ci: qualify shared Android unit and emulator jobs

Co-Authored-By: Codex <noreply@openai.com>
feat(scanner): send immutable raw bytes to compatible semantic servers
2026-11-02 18:18:04 +00:00 · 2026-11-02 10:56:59 -06:00 · 2026-11-02 07:53:42 -06:00 · 2026-11-02 07:10:00 -06:00 · 2026-11-01 21:21:44 -06:00 · 2026-11-01 23:05:30 +00:00
30 changed files with 767 additions and 55 deletions
@@ -0,0 +1,22 @@
+# STATIC QUALIFICATION TEMPLATE, NOT A PRODUCTION CALLER. Do not copy, commit or dispatch until every UNRESOLVED_* value is
+# replaced by an actual value and the result is frozen-reviewed. Final production stays the central policy / organisation
+# workflow: no per-repository bespoke Android workflow survives qualification.
+#
+# Owner branch rules for the one qualification run:
+#   - derive the branch from the recorded current Android source head (never from the peer PR10 branch);
+#   - the branch changes only this one workflow file (.gitea/workflows/android-qualification.yaml) and nothing else;
+#   - the branch is created and the workflow dispatched by the owner after the runtime gates in rollout.md pass.
+# Manual only: no push or pull_request trigger, so nothing runs by accident and no fork event can reach the runner.
+name: android-qualification
+on:
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: android-qualification-${{ github.ref }}
+  cancel-in-progress: false
+jobs:
+  ci:
+    uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/android.yaml@4a7f159b82727e93689799d93ee03288a36208ba
+    with:
+      runner: android-build
@@ -38,7 +38,7 @@ The same APK runs on other Android devices with explicit manual entry. When the

 The shared launcher name/icon remain QQQ Mobile. On connecting to a server, the host reads public `GET /qqq/v1/qbit/mobile-scanners/branding` (`displayName`, `primaryColor`, optional `logoUrl`). The name and Material theme apply to login, device approval, and native app screens. Names are limited to 80 printable characters and colors to `#RRGGBB`; malformed values fall back to QQQ defaults. Button foregrounds choose readable black/white contrast. Optional logos must use HTTPS, are fetched without session/device headers or cookies, and cannot prevent login if unavailable. Responses are size-limited, redirects are disabled, and branding is reset when changing servers. Reconnect to pick up server branding changes; no APK rebuild is needed.

-The persistent footer shows **Checking**, **Connected**, or **Disconnected** with the last check time. It checks `GET /qqq/v1/qbit/mobile-scanners/status` every five seconds while foregrounded and on network changes; `Connected` means a valid `{ "status": "ok" }` response, not sign-in or device approval. Tap the footer for **Copy**, **Clear**, and **Close** diagnostics. The in-memory log holds the latest 100 fixed event codes with timestamps, HTTP status, and latency for branding, connection checks, native QQQ calls (including login/process requests), and device enrollment/status requests. A transport failure has no HTTP status; an HTTP response retains its status, including 401/403/500 errors. The log contains no credentials, scan values, request paths, queries, raw response text, or exception messages. Changing servers clears the displayed diagnostics. Monitoring never queues or retries a scan.
+The persistent footer shows **Checking**, **Connected**, or **Disconnected** with the last check time. It checks `GET /qqq/v1/qbit/mobile-scanners/status` every five seconds while foregrounded and on network changes; `Connected` means a valid `{ "status": "ok" }` response, not sign-in or device approval. Tap the footer, or use the Diagnostics entry in the menu, to open a full-screen diagnostics view with a server connection summary (reachability only), the recent activity newest first in local time, **All** and **Problems** filters, **Pause updates** and **Resume live updates**, **Copy**, **Share** and **Clear**, and **Back**. While it is open, process input stays blocked. The in-memory log holds the latest 100 fixed event codes with timestamps, HTTP status, and latency for branding, connection checks, native QQQ calls (including login/process requests), and device enrollment/status requests. A transport failure has no HTTP status; an HTTP response retains its status, including 401/403/500 errors. The log contains no credentials, scan values, request paths, queries, raw response text, or exception messages. Changing servers clears the displayed diagnostics. Monitoring never queues or retries a scan.

 ## Online-only behavior

@@ -1,6 +1,6 @@
 # Echo native UI acceptance fixture

-The explicit Echo scenario exercises the real Android host, TABLE login, enrollment/approval, semantic printer/media choices, real Echo process and H2 persistence. Its test-only backend accepts **simulated** jobs. Passing it does not qualify EMDK, barcode rendering, printer adapters or physical output.
+The explicit Echo scenario exercises the real Android host, TABLE login, enrollment/approval, semantic printer/media/document choices, real Echo process and H2 persistence. Its test-only backend accepts **simulated** jobs. Passing it does not qualify EMDK, barcode rendering, printer adapters or physical output.

 The backend owner supplies `com.kingsrook.examples.echo.fixture.EchoHttpFixture` from the isolated optional Echo test module, launched with a free loopback port, `ECHO_FIXTURE_TYPE=echo-ui-e2e` and private `ECHO_FIXTURE_SCANNER_PASSWORD`/`ECHO_FIXTURE_ADMIN_PASSWORD`. Readiness is `ECHO_UI_E2E_READY port=N simulatedPrinting=true`. It uses in-memory H2 and no real printing/generation adapter. Root owns launch, the exact private dependency tuple and approval of the concrete APK/fixture cohort.

@@ -33,10 +33,10 @@ Only after root launches the private fixture and approves the exact cohort:
 node scripts/ci/scanner-device-echo-e2e.mjs --serial TC22_SERIAL --fixture PRIVATE_ECHO_FIXTURE.json
 ```

-The native test signs in, enrolls and approves through existing helpers; opens Apps → Echo; selects `Simulated printer` / `Simulated 4 x 6 in — 300 dpi` once through the semantic possible-value controls; injects two public synthetic values with CODE128/QR types through the E2E-only driver; checks `Print queued` and absent manual controls; rotates/recreates without another acceptance; then uses Apps/Leave and verifies the run closes. Independent reads use standard QQQ `echoScan` and read-only `echoFixtureRun` queries as the scanner with approved-device headers, retaining the real actor/device locks. No custom business verification endpoint or administrator bypass is used.
+The native test signs in, enrolls and approves through existing helpers; opens Apps → Echo; selects the printer, media and an INTEGER Document through semantic possible-value controls, reselects the printer to verify stale dependent selections are cleared and Next is refused until reselection, then retains all three choices; injects two public synthetic values with CODE128/QR types through the E2E-only driver; checks `Print queued` and absent manual controls; rotates/recreates without another acceptance; then uses Apps/Leave and verifies the run closes. Independent reads use standard QQQ `echoScan` and read-only `echoFixtureRun` queries as the scanner with approved-device headers, retaining the real actor/device locks. No custom business verification endpoint or administrator bypass is used.

 The existing OpenAPI proxy audits all observed requests and requires native cancellation. Fixed stage markers and operation IDs/counts, APK hashes and a simulation-labelled `echo-proof.json` are written under `scanner-host/build/native-device-e2e/`; credentials, serial and opaque identifiers are redacted from instrumentation output. No normal app data, global animation settings, DataWedge profile or existing forwarding is replaced. The runner removes only its own reverse and newly installed disposable packages; cleanup failures fail the run and its proof.

-At preparation time, compilation and source/unit guards are the only authorized checks. Native/device acceptance remains pending until the explicit approved invocation completes; do not describe this fixture as physical printing evidence.
+The user-authorized TC22 invocation completed successfully after the bounded compilation/guards. This fixture remains simulated printing, not physical printing evidence.

-Recorded acceptance: all5stages passed onTC22 with169JVMtests,8Nodeguards,zero-warninglint and86/86documentednative requests. Printing is simulated. The proof explicitly leaves physicalScannerQualified and physicalPrintingQualified false.
+Current recorded acceptance: all7 stages passed on TC22, including Document selection and stale selection clearing. Root verified99 focused/host JVM tests,8 Node guards, zero lint errors/warnings, and112/112 documented native requests. Printing is simulated. The proof explicitly leaves physicalScannerQualified and physicalPrintingQualified false.
@@ -1,3 +1,37 @@
+## November 2 — current checkpoint
+
+Source candidate: immutable `ScannerCapture` retains SDK raw bytes as canonical Base64 before the callback returns and routes them through the ordinary semantic process payload. New optional fields are sent only after same-server discovery advertises mobile-scanners >=1.5,<2; older servers still receive the five legacy keys. Barcode text and symbology remain unchanged, scan/capture string representations are redacted, and a failed-submit regression proves the entire event is resent unchanged. Verification passes 185 JVM tests (44 core, 56 mobileapp, 85 host), lint with zero errors/warnings (two existing informational hints), debug/E2E APK builds and QA Android-test compilation. New native tests and operator installation have not run. The SDK configuration is unchanged and AIM extraction is not implemented by this transport slice.
+
+Completed and verified:
+
+- Android source `fb3cc5d` is signed and published as Gitea PR 10. It passes 174 JVM tests (44 core, 55 mobileapp, 75 host), lint with zero errors and zero warnings, and the debug APK build.
+- The native `SameOriginInterceptor` fixes the cookie-bearing heartbeat that returned 403. The server's same-origin guard is not weakened.
+- The normal TC22 installation was updated without clearing data. Existing login and device approval, heartbeat, the real print client's printer, fresh 4x1 media and published document selection, and Cancel then Leave all work against the one local server.
+- That server is one QQQ demo on host port 57832. It runs Mobile Scanners/Echo, Collaboration/Record Files, Document Generation and Printing (API 1.10.0, mobile 1.4.0, printing 2.3.0). On this workstation, device port 8080 forwards to host port 57832. The original accounts, enrollment and approval are retained.
+- The Printing owner has aligned the loaded 4x1 stock (101600 x 25400 microns at 300 dpi) and updated the real media revision. A real Echo 4x1 barcode document is published. The TC22 selected the actual printer, the fresh 4x1 media and that document, and Next succeeded and shows Scanner ready and Connected.
+- The emulator is off because it stalls this workstation. Do not restart it automatically.
+
+Not yet done:
+
+- No physical Echo print or rescan has been proven. One separate synthetic HTTP Echo event reached the actual Windows spooler; physical paper and handheld print/rescan remain unconfirmed. One physical scan of QQQ-TEST-123456 has been requested from the user.
+- Still open for 1.0: physical Code128 and leading-zero QR scan, print and rescan; full provider, camera, GPS, projection and device qualification; public coherent artifacts; primary Gitea CI; and final signing and distribution. Signing is deliberately last, by the user's decision. The first demo working does not collapse these requirements, and nothing here claims release readiness.
+- Core native API merge continuation PR 1337 (a42f9e5) was reviewed with no actionable conflict regression and its 57 focused tests were verified. Normal CI and publication are not established, and default dependencies are not repinned.
+
+The entries below are historical. Where they describe the printer media report, the 4x1 document or the same-origin fix as pending, this checkpoint supersedes them.
+
+## November 2 — native cookie Origin compatibility verified on TC22
+
+The combined Echo Demo on57832 (reached through device port8080) returned200 for login, then403 for the cookie-bearing session heartbeat POST, because Android's native QQQ requests omitted `Origin`. The server's same-origin guard remains enforced. Core now has a small `SameOriginInterceptor`: it sets `Origin` from the actual request URL's canonical scheme/host/port only (default ports omitted, IPv6 bracketed, never credentials/input/headers) and is installed last so additional headers cannot override it. It is used by `NetworkQQQRepository` and the `DeviceApi`, `MobileSessionApi` and `RecordFilesApi` clients. Version discovery, presentation/logo fetches, OIDC/browser/token requests and redirect refusal are unchanged.
+
+All174 JVM tests passed (44core/55mobileapp/75host), with zero failures/errors/skips. Lint has zero errors/warnings and two existing informational hints; debug APK build passed. MockWebServer tests cover exact Origin plus cookie on real POSTs, canonicalization, override resistance and redirect non-forwarding. Session and record-file host tests assert the header on their actual requests.
+
+The verified APK (SHA256 `0B872005B2FA84F693E73CC49133F5C1C02F732A034AA0635A2B50682A61A98E`) was installed on the normal TC22 without clearing its data. Existing scanner login and device approval work against the actual combined server; heartbeat remains connected. Echo opens its three required choices, the approved printer and its reported media load, and Cancel -> Leave returns to the app normally. This directly qualifies setup/session/cancel against the strict host, not a physical print. The earlier112-request/two-synthetic-scan acceptance remains separate. (Superseded: the printing owner has since reported the 4x1 media and the 4x1 document is published; see the current checkpoint above. Physical printing is still unproven.) Emulator stays off.
+
+## November 1 — required Document choice verified on the real TC22
+
+Echo asks for printer, paper/label size and Document once; all subsequent scans use those server-pinned choices. Android production code is unchanged: the generic semantic INTEGER/PVS/dependency controls handle it. The updated separate E2E app passed all7 stages on the actual TC22 (select Document, clear stale choices on parent change, validate required fields, queue two scans, recreate without duplication, Apps/Leave/CLOSED). All112 requests matched published semantic operations. Disposable app/reverse/fixture cleanup passed, normal app/data preserved, emulator off. Printing and scanner inputs are simulated; physicalScannerQualified/physicalPrintingQualified remain false.
+
+Verification:99 focused/host JVM tests,8 Node guards, zero lint errors/warnings and both disposable APKs compiled; after a test-only fixed-footer click correction, the actual TC22 acceptance passed. Companion server source8da274e is signed/pushed with45 library and24 composed demo tests passing. Private live server53118 still has header fix101efc8 pending document-choice rollout; real printer pairing retry awaits the current Windows consent. Installed normal APK324227CC... remains sourcea2f0080, whose production code is identical to this test-only change. Full physical/provider/camera/GPS/projection/public artifact/signing gates remain open.
 ## November 1 — Echo native semantic choices verified on TC22

 Claude implemented named process possible values using the actual published `searchProcessPossibleValues` JSON contract, dependent-field metadata, cancellation/error/retry and stale-response rejection. The unchanged Echo fixture now completes login, enrollment/approval, printer/media selection once, two accepted synthetic scans, rotation/recreation without duplicates, and Apps/Leave closing the run on the real TC22. All86observed requests matched published semantic operations. Disposable-package cleanup passed; normal package/data and real printers were preserved.
@@ -1,7 +1,17 @@
 # TODO

+- [x] Implement negotiated mobile1.5 raw-byte transport with immutable capture, same-server capability gating and byte-identical failed-request retry;185 JVM tests, lint0errors/0warnings, debug/E2E builds and QA test compilation pass.
+- [ ] Qualify new raw-byte delivery on TC22 and complete actual AIM extraction/decoder-profile checks. Current source leaves AIM absent and does not change hardware configuration; full Echo fidelity is still open.
+- [x] Verify native `Origin` compatibility:174 JVM tests, lint0errors0warnings and APK build pass; normal TC22 login/approval/heartbeat/Echo setup/printer-media choices/Cancel-Leave pass against the strict local Echo host through8080->57832, preserving data.
+
+- [x] Verify generic INTEGER Document choice/dependency clearing on actual TC22:7 stages,112 semantic requests,99 focused/host tests and8 Node guards; simulated printing, normal data preserved.
+- [x] Connect the installed print client to the single local server and publish the actual Echo4x1 document through native QQQ processes.
+- [x] Resolve the printing agent's earlier 4x6 media report versus loaded 4x1 stock: the Printing owner aligned 101600 x 25400 micron/300 dpi media and the TC22 selected the real printer, fresh 4x1 media and published document; Next succeeded.
+- [ ] Complete one physical Code128 (QQQ-TEST-123456) scan, print and rescan on the TC22, then leading-zero QR. One separate synthetic HTTP Echo event reached the actual Windows spooler; physical paper and handheld print/rescan remain unconfirmed.
+- [ ] Qualify public coherent artifacts and primary Gitea CI; signing and distribution stay last by user decision. Core PR 1337 normal CI and publication are not established; do not repin default dependencies.
+
 - [x] Add metadata-driven Echo acknowledgment/manual-entry hints with old defaults; 167 JVM tests, strict compilation, lint zero errors/warnings and debug build pass.
- [ ] Qualify native Echo setup/scan/print-acceptance/leave with the actual owner adapters and independently decoded physical output; source tests are not physical printing evidence.
+- [ ] Qualify native Echo scan/print-acceptance with independently decoded physical output (setup and Leave against the real owner adapters are verified; source tests are not physical printing evidence).
 - [x] Verify Query artwork, Dogfooding/Query links and licenses on the normal TC22 About screen using filtered accessibility data.

 - [x] Apply scoped copyright/import/header/formatter corrections, mechanical CI gate and Kotlin warnings-as-errors;163JVM plus46TC22 sample native cases pass. See [review](CODING-STANDARDS-REVIEW-2026-11-01.md) for the remaining formatter CI limitation.
@@ -93,4 +103,5 @@ Offline queue/background synchronization is deliberately outside version one.
 - [ ] Complete the final operator walkthrough on TC22 after updating the preserved demo/runtime, including outage/reconnect and real camera capture.

 - [x] Implement named semantic process choices and qualify Echo native setup/two scans/rotation/Apps Leave onTC22 (169JVM,8guards,86documentedrequests; printing simulated).
- [ ] Finish real Echo host/owner adapters, print a physical label and rescan exact value/type; then preserved-data demo upgrade.
+- [x] Real Echo host and owner adapters are composed and running in the single local server (see the Origin item above).
+- [ ] Print a physical label and rescan the exact value and type (tracked above).
@@ -6,6 +6,8 @@ The app first requires the system's `com.symbol.emdk` shared library and enabled

 ## Lifecycle and process contract

+When verified discovery for the current server advertises mobile-scanners 1.5 or newer within major 1, each capture can also send `rawDataBase64` and `aimIdentifier`. The EMDK callback encodes its exact `getRawData()` output once before returning; the immutable event survives HTTP retries unchanged. Older servers receive the legacy event fields. Raw input is bounded to 8192 bytes; null, empty or oversized raw input is omitted rather than truncated. These are SDK bytes, which may include framing, not a claim of original symbol codewords. Current hardware capture leaves AIM absent: no prefix inference or scanner configuration change is implemented. Decoder qualification and native raw-byte acceptance remain required for full Echo fidelity.
+
 The adapter acquires the default scanner only while the server-defined SCANNER widget is visible and its Activity is resumed. HARD trigger reads are armed after IDLE, with one outstanding read. A decoded string is passed unchanged to the existing ScanEvent and semantic process submission, with its EMDK symbology and adapter-owned `zebra-emdk` source. New reads wait until the prior event is confirmed or explicitly abandoned by the existing process flow. Manual events remain `manual`. Neither source label is server-side attestation.

 An IDLE callback with no pending read also rearms after a trigger release or timeout without a decode. If IDLE precedes the data callback, accepting that data blocks further input and cancels any read armed in between. A rapid pause/resume during an earlier asynchronous manager-open request can temporarily encounter the one-manager guard; **Reconnect scanner** retries explicitly after the prior manager has released. An unconfirmed release remains blocked until the app restarts.
@@ -106,6 +106,8 @@ class NetworkQQQRepository(private var baseUrl: String, @Volatile var requestObs
                  }
                  response
               }
+               // Last, so a caller-supplied additional header can never override the request's own origin.
+               .addInterceptor(SameOriginInterceptor())
               .build()
         )
         .baseUrl(baseUrl)
@@ -0,0 +1,31 @@
+/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
+package com.kingsrook.qqq.frontend.android.core.controllers
+
+import okhttp3.HttpUrl
+import okhttp3.Interceptor
+import okhttp3.Response
+
+/*******************************************************************************
+ ** Native requests have no browser to supply `Origin`, yet cookie-bearing QQQ mutations must present their own origin.
+ ** The value is always the canonical scheme/host/port of the actual request URL: never credentials, input or header state.
+ ** Install it only on clients that talk to the selected QQQ server, never on provider, logo or download clients, and
+ ** after any header-adding interceptor so that it has the final say.
+ *******************************************************************************/
+class SameOriginInterceptor : Interceptor {
+   /*******************************************************************************
+    ** Replace any existing `Origin` with the origin of the URL being requested; redirects stay refused by the clients.
+    *******************************************************************************/
+   override fun intercept(chain: Interceptor.Chain): Response =
+      chain.proceed(chain.request().newBuilder().header("Origin", httpOrigin(chain.request().url)).build())
+
+   companion object {
+      /*******************************************************************************
+       ** `scheme://host[:port]` with the scheme's default port omitted and IPv6 hosts bracketed.
+       *******************************************************************************/
+      fun httpOrigin(url: HttpUrl): String {
+         val host = if (url.host.contains(':')) "[${url.host}]" else url.host
+         val port = if (url.port == HttpUrl.defaultPort(url.scheme)) "" else ":${url.port}"
+         return "${url.scheme}://$host$port"
+      }
+   }
+}
@@ -44,6 +44,11 @@ class UiApiCompatibility(
   @Volatile
   private var verified: UiApiVersion? = null

+   /*******************************************************************************
+    ** Non-blocking view of an already verified result; never performs discovery, so it is safe on the UI thread.
+    *******************************************************************************/
+   fun verifiedVersion(): UiApiVersion? = verified
+
   /*******************************************************************************
    ** Call on an IO thread. Synchronization prevents competing startup requests bypassing discovery.
    *******************************************************************************/
@@ -65,6 +65,7 @@ class NetworkQQQRepositoryTest {
         assertEquals("run", body.getJSONObject("processValues").getString("echoRunId"))
         assertEquals("form", body.getString("useCase"))
         assertEquals(listOf("4x6", "7"), options.map { it.id.toString() })
+         assertTrue("A JSON integer id must stay an integer for INTEGER fields", options[1].id is Int)
         assertEquals(listOf("4 x 6 in", "Seven"), options.map { it.label })
         assertTrue(repository.processPossibleValues("echoPrint", "mediaId", emptyMap(), emptyMap()).isEmpty())
      }
@@ -139,6 +140,38 @@ class NetworkQQQRepositoryTest {
      }
   }

+   /*******************************************************************************
+    ** Cookie-bearing native mutations (session/process POSTs) carry the exact request origin, and a caller-supplied
+    ** additional header can neither add a different Origin nor remove the real one. Login (no cookie yet) carries it too.
+    *******************************************************************************/
+   @Test
+   fun cookieBearingPostsCarryTheExactRequestOriginEvenIfAdditionalHeadersTryToSetOne() = runBlocking()
+   {
+      MockWebServer().use { server ->
+         server.start()
+         server.enqueue(MockResponse().setBody(VERSION_FIXTURE))
+         server.enqueue(MockResponse().setHeader("Content-Type", "application/json").setBody("""{"type":"COMPLETE","processUUID":"process","nextStep":"result","values":{}}"""))
+         server.enqueue(MockResponse().setHeader("Content-Type", "application/json").setBody("{}"))
+         val origin = server.url("/").toString()
+         val repository = NetworkQQQRepository(origin, additionalHeaders = { mapOf("Origin" to "https://evil.example", "X-QQQ-Device-Id" to "test-device") })
+         repository.setEnvironment(Environment("test", origin))
+         repository.setSessionUUID("synthetic-session")
+         repository.processStep("edit", "process", "input", mapOf("a" to "b"), 1000)
+         repository.logout()
+         server.takeRequest()
+         // Forwarded debug servers may listen elsewhere (for example 8080): only the URL the client used matters.
+         val expected = "http://${server.hostName}:${server.port}"
+         listOf(server.takeRequest(), server.takeRequest()).forEach { request ->
+            assertEquals("POST", request.method)
+            assertEquals("sessionUUID=synthetic-session", request.getHeader("Cookie"))
+            assertEquals(expected, request.getHeader("Origin"))
+            assertEquals(1, request.headers.values("Origin").size)
+            assertEquals("http://" + request.getHeader("Host"), request.getHeader("Origin"))
+            assertEquals("test-device", request.getHeader("X-QQQ-Device-Id"))
+         }
+      }
+   }
+
   /*******************************************************************************
    **
    *******************************************************************************/
@@ -0,0 +1,70 @@
+/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
+package com.kingsrook.qqq.frontend.android.core.controllers
+
+import okhttp3.HttpUrl.Companion.toHttpUrl
+import okhttp3.OkHttpClient
+import okhttp3.Request
+import okhttp3.mockwebserver.MockResponse
+import okhttp3.mockwebserver.MockWebServer
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+/*******************************************************************************
+ ** Native clients present the exact origin of the URL they actually request, canonicalized like a browser.
+ *******************************************************************************/
+class SameOriginInterceptorTest {
+   /*******************************************************************************
+    ** The origin comes only from scheme/host/port: a debug loopback forward keeps its device-side port
+    ** (whatever the server listens on behind it), defaults are omitted, and IPv6 hosts stay bracketed.
+    *******************************************************************************/
+   @Test
+   fun originIsTheCanonicalSchemeHostAndPortOfTheRequestUrl() {
+      fun origin(url: String) = SameOriginInterceptor.httpOrigin(url.toHttpUrl())
+      assertEquals("http://127.0.0.1:57832", origin("http://127.0.0.1:57832/qqq/v1/manageSession"))
+      assertEquals("http://127.0.0.1", origin("http://127.0.0.1:80/"))
+      assertEquals("https://qqq.example.test", origin("https://qqq.example.test/"))
+      assertEquals("https://qqq.example.test", origin("https://qqq.example.test:443/path"))
+      assertEquals("https://qqq.example.test:8443", origin("https://qqq.example.test:8443/"))
+      assertEquals("http://qqq.example.test:443", origin("http://QQQ.Example.Test:443/"))
+      assertEquals("http://[::1]:57832", origin("http://[::1]:57832/"))
+      assertEquals("https://[2001:db8::1]", origin("https://[2001:db8::1]:443/"))
+      assertEquals("Credentials, path, query and fragment are never part of an origin", "http://127.0.0.1:57832",
+         origin("http://user:secret@127.0.0.1:57832/a/b?token=x#fragment"))
+   }
+
+   /*******************************************************************************
+    ** The header the interceptor sets is final, even when an earlier layer tried to supply a different one.
+    *******************************************************************************/
+   @Test
+   fun overridesAnyExistingOriginAndMatchesTheServerRequestHost() {
+      MockWebServer().use { server ->
+         server.enqueue(MockResponse().setBody("{}"))
+         server.start()
+         val client = OkHttpClient.Builder().followRedirects(false).followSslRedirects(false).addInterceptor(SameOriginInterceptor()).build()
+         client.newCall(Request.Builder().url(server.url("/")).header("Origin", "https://evil.example").build()).execute().close()
+         val request = server.takeRequest()
+         assertEquals("http://" + request.getHeader("Host"), request.getHeader("Origin"))
+         assertEquals(1, request.headers.values("Origin").size)
+      }
+   }
+
+   /*******************************************************************************
+    ** A redirect is still refused, so neither the cookie nor this origin reaches another server.
+    *******************************************************************************/
+   @Test
+   fun refusedRedirectNeverReachesAnotherOrigin() {
+      MockWebServer().use { first ->
+         MockWebServer().use { other ->
+            first.start()
+            other.start()
+            first.enqueue(MockResponse().setResponseCode(307).setHeader("Location", other.url("/stolen").toString()))
+            val client = OkHttpClient.Builder().followRedirects(false).followSslRedirects(false).addInterceptor(SameOriginInterceptor()).build()
+            client.newCall(Request.Builder().url(first.url("/")).header("Cookie", "sessionUUID=synthetic").build()).execute().use { assertEquals(307, it.code) }
+            assertEquals(1, first.requestCount)
+            assertEquals(0, other.requestCount)
+            assertNull(other.takeRequest(100, java.util.concurrent.TimeUnit.MILLISECONDS))
+         }
+      }
+   }
+}
@@ -418,6 +418,37 @@ class ProcessSubmissionTest {
      }
   }

+   /*******************************************************************************
+    ** The optional fidelity keys are ordinary undeclared event values; a lost response must resend all of them.
+    *******************************************************************************/
+   @Test
+   fun failedScanSubmissionResendsTheSameEntireEventMapIncludingFidelityValues() = runTest()
+   {
+      Dispatchers.setMain(StandardTestDispatcher(testScheduler))
+      try {
+         val repository = SubmissionRepository().apply { stepFailures = 1 }
+         val model = model(repository)
+         model.doInit()
+         advanceUntilIdle()
+         val event = mapOf(
+            "barcode" to "000123", "symbology" to "LABEL-TYPE-QRCODE", "scanSource" to "zebra-emdk",
+            "eventId" to "scan-1", "capturedAt" to "2026-01-01T00:00:00Z",
+            "aimIdentifier" to "]Q1", "rawDataBase64" to "AAECAw=="
+         )
+         model.runStep(event, ProcessAcknowledgment("acknowledgedEventId", "scan-1"))
+         advanceUntilIdle()
+         assertTrue(model.unconfirmedSubmission)
+         assertEquals(event, model.pendingStepValues)
+         repository.responseValues = mapOf("acknowledgedEventId" to "scan-1")
+         model.retryPendingStep()
+         advanceUntilIdle()
+         assertEquals(listOf(event, event), repository.submissions)
+         assertNull(model.pendingStepValues)
+      } finally {
+         Dispatchers.resetMain()
+      }
+   }
+
   /*******************************************************************************
    **
    *******************************************************************************/
@@ -597,6 +628,120 @@ class ProcessSubmissionTest {
      }
   }

+   /*******************************************************************************
+    ** Setup chain printer -> media -> document, where the document is an INTEGER-keyed choice depending on both parents.
+    ** Ancestor changes must clear the whole stale suffix, block Next until reselection, keep the integer id typed on
+    ** submission, and never let a late reply for the old parents restore the old document.
+    *******************************************************************************/
+   @Test
+   fun integerDocumentChoiceDependsOnPrinterAndMediaAndNeverSurvivesAParentChange() = runTest()
+   {
+      Dispatchers.setMain(StandardTestDispatcher(testScheduler))
+      try {
+         fun choice(id: Int, label: String) = com.kingsrook.qqq.frontend.android.core.model.QPossibleValue(id, label)
+         val printer = QFieldMetaData("printerId", "Printer", type = QFieldType.STRING, isRequired = true, possibleValueSourceName = "printers")
+         val media = QFieldMetaData(
+            "mediaId", "Paper or label size", type = QFieldType.STRING, isRequired = true, possibleValueSourceName = "media",
+            possibleValueSourceDependsOn = listOf("printerId"), possibleValueSourceDependencyBehavior = "DISABLE_UNTIL_SET"
+         )
+         val document = QFieldMetaData(
+            "templateId", "Document", type = QFieldType.INTEGER, isRequired = true, possibleValueSourceName = "documents",
+            possibleValueSourceDependsOn = listOf("printerId", "mediaId"), possibleValueSourceDependencyBehavior = "DISABLE_UNTIL_SET"
+         )
+         val repository = SubmissionRepository().apply {
+            inputOverride = QFrontendStepMetaData("input", "Input", components = listOf(QFrontendComponent(QComponentType.EDIT_FORM)), formFields = listOf(printer, media, document))
+            possibleValueResolver = { field, values ->
+               when (field) {
+                  "printerId" -> listOf(choice(1, "P1"))
+                  "mediaId" -> if (values["printerId"] == "p1") listOf(choice(2, "M1")) else if (values["printerId"] == "p2") listOf(choice(3, "M2")) else emptyList()
+                  else -> when (values["printerId"] to values["mediaId"]) {
+                     "p1" to "m1" -> listOf(choice(7, "Seven"), choice(9, "Nine"))
+                     "p1" to "m1b" -> listOf(choice(11, "Eleven"))
+                     "p2" to "m2" -> listOf(choice(13, "Thirteen"))
+                     else -> emptyList()
+                  }
+               }
+            }
+         }
+         val model = model(repository)
+         model.doInit()
+         advanceUntilIdle()
+         listOf(printer, media, document).forEach { model.loadRemoteOptions(it) }
+         advanceUntilIdle()
+         assertEquals("Choose Printer and Paper or label size first.", model.remoteOptionsBlockedReason(document))
+
+         fun choose(name: String, value: Any?) { model.processValues[name] = value; model.fieldChanged(name); }
+         choose("printerId", "p1")
+         advanceUntilIdle()
+         assertEquals("Choose Paper or label size first.", model.remoteOptionsBlockedReason(document))
+         choose("mediaId", "m1")
+         advanceUntilIdle()
+         assertNull(model.remoteOptionsBlockedReason(document))
+         val requested = repository.possibleValueRequests.last()
+         assertEquals("documents is searched with both parent values", mapOf("printerId" to "p1", "mediaId" to "m1"), requested.second.filterKeys { it != "templateId" }.filterValues { it != null })
+         assertEquals(listOf(7, 9), model.remoteOptions["templateId"]?.map { it.id })
+         assertTrue("Choice ids stay true integers", model.remoteOptions["templateId"]!!.all { it.id is Int })
+
+         // Required: nothing selected means Next must not submit.
+         model.runStep()
+         advanceUntilIdle()
+         assertEquals("Document is required.", model.fieldErrors["templateId"])
+         assertTrue(repository.submissions.isEmpty())
+
+         // Changing media clears the document and Next stays blocked until it is chosen again.
+         choose("templateId", 7)
+         choose("mediaId", "m1b")
+         assertNull("Document chosen for the old media is cleared", model.processValues["templateId"])
+         assertEquals(1, model.fieldResets["templateId"])
+         advanceUntilIdle()
+         assertEquals(listOf(11), model.remoteOptions["templateId"]?.map { it.id })
+         model.runStep()
+         advanceUntilIdle()
+         assertEquals("Document is required.", model.fieldErrors["templateId"])
+         assertTrue(repository.submissions.isEmpty())
+
+         // Changing the printer clears media and the document; the old document id is not an offered choice.
+         choose("mediaId", "m1")
+         advanceUntilIdle()
+         choose("templateId", 9)
+         val gate = CompletableDeferred<Unit>()
+         repository.possibleValueGate = gate
+         model.loadRemoteOptions(document)
+         runCurrent()
+         choose("printerId", "p2")
+         assertNull(model.processValues["mediaId"])
+         assertNull(model.processValues["templateId"])
+         assertEquals(2, model.fieldResets["templateId"])
+         assertEquals("Choose Paper or label size first.", model.remoteOptionsBlockedReason(document))
+         // A reply for the old printer/media that was already in flight is discarded, not republished.
+         repository.possibleValueGate = null
+         gate.complete(Unit)
+         advanceUntilIdle()
+         assertNull("Late old-parent reply cannot restore choices", model.remoteOptions["templateId"])
+         assertNull("Late old-parent reply cannot restore the old document", model.processValues["templateId"])
+         model.runStep()
+         advanceUntilIdle()
+         assertTrue(model.fieldErrors.containsKey("mediaId") && model.fieldErrors.containsKey("templateId"))
+         assertTrue(repository.submissions.isEmpty())
+
+         // After reselection the typed integer id is what is submitted.
+         choose("mediaId", "m2")
+         advanceUntilIdle()
+         assertEquals(listOf(13), model.remoteOptions["templateId"]?.map { it.id })
+         choose("templateId", model.remoteOptions["templateId"]!!.single().id)
+         model.runStep()
+         advanceUntilIdle()
+         val submitted = repository.submissions.single()
+         assertEquals("p2", submitted["printerId"])
+         assertEquals("m2", submitted["mediaId"])
+         assertEquals(13, submitted["templateId"])
+         assertTrue("Document is submitted as an integer, not text or a decimal", submitted["templateId"] is Int)
+         assertEquals("result", model.activeStepName)
+      } finally {
+         Dispatchers.resetMain()
+      }
+   }
+
   /*******************************************************************************
    **
    *******************************************************************************/
@@ -629,6 +774,7 @@ class ProcessSubmissionTest {
      val possibleValueRequests = mutableListOf<Pair<String, Map<String, Any?>>>()
      var possibleValueFailure = false
      var possibleValueGate: CompletableDeferred<Unit>? = null
+      var possibleValueResolver: ((String, Map<String, Any?>) -> List<com.kingsrook.qqq.frontend.android.core.model.QPossibleValue>)? = null
      private val input = QFrontendStepMetaData(
         "input", "Input", components = listOf(QFrontendComponent(QComponentType.EDIT_FORM)),
         formFields = listOf(QFieldMetaData("eventId", "Event", type = QFieldType.STRING, isRequired = true, isHidden = hiddenEventId))
@@ -669,6 +815,7 @@ class ProcessSubmissionTest {
         possibleValueRequests.add(fieldName to values.toMap())
         possibleValueGate?.await()
         if (possibleValueFailure) throw java.io.IOException("Choices unavailable")
+         possibleValueResolver?.let { return it(fieldName, values.toMap()) }
         return when {
            fieldName == "printerId" -> listOf(com.kingsrook.qqq.frontend.android.core.model.QPossibleValue("printer", "Simulated printer"))
            values["printerId"] == "printer" -> listOf(com.kingsrook.qqq.frontend.android.core.model.QPossibleValue("4x6", "4 x 6 in"))
@@ -17,8 +17,10 @@ import androidx.compose.ui.test.assertIsDisplayed
 import androidx.compose.ui.test.assertIsEnabled
 import androidx.compose.ui.test.assertIsNotEnabled
 import androidx.compose.ui.test.assertTextContains
+import androidx.compose.ui.test.hasAnyAncestor
 import androidx.compose.ui.test.hasText
 import androidx.compose.ui.test.isEnabled
+import androidx.compose.ui.test.isPopup
 import androidx.compose.ui.test.junit4.createAndroidComposeRule
 import androidx.compose.ui.test.onAllNodesWithText
 import androidx.compose.ui.test.onFirst
@@ -109,12 +111,53 @@ class ScannerEndToEndTest {
         return (0 until records.length()).map { records.getJSONObject(it).getJSONObject("values") }
      }

+      /*******************************************************************************
+       ** Discover choices through the same versioned `searchProcessPossibleValues` POST the renderer uses
+       ** ({values, processValues, useCase:form}), so no document id or label is assumed by this harness.
+       *******************************************************************************/
+      fun choices(field: String, values: JSONObject): List<Pair<Any, String>> {
+         val request = Request.Builder().url("$origin/qqq/v1/processes/echoPrint/possibleValues/$field").header("Cookie", scannerCookie)
+            .post(JSONObject().put("values", values).put("processValues", JSONObject()).put("useCase", "form").toString().toRequestBody("application/json".toMediaType()))
+         device.headers().forEach { (name, value) -> request.header(name, value) }
+         val options = executeJson(request.build()).optJSONArray("options") ?: return emptyList()
+         return (0 until options.length()).map { options.getJSONObject(it) }.map { it.get("id") to it.getString("label") }
+      }
+      val printerChoice = choices("printerId", JSONObject().put("mediaId", JSONObject.NULL).put("templateId", JSONObject.NULL)).single { it.second == "Simulated printer" }
+      val mediaChoice = choices("mediaId", JSONObject().put("printerId", printerChoice.first).put("templateId", JSONObject.NULL)).single { it.second == "Simulated 4 x 6 in — 300 dpi" }
+      val documents = choices("templateId", JSONObject().put("printerId", printerChoice.first).put("mediaId", mediaChoice.first))
+      assertTrue("Document choices must be offered for the selected printer/media with unique labels and true JSON integer ids",
+         documents.isNotEmpty() && documents.map { it.second }.toSet().size == documents.size && documents.all { it.first is Int || it.first is Long })
+      // Choose a different document after the stale-selection check when more than one is offered, so restoring the old one is detectable.
+      val firstDocument = documents.first()
+      val finalDocument = documents.last()
+      // Persisted setup column holding the chosen document id; confirm against the server fixture schema.
+      val documentColumn = "templateId"
+      fun assertSetupPinned(row: JSONObject) {
+         assertTrue("Setup must pin the selected printer and media once", row.getString("state") == "OPEN" &&
+            row.getString("printerRecordId") == "fixture-printer" && row.getString("mediaId") == "fixture-4x6")
+         val persisted = row.opt(documentColumn)
+         assertTrue("Setup must persist the chosen document as the same integer id the choices returned",
+            persisted is Number && persisted.toLong() == (finalDocument.first as Number).toLong())
+      }
+
+      /*******************************************************************************
+       ** The only enabled, unselected choice control (earlier fields already hold labels).
+       *******************************************************************************/
+      fun openOnlyRemainingChoice() {
+         ui.waitUntil(timeoutMillis = 60_000) {
+            ui.onAllNodesWithText("Choose a value").fetchSemanticsNodes().size == 1 &&
+               ui.onAllNodes(hasText("Choose a value") and isEnabled()).fetchSemanticsNodes().size == 1
+         }
+         ui.onNodeWithText("Choose a value").performScrollTo().performClick()
+      }
+
      val priorRuns = rows("echoFixtureRun").map { it.getString("id") }.toSet()
      ui.onNodeWithTag("appHome.rowForApp:echo").performClick()
      waitForTag("appHome.rowForProcess:echoPrint")
      ui.onNodeWithTag("appHome.rowForProcess:echoPrint").performClick()
      waitFor("Printer")
      waitFor("Paper or label size")
+      waitFor("Document")
      ui.onAllNodesWithText("Choose a value").onFirst().performScrollTo().performClick()
      waitFor("Simulated printer")
      ui.onNodeWithText("Simulated printer").performClick()
@@ -123,14 +166,40 @@ class ScannerEndToEndTest {
      ui.onAllNodesWithText("Choose a value").onFirst().performScrollTo().performClick()
      waitFor("Simulated 4 x 6 in — 300 dpi")
      ui.onNodeWithText("Simulated 4 x 6 in — 300 dpi").performClick()
+      // Document depends on both printer and media; it is the only unselected control left once media holds its label.
+      openOnlyRemainingChoice()
+      waitFor(firstDocument.second)
+      ui.onNodeWithText(firstDocument.second).performClick()
+      waitFor(firstDocument.second)
+      stage("echo-document-selected")
+
+      // Choosing a controlling field again drops every dependent selection and blocks Next until they are reselected.
+      ui.onNodeWithText("Simulated printer").performScrollTo().performClick()
+      ui.onNode(hasText("Simulated printer") and hasAnyAncestor(isPopup())).performClick()
+      ui.waitUntil(timeoutMillis = 60_000) { ui.onAllNodesWithText("Choose a value").fetchSemanticsNodes().size == 2 }
+      assertTrue("The stale document must not stay selected", ui.onAllNodesWithText(firstDocument.second).fetchSemanticsNodes().isEmpty())
+      waitFor("Choose Paper or label size first.")
+      ui.onNodeWithText("Next", substring = false).performClick()
+      waitFor("Paper or label size is required.")
+      waitFor("Document is required.")
+      assertTrue("Next must not start setup without a reselected document", ui.onAllNodesWithText("Scanner ready. Press the handheld trigger.").fetchSemanticsNodes().isEmpty() &&
+         rows("echoFixtureRun").none { it.getString("id") !in priorRuns && it.optString("printerRecordId").isNotBlank() })
+      ui.onAllNodesWithText("Choose a value").onFirst().performScrollTo().performClick()
+      waitFor("Simulated 4 x 6 in — 300 dpi")
+      ui.onNodeWithText("Simulated 4 x 6 in — 300 dpi").performClick()
+      openOnlyRemainingChoice()
+      waitFor(finalDocument.second)
+      ui.onNodeWithText(finalDocument.second).performClick()
+      waitFor(finalDocument.second)
+      assertTrue("Only the reselected document may remain chosen", firstDocument == finalDocument || ui.onAllNodesWithText(firstDocument.second).fetchSemanticsNodes().isEmpty())
+      stage("echo-stale-document-cleared")
      ui.onNodeWithText("Next", substring = false).performClick()
      waitFor("Scanner ready. Press the handheld trigger.")
      assertTrue("Echo must not offer manual barcode input", ui.onAllNodesWithText("Manual barcode").fetchSemanticsNodes().isEmpty())
      assertTrue("Echo must not offer manual submission", ui.onAllNodesWithText("Submit barcode").fetchSemanticsNodes().isEmpty())
      val run = rows("echoFixtureRun").single { it.getString("id") !in priorRuns }
      val runId = run.getString("id")
-      assertTrue("Setup must pin the selected printer and media once", run.getString("state") == "OPEN" &&
-         run.getString("printerRecordId") == "fixture-printer" && run.getString("mediaId") == "fixture-4x6")
+      assertSetupPinned(run)
      stage("echo-setup-selected")

      var receipt = ""
@@ -153,6 +222,7 @@ class ScannerEndToEndTest {
         assertTrue("Only a synthetic accepted job may acknowledge this fixture scan",
            row.getString("id") == receipt && row.getString("printJobId") == "fixture-job-$receipt" && row.getString("eventId").isNotBlank())
         assertTrue("Each event must create exactly one accepted Echo scan", rows("echoScan").count { it.optString("runId") == runId } == index + 1)
+         assertSetupPinned(rows("echoFixtureRun").single { it.getString("id") == runId })
         stage(if (index == 0) "echo-first-queued" else "echo-second-queued")
      }

@@ -25,7 +25,7 @@ internal fun createScannerDriver(context: Context): ScannerDriver = object : Sca
         val data = intent.getStringExtra("com.symbol.datawedge.data_string") ?: return
         if (intent.getStringExtra("com.symbol.datawedge.decode_mode") == "multiple" || intent.hasExtra("com.symbol.datawedge.barcodes")) return
         pending = false
-         listener?.scanned(data, intent.getStringExtra("com.symbol.datawedge.label_type") ?: "UNKNOWN")
+         listener?.scanned(ScannerCapture.of(data, intent.getStringExtra("com.symbol.datawedge.label_type") ?: "UNKNOWN"))
         listener?.idle()
      }
   }
@@ -8,6 +8,7 @@ import com.kingsrook.qqq.frontend.android.core.controllers.ANDROID_CLIENT
 import android.os.Build
 import com.kingsrook.qqq.frontend.android.core.controllers.RequestOutcome
 import com.kingsrook.qqq.frontend.android.core.controllers.RequestOutcomeInterceptor
+import com.kingsrook.qqq.frontend.android.core.controllers.SameOriginInterceptor
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.withContext
 import okhttp3.MediaType.Companion.toMediaType
@@ -33,7 +34,7 @@ class DeviceApi(
   var displayName: String = ""
      private set
   private val client = OkHttpClient.Builder().followRedirects(false).followSslRedirects(false)
-      .addInterceptor(RequestOutcomeInterceptor(onRequestOutcome)).build()
+      .addInterceptor(RequestOutcomeInterceptor(onRequestOutcome)).addInterceptor(SameOriginInterceptor()).build()

   /*******************************************************************************
    ** Check enrollment on demand; approval remains a server-side decision.
@@ -5,6 +5,7 @@ import com.kingsrook.qqq.frontend.android.core.controllers.ANDROID_CLIENT
 import com.kingsrook.qqq.frontend.android.core.controllers.MOBILE_SCANNERS_PATH
 import com.kingsrook.qqq.frontend.android.core.controllers.RequestOutcome
 import com.kingsrook.qqq.frontend.android.core.controllers.RequestOutcomeInterceptor
+import com.kingsrook.qqq.frontend.android.core.controllers.SameOriginInterceptor
 import com.kingsrook.qqq.frontend.android.core.controllers.UiApiCompatibility
 import com.kingsrook.qqq.frontend.android.core.controllers.UiApiException
 import java.io.IOException
@@ -53,7 +54,7 @@ internal class MobileSessionApi(
   onOutcome: (RequestOutcome) -> Unit = {},
 ) : MobileSessionTransport {
   private val client = OkHttpClient.Builder().followRedirects(false).followSslRedirects(false)
-      .callTimeout(5, TimeUnit.SECONDS).addInterceptor(RequestOutcomeInterceptor(onOutcome)).build()
+      .callTimeout(5, TimeUnit.SECONDS).addInterceptor(RequestOutcomeInterceptor(onOutcome)).addInterceptor(SameOriginInterceptor()).build()

   /*******************************************************************************
    ** Send the current eligible session metadata and accept only the server's bounded lease policy.
@@ -4,6 +4,7 @@ package io.qrun.mobile.scanner
 import com.kingsrook.qqq.frontend.android.core.controllers.ANDROID_CLIENT
 import com.kingsrook.qqq.frontend.android.core.controllers.RequestOutcome
 import com.kingsrook.qqq.frontend.android.core.controllers.RequestOutcomeInterceptor
+import com.kingsrook.qqq.frontend.android.core.controllers.SameOriginInterceptor
 import com.kingsrook.qqq.frontend.android.core.controllers.UiApiCompatibility
 import com.kingsrook.qqq.frontend.android.core.controllers.UiApiException
 import java.io.File
@@ -156,7 +157,7 @@ internal class RecordFilesApi(
   private val compatibility: UiApiCompatibility, onOutcome: (RequestOutcome) -> Unit = {}
 ) : RecordFilesTransport {
   private val client = OkHttpClient.Builder().followRedirects(false).followSslRedirects(false)
-      .callTimeout(30, TimeUnit.SECONDS).addInterceptor(RequestOutcomeInterceptor(onOutcome)).build()
+      .callTimeout(30, TimeUnit.SECONDS).addInterceptor(RequestOutcomeInterceptor(onOutcome)).addInterceptor(SameOriginInterceptor()).build()

   @Volatile
   private var captureContractVerified = false
@@ -7,18 +7,36 @@ import java.util.UUID
 /*******************************************************************************
 ** One physical scan remains one event even when its HTTP request is retried.
 *******************************************************************************/
-data class ScanEvent(
-   val barcode: String,
-   val symbology: String,
+internal data class ScanEvent(
+   val capture: ScannerCapture,
   val scanSource: String,
   val eventId: String = UUID.randomUUID().toString(),
   val capturedAt: String = Instant.now().toString()
 ) {
+   constructor(barcode: String, symbology: String, scanSource: String) :
+      this(ScannerCapture.of(barcode, symbology), scanSource)
+
+   val barcode: String get() = capture.barcode
+   val symbology: String get() = capture.symbology
+
   /*******************************************************************************
-    ** A fixed schema prevents arbitrary intent extras becoming process inputs.
+    ** A fixed schema prevents arbitrary intent extras becoming process inputs. The optional fidelity
+    ** keys are added only for servers verified to accept them; absent values are omitted, never blank.
    *******************************************************************************/
-   fun values(): Map<String, Any> = mapOf(
-      "barcode" to barcode, "symbology" to symbology, "scanSource" to scanSource,
-      "eventId" to eventId, "capturedAt" to capturedAt
-   )
+   fun values(includeFidelity: Boolean = false): Map<String, Any> {
+      val values = linkedMapOf<String, Any>(
+         "barcode" to barcode, "symbology" to symbology, "scanSource" to scanSource,
+         "eventId" to eventId, "capturedAt" to capturedAt
+      )
+      if (includeFidelity) {
+         capture.aimIdentifier?.let { values["aimIdentifier"] = it }
+         capture.rawDataBase64?.let { values["rawDataBase64"] = it }
+      }
+      return values
+   }
+
+   /*******************************************************************************
+    ** Scan content must not appear in logs; the event identity is an opaque correlation value.
+    *******************************************************************************/
+   override fun toString(): String = "ScanEvent(redacted, source=$scanSource, eventId=$eventId)"
 }
@@ -0,0 +1,28 @@
+/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
+package io.qrun.mobile.scanner
+
+import com.kingsrook.qqq.frontend.android.core.controllers.UiApiVersion
+
+/*******************************************************************************
+ ** The optional aimIdentifier/rawDataBase64 inputs exist from mobile-scanners 1.5.0; older servers
+ ** must receive exactly the legacy keys. Derived only from already-verified discovery data.
+ *******************************************************************************/
+internal object ScanFidelityCapability {
+   private val VERSION = Regex("(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)")
+
+   /*******************************************************************************
+    ** Require the single registered mobile-scanners extension at its fixed path with version >=1.5.0,<2.
+    *******************************************************************************/
+   fun supports(version: UiApiVersion?): Boolean {
+      val extension = version?.extensions?.singleOrNull { it.name == "mobile-scanners" } ?: return false
+      if (extension.pathPrefix != "/qbit/mobile-scanners") return false
+      val parts = VERSION.matchEntire(extension.version)?.groupValues ?: return false
+      return parts[1] == "1" && (parts[2].toIntOrNull() ?: return false) >= 5 && parts[3].toIntOrNull() != null
+   }
+
+   /*******************************************************************************
+    ** Discovery data from another server never grants capability to this server's widgets.
+    *******************************************************************************/
+   fun available(server: String, discoveredServer: String, version: UiApiVersion?): Boolean =
+      server == discoveredServer && supports(version)
+}
@@ -281,7 +281,10 @@ class ScannerActivity : ComponentActivity() {
         },
         LocalCustomWidgetRenderer provides { parameters, modifier, disabled ->
            if (parameters.widgetBlock.blockType == "SCANNER") {
-               ScannerWidget(parameters, modifier, disabled)
+               ScannerWidget(
+                  parameters, modifier, disabled,
+                  fidelityAvailable = { ScanFidelityCapability.available(server, compatibility.server, compatibility.verifiedVersion()) }
+               )
               true
            } else if (parameters.widgetBlock.blockType == "RECORD_FILES_CAPTURE") {
               RecordPhotoWidget(parameters, recordFiles, modifier, disabled)
@@ -0,0 +1,46 @@
+/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
+package io.qrun.mobile.scanner
+
+import java.util.Base64
+
+/*******************************************************************************
+ ** One immutable decoded read: the SDK's text and symbology, the SDK's raw bytes already encoded once as
+ ** canonical padded Base64, and an AIM identifier only when a qualified driver supplied it explicitly.
+ ** Raw bytes are exact SDK output (possibly with SDK framing), not a claim of complete symbol capture.
+ *******************************************************************************/
+internal data class ScannerCapture(
+   val barcode: String, val symbology: String, val rawDataBase64: String? = null, val aimIdentifier: String? = null
+) {
+   init {
+      require(aimIdentifier == null || AIM.matches(aimIdentifier)) { "Invalid AIM identifier." }
+   }
+
+   /*******************************************************************************
+    ** Scan content is business data and must not reach logs or crash reports.
+    *******************************************************************************/
+   override fun toString(): String = "ScannerCapture(redacted, raw=${if (rawDataBase64 == null) "absent" else "present"}, aim=${if (aimIdentifier == null) "absent" else "present"})"
+
+   /*******************************************************************************
+    ** Raw limits live here so every source builds captures under the same transport limits.
+    *******************************************************************************/
+   companion object {
+      const val MAX_RAW_BYTES = 8192
+      private val AIM = Regex("\\][A-Za-z][0-9A-Za-z]")
+
+      /*******************************************************************************
+       ** Encode SDK bytes once; the caller's array is never retained. Null, empty or oversize raw data is
+       ** omitted rather than truncated, so an optional field is either exact SDK output or absent.
+       *******************************************************************************/
+      fun of(barcode: String, symbology: String, rawData: ByteArray? = null, aimIdentifier: String? = null): ScannerCapture =
+         ScannerCapture(
+            barcode, symbology,
+            if (rawData == null || rawData.isEmpty() || rawData.size > MAX_RAW_BYTES) null else Base64.getEncoder().encodeToString(rawData),
+            aimIdentifier
+         )
+
+      /*******************************************************************************
+       ** Manual entry has no scanner evidence, so it carries neither raw bytes nor an AIM identifier.
+       *******************************************************************************/
+      fun manual(barcode: String) = ScannerCapture(barcode, "MANUAL")
+   }
+}
@@ -17,7 +17,7 @@ internal interface ScannerDriver {
      /*******************************************************************************
       ** Preserve raw barcode data and reject callbacks after ownership, readiness or generation changes.
       *******************************************************************************/
-      fun scanned(barcode: String, symbology: String)
+      fun scanned(capture: ScannerCapture)

      /*******************************************************************************
       ** Distinguish ordinary empty reads from rejected multi-barcode reads without fabricating a scan.
@@ -61,7 +61,7 @@ internal interface ScannerDriver {
 *******************************************************************************/
 internal class ScannerInputSession(
   private val createDriver: () -> ScannerDriver?,
-   private val onScan: (String, String) -> Unit,
+   private val onScan: (ScannerCapture) -> Unit,
   private val onStatus: (String, Boolean) -> Unit,
   private val canAcceptInput: () -> Boolean = { true },
 ) {
@@ -122,13 +122,13 @@ internal class ScannerInputSession(
            /*******************************************************************************
             ** Preserve raw barcode data and reject callbacks after ownership, readiness or generation changes.
             *******************************************************************************/
-            override fun scanned(barcode: String, symbology: String) {
+            override fun scanned(capture: ScannerCapture) {
               if (!isCurrent() || !accepting || !armed || !canAcceptInput()) return
               armed = false
               accepting = false
               readNotice = null
               onStatus("Waiting for scan confirmation…", false)
-               onScan(barcode, symbology)
+               onScan(capture)
               // IDLE may precede data. Stop any read armed in that interval before accepting more input.
               try {
                  if (driver === current && current.isReadPending()) current.cancelRead()
@@ -41,7 +41,8 @@ import com.kingsrook.qqq.frontend.android.mobileapp.ui.LocalProcessInputAllowed
@Composable
 internal fun ScannerWidget(
   parameters: WidgetBlockParameters, modifier: Modifier, disabled: Boolean,
-   driverFactory: (Context) -> ScannerDriver? = ::createScannerDriver
+   driverFactory: (Context) -> ScannerDriver? = ::createScannerDriver,
+   fidelityAvailable: () -> Boolean = { false }
 ) {
   val context = LocalContext.current
   val view = LocalView.current
@@ -82,7 +83,8 @@ internal fun ScannerWidget(
   /*******************************************************************************
    ** Each new physical scan has an identity; retries are handled by ProcessViewModel.
    *******************************************************************************/
-   fun submit(barcode: String, symbology: String, source: String): Boolean {
+   fun submit(capture: ScannerCapture, source: String): Boolean {
+      val barcode = capture.barcode
      if (process == null) {
         notice = "This scanner control requires an active process."
         return false
@@ -96,9 +98,10 @@ internal fun ScannerWidget(
         return false
      }
      notice = "Sending scan…"
-      val event = ScanEvent(barcode, symbology, source)
+      val event = ScanEvent(capture, source)
+      // Capability is read from cached verified discovery on the UI thread; it never triggers HTTP.
      process.runStep(
-         event.values(), ProcessAcknowledgment(
+         event.values(includeFidelity = fidelityAvailable()), ProcessAcknowledgment(
            "acknowledgedEventId", event.eventId,
            requiredValues = mapOf("scanSaved" to true), nonEmptyStringFields = setOf("scanId")
         )
@@ -111,12 +114,12 @@ internal fun ScannerWidget(
      return accepted
   }

-   val currentSubmit by rememberUpdatedState<(String, String, String) -> Boolean>(::submit)
+   val currentSubmit by rememberUpdatedState<(ScannerCapture, String) -> Boolean>(::submit)
   val input = remember(context, process, driverFactory)
   {
      ScannerInputSession(
         { driverFactory(context) },
-         { barcode, symbology -> currentSubmit(barcode, symbology, HARDWARE_SCAN_SOURCE) },
+         { capture -> currentSubmit(capture, HARDWARE_SCAN_SOURCE) },
         { message, reconnect -> scannerStatus = message; canReconnect = reconnect },
         canAcceptInput = { currentInputReady() })
   }
@@ -156,7 +159,7 @@ internal fun ScannerWidget(
         )
         Button(enabled = ready && manual.isNotEmpty(), onClick = {
            focusManager.clearFocus(); keyboard?.hide()
-            if (submit(manual, "MANUAL", "manual")) manual = ""
+            if (submit(ScannerCapture.manual(manual), "manual")) manual = ""
         }) { Text(scannerMetaData.submitLabel) }
      }
   }
@@ -30,18 +30,24 @@ internal class ZebraScannerDriver(private val context: Context) : ScannerDriver
   private var opening = false
   private var ownsClaim = false
   private val dataListener = Scanner.DataListener { collection ->
+      // Copy SDK-owned data now; the collection must not be read after this callback returns. AIM is never
+      // inferred here: it stays absent until a qualified driver obtains it from an explicit source.
+      val scans = collection?.scanData
+      var capture: ScannerCapture? = null
+      var multiple = false
+      if (collection?.result == com.symbol.emdk.barcode.ScannerResults.SUCCESS && !scans.isNullOrEmpty()) {
+         if (scans.size != 1) multiple = true
+         else {
+            val scan = scans.single()
+            val barcode = scan?.data
+            if (!barcode.isNullOrEmpty())
+               capture = ScannerCapture.of(barcode, scan.labelType?.toString() ?: "UNKNOWN", scan.rawData)
+         }
+      }
+      val delivered = capture
      main.post {
         if (!closed) {
-            val scans = collection?.scanData
-            if (collection?.result != com.symbol.emdk.barcode.ScannerResults.SUCCESS || scans.isNullOrEmpty())
-               listener?.noData(false)
-            else if (scans.size != 1) listener?.noData(true)
-            else {
-               val scan = scans.single()
-               val barcode = scan?.data
-               if (barcode.isNullOrEmpty()) listener?.noData(false)
-               else listener?.scanned(barcode, scan.labelType?.toString() ?: "UNKNOWN")
-            }
+            if (delivered != null) listener?.scanned(delivered) else listener?.noData(multiple)
         }
      }
   }
@@ -139,7 +139,7 @@ class ScannerOverlayTest {
       **
       *******************************************************************************/
      fun emit(value: String) {
-         pending = false; listener.scanned(value, "QRCODE"); listener.idle()
+         pending = false; listener.scanned(ScannerCapture.of(value, "QRCODE")); listener.idle()
      }
   }

@@ -328,7 +328,16 @@ class MobileSessionTest {
         val screen = server.takeRequest()
         assertEquals("/qqq/v1/qbit/mobile-scanners/sessions/current/screen", screen.path)
         assertEquals(4, JSONObject(screen.body.readUtf8()).getLong("sequence"))
-         assertEquals("/qqq/v1/qbit/mobile-scanners/sessions/current/end", server.takeRequest().path)
+         val end = server.takeRequest()
+         assertEquals("/qqq/v1/qbit/mobile-scanners/sessions/current/end", end.path)
+         // Cookie-bearing native POSTs must present the exact origin of the URL used, like a browser.
+         val expectedOrigin = origin.trimEnd('/')
+         listOf(heartbeat, screen, end).forEach { request ->
+            assertEquals("POST", request.method)
+            assertEquals("sessionUUID=synthetic-session", request.getHeader("Cookie"))
+            assertEquals(expectedOrigin, request.getHeader("Origin"))
+            assertEquals(1, request.headers.values("Origin").size)
+         }
      }
   }

@@ -109,7 +109,15 @@ class RecordFilesApiTest {
         val finalize = server.takeRequest()
         assertEquals(intent.requestId, finalize.getHeader("Idempotency-Key"))
         assertEquals(0L, finalize.bodySize)
-         assertEquals("GET", server.takeRequest().method)
+         val status = server.takeRequest()
+         assertEquals("GET", status.method)
+         // Every native record-file request (including the cookie-bearing mutations) presents its own exact origin.
+         val expectedOrigin = origin.trimEnd('/')
+         listOf(descriptor, capabilities, first, second, chunk, finalize, status).forEach {
+            assertEquals(expectedOrigin, it.getHeader("Origin"))
+            assertEquals(1, it.headers.values("Origin").size)
+         }
+         listOf(capabilities, first, second, chunk, finalize, status).forEach { assertEquals("sessionUUID=synthetic-session", it.getHeader("Cookie")) }
      }
   }

@@ -1,14 +1,31 @@
 /* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
 package io.qrun.mobile.scanner

+import com.kingsrook.qqq.frontend.android.core.controllers.UiApiExtension
+import com.kingsrook.qqq.frontend.android.core.controllers.UiApiVersion
+import java.util.Base64
+import org.junit.Assert.assertArrayEquals
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
 import org.junit.Assert.assertNotEquals
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertThrows
+import org.junit.Assert.assertTrue
 import org.junit.Test

 /*******************************************************************************
 ** Retrying a submission must not turn it into a second captured scan.
 *******************************************************************************/
 class ScanEventTest {
+   private val legacyKeys = setOf("barcode", "symbology", "scanSource", "eventId", "capturedAt")
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   private fun version(scanners: String?, path: String = "/qbit/mobile-scanners") = UiApiVersion(
+      "1.8.0", extensions = listOfNotNull(scanners?.let { UiApiExtension("mobile-scanners", it, path) })
+   )
+
   /*******************************************************************************
    **
    *******************************************************************************/
@@ -19,4 +36,126 @@ class ScanEventTest {
      assertEquals("001234", event.values()["barcode"])
      assertNotEquals(event.eventId, ScanEvent("001234", "LABEL-TYPE-CODE128", "scanner").eventId)
   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun oldServerGetsExactlyTheLegacyFiveKeysEvenWhenFidelityIsCaptured() {
+      val event = ScanEvent(ScannerCapture.of("A", "QRCODE", byteArrayOf(1, 2), "]Q1"), "zebra-emdk")
+      assertEquals(legacyKeys, event.values().keys)
+      assertEquals(legacyKeys, event.values(includeFidelity = false).keys)
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun fidelityValuesAreFlatStringsAndMissingKeysAreOmitted() {
+      val raw = byteArrayOf(0x1d, 0x41)
+      val full = ScanEvent(ScannerCapture.of("A", "QRCODE", raw, "]Q1"), "zebra-emdk").values(true)
+      assertEquals("]Q1", full["aimIdentifier"])
+      assertEquals(Base64.getEncoder().encodeToString(raw), full["rawDataBase64"])
+      val rawOnly = ScanEvent(ScannerCapture.of("A", "QRCODE", raw), "zebra-emdk").values(true)
+      assertEquals(legacyKeys + "rawDataBase64", rawOnly.keys)
+      assertEquals(legacyKeys, ScanEvent(ScannerCapture.manual("A"), "manual").values(true).keys)
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun retryPayloadIsUnchangedAcrossRepeatedValueBuilding() {
+      val source = byteArrayOf(0, 1, 2)
+      val event = ScanEvent(ScannerCapture.of("A", "QRCODE", source, "]Q1"), "zebra-emdk")
+      val first = event.values(true)
+      source[0] = 9
+      assertEquals(first, event.values(true))
+      assertEquals(first, event.copy().values(true))
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun captureCopiesInputAndAllByteValuesRoundTrip() {
+      val all = ByteArray(256) { it.toByte() }
+      val capture = ScannerCapture.of("A", "QRCODE", all)
+      all.fill(0)
+      val expected = ByteArray(256) { it.toByte() }
+      assertArrayEquals(expected, Base64.getDecoder().decode(capture.rawDataBase64))
+      assertEquals(capture, ScannerCapture.of("A", "QRCODE", expected))
+      assertEquals(capture.hashCode(), ScannerCapture.of("A", "QRCODE", expected).hashCode())
+      assertNotEquals(capture, ScannerCapture.of("A", "QRCODE", expected, "]Q1"))
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun rawLengthLimitsOmitInsteadOfTruncating() {
+      assertNull(ScannerCapture.of("A", "Q", null).rawDataBase64)
+      assertNull(ScannerCapture.of("A", "Q", ByteArray(0)).rawDataBase64)
+      assertNull(ScannerCapture.of("A", "Q", ByteArray(8193)).rawDataBase64)
+      val max = ScannerCapture.of("A", "Q", ByteArray(8192) { 1 })
+      assertEquals(10924, max.rawDataBase64!!.length)
+      assertEquals("AA==", ScannerCapture.of("A", "Q", ByteArray(1)).rawDataBase64)
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun aimMustBeOriginalWellFormedIdentifier() {
+      listOf("]Q1", "]c0", "]A0", "]z9").forEach { assertEquals(it, ScannerCapture.of("A", "Q", null, it).aimIdentifier) }
+      listOf("", "Q1", "]Q", "]Q11", "]11", "]Q!", "]Q1 ", "]Qé").forEach {
+         assertThrows(IllegalArgumentException::class.java) { ScannerCapture.of("A", "Q", null, it) }
+      }
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun stringFormsNeverLeakScanContent() {
+      val event = ScanEvent(ScannerCapture.of("SECRET-BARCODE", "QRCODE", "SECRET-RAW".toByteArray(), "]Q1"), "zebra-emdk")
+      listOf(event.toString(), event.capture.toString()).forEach {
+         assertFalse(it, it.contains("SECRET"))
+         assertFalse(it, it.contains(Base64.getEncoder().encodeToString("SECRET-RAW".toByteArray())))
+         assertFalse(it, it.contains("]Q1"))
+      }
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun capabilityRequiresMobileScanners15WithinMajor1AtRegisteredPath() {
+      assertTrue(ScanFidelityCapability.supports(version("1.5.0")))
+      assertTrue(ScanFidelityCapability.supports(version("1.12.3")))
+      listOf("1.4.9", "1.1.0", "2.0.0", "2.5.0", "1.5", "1.5.0-rc1", "01.5.0", "1.5.0.1", "", "1.99999999999.0").forEach {
+         assertFalse(it, ScanFidelityCapability.supports(version(it)))
+      }
+      assertFalse(ScanFidelityCapability.supports(version("1.5.0", "/qbit/other")))
+      assertFalse(ScanFidelityCapability.supports(version(null)))
+      assertFalse(ScanFidelityCapability.supports(null))
+      val duplicate = UiApiVersion(
+         "1.8.0", extensions = listOf(
+            UiApiExtension("mobile-scanners", "1.5.0", "/qbit/mobile-scanners"),
+            UiApiExtension("mobile-scanners", "1.5.0", "/qbit/mobile-scanners")
+         )
+      )
+      assertFalse(ScanFidelityCapability.supports(duplicate))
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun capabilityIsScopedToTheServerThatWasDiscovered() {
+      val v = version("1.5.0")
+      assertTrue(ScanFidelityCapability.available("https://a/", "https://a/", v))
+      assertFalse(ScanFidelityCapability.available("https://b/", "https://a/", v))
+      assertFalse(ScanFidelityCapability.available("https://a/", "https://a/", null))
+   }
 }
@@ -65,8 +65,8 @@ class ScannerInputSessionTest {
      /*******************************************************************************
       **
       *******************************************************************************/
-      fun scan(value: String = "001234567890") {
-         pending = false; listener.scanned(value, "QRCODE")
+      fun scan(value: String = "001234567890", raw: ByteArray? = null) {
+         pending = false; listener.scanned(ScannerCapture.of(value, "QRCODE", raw))
      }
   }

@@ -76,10 +76,11 @@ class ScannerInputSessionTest {
   private class Fixture {
      val devices = mutableListOf<Device>()
      val scans = mutableListOf<Pair<String, String>>()
+      val captures = mutableListOf<ScannerCapture>()
      val statuses = mutableListOf<String>()
      val session = ScannerInputSession(
         { Device().also { devices.add(it) } },
-         { value, type -> scans.add(value to type) }, { message, _ -> statuses.add(message) })
+         { capture -> captures.add(capture); scans.add(capture.barcode to capture.symbology) }, { message, _ -> statuses.add(message) })

      /*******************************************************************************
       **
@@ -97,7 +98,7 @@ class ScannerInputSessionTest {
   @Test
   fun missingHardwareKeepsManualFallback() {
      val statuses = mutableListOf<String>()
-      val session = ScannerInputSession({ null }, { _, _ -> error("Unexpected scan") }, { message, _ -> statuses.add(message) })
+      val session = ScannerInputSession({ null }, { error("Unexpected scan") },{ message, _ -> statuses.add(message) })
      session.setAccepting(true)
      session.setActive(true)
      assertTrue(statuses.single().contains("manually"))
@@ -111,7 +112,7 @@ class ScannerInputSessionTest {
      val device = Device()
      var allowed = true
      val scans = mutableListOf<String>()
-      val session = ScannerInputSession({ device }, { value, _ -> scans.add(value) }, { _, _ -> }, { allowed })
+      val session = ScannerInputSession({ device }, { capture -> scans.add(capture.barcode) }, { _, _ -> }, { allowed })
      session.setAccepting(true)
      session.setActive(true)
      device.idle()
@@ -135,7 +136,7 @@ class ScannerInputSessionTest {
   fun hiddenSurfaceNeverArmsEvenWhenOldReadinessFlagIsTrue() {
      val device = Device()
      var allowed = false
-      val session = ScannerInputSession({ device }, { _, _ -> error("Unexpected scan") }, { _, _ -> }, { allowed })
+      val session = ScannerInputSession({ device }, { error("Unexpected scan") }, { _, _ -> }, { allowed })
      session.setAccepting(true)
      session.setActive(true)
      device.idle()
@@ -176,6 +177,27 @@ class ScannerInputSessionTest {
      assertEquals(2, device.reads)
   }

+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun rawBytesReachTheSinkUnchangedAndStaleOwnersDeliverNothing() {
+      val fixture = Fixture()
+      val first = fixture.start()
+      first.idle()
+      val raw = ByteArray(256) { it.toByte() }
+      fixture.session.setActive(false)
+      fixture.session.setActive(true)
+      first.scan("stale", raw)
+      assertTrue(fixture.captures.isEmpty())
+      val second = fixture.devices.last()
+      second.idle()
+      second.scan("current", raw)
+      assertEquals("current", fixture.captures.single().barcode)
+      assertEquals(java.util.Base64.getEncoder().encodeToString(raw), fixture.captures.single().rawDataBase64)
+      assertTrue(fixture.captures.single().aimIdentifier == null)
+   }
+
   /*******************************************************************************
    **
    *******************************************************************************/
@@ -188,7 +210,7 @@ class ScannerInputSessionTest {
      device.idle()
      assertEquals(2, device.reads)
      // Deliver the first read's data while the second read is pending.
-      device.listener.scanned("001234567890", "QRCODE")
+      device.listener.scanned(ScannerCapture.of("001234567890", "QRCODE"))
      assertEquals(1, device.cancels)
      assertEquals(1, fixture.scans.size)
      device.idle()
@@ -261,7 +283,7 @@ class ScannerInputSessionTest {
      device.idle()
      device.pending = false
      device.idle()
-      device.listener.scanned("001234567890", "QRCODE")
+      device.listener.scanned(ScannerCapture.of("001234567890", "QRCODE"))
      device.listener.noData(false)
      device.idle()
      assertEquals(1, device.cancels)
@@ -360,7 +360,7 @@ export async function runScannerE2e(options = {}) {
         }
         reports.push({ scenario: phase.name ?? phase.mode, ...proxy.verify(!phase.expectedError, Boolean(phase.requireCancel), Boolean(phase.requireSession), Boolean(phase.requirePhotos)) });
         if (echo) {
-            const expectedStages = ['echo-setup-selected', 'echo-first-queued', 'echo-second-queued', 'echo-recreation-stable', 'echo-run-closed'];
+            const expectedStages = ['echo-document-selected', 'echo-stale-document-cleared', 'echo-setup-selected', 'echo-first-queued', 'echo-second-queued', 'echo-recreation-stable', 'echo-run-closed'];
            if (expectedStages.some(stage => !stages.has(stage))) throw new Error('Echo did not complete every setup/queue/recreation/cancellation stage.');
            await writeFile(join(echoEvidence, 'echo-proof.json'), JSON.stringify({ status: 'PASSED', fixtureType: 'echo-ui-e2e', simulatedPrinting: true,
               artifacts: echoArtifacts, completedStages: expectedStages, acceptedScans: 2, ...reports.at(-1), physicalScannerQualified: false, physicalPrintingQualified: false }, null, 2));
Author	SHA1	Message	Date
forge-recoveryandCodex	8478ae50f8	ci: qualify shared Android unit and emulator jobs Co-Authored-By: Codex <noreply@openai.com>	2026-11-02 18:18:04 +00:00
james.maes Claude Sonnet 5.5 Codex	e255b7341d	feat(scanner): send immutable raw bytes to compatible semantic servers Capture exact SDK bytes before callback return and submit them through the existing process API only after same-server mobile-scanners 1.5 discovery. Preserve legacy server payloads and pending event retries; redact capture string representations. Verify 185 JVM tests, zero lint errors or warnings, debug/E2E builds and QA test compilation. Hardware AIM extraction and native delivery qualification remain open; the operator installation is unchanged. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Co-Authored-By: Codex <noreply@openai.com>	2026-11-02 10:56:59 -06:00
james.maesandClaude Sonnet 5.5	ffc5b493fa	docs: record verified local Echo setup and remaining release gates Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-02 07:53:42 -06:00
james.maesandClaude Sonnet 5.5	fb3cc5d2f8	fix(android): send native request origins for cookie sessions Derive Origin from each QQQ request URL after caller headers so strict same-origin servers accept session heartbeats and process actions. Verify 174 JVM tests, lint, APK build, and actual TC22 sign-in, Echo setup and cancellation without clearing data. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-02 07:10:00 -06:00
james.maesandClaude Sonnet 5.5	47a923a712	test(android): verify Echo document selection on native forms Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-01 21:21:44 -06:00
forge-recovery	a2f0080755	Merge pull request 'Merge retained GitHub work into the Gitea primary branch' (#9 ) from migration/github-cutoff-reconcile-20261101 into feature/echo-scanner-presentation	2026-11-01 23:05:30 +00:00