === 1) missing.push("permittedApps: administrator list of required Android companion apps (camera/photo picker, printing); only QQQ is listed")
+
+   const tools = []
+   ;(p.tools ?? []).forEach((a, i) => { const v = validateApp(a, i, "tools", errors, { icons: false }); if (v) tools.push(v) })
+
+   const r = p.restrictions ?? {}
+   for (const [key, allowed] of [["systemSettingsRestricted", [0, 1, 3]], ["recentAppsAccessDisabled", [0, 1]], ["recentAppsButtonDisabled", [0, 1, 2, 3]]]) {
+      if (!allowed.includes(r[key])) errors.push(`restrictions.${key} must be one of ${allowed.join(", ")} (explicit decision required)`)
+   }
+   if (r.systemSettingsRestricted === 3) warnings.push("systemSettingsRestricted 3 requires MX 11.7+ and OSx 11.5.21+ on the device")
+   if (r.systemSettingsRestricted === 1) warnings.push("systemSettingsRestricted 1 (EHS default) hides most Settings panels; confirm Bluetooth printer pairing and Wi-Fi workflows on a spare device")
+
+   const deploy = []
+   ;(p.deploy ?? []).forEach((d, i) => {
+      const where = `deploy[${i}]`
+      const known = [EHS_PACKAGE, q.package]
+      if (!d || !known.includes(d.package)) errors.push(`${where}.package must be EHS or the QQQ package`)
+      else if (!["Install", "Upgrade"].includes(d.action)) errors.push(`${where}.action must be Install or Upgrade`)
+      else if (typeof d.apk !== "string" || !d.apk.startsWith("/") || d.apk.split("/").includes("..") || !d.apk.endsWith(".apk")) errors.push(`${where}.apk must be an absolute on-device .apk path already staged`)
+      else deploy.push({ package: d.package, action: d.action, apk: d.apk })
+   })
+   if (!deploy.some((d) => d.package === EHS_PACKAGE)) missing.push("deploy: EHS APK on-device path (artifact delivery method and checksum are an administrator decision)")
+
+   return { errors, missing, warnings, normalized: { title, logo, wallpaper, textColor, backgroundColor, apps, tools, deploy, qqq: q, launcher: l, restrictions: r } }
+}
+
+/*******************************************************************************
+ ** Render enterprisehomescreen.xml. Tags not parameterized keep the values of Zebra's documented default file.
+ *******************************************************************************/
+export function renderEhs(profile, n) {
+   const qqqApp = n.apps.find((a) => a.package === n.qqq.package)
+   const lines = ["<?xml version=\"1.0\" encoding=\"utf-8\"?>", `<!-- profile ${xml(profile.profileId)} revision ${profile.revision}; generated for review, see docs/COMPANY-PROFILE.md. EHS docs 8.0. -->`, "<config>"]
+   lines.push("    <kiosk>", applicationTag(qqqApp, "        "), "    </kiosk>")
+   lines.push("    <applications>", ...n.apps.map((a) => applicationTag(a, "        ")), "    </applications>")
+   if (n.tools.length > 0) lines.push("    <tools>", ...n.tools.map((a) => applicationTag(a, "        ")), "    </tools>")
+   // EHS stores a hash here when an administrator sets the password in Admin Mode; it must never be authored.
+   lines.push("    <passwords>", "        <admin></admin>", "    </passwords>")
+   lines.push("    <preferences>")
+   lines.push(n.title.dynamic ? `        <title><value>${xml(n.title.text)}</value></title>` : `        <title>${xml(n.title.text)}</title>`)
+   if (n.logo) {
+      lines.push("        <title_bar_icon>", "            <title_bar_icon_disabled>0</title_bar_icon_disabled>", `            <title_bar_icon_file>${xml(n.logo)}</title_bar_icon_file>`)
+      lines.push(`            <reuse_custom_icon>${n.launcher.reuseLogoOnEhsScreens ? 1 : 0}</reuse_custom_icon>`, "        </title_bar_icon>")
+   }
+   lines.push(`        <icon_label_background_color>${xml(n.backgroundColor)}</icon_label_background_color>`, `        <icon_label_text_color>${xml(n.textColor)}</icon_label_text_color>`)
+   lines.push("        <orientation></orientation>", "        <auto_launch_enable>0</auto_launch_enable>", "        <service_auto_launch_enable>0</service_auto_launch_enable>")
+   lines.push(`        <wallpaper>${xml(n.wallpaper ?? "")}</wallpaper>`)
+   if (n.wallpaper) lines.push(`        <wallpaper_stretching_enabled>${n.launcher.wallpaperStretch ? 1 : 0}</wallpaper_stretching_enabled>`)
+   lines.push("        <kiosk_mode_enabled>0</kiosk_mode_enabled>", "        <keyguard_camera_disabled>1</keyguard_camera_disabled>", "        <keyguard_search_disabled>1</keyguard_search_disabled>")
+   lines.push("        <usb_debugging_disabled>1</usb_debugging_disabled>", `        <system_settings_restricted>${n.restrictions.systemSettingsRestricted}</system_settings_restricted>`)
+   lines.push(`        <recent_apps_button_disabled>${n.restrictions.recentAppsButtonDisabled}</recent_apps_button_disabled>`, `        <recent_apps_access_disabled>${n.restrictions.recentAppsAccessDisabled}</recent_apps_access_disabled>`)
+   lines.push("        <wireless_info>", `            <show_ip_address>${profile.launcher?.showIpAddress ? 1 : 0}</show_ip_address>`, "            <show_mac_address>0</show_mac_address>", "            <show_bssid>0</show_bssid>", "            <show_ssid>0</show_ssid>", "            <show_scan_result>0</show_scan_result>", "        </wireless_info>")
+   lines.push("        <screen_blanking>", "            <blanking_enabled>0</blanking_enabled>", "            <speed_threshold>10</speed_threshold>", "            <blanking_mode>1</blanking_mode>", "        </screen_blanking>")
+   lines.push("    </preferences>")
+   lines.push("</config>", "")
+   return lines.join("\n")
+}
+
+/*******************************************************************************
+ ** Render the StageNow/MX AppMgr document: optional APK installs, then EHS as the default launcher.
+ *******************************************************************************/
+export function renderMx(profile, n) {
+   const lines = ["<?xml version=\"1.0\" encoding=\"utf-8\"?>", `<!-- profile ${xml(profile.profileId)} revision ${profile.revision}; AppMgr only. Device ${xml(profile.device.model)} Android ${xml(profile.device.androidVersion)} MX ${xml(profile.device.mxVersion)}. -->`, "<wap-provisioningdoc>"]
+   for (const d of n.deploy) lines.push("    <characteristic version=\"4.2\" type=\"AppMgr\">", `        <parm name="Action" value="${d.action}" />`, `        <parm name="APK" value="${xml(d.apk)}" />`, "    </characteristic>")
+   lines.push("    <characteristic version=\"4.2\" type=\"AppMgr\">", "        <parm name=\"Action\" value=\"SetDefaultLauncher\" />", `        <parm name="Package" value="${EHS_PACKAGE}" />`, "    </characteristic>")
+   lines.push("</wap-provisioningdoc>", "")
+   return lines.join("\n")
+}
+
+/*******************************************************************************
+ ** Validate then write outputs. MX output is withheld until the device is measured.
+ *******************************************************************************/
+export function generate(profile, outDir) {
+   const { errors, missing, warnings, normalized } = validate(profile)
+   const report = { profileId: profile?.profileId, revision: profile?.revision, ready: false, errors, missing, warnings, files: [] }
+   if (errors.length > 0) return report
+   mkdirSync(outDir, { recursive: true })
+   const emit = (name, text) => { writeFileSync(join(outDir, name), text, "utf8"); report.files.push(name) }
+   emit("enterprisehomescreen.xml", renderEhs(profile, normalized))
+   // Android managed configuration for the EMM; withheld while the endpoint is still a placeholder.
+   if (!missing.some((m) => m.startsWith("qqq.endpoint"))) {
+      const managed = { [MANAGED_SERVER_KEY]: managedServerUrl(profile.qqq.endpoint) }
+      if (profile.qqq.orientation != null) managed[MANAGED_ORIENTATION_KEY] = profile.qqq.orientation
+      emit("managed-configuration.json", JSON.stringify(managed, null, 2) + "\n")
+   } else report.warnings.push("managed-configuration.json withheld: qqq.endpoint is still a placeholder")
+   const mxReady =!missing.some((m) => m.startsWith("device.") || m.startsWith("deploy:"))
+   if (mxReady) emit("stagenow-mx-appmgr.xml", renderMx(profile, normalized))
+   else report.warnings.push("stagenow-mx-appmgr.xml withheld: device measurements and EHS APK path are missing")
+   report.ready = missing.length === 0
+   writeFileSync(join(outDir, "profile-report.json"), JSON.stringify(report, null, 2) + "\n", "utf8")
+   report.files.push("profile-report.json")
+   return report
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+   const [input, outDir, ...flags] = process.argv.slice(2)
+   if (!input || !outDir) { console.error("usage: generate-company-profile.mjs <profile.json> <output-dir> [--require-ready]"); process.exit(64) }
+   const report = generate(JSON.parse(readFileSync(input, "utf8")), outDir)
+   console.log(JSON.stringify(report, null, 2))
+   if (report.errors.length > 0) process.exit(1)
+   if (flags.includes("--require-ready") && !report.ready) process.exit(2)
+}

deployment/company-profile/generate-company-profile.test.mjs

@@ -0,0 +1,125 @@
+/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
+import assert from "node:assert/strict"
+import { mkdtempSync, readFileSync, readdirSync } from "node:fs"
+import { tmpdir } from "node:os"
+import { join } from "node:path"
+import test from "node:test"
+import { EHS_PACKAGE, MANAGED_ORIENTATIONS, generate, managedServerUrl, validate, xml } from "./generate-company-profile.mjs"
+
+const example = () => JSON.parse(readFileSync(new URL("./profile.example.json", import.meta.url), "utf8"))
+const measured = () => {
+   const p = example()
+   Object.assign(p.device, { androidVersion: "14", mxVersion: "14.0.0.0", osBuild: "measured-build" })
+   p.ehs.installedVersion = "8.0"
+   p.qqq.endpoint = "https://qqq.company.test"
+   p.permittedApps.push({ label: "Camera", package: "com.example.camera", activity: null, icon: null })
+   p.deploy = [{ package: EHS_PACKAGE, action: "Install", apk: "/enterprise/usr/persist/EHS.apk" }]
+   return p
+}
+const out = () => mkdtempSync(join(tmpdir(), "company-profile-"))
+
+test("example is valid but reports every unmeasured input and withholds MX output", () => {
+   const dir = out()
+   const report = generate(example(), dir)
+   assert.deepEqual(report.errors, [])
+   assert.equal(report.ready, false)
+   assert.ok(report.missing.some((m) => m.startsWith("device.mxVersion")))
+   assert.ok(report.missing.some((m) => m.startsWith("permittedApps")))
+   assert.ok(report.missing.some((m) => m.startsWith("qqq.endpoint")))
+   assert.deepEqual(readdirSync(dir).sort(), ["enterprisehomescreen.xml", "profile-report.json"])
+})
+
+test("measured profile is ready and emits documented EHS and MX elements only", () => {
+   const dir = out()
+   const report = generate(measured(), dir)
+   assert.deepEqual(report.errors, [])
+   assert.equal(report.ready, true)
+   const ehs = readFileSync(join(dir, "enterprisehomescreen.xml"), "utf8")
+   assert.match(ehs, /<title><value>Company \[serial_number\]<\/value><\/title>/)
+   assert.match(ehs, /<wallpaper>\/enterprise\/usr\/company\/wallpaper\.png<\/wallpaper>/)
+   assert.match(ehs, /<usb_debugging_disabled>1<\/usb_debugging_disabled>/)
+   assert.match(ehs, /<kiosk_mode_enabled>0<\/kiosk_mode_enabled>/)
+   assert.match(ehs, /<admin><\/admin>/)
+   const mx = readFileSync(join(dir, "stagenow-mx-appmgr.xml"), "utf8")
+   assert.match(mx, /value="SetDefaultLauncher"/)
+   assert.match(mx, new RegExp(`name="Package" value="${EHS_PACKAGE.replace(/\./g, "\\.")}"`))
+   assert.doesNotMatch(ehs, /<admin>[^<]+<\/admin>/)
+   assert.doesNotMatch(mx + ehs, /token|secret/i)
+})
+
+test("security-weakening or undocumented inputs are rejected", () => {
+   const cases = [
+      (p) => { p.permittedApps.push({ label: "All", package: "com.android.*" }) },
+      (p) => { p.permittedApps.push({ label: "Wild", package: "com.mobility.*" }) },
+      (p) => { p.launcher.wallpaper = "/sdcard/wallpaper.png" },
+      (p) => { p.launcher.wallpaper = "/enterprise/usr/../x.png" },
+      (p) => { p.qqq.endpoint = "http://qqq.company.test" },
+      (p) => { p.qqq.endpoint = "https://user:pw@qqq.company.test" },
+      (p) => { p.launcher.title = "Dynamic [username]" },
+      (p) => { p.restrictions.systemSettingsRestricted = 2 },
+      (p) => { delete p.restrictions.recentAppsAccessDisabled },
+      (p) => { p.launcher.iconSize = "XL" },
+      (p) => { p.permittedApps.push({ label: "A very long label over limit", package: "com.example.long" }) },
+      (p) => { p.permittedApps = [{ label: "Other", package: "com.example.other" }] },
+      (p) => { p.deploy = [{ package: "com.evil.app", action: "Install", apk: "/enterprise/usr/persist/x.apk" }] },
+   ]
+   for (const mutate of cases) {
+      const p = measured()
+      mutate(p)
+      assert.ok(validate(p).errors.length > 0, mutate.toString())
+   }
+})
+
+test("managed configuration uses the app's exact keys and is withheld for a placeholder endpoint", () => {
+   const withheld = out()
+   const placeholder = generate(example(), withheld)
+   assert.ok(!readdirSync(withheld).includes("managed-configuration.json"))
+   assert.ok(placeholder.warnings.some((w) => w.startsWith("managed-configuration.json withheld")))
+
+   const dir = out()
+   const p = measured()
+   p.qqq.endpoint = " https://QQQ.Company.test "
+   p.qqq.orientation = "REVERSE_LANDSCAPE"
+   assert.deepEqual(generate(p, dir).errors, [])
+   assert.deepEqual(JSON.parse(readFileSync(join(dir, "managed-configuration.json"), "utf8")), {
+      qqq_server_url: "https://qqq.company.test/",
+      qqq_orientation: "REVERSE_LANDSCAPE",
+   })
+
+   const noOrientation = out()
+   generate(measured(), noOrientation)
+   assert.deepEqual(Object.keys(JSON.parse(readFileSync(join(noOrientation, "managed-configuration.json"), "utf8"))), ["qqq_server_url"])
+})
+
+test("managed server URL accepts only an https origin, mirroring the app", () => {
+   assert.equal(managedServerUrl("https://qqq.company.test"), "https://qqq.company.test/")
+   assert.equal(managedServerUrl("https://qqq.company.test:8443/"), "https://qqq.company.test:8443/")
+   for (const bad of ["http://qqq.company.test", "https://u:p@qqq.company.test", "https://qqq.company.test/app", "https://qqq.company.test/?x=1", "https://qqq.company.test/#f", "ftp://qqq.company.test", "nonsense", "", null, 7, `https://${"a".repeat(2100)}`]) {
+      assert.equal(managedServerUrl(bad), null, String(bad))
+      const p = measured()
+      p.qqq.endpoint = bad
+      assert.ok(validate(p).errors.length > 0, String(bad))
+   }
+})
+
+test("orientation must be an exact app value", () => {
+   for (const good of MANAGED_ORIENTATIONS) {
+      const p = measured()
+      p.qqq.orientation = good
+      assert.deepEqual(validate(p).errors, [])
+   }
+   for (const bad of ["portrait", "Landscape", "AUTO", "SENSOR", "", 90]) {
+      const p = measured()
+      p.qqq.orientation = bad
+      assert.ok(validate(p).errors.length > 0, String(bad))
+   }
+})
+
+test("XML special characters in labels are escaped", () => {
+   assert.equal(xml(`a&b<c>"d"'e'`), "a&amp;b&lt;c&gt;&quot;d&quot;&apos;e&apos;")
+   const p = measured()
+   p.permittedApps[1].label = "Pick & <Scan>"
+   const dir = out()
+   assert.deepEqual(generate(p, dir).errors, [])
+   assert.match(readFileSync(join(dir, "enterprisehomescreen.xml"), "utf8"), /label="Pick &amp; &lt;Scan&gt;"/)
+})

deployment/company-profile/profile.example.json

@@ -0,0 +1,41 @@
+{
+  "profileId": "example-company",
+  "revision": 1,
+  "device": {
+    "model": "TC22",
+    "androidVersion": null,
+    "mxVersion": null,
+    "osBuild": null
+  },
+  "ehs": {
+    "docsVersion": "8.0",
+    "installedVersion": null
+  },
+  "qqq": {
+    "package": "io.qrun.mobile.scanner",
+    "activity": "io.qrun.mobile.scanner.ScannerActivity",
+    "label": "QQQ Mobile",
+    "endpoint": "https://qqq.example.invalid",
+    "orientation": null
+  },
+  "launcher": {
+    "title": "Company [serial_number]",
+    "titleBarLogo": "/enterprise/usr/company/logo.png",
+    "reuseLogoOnEhsScreens": true,
+    "wallpaper": "/enterprise/usr/company/wallpaper.png",
+    "wallpaperStretch": false,
+    "iconLabelTextColor": "#FFFFFFFF",
+    "iconLabelBackgroundColor": "#00FFFFFF",
+    "iconSize": null
+  },
+  "permittedApps": [
+    { "label": "QQQ Mobile", "package": "io.qrun.mobile.scanner", "activity": "io.qrun.mobile.scanner.ScannerActivity", "icon": null }
+  ],
+  "tools": [],
+  "restrictions": {
+    "systemSettingsRestricted": 1,
+    "recentAppsAccessDisabled": 1,
+    "recentAppsButtonDisabled": 1
+  },
+  "deploy": []
+}

docs/ADR-DEVICE-SCREEN-VIEWING.md

@@ -6,12 +6,12 @@ The existing mobile-scanners 1.1 transport captures only eligible QQQ app conten
 
 The additive 1.2 contract advertises supported capture modes in the session heartbeat. Missing capabilities and missing mode fields mean `APP_CONTENT`. `DEVICE_SCREEN` is selected only by an authenticated, approved device operator using Android's own consent dialog. An administrator cannot grant that consent. The existing admin-only viewer and current device/session authorization remain mandatory; a mode change invalidates old leases and pixels. Each new lease and frame carries its mode, preventing a full-display frame from being accepted as app-content capture. The session record exposes the current mode to the administrator.
 
-Android uses a nonexported `mediaProjection` foreground service, an ongoing notification with Stop, one in-memory consent result, one virtual display and a bounded ImageReader. No audio, remote control, screen recording or saved screenshots are added. Frame size/rate/byte limits and ephemeral latest-only server retention stay unchanged. A single MobileSessionController owns heartbeats/uploads; device mode changes its capture source and allows background heartbeats while consent and the current authenticated session remain valid. Location telemetry retains its existing foreground-only rules.
+Android uses a nonexported `mediaProjection` foreground service, an ongoing informational notification, one in-memory consent result, one virtual display and a bounded ImageReader. No audio, remote control, screen recording or saved screenshots are added. Frame size/rate/byte limits and ephemeral latest-only server retention stay unchanged. A single MobileSessionController owns heartbeats/uploads; device mode changes its capture source and allows background heartbeats while consent and the current authenticated session remain valid. Location telemetry retains its existing foreground-only rules.
 
-Starting requires an explicit operator action and system approval for this sharing session, plus an enabled sharing notification. While waiting for an administrator's bounded lease, no frame is uploaded; absence of a lease times out after 30 seconds. Once viewing has begun, lease loss/expiry, network failure, operator/system Stop, device lock, approval loss, logout, server change or controller disposal invalidates capture immediately and releases projection/display/images/service. A service watchdog independently enforces the lease deadline even during encoding or an outstanding request. There is no automatic restart or remembered consent. Activity recreation may end sharing and require fresh consent; it must never silently broaden or revive a grant. Explicit/system Stop pauses all viewing; app-content viewing remains available through the existing Allow viewing control.
+Starting requires an explicit operator action and system approval for this sharing session, plus an enabled sharing notification. While waiting for an administrator's bounded lease, no frame is uploaded; absence of a lease times out after 30 seconds. Once viewing has begun, lease loss/expiry, network failure, system Stop, device lock, approval loss, logout, server change or controller disposal invalidates capture immediately and releases projection/display/images/service. A service watchdog independently enforces the lease deadline even during encoding or an outstanding request. There is no automatic restart or remembered consent. Activity recreation may end sharing and require fresh consent; it must never silently broaden or revive a grant. System Stop suspends viewing until a fresh sharing grant is started. The app has no Stop viewing, Allow viewing, or custom notification stop action. Android system consent and stop controls remain available.
 
 Implementation files: Android SessionScreen/MobileSessionApi/MobileSessionController, new DeviceScreenCaptureService and operator control, ScannerActivity wiring and manifest; server MobileSessionService/MobileScreenService/MobileSessionSchemas/ScreenSpec, session metadata/H2 additive migration and extension version. Existing standard rendering and authenticated session APIs are reused; no parallel media server or business-screen framework is added.
 
-Required tests cover old1.1 fallback, mode mismatch/lease rotation, revoked/ended sessions, bounded no-viewer timeout, late consent/capture after logout, denial/cancel/duplicate result, stale frame disposal, system Stop and notification Stop. Actual Android consent, background display capture, rotation/lock and protected-window behavior require a separate approved native test; synthetic tests do not establish physical capture acceptance.
+Required tests cover old1.1 fallback, mode mismatch/lease rotation, revoked/ended sessions, bounded no-viewer timeout, late consent/capture after logout, denial/cancel/duplicate result, stale frame disposal, system Stop. Actual Android consent, background display capture, rotation/lock and protected-window behavior require a separate approved native test; synthetic tests do not establish physical capture acceptance.
 
 Android's [official MediaProjection guide](https://developer.android.com/media/grow/media-projection) requires new consent for each projection session, one-use projection tokens and callback cleanup. Android14+ requires the mediaProjection foreground-service type/permission and supports display or app selection. The device-screen control requests the default display where supported and keeps the system confirmation visible. Protected windows remain protected by Android; we do not attempt to bypass them. A consenting user may expose other apps and notifications, which the control must explain before starting.

docs/COMPANY-PROFILE.md

@@ -0,0 +1,85 @@
+# Company scanner profile package
+
+Status 2026-11-02: **prepared, not applied.** Nothing here has been installed on, pushed to or tested against a device. No device, setting, credential or server was changed. The target device's Android build, MX version and installed EHS version have **not been measured**; Zebra documentation versions below are the documentation reviewed, not device facts. Context and layering: `docs/DEVICE-PROVISIONING.md`.
+
+Files: `deployment/company-profile/`
+
+| File | Purpose |
+| --- | --- |
+| `profile.example.json` | Non-secret parameters. Unmeasured or unknown values are `null` or placeholders on purpose. |
+| `generate-company-profile.mjs` | Validates the profile and renders `enterprisehomescreen.xml`, `managed-configuration.json` (once the endpoint is real) and `stagenow-mx-appmgr.xml` (only when the device is measured). No dependencies. |
+| `generate-company-profile.test.mjs` | `node:test` cases for rendering, withholding and rejection. |
+| `DEVICE-OWNER-ENROLLMENT.md` | The separate, destructive enrollment path. Not generated. |
+
+```text
+node deployment/company-profile/generate-company-profile.mjs my-profile.json out/ [--require-ready]
+node --test deployment/company-profile/
+```
+
+Exit 1 on validation errors; 2 with `--require-ready` while any input is still missing. `out/profile-report.json` lists `missing` and `warnings`. One shared APK serves every customer: customer differences are only profile values (title, logo, wallpaper, app list), never a build.
+
+## What the generated EHS file contains
+
+Only tags from Zebra's EHS 8.0 Advanced Settings (`techdocs.zebra.com/ehs/latest/guide/settings/`): `kiosk`, `applications`, `tools`, `passwords`, and in `preferences` the `title` (static, or `<value>` with one documented device-ID token), `title_bar_icon` (`title_bar_icon_disabled`, `title_bar_icon_file`, `reuse_custom_icon`), icon label colours, `orientation`, `wallpaper`, `wallpaper_stretching_enabled`, the keyguard/USB/settings/recent-apps tags, `wireless_info` and `screen_blanking`. Tags not parameterised keep the values of Zebra's documented default file. Constraints enforced from that page: images only under `/enterprise/usr` (the persistent location), documented image formats, app labels of at most 18 characters, XML escaping, no wildcard packages (rejected for least privilege), no EHS self-listing.
+
+Layout: EHS shows apps in listed order (links first when both exist). Arbitrary pixel placement is not a documented feature; folders are not in the pages reviewed and are not generated.
+
+Explicit non-goals, enforced by the generator: `usb_debugging_disabled` is always `1`, `kiosk_mode_enabled` is always `0`, no `bypass keyguard`, `<passwords>` is always empty, `launcher.iconSize` is rejected (the Zebra snippet does not show where `user_options` sits).
+
+## What the generated MX file contains
+
+`AppMgr` characteristics only (`techdocs.zebra.com/mx/appmgr/`): optional `Install`/`Upgrade` of an APK already on the device, then `SetDefaultLauncher` for `com.zebra.mdna.enterprisehomescreen` (EHS setup page, `.../ehs/latest/guide/setup/`). Characteristic version `4.2` is the version used in Zebra's examples; `SetDefaultLauncher` is listed as MX 4.1+. **Not generated:** AccessMgr (allowlist and permission grants can lock out settings or break the scanner; Zebra's schema needs a device-specific review) and file delivery of the EHS XML and images to `/enterprise/usr` (Zebra recommends StageNow, DNA Cloud or an EMM for moving files; the StageNow file-delivery parameters were not in the cached pages, so they are not guessed).
+
+## Hazards to review before any device
+
+1. **EHS defaults disable USB debugging.** Zebra: `usb_debugging_disabled` 1 "or if left unspecified will prevent user access to the file system and all ADB functionality". Installing EHS on the current development TC22 will cut ADB. Use a spare device; Zebra advises restoring USB debugging before uninstalling EHS.
+2. **Pushing the XML overwrites the existing file**, including the stored admin password hash. Set the EHS admin password in Admin Mode on a reference device; never author it. Decide whether to deploy that device's exported file.
+3. **`system_settings_restricted` 1 (default) hides most Settings panels** and Zebra warns it might prevent some MX features. Confirm Bluetooth printer pairing and Wi-Fi workflows. The profile requires this value explicitly.
+4. **Default launcher:** EHS must be re-designated after any reinstall. Test Home/Back/recovery before relying on it.
+5. **MediaProjection consent is still per session** on Android 14; nothing here grants it.
+6. **Managed bootstrap is consumed by the app, but only through an EMM.** `managed-configuration.json` is a reviewable key/value payload for the EMM's Android managed-configuration (app restrictions) field; StageNow/MX and the EHS XML do not deliver it, and no Zebra schema is claimed for it. See "Managed configuration" below.
+
+## Inputs still required (also in `profile-report.json`)
+
+- Measured on the target TC22: `device.androidVersion`, `device.mxVersion`, `device.osBuild`; choose and record `ehs.installedVersion` for that firmware (docs reviewed: EHS 8.0).
+- Company logo and wallpaper image files, delivered to `/enterprise/usr/...`, and their paths.
+- Real company `qqq.endpoint` (HTTPS origin) and optional `qqq.orientation`; the EMM to push them as app restrictions.
+- Administrator list of permitted Android companion apps (camera/photo picker, printing) with exact package and activity names from the device.
+- On-device EHS APK path and the artifact delivery/checksum method; the QQQ APK path if the profile should also deploy it.
+- Decisions: `systemSettingsRestricted`, recent-apps values, `show IP` visibility, who sets the EHS admin password, EMM versus StageNow, and whether a device-owner fleet is wanted.
+
+## Managed configuration (implemented in the shared APK)
+
+The app declares `res/xml/app_restrictions.xml` (manifest `android.content.APP_RESTRICTIONS`) and reads it with `RestrictionsManager` (`ManagedConfiguration.kt`). Two keys, both optional; unmanaged installs behave exactly as before.
+
+| Key | Values | Behaviour |
+| --- | --- | --- |
+| `qqq_server_url` | HTTPS origin only: no credentials, path, query or fragment; HTTP is rejected even in debug builds | No saved server: the connect form is prefilled with it and says the administrator configured it; the person still taps Connect. Different saved server: never switched silently. Settings shows a notice with "Use administrator's server", which runs the existing confirmed Change-server path (ends the session, logs out) and then shows the prefilled form. |
+| `qqq_orientation` | exactly `SYSTEM`, `PORTRAIT`, `LANDSCAPE`, `REVERSE_PORTRAIT`, `REVERSE_LANDSCAPE` | A bootstrap default applied when the managed value changes (last applied value is remembered); a later local choice stands until the administrator changes it again. Unknown values are rejected, not defaulted. |
+
+Changes are re-read when the host resumes and while it is resumed (system `ACTION_APPLICATION_RESTRICTIONS_CHANGED`, not exported). Rejected keys are tracked by name only; values are never logged. No credentials, business metadata or branding are accepted this way. In the profile: `qqq.endpoint` and optional `qqq.orientation` produce `managed-configuration.json` (withheld while the endpoint is a placeholder). The EMM must be told to push those two keys as app restrictions for `io.qrun.mobile.scanner`.
+
+## Dynamic status wallpaper (implemented, optional)
+
+EHS has no QQQ-user or IP field (title tokens are device IDs only; Wireless Info shows the IP when `show_ip_address` is 1, exposed as `launcher.showIpAddress`), so the shared APK carries an optional native live wallpaper: `QqqStatusWallpaperService`, declared with the system-only `BIND_WALLPAPER` guard. It is inactive until a person picks it: Settings → "Status wallpaper…" opens Android's standard live-wallpaper chooser preselected to it. Nothing is applied silently; no new permission and no second app.
+
+- **What it shows:** company brand name always (the server's public brand name/colour already used by the host, or the default). On the unlocked home screen only, also: signed-in display name, server host and the default network's IP (address and interface, via a network callback, no polling). Preview, lock screen, a locked keyguard, a missing keyguard service and lock-only wallpaper show the brand alone. Identity is withdrawn when the screen turns off or the wallpaper stops being visible.
+- **Freshness is not overstated.** The existing heartbeat runs only while the app is foreground. Shown while foreground: "Signed in: NAME". After the app leaves the screen: the name with "Last confirmed HH:mm (app in background)". After 15 minutes in the background the name is replaced by "Session unverified". States are UNKNOWN (new process, destroyed host), SIGNED_OUT and SIGNED_IN; the snapshot lives only in memory, so process death and server change return it to UNKNOWN, and logout, revocation and unauthorized responses clear the name. It holds no token, cookie, credential or session id and logs nothing.
+- **Limit:** a wallpaper is visible only where the launcher or a transparent window shows it. Whether EHS reveals it is unproven; EHS draws its own `<wallpaper>` image, so leave that empty when testing.
+
+## Status of the implementation
+
+| Item | Status |
+| --- | --- |
+| Wallpaper service, manifest/resources, managed configuration, settings entry, activity wiring | Compiled into the debug and E2E APKs built after the last source edit (2026-11-02 15:34). Not installed; not run on a device. |
+| JVM unit tests `WallpaperStatusTest` (13), `ManagedConfigurationTest` (8) | Pass in the host unit-test run after the last source edit. |
+| Generator tests for managed keys, URL and orientation | Seven generator tests pass (root run). |
+| Visibility behind EHS, lock-screen behaviour, keyguard/wake timing, Android 14 wallpaper flags on a TC22, EMM delivery of restrictions | **Untested on hardware.** |
+
+APIs used that should be confirmed by the build and a device, because the SDK jar was not readable in this session: `WallpaperService.Engine.getWallpaperFlags()` (API 34, guarded), `KeyguardManager.isKeyguardLocked`, `ConnectivityManager.registerDefaultNetworkCallback` (API 24), `RestrictionsManager.getApplicationRestrictions`, `WallpaperManager.ACTION_CHANGE_LIVE_WALLPAPER` / `EXTRA_LIVE_WALLPAPER_COMPONENT`, `ContextCompat.registerReceiver` with `RECEIVER_NOT_EXPORTED` (core 1.13.1).
+
+## Validation status
+
+- Authored against the cached Zebra pages `qqq-zebra-docs-ehs-settings.md`, `-ehs-setup.md`, `-mx-appmgr.md` and `-mx-accessmgr.md` (untrusted reference content; facts above cite their official page).
+- Seven generator tests pass (`node --test deployment/company-profile/`), including managed keys, URL and orientation.
+- Nothing has been validated against Zebra's StageNow importer or a device.

docs/FINISH-1.0.md

@@ -0,0 +1,21 @@
+# Current finish work — November 3
+
+Operator availability (November 3): physical handheld/printer checks are deferred until later today. Preserve the ready local demo; remote source/publication work can proceed independently. Printing owner confirms existing copies1–100 support. Generation owner adoption is still pending; all ten canonical paths match the handoff baseline.
+
+Echo Copies per scan is live in the normal local server57832. The optional field defaults to 1 and accepts 1–100; the selected quantity applies to each scan until Leave. The updated normal TC22 APK is installed with its data/sign-in/approval preserved; Connected and settings were verified. Original accounts, approval, database and printer configuration are retained. The emulator stays off and signing/distribution stays last by the user's decision.
+
+| Work | Verified state / remaining work |
+| --- | --- |
+| Copies per Echo scan | Implemented and live; server-pinned quantity, one job per scan and retry identity verified. Physical label count remains open. |
+| Semantic native Echo flow | Ten stages and 116/116 documented requests pass on the actual TC22 with simulated scanner inputs/printing: default 1, range rejection, selected 3 across two scans, recreation and Apps/Leave. |
+| Visible scan value/type/result | Installed in the verified normal APK; physical scan feedback awaits a trigger pull. |
+| Barcode fidelity/AIM | Server/renderer and candidate Android source tests pass; actual EMDK data/profile behavior and physical print/rescan remain unqualified. |
+| Company profile/wallpaper | Implementation installed; seven generator tests and system wallpaper preview pass. No company profile/wallpaper applied; managed deployment and lock-screen behavior await qualification. |
+| Record photos | Real Record Files/mobile integration and Echo photo flow are composed in the local server; authorization tests pass. Actual camera/gallery capture/upload remains open. |
+| Actual Authentik | Fresh real-provider desktop acceptance passes. Native harness is integrated/compiled; on-device callback still awaits temporary CA installation and device interaction. No trust bypass. |
+| GPS/whole-device viewing | Physical qualification remains open; required Android consent is retained. |
+| Publication | Generation copies handoff awaits canonical owner adoption; coherent public artifacts and primary Gitea CI remain open. Signing/distribution is explicitly last. |
+
+Verification: 377 unique server/owner tests across qualified module runs (Generation179, Printing16, scanner53, base demo8, mobile Record Files18, Echo68, composed demo35); 222 Android JVM tests (44 core/56 mobile/122 host); lint zero errors/warnings with two informational hints; debug/E2E/test APK compilation; 23 Node tests (eight Echo runner guards/seven profile generator/eight Authentik launcher guards). Tests and local demonstration do not establish a production 1.0 release.
+
+The normal installed APK is 4AAB6951D3B0ABDDD4F5A8DC6790DCD84233EE08179B68DB108BF77909AB850E (November 3, same-signer update, no data clear). Local discovery now advertises UI API1.10, mobile-scanners1.5, printing2.3 and mobile-record-files1.0. Runtime pointer: C:/Users/james/.cache/qqq-local-all-qbits-current.txt. Qualified copies gate pointer: C:/Users/james/.cache/qqq-copies-gate-current.txt. Native proof: scanner-host/build/native-device-e2e/echo-proof.json. Generation's isolated ten-file handoff is C:/Users/james/.cache/qqq-generation-copies-handoff.md; canonical owner source is untouched and no acknowledgement is claimed.

docs/NAVIGATION-UX.md

@@ -17,7 +17,7 @@ Every screen provides one **hamburger navigation drawer**, a clear current app/p
 | Diagnostics | Server reachability details, recent safe logs, retry/check connection and app/version information. Reachable from the connection footer and secondary menu. |
 | Administration | Approval and fleet management remain in QQQ administration. A handheld pending approval shows its short name and administrator instructions. |
 
-The default-on foreground location reporting toggle, permission recovery and actual provider/fix status belong under device settings. Android location permission is requested once when an approved signed-in session first becomes foreground with reporting enabled; denial leaves scanning usable. Camera permission is requested when the operator chooses Take photo. A live viewing indicator and Stop viewing control remain visible while an administrator is viewing the app; they are not hidden in settings.
+The default-on foreground location reporting toggle, permission recovery and actual provider/fix status belong under device settings. Android location permission is requested once when an approved signed-in session first becomes foreground with reporting enabled; denial leaves scanning usable. Camera permission is requested when the operator chooses Take photo. A live viewing indicator remains visible while an administrator is viewing the app. The app provides no pause or stop viewing control, including in Settings; Android's system consent and stop controls remain available for optional whole-device sharing.
 
 The owner also requires a device-local Orientation preference in Settings: System default, Portrait, Landscape, Reverse portrait and Reverse landscape. Persist the selection across app restarts and apply it across login, menus and processes. Use Android's activity orientation policy without changing system-wide rotation settings. Rotation or a policy change must preserve drafts and pending upload identity. Licenses belong in the same secondary Settings layer and must remain readable offline.
 

docs/REAL-AUTHENTIK-ACCEPTANCE.md

@@ -0,0 +1,68 @@
+# Real Authentik native acceptance (opt-in, physical TC22)
+
+This is the only test that runs the Android OAuth2 callback against a real provider. It is skipped by default
+(`RealAuthentikAcceptanceTest` needs `-e realAuthentik true`) and is never part of the synthetic E2E scenarios.
+Until it passes on the device, [AUTHENTICATION.md](AUTHENTICATION.md) makes no claim of an Android Authentik round trip.
+
+## What it exercises
+
+The unmodified flow: `oauth2.signIn` -> real AppAuth external browser -> the real provider -> the exported
+`OAuth2RedirectActivity` (`io.qrun.mobile.scanner.e2e.oauth://callback/oauth2redirect`) -> the real QQQ code exchange ->
+device pending -> real administrator approval (`mobileDeviceApprove`) -> catalog; then operator A's **Sign out of company**
+(RP-initiated, through the browser) and a fresh login of operator B without clearing any browser state. It asserts the
+principal QQQ shows (`Current User: ...`), exactly one ACTIVE session for the device, A's session no longer ACTIVE, B's
+different, an optional exact server actor, and that no password form is ever offered. It injects no callback, ActivityResult,
+token or discovery document.
+
+## Trust and transport
+
+- `scanner-host/src/e2e/res/xml/network_security_config.xml` (E2E package only) keeps system trust and the existing cleartext
+  `127.0.0.1` fixture traffic, and additionally lets the literal host `localhost` trust a **user-installed** CA over HTTPS only.
+  Nothing is pinned or bypassed; debug, qa and release builds are unchanged.
+- The temporary fixture CA must be installed by the person holding the device, through Android settings (a screen lock/PIN is
+  required), and removed afterwards. Neither this test nor the launcher installs, probes or changes trust. The browser must
+  also trust that CA, otherwise it shows a certificate warning: do not continue past it.
+
+## Prerequisites
+
+The provider fixture and QQQ are running (QQQ `https://localhost:18443`, Authentik `https://localhost:19443`) with the exact E2E
+callback registered for login and post-logout; a physical TC22 with `ANDROID_SERIAL` set only in the environment, unlocked and
+awake; the disposable packages absent; and a private config file **outside the repository** (it holds a live administrator
+session cookie):
+
+```json
+{
+   "fixtureType": "real-authentik-android",
+   "qqqOrigin": "https://localhost:18443",
+   "adminCookie": "<Cookie header value of an admin QQQ session; never printed>",
+   "operators": {
+      "A": { "display": "<exact Current User text for the first operator>", "actor": "<optional server actor value>" },
+      "B": { "display": "<exact Current User text for the second operator>", "actor": "<optional server actor value>" }
+   },
+   "sessionActorField": "<optional mobileSession column holding the actor; omit to skip>"
+}
+```
+
+## Run
+
+```text
+./gradlew :scanner-host:assembleE2e :scanner-host:assembleE2eAndroidTest
+node scripts/ci/real-authentik-android.mjs --config <private-config.json> --confirm-temporary-ca-installed
+node --test scripts/ci/real-authentik-android.test.mjs      # guard tests, no device needed
+```
+
+The launcher refuses emulators and any device that is not a Zebra TC22, refuses a config inside the checkout or with a different
+origin, and refuses if `io.qrun.mobile.scanner.e2e` or its `.test` package already exists (it never uses `install -r`). It adds
+`adb reverse` for `tcp:18443` and `tcp:19443` only when absent (never rebinding; a differing existing mapping is an error),
+never touches `tcp:8080` or any other mapping, never reads or changes the normal `io.qrun.mobile.scanner` package or its data,
+pushes the config through `run-as` stdin (never to shared storage), and afterwards removes only the pushed file, the two
+disposable packages and the reverse mappings it created. Output is fixed stage text and a PASS/failure sentence: no serial, URL,
+cookie, token or credential. The operator types provider credentials in the browser when an `ACTION:` line appears (bounds: 45 s
+for the browser to appear, 600 s per login, 300 s for company logout, 40 min total).
+
+## Limits
+
+No browser automation is included, so the operator enters credentials. The test cannot verify CA installation; a missing CA
+shows up as the browser never opening within the bound. Process death during the browser step loses the in-memory attempt by
+design; rerun. A pass proves this provider/server/package combination only; it is not production-provider, release-build or
+EMDK trigger qualification.

docs/SESSION-STATE.md

@@ -1,3 +1,27 @@
+## November 3 — final client installed; Authentik harness integrated
+
+The verified debug APK 4AAB6951D3B0ABDDD4F5A8DC6790DCD84233EE08179B68DB108BF77909AB850E is installed on the normal TC22 with the same signer and install -r. Existing sign-in, device approval and Connected status survived. Navigation, portrait setting, foreground-location toggle and the brand-only system wallpaper preview were verified; wallpaper was not applied. Feedback, managed configuration and AIM code are now installed, with physical trigger/fidelity still unqualified.
+
+Fresh verification passes 222 JVM tests, lint zero errors/warnings, debug/E2E/test APK builds, 23 Node tests and the 255-file source standard check. The updated disposable TC22 Echo suite passed all ten stages with every request matching semantic operations; simulated input/printing only. The actual Authentik desktop test passed again on November 3 with strict TLS: nonce rejection, operator A, company logout, old-cookie rejection and fresh operator B. The opt-in real Authentik Android harness is now in the repository and compiles; native execution awaits temporary CA installation/device interaction. No normal app/server trust change was made.
+
+Echo server source is signed and published at 45f9cbd in Gitea PR7. Generation copies now has an isolated canonical Git integration, with additive PostgreSQL migration verified on real PostgreSQL17. Shared source/dependency publication and hosted CI remain separate gates; no production 1.0 release or physical print claim. Earlier installed-APK/uncompiled-harness notes below are historical.
+
+## November 2 — Echo copies live and native acceptance complete
+
+Echo setup now exposes optional **Copies per scan**, default 1, range 1–100. The server pins it for the run and submits one job with that copy count for each scan. The normal TC22 is connected and left on the fresh setup screen showing 1. Its installed APK remains D8109C61E71660D2195337DA988F7F692CC4A0DBE95F61230930D6549CAB4D9B; no client upgrade was needed for this generic semantic field.
+
+Disposable TC22 Echo acceptance passed ten stages and 116/116 documented requests, including default 1, rejecting 0/101, selected 3 across two scans, recreation and Apps/Leave. Inputs and printing are simulated; physical label count is unconfirmed. The combined source passes 222 JVM tests, lint with zero errors/warnings, APK compilation and 15 Node tests. New scan-feedback, managed-profile/wallpaper and AIM source is not installed on the normal app.
+
+The existing local server on port 57832 now advertises mobile-scanners 1.5 and mobile-record-files 1.0, retaining the original database, approval, accounts and printer settings. Server/owner gates passed 377 unique tests across the qualified module runs. Generation copies changes remain in the isolated owner handoff, awaiting canonical adoption/publication. Physical trigger/print/rescan, camera/GPS/projection and native Authentik remain open; the operator is remote and temporary CA installation is unconfirmed. Signing/distribution stays last. Older checkpoints below are historical; see FINISH-1.0.md for the current ledger.
+
+## November 2 — administrator viewing controls
+
+Removed app-authored Stop viewing / Allow viewing, Stop device screen sharing and the custom notification Stop sharing action. The visible indicator, Android consent/system revocation, password/lifecycle guards, server authorization and lease expiry remain unchanged. The existing native regression verifies an informational non-clickable indicator with no stop/allow buttons, continued JPEG frames after resume, background frame clearing, administrator session termination and fresh login.
+
+Verification: 185 JVM tests (44 core, 56 mobileapp, 85 host), eight Node guard tests, lint zero errors/warnings (two existing informational hints), debug/QA/test APK builds, and the real TC22 session-monitor scenario passed; all 112 native requests matched published semantic operations. The disposable QA packages were removed. Whole-device Android consent was not rerun for this UI removal.
+
+Installed the verified debug APK D8109C61E71660D2195337DA988F7F692CC4A0DBE95F61230930D6549CAB4D9B on the normal TC22 with install -r and no data clear. The process restart required sign-in; restored the existing scanner account and verified Connected, the Echo catalog entry and existing approval. Local server57832 remains HTTP200 and the print service remains Running. This APK also contains the previously verified optional raw-scan metadata client, gated off against the unchanged installed mobile1.4 server. Existing unrelated source/test changes are preserved. No commits, publication or broader release work resumed for this scoped request.
+
 ## November 2 — current checkpoint
 
 Source candidate: immutable `ScannerCapture` retains SDK raw bytes as canonical Base64 before the callback returns and routes them through the ordinary semantic process payload. New optional fields are sent only after same-server discovery advertises mobile-scanners >=1.5,<2; older servers still receive the five legacy keys. Barcode text and symbology remain unchanged, scan/capture string representations are redacted, and a failed-submit regression proves the entire event is resent unchanged. Verification passes 185 JVM tests (44 core, 56 mobileapp, 85 host), lint with zero errors/warnings (two existing informational hints), debug/E2E APK builds and QA Android-test compilation. New native tests and operator installation have not run. The SDK configuration is unchanged and AIM extraction is not implemented by this transport slice.

docs/TODO.md

@@ -1,4 +1,17 @@
 # TODO
+Latest November 3 checkpoint:
+
+- [x] Install final client over the normal TC22 with signature match/data preserved; existing sign-in/approval and Connected verified. Settings include portrait, location reporting and working wallpaper preview.
+- [x] Fresh 222 JVM tests, lint zero errors/warnings, all APK builds, 23 Node tests and 255-file standards gate; updated ten-stage native Echo acceptance passes with simulated scans/printing.
+- [x] Integrate and compile opt-in real Authentik Android acceptance; real-provider desktop acceptance rerun passes all six phases with strict TLS.
+- [ ] Run real native Authentik after temporary CA installation/device interaction. Confirm physical scanner/label count/fidelity, camera/GPS/projection/profile behavior. Complete shared artifact publication/hosted CI; signing remains last.
+
+Current checkpoint (November 2, copies adoption; supersedes older source/runtime notes below):
+
+- [x] Verify optional Copies per scan through the actual generic native UI: default 1, range 1–100, selected 3 retained across two scans/recreation, and Apps/Leave; ten stages, 116 documented requests. Normal TC22 setup shows 1 against the updated local server.
+- [x] Combined candidate gate: 222 JVM tests, lint zero errors/warnings, debug/E2E/test APK compilation and 15 Node tests. Normal installed APK remains D8109C61; newer feedback/profile/wallpaper/AIM code is not installed.
+- [ ] Physically confirm label quantity and barcode fidelity. Native Authentik and camera/GPS/projection qualification remain open while the operator is remote; temporary CA installation is unconfirmed.
+- [ ] Coordinate canonical Generation copies adoption and coherent publication/CI. Signing/distribution remains last.
 
 - [x] Implement negotiated mobile1.5 raw-byte transport with immutable capture, same-server capability gating and byte-identical failed-request retry;185 JVM tests, lint0errors/0warnings, debug/E2E builds and QA test compilation pass.
 - [ ] Qualify new raw-byte delivery on TC22 and complete actual AIM extraction/decoder-profile checks. Current source leaves AIM absent and does not change hardware configuration; full Echo fidelity is still open.
@@ -105,3 +118,7 @@ Offline queue/background synchronization is deliberately outside version one.
 - [x] Implement named semantic process choices and qualify Echo native setup/two scans/rotation/Apps Leave onTC22 (169JVM,8guards,86documentedrequests; printing simulated).
 - [x] Real Echo host and owner adapters are composed and running in the single local server (see the Origin item above).
 - [ ] Print a physical label and rescan the exact value and type (tracked above).
+
+# Scoped administrator viewing update — November 2
+
+- [x] Remove app-authored viewing stop controls, verify the existing native session-monitor flow and install on TC22 with app data preserved. Retain the visible indicator, Android consent/system stop controls, server leases and authorization.

docs/UI-API.md

@@ -67,7 +67,7 @@ The approved, authenticated host sends foreground activity through the registere
 
 An administrator viewing the ordinary QQQ session record renews a short screen-viewing lease through its standard widget. The host uses PixelCopy on its own app-content rectangle only, at most once per second, bounded to 640×1280 pixels and 256 KiB JPEG. No OS screen, other application or remote control is exposed. Capture requires the resumed, focused, approved authenticated screen, completed rendering and a live lease. Password screens, loading transitions, backgrounding and logout block capture and clear the server's displayed frame. Screen/session state is checked after capture and immediately before upload. Lease timing uses server-relative duration and Android's monotonic clock, not the handheld wall clock. Frames are not saved locally.
 
-The operator sees a screen-viewing indicator and can stop viewing until they allow it again. Foreground location reporting defaults on when no saved choice exists; an explicit saved off choice is preserved. Settings exposes the reporting toggle, precise/approximate Android permission, provider availability and fix status. The host requests coarse and fine Android permission together once, on the first approved signed-in foreground session with reporting enabled. Denial never prevents scans or triggers repeated automatic prompts; Settings links to Android permission settings for recovery. Precise permission permits GPS updates, while approximate permission uses available network location. Device location providers must also be enabled; the reporting preference cannot turn on Android GPS. No background location permission is requested or background tracking performed. Updates stop outside approved signed-in foreground sessions or when reporting is disabled. Heartbeats report coordinates, accuracy and capture time only when a foreground fix exists; QQQ shows the age of the last known observation separately. Earlier clients stored no reporting preference, so a previously missing Android grant is not treated as an explicit reporting opt-out.
+The operator sees an informational screen-viewing indicator. The app provides no operator pause or stop controls; administrator viewing remains subject to server leases and authorization. Optional whole-device sharing still requires Android consent and honors system revocation. Foreground location reporting defaults on when no saved choice exists; an explicit saved off choice is preserved. Settings exposes the reporting toggle, precise/approximate Android permission, provider availability and fix status. The host requests coarse and fine Android permission together once, on the first approved signed-in foreground session with reporting enabled. Denial never prevents scans or triggers repeated automatic prompts; Settings links to Android permission settings for recovery. Precise permission permits GPS updates, while approximate permission uses available network location. Device location providers must also be enabled; the reporting preference cannot turn on Android GPS. No background location permission is requested or background tracking performed. Updates stop outside approved signed-in foreground sessions or when reporting is disabled. Heartbeats report coordinates, accuracy and capture time only when a foreground fix exists; QQQ shows the age of the last known observation separately. Earlier clients stored no reporting preference, so a previously missing Android grant is not treated as an explicit reporting opt-out.
 
 ## Record photos
 

qqq/android/mobileapp/src/main/java/com/kingsrook/qqq/frontend/android/mobileapp/viewmodel/ProcessViewModel.kt

@@ -69,6 +69,11 @@ open class ProcessViewModel : ViewModel() {
       private set
    var submissionError: String? by mutableStateOf(null)
       private set
+   /*******************************************************************************
+    ** Client-only widget state for this process instance. It survives step changes and recreation, is
+    ** replaced with the process, and is never submitted, saved, logged or shared between processes.
+    *******************************************************************************/
+   val widgetState = mutableStateMapOf<String, Any>()
    private var processComplete: Boolean by mutableStateOf(false)
    private var initializing = false
 

scanner-host/src/androidTest/java/io/qrun/mobile/scanner/RealAuthentikAcceptanceTest.kt

@@ -0,0 +1,273 @@
+/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
+package io.qrun.mobile.scanner
+
+import android.os.Bundle
+import androidx.compose.ui.semantics.SemanticsProperties
+import androidx.compose.ui.semantics.getOrNull
+import androidx.compose.ui.test.SemanticsMatcher
+import androidx.compose.ui.test.assertIsEnabled
+import androidx.compose.ui.test.hasClickAction
+import androidx.compose.ui.test.hasTestTag
+import androidx.compose.ui.test.hasText
+import androidx.compose.ui.test.isEnabled
+import androidx.compose.ui.test.junit4.createAndroidComposeRule
+import androidx.compose.ui.test.onAllNodesWithTag
+import androidx.compose.ui.test.onAllNodesWithText
+import androidx.compose.ui.test.onNodeWithTag
+import androidx.compose.ui.test.onNodeWithText
+import androidx.compose.ui.test.performClick
+import androidx.compose.ui.test.performTextReplacement
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import androidx.test.platform.app.InstrumentationRegistry
+import java.io.File
+import java.net.URI
+import java.util.concurrent.TimeUnit
+import okhttp3.OkHttpClient
+import org.json.JSONObject
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotEquals
+import org.junit.Assert.assertTrue
+import org.junit.Assume.assumeTrue
+import org.junit.Rule
+import org.junit.Test
+import org.junit.runner.RunWith
+
+/*******************************************************************************
+ ** Opt-in acceptance against the real fixture Authentik and real QQQ (docs/REAL-AUTHENTIK-ACCEPTANCE.md).
+ ** Skipped unless the instrumentation argument realAuthentik=true is passed, so ordinary runs never reach it.
+ ** Nothing here injects a callback, ActivityResult, token or discovery document, and nothing clears browser
+ ** state: the external browser, the exported callback activity and the QQQ code exchange run as in production.
+ ** The person holding the device types each operator's provider credentials into the browser themselves.
+ ** Progress is reported only as fixed stage names; no URL, query, token, cookie or credential is emitted.
+ *******************************************************************************/
+@RunWith(AndroidJUnit4::class)
+class RealAuthentikAcceptanceTest {
+   @get:Rule
+   val ui = createAndroidComposeRule<ScannerActivity>()
+   private val instrumentation = InstrumentationRegistry.getInstrumentation()
+   private val context get() = instrumentation.targetContext
+   private val client = OkHttpClient.Builder().callTimeout(20, TimeUnit.SECONDS).build()
+   private lateinit var admin: SessionAcceptanceClient
+   private lateinit var deviceId: String
+   private var actorField: String = ""
+
+   /*******************************************************************************
+    ** A signs in through the browser, company sign-out runs, then B must authenticate afresh.
+    *******************************************************************************/
+   @Test
+   fun browserCallbackThenCompanyLogoutThenFreshSecondOperator() {
+      assumeTrue(InstrumentationRegistry.getArguments().getString("realAuthentik") == "true")
+      check(context.packageName == "io.qrun.mobile.scanner.e2e") { "Requires the disposable E2E package" }
+      val file = File(context.filesDir, "real-auth.json")
+      val config = try { JSONObject(file.readText()) } catch (exception: Exception) { throw AssertionError("Fixture configuration is invalid") }
+      finally { file.delete() }
+      check(config.optString("fixtureType") == "real-authentik-android")
+      val server = URI(config.getString("qqqOrigin"))
+      check(server.scheme == "https" && server.host == "localhost" && server.port == 18443 && server.userInfo == null &&
+         server.query == null && server.fragment == null && server.path in setOf("", "/"))
+      val origin = "https://localhost:18443"
+      val operators = config.getJSONObject("operators")
+      val a = operators.getJSONObject("A")
+      val b = operators.getJSONObject("B")
+      check(a.getString("display") != b.getString("display")) { "Operators must have distinct display names" }
+      actorField = config.optString("sessionActorField")
+      admin = SessionAcceptanceClient(origin, config.getString("adminCookie"), client)
+
+      var lastSession: String? = null
+      try {
+         waitFor("QQQ server URL")
+         ui.onNodeWithText("QQQ server URL").performTextReplacement("$origin/")
+         click("Connect")
+         // OAuth2 is advertised: the browser button exists and no local password form is offered.
+         await("browser-login-offered") { ui.onAllNodesWithTag("oauth2.signIn").fetchSemanticsNodes().isNotEmpty() }
+         assertTrue("No password fallback may be offered", ui.onAllNodesWithText("Password").fetchSemanticsNodes().isEmpty())
+         stage("login-screen-verified")
+
+         // Operator A: real browser, real provider redirect, exported callback, real QQQ exchange.
+         browserLogin("A")
+         deviceId = DeviceCredentials(context, "$origin/").deviceId
+         assertTrue("A new device must wait for administrator approval", pendingShown())
+         stage("device-pending-A")
+         approveAndOpenCatalog()
+         assertPrincipal(a.getString("display"))
+         val sessionA = activeSession(a.optString("actor"))
+         stage("operator-A-verified")
+
+         // Optional company sign-out; no browser state is cleared by this harness.
+         companySignOut()
+         await("operator-A-session-ended") { sessionStatus(sessionA) != "ACTIVE" }
+         stage("operator-A-qqq-session-ended")
+         click("Log back in")
+
+         // Operator B must authenticate again; a silent reuse of A would show A as the principal.
+         await("browser-login-offered-B") { ui.onAllNodesWithTag("oauth2.signIn").fetchSemanticsNodes().isNotEmpty() }
+         browserLogin("B")
+         if (pendingShown()) approveAndOpenCatalog()
+         else await("catalog-B", 60) { catalogShown() }
+         assertPrincipal(b.getString("display"))
+         lastSession = activeSession(b.optString("actor"))
+         assertNotEquals("B must hold a different QQQ session than A", sessionA, lastSession)
+         stage("operator-B-verified")
+      } finally {
+         // End only the disposable device session; the supplied admin session belongs to root and is left alone.
+         lastSession?.let { runCatching { admin.apply("mobileSessionEnd", JSONObject().put("sessionId", it)) } }
+      }
+   }
+
+   /*******************************************************************************
+    ** Start AppAuth from the native button, require a real external browser, then wait for the operator.
+    *******************************************************************************/
+   private fun browserLogin(label: String) {
+      click("oauth2.signIn", tag = true)
+      stage("browser-$label-requested")
+      var browser: String? = null
+      await("external-browser-foreground-$label", 45) {
+         browser = foreignPackage()
+         browser != null || ui.onAllNodesWithTag("oauth2.message").fetchSemanticsNodes().isNotEmpty()
+      }
+      assertTrue(
+         "Browser sign-in never reached an external browser. Check temporary CA trust, reverse mappings and server advertisement.",
+         browser != null
+      )
+      stage("browser-$label-operator-enter-credentials")
+      // The provider's callback re-enters through the exported redirect activity; only then is the app foreground again.
+      await("callback-returned-$label", 600) {
+         activePackage() == context.packageName && (
+            pendingShown() || catalogShown() || ui.onAllNodesWithTag("oauth2.message").fetchSemanticsNodes().isNotEmpty())
+      }
+      assertTrue("Native sign-in did not complete after the browser returned", ui.onAllNodesWithTag("oauth2.message").fetchSemanticsNodes().isEmpty())
+      stage("callback-exchange-$label-complete")
+   }
+
+   /*******************************************************************************
+    ** Approve this device through the real administrator process, then re-check approval in the app.
+    *******************************************************************************/
+   private fun approveAndOpenCatalog() {
+      admin.apply("mobileDeviceApprove", JSONObject().put("deviceId", deviceId))
+      click("Check approval")
+      await("approved-catalog", 60) { catalogShown() }
+   }
+
+   /*******************************************************************************
+    ** The principal shown by QQQ comes from the provider claims QQQ validated, not from this harness.
+    *******************************************************************************/
+   private fun assertPrincipal(display: String) {
+      click("topBar.accountIcon", tag = true)
+      await("principal-visible") { ui.onAllNodesWithText("Current User:  $display").fetchSemanticsNodes().isNotEmpty() }
+      click("Close")
+   }
+
+   /*******************************************************************************
+    ** Run optional RP-initiated logout through the browser and require explicit completion.
+    *******************************************************************************/
+   private fun companySignOut() {
+      click("topBar.accountIcon", tag = true)
+      await("company-signout-offered", 30) { ui.onAllNodesWithText("Sign out of company").fetchSemanticsNodes().isNotEmpty() }
+      click("Sign out of company")
+      // The confirmation dialog explains the effect; its button carries the same label as the Account item.
+      await("company-signout-confirm") {
+         ui.onAllNodesWithText("Sign out of QQQ and continue in your browser", substring = true).fetchSemanticsNodes().isNotEmpty() &&
+            ui.onAllNodes(hasText("Sign out of company") and hasClickAction() and isEnabled()).fetchSemanticsNodes().size == 1
+      }
+      click("Sign out of company")
+      stage("company-signout-requested")
+      await("company-signout-browser", 45) { foreignPackage() != null }
+      stage("company-signout-operator-confirm-if-asked")
+      await("company-signout-returned", 300) {
+         activePackage() == context.packageName && ui.onAllNodesWithTag("oauth2.logoutMessage").fetchSemanticsNodes().isNotEmpty()
+      }
+      await("company-signout-result", 30) { logoutMessage().contains("Company sign-out") }
+      val message = logoutMessage()
+      assertTrue("Company sign-out must be verified complete", message.contains("Company sign-out completed.") && !message.contains("did not complete"))
+      stage("company-signout-verified")
+   }
+
+   /*******************************************************************************
+    ** The visible company sign-out progress/result text.
+    *******************************************************************************/
+   private fun logoutMessage(): String = ui.onNodeWithTag("oauth2.logoutMessage").fetchSemanticsNode().config
+      .getOrNull(SemanticsProperties.Text)?.joinToString("") { it.text }.orEmpty()
+
+   /*******************************************************************************
+    ** The single ACTIVE session for this device, optionally checked for its server-derived actor.
+    *******************************************************************************/
+   private fun activeSession(expectedActor: String): String {
+      var found: JSONObject? = null
+      await("active-session", 30) {
+         found = admin.sessions().singleOrNull { it.optString("deviceId") == deviceId && it.optString("status") == "ACTIVE" }
+         found != null
+      }
+      val row = requireNotNull(found)
+      if (actorField.isNotBlank() && expectedActor.isNotBlank()) assertEquals("Server actor must match the provider user", expectedActor, row.optString(actorField))
+      return row.getString("id")
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   private fun sessionStatus(id: String) = admin.sessions().single { it.getString("id") == id }.optString("status")
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   private fun pendingShown() = ui.onAllNodesWithText("An administrator must approve this device before you can run mobile apps.").fetchSemanticsNodes().isNotEmpty()
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   private fun catalogShown() = ui.onAllNodes(SemanticsMatcher("test tag starts with appHome.rowForApp:") {
+      it.config.getOrNull(SemanticsProperties.TestTag)?.startsWith("appHome.rowForApp:") == true
+   }).fetchSemanticsNodes().isNotEmpty()
+
+   /*******************************************************************************
+    ** The active window's package when it is neither this app nor system chrome (that is, the browser).
+    *******************************************************************************/
+   private fun foreignPackage(): String? = activePackage()?.takeIf { it != context.packageName && it != "com.android.systemui" && it != "android" }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   private fun activePackage(): String? {
+      val root = instrumentation.uiAutomation.rootInActiveWindow ?: return null
+      return try {
+         root.packageName?.toString()
+      } finally {
+         @Suppress("DEPRECATION") root.recycle()
+      }
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   private fun click(label: String, tag: Boolean = false) {
+      val matcher = (if (tag) hasTestTag(label) else hasText(label, substring = false)) and hasClickAction()
+      await("enabled-app-control") { ui.onAllNodes(matcher and isEnabled()).fetchSemanticsNodes().isNotEmpty() }
+      ui.onNode(matcher).assertIsEnabled().performClick()
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   private fun waitFor(text: String) = await("app-control") { ui.onAllNodesWithText(text, substring = false).fetchSemanticsNodes().isNotEmpty() }
+
+   /*******************************************************************************
+    ** Fixed stage identifiers only; the launcher maps them to operator instructions.
+    *******************************************************************************/
+   private fun stage(name: String) = instrumentation.sendStatus(0, Bundle().apply { putString("qqqStage", name) })
+
+   /*******************************************************************************
+    ** Bounded wait that keeps Compose's clock moving while the app is in the background.
+    *******************************************************************************/
+   private fun await(name: String, seconds: Long = 40, predicate: () -> Boolean) {
+      val deadline = System.nanoTime() + TimeUnit.SECONDS.toNanos(seconds)
+      var previous = System.nanoTime()
+      do {
+         val now = System.nanoTime()
+         ui.mainClock.advanceTimeBy(TimeUnit.NANOSECONDS.toMillis(now - previous).coerceAtLeast(16))
+         previous = now
+         if (predicate()) return
+         Thread.sleep(250)
+      } while (System.nanoTime() < deadline)
+      throw AssertionError("Real-provider stage did not complete within its bound: $name")
+   }
+}

scanner-host/src/androidTest/java/io/qrun/mobile/scanner/ScannerEndToEndTest.kt

@@ -13,10 +13,21 @@ import android.provider.MediaStore
 import android.util.Base64
 
 import androidx.compose.ui.test.hasClickAction
+import androidx.compose.ui.test.assert
+import androidx.compose.ui.test.assertHasNoClickAction
 import androidx.compose.ui.test.assertIsDisplayed
 import androidx.compose.ui.test.assertIsEnabled
 import androidx.compose.ui.test.assertIsNotEnabled
 import androidx.compose.ui.test.assertTextContains
+import androidx.compose.ui.test.assertTextEquals
+import androidx.compose.ui.test.SemanticsMatcher
+import androidx.compose.ui.semantics.SemanticsActions
+import androidx.compose.ui.semantics.SemanticsProperties
+import androidx.compose.ui.semantics.getOrNull
+import androidx.compose.ui.test.hasSetTextAction
+import androidx.core.view.WindowCompat
+import androidx.core.view.ViewCompat
+import androidx.core.view.WindowInsetsCompat
 import androidx.compose.ui.test.hasAnyAncestor
 import androidx.compose.ui.test.hasText
 import androidx.compose.ui.test.isEnabled
@@ -132,12 +143,35 @@ class ScannerEndToEndTest {
       val finalDocument = documents.last()
       // Persisted setup column holding the chosen document id; confirm against the server fixture schema.
       val documentColumn = "templateId"
+      // Persisted setup column and process field for the optional Copies per scan integer. The Echo owner must expose
+      // both; the Printing service's own limit is 1..100, and this test does not hard-code any other bound.
+      val copiesColumn = "copies"
+      val selectedCopies = 3
+      fun assertCopiesPinned(row: JSONObject) {
+         val pinnedCopies = row.opt(copiesColumn)
+         assertTrue("Setup must pin Copies per scan as the true JSON integer $selectedCopies the operator chose (found: $pinnedCopies); " +
+            "the Echo fixture run table must expose an integer '$copiesColumn' column",
+            pinnedCopies is Number && pinnedCopies.toLong() == selectedCopies.toLong())
+      }
       fun assertSetupPinned(row: JSONObject) {
          assertTrue("Setup must pin the selected printer and media once", row.getString("state") == "OPEN" &&
             row.getString("printerRecordId") == "fixture-printer" && row.getString("mediaId") == "fixture-4x6")
          val persisted = row.opt(documentColumn)
          assertTrue("Setup must persist the chosen document as the same integer id the choices returned",
             persisted is Number && persisted.toLong() == (finalDocument.first as Number).toLong())
+         assertCopiesPinned(row)
+      }
+
+      /*******************************************************************************
+       ** The metadata-driven integer control: a text field labelled by the server's field label, found by its set-text action.
+       *******************************************************************************/
+      val copiesField = hasText("Copies per scan") and hasSetTextAction()
+      fun copiesValue(): String? = ui.onNode(copiesField).performScrollTo().fetchSemanticsNode().config.getOrNull(SemanticsProperties.EditableText)?.text
+      fun enterCopies(value: String) {
+         ui.onNode(copiesField).performScrollTo().performTextReplacement(value)
+         // Dismiss the keyboard as a person would, so later read-only scan-display assertions measure the app, not this input.
+         ui.activityRule.scenario.onActivity { WindowCompat.getInsetsController(it.window, it.window.decorView).hide(WindowInsetsCompat.Type.ime()) }
+         ui.waitForIdle()
       }
 
       /*******************************************************************************
@@ -158,6 +192,9 @@ class ScannerEndToEndTest {
       waitFor("Printer")
       waitFor("Paper or label size")
       waitFor("Document")
+      waitFor("Copies per scan")
+      assertEquals("Copies per scan must default to 1 from the server's field metadata", "1", copiesValue())
+      stage("echo-copies-defaulted")
       ui.onAllNodesWithText("Choose a value").onFirst().performScrollTo().performClick()
       waitFor("Simulated printer")
       ui.onNodeWithText("Simulated printer").performClick()
@@ -193,10 +230,33 @@ class ScannerEndToEndTest {
       waitFor(finalDocument.second)
       assertTrue("Only the reselected document may remain chosen", firstDocument == finalDocument || ui.onAllNodesWithText(firstDocument.second).fetchSemanticsNodes().isEmpty())
       stage("echo-stale-document-cleared")
+      assertEquals("Reselecting a controlling choice must not disturb the independent Copies per scan value", "1", copiesValue())
+      // The field's advertised bounds (Printing's 1..100) are enforced by the renderer before any run is created.
+      for ((invalid, message) in listOf("0" to "Copies per scan is below the allowed minimum.", "101" to "Copies per scan exceeds the allowed maximum.")) {
+         enterCopies(invalid)
+         ui.onNodeWithText("Next", substring = false).performClick()
+         waitFor(message)
+         assertTrue("Invalid Copies per scan must not start setup", ui.onAllNodesWithText("Scanner ready. Press the handheld trigger.").fetchSemanticsNodes().isEmpty() &&
+            rows("echoFixtureRun").none { it.getString("id") !in priorRuns && it.optString("printerRecordId").isNotBlank() })
+      }
+      enterCopies(selectedCopies.toString())
+      assertEquals("The chosen quantity must be held by the metadata-driven integer field", selectedCopies.toString(), copiesValue())
+      stage("echo-copies-selected")
       ui.onNodeWithText("Next", substring = false).performClick()
       waitFor("Scanner ready. Press the handheld trigger.")
       assertTrue("Echo must not offer manual barcode input", ui.onAllNodesWithText("Manual barcode").fetchSemanticsNodes().isEmpty())
       assertTrue("Echo must not offer manual submission", ui.onAllNodesWithText("Submit barcode").fetchSemanticsNodes().isEmpty())
+      // The scan display is read-only and present although Echo disables manual entry; nothing opens the keyboard.
+      fun assertScanDisplay(barcode: String?, symbology: String?, status: String) {
+         ui.onNodeWithTag("scanner-barcode").performScrollTo().assertIsDisplayed()
+            .assert(SemanticsMatcher.keyNotDefined(SemanticsActions.SetText))
+         if (barcode != null) ui.onNodeWithTag("scanner-barcode").assert(hasText(barcode))
+         ui.onNodeWithTag("scanner-symbology").assertTextEquals("Symbology: ${symbology ?: "—"}")
+         ui.onNodeWithTag("scanner-status").assertTextEquals(status)
+         assertTrue("Read-only scan display must not open the keyboard",
+            ViewCompat.getRootWindowInsets(ui.activity.window.decorView)?.isVisible(WindowInsetsCompat.Type.ime()) != true)
+      }
+      assertScanDisplay(null, null, "Waiting for scan")
       val run = rows("echoFixtureRun").single { it.getString("id") !in priorRuns }
       val runId = run.getString("id")
       assertSetupPinned(run)
@@ -216,6 +276,7 @@ class ScannerEndToEndTest {
          val row = requireNotNull(accepted)
          receipt = row.getString("mobileScanId")
          waitFor("Print queued $receipt", substring = true)
+         assertScanDisplay(sample.first, sample.second, "Confirmed by server")
          assertTrue("Accepted Echo scans must preserve exact type and approved-device attribution",
             row.getString("symbology") == sample.second && row.getString("rendererSymbology") == (if (index == 0) "code128" else "qr") &&
                row.getString("scanSource") == "e2e-fixture" && row.getString("deviceId") == device.deviceId && row.getString("actorId") == "scanner")
@@ -230,10 +291,13 @@ class ScannerEndToEndTest {
       waitFor("Print queued $receipt", substring = true)
       ui.activityRule.scenario.recreate()
       waitFor("Print queued $receipt", substring = true)
+      assertScanDisplay("000-ECHO-QR", "QRCODE", "Confirmed by server")
       assertTrue("Recreation must retain scan phase without showing printer selection", ui.onAllNodesWithText("Choose a value").fetchSemanticsNodes().isEmpty())
       val acceptedRows = rows("echoScan").filter { it.optString("runId") == runId }
       assertTrue("Rotation/recreation must not accept another event", acceptedRows.size == 2 && acceptedRows.map { it.getString("eventId") }.toSet().size == 2 &&
          acceptedRows.map { it.getString("printJobId") }.toSet().size == 2)
+      assertSetupPinned(rows("echoFixtureRun").single { it.getString("id") == runId })
+      stage("echo-copies-persisted")
       stage("echo-recreation-stable")
       ui.onNodeWithTag("topBar.menuIcon").performClick()
       ui.onNodeWithTag("drawer.home").performClick()
@@ -242,6 +306,7 @@ class ScannerEndToEndTest {
       waitForTag("appHome.rowForApp:echo")
       waitForServer { rows("echoFixtureRun").single { it.getString("id") == runId }.getString("state") == "CLOSED" }
       assertTrue("Leaving must close this run without accepting extra print work", rows("echoScan").count { it.optString("runId") == runId } == 2)
+      assertCopiesPinned(rows("echoFixtureRun").single { it.getString("id") == runId })
       stage("echo-run-closed")
    }
 
@@ -477,9 +542,11 @@ class ScannerEndToEndTest {
          screenWidget()
          ui.onAllNodesWithText("Screen being viewed by an administrator").fetchSemanticsNodes().isNotEmpty()
       }
-      ui.onNodeWithText("Stop viewing").performClick()
-      waitFor("Screen viewing paused")
-      waitForServer { screenWidget().toString().contains("OPERATOR_PAUSED") && findImage(screenWidget()) == null }
+      // Scanner users have no in-app control to pause or disable administrator viewing.
+      assertTrue("No in-app Stop viewing control", ui.onAllNodesWithText("Stop viewing").fetchSemanticsNodes().isEmpty())
+      assertTrue("No in-app Allow viewing control", ui.onAllNodesWithText("Allow viewing").fetchSemanticsNodes().isEmpty())
+      ui.onNodeWithText("Screen being viewed by an administrator").assertHasNoClickAction()
+      waitForServer { findImage(screenWidget()).orEmpty().startsWith("data:image/jpeg;base64,") }
       val launch = processCall("mobileSessionEnd", "/init", JSONObject())
       val applied = processCall("mobileSessionEnd", "/${launch.getString("processUUID")}/step/input", JSONObject().put("sessionId", sessionId))
       if (applied.optString("nextStep") == "result") processCall("mobileSessionEnd", "/${launch.getString("processUUID")}/step/result", JSONObject())
@@ -707,11 +774,65 @@ class ScannerEndToEndTest {
       assertEquals("scanner", scans.single().getString("userId"))
       assertEquals("manual", scans.single().getString("scanSource"))
       assertTrue(scans.single().has("receivedAt"))
+
+      // Scanner-sourced fixture event with exact raw bytes (NUL, high bytes, embedded ]Q1) and an explicit AIM
+      // identifier, delivered through the disposable e2e driver. Text, type and bytes are fixed and non-sensitive.
+      val scannedBarcode = "000-NATIVE-RAW-0123"
+      val scannedSymbology = "LABEL-TYPE-QRCODE"
+      val rawBytes = byteArrayOf(0x00, 0xFF.toByte(), 0x80.toByte(), ']'.code.toByte(), 'Q'.code.toByte(), '1'.code.toByte(), 'A'.code.toByte(), 0x00, 0xFE.toByte())
+      // The same >=1.5 negotiation rule as production, read independently from public discovery of this scenario's server.
+      val fidelityNegotiated = mobileScannersAtLeast15()
+      fun scanRows() = jsonRequest("/qqq/v1/table/mobileScan/query", JSONObject()).getJSONArray("records")
+      val beforeScan = scanRows().length()
+      waitFor("Scanner ready. Press the handheld trigger.")
+      context.sendBroadcast(Intent("io.qrun.mobile.scanner.SCAN").setPackage(context.packageName)
+         .addCategory(Intent.CATEGORY_DEFAULT).putExtra("com.symbol.datawedge.data_string", scannedBarcode)
+         .putExtra("com.symbol.datawedge.label_type", scannedSymbology)
+         .putExtra("io.qrun.mobile.scanner.e2e.raw_data", rawBytes)
+         .putExtra("io.qrun.mobile.scanner.e2e.aim_identifier", "]Q1"))
+      var scanned: JSONObject? = null
+      waitForServer {
+         val rows = scanRows()
+         scanned = (0 until rows.length()).map { rows.getJSONObject(it).getJSONObject("values") }
+            .singleOrNull { it.optString("barcode") == scannedBarcode }
+         scanned != null
+      }
+      val persisted = requireNotNull(scanned)
+      // The acknowledgment names this event's id, so it cannot be the earlier manual acknowledgment.
+      waitFor("Saved scan ${persisted.getString("id")}", substring = true)
+      assertEquals("e2e-fixture", persisted.getString("scanSource"))
+      assertEquals(device.deviceId, persisted.getString("deviceId"))
+      assertEquals(scannedBarcode, persisted.getString("barcode"))
+      assertEquals(scannedSymbology, persisted.getString("symbology"))
+      if (fidelityNegotiated) {
+         assertTrue("Persisted raw bytes must equal the exact bytes sent, including NUL and high bytes",
+            rawBytes.contentEquals(Base64.decode(persisted.getString("rawDataBase64"), Base64.NO_WRAP)))
+         assertEquals("]Q1", persisted.getString("aimIdentifier"))
+      } else {
+         assertTrue("A server without scan fidelity must receive and persist legacy fields only",
+            persisted.isNull("rawDataBase64") && persisted.isNull("aimIdentifier"))
+      }
+      assertEquals("One scanner event must create exactly one durable scan", beforeScan + 1, scanRows().length())
+      stage(if (fidelityNegotiated) "native-raw-scan-persisted" else "native-legacy-scan-persisted")
+
+      val beforeRevoke = scanRows()
       runAdmin("mobileDeviceRevoke", device.deviceId)
       // The active heartbeat revokes the open UI as well as protected process submissions.
       waitFor("Log back in")
-      val afterRevoke = jsonRequest("/qqq/v1/table/mobileScan/query", JSONObject()).getJSONArray("records")
-      assertEquals("Revoked devices cannot save through an already-open process", records.length(), afterRevoke.length())
+      val afterRevoke = scanRows()
+      assertEquals("Revoked devices cannot save through an already-open process", beforeRevoke.length(), afterRevoke.length())
+   }
+
+   /*******************************************************************************
+    ** Public, credential-free discovery: mobile-scanners at its fixed path with version >=1.5.0 and <2.
+    *******************************************************************************/
+   private fun mobileScannersAtLeast15(): Boolean {
+      val discovery = executeJson(Request.Builder().url("$origin/qqq/v1/version").get().build())
+      val extensions = discovery.optJSONArray("extensions") ?: return false
+      val extension = (0 until extensions.length()).map { extensions.getJSONObject(it) }.singleOrNull { it.optString("name") == "mobile-scanners" } ?: return false
+      if (extension.optString("pathPrefix") != "/qbit/mobile-scanners") return false
+      val parts = Regex("(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)").matchEntire(extension.optString("version"))?.groupValues ?: return false
+      return parts[1] == "1" && (parts[2].toIntOrNull() ?: return false) >= 5
    }
 
    /*******************************************************************************

scanner-host/src/e2e/AndroidManifest.xml

@@ -1,6 +1,9 @@
 <?xml version="1.0" encoding="utf-8"?>
 <manifest xmlns:android="http://schemas.android.com/apk/res/android" xmlns:tools="http://schemas.android.com/tools">
-   <!-- Isolated test application; the normal debug/release identities are untouched. -->
+   <!-- Isolated test application; the normal debug/release identities are untouched.
+        networkSecurityConfig supersedes usesCleartextTraffic on API 24+; the config itself keeps cleartext for
+        the 127.0.0.1 fixtures and adds user-CA trust for the host localhost only (see docs/REAL-AUTHENTIK-ACCEPTANCE.md). -->
    <application android:usesCleartextTraffic="true" android:label="QQQ Mobile E2E"
+      android:networkSecurityConfig="@xml/network_security_config"
       tools:replace="android:usesCleartextTraffic,android:label" />
 </manifest>

scanner-host/src/e2e/java/io/qrun/mobile/scanner/ScannerDriverFactory.kt

@@ -8,6 +8,8 @@ import android.content.IntentFilter
 import androidx.core.content.ContextCompat
 
 internal const val HARDWARE_SCAN_SOURCE = "e2e-fixture"
+internal const val E2E_RAW_DATA_EXTRA = "io.qrun.mobile.scanner.e2e.raw_data"
+internal const val E2E_AIM_IDENTIFIER_EXTRA = "io.qrun.mobile.scanner.e2e.aim_identifier"
 
 /*******************************************************************************
  ** Disposable E2E package only. No debug/release source set contains this ingress.
@@ -25,7 +27,10 @@ internal fun createScannerDriver(context: Context): ScannerDriver = object : Sca
          val data = intent.getStringExtra("com.symbol.datawedge.data_string") ?: return
          if (intent.getStringExtra("com.symbol.datawedge.decode_mode") == "multiple" || intent.hasExtra("com.symbol.datawedge.barcodes")) return
          pending = false
-         listener?.scanned(ScannerCapture.of(data, intent.getStringExtra("com.symbol.datawedge.label_type") ?: "UNKNOWN"))
+         // Test-only fixture metadata: exact bytes and an explicit AIM identifier, never derived from the text.
+         val raw = intent.getByteArrayExtra(E2E_RAW_DATA_EXTRA)
+         val aim = intent.getStringExtra(E2E_AIM_IDENTIFIER_EXTRA)
+         listener?.scanned(ScannerCapture.of(data, intent.getStringExtra("com.symbol.datawedge.label_type") ?: "UNKNOWN", raw, aim))
          listener?.idle()
       }
    }

scanner-host/src/e2e/res/xml/network_security_config.xml

@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 -->
+<!-- E2E package only. Keeps the existing cleartext 127.0.0.1 fixture traffic and system trust everywhere, and lets
+     ONLY the literal host "localhost" additionally trust a user-installed (temporary, user-approved) test CA.
+     localhost is HTTPS-only. Debug, qa and release builds never see this file. No certificate is pinned or bypassed. -->
+<network-security-config>
+   <base-config cleartextTrafficPermitted="true">
+      <trust-anchors>
+         <certificates src="system" />
+      </trust-anchors>
+   </base-config>
+   <domain-config cleartextTrafficPermitted="false">
+      <domain includeSubdomains="false">localhost</domain>
+      <trust-anchors>
+         <certificates src="system" />
+         <certificates src="user" />
+      </trust-anchors>
+   </domain-config>
+</network-security-config>

scanner-host/src/main/AndroidManifest.xml

@@ -16,6 +16,15 @@
          android:icon="@drawable/ic_scanner"
          android:label="QQQ Mobile" android:theme="@android:style/Theme.Material.Light.NoActionBar">
       <uses-library android:name="com.symbol.emdk" android:required="false" />
+      <meta-data android:name="android.content.APP_RESTRICTIONS" android:resource="@xml/app_restrictions" />
+      <!-- Optional live wallpaper; inactive until chosen in Android's wallpaper chooser. Only the system may bind it. -->
+      <service android:name=".QqqStatusWallpaperService" android:exported="true" android:label="@string/status_wallpaper_label"
+            android:permission="android.permission.BIND_WALLPAPER">
+         <intent-filter>
+            <action android:name="android.service.wallpaper.WallpaperService" />
+         </intent-filter>
+         <meta-data android:name="android.service.wallpaper" android:resource="@xml/status_wallpaper" />
+      </service>
       <service android:name=".DeviceScreenCaptureService" android:foregroundServiceType="mediaProjection" android:exported="false" />
       <provider android:name="androidx.core.content.FileProvider" android:authorities="${applicationId}.photos"
             android:exported="false" android:grantUriPermissions="true">

scanner-host/src/main/java/io/qrun/mobile/scanner/AimOutputProfile.kt

@@ -0,0 +1,52 @@
+/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
+package io.qrun.mobile.scanner
+
+/*******************************************************************************
+ ** What a configuration read-back proves after the AIM output profile was requested.
+ *******************************************************************************/
+internal enum class AimReadback { CONFIRMED, UNCHANGED, INDETERMINATE }
+
+/*******************************************************************************
+ ** Classify the value the scanner reports (null when it could not be read) against the value it held before the
+ ** request and the AIM value requested. AIM wins even when the original was already AIM; only exactly the original
+ ** counts as unchanged; an unreadable or any other value is indeterminate and must be restored or failed, never
+ ** trusted. Generic so the rule is independent of the vendor SDK's enum.
+ *******************************************************************************/
+internal fun <T : Any> classifyAimReadback(original: T, aim: T, effective: T?): AimReadback = when {
+   effective == null -> AimReadback.INDETERMINATE
+   effective == aim -> AimReadback.CONFIRMED
+   effective == original -> AimReadback.UNCHANGED
+   else -> AimReadback.INDETERMINATE
+}
+
+/*******************************************************************************
+ ** Strict reading of the application-owned EMDK "AIM code identifier" output profile. Only a driver that
+ ** applied ScannerConfig.scanParams.codeIdType=AIM and read the same value back may call [split]; without
+ ** that confirmation the SDK text is user payload and must never be stripped or interpreted.
+ *******************************************************************************/
+internal object AimOutputProfile {
+   private val AIM = Regex("\\][A-Za-z][0-9A-Za-z]")
+
+   // AIM symbology character each known EMDK label must report; the modifier character is not checked here.
+   private val FAMILY = mapOf(
+      "CODE128" to 'C', "CODE39" to 'A', "CODE93" to 'G', "I2OF5" to 'I', "QRCODE" to 'Q', "DATAMATRIX" to 'd',
+      "PDF417" to 'L', "AZTEC" to 'z', "EAN13" to 'E', "EAN8" to 'E', "UPCA" to 'E', "UPCE0" to 'E', "UPCE1" to 'E'
+   )
+
+   /*******************************************************************************
+    ** The configured identifier and the user payload that followed it, taken exactly as the SDK delivered them.
+    *******************************************************************************/
+   internal data class Split(val aimIdentifier: String, val payload: String)
+
+   /*******************************************************************************
+    ** Remove exactly the first three characters when they form an AIM identifier consistent with the label.
+    ** A missing, malformed or label-inconsistent prefix returns null: the scan is not trusted, never guessed.
+    ** An empty payload is refused, and a payload that itself begins with an identifier is left intact.
+    *******************************************************************************/
+   fun split(text: String, label: String): Split? {
+      if (text.length < 4 || !AIM.matches(text.substring(0, 3))) return null
+      val family = FAMILY[label.removePrefix("LABEL-TYPE-")]
+      if (family != null && text[1] != family) return null
+      return Split(text.substring(0, 3), text.substring(3))
+   }
+}

scanner-host/src/main/java/io/qrun/mobile/scanner/DeviceScreenCaptureService.kt

@@ -6,7 +6,6 @@ import android.app.KeyguardManager
 import android.app.Notification
 import android.app.NotificationChannel
 import android.app.NotificationManager
-import android.app.PendingIntent
 import android.app.Service
 import android.content.BroadcastReceiver
 import android.content.Context
@@ -81,9 +80,6 @@ class DeviceScreenCaptureService : Service() {
     ** Establish the visible sharing notification before accepting consent; never restart projection automatically.
     *******************************************************************************/
    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
-      if (intent?.action == STOP) {
-         finishProjection(); return START_NOT_STICKY
-      }
       try {
          val manager = getSystemService(NotificationManager::class.java)
          manager.createNotificationChannel(NotificationChannel(CHANNEL, "Device screen sharing", NotificationManager.IMPORTANCE_LOW))
@@ -91,13 +87,9 @@ class DeviceScreenCaptureService : Service() {
             finishProjection()
             return START_NOT_STICKY
          }
-         val stop = PendingIntent.getService(
-            this, 0, Intent(this, DeviceScreenCaptureService::class.java).setAction(STOP),
-            PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE
-         )
          val notification = Notification.Builder(this, CHANNEL).setSmallIcon(R.drawable.ic_scanner)
             .setContentTitle("QQQ device screen sharing").setContentText("Other apps and notifications may be visible to your administrator.")
-            .setOngoing(true).addAction(Notification.Action.Builder(null, "Stop sharing", stop).build()).build()
+            .setOngoing(true).build()
          if (Build.VERSION.SDK_INT >= 29) startForeground(NOTIFICATION_ID, notification, ServiceInfo.FOREGROUND_SERVICE_TYPE_MEDIA_PROJECTION)
          else startForeground(NOTIFICATION_ID, notification)
          foregroundReady = true
@@ -340,11 +332,10 @@ class DeviceScreenCaptureService : Service() {
    }
 
    /*******************************************************************************
-    ** Keep notification and stop-action identifiers private to the nonexported projection service.
+    ** Keep notification identifiers private to the nonexported projection service.
     *******************************************************************************/
    private companion object {
       const val CHANNEL = "qqq-device-screen"
-      const val STOP = "io.qrun.mobile.scanner.STOP_DEVICE_SCREEN"
       const val NOTIFICATION_ID = 8716
    }
 }

scanner-host/src/main/java/io/qrun/mobile/scanner/DeviceScreenSharing.kt

@@ -187,7 +187,6 @@ internal fun DeviceScreenSharingControl(sharing: DeviceScreenSharing, controller
    }
    if (sharing.active) {
       Text("Sharing this device screen, including other apps and notifications.")
-      TextButton(onClick = { controller.pauseViewing() }) { Text("Stop device screen sharing") }
    } else if (controller.supportsDeviceScreen) {
       val canNotify = remember(permissionRevision) {
          Build.VERSION.SDK_INT < 33 ||
@@ -201,7 +200,7 @@ internal fun DeviceScreenSharingControl(sharing: DeviceScreenSharing, controller
    }
    if (disclosure) AlertDialog(
       onDismissRequest = { disclosure = false }, title = { Text("Share this device screen?") },
-      text = { Text("An authorized administrator can see other apps and notifications while viewing this session. Android will ask for permission. Sharing stops if the viewer disconnects, you sign out, or this activity restarts. Use Stop sharing in the notification or Android's sharing indicator at any time.") },
+      text = { Text("An authorized administrator can see other apps and notifications while viewing this session. Android will ask for permission. Sharing stops if the viewer disconnects, you sign out, or this activity restarts. Android shows its own sharing indicator while this device screen is shared.") },
       dismissButton = { TextButton(onClick = { disclosure = false }) { Text("Cancel") } },
       confirmButton = {
          TextButton(onClick = {

scanner-host/src/main/java/io/qrun/mobile/scanner/ManagedConfiguration.kt

@@ -0,0 +1,90 @@
+/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
+package io.qrun.mobile.scanner
+
+import android.content.Context
+import android.content.RestrictionsManager
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+
+/** Android managed-configuration keys; they must match res/xml/app_restrictions.xml and the company profile generator. */
+internal const val MANAGED_SERVER_URL = "qqq_server_url"
+internal const val MANAGED_ORIENTATION = "qqq_orientation"
+
+/*******************************************************************************
+ ** Validated administrator bootstrap values. Absent or rejected keys are null, which leaves unmanaged behaviour unchanged.
+ ** Only key names, never values, are recorded for rejected input.
+ *******************************************************************************/
+internal data class ManagedValues(val serverUrl: String? = null, val orientation: OrientationPolicy? = null, val rejectedKeys: List<String> = emptyList())
+
+/*******************************************************************************
+ ** What a managed server URL means for the current installation.
+ *******************************************************************************/
+internal enum class ManagedServerAction { NONE, PREFILL, OFFER_CHANGE }
+
+/*******************************************************************************
+ ** Pure validation and reconciliation rules for managed configuration.
+ *******************************************************************************/
+internal object ManagedConfiguration {
+   private const val MAX_URL = 2048
+
+   /*******************************************************************************
+    ** Accept only an HTTPS origin without credentials, path, query or fragment (managed values never allow HTTP, even
+    ** in debug builds), and only an exact existing orientation name. Anything else is rejected, never defaulted.
+    *******************************************************************************/
+   fun parse(serverUrl: String?, orientation: String?): ManagedValues {
+      val rejected = mutableListOf<String>()
+      val url = serverUrl?.takeIf { it.isNotBlank() }?.let { raw ->
+         try {
+            require(raw.length <= MAX_URL) { "URL too long" }
+            normalizeServerUrl(raw, allowHttp = false)
+         } catch (exception: Exception) {
+            rejected += MANAGED_SERVER_URL
+            null
+         }
+      }
+      val policy = orientation?.takeIf { it.isNotBlank() }?.let { raw ->
+         OrientationPolicy.entries.firstOrNull { it.name == raw } ?: run { rejected += MANAGED_ORIENTATION; null }
+      }
+      return ManagedValues(url, policy, rejected)
+   }
+
+   /*******************************************************************************
+    ** No saved server: offer the managed URL in the connect form. A different saved server is never switched silently;
+    ** the person is offered the existing change-server path (confirm, end session, sign out).
+    *******************************************************************************/
+   fun serverAction(savedServer: String?, managedServer: String?): ManagedServerAction = when {
+      managedServer == null -> ManagedServerAction.NONE
+      savedServer == null -> ManagedServerAction.PREFILL
+      savedServer == managedServer -> ManagedServerAction.NONE
+      else -> ManagedServerAction.OFFER_CHANGE
+   }
+
+   /*******************************************************************************
+    ** Managed orientation is a bootstrap default applied only when the administrator's value changes. A later local
+    ** choice stands until the managed value changes again. Null means nothing to apply.
+    *******************************************************************************/
+   fun orientationToApply(managed: OrientationPolicy?, lastApplied: String?): OrientationPolicy? =
+      managed?.takeIf { it.name != lastApplied }
+}
+
+/*******************************************************************************
+ ** Read this application's current restrictions; a missing service or no restrictions yields no managed values.
+ *******************************************************************************/
+internal fun readManagedValues(context: Context): ManagedValues {
+   val manager = context.getSystemService(Context.RESTRICTIONS_SERVICE) as? RestrictionsManager ?: return ManagedValues()
+   val restrictions = manager.applicationRestrictions
+   return ManagedConfiguration.parse(restrictions.getString(MANAGED_SERVER_URL), restrictions.getString(MANAGED_ORIENTATION))
+}
+
+/*******************************************************************************
+ ** Settings notice shown only when the managed server differs from the connected one. The button runs the caller's
+ ** existing confirmed change-server flow; this composable changes nothing itself.
+ *******************************************************************************/
+@Composable
+internal fun ManagedServerNotice(connectedServer: String, managedServer: String?, onChange: () -> Unit) {
+   if (ManagedConfiguration.serverAction(connectedServer, managedServer) != ManagedServerAction.OFFER_CHANGE) return
+   Text("Your administrator configured a different server: $managedServer", style = MaterialTheme.typography.bodySmall)
+   TextButton(onClick = onChange) { Text("Use administrator's server") }
+}

scanner-host/src/main/java/io/qrun/mobile/scanner/QqqStatusWallpaperService.kt

@@ -0,0 +1,297 @@
+/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
+package io.qrun.mobile.scanner
+
+import android.app.Activity
+import android.app.KeyguardManager
+import android.app.WallpaperManager
+import android.content.ActivityNotFoundException
+import android.content.BroadcastReceiver
+import android.content.ComponentName
+import android.content.Context
+import android.content.Intent
+import android.content.IntentFilter
+import android.graphics.Canvas
+import android.graphics.Color
+import android.graphics.Paint
+import android.graphics.Typeface
+import android.net.ConnectivityManager
+import android.net.LinkProperties
+import android.net.Network
+import android.os.Build
+import android.os.Handler
+import android.os.Looper
+import android.os.SystemClock
+import android.service.wallpaper.WallpaperService
+import android.view.SurfaceHolder
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.core.content.ContextCompat
+import java.time.Instant
+import java.time.ZoneId
+import java.time.format.DateTimeFormatter
+
+/*******************************************************************************
+ ** The one in-process publisher. The wallpaper engine runs in this application's main process, so the snapshot
+ ** is shared by reference and disappears with the process; nothing is written to disk.
+ *******************************************************************************/
+internal object WallpaperStatus {
+   val store = WallpaperStatusStore(SystemClock::elapsedRealtime, System::currentTimeMillis)
+}
+
+/*******************************************************************************
+ ** Optional live wallpaper showing the company name and, on the unlocked home screen only, the approved session
+ ** display name and current IP. Inactive until a person selects it in Android's wallpaper chooser.
+ *******************************************************************************/
+class QqqStatusWallpaperService : WallpaperService() {
+   /*******************************************************************************
+    ** One engine per wallpaper surface; the framework destroys it when the wallpaper is replaced.
+    *******************************************************************************/
+   override fun onCreateEngine(): Engine = StatusEngine()
+
+   /*******************************************************************************
+    ** Draws text with a single Canvas pass. Network, keyguard and store observation exist only while visible.
+    *******************************************************************************/
+   private inner class StatusEngine : Engine(), WallpaperStatusListener {
+      private val main = Handler(Looper.getMainLooper())
+      private val connectivity = getSystemService(Context.CONNECTIVITY_SERVICE) as? ConnectivityManager
+      private val keyguard = getSystemService(Context.KEYGUARD_SERVICE) as? KeyguardManager
+      private val paint = Paint(Paint.ANTI_ALIAS_FLAG)
+      private val timeFormat = DateTimeFormatter.ofPattern("HH:mm").withZone(ZoneId.systemDefault())
+      private var observing = false
+      private var destroyed = false
+      private var networkCallback: ConnectivityManager.NetworkCallback? = null
+      private var currentNetwork: Network? = null
+      private var networkKnown = false
+      private var networkAddresses: String? = null
+      private val redraw = Runnable { draw() }
+      private val screenReceiver = object : BroadcastReceiver() {
+         /*******************************************************************************
+          ** Withdraw identity the moment the screen turns off; redraw once the user unlocks.
+          *******************************************************************************/
+         override fun onReceive(context: Context, intent: Intent) {
+            if (intent.action == Intent.ACTION_SCREEN_OFF) drawBrandOnly() else draw()
+         }
+      }
+
+      /*******************************************************************************
+       ** Observe only while visible. Becoming invisible first paints brand-only so a stale frame cannot flash on wake.
+       *******************************************************************************/
+      override fun onVisibilityChanged(visible: Boolean) {
+         if (destroyed) return
+         if (visible) {
+            startObserving()
+            draw()
+         } else {
+            drawBrandOnly()
+            stopObserving()
+         }
+      }
+
+      /*******************************************************************************
+       ** Repaint when the surface size changes.
+       *******************************************************************************/
+      override fun onSurfaceChanged(holder: SurfaceHolder, format: Int, width: Int, height: Int) {
+         super.onSurfaceChanged(holder, format, width, height)
+         if (observing) draw() else drawBrandOnly()
+      }
+
+      /*******************************************************************************
+       ** Release the network callback, receiver, store listener and pending timers; nothing outlives the engine.
+       *******************************************************************************/
+      override fun onDestroy() {
+         destroyed = true
+         stopObserving()
+         super.onDestroy()
+      }
+
+      /*******************************************************************************
+       ** The store may notify from any thread; repaint on the main looper.
+       *******************************************************************************/
+      override fun changed() {
+         main.post(redraw)
+      }
+
+      /*******************************************************************************
+       ** Start network, unlock and store observation once per visible period.
+       *******************************************************************************/
+      private fun startObserving() {
+         if (observing) return
+         observing = true
+         WallpaperStatus.store.addListener(this)
+         ContextCompat.registerReceiver(
+            this@QqqStatusWallpaperService, screenReceiver,
+            IntentFilter().apply { addAction(Intent.ACTION_USER_PRESENT); addAction(Intent.ACTION_SCREEN_OFF) },
+            ContextCompat.RECEIVER_NOT_EXPORTED
+         )
+         val callback = object : ConnectivityManager.NetworkCallback() {
+            /*******************************************************************************
+             ** Addresses are reported here after the default network becomes available and whenever they change.
+             *******************************************************************************/
+            override fun onLinkPropertiesChanged(network: Network, linkProperties: LinkProperties) {
+               val text = formatNetworkAddresses(linkProperties.interfaceName, linkProperties.linkAddresses.mapNotNull { it.address.hostAddress })
+               main.post { if (observing) { currentNetwork = network; networkKnown = true; networkAddresses = text; draw() } }
+            }
+
+            /*******************************************************************************
+             ** Ignore the loss of a network that already stopped being the default.
+             *******************************************************************************/
+            override fun onLost(network: Network) {
+               main.post { if (observing && network == currentNetwork) { currentNetwork = null; networkKnown = true; networkAddresses = null; draw() } }
+            }
+         }
+         try {
+            connectivity?.registerDefaultNetworkCallback(callback)
+            networkCallback = callback
+         } catch (exception: RuntimeException) {
+            networkKnown = false
+         }
+      }
+
+      /*******************************************************************************
+       ** Undo everything startObserving did and cancel scheduled work. Safe to call repeatedly.
+       *******************************************************************************/
+      private fun stopObserving() {
+         main.removeCallbacks(redraw)
+         if (!observing) return
+         observing = false
+         WallpaperStatus.store.removeListener(this)
+         try {
+            unregisterReceiver(screenReceiver)
+         } catch (exception: IllegalArgumentException) { /* Already unregistered. */
+         }
+         networkCallback?.let {
+            try {
+               connectivity?.unregisterNetworkCallback(it)
+            } catch (exception: IllegalArgumentException) { /* Already unregistered. */
+            }
+         }
+         networkCallback = null
+         currentNetwork = null
+         networkKnown = false
+         networkAddresses = null
+      }
+
+      /*******************************************************************************
+       ** Preview and lock-only wallpaper never show identity. A locked keyguard, or no keyguard service, is treated
+       ** as locked. The wallpaper-flag check is additive: only an engine bound to the lock screen alone is certain.
+       *******************************************************************************/
+      private fun currentContext(): WallpaperContext {
+         if (isPreview) return WallpaperContext.PREVIEW
+         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE && getWallpaperFlags() == WallpaperManager.FLAG_LOCK) return WallpaperContext.LOCKED
+         return if (keyguard?.isKeyguardLocked == false) WallpaperContext.HOME else WallpaperContext.LOCKED
+      }
+
+      /*******************************************************************************
+       ** Paint the frame for the current context and schedule the single timer that withdraws an aging name.
+       *******************************************************************************/
+      private fun draw() {
+         if (destroyed) return
+         main.removeCallbacks(redraw)
+         val snapshot = WallpaperStatus.store.snapshot
+         val now = SystemClock.elapsedRealtime()
+         val context = currentContext()
+         val frame = WallpaperPresentation.render(
+            snapshot, context, WallpaperPresentation.networkLine(networkKnown, networkAddresses), now
+         ) { timeFormat.format(Instant.ofEpochMilli(it)) }
+         paintFrame(frame)
+         if (context == WallpaperContext.HOME && observing) WallpaperPresentation.millisUntilStale(snapshot, now)?.let { main.postDelayed(redraw, it + 50) }
+      }
+
+      /*******************************************************************************
+       ** Brand-only frame used on invisibility, screen off and teardown.
+       *******************************************************************************/
+      private fun drawBrandOnly() {
+         if (destroyed) return
+         main.removeCallbacks(redraw)
+         val snapshot = WallpaperStatus.store.snapshot
+         paintFrame(WallpaperPresentation.render(snapshot, WallpaperContext.LOCKED, "", 0L) { "" })
+      }
+
+      /*******************************************************************************
+       ** Draw the header and lines centred in the upper third, shortening any line to fit. Never logs text.
+       *******************************************************************************/
+      private fun paintFrame(frame: WallpaperFrame) {
+         val holder = surfaceHolder
+         if (!holder.surface.isValid) return
+         val canvas: Canvas? = try {
+            holder.lockCanvas()
+         } catch (exception: RuntimeException) {
+            null
+         }
+         if (canvas == null) return
+         try {
+            draw(canvas, frame)
+         } finally {
+            holder.unlockCanvasAndPost(canvas)
+         }
+      }
+
+      /*******************************************************************************
+       ** Canvas layout kept deliberately plain: solid brand colour, bold header, regular status lines.
+       *******************************************************************************/
+      private fun draw(canvas: Canvas, frame: WallpaperFrame) {
+         val width = canvas.width.toFloat()
+         canvas.drawColor(Color.parseColor(frame.colorHex))
+         paint.color = if (frame.darkText) Color.BLACK else Color.WHITE
+         paint.textAlign = Paint.Align.CENTER
+         val maxWidth = width * 0.9f
+         var y = canvas.height * 0.22f
+         paint.typeface = Typeface.DEFAULT_BOLD
+         paint.textSize = width * 0.07f
+         canvas.drawText(fit(frame.header, maxWidth), width / 2, y, paint)
+         paint.typeface = Typeface.DEFAULT
+         paint.textSize = width * 0.045f
+         frame.lines.forEach { line ->
+            y += paint.textSize * 1.6f
+            canvas.drawText(fit(line, maxWidth), width / 2, y, paint)
+         }
+      }
+
+      /*******************************************************************************
+       ** Truncate with an ellipsis so long names cannot run off the display.
+       *******************************************************************************/
+      private fun fit(text: String, maxWidth: Float): String {
+         val count = paint.breakText(text, true, maxWidth, null)
+         return if (count >= text.length) text else text.take((count - 1).coerceAtLeast(0)) + "…"
+      }
+   }
+}
+
+/*******************************************************************************
+ ** The standard Android live-wallpaper chooser, preselected to this wallpaper. Activation still needs the person's
+ ** confirmation there; nothing is applied silently.
+ *******************************************************************************/
+internal fun wallpaperChooserIntent(context: Context): Intent = Intent(WallpaperManager.ACTION_CHANGE_LIVE_WALLPAPER)
+   .putExtra(WallpaperManager.EXTRA_LIVE_WALLPAPER_COMPONENT, ComponentName(context, QqqStatusWallpaperService::class.java))
+
+/*******************************************************************************
+ ** Open the chooser; false when the device offers none or refuses the request.
+ *******************************************************************************/
+internal fun openWallpaperChooser(activity: Activity): Boolean = try {
+   activity.startActivity(wallpaperChooserIntent(activity))
+   true
+} catch (exception: ActivityNotFoundException) {
+   false
+} catch (exception: SecurityException) {
+   false
+}
+
+/*******************************************************************************
+ ** Settings entry that opens the wallpaper chooser. It states exactly what the wallpaper will and will not show.
+ *******************************************************************************/
+@Composable
+internal fun WallpaperSetting(activity: Activity) {
+   var unavailable by remember { mutableStateOf(false) }
+   TextButton(onClick = { unavailable = !openWallpaperChooser(activity) }) { Text("Status wallpaper…") }
+   Text(
+      "Optional live wallpaper: company name only on the lock screen; your name and this device's IP on the unlocked home screen. You confirm it in Android.",
+      style = MaterialTheme.typography.bodySmall
+   )
+   if (unavailable) Text("This device has no live wallpaper chooser.")
+}

scanner-host/src/main/java/io/qrun/mobile/scanner/ScannerActivity.kt

@@ -1,9 +1,14 @@
 /* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
 package io.qrun.mobile.scanner
 
+import android.content.BroadcastReceiver
+import android.content.Context
+import android.content.Intent
+import android.content.IntentFilter
 import android.os.Build
 import android.os.Bundle
 import android.graphics.Rect
+import androidx.core.content.ContextCompat
 import androidx.activity.ComponentActivity
 import androidx.activity.compose.setContent
 import androidx.compose.foundation.layout.Arrangement
@@ -74,6 +79,14 @@ class ScannerActivity : ComponentActivity() {
    private var focused by mutableStateOf(false)
    private var captureBounds by mutableStateOf<Rect?>(null)
    private val windowFocusObserver = android.view.ViewTreeObserver.OnWindowFocusChangeListener { focused = it }
+   private var managed by mutableStateOf(ManagedValues())
+   private var watchingManagedConfiguration = false
+   private val restrictionsReceiver = object : BroadcastReceiver() {
+      /*******************************************************************************
+       ** Reread administrator restrictions when the system reports a change while this host is visible.
+       *******************************************************************************/
+      override fun onReceive(context: Context, intent: Intent) = refreshManagedConfiguration()
+   }
 
    /*******************************************************************************
     ** Mark the host resumed so visible scanner ownership and foreground telemetry can be reevaluated.
@@ -82,13 +95,44 @@ class ScannerActivity : ComponentActivity() {
       super.onResume()
       resumed = true
       window.decorView.post { if (resumed) focused = window.decorView.hasWindowFocus() }
+      startWatchingManagedConfiguration()
    }
 
    /*******************************************************************************
     ** Withdraw foreground eligibility before Android pauses the activity and scanner input.
     *******************************************************************************/
    override fun onPause() {
-      resumed = false; super.onPause()
+      resumed = false; stopWatchingManagedConfiguration(); super.onPause()
+   }
+
+   /*******************************************************************************
+    ** Reread managed values (also covers changes missed while paused) and apply a changed orientation default.
+    *******************************************************************************/
+   private fun refreshManagedConfiguration() {
+      managed = readManagedValues(this)
+      val preferences = getSharedPreferences("host", MODE_PRIVATE)
+      val target = ManagedConfiguration.orientationToApply(managed.orientation, preferences.getString("managed_orientation_applied", null)) ?: return
+      preferences.edit().putString("managed_orientation_applied", target.name).apply()
+      target.select(this)
+   }
+
+   /*******************************************************************************
+    ** Observe restriction changes only while the host is resumed; the system broadcast is not exported to other apps.
+    *******************************************************************************/
+   private fun startWatchingManagedConfiguration() {
+      refreshManagedConfiguration()
+      if (watchingManagedConfiguration) return
+      ContextCompat.registerReceiver(this, restrictionsReceiver, IntentFilter(Intent.ACTION_APPLICATION_RESTRICTIONS_CHANGED), ContextCompat.RECEIVER_NOT_EXPORTED)
+      watchingManagedConfiguration = true
+   }
+
+   /*******************************************************************************
+    ** Stop observing before the activity leaves the foreground.
+    *******************************************************************************/
+   private fun stopWatchingManagedConfiguration() {
+      if (!watchingManagedConfiguration) return
+      unregisterReceiver(restrictionsReceiver)
+      watchingManagedConfiguration = false
    }
 
    /*******************************************************************************
@@ -121,6 +165,7 @@ class ScannerActivity : ComponentActivity() {
    override fun onCreate(savedInstanceState: Bundle?) {
       super.onCreate(savedInstanceState)
       window.decorView.viewTreeObserver.addOnWindowFocusChangeListener(windowFocusObserver)
+      refreshManagedConfiguration()
       OrientationPolicy.read(this).apply(this)
       val preferences = getSharedPreferences("host", MODE_PRIVATE)
       setContent()
@@ -135,7 +180,7 @@ class ScannerActivity : ComponentActivity() {
                var server by remember { mutableStateOf(preferences.getString("server", null)) }
                val currentServer = server
                if (currentServer == null) {
-                  ServerForm { value -> preferences.edit().putString("server", value).apply(); server = value }
+                  ServerForm(managed.serverUrl) { value -> preferences.edit().putString("server", value).apply(); server = value }
                } else {
                   key(currentServer)
                   {
@@ -217,6 +262,16 @@ class ScannerActivity : ComponentActivity() {
          withFrameNanos { }
          renderedScreen = currentScreen
       }
+      // Display-only wallpaper status: approved name and sign-in state, never the session id. Cleared when this host leaves composition.
+      val signedIn = approved && qViewModel.isAuthenticated && !qViewModel.isLogoutRequested
+      val serverHost = remember(server) { runCatching { URI(server).host }.getOrNull() }
+      LaunchedEffect(signedIn, resumed, qViewModel.sessionUserFullName, brand)
+      {
+         WallpaperStatus.store.setBrand(brand.displayName, brand.primaryColor)
+         if (signedIn) WallpaperStatus.store.signedIn(qViewModel.sessionUserFullName, serverHost, resumed)
+         else WallpaperStatus.store.signedOutIfSignedIn()
+      }
+      DisposableEffect(server) { onDispose { WallpaperStatus.store.clear() } }
       val sessionApi = remember(server, diagnostics) { MobileSessionApi(server, credentials::headers, compatibility, diagnostics::sessionRequest) }
       val deviceSharing = remember(server, qViewModel.sessionUUID) { DeviceScreenSharing(applicationContext) }
       val sessions = remember(sessionApi, qViewModel.sessionUUID)
@@ -259,6 +314,10 @@ class ScannerActivity : ComponentActivity() {
          LocalBusinessNavigationEnabled provides approved,
          LocalDeviceSettings provides {
             OrientationSetting(this@ScannerActivity)
+            WallpaperSetting(this@ScannerActivity)
+            ManagedServerNotice(server, managed.serverUrl) {
+               qViewModel.qNavigator.requestLeave("Change server and sign out?", "Change server", alwaysConfirm = true) { qViewModel.changeServerAction?.invoke() }
+            }
             DeviceScreenSharingControl(deviceSharing, sessions) {
                approved && qViewModel.isAuthenticated && !qViewModel.isLogoutRequested
             }
@@ -314,12 +373,13 @@ internal fun normalizeServerUrl(input: String, allowHttp: Boolean): String {
  ** Initial server configuration is editable until the host connects.
  *******************************************************************************/
 @Composable
-private fun ServerForm(onConnect: (String) -> Unit) {
-   var url by remember { mutableStateOf(if (BuildConfig.DEBUG) "http://127.0.0.1:8080/" else "https://") }
+private fun ServerForm(managedUrl: String?, onConnect: (String) -> Unit) {
+   var url by remember(managedUrl) { mutableStateOf(managedUrl ?: if (BuildConfig.DEBUG) "http://127.0.0.1:8080/" else "https://") }
    var error by remember { mutableStateOf("") }
    Column(Modifier.imePadding().verticalScroll(rememberScrollState()).padding(24.dp), verticalArrangement = Arrangement.spacedBy(16.dp))
    {
       Text("Connect QQQ Mobile", style = MaterialTheme.typography.headlineMedium)
+      if (managedUrl != null) Text("Your administrator configured this server. Review it, then connect.")
       OutlinedTextField(url, { url = it }, label = { Text("QQQ server URL") }, singleLine = true)
       Button(onClick = {
          try {

scanner-host/src/main/java/io/qrun/mobile/scanner/ScannerFeedback.kt

@@ -0,0 +1,85 @@
+/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
+package io.qrun.mobile.scanner
+
+import com.kingsrook.qqq.frontend.android.mobileapp.viewmodel.ProcessAcknowledgment
+
+/*******************************************************************************
+ ** The most recent submitted read, kept in memory only so it stays visible while awaiting the next scan.
+ ** Manual entry has no symbology; it is never labelled with a guessed one.
+ *******************************************************************************/
+internal data class LastScan(val eventId: String, val barcode: String, val symbology: String?) {
+   /*******************************************************************************
+    ** Scan content is business data and must not reach logs or crash reports.
+    *******************************************************************************/
+   override fun toString(): String = "LastScan(redacted, eventId=$eventId)"
+
+   /*******************************************************************************
+    *******************************************************************************/
+   companion object {
+      /*******************************************************************************
+       ** Manual submissions carry no scanner evidence, so their symbology is absent.
+       *******************************************************************************/
+      fun of(event: ScanEvent) = LastScan(event.eventId, event.barcode, if (event.scanSource == "manual") null else event.symbology)
+   }
+}
+
+/*******************************************************************************
+ ** What the read-only scan display shows: the exact value, its symbology, and where the request stands.
+ *******************************************************************************/
+internal data class ScanFeedback(val barcode: String, val symbology: String, val details: String, val status: String) {
+   /*******************************************************************************
+    ** Scan content is business data and must not reach logs or crash reports.
+    *******************************************************************************/
+   override fun toString(): String = "ScanFeedback(redacted, status=$status)"
+}
+
+/*******************************************************************************
+ ** Derives scan feedback from the process's own pending/acknowledgment state; it adds no state machine.
+ *******************************************************************************/
+internal object ScannerFeedback {
+   const val WAITING = "Waiting for scan"
+   const val STATE_KEY = "scanner.lastScan"
+
+   /*******************************************************************************
+    ** The one receipt definition: submission and display must agree on what counts as confirmation.
+    *******************************************************************************/
+   fun acknowledgment(eventId: String) = ProcessAcknowledgment(
+      "acknowledgedEventId", eventId, requiredValues = mapOf("scanSaved" to true), nonEmptyStringFields = setOf("scanId")
+   )
+   const val MANUAL_SYMBOLOGY = "Not applicable (manual entry)"
+
+   /*******************************************************************************
+    ** A pending request (including a retryable one) is authoritative because retries resend it unchanged;
+    ** otherwise the last submitted read stays visible, whether confirmed, rejected or cancelled.
+    *******************************************************************************/
+   fun derive(
+      last: LastScan?, pendingValues: Map<String, Any?>?, responseValues: Map<String, Any?>, waiting: Boolean, cancelling: Boolean
+   ): ScanFeedback? {
+      val pendingId = pendingValues?.get("eventId") as? String
+      val pendingBarcode = pendingValues?.get("barcode") as? String
+      val shown = if (pendingId != null && pendingBarcode != null)
+         LastScan(
+            pendingId, pendingBarcode,
+            if (pendingValues["scanSource"] == "manual") null else pendingValues["symbology"] as? String
+         )
+      else last
+      if (shown == null) return null
+      val status = when {
+         acknowledgment(shown.eventId).matches(responseValues) -> "Confirmed by server"
+         cancelling -> "Cancelling. Scan was not confirmed."
+         pendingId == shown.eventId && waiting -> "Sending scan…"
+         pendingId == shown.eventId -> "Not confirmed. Retry the same request or leave the process; do not assume it was saved."
+         else -> "Not confirmed. Follow the process message before submitting again."
+      }
+      return ScanFeedback(shown.barcode, shown.symbology ?: MANUAL_SYMBOLOGY, describe(shown.barcode), status)
+   }
+
+   /*******************************************************************************
+    ** Control characters are invisible in a text field, so report them without altering the value.
+    *******************************************************************************/
+   fun describe(barcode: String): String {
+      val controls = barcode.count { Character.isISOControl(it) }
+      val length = "${barcode.length} ${if (barcode.length == 1) "character" else "characters"}"
+      return if (controls == 0) length else "$length, $controls control ${if (controls == 1) "character" else "characters"}"
+   }
+}

scanner-host/src/main/java/io/qrun/mobile/scanner/ScannerWidget.kt

@@ -4,6 +4,7 @@ package io.qrun.mobile.scanner
 import android.content.Context
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.text.KeyboardActions
 import androidx.compose.foundation.text.KeyboardOptions
@@ -22,6 +23,7 @@ import androidx.compose.runtime.rememberUpdatedState
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.platform.testTag
 import androidx.compose.ui.platform.LocalView
 import androidx.compose.ui.platform.LocalWindowInfo
 import androidx.compose.ui.platform.LocalFocusManager
@@ -32,7 +34,6 @@ import androidx.lifecycle.Lifecycle
 import androidx.lifecycle.LifecycleEventObserver
 import androidx.lifecycle.compose.LocalLifecycleOwner
 import com.kingsrook.qqq.frontend.android.mobileapp.ui.widgets.blocks.WidgetBlockParameters
-import com.kingsrook.qqq.frontend.android.mobileapp.viewmodel.ProcessAcknowledgment
 import com.kingsrook.qqq.frontend.android.mobileapp.ui.LocalProcessInputAllowed
 
 /*******************************************************************************
@@ -99,12 +100,10 @@ internal fun ScannerWidget(
       }
       notice = "Sending scan…"
       val event = ScanEvent(capture, source)
+      process.widgetState[ScannerFeedback.STATE_KEY] = LastScan.of(event)
       // Capability is read from cached verified discovery on the UI thread; it never triggers HTTP.
       process.runStep(
-         event.values(includeFidelity = fidelityAvailable()), ProcessAcknowledgment(
-            "acknowledgedEventId", event.eventId,
-            requiredValues = mapOf("scanSaved" to true), nonEmptyStringFields = setOf("scanId")
-         )
+         event.values(includeFidelity = fidelityAvailable()), ScannerFeedback.acknowledgment(event.eventId)
       )
       // runStep can reject local metadata/validation before accepting an event.
       // A synchronous test repository can also finish and acknowledge it immediately.
@@ -143,6 +142,11 @@ internal fun ScannerWidget(
    {
       Text(parameters.widgetBlock.values["title"]?.toString() ?: "Scan a barcode")
       Text(parameters.widgetBlock.values["instructions"]?.toString() ?: "Press the handheld scan trigger. Wait for server confirmation before scanning again.")
+      val feedback = ScannerFeedback.derive(
+         process?.widgetState?.get(ScannerFeedback.STATE_KEY) as? LastScan, process?.pendingStepValues, parameters.values,
+         process?.waitingOnBackend == true, process?.cancelling == true
+      )
+      ScanFeedbackPanel(feedback)
       if (parameters.values["scanSaved"] == true && notice.isEmpty()) {
          Text("${scannerMetaData.acknowledgmentLabel} ${parameters.values["scanId"] ?: ""}")
       }
@@ -164,3 +168,19 @@ internal fun ScannerWidget(
       }
    }
 }
+
+/*******************************************************************************
+ ** Shown for every SCANNER widget, including those with manual entry disabled. A read-only field never
+ ** requests focus or opens the keyboard, and the value is displayed exactly as received.
+ *******************************************************************************/
+@Composable
+internal fun ScanFeedbackPanel(feedback: ScanFeedback?) {
+   OutlinedTextField(
+      feedback?.barcode ?: "", {}, modifier = Modifier.fillMaxWidth().testTag("scanner-barcode"),
+      label = { Text("Barcode") }, readOnly = true, singleLine = true,
+      placeholder = { Text(ScannerFeedback.WAITING) },
+      supportingText = feedback?.let { { Text(it.details) } }
+   )
+   Text("Symbology: ${feedback?.symbology ?: "—"}", Modifier.testTag("scanner-symbology"))
+   Text(feedback?.status ?: ScannerFeedback.WAITING, Modifier.testTag("scanner-status"))
+}

scanner-host/src/main/java/io/qrun/mobile/scanner/SessionHostUi.kt

@@ -7,7 +7,6 @@ import androidx.compose.foundation.layout.padding
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Surface
 import androidx.compose.material3.Text
-import androidx.compose.material3.TextButton
 import androidx.compose.runtime.Composable
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
@@ -44,17 +43,15 @@ private fun containsPasswordWidget(value: Any?): Boolean = when (value) {
 }
 
 /*******************************************************************************
- ** Keep the operator informed of active viewing and expose immediate pause/resume control.
+ ** Keep the operator informed of active or suspended viewing; this indicator is informational and offers no operator control.
  *******************************************************************************/
 @Composable
 internal fun ScreenViewingIndicator(controller: MobileSessionController) {
    if (controller.viewing || controller.operatorPaused) Surface(color = MaterialTheme.colorScheme.secondaryContainer)
    {
-      Row(Modifier.fillMaxWidth().padding(horizontal = 12.dp), verticalAlignment = Alignment.CenterVertically)
+      Row(Modifier.fillMaxWidth().padding(horizontal = 12.dp, vertical = 8.dp), verticalAlignment = Alignment.CenterVertically)
       {
          Text(if (controller.operatorPaused) "Screen viewing paused" else "Screen being viewed by an administrator", Modifier.weight(1f))
-         TextButton(onClick = { if (controller.operatorPaused) controller.allowViewing() else controller.pauseViewing() })
-         { Text(if (controller.operatorPaused) "Allow viewing" else "Stop viewing") }
       }
    }
 }

scanner-host/src/main/java/io/qrun/mobile/scanner/WallpaperStatus.kt

@@ -0,0 +1,193 @@
+/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
+package io.qrun.mobile.scanner
+
+/*******************************************************************************
+ ** What this process currently knows about the operator's session. Never persisted: a new process starts UNKNOWN.
+ *******************************************************************************/
+internal enum class WallpaperSessionState { UNKNOWN, SIGNED_OUT, SIGNED_IN }
+
+/*******************************************************************************
+ ** Immutable display-only snapshot. Holds no credential, token, cookie or session identifier.
+ *******************************************************************************/
+internal data class WallpaperSnapshot(
+   val state: WallpaperSessionState = WallpaperSessionState.UNKNOWN,
+   val displayName: String? = null,
+   val serverHost: String? = null,
+   val brandName: String = HostBrand().displayName,
+   val brandColor: String = HostBrand().primaryColor,
+   val foreground: Boolean = false,
+   val confirmedAtElapsed: Long = 0L,
+   val confirmedAtWall: Long = 0L,
+)
+
+/*******************************************************************************
+ ** Observer notified after a snapshot changes; it may be called on any thread.
+ *******************************************************************************/
+internal fun interface WallpaperStatusListener {
+   /*******************************************************************************
+    ** Read the new snapshot from the store; the callback carries no data.
+    *******************************************************************************/
+   fun changed()
+}
+
+/*******************************************************************************
+ ** In-memory publisher of the approved session display name. Identity is dropped on sign-out and clear.
+ *******************************************************************************/
+internal class WallpaperStatusStore(private val elapsed: () -> Long, private val wall: () -> Long) {
+   private val lock = Any()
+   private val listeners = LinkedHashSet<WallpaperStatusListener>()
+   @Volatile
+   var snapshot = WallpaperSnapshot()
+      private set
+
+   /*******************************************************************************
+    ** Register until removed; the wallpaper engine removes itself when it stops being visible or is destroyed.
+    *******************************************************************************/
+   fun addListener(listener: WallpaperStatusListener) = synchronized(lock) { listeners.add(listener) }
+
+   /*******************************************************************************
+    ** Stop notifying a listener; safe to call when it was never added.
+    *******************************************************************************/
+   fun removeListener(listener: WallpaperStatusListener) = synchronized(lock) { listeners.remove(listener) }
+
+   /*******************************************************************************
+    ** Apply the validated public brand of the selected server; invalid values keep the current brand.
+    *******************************************************************************/
+   fun setBrand(name: String, color: String) {
+      val cleanName = cleanText(name, 80) ?: return
+      if (!BRAND_COLOR.matches(color)) return
+      update { it.copy(brandName = cleanName, brandColor = color.uppercase()) }
+   }
+
+   /*******************************************************************************
+    ** Record a signed-in, device-approved session. Each call confirms the session as of now; the caller invokes it
+    ** again with foreground=false as the app leaves the screen, which is the last time the server was reachable.
+    *******************************************************************************/
+   fun signedIn(displayName: String?, serverHost: String?, foreground: Boolean) {
+      update {
+         it.copy(
+            state = WallpaperSessionState.SIGNED_IN, displayName = cleanText(displayName, MAX_NAME), serverHost = cleanText(serverHost, 80),
+            foreground = foreground, confirmedAtElapsed = elapsed(), confirmedAtWall = wall()
+         )
+      }
+   }
+
+   /*******************************************************************************
+    ** Drop identity when a signed-in session ends (logout, unauthorized, revocation); leave other states alone so
+    ** startup does not claim "signed out" before restoration finishes.
+    *******************************************************************************/
+   fun signedOutIfSignedIn() {
+      if (snapshot.state == WallpaperSessionState.SIGNED_IN) update { it.signedOutCopy() }
+   }
+
+   /*******************************************************************************
+    ** Forget everything session-related (activity destroyed, server change): the state becomes UNKNOWN, not signed out.
+    *******************************************************************************/
+   fun clear() = update { it.copy(state = WallpaperSessionState.UNKNOWN, displayName = null, serverHost = null, foreground = false, confirmedAtElapsed = 0L, confirmedAtWall = 0L) }
+
+   private fun WallpaperSnapshot.signedOutCopy() =
+      copy(state = WallpaperSessionState.SIGNED_OUT, displayName = null, serverHost = null, foreground = false, confirmedAtElapsed = 0L, confirmedAtWall = 0L)
+
+   /*******************************************************************************
+    ** Swap the snapshot and notify outside the lock so a listener cannot deadlock the publisher.
+    *******************************************************************************/
+   private fun update(change: (WallpaperSnapshot) -> WallpaperSnapshot) {
+      val toNotify = synchronized(lock) {
+         val next = change(snapshot)
+         if (next == snapshot) return
+         snapshot = next
+         listeners.toList()
+      }
+      toNotify.forEach { it.changed() }
+   }
+
+   /*******************************************************************************
+    ** Single-line presentation text only: no control characters, bounded length, null when empty.
+    *******************************************************************************/
+   companion object {
+      const val MAX_NAME = 40
+      private val BRAND_COLOR = Regex("#[0-9a-fA-F]{6}")
+
+      /*******************************************************************************
+       ** Normalize display text before it can reach a canvas.
+       *******************************************************************************/
+      fun cleanText(raw: String?, max: Int): String? = raw?.filterNot { it.isISOControl() }?.trim()?.take(max)?.takeIf { it.isNotEmpty() }
+   }
+}
+
+/*******************************************************************************
+ ** Where the wallpaper is being drawn. Identity and IP are shown only for HOME.
+ *******************************************************************************/
+internal enum class WallpaperContext { PREVIEW, LOCKED, HOME }
+
+/*******************************************************************************
+ ** Text and colours for one frame.
+ *******************************************************************************/
+internal data class WallpaperFrame(val header: String, val lines: List<String>, val colorHex: String, val darkText: Boolean)
+
+/*******************************************************************************
+ ** Pure rules that decide what the wallpaper may say, so they can be tested without a device.
+ *******************************************************************************/
+internal object WallpaperPresentation {
+   /** The heartbeat only runs while the app is foreground; beyond this the name is no longer shown. */
+   const val STALE_AFTER_MILLIS = 15 * 60 * 1000L
+
+   /*******************************************************************************
+    ** A signed-in session whose app has been in the background past the window is unverified, not signed in.
+    *******************************************************************************/
+   fun isStale(snapshot: WallpaperSnapshot, nowElapsed: Long) =
+      snapshot.state == WallpaperSessionState.SIGNED_IN && !snapshot.foreground && nowElapsed - snapshot.confirmedAtElapsed >= STALE_AFTER_MILLIS
+
+   /*******************************************************************************
+    ** Milliseconds until a displayed, not-yet-stale name must be withdrawn, or null when no timer is needed.
+    *******************************************************************************/
+   fun millisUntilStale(snapshot: WallpaperSnapshot, nowElapsed: Long): Long? =
+      if (snapshot.state == WallpaperSessionState.SIGNED_IN && !snapshot.foreground && !isStale(snapshot, nowElapsed))
+         STALE_AFTER_MILLIS - (nowElapsed - snapshot.confirmedAtElapsed) else null
+
+   /*******************************************************************************
+    ** Compose the IP line from what the network callback last reported.
+    *******************************************************************************/
+   fun networkLine(known: Boolean, addresses: String?) = when {
+      !known -> "IP: unknown"
+      addresses == null -> "IP: no network address"
+      else -> "IP: $addresses"
+   }
+
+   /*******************************************************************************
+    ** Brand only for PREVIEW and LOCKED. HOME adds session state, the approved display name only while it is fresh,
+    ** the server host, and the IP. The wording never claims the server just verified a background session.
+    *******************************************************************************/
+   fun render(snapshot: WallpaperSnapshot, context: WallpaperContext, networkLine: String, nowElapsed: Long, formatTime: (Long) -> String): WallpaperFrame {
+      val dark = useBlackOnPrimary(snapshot.brandColor)
+      if (context != WallpaperContext.HOME) return WallpaperFrame(snapshot.brandName, emptyList(), snapshot.brandColor, dark)
+      val lines = mutableListOf<String>()
+      when (snapshot.state) {
+         WallpaperSessionState.UNKNOWN -> lines += "Session: not available"
+         WallpaperSessionState.SIGNED_OUT -> lines += "Signed out"
+         WallpaperSessionState.SIGNED_IN -> if (isStale(snapshot, nowElapsed)) {
+            lines += "Session unverified"
+            lines += "Last confirmed ${formatTime(snapshot.confirmedAtWall)}"
+         } else {
+            lines += snapshot.displayName?.let { "Signed in: $it" } ?: "Signed in"
+            if (!snapshot.foreground) lines += "Last confirmed ${formatTime(snapshot.confirmedAtWall)} (app in background)"
+            snapshot.serverHost?.let { lines += "Server: $it" }
+         }
+      }
+      lines += networkLine
+      return WallpaperFrame(snapshot.brandName, lines, snapshot.brandColor, dark)
+   }
+}
+
+/*******************************************************************************
+ ** Summarize the default network's link addresses for display: interface label plus up to two usable addresses,
+ ** IPv4 first. Loopback and IPv6 link-local addresses are omitted; scope suffixes are stripped. Null when none remain.
+ *******************************************************************************/
+internal fun formatNetworkAddresses(interfaceName: String?, addresses: List<String>): String? {
+   val usable = addresses.map { it.substringBefore('%') }
+      .filter { it.isNotBlank() && !it.startsWith("fe80", ignoreCase = true) && it != "::1" && !it.startsWith("127.") }
+      .distinct()
+   if (usable.isEmpty()) return null
+   val label = interfaceName?.filter { it.isLetterOrDigit() || it == '.' || it == '_' || it == '-' }?.take(16)?.takeIf { it.isNotEmpty() }
+   return (label?.let { "$it " } ?: "") + usable.sortedBy { it.contains(':') }.take(2).joinToString(", ")
+}

scanner-host/src/main/java/io/qrun/mobile/scanner/ZebraScannerDriver.kt

@@ -8,6 +8,7 @@ import com.symbol.emdk.EMDKManager
 import com.symbol.emdk.EMDKResults
 import com.symbol.emdk.barcode.BarcodeManager
 import com.symbol.emdk.barcode.Scanner
+import com.symbol.emdk.barcode.ScannerConfig
 import com.symbol.emdk.barcode.StatusData
 
 /*******************************************************************************
@@ -29,9 +30,27 @@ internal class ZebraScannerDriver(private val context: Context) : ScannerDriver
    private var closed = false
    private var opening = false
    private var ownsClaim = false
+
+   /*******************************************************************************
+    ** The scanner's output format as this driver has proven it. Text is accepted only in AIM (prefix present and
+    ** confirmed by read-back) or PLAIN (unchanged or restored, confirmed by read-back); PENDING and FAILED are
+    ** indeterminate, so any decode, and any readiness signal, is withheld.
+    *******************************************************************************/
+   private enum class Profile { PENDING, AIM, PLAIN, FAILED }
+
+   // Application-owned, temporary: AIM is set only after applying codeIdType=AIM and reading the same value back.
+   // The original value is restored (and read back) before the scanner is released.
+   @Volatile private var profile = Profile.PENDING
+   private var idleSeenBeforeProfile = false
+   private var originalCodeIdType: ScannerConfig.CodeIdType? = null
+   private var codeIdTypeChanged = false
    private val dataListener = Scanner.DataListener { collection ->
-      // Copy SDK-owned data now; the collection must not be read after this callback returns. AIM is never
-      // inferred here: it stays absent until a qualified driver obtains it from an explicit source.
+      // Copy SDK-owned data now; the collection must not be read after this callback returns. AIM is read only
+      // under the confirmed profile, by AimOutputProfile; without it the text is user payload and stays untouched.
+      // This runs on an SDK thread, possibly while the open sequence is still configuring: an unresolved or failed
+      // format drops the decode instead of guessing. The hardware read completes and the next IDLE re-arms it.
+      val mode = profile
+      if (mode != Profile.AIM && mode != Profile.PLAIN) return@DataListener
       val scans = collection?.scanData
       var capture: ScannerCapture? = null
       var multiple = false
@@ -40,8 +59,16 @@ internal class ZebraScannerDriver(private val context: Context) : ScannerDriver
          else {
             val scan = scans.single()
             val barcode = scan?.data
-            if (!barcode.isNullOrEmpty())
-               capture = ScannerCapture.of(barcode, scan.labelType?.toString() ?: "UNKNOWN", scan.rawData)
+            val label = scan?.labelType?.toString() ?: "UNKNOWN"
+            if (!barcode.isNullOrEmpty()) {
+               if (mode == Profile.PLAIN) capture = ScannerCapture.of(barcode, label, scan.rawData)
+               else {
+                  // A missing or inconsistent prefix under the confirmed profile drops the read; it is never guessed.
+                  // Raw bytes stay exactly what the SDK returned, whether or not they carry the same prefix.
+                  val split = AimOutputProfile.split(barcode, label)
+                  if (split != null) capture = ScannerCapture.of(split.payload, label, scan.rawData, split.aimIdentifier)
+               }
+            }
          }
       }
       val delivered = capture
@@ -54,8 +81,11 @@ internal class ZebraScannerDriver(private val context: Context) : ScannerDriver
    private val statusListener = Scanner.StatusListener { status ->
       main.post {
          if (!closed) {
-            if (status.state == StatusData.ScannerStates.IDLE) listener?.idle()
-            else if (status.state == StatusData.ScannerStates.ERROR) listener?.failed()
+            if (status.state == StatusData.ScannerStates.IDLE) {
+               // Readiness arms a read. It is withheld until the output format is proven, then replayed once.
+               if (profile == Profile.AIM || profile == Profile.PLAIN) listener?.idle()
+               else if (profile == Profile.PENDING) idleSeenBeforeProfile = true
+            } else if (status.state == StatusData.ScannerStates.ERROR) listener?.failed()
          }
       }
    }
@@ -97,7 +127,15 @@ internal class ZebraScannerDriver(private val context: Context) : ScannerDriver
                         device.addStatusListener(statusListener)
                         device.triggerType = Scanner.TriggerType.HARD
                         device.enable()
+                        if (!applyAimProfile(device)) {
+                           profile = Profile.FAILED
+                           this@ZebraScannerDriver.listener?.failed()
+                        } else if (idleSeenBeforeProfile) {
+                           idleSeenBeforeProfile = false
+                           this@ZebraScannerDriver.listener?.idle()
+                        }
                      } catch (exception: Exception) {
+                        profile = Profile.FAILED
                         this@ZebraScannerDriver.listener?.failed()
                      }
                   }
@@ -157,31 +195,100 @@ internal class ZebraScannerDriver(private val context: Context) : ScannerDriver
       scanner = null
       manager = null
       var failure: Exception? = null
+      var releaseFailure: Exception? = null
 
       /*******************************************************************************
        ** Attempt every resource release even when an earlier cleanup fails, then propagate the recorded failure.
+       ** Only a failed device or manager release means ownership is unknown; other failures are still reported.
        *******************************************************************************/
-      fun attempt(action: () -> Unit) {
+      fun attempt(isRelease: Boolean = false, action: () -> Unit) {
          try {
             action()
          } catch (exception: Exception) {
             failure = exception
+            if (isRelease) releaseFailure = exception
          }
       }
       if (device != null) {
          attempt { device.removeDataListener(dataListener) }
          attempt { device.removeStatusListener(statusListener) }
          attempt { if (device.isReadPending) device.cancelRead() }
-         attempt { device.release() }
+         attempt { check(restoreCodeIdType(device)) { "Scanner output profile restoration could not be verified" } }
+         attempt(isRelease = true) { device.release() }
       }
       if (owner != null) {
-         attempt { owner.release(EMDKManager.FEATURE_TYPE.BARCODE) }
-         attempt { owner.release() }
+         attempt(isRelease = true) { owner.release(EMDKManager.FEATURE_TYPE.BARCODE) }
+         attempt(isRelease = true) { owner.release() }
       }
-      if (!opening && failure == null) releaseClaim()
+      // A confirmed device and manager release frees the application-wide claim even when restoring the scanner's
+      // output format failed; an unconfirmed release keeps it, and a pending asynchronous bind still resolves it later.
+      if (!opening && releaseFailure == null) releaseClaim()
       failure?.let { throw it }
    }
 
+   /*******************************************************************************
+    ** Ask the enabled scanner to prefix each decode with its AIM identifier and prove the resulting format by
+    ** reading it back, whatever the setter reported. A setter that threw is not trusted either way: the read-back
+    ** decides. AIM confirmed -> AIM; unchanged or restored-and-verified -> PLAIN; anything else -> false (the caller
+    ** fails the open), because prefixed text would then be indistinguishable from user data. An unsupported setting
+    ** changes nothing and leaves AIM absent (PLAIN). Reading the original value may throw; the caller fails the open.
+    *******************************************************************************/
+   private fun applyAimProfile(device: Scanner): Boolean {
+      val config = device.config
+      if (!config.isParamSupported("config.scanParams.codeIdType")) {
+         profile = Profile.PLAIN
+         return true
+      }
+      val original = config.scanParams.codeIdType
+      originalCodeIdType = original
+      codeIdTypeChanged = true
+      config.scanParams.codeIdType = ScannerConfig.CodeIdType.AIM
+      try {
+         device.config = config
+      } catch (exception: Exception) {
+         android.util.Log.w("Scanner", "AIM output profile could not be applied")
+      }
+      val effective = try {
+         device.config.scanParams.codeIdType
+      } catch (exception: Exception) {
+         null
+      }
+      return when (classifyAimReadback(original, ScannerConfig.CodeIdType.AIM, effective)) {
+         AimReadback.CONFIRMED -> {
+            // Nothing to undo when the scanner already reported AIM before this driver touched it.
+            codeIdTypeChanged = original != ScannerConfig.CodeIdType.AIM
+            profile = Profile.AIM
+            true
+         }
+         AimReadback.UNCHANGED -> {
+            codeIdTypeChanged = false
+            profile = Profile.PLAIN
+            true
+         }
+         AimReadback.INDETERMINATE -> restoreCodeIdType(device).also { if (it) profile = Profile.PLAIN }
+      }
+   }
+
+   /*******************************************************************************
+    ** Put back the value read before this driver changed it and prove it by reading it back; setter success alone is
+    ** not proof. The profile is FAILED until proven, so no decode is trusted while the format is indeterminate.
+    *******************************************************************************/
+   private fun restoreCodeIdType(device: Scanner): Boolean {
+      val original = originalCodeIdType
+      if (!codeIdTypeChanged || original == null) return true
+      profile = Profile.FAILED
+      val verified = try {
+         val config = device.config
+         config.scanParams.codeIdType = original
+         device.config = config
+         device.config.scanParams.codeIdType == original
+      } catch (exception: Exception) {
+         false
+      }
+      if (verified) codeIdTypeChanged = false
+      return verified
+   }
+
    /*******************************************************************************
     ** Relinquish only this driver's manager claim after asynchronous opening and cleanup are resolved.
     *******************************************************************************/

scanner-host/src/main/res/values/company_profile.xml

@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+   <string name="status_wallpaper_label">QQQ status wallpaper</string>
+   <string name="status_wallpaper_description">Company name on the lock screen. On the unlocked home screen it also shows the signed-in display name and the device IP address.</string>
+   <string name="restriction_server_url_title">QQQ server URL</string>
+   <string name="restriction_server_url_description">HTTPS origin only, for example https://qqq.example.com/. No credentials, path, query or fragment. A different connected server is never switched silently.</string>
+   <string name="restriction_orientation_title">Screen orientation</string>
+   <string name="restriction_orientation_description">Applied when this value changes; the operator may change it locally afterwards.</string>
+   <string-array name="restriction_orientation_entries">
+      <item>System default</item>
+      <item>Portrait</item>
+      <item>Landscape</item>
+      <item>Reverse portrait</item>
+      <item>Reverse landscape</item>
+   </string-array>
+   <string-array name="restriction_orientation_values">
+      <item>SYSTEM</item>
+      <item>PORTRAIT</item>
+      <item>LANDSCAPE</item>
+      <item>REVERSE_PORTRAIT</item>
+      <item>REVERSE_LANDSCAPE</item>
+   </string-array>
+</resources>

scanner-host/src/main/res/xml/app_restrictions.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<restrictions xmlns:android="http://schemas.android.com/apk/res/android">
+   <restriction android:key="qqq_server_url" android:title="@string/restriction_server_url_title"
+         android:description="@string/restriction_server_url_description" android:restrictionType="string" />
+   <restriction android:key="qqq_orientation" android:title="@string/restriction_orientation_title"
+         android:description="@string/restriction_orientation_description" android:restrictionType="choice"
+         android:entries="@array/restriction_orientation_entries" android:entryValues="@array/restriction_orientation_values" />
+</restrictions>

scanner-host/src/main/res/xml/status_wallpaper.xml

@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="utf-8"?>
+<wallpaper xmlns:android="http://schemas.android.com/apk/res/android"
+      android:thumbnail="@drawable/ic_scanner" android:description="@string/status_wallpaper_description" />

scanner-host/src/test/java/io/qrun/mobile/scanner/AimOutputProfileTest.kt

@@ -0,0 +1,61 @@
+/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
+package io.qrun.mobile.scanner
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+/*******************************************************************************
+ ** The confirmed AIM output profile removes only a consistent three-character prefix.
+ *******************************************************************************/
+class AimOutputProfileTest {
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun splitsConsistentPrefixAndKeepsPayloadExact() {
+      assertEquals(AimOutputProfile.Split("]C0", "001234"), AimOutputProfile.split("]C0001234", "LABEL-TYPE-CODE128"))
+      assertEquals(AimOutputProfile.Split("]Q1", "001234567890"), AimOutputProfile.split("]Q1001234567890", "QRCODE"))
+      assertEquals(AimOutputProfile.Split("]E0", "5901234123457"), AimOutputProfile.split("]E05901234123457", "LABEL-TYPE-EAN13"))
+      assertEquals(AimOutputProfile.Split("]E4", "12345670"), AimOutputProfile.split("]E412345670", "EAN8"))
+      assertEquals(AimOutputProfile.Split("]d1", " A "), AimOutputProfile.split("]d1 A ", "DATAMATRIX"))
+      assertEquals(AimOutputProfile.Split("]X0", "x"), AimOutputProfile.split("]X0x", "LABEL-TYPE-SOMETHING-ELSE"))
+   }
+
+   /*******************************************************************************
+    ** Only the first three characters are removed, even when the user payload looks like an identifier.
+    *******************************************************************************/
+   @Test
+   fun payloadBeginningWithAnIdentifierIsNotStrippedTwice() {
+      assertEquals(AimOutputProfile.Split("]C0", "]C0123"), AimOutputProfile.split("]C0]C0123", "CODE128"))
+      assertEquals(AimOutputProfile.Split("]C0", "]Q1abc"), AimOutputProfile.split("]C0]Q1abc", "CODE128"))
+      assertEquals(AimOutputProfile.Split("]Q1", "]"), AimOutputProfile.split("]Q1]", "QRCODE"))
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun malformedOrInconsistentPrefixIsNotTrusted() {
+      for (text in listOf("", "]", "]C", "]C0", "C0001234", "[C0001234", "]00001234", "]C-001234", "]éC0123", " ]C0123", "001234")) {
+         assertNull(text, AimOutputProfile.split(text, "CODE128"))
+      }
+      // A well-formed prefix that belongs to another symbology family means the label or prefix is not what was configured.
+      assertNull(AimOutputProfile.split("]Q1001234", "CODE128"))
+      assertNull(AimOutputProfile.split("]E0001234567890", "LABEL-TYPE-CODE128"))
+      assertNull(AimOutputProfile.split("]C0001234", "QRCODE"))
+      assertNull(AimOutputProfile.split("]C0001234", "EAN13"))
+   }
+
+   /*******************************************************************************
+    ** The capture constructor accepts exactly what the parser produces.
+    *******************************************************************************/
+   @Test
+   fun parsedIdentifierIsAValidCaptureIdentifier() {
+      val split = AimOutputProfile.split("]z0Hello", "AZTEC")!!
+      val capture = ScannerCapture.of(split.payload, "AZTEC", "]z0Hello".toByteArray(), split.aimIdentifier)
+      assertEquals("Hello", capture.barcode)
+      assertEquals("]z0", capture.aimIdentifier)
+      assertEquals(java.util.Base64.getEncoder().encodeToString("]z0Hello".toByteArray()), capture.rawDataBase64)
+   }
+}

scanner-host/src/test/java/io/qrun/mobile/scanner/AimReadbackTest.kt

@@ -0,0 +1,47 @@
+/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
+package io.qrun.mobile.scanner
+
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+/*******************************************************************************
+ ** The driver may accept scanner text only in a format proven by read-back; everything else must fail closed.
+ *******************************************************************************/
+class AimReadbackTest {
+   private val aim = "AIM"
+   private val original = "NONE"
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun reportedAimIsConfirmedEvenIfTheSetterThrew() {
+      assertEquals(AimReadback.CONFIRMED, classifyAimReadback(original, aim, aim))
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun aScannerAlreadyReportingAimIsConfirmedNotUnchanged() {
+      assertEquals(AimReadback.CONFIRMED, classifyAimReadback(aim, aim, aim))
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun exactlyTheOriginalValueIsUnchanged() {
+      assertEquals(AimReadback.UNCHANGED, classifyAimReadback(original, aim, original))
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun anUnreadableOrForeignValueIsIndeterminate() {
+      assertEquals(AimReadback.INDETERMINATE, classifyAimReadback(original, aim, null))
+      assertEquals(AimReadback.INDETERMINATE, classifyAimReadback(original, aim, "SYMBOL"))
+      assertEquals(AimReadback.INDETERMINATE, classifyAimReadback(aim, aim, null))
+   }
+}

scanner-host/src/test/java/io/qrun/mobile/scanner/ManagedConfigurationTest.kt

@@ -0,0 +1,100 @@
+/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
+package io.qrun.mobile.scanner
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+/*******************************************************************************
+ ** Managed configuration is a bootstrap only: HTTPS origins and exact known orientation names, never silently defaulted.
+ *******************************************************************************/
+class ManagedConfigurationTest {
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun noRestrictionsLeavesEverythingUnmanaged() {
+      assertEquals(ManagedValues(), ManagedConfiguration.parse(null, null))
+      assertEquals(ManagedValues(), ManagedConfiguration.parse("", "  "))
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun acceptsOnlyANormalizedHttpsOrigin() {
+      assertEquals("https://qqq.example.com/", ManagedConfiguration.parse(" https://QQQ.example.com ", null).serverUrl)
+      assertEquals("https://qqq.example.com:8443/", ManagedConfiguration.parse("https://qqq.example.com:8443/", null).serverUrl)
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun rejectsHttpCredentialsPathsQueriesAndGarbageWithoutRecordingTheValue() {
+      listOf(
+         "http://qqq.example.com", "http://127.0.0.1:8080/", "https://user:pw@qqq.example.com", "https://qqq.example.com/app",
+         "https://qqq.example.com/?t=1", "https://qqq.example.com/#f", "ftp://qqq.example.com", "not a url", "https://", "https://" + "a".repeat(2100)
+      ).forEach { value ->
+         val parsed = ManagedConfiguration.parse(value, null)
+         assertNull(value, parsed.serverUrl)
+         assertEquals(listOf(MANAGED_SERVER_URL), parsed.rejectedKeys)
+      }
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun orientationAcceptsEveryExistingNameExactly() {
+      OrientationPolicy.entries.forEach { assertEquals(it, ManagedConfiguration.parse(null, it.name).orientation) }
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun unknownOrientationIsRejectedNotDefaultedToPortrait() {
+      listOf("portrait", "Landscape", "AUTO", "SENSOR", "90", "REVERSE-PORTRAIT").forEach { value ->
+         val parsed = ManagedConfiguration.parse(null, value)
+         assertNull(value, parsed.orientation)
+         assertEquals(listOf(MANAGED_ORIENTATION), parsed.rejectedKeys)
+      }
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun aBadValueDoesNotBlockTheGoodOne() {
+      val parsed = ManagedConfiguration.parse("http://bad.example.com", "LANDSCAPE")
+      assertNull(parsed.serverUrl)
+      assertEquals(OrientationPolicy.LANDSCAPE, parsed.orientation)
+      assertEquals(listOf(MANAGED_SERVER_URL), parsed.rejectedKeys)
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun serverIsNeverSwitchedSilently() {
+      val managed = "https://managed.example.com/"
+      assertEquals(ManagedServerAction.NONE, ManagedConfiguration.serverAction("https://other.example.com/", null))
+      assertEquals(ManagedServerAction.NONE, ManagedConfiguration.serverAction(null, null))
+      assertEquals(ManagedServerAction.PREFILL, ManagedConfiguration.serverAction(null, managed))
+      assertEquals(ManagedServerAction.NONE, ManagedConfiguration.serverAction(managed, managed))
+      assertEquals(ManagedServerAction.OFFER_CHANGE, ManagedConfiguration.serverAction("https://other.example.com/", managed))
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun orientationIsAppliedOnlyWhenTheManagedValueChanges() {
+      assertNull(ManagedConfiguration.orientationToApply(null, null))
+      assertNull(ManagedConfiguration.orientationToApply(null, "LANDSCAPE"))
+      assertEquals(OrientationPolicy.LANDSCAPE, ManagedConfiguration.orientationToApply(OrientationPolicy.LANDSCAPE, null))
+      assertNull(ManagedConfiguration.orientationToApply(OrientationPolicy.LANDSCAPE, "LANDSCAPE"))
+      assertEquals(OrientationPolicy.SYSTEM, ManagedConfiguration.orientationToApply(OrientationPolicy.SYSTEM, "LANDSCAPE"))
+   }
+}

scanner-host/src/test/java/io/qrun/mobile/scanner/ScannerFeedbackTest.kt

@@ -0,0 +1,121 @@
+/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
+package io.qrun.mobile.scanner
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/*******************************************************************************
+ ** The visible scan must survive acknowledgment and retry unchanged, never invent a symbology, and
+ ** claim success only on the same receipt the process requires.
+ *******************************************************************************/
+class ScannerFeedbackTest {
+   private val event = ScanEvent(ScannerCapture.of("00123\u001d45", "LABEL-TYPE-CODE128"), "zebra-emdk")
+   private val receipt = mapOf("acknowledgedEventId" to event.eventId, "scanSaved" to true, "scanId" to "7")
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   private fun derive(last: LastScan?, pending: Map<String, Any?>?, response: Map<String, Any?>, waiting: Boolean = false, cancelling: Boolean = false) =
+      ScannerFeedback.derive(last, pending, response, waiting, cancelling)
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun nothingScannedYieldsNoFeedbackSoThePanelShowsWaiting() {
+      assertNull(derive(null, null, emptyMap()))
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun lastCaptureStaysVisibleAfterFullReceiptClearsPendingState() {
+      val feedback = derive(LastScan.of(event), null, receipt)!!
+      assertEquals("00123\u001d45", feedback.barcode)
+      assertEquals("LABEL-TYPE-CODE128", feedback.symbology)
+      assertEquals("Confirmed by server", feedback.status)
+      assertEquals("8 characters, 1 control character", feedback.details)
+   }
+
+   /*******************************************************************************
+    ** The event id alone is not a receipt: scanSaved=true and a non-blank scanId are also required.
+    *******************************************************************************/
+   @Test
+   fun incompleteReceiptsAreNeverReportedAsConfirmed() {
+      val partial = listOf(
+         mapOf("acknowledgedEventId" to event.eventId),
+         receipt + ("scanSaved" to false),
+         receipt + ("scanId" to " "),
+         receipt - "scanId",
+      )
+      for (response in partial) assertEquals(
+         "Not confirmed. Follow the process message before submitting again.", derive(LastScan.of(event), null, response)!!.status
+      )
+      assertEquals(
+         "Not confirmed. Retry the same request or leave the process; do not assume it was saved.",
+         derive(null, event.values(), partial[1])!!.status
+      )
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun retryShowsTheSameValueAndTypeFromThePendingRequest() {
+      val pending = event.values()
+      val sending = derive(null, pending, emptyMap(), waiting = true)!!
+      val failed = derive(null, pending, emptyMap())!!
+      assertEquals("Sending scan…", sending.status)
+      assertTrue(failed.status.startsWith("Not confirmed. Retry the same request"))
+      for (feedback in listOf(sending, failed)) {
+         assertEquals(event.barcode, feedback.barcode)
+         assertEquals(event.symbology, feedback.symbology)
+      }
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun nextCaptureReplacesAnEarlierConfirmedOne() {
+      val next = ScanEvent(ScannerCapture.of("999", "QRCODE"), "zebra-emdk")
+      val feedback = derive(LastScan.of(event), next.values(), receipt, waiting = true)!!
+      assertEquals("999", feedback.barcode)
+      assertEquals("QRCODE", feedback.symbology)
+      assertEquals("Sending scan…", feedback.status)
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun cancellationIsNotReportedAsConfirmation() {
+      assertEquals("Cancelling. Scan was not confirmed.", derive(LastScan.of(event), event.values(), emptyMap(), cancelling = true)!!.status)
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun manualEntryNeverReceivesAGuessedSymbology() {
+      val manual = ScanEvent(ScannerCapture.manual("00042"), "manual")
+      assertNull(LastScan.of(manual).symbology)
+      assertEquals(ScannerFeedback.MANUAL_SYMBOLOGY, derive(LastScan.of(manual), null, emptyMap())!!.symbology)
+      val pending = derive(null, manual.values(), emptyMap())!!
+      assertEquals(ScannerFeedback.MANUAL_SYMBOLOGY, pending.symbology)
+      assertEquals("00042", pending.barcode)
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun scanContentIsRedactedFromToString() {
+      assertFalse(LastScan.of(event).toString().contains("00123"))
+      assertFalse(derive(LastScan.of(event), null, receipt)!!.toString().contains("00123"))
+   }
+}

scanner-host/src/test/java/io/qrun/mobile/scanner/WallpaperStatusTest.kt

@@ -0,0 +1,189 @@
+/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
+package io.qrun.mobile.scanner
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/*******************************************************************************
+ ** The wallpaper may show identity and IP only on the unlocked home screen, only while fresh, and never keeps either
+ ** after the session ends.
+ *******************************************************************************/
+class WallpaperStatusTest {
+   private var elapsed = 1_000L
+   private var wall = 1_700_000_000_000L
+   private val store = WallpaperStatusStore({ elapsed }, { wall })
+   private val ip = "IP: wlan0 10.0.0.5"
+
+   private fun render(context: WallpaperContext, now: Long = elapsed) =
+      WallpaperPresentation.render(store.snapshot, context, ip, now) { "HH:mm" }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun newProcessIsUnknownAndShowsNoIdentity() {
+      assertEquals(WallpaperSessionState.UNKNOWN, store.snapshot.state)
+      assertEquals(listOf("Session: not available", ip), render(WallpaperContext.HOME).lines)
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun previewAndLockedShowBrandOnlyEvenWhenSignedIn() {
+      store.signedIn("Ada Lovelace", "qqq.example.com", foreground = true)
+      listOf(WallpaperContext.PREVIEW, WallpaperContext.LOCKED).forEach {
+         val frame = render(it)
+         assertEquals(HostBrand().displayName, frame.header)
+         assertTrue(frame.lines.isEmpty())
+      }
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun homeShowsNameServerAndIpWhileForeground() {
+      store.signedIn("Ada Lovelace", "qqq.example.com", foreground = true)
+      assertEquals(listOf("Signed in: Ada Lovelace", "Server: qqq.example.com", ip), render(WallpaperContext.HOME).lines)
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun backgroundSessionIsLabelledLastConfirmedNotLive() {
+      store.signedIn("Ada Lovelace", "qqq.example.com", foreground = true)
+      store.signedIn("Ada Lovelace", "qqq.example.com", foreground = false)
+      val lines = render(WallpaperContext.HOME, elapsed + 60_000).lines
+      assertTrue(lines.contains("Signed in: Ada Lovelace"))
+      assertTrue(lines.contains("Last confirmed HH:mm (app in background)"))
+      assertFalse(lines.any { it.contains("verified", ignoreCase = true) && !it.contains("unverified", ignoreCase = true) })
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun nameIsWithdrawnAfterTheStaleWindow() {
+      store.signedIn("Ada Lovelace", "qqq.example.com", foreground = false)
+      val justBefore = elapsed + WallpaperPresentation.STALE_AFTER_MILLIS - 1
+      val atWindow = elapsed + WallpaperPresentation.STALE_AFTER_MILLIS
+      assertTrue(render(WallpaperContext.HOME, justBefore).lines.contains("Signed in: Ada Lovelace"))
+      assertEquals(1L, WallpaperPresentation.millisUntilStale(store.snapshot, justBefore))
+      val stale = render(WallpaperContext.HOME, atWindow).lines
+      assertEquals(listOf("Session unverified", "Last confirmed HH:mm", ip), stale)
+      assertNull(WallpaperPresentation.millisUntilStale(store.snapshot, atWindow))
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun foregroundSessionNeverGoesStaleOrNeedsATimer() {
+      store.signedIn("Ada Lovelace", null, foreground = true)
+      assertFalse(WallpaperPresentation.isStale(store.snapshot, elapsed + 10 * WallpaperPresentation.STALE_AFTER_MILLIS))
+      assertNull(WallpaperPresentation.millisUntilStale(store.snapshot, elapsed))
+      assertEquals(listOf("Signed in: Ada Lovelace", ip), render(WallpaperContext.HOME).lines)
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun signOutDropsNameAndServerButClearReturnsToUnknown() {
+      store.signedIn("Ada Lovelace", "qqq.example.com", foreground = true)
+      store.signedOutIfSignedIn()
+      assertEquals(WallpaperSessionState.SIGNED_OUT, store.snapshot.state)
+      assertNull(store.snapshot.displayName)
+      assertNull(store.snapshot.serverHost)
+      assertEquals(listOf("Signed out", ip), render(WallpaperContext.HOME).lines)
+      store.signedIn("Grace Hopper", "qqq.example.com", foreground = true)
+      store.clear()
+      assertEquals(WallpaperSessionState.UNKNOWN, store.snapshot.state)
+      assertNull(store.snapshot.displayName)
+      assertFalse(render(WallpaperContext.HOME).lines.any { it.contains("Grace") })
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun startupDoesNotClaimSignedOutBeforeAnySession() {
+      store.signedOutIfSignedIn()
+      assertEquals(WallpaperSessionState.UNKNOWN, store.snapshot.state)
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun displayTextIsSingleLineAndBounded() {
+      store.signedIn("Ada\nLovelace\u0007 ${"x".repeat(100)}", "host", foreground = true)
+      val name = store.snapshot.displayName!!
+      assertTrue(name.length <= WallpaperStatusStore.MAX_NAME)
+      assertTrue(name.none { it.isISOControl() })
+      store.signedIn("   ", "host", foreground = true)
+      assertNull(store.snapshot.displayName)
+      assertEquals(listOf("Signed in", "Server: host", ip), render(WallpaperContext.HOME).lines)
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun brandIsValidatedAndFallsBackToTheDefault() {
+      store.setBrand("Acme Corp", "#aa5500")
+      assertEquals("Acme Corp", store.snapshot.brandName)
+      assertEquals("#AA5500", store.snapshot.brandColor)
+      store.setBrand("Bad", "red")
+      store.setBrand("", "#000000")
+      assertEquals("Acme Corp", store.snapshot.brandName)
+      assertEquals("#AA5500", store.snapshot.brandColor)
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun listenersAreNotifiedUntilRemovedAndOnlyOnRealChange() {
+      var calls = 0
+      val listener = WallpaperStatusListener { calls++ }
+      store.addListener(listener)
+      store.signedIn("Ada", null, foreground = true)
+      elapsed += 1
+      store.signedIn("Ada", null, foreground = true)
+      store.clear()
+      assertEquals(3, calls)
+      store.clear()
+      assertEquals(3, calls)
+      store.removeListener(listener)
+      store.signedIn("Ada", null, foreground = true)
+      assertEquals(3, calls)
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun networkLineDistinguishesUnknownFromNoAddress() {
+      assertEquals("IP: unknown", WallpaperPresentation.networkLine(false, null))
+      assertEquals("IP: no network address", WallpaperPresentation.networkLine(true, null))
+      assertEquals("IP: wlan0 10.0.0.5", WallpaperPresentation.networkLine(true, "wlan0 10.0.0.5"))
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun addressFormattingOmitsLoopbackAndLinkLocalAndPrefersIpv4() {
+      assertEquals("wlan0 10.0.0.5, 2001:db8::1", formatNetworkAddresses("wlan0", listOf("fe80::1%wlan0", "2001:db8::1%wlan0", "10.0.0.5", "127.0.0.1", "::1")))
+      assertEquals("10.0.0.5", formatNetworkAddresses(null, listOf("10.0.0.5")))
+      assertEquals("tun0x 10.8.0.2", formatNetworkAddresses("tun0 \n<x>", listOf("10.8.0.2")))
+      assertNull(formatNetworkAddresses("wlan0", listOf("fe80::1%wlan0", "127.0.0.1")))
+      assertNull(formatNetworkAddresses("wlan0", emptyList()))
+   }
+}

scripts/ci/real-authentik-android.mjs

@@ -0,0 +1,216 @@
+// Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0
+// Opt-in real Authentik native acceptance on ONE physical Zebra TC22 using only the disposable E2E package.
+// See docs/REAL-AUTHENTIK-ACCEPTANCE.md. Never touches the normal scanner package or its data, reverse tcp:8080, any
+// reverse mapping it did not add, or any trust store; never prints the serial, config, cookies or URLs with queries.
+import { spawn } from 'node:child_process';
+import { access, readFile } from 'node:fs/promises';
+import { dirname, join, relative, resolve, isAbsolute } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const E2E_PACKAGE = 'io.qrun.mobile.scanner.e2e';
+export const TEST_PACKAGE = `${E2E_PACKAGE}.test`;
+export const TEST_CLASS = 'io.qrun.mobile.scanner.RealAuthentikAcceptanceTest';
+export const REVERSE_PORTS = ['18443', '19443'];
+export const QQQ_ORIGIN = 'https://localhost:18443';
+const INSTRUMENT_MS = 40 * 60_000;
+
+/** Operator-facing text for the fixed stage names the instrumentation emits; nothing dynamic is ever printed. */
+export const STAGES = {
+   'login-screen-verified': 'Browser login offered, no password fallback.',
+   'browser-A-requested': 'Opening external browser for operator A.',
+   'browser-A-operator-enter-credentials': 'ACTION: in the browser sign in as scanner-a (type the credentials yourself).',
+   'callback-exchange-A-complete': 'Callback and QQQ exchange completed for A.',
+   'device-pending-A': 'Device is pending approval (expected).',
+   'operator-A-verified': 'Principal A verified, session ACTIVE.',
+   'company-signout-requested': 'Company sign-out requested.',
+   'company-signout-operator-confirm-if-asked': 'ACTION: confirm provider logout in the browser if it asks.',
+   'company-signout-verified': 'Company sign-out reported complete.',
+   'operator-A-qqq-session-ended': 'QQQ session for A ended.',
+   'browser-B-requested': 'Opening external browser for operator B.',
+   'browser-B-operator-enter-credentials': 'ACTION: the provider must ask for credentials; sign in as scanner-b.',
+   'callback-exchange-B-complete': 'Callback and QQQ exchange completed for B.',
+   'operator-B-verified': 'Principal B verified, distinct session ACTIVE.',
+};
+
+/*******************************************************************************
+ ** Admit only the exact fixture descriptor, before any adb call. Values are never echoed in errors.
+ *******************************************************************************/
+export function validateConfig(config) {
+   const text = (value, max) => typeof value === 'string' && value.length > 0 && value.length <= max && !/[\r\n\u0000]/.test(value);
+   if (config?.fixtureType !== 'real-authentik-android' || config.qqqOrigin !== QQQ_ORIGIN) throw new Error('Config must describe the real-authentik-android fixture on its exact HTTPS origin.');
+   if (!text(config.adminCookie, 4096)) throw new Error('Config needs the administrator session cookie header value.');
+   const a = config.operators?.A?.display, b = config.operators?.B?.display;
+   if (!text(a, 200) || !text(b, 200) || a === b) throw new Error('Config needs distinct display names for operators A and B.');
+   for (const key of ['A', 'B']) {
+      const actor = config.operators[key].actor;
+      if (actor !== undefined && !text(actor, 200)) throw new Error('Operator actor values must be short single-line text.');
+   }
+   if (config.sessionActorField !== undefined && !/^[A-Za-z][A-Za-z0-9_]{0,63}$/.test(config.sessionActorField)) throw new Error('sessionActorField must be a column name.');
+   return config;
+}
+
+/*******************************************************************************
+ ** The config holds a live administrator session, so it must never sit inside a repository checkout.
+ *******************************************************************************/
+export function configOutsideRepository(configPath, repository) {
+   const relativePath = relative(resolve(repository), resolve(configPath));
+   return relativePath.startsWith('..') || isAbsolute(relativePath);
+}
+
+/*******************************************************************************
+ ** Only the physical Zebra TC22 is a valid target; an emulator or any other device is refused.
+ *******************************************************************************/
+export function validateTarget(serial, properties) {
+   if (!serial || !/^[A-Za-z0-9._:-]+$/.test(serial) || serial.startsWith('emulator-')) throw new Error('ANDROID_SERIAL must name the physical TC22 (emulators are prohibited).');
+   if (properties.qemu === '1' || !/^zebra/i.test(properties.manufacturer ?? '') || !/^TC22/i.test(properties.model ?? '')) throw new Error('The selected device is not the physical Zebra TC22.');
+}
+
+/*******************************************************************************
+ ** Disposable packages are never replaced or reused; the normal package is not consulted.
+ *******************************************************************************/
+export function refuseExistingDisposablePackages(installedLines) {
+   const installed = new Set(installedLines.map(line => line.trim()));
+   for (const pkg of [E2E_PACKAGE, TEST_PACKAGE]) {
+      if (installed.has(`package:${pkg}`)) throw new Error(`${pkg} already exists. Remove it deliberately before this run; it will not be replaced.`);
+   }
+}
+
+/*******************************************************************************
+ ** Parse `adb reverse --list` into "tcp:A tcp:B" mappings (the device-name column is ignored).
+ *******************************************************************************/
+export function parseReverseList(output) {
+   return output.split(/\r?\n/).map(line => line.trim().split(/\s+/)).filter(parts => parts.length >= 3).map(parts => `${parts[parts.length - 2]} ${parts[parts.length - 1]}`);
+}
+
+/*******************************************************************************
+ ** Decide which of the two fixture ports to add. A pre-existing identical mapping is left in place and not owned;
+ ** a differing one is refused rather than changed. Any other mapping (including 8080) is never considered.
+ *******************************************************************************/
+export function planReverse(existing) {
+   const add = [];
+   for (const port of REVERSE_PORTS) {
+      const mappings = existing.filter(mapping => mapping.startsWith(`tcp:${port} `));
+      if (mappings.length === 0) add.push(port);
+      else if (mappings.some(mapping => mapping !== `tcp:${port} tcp:${port}`)) throw new Error(`Existing reverse mapping for ${port} differs; refusing to change it.`);
+   }
+   return add;
+}
+
+/*******************************************************************************
+ ** Classify one instrumentation output line: a fixed stage, the final verdict, a safe failure sentence, or nothing.
+ ** Anything URL-like or query-like is dropped, so no callback, token or credential can be printed.
+ *******************************************************************************/
+export function classifyLine(line) {
+   const stage = /^INSTRUMENTATION_STATUS: qqqStage=([A-Za-z0-9-]+)$/.exec(line);
+   if (stage) return { stage: stage[1], text: STAGES[stage[1]] ?? `Stage ${stage[1]}` };
+   if (/^(OK \(\d+ tests?\)|FAILURES!!!|Tests run:.*)$/.test(line)) return { verdict: line };
+   const assertion = /AssertionError: ([^\r\n]{1,160})/.exec(line);
+   if (assertion && !/[?&=]|https?:/i.test(assertion[1])) return { failure: assertion[1] };
+   return {};
+}
+
+/*******************************************************************************
+ ** The instrumentation command line the launcher runs; fixed, with no value from the config.
+ *******************************************************************************/
+export function instrumentArguments() {
+   return ['shell', 'am', 'instrument', '-w', '-r', '-e', 'realAuthentik', 'true', '-e', 'class', TEST_CLASS, `${TEST_PACKAGE}/androidx.test.runner.AndroidJUnitRunner`];
+}
+
+/*******************************************************************************
+ ** Run adb for the selected device without a shell; never echo its output.
+ *******************************************************************************/
+function adb(adbPath, serial, argv, { input, timeout = 120_000, onLine } = {}) {
+   return new Promise((done, reject) => {
+      const child = spawn(adbPath, ['-s', serial, ...argv], { stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true });
+      let out = '', pending = '';
+      const timer = setTimeout(() => { child.kill(); reject(new Error('adb operation timed out')); }, timeout);
+      child.stdout.on('data', chunk => {
+         out += chunk;
+         if (onLine) { pending += chunk; const lines = pending.split(/\r?\n/); pending = lines.pop(); lines.forEach(onLine); }
+      });
+      child.stderr.on('data', () => {});
+      child.on('error', () => { clearTimeout(timer); reject(new Error('adb could not start')); });
+      child.on('close', code => { clearTimeout(timer); code === 0 ? done(out) : reject(new Error(`adb exited ${code}`)); });
+      child.stdin.end(input ?? '');
+   });
+}
+
+/*******************************************************************************
+ ** Orchestrate one run. Cleanup removes only what this run added: the config file, the two disposable packages
+ ** and the reverse mappings it created. The operator's trust store is never touched.
+ *******************************************************************************/
+async function main(args, environment) {
+   const option = name => { const index = args.indexOf(name); return index < 0 ? undefined : args[index + 1]; };
+   const repository = resolve(option('--repo') ?? join(dirname(fileURLToPath(import.meta.url)), '../..'));
+   const serial = environment.ANDROID_SERIAL;
+   const sdk = environment.ANDROID_HOME ?? environment.ANDROID_SDK_ROOT;
+   const adbPath = sdk ? join(sdk, 'platform-tools', process.platform === 'win32' ? 'adb.exe' : 'adb') : 'adb';
+   const say = text => console.log(String(text).replaceAll(serial ?? '\u0000', '<DEVICE>'));
+
+   if (!args.includes('--confirm-temporary-ca-installed')) throw new Error('Install the temporary test CA through Android settings, then pass --confirm-temporary-ca-installed.');
+   const configPath = option('--config') ?? (() => { throw new Error('--config <owner-private json> is required.'); })();
+   if (!configOutsideRepository(configPath, repository)) throw new Error('Keep the config outside the repository checkout.');
+   const configText = await readFile(configPath, 'utf8');
+   let config;
+   try { config = JSON.parse(configText); } catch { throw new Error('Config is not valid JSON.'); }
+   validateConfig(config);
+   const apks = [
+      join(repository, 'scanner-host/build/outputs/apk/e2e/scanner-host-e2e.apk'),
+      join(repository, 'scanner-host/build/outputs/apk/androidTest/e2e/scanner-host-e2e-androidTest.apk'),
+   ];
+   for (const apk of apks) await access(apk).catch(() => { throw new Error('Build :scanner-host:assembleE2e :scanner-host:assembleE2eAndroidTest first.'); });
+
+   if (!serial || !/^[A-Za-z0-9._:-]+$/.test(serial) || serial.startsWith('emulator-')) throw new Error('ANDROID_SERIAL must name the physical TC22 (emulators are prohibited).');
+   const property = async name => (await adb(adbPath, serial, ['shell', 'getprop', name])).trim();
+   validateTarget(serial, { qemu: await property('ro.kernel.qemu'), manufacturer: await property('ro.product.manufacturer'), model: await property('ro.product.model') });
+   say(`Device: physical TC22, Android ${await property('ro.build.version.release')}`);
+
+   const installed = (await adb(adbPath, serial, ['shell', 'pm', 'list', 'packages', '-u'])).split(/\r?\n/);
+   refuseExistingDisposablePackages(installed);
+   say('Disposable packages are absent; the normal scanner app is neither read nor changed.');
+
+   const reverseList = async () => parseReverseList(await adb(adbPath, serial, ['reverse', '--list']));
+   const before = await reverseList();
+   const owned = planReverse(before);
+   const installedHere = [];
+   let configPushed = false;
+   try {
+      for (const port of owned) await adb(adbPath, serial, ['reverse', '--no-rebind', `tcp:${port}`, `tcp:${port}`]);
+      say(`Reverse mappings added by this run: ${owned.length ? owned.join(', ') : 'none (already present, left in place)'}.`);
+      for (const [apk, pkg] of [[apks[0], E2E_PACKAGE], [apks[1], TEST_PACKAGE]]) {
+         await adb(adbPath, serial, ['install', '--no-streaming', apk], { timeout: 300_000 });
+         installedHere.push(pkg);
+      }
+      await adb(adbPath, serial, ['shell', 'run-as', E2E_PACKAGE, 'mkdir', '-p', 'files']);
+      await adb(adbPath, serial, ['shell', 'run-as', E2E_PACKAGE, 'sh', '-c', "'cat > files/real-auth.json'"], { input: configText });
+      configPushed = true;
+
+      say('Starting. Keep the TC22 unlocked and awake; follow the ACTION lines.');
+      let verdict = '', failure = '';
+      await adb(adbPath, serial, instrumentArguments(), {
+         timeout: INSTRUMENT_MS,
+         onLine: line => {
+            const result = classifyLine(line);
+            if (result.stage) say(result.text);
+            else if (result.verdict) verdict = result.verdict;
+            else if (result.failure && !failure) failure = result.failure;
+         },
+      });
+      if (!/^OK \(/.test(verdict)) throw new Error(`Acceptance did not pass${failure ? `: ${failure}` : '.'}`);
+      say(`PASS: ${verdict}`);
+   } finally {
+      if (configPushed) await adb(adbPath, serial, ['shell', 'run-as', E2E_PACKAGE, 'rm', '-f', 'files/real-auth.json']).catch(() => say('WARNING: could not remove the pushed config; uninstalling the package removes it.'));
+      for (const pkg of [...installedHere].reverse()) await adb(adbPath, serial, ['uninstall', pkg]).catch(() => say(`WARNING: could not uninstall ${pkg}.`));
+      for (const port of owned) await adb(adbPath, serial, ['reverse', '--remove', `tcp:${port}`]).catch(() => say(`WARNING: could not remove reverse ${port}.`));
+      const after = await reverseList().catch(() => null);
+      if (after && JSON.stringify([...after].sort()) !== JSON.stringify([...before].sort())) say('WARNING: reverse mappings differ from the starting set; review manually.');
+      say('Reminder: remove the temporary test CA through Android settings when finished.');
+   }
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+   main(process.argv.slice(2), process.env).catch(error => {
+      console.error(`FAILED: ${String(error.message).replaceAll(process.env.ANDROID_SERIAL ?? '\u0000', '<DEVICE>')}`);
+      process.exitCode = 1;
+   });
+}

scripts/ci/real-authentik-android.test.mjs

@@ -0,0 +1,99 @@
+// Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+   classifyLine, configOutsideRepository, instrumentArguments, parseReverseList, planReverse, refuseExistingDisposablePackages,
+   validateConfig, validateTarget,
+} from './real-authentik-android.mjs';
+
+const config = () => ({
+   fixtureType: 'real-authentik-android', qqqOrigin: 'https://localhost:18443', adminCookie: 'synthetic-cookie-value',
+   operators: { A: { display: 'Operator A' }, B: { display: 'Operator B' } },
+});
+
+/*******************************************************************************
+ ** A wrong origin, fixture type or identical operators must stop the run before any adb call.
+ *******************************************************************************/
+test('config is admitted only for the exact fixture origin with distinct operators', () => {
+   assert.doesNotThrow(() => validateConfig(config()));
+   for (const bad of [
+      { ...config(), qqqOrigin: 'https://localhost:18443/' }, { ...config(), qqqOrigin: 'http://localhost:18443' },
+      { ...config(), qqqOrigin: 'https://127.0.0.1:18443' }, { ...config(), fixtureType: 'echo-ui-e2e' }, { ...config(), adminCookie: '' },
+      { ...config(), adminCookie: 'a\nb' }, { ...config(), operators: { A: { display: 'Same' }, B: { display: 'Same' } } },
+      { ...config(), sessionActorField: 'a; DROP' },
+   ]) assert.throws(() => validateConfig(bad));
+});
+
+/*******************************************************************************
+ ** Errors must not echo the secret they reject.
+ *******************************************************************************/
+test('a rejected config never leaks the cookie into the error', () => {
+   const bad = { ...config(), adminCookie: 'secret-cookie\nvalue' };
+   assert.throws(() => validateConfig(bad), error => !error.message.includes('secret-cookie'));
+});
+
+/*******************************************************************************
+ ** The config holds a live administrator session; a checkout path must be refused.
+ *******************************************************************************/
+test('config inside the repository is refused, outside is allowed', () => {
+   assert.equal(configOutsideRepository('/work/repo/scripts/config.json', '/work/repo'), false);
+   assert.equal(configOutsideRepository('/work/repo/config.json', '/work/repo'), false);
+   assert.equal(configOutsideRepository('/work/private/config.json', '/work/repo'), true);
+   assert.equal(configOutsideRepository('/work/repository-other/config.json', '/work/repo'), true);
+});
+
+/*******************************************************************************
+ ** Only the physical Zebra TC22 may be targeted.
+ *******************************************************************************/
+test('emulators and other devices are refused as targets', () => {
+   assert.doesNotThrow(() => validateTarget('SYNTHETIC_SERIAL', { qemu: '', manufacturer: 'Zebra Technologies', model: 'TC22' }));
+   assert.throws(() => validateTarget('emulator-5554', { qemu: '1', manufacturer: 'Google', model: 'sdk' }));
+   assert.throws(() => validateTarget('SYNTHETIC_SERIAL', { qemu: '1', manufacturer: 'Zebra', model: 'TC22' }));
+   assert.throws(() => validateTarget('SYNTHETIC_SERIAL', { qemu: '', manufacturer: 'Samsung', model: 'TC22' }));
+   assert.throws(() => validateTarget('SYNTHETIC_SERIAL', { qemu: '', manufacturer: 'Zebra', model: 'TC27' }));
+   assert.throws(() => validateTarget('bad serial; rm', { qemu: '', manufacturer: 'Zebra', model: 'TC22' }));
+   assert.throws(() => validateTarget(undefined, { qemu: '', manufacturer: 'Zebra', model: 'TC22' }));
+});
+
+/*******************************************************************************
+ ** An existing disposable package could hold another run's state; it is never replaced.
+ *******************************************************************************/
+test('existing disposable packages are refused and the normal package is irrelevant', () => {
+   assert.doesNotThrow(() => refuseExistingDisposablePackages(['package:io.qrun.mobile.scanner', 'package:com.android.chrome']));
+   assert.throws(() => refuseExistingDisposablePackages(['package:io.qrun.mobile.scanner.e2e']));
+   assert.throws(() => refuseExistingDisposablePackages(['package:io.qrun.mobile.scanner.e2e.test']));
+});
+
+/*******************************************************************************
+ ** Only 18443 and 19443 may ever be added; 8080 and every other mapping are invisible to the plan.
+ *******************************************************************************/
+test('reverse plan adds only missing fixture ports and never considers other mappings', () => {
+   const existing = parseReverseList('host-1 tcp:8080 tcp:57832\nhost-1 tcp:18081 tcp:18081\n');
+   assert.deepEqual(planReverse(existing), ['18443', '19443']);
+   assert.deepEqual(planReverse(parseReverseList('host-1 tcp:18443 tcp:18443\n')), ['19443']);
+   assert.deepEqual(planReverse(parseReverseList('host-1 tcp:18443 tcp:18443\nhost-1 tcp:19443 tcp:19443\n')), []);
+   assert.throws(() => planReverse(parseReverseList('host-1 tcp:19443 tcp:9999\n')));
+   assert.ok(planReverse([]).every(port => ['18443', '19443'].includes(port)));
+});
+
+/*******************************************************************************
+ ** Output handling must map fixed stages and drop anything carrying a URL or query.
+ *******************************************************************************/
+test('instrumentation output exposes only fixed stages, the verdict and a safe failure', () => {
+   assert.deepEqual(classifyLine('INSTRUMENTATION_STATUS: qqqStage=operator-A-verified'), { stage: 'operator-A-verified', text: 'Principal A verified, session ACTIVE.' });
+   assert.deepEqual(classifyLine('OK (1 test)'), { verdict: 'OK (1 test)' });
+   assert.deepEqual(classifyLine('java.lang.AssertionError: Native sign-in did not complete'), { failure: 'Native sign-in did not complete' });
+   assert.deepEqual(classifyLine('java.lang.AssertionError: bad https://host/cb?code=abc'), {});
+   assert.deepEqual(classifyLine('INSTRUMENTATION_STATUS: stack=https://localhost:19443/x?code=secret'), {});
+   assert.deepEqual(classifyLine('INSTRUMENTATION_STATUS: qqqStage=bad stage'), {});
+});
+
+/*******************************************************************************
+ ** The launched class is fixed, opts in explicitly and carries nothing from the config.
+ *******************************************************************************/
+test('instrumentation targets only the opt-in class in the disposable test package', () => {
+   const joined = instrumentArguments().join(' ');
+   assert.match(joined, /-e realAuthentik true/);
+   assert.match(joined, /io\.qrun\.mobile\.scanner\.e2e\.test\/androidx\.test\.runner\.AndroidJUnitRunner$/);
+   assert.equal(joined.includes('cookie'), false);
+});

scripts/ci/scanner-e2e-runner.mjs

@@ -30,9 +30,9 @@ export function validateEchoFixtureDescriptor(fixture) {
  *******************************************************************************/
 export function validateEchoFixtureContract(version, branding) {
    const extension = Array.isArray(version?.extensions) ? version.extensions.find(value => value.name === 'mobile-scanners') : null;
-   if (version?.apiVersion !== '1.10.0' || extension?.version !== '1.4.0' || extension.pathPrefix !== '/qbit/mobile-scanners' ||
+   if (version?.apiVersion !== '1.10.0' || !['1.4.0', '1.5.0'].includes(extension?.version) || extension.pathPrefix !== '/qbit/mobile-scanners' ||
          branding?.displayName !== 'Echo UI E2E — simulated printing') {
-      throw new Error('Echo requires the simulated Echo fixture with core UI API1.10 and mobile-scanners1.4.');
+      throw new Error('Echo requires the simulated Echo fixture with core UI API1.10 and mobile-scanners1.4 or 1.5.');
    }
 }
 
@@ -335,8 +335,9 @@ export async function runScannerE2e(options = {}) {
             await adbRun('shell', 'run-as', packageName, 'mkdir', '-p', 'shared_prefs');
             await run(adb, [...adbPrefix, 'shell', 'run-as', packageName, 'sh', '-c', "'cat > shared_prefs/host.xml'"],
                '<?xml version="1.0" encoding="utf-8" standalone="yes" ?><map><boolean name="locationReportingEnabled" value="false" /><boolean name="locationPermissionRequested" value="true" /></map>');
-         } else if ((phase.name ?? phase.mode) === 'session-monitor' && packageName === 'io.qrun.mobile.scanner.e2e') {
+         } else if ((phase.name ?? phase.mode) === 'session-monitor') {
             // Preserve this scenario's real denied-location telemetry assertion without an OS dialog.
+            // Package selection already limits this to the disposable e2e or physical qa application.
             await adbRun('shell', 'pm', 'revoke', packageName, 'android.permission.ACCESS_FINE_LOCATION');
             await adbRun('shell', 'pm', 'revoke', packageName, 'android.permission.ACCESS_COARSE_LOCATION');
             await adbRun('shell', 'run-as', packageName, 'mkdir', '-p', 'shared_prefs');
@@ -360,7 +361,7 @@ export async function runScannerE2e(options = {}) {
          }
          reports.push({ scenario: phase.name ?? phase.mode, ...proxy.verify(!phase.expectedError, Boolean(phase.requireCancel), Boolean(phase.requireSession), Boolean(phase.requirePhotos)) });
          if (echo) {
-            const expectedStages = ['echo-document-selected', 'echo-stale-document-cleared', 'echo-setup-selected', 'echo-first-queued', 'echo-second-queued', 'echo-recreation-stable', 'echo-run-closed'];
+            const expectedStages = ['echo-copies-defaulted', 'echo-document-selected', 'echo-stale-document-cleared', 'echo-copies-selected', 'echo-setup-selected', 'echo-first-queued', 'echo-second-queued', 'echo-recreation-stable', 'echo-copies-persisted', 'echo-run-closed'];
             if (expectedStages.some(stage => !stages.has(stage))) throw new Error('Echo did not complete every setup/queue/recreation/cancellation stage.');
             await writeFile(join(echoEvidence, 'echo-proof.json'), JSON.stringify({ status: 'PASSED', fixtureType: 'echo-ui-e2e', simulatedPrinting: true,
                artifacts: echoArtifacts, completedStages: expectedStages, acceptedScans: 2, ...reports.at(-1), physicalScannerQualified: false, physicalPrintingQualified: false }, null, 2));

scripts/ci/scanner-echo-guards.test.mjs

@@ -37,6 +37,7 @@ test('Echo artifacts and error text contain no selected serial', () => {
 test('explicit simulated Echo descriptor is accepted', () => {
    assert.equal(validateEchoFixtureDescriptor(fixture).port, '49152');
    validateEchoFixtureContract(version, branding);
+   validateEchoFixtureContract({ ...version, extensions: [{ ...version.extensions[0], version: '1.5.0' }] }, branding);
 });
 
 /*******************************************************************************
@@ -75,6 +76,10 @@ test('wrong-purpose or incomplete credentials are refused', () => {
 test('contract and simulated branding must match the prepared cohort', () => {
    assert.throws(() => validateEchoFixtureContract({ ...version, apiVersion: '1.9.0' }, branding));
    assert.throws(() => validateEchoFixtureContract({ ...version, extensions: [{ ...version.extensions[0], version: '1.3.0' }] }, branding));
+   for (const unsupported of ['1.6.0', '1.5.1', '1.4.1', '2.0.0', '1.10.0', '1.5']) {
+      assert.throws(() => validateEchoFixtureContract({ ...version, extensions: [{ ...version.extensions[0], version: unsupported }] }, branding));
+   }
+   assert.throws(() => validateEchoFixtureContract({ ...version, extensions: [{ ...version.extensions[0], version: '1.5.0', pathPrefix: '/other' }] }, branding));
    assert.throws(() => validateEchoFixtureContract(version, { displayName: 'QQQ Mobile' }));
 });