fix(network): raise the remaining short limits for slow links (1.0.5, versionCode 7)

1.0.4 gave the metadata load 60 seconds. Every other call still had a 5 second call limit or OkHttp's 10 second defaults, so a slow warehouse link could still fail start-up, enrollment or a process step. All limits now come from one set, NetworkTimeouts: - connect 10 s (unchanged value, now named) - small calls 30 s: version discovery, branding, logo, reachability and the session heartbeat (were a 5 s call limit); device enrollment and status, sign-in, table and process-status calls (were a 10 s read) - process init and step 60 s read and write, no call limit as before - metadata load 60 s (unchanged) - best-effort calls 5 s (unchanged): ending the device session and live screen frames, so sign-out, Change server and screen viewing never wait on a dead link Not changed: the 3 s bounds around sign-out and the 30 s photo transfer limit. Tests assert the configured limits of every client (NetworkTimeoutsTest, SlowLinkTimeoutsTest); the test that pinned the 10 s default now expects an ordinary call to survive a 12 s answer. Docs: CHANGELOG 1.0.5 candidate; RELEASING, INSTALLATION, SESSION-STATE and TODO record the published 1.0.4 and the 1.0.5 release steps. Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Merge pull request 'fix(auth): end the identity-provider session on sign-out and force re-authentication on sign-in' (#27 ) from fix/signout-idp-session into main
2026-11-09 19:35:59 -06:00 · 2026-11-09 20:10:27 +00:00 · 2026-11-09 14:10:00 -06:00 · 2026-11-09 20:01:50 +00:00 · 2026-11-09 20:01:24 +00:00 · 2026-11-09 14:01:07 -06:00
36 changed files with 591 additions and 405 deletions
@@ -1,14 +0,0 @@
-version: 2.1
-setup: true
-orbs:
-  qqq-orb: kingsrook/qqq-orb@0.8
-workflows:
-  setup:
-    jobs:
-    - qqq-orb/generate_pipeline:
-        orb_version: '0.8'
-        filters:
-          branches:
-            ignore: automation/qbit-rc-pending
-          tags:
-            only: /.*/
@@ -0,0 +1,19 @@
+name: build
+on:
+  push:
+    branches: ['**']
+    tags: ['v*']
+jobs:
+  android:
+    uses: self:KofTwentyTwo/ci-workflows/.gitea/workflows/android.yaml@v1
+    secrets: inherit
+    with:
+      node-version: '24.11.1'
+      commands: |
+        node scripts/ci/check-source-standards.mjs
+        node --test scripts/ci/scanner-echo-guards.test.mjs
+      tasks: |
+        testDebugUnitTest :scanner-host:lintDebug :scanner-host:assembleDebug
+        -PscannerTestBuildType=qa :scanner-host:assembleQa :scanner-host:assembleQaAndroidTest
+      emulator-tasks: connectedDebugAndroidTest
+      publish-tasks: :qqq:android:core:publishAllPublicationsToGiteaRepository :qqq:android:mobileapp:publishAllPublicationsToGiteaRepository
@@ -1,13 +0,0 @@
-name: QRun Android lifecycle
-'on':
-  push:
-    branches: [main]
-  workflow_dispatch:
-permissions:
-  contents: read
-  actions: read
-jobs:
-  release:
-    uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/android.yaml@qrun-release-v1
-    with:
-      runner: android-build
@@ -1,138 +0,0 @@
-name: Release scanner APK
-
-on:
-  push:
-    tags: ['scanner-v*']
-
-permissions:
-  contents: read
-
-concurrency:
-  group: scanner-release
-  cancel-in-progress: false
-
-jobs:
-  verify:
-    uses: ./.github/workflows/scanner.yml
-
-  package:
-    needs: verify
-    runs-on: ubuntu-24.04
-    timeout-minutes: 30
-    environment: scanner-release
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          persist-credentials: false
-          fetch-depth: 0
-      - name: Require main ancestry and a strictly newer Android version
-        id: release-version
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GH_REPO: ${{ github.repository }}
-          SCANNER_VERSION_CODE: ${{ vars.SCANNER_VERSION_CODE }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          git merge-base --is-ancestor "$GITHUB_SHA" refs/remotes/origin/main
-          [[ "$SCANNER_VERSION_CODE" =~ ^[1-9][0-9]{0,9}$ ]] || exit 1
-          (( SCANNER_VERSION_CODE <= 2100000000 )) || exit 1
-          gh api --paginate "repos/$GH_REPO/releases?per_page=100" \
-            --jq '.[] | select(.draft == false) | select(.tag_name | startswith("scanner-v")) | .tag_name' > "$RUNNER_TEMP/scanner-prior-tags.txt"
-          while IFS= read -r tag; do
-            [[ "$tag" =~ ^scanner-v[0-9]+\.[0-9]+\.[0-9]+(-[A-Za-z0-9.-]+)?$ ]] || exit 1
-            prior_directory=$(mktemp -d "$RUNNER_TEMP/scanner-prior.XXXXXX")
-            gh release download "$tag" --pattern BUILD.txt --dir "$prior_directory"
-            previous=$(sed -n 's/^Version code: //p' "$prior_directory/BUILD.txt")
-            [[ "$previous" =~ ^[1-9][0-9]{0,9}$ ]] || exit 1
-            (( SCANNER_VERSION_CODE > previous )) || { echo 'Version code must exceed every published scanner release'; exit 1; }
-          done < "$RUNNER_TEMP/scanner-prior-tags.txt"
-          printf 'code=%s\n' "$SCANNER_VERSION_CODE" >> "$GITHUB_OUTPUT"
-      - uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
-        with:
-          distribution: temurin
-          java-version: '21'
-      - uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4
-      - name: Install Android SDK packages
-        run: |
-          "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" "platforms;android-35" "build-tools;34.0.0" "build-tools;35.0.0" "platform-tools"
-      - name: Build and verify signed release
-        env:
-          SCANNER_KEYSTORE_BASE64: ${{ secrets.SCANNER_KEYSTORE_BASE64 }}
-          SCANNER_STORE_PASSWORD: ${{ secrets.SCANNER_STORE_PASSWORD }}
-          SCANNER_KEY_ALIAS: ${{ secrets.SCANNER_KEY_ALIAS }}
-          SCANNER_KEY_PASSWORD: ${{ secrets.SCANNER_KEY_PASSWORD }}
-          SCANNER_CERTIFICATE_SHA256: ${{ vars.SCANNER_CERTIFICATE_SHA256 }}
-          SCANNER_VERSION_CODE: ${{ steps.release-version.outputs.code }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          umask 077
-          version="${GITHUB_REF_NAME#scanner-v}"
-          [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[A-Za-z0-9.-]+)?$ ]] || exit 1
-          [[ "$SCANNER_VERSION_CODE" =~ ^[1-9][0-9]{0,9}$ ]] || exit 1
-          (( SCANNER_VERSION_CODE <= 2100000000 )) || exit 1
-          [[ "$SCANNER_CERTIFICATE_SHA256" =~ ^[A-Fa-f0-9]{64}$ ]] || exit 1
-          for name in SCANNER_KEYSTORE_BASE64 SCANNER_STORE_PASSWORD SCANNER_KEY_ALIAS SCANNER_KEY_PASSWORD; do
-            [[ -n "${!name}" ]] || { echo "Missing release signing configuration: $name"; exit 1; }
-          done
-          export SCANNER_KEYSTORE="$RUNNER_TEMP/scanner-release.jks"
-          trap 'rm -f -- "$SCANNER_KEYSTORE"' EXIT
-          printf '%s' "$SCANNER_KEYSTORE_BASE64" | base64 --decode > "$SCANNER_KEYSTORE"
-          unset SCANNER_KEYSTORE_BASE64
-          ./gradlew --no-daemon --console=plain :scanner-host:lintRelease :scanner-host:assembleRelease \
-            "-PscannerVersionName=$version" "-PscannerVersionCode=$SCANNER_VERSION_CODE"
-          mkdir -p release
-          cp scanner-host/build/outputs/apk/release/scanner-host-release.apk "release/qqq-mobile-$version.apk"
-          cp scanner-host/build/reports/third-party/release/{aboutlibraries.json,LICENSE,NOTICE} release/
-          "$ANDROID_HOME/build-tools/35.0.0/apksigner" verify --verbose --print-certs "release/qqq-mobile-$version.apk" > release/signature.txt
-          certificate=$(sed -n 's/^Signer #1 certificate SHA-256 digest: //p' release/signature.txt)
-          [[ "${certificate,,}" == "${SCANNER_CERTIFICATE_SHA256,,}" ]] || { echo 'Unexpected signing certificate'; exit 1; }
-          "$ANDROID_HOME/build-tools/35.0.0/aapt" dump badging "release/qqq-mobile-$version.apk" > "$RUNNER_TEMP/scanner-manifest.txt"
-          grep -F "package: name='io.qrun.mobile.scanner' versionCode='$SCANNER_VERSION_CODE' versionName='$version'" "$RUNNER_TEMP/scanner-manifest.txt"
-          if grep -q 'application-debuggable' "$RUNNER_TEMP/scanner-manifest.txt"; then
-            echo 'Refusing a debuggable release'; exit 1
-          fi
-          printf 'Source: %s\nVersion: %s\nVersion code: %s\n' "$GITHUB_SHA" "$version" "$SCANNER_VERSION_CODE" > release/BUILD.txt
-          (cd release && sha256sum -- *.apk signature.txt BUILD.txt aboutlibraries.json LICENSE NOTICE > SHA256SUMS)
-      - name: Retain signed deliverable
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: scanner-release-${{ github.sha }}
-          path: release/
-          if-no-files-found: error
-          retention-days: 30
-
-  publish:
-    needs: package
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
-        with:
-          name: scanner-release-${{ github.sha }}
-          path: release
-      - name: Publish immutable-tag APK assets
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GH_REPO: ${{ github.repository }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          (cd release && sha256sum --check SHA256SUMS)
-          prerelease=()
-          version="${GITHUB_REF_NAME#scanner-v}"
-          tag_object=$(gh api "repos/$GH_REPO/git/ref/tags/$GITHUB_REF_NAME" --jq '.object.sha')
-          tag_type=$(gh api "repos/$GH_REPO/git/ref/tags/$GITHUB_REF_NAME" --jq '.object.type')
-          for ((attempt=0; attempt<5; attempt++)); do
-            if [[ "$tag_type" == commit ]]; then break; fi
-            [[ "$tag_type" == tag ]] || exit 1
-            tag_json=$(gh api "repos/$GH_REPO/git/tags/$tag_object")
-            tag_object=$(jq -r '.object.sha' <<< "$tag_json")
-            tag_type=$(jq -r '.object.type' <<< "$tag_json")
-          done
-          [[ "$tag_type" == commit && "$tag_object" == "$GITHUB_SHA" ]] || { echo 'Release tag no longer identifies the verified source'; exit 1; }
-          if [[ "$version" == *-* ]]; then prerelease=(--prerelease); fi
-          gh release create "$GITHUB_REF_NAME" --verify-tag --title "QQQ Mobile $version" \
-            --generate-notes "${prerelease[@]}" release/*
@@ -1,163 +0,0 @@
-name: Scanner Android
-
-on:
-  push:
-    branches: [main, 'feature/**', 'fix/**', 'release/**', 'hotfix/**']
-  pull_request:
-  workflow_call:
-  workflow_dispatch:
-    inputs:
-      emulator:
-        description: Run native UI and real-server scanner end-to-end tests
-        type: boolean
-        default: true
-
-permissions:
-  contents: read
-
-concurrency:
-  group: scanner-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  verify:
-    name: Tests, lint, and debug APK
-    runs-on: ubuntu-24.04
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
-        with:
-          distribution: temurin
-          java-version: '21'
-      - uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4
-        with:
-          cache-read-only: ${{ github.event_name == 'pull_request' }}
-      - name: Verify source headers, whitespace, imports and JavaScript syntax
-        run: node scripts/ci/check-source-standards.mjs
-      - name: Run no-device Echo fixture guard tests
-        run: node --test scripts/ci/scanner-echo-guards.test.mjs
-      - name: Install required Android SDK packages
-        run: |
-          "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" "platforms;android-35" "build-tools;34.0.0" "build-tools;35.0.0" "platform-tools"
-      - name: Verify shared libraries and scanner host
-        run: >-
-          ./gradlew --no-daemon --console=plain
-          :qqq:android:core:testDebugUnitTest
-          :qqq:android:mobileapp:testDebugUnitTest
-          :scanner-host:testDebugUnitTest
-          :scanner-host:lintDebug
-          :scanner-host:assembleDebug
-      - name: Compile opt-in physical QA acceptance
-        run: >-
-          ./gradlew --no-daemon --console=plain -PscannerTestBuildType=qa
-          :scanner-host:assembleQa :scanner-host:assembleQaAndroidTest
-      - name: Hash debug APK
-        run: |
-          mkdir -p scanner-host/build/outputs/apk/debug/notices
-          cp scanner-host/build/reports/third-party/debug/{aboutlibraries.json,LICENSE,NOTICE} scanner-host/build/outputs/apk/debug/notices/
-          (cd scanner-host/build/outputs/apk/debug && sha256sum scanner-host-debug.apk notices/* > SHA256SUMS)
-      - name: Upload installable development APK
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: scanner-debug-${{ github.sha }}
-          path: scanner-host/build/outputs/apk/debug/
-          if-no-files-found: error
-          retention-days: 14
-      - name: Upload test and lint evidence
-        if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: scanner-checks-${{ github.sha }}
-          path: |
-            qqq/android/core/build/test-results/
-            qqq/android/mobileapp/build/test-results/
-            scanner-host/build/test-results/
-            scanner-host/build/reports/
-          retention-days: 14
-
-  emulator:
-    name: Native UI and real-server scanner E2E
-    if: github.event_name != 'workflow_dispatch' || inputs.emulator
-    needs: verify
-    runs-on: ubuntu-24.04
-    timeout-minutes: 40
-    env:
-      QQQ_CORE_SHA: ecf0f550a0357cec6387c2b54efca128a405a629
-      SCANNER_SERVER_SHA: 10416938724c9663d66f7848ff2b1a63fe635794
-      MAVEN_OPTS: -XX:ActiveProcessorCount=2 -Xmx768m
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
-        with:
-          distribution: temurin
-          java-version: '21'
-      - uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4
-      - name: Check out the pinned QQQ core source
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          repository: QRun-IO/qqq
-          ref: ${{ env.QQQ_CORE_SHA }}
-          path: .e2e-core
-          persist-credentials: false
-      - name: Check out the pinned real QQQ demo
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          repository: QRun-IO/qbit-mobile-scanners
-          ref: ${{ env.SCANNER_SERVER_SHA }}
-          path: .e2e-server
-          persist-credentials: false
-      - name: Verify and build the isolated source-pinned server fixture
-        env:
-          JAVA_TOOL_OPTIONS: -XX:ActiveProcessorCount=2 -Xmx768m
-        run: |
-          test "$(git -C .e2e-core rev-parse HEAD)" = "$QQQ_CORE_SHA"
-          test "$(git -C .e2e-server rev-parse HEAD)" = "$SCANNER_SERVER_SHA"
-          fixture_m2=$(mktemp -d "$RUNNER_TEMP/scanner-fixture-m2.XXXXXX")
-          core_revision="4.1.0-ci.$QQQ_CORE_SHA"
-          (cd .e2e-core && ./mvnw --batch-mode --no-transfer-progress \
-            -Dmaven.repo.local="$fixture_m2" -Drevision="$core_revision" \
-            -pl qqq-bom,qqq-middleware-api -am clean install)
-          (cd .e2e-server && ./mvnw --batch-mode --no-transfer-progress \
-            -Dmaven.repo.local="$fixture_m2" -Dqqq.version="$core_revision" clean install)
-          (cd .e2e-server && ./mvnw --batch-mode --no-transfer-progress -f demo/pom.xml \
-            -Dmaven.repo.local="$fixture_m2" -Dqqq.version="$core_revision" clean verify \
-            dependency:build-classpath -DincludeScope=runtime -Dmdep.outputFile=target/e2e-classpath.txt \
-            dependency:tree -Dscope=runtime -DoutputFile=target/fixture-dependencies.txt \
-            help:effective-pom -Doutput=target/fixture-effective-pom.xml)
-          node scripts/ci/verify-fixture-provenance.mjs .e2e-server "$fixture_m2" "$QQQ_CORE_SHA" "$SCANNER_SERVER_SHA"
-      - name: Enable hosted-runner hardware acceleration
-        run: |
-          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
-          sudo udevadm control --reload-rules
-          sudo udevadm trigger --name-match=kvm
-      - name: Run emulator checks
-        uses: ReactiveCircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2
-        with:
-          api-level: 35
-          target: google_apis
-          arch: x86_64
-          disable-animations: true
-          script: |
-            ./gradlew --no-daemon --console=plain :qqqsampleandroidmobileapp:connectedDebugAndroidTest :scanner-host:assembleE2e :scanner-host:assembleE2eAndroidTest
-            node scripts/ci/scanner-e2e.mjs .e2e-server
-      - name: Upload emulator evidence
-        if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: scanner-emulator-${{ github.sha }}
-          include-hidden-files: true
-          path: |
-            qqqsampleandroidmobileapp/build/reports/androidTests/
-            qqqsampleandroidmobileapp/build/outputs/androidTest-results/
-            scanner-host/build/native-e2e/
-            .e2e-server/demo/target/fixture-provenance.json
-            .e2e-server/demo/target/fixture-dependencies.txt
-            .e2e-server/demo/target/fixture-effective-pom.xml
-            .e2e-core/**/target/surefire-reports/TEST-*.xml
-            .e2e-server/**/target/surefire-reports/TEST-*.xml
-          retention-days: 14
@@ -1,3 +0,0 @@
-profile: android
-orb_version: '0.8'
-default_branch: main
@@ -24,4 +24,4 @@ Never log or place passwords, session cookies, or device tokens in process value

 ## Repository automation

-The primary forge is Gitea (`git.kof22.com/QRun-IO`); GitHub is a shadow/archive, so make no ordinary GitHub writes. Protected `main` on Gitea has `.gitea/workflows/qrun-android-release.yaml` calling the shared `KofTwentyTwo/platform-ci` `android.yaml@qrun-release-v1`; pull-request checks come from central Gitea policy, not from that release workflow. It is not a scanner-APK signing pipeline, and no automatic signing CI is configured. CircleCI is managed by `kingsrook/qqq-orb` using `.qqq-ci.yml`; preserve that lane and its main-only library publication. The legacy `.github` `Scanner Android` workflow builds a debug APK artifact and never publishes libraries or production releases; it and the scanner release workflow are not a selected release path. The owner has authorized production signing with the QRun-owned key `qqq-mobile-release` (details and fingerprint in `docs/RELEASING.md`) for signed-APK/MDM distribution. Do not create replacement or additional signing keys, put key material, passwords or vault item details in the repository, or use the legacy GitHub release workflows; create no tags or releases without current authorization. Do not replace managed CI with a stale local template.
+The primary forge is Gitea (`git.kof22.com/QRun-IO`); GitHub is a shadow/archive, so make no ordinary GitHub writes. `.gitea/workflows/build.yaml` calls the shared `KofTwentyTwo/ci-workflows` Android workflow (`android.yaml@v1`) on every push: source checks, JVM unit tests, scanner lint, debug and QA APK assembly, and connected tests on an emulator (android-build runners). A `vX.Y.Z` tag also publishes the SDK AARs (`qqq-android-core`, `qqq-android-mobileapp`) to the QRun-IO Gitea Maven registry. It is not a scanner-APK signing pipeline, and no automatic signing CI is configured. The owner has authorized production signing with the QRun-owned key `qqq-mobile-release` (details and fingerprint in `docs/RELEASING.md`) for signed-APK/MDM distribution. Do not create replacement or additional signing keys, or put key material, passwords or vault item details in the repository; create no tags or releases without current authorization.
@@ -1,5 +1,24 @@
 # Changelog

+## 1.0.5 (versionCode 7), candidate
+
+Not signed, tagged or published (prepared 2026-11-09). Updates 1.0.4 in place with the same permanent signer. Build and release steps: [RELEASING](docs/RELEASING.md#next-candidate-105-versioncode-7).
+
+- Slow links: the short network limits that 1.0.4 left in place are raised, and all limits now come from one shared set (`NetworkTimeouts`). Nothing else changes.
+  - Version discovery (`/qqq/v1/version`), branding, logo, the reachability check and the session heartbeat allowed 5 seconds for the whole call and now allow 30. A version check that took longer than 5 seconds stopped start-up with "Unable to check QQQ UI API compatibility".
+  - Device enrollment and status, sign-in, table and process-status calls waited OkHttp's default 10 seconds for the server and now wait 30.
+  - Process init and step wait 60 seconds. A client that gives up after the server has run a step invites the operator to run it twice.
+  - Opening the connection stays at 10 seconds, so a server that cannot be reached is still reported quickly.
+  - Unchanged on purpose: ending the device session (sign-out, Change server) and live screen frames keep a 5 second call limit; the 3 second bounds around sign-out and the 30 second photo transfer limit are not touched.
+
+## 1.0.4 (versionCode 6)
+
+Published 2026-11-09 as prerelease [scanner-v1.0.4](https://git.kof22.com/QRun-IO/qqq-android/releases/tag/scanner-v1.0.4).
+
+- Loading the server's metadata no longer fails with "Error loading QInstance: timeout" on a handheld. The metadata response is about 1.7 MB and takes the server 4 to 8 seconds to build, and the default 10 second read timeout expired. That one call now allows 60 seconds; every other call keeps its short timeout. A timeout now reads "Timed out after 60.0s loading the server's metadata from <server>/qqq/v1/metaData".
+- Sign-out now also ends the identity-provider session in the browser when the server supports it (the same flow as "Sign out of company", now behind the single **Sign out** action), and every browser sign-in sends `max_age=0` next to `prompt=login`. Before, ordinary Sign out cleared only the QQQ session, so the provider session left in the browser silently signed the same person straight back in on the next sign-in. Servers without provider logout still get local plus QQQ sign-out. Stored-session restore after sign-out was checked and is not a cause (test added).
+- Includes 1.0.3 (versionCode 5): string widget icons and summary-only help content from current QQQ core are accepted. (PR 24)
+
 ## 1.0.2 (versionCode 4), candidate

 Not yet built, signed, tagged or published (prepared 2026-11-06). Supersedes the unpublished signed 1.0.1 (versionCode 3) candidate and updates it in place with the same permanent signer.
@@ -23,9 +23,9 @@ The smoke script clears application data only after verifying the target is an e

 ## CI and delivery

-Managed CircleCI remains the shared-library test and Maven publication lane. Its Android profile publishes libraries only from `main`, after its checks. Feature branches do not publish.
+`.gitea/workflows/build.yaml` calls the shared `KofTwentyTwo/ci-workflows` Android workflow (`android.yaml@v1`) on every push: source checks, JVM unit tests, scanner lint, debug and QA APK assembly, and connected tests on an emulator (android-build runners). A `vX.Y.Z` tag also publishes the SDK AARs (`qqq-android-core`, `qqq-android-mobileapp`) to the QRun-IO Gitea Maven registry. Feature branches never publish.

-The GitHub **Scanner Android** workflow runs shared-library/scanner JVM tests, scanner lint, and debug APK assembly for pull requests and supported branches. It uploads the development APK with SHA256 and verification reports. **Run workflow** optionally adds native emulator tests and a scanner launch screenshot. This workflow never publishes Maven artifacts, signs a production APK, or deploys to a device/store.
+The emulator scanner end-to-end suite against a real QQQ server (`scripts/ci/scanner-e2e.mjs`) is not part of CI; run it locally as described in [emulator testing](docs/EMULATOR.md).

 Production signing and distribution require a separately configured release procedure. Do not treat the development APK as a production release.

@@ -73,7 +73,7 @@ Limits: JVM, emulator and synthetic-scan tests do not prove physical trigger, li

 ## CI and automation

-The primary forge is Gitea (`git.kof22.com/QRun-IO`); GitHub is a shadow/archive and receives no ordinary writes. Protected `main` runs [`.gitea/workflows/qrun-android-release.yaml`](.gitea/workflows/qrun-android-release.yaml) on push and manual dispatch; it calls the shared `KofTwentyTwo/platform-ci` Android workflow (`android.yaml@qrun-release-v1`). That workflow builds, verifies and publishes the SDK libraries; it is not a scanner-APK signing or release pipeline. Pull-request checks come from central Gitea policy. The managed CircleCI profile (`.qqq-ci.yml`) and its main-only library publication are retained. The `.github` workflows are legacy and not a release path. Shared CI design is out of scope for this repository's local use: the demo above needs none of it.
+The primary forge is Gitea (`git.kof22.com/QRun-IO`); GitHub is a shadow/archive and receives no ordinary writes. `.gitea/workflows/build.yaml` calls the shared `KofTwentyTwo/ci-workflows` Android workflow (`android.yaml@v1`) on every push: source checks, JVM unit tests, scanner lint, debug and QA APK assembly, and connected tests on an emulator (android-build runners). A `vX.Y.Z` tag also publishes the SDK AARs (`qqq-android-core`, `qqq-android-mobileapp`) to the QRun-IO Gitea Maven registry. It is not a scanner-APK signing or release pipeline. Shared CI design is out of scope for this repository's local use: the demo above needs none of it.

 ## Extension points

@@ -63,7 +63,7 @@ The fresh-login prompt is a request to the provider, not cryptographic proof of

 ## Optional company sign-out (implementation awaiting qualification)

-Ordinary **Sign out** continues to end only the QQQ session. The scanner also exposes a separate **Sign out of company** action in Account when the server advertises API1.10 or later within major1, feature `nativeSessionLogout`, and OAuth2 metadata `nativeSessionLogout` with flow `OIDC_RP_INITIATED_LOGOUT` and `postLogoutRedirectUris`. Other library hosts opt into that separate action with `LocalCompanySignOutEnabled`; it is disabled by default. No automatic provider-logout policy is selected. The confirmation explains that company sign-out may affect other applications in the browser.
+Since 1.0.4, **Sign out** in Account ends the QQQ session and, when the server advertises API1.10 or later within major1, feature `nativeSessionLogout`, and OAuth2 metadata `nativeSessionLogout` with flow `OIDC_RP_INITIATED_LOGOUT` and `postLogoutRedirectUris`, also ends the provider session in the browser (formerly the separate **Sign out of company** action; without that support Sign out stays QQQ-only). Other library hosts opt into provider sign-out with `LocalCompanySignOutEnabled`; it is disabled by default. No automatic provider-logout policy is selected. The confirmation explains that company sign-out may affect other applications in the browser.

 Register the installed package's exact callback separately as a provider **post-logout** redirect, even when it matches the existing login callback. The client sends `{"nativeLogout":{"postLogoutRedirectUri":"<registered callback>"}}` to the existing `POST /qqq/v1/logout`. Its optional `nativeLogoutData` contains `issuer`, `endSessionEndpoint`, `postLogoutRedirectUri` and sensitive `idTokenHint`. Old sessions or unsupported servers may legitimately omit this data. The ordinary logout request remains unchanged.

@@ -4,28 +4,22 @@ Use this for the **production-signed** APK on a small number of devices. Move to

 This guide is not the local demo. The demo uses the development-signed debug APK, plain HTTP and `adb reverse` port forwarding to a workstation server; see [README](../README.md#installing-on-a-device). The two builds have different signers and cannot update each other.

-**Current release status (November 5, 2026):** the only published release is the signed preview 1.0.0 below. A signed **1.0.1 (versionCode 3) candidate** exists but is **not published and has no download link**; this guide does not point to one. Use the table below for what is actually hosted. It is superseded by the planned **1.0.2 (versionCode 4)** candidate (not yet built; see [RELEASING](RELEASING.md#next-candidate-102-versioncode-4)). When a newer version is published, use the file, checksum and link given by the release owner, and verify the same signer.
-
-| Candidate (not published) | Value |
-| --- | --- |
-| Version | 1.0.1, versionCode 3 |
-| APK SHA-256 | `5124716B59CAD303717E7834FE64DDC1537E33A25C9AB75A6EA1ACF03AC2717F` (15015419 bytes) |
-| Signing certificate SHA-256 | Same as below (`BDDB2D2F...5B17A9FF`) |
+**Current release status (November 9, 2026):** the latest published build is **1.0.4 (versionCode 6)** below, a Gitea prerelease. It updates 1.0.3, 1.0.2, 1.0.1 and 1.0.0 in place. A **1.0.5 (versionCode 7)** candidate with longer network limits for slow links is prepared but not signed or published (see [RELEASING](RELEASING.md#next-candidate-105-versioncode-7)). When a newer version is published, use the file, checksum and link on its release page, and verify the same signer.

 Details and qualification status: [RELEASING](RELEASING.md).

 | Item | Value |
 | --- | --- |
-| Source | [Signed preview release scanner-v1.0.0](https://git.kof22.com/QRun-IO/qqq-android/releases/tag/scanner-v1.0.0) (prerelease; forge sign-in required) |
-| File | `QQQ-Mobile-1.0.0.apk`, with `SHA256SUMS` on the same release page |
+| Source | [Release scanner-v1.0.4](https://git.kof22.com/QRun-IO/qqq-android/releases/tag/scanner-v1.0.4) (prerelease; downloads without sign-in) |
+| File | `QQQ-Mobile-1.0.4.apk` (15015419 bytes), with `SHA256SUMS`, `INSTALL.md` and `RELEASE-NOTES.md` on the same release page |
 | Application ID | `io.qrun.mobile.scanner` |
-| Version | 1.0.0, versionCode 2 |
-| APK SHA-256 | `EE5AC896B8985AF6F11B2E883955925D6571A2913D74A4AACCDB564B79394D51` |
+| Version | 1.0.4, versionCode 6 |
+| APK SHA-256 | `F643872F4435B55F6A0B929D1762CAACB18010E5CC0B473C7B4BABBDC4299489` |
 | Signing certificate SHA-256 | `BDDB2D2F45A5925C643A83ABAF616C1EAB2387DC5CDA7B645A6F4C0D5B17A9FF` |

-The same APK is used for every customer; branding comes from the server at runtime. Download the APK and `SHA256SUMS` from the release page and compare the SHA-256 before installing, then verify the signing certificate matches the value above. The checksum shows the file is intact, not who signed it. This is a preview, not a stable release. Only the APK and `SHA256SUMS` are hosted; there is no hosted install kit.
+The same APK is used for every customer; branding comes from the server at runtime. Download the APK and `SHA256SUMS` from the release page and compare the SHA-256 before installing, then verify the signing certificate matches the value above. The checksum shows the file is intact, not who signed it. This is a prerelease, not a stable release. Earlier releases: `scanner-v1.0.2` and the signed preview `scanner-v1.0.0` (`QQQ-Mobile-1.0.0.apk`, SHA-256 `EE5AC896B8985AF6F11B2E883955925D6571A2913D74A4AACCDB564B79394D51`).

-**Device evidence.** *Historical (November 4):* this APK was installed and launched once on a fresh Zebra MC9400 (Android 13) and showed the Connect screen; it was not yet enrolled. *Current (November 5):* with the user's explicit authorization, the MC9400 was migrated: 1.0.0 enrollment over trusted HTTPS passed, then an in-place 1.0.1 update preserved login and enrollment. Apps/ScanCapture navigation and EMDK Scanner-ready were observed, and the operator confirmed a physical Saved scan that the backend verified. These checks are done and need not be repeated for this device. The 1.0.1 candidate is still unpublished, native Authentik login/logout/account switching is not yet qualified with the production APK, and the TC22 keeps its original development-signed installation.
+**Device evidence (1.0.0 and 1.0.1; 1.0.4 had not been installed on a device when it was published).** *Historical (November 4):* the 1.0.0 APK was installed and launched once on a fresh Zebra MC9400 (Android 13) and showed the Connect screen; it was not yet enrolled. *Current (November 5):* with the user's explicit authorization, the MC9400 was migrated: 1.0.0 enrollment over trusted HTTPS passed, then an in-place 1.0.1 update preserved login and enrollment. Apps/ScanCapture navigation and EMDK Scanner-ready were observed, and the operator confirmed a physical Saved scan that the backend verified. These checks are done and need not be repeated for this device. The 1.0.1 candidate is still unpublished, native Authentik login/logout/account switching is not yet qualified with the production APK, and the TC22 keeps its original development-signed installation.

 ## Before you start

@@ -35,7 +29,7 @@ The same APK is used for every customer; branding comes from the server at runti

 ## Install: copy the file (recommended)

-1. Copy the verified `QQQ-Mobile-1.0.0.apk` to the device's **Downloads** folder.
+1. Copy the verified `QQQ-Mobile-1.0.4.apk` to the device's **Downloads** folder.
 2. Open **Files**, go to Downloads, and tap the APK.
 3. If Android asks, allow that Files app to install apps, then continue. You can turn the permission off again afterward.

@@ -45,9 +39,12 @@ Requires USB debugging enabled on the device, a computer the device has been ask

 ```powershell
 adb devices
-adb -s DEVICE_SERIAL install -r QQQ-Mobile-1.0.0.apk
+adb -s DEVICE_SERIAL install -r QQQ-Mobile-1.0.4.apk
+adb -s DEVICE_SERIAL shell dumpsys package io.qrun.mobile.scanner | findstr /i "versionName versionCode"
 ```

+The last command confirms the installed version (expect `versionCode=6` and `versionName=1.0.4`).
+
 Replace `DEVICE_SERIAL` with the serial of the device you chose from `adb devices`. Always name the target with `-s`. Do not add `-d` (downgrade) or `-t`.

 ## First launch and enrollment
@@ -1,6 +1,28 @@
 # Scanner APK release readiness

-## Current status (November 5, 2026)
+## Current status (November 9, 2026)
+
+- **Latest published:** [scanner-v1.0.4](https://git.kof22.com/QRun-IO/qqq-android/releases/tag/scanner-v1.0.4), QQQ Mobile **1.0.4 (versionCode 6)**, a Gitea prerelease. The tag is on `main` `9bae976138c4447f3fa451ee49b8585e80f01847` (1.0.3 source plus Android PRs 26 and 27; a lightweight tag created with the release, like `scanner-v1.0.2`). Assets: `QQQ-Mobile-1.0.4.apk` (15015419 bytes, SHA-256 `F643872F4435B55F6A0B929D1762CAACB18010E5CC0B473C7B4BABBDC4299489`), `SHA256SUMS`, `INSTALL.md`, `RELEASE-NOTES.md`. The APK was downloaded back without sign-in and matched; `aapt2` shows versionCode 6 and versionName 1.0.4; `apksigner` verifies v2 and v3 with one signer whose certificate SHA-256 is `BDDB2D2F45A5925C643A83ABAF616C1EAB2387DC5CDA7B645A6F4C0D5B17A9FF`.
+- **Earlier releases:** `scanner-v1.0.2` (1.0.2, versionCode 4, signed candidate, prerelease) and `scanner-v1.0.0` (signed preview). 1.0.3 (versionCode 5) was signed and installed on the TC22 and MC9400 but never tagged or published; 1.0.4 includes it.
+- **Qualification of 1.0.4:** hosted CI on the tagged commit passed source checks, JVM unit tests, debug lint and the debug build; the emulator tests did not run because the runner had no usable `/dev/kvm`. No `lintRelease` result was recorded for the 1.0.4 build, and 1.0.4 had not been installed on a device when it was published.
+- **Next candidate:** **1.0.5 (versionCode 7)**, slow-link network limits; see [Next candidate](#next-candidate-105-versioncode-7). Not signed, tagged or published.
+- **CI note:** the shared workflow's Gradle step currently runs only the first line of `tasks` (unit tests, debug lint, debug build); the QA assembly line does not run. Run the release-variant lint and build locally before signing.
+
+## Next candidate: 1.0.5 (versionCode 7)
+
+Prepared on 2026-11-09 on branch `fix/slow-link-timeouts`. **Nothing is signed, tagged, installed or published for 1.0.5.** It updates 1.0.4 in place with the same signer and a higher `versionCode`.
+
+Change since 1.0.4 (details in [CHANGELOG](../CHANGELOG.md#105-versioncode-7-candidate)): the remaining short network limits are raised for slow links, from one shared set (`NetworkTimeouts`).
+
+Build from the exact merged `main` commit, with no `SCANNER_*` signing variables set:
+
+```
+./gradlew --no-daemon --console=plain :scanner-host:lintRelease :scanner-host:assembleRelease -PscannerVersionName=1.0.5 -PscannerVersionCode=7
+```
+
+Then sign `scanner-host/build/outputs/apk/release/scanner-host-release-unsigned.apk` in isolation, as for 1.0.4: `zipalign -P 16 -f 4`, then `apksigner sign` with the existing permanent key (certificate SHA-256 `BDDB2D2F...5B17A9FF`, recovered from the vault only for this step), then verify v2 and v3 with exactly one signer, `versionCode='7' versionName='1.0.5'`, and write `QQQ-Mobile-1.0.5.apk` and `SHA256SUMS`. Tag the built commit `scanner-v1.0.5`, create the Gitea release with the APK, `SHA256SUMS`, install notes and release notes, download the APK back and compare its SHA-256. Record the hashes here and in [INSTALLATION](INSTALLATION.md).
+
+## Status on November 5, 2026 (historical)

 - **Published:** the only published release is still [scanner-v1.0.0](https://git.kof22.com/QRun-IO/qqq-android/releases/tag/scanner-v1.0.0), a **signed preview** (Gitea prerelease, not a stable release). It is unchanged.
 - **Candidate, not published:** QQQ Mobile **1.0.1 (versionCode 3)** is a signed candidate. Its release qualification is incomplete, and no tag or download link is available yet.
@@ -13,6 +35,8 @@

 ## Next candidate: 1.0.2 (versionCode 4)

+*(Historical: 1.0.2 was built, signed and published as prerelease `scanner-v1.0.2` on 2026-11-06, and is superseded by 1.0.4.)*
+
 Prepared on 2026-11-06 on branch `release/scanner-1.0.2` (Android PRs 17 and 18 merged locally plus these notes). **Nothing is built, signed, tagged, installed or published for 1.0.2.** The signed 1.0.1 candidate stays unpublished and is superseded; 1.0.2 updates it in place with the same signer and a higher `versionCode`.

 Changes since 1.0.1 (details in [CHANGELOG](../CHANGELOG.md#102-versioncode-4-candidate)): company sign-out now completes (the device-session end ran before the provider logout, so no `nativeLogoutData` came back and the browser never opened on the MC9400); the user name is shown after browser sign-in; app/OS version are reported on every heartbeat (effective with mobile-scanners server 1.6.0).
@@ -41,7 +65,7 @@ Dated evidence below is preserved. As of November 4: a QRun-owned production sig

 ## What exists today

- **Gitea CI (actual).** `.gitea/workflows/qrun-android-release.yaml` is in the repository, runs on push to `main` (and manual dispatch) and calls the central `KofTwentyTwo/platform-ci` Android workflow at `qrun-release-v1`. A central main run (3634) passed and published the SDK AARs. It is **not** a scanner-APK signing or release pipeline: it uses no scanner signing secrets and produces no production-signed scanner APK.
+- **Gitea CI (actual).** `.gitea/workflows/build.yaml` calls the shared `KofTwentyTwo/ci-workflows` Android workflow (`android.yaml@v1`) on every push: source checks, JVM unit tests, scanner lint, debug and QA APK assembly, and connected tests on an emulator (android-build runners). A `vX.Y.Z` tag also publishes the SDK AARs (`qqq-android-core`, `qqq-android-mobileapp`) to the QRun-IO Gitea Maven registry. It is **not** a scanner-APK signing or release pipeline: it uses no scanner signing secrets and produces no production-signed scanner APK.
 - **Gradle signing (supported, not selected).** `scanner-host/build.gradle.kts` reads four environment variables: `SCANNER_KEYSTORE`, `SCANNER_STORE_PASSWORD`, `SCANNER_KEY_ALIAS`, `SCANNER_KEY_PASSWORD`.
  - All four set: the `release` build type is signed with them.
  - None set: `assembleRelease` produces an **unsigned** APK, which is what the isolated signing step consumes.
@@ -49,7 +73,7 @@ Dated evidence below is preserved. As of November 4: a QRun-owned production sig
  - Debug, `e2e` and `qa` builds keep the development debug signing.
  - Version comes from `-PscannerVersionName` (semantic version, default `0.1.0`) and `-PscannerVersionCode` (1 to 2100000000, default `1`).
 - **Identity.** One APK serves all customers; branding is applied at runtime from the selected server's metadata, so no per-customer key or build is needed.
- **Legacy GitHub workflows (historical only).** `.github/workflows/release-scanner.yml` and `scanner.yml` predate Gitea as primary forge. They are not a release path; do not run or follow them. The [November 1 review](RELEASE-AUTOMATION-REVIEW.md) covered those files only.
+- **Legacy GitHub workflows (removed).** `.github/workflows/release-scanner.yml` and `scanner.yml` predated Gitea as primary forge and were removed with the CircleCI configuration. The [November 1 review](RELEASE-AUTOMATION-REVIEW.md) covered those files only.

 ## First release: 1.0.0 (versionCode 2)

@@ -2,6 +2,12 @@

 As of **2026-11-06**. Scope: scanner host and maintained local Echo workflow. [TODO](TODO.md) tracks remaining work; [history](history/README.md) preserves earlier evidence. This is not a final-release or full-qualification claim. See [Release facts](#release-facts-2026-11-05) below.

+## Release facts (2026-11-09)
+
+- **Published:** `scanner-v1.0.4` (1.0.4, versionCode 6, prerelease) on `main` `9bae976`: the 60 second metadata load limit (PR 26), sign-out that ends the identity-provider session (PR 27) and 1.0.3's widget icon fix (PR 24). APK SHA-256 `F643872F4435B55F6A0B929D1762CAACB18010E5CC0B473C7B4BABBDC4299489`. Not yet installed on a device when published. Details: [RELEASING](RELEASING.md).
+- **Candidate:** 1.0.5 (versionCode 7) raises the remaining short network limits for slow links from one shared set (`NetworkTimeouts`); branch `fix/slow-link-timeouts`. Not signed, tagged or published.
+- **CI:** emulator tests do not run on the hosted runners (no usable `/dev/kvm`), and the shared workflow runs only the first Gradle task line.
+
 ## Release candidate 1.0.2 (versionCode 4), 2026-11-06

 - Branch `release/scanner-1.0.2` carries Android PR 17 (company sign-out ordering, OAuth user name) and PR 18 (heartbeat app/OS version) plus the [1.0.2 changelog](../CHANGELOG.md#102-versioncode-4-candidate) and build instructions in [RELEASING](RELEASING.md#next-candidate-102-versioncode-4). It depends on both PRs merging first and must be rebased onto the resulting `main`. **Nothing is built, signed, tagged, installed or published for 1.0.2**; the signed 1.0.1 candidate stays unpublished.
@@ -6,7 +6,8 @@ Open work only, as of **2026-11-05**. Current evidence: [SESSION-STATE](SESSION-

 - [ ] Qualify actual GS1 label media and physical printed-label rescan. Synthetic capture/render evidence does not close this check.
 - [ ] Verify actual production-APK native Authentik login, logout and account switching; awaiting the MC wireless-debug endpoint. Real-server discovery (UI API 1.10, strict nonce, scanner and printing channels) is already verified; no native-Authentik PASS is claimed.
- [ ] After Android PRs 17 and 18 merge, rebase `release/scanner-1.0.2`, then build, sign (same permanent signer) and publish 1.0.2 (versionCode 4) with checksum and installation instructions after remaining qualification; see [RELEASING](RELEASING.md#next-candidate-102-versioncode-4). The signed 1.0.1 (versionCode 3) candidate is superseded and stays unpublished. The published release is still the 1.0.0 signed preview.
+- [ ] Install published 1.0.4 (`scanner-v1.0.4`) on the handhelds and confirm the in-place update. Then merge the 1.0.5 slow-link change, build, sign (same permanent signer), tag `scanner-v1.0.5` and publish; see [RELEASING](RELEASING.md#next-candidate-105-versioncode-7).
+- [ ] (Superseded by 1.0.4; kept for its notes.) After Android PRs 17 and 18 merge, rebase `release/scanner-1.0.2`, then build, sign (same permanent signer) and publish 1.0.2 (versionCode 4) with checksum and installation instructions after remaining qualification; see [RELEASING](RELEASING.md#next-candidate-102-versioncode-4). The signed 1.0.1 (versionCode 3) candidate is superseded and stays unpublished. The published release is still the 1.0.0 signed preview.
 - [ ] Publish and distribute full release assets to remaining devices; validate MDM/company profile and wallpaper separately. A customer deployment needs a customer HTTPS URL with a trusted certificate.
 - [ ] Printing: the next installer remains with the active printing owner (print nonce fix PR 11 postdates published print 1.1.1).
 - [ ] Optional, non-blocking: automatic APK signing CI. Direct APK release does not depend on it.
@@ -30,10 +30,10 @@ plugins {
 publishing {
   repositories {
      maven {
-         name = "githubQqqMavenRegistry"
-         url = uri("https://maven.pkg.github.com/QRun-IO/qqq-maven-registry")
-         // username and password (a personal Github access token) should be specified as
-         // `githubPackagesUsername` and `githubPackagesPassword` Gradle properties
+         // Gitea Maven registry of the repository owner. CI sets giteaMavenUrl, giteaUsername
+         // and giteaPassword (ci-workflows android.yaml, publish-tasks on vX.Y.Z tags).
+         name = "gitea"
+         url = uri(providers.gradleProperty("giteaMavenUrl").getOrElse("https://git.kof22.com/api/packages/QRun-IO/maven"))
         credentials(PasswordCredentials::class)
      }
   }
@@ -44,18 +44,36 @@ import okhttp3.RequestBody
 import okhttp3.RequestBody.Companion.toRequestBody
 import org.json.JSONObject
 import retrofit2.Retrofit
+import java.io.IOException
+import java.io.InterruptedIOException
 import java.util.TimeZone
 import java.util.concurrent.ConcurrentHashMap
+import java.util.concurrent.TimeUnit
+
+/*******************************************************************************
+ ** Ceiling for loading the server's metadata (GET /qqq/v1/metaData). That response is large (about 1.7 MB before
+ ** compression for a platform administrator) and the server needs seconds to build it, so the default 10 second
+ ** OkHttp read timeout expired on handhelds. The value lives with the other limits in NetworkTimeouts.
+ *******************************************************************************/
+const val METADATA_LOAD_TIMEOUT_SECONDS = NetworkTimeouts.METADATA_LOAD_SECONDS
+
+/*******************************************************************************
+ ** The HTTP clients of one server: ordinary calls, the metadata load, and process init and step.
+ *******************************************************************************/
+internal class RepositoryClients(val standard: OkHttpClient, val metaData: OkHttpClient, val process: OkHttpClient)


 /*******************************************************************************
 *******************************************************************************/
-class NetworkQQQRepository(private var baseUrl: String, @Volatile var requestObserver: (RequestOutcome) -> Unit = {}, private val compatibility: UiApiCompatibility? = null, private val additionalHeaders: (String) -> Map<String, String> = { emptyMap() }) : QQQRepository {
+class NetworkQQQRepository(private var baseUrl: String, @Volatile var requestObserver: (RequestOutcome) -> Unit = {}, private val compatibility: UiApiCompatibility? = null, private val metaDataTimeoutMillis: Long = METADATA_LOAD_TIMEOUT_SECONDS * 1000, private val additionalHeaders: (String) -> Map<String, String> = { emptyMap() }) : QQQRepository {
   private val sessionUUIDs = ConcurrentHashMap<String, String>()
   private val retroJson = Json { ignoreUnknownKeys = true }
   private val compatibilityByServer = ConcurrentHashMap<String, UiApiCompatibility>()

   private val qqqApiServiceMap: MutableMap<String, QQQApiService> = mutableMapOf()
+   private val metaDataApiServiceMap: MutableMap<String, QQQApiService> = mutableMapOf()
+   private val processApiServiceMap: MutableMap<String, QQQApiService> = mutableMapOf()
+   internal val clientsByServer: MutableMap<String, RepositoryClients> = mutableMapOf()

   /*******************************************************************************
    *******************************************************************************/
@@ -63,9 +81,17 @@ class NetworkQQQRepository(private var baseUrl: String, @Volatile var requestObs
      baseUrl = environment.baseUrl

      if (qqqApiServiceMap[baseUrl] == null) {
-         val thisRetrofit = buildRetrofit(baseUrl)
-         val thisQQQApiService = thisRetrofit.create(QQQApiService::class.java)
-         qqqApiServiceMap[baseUrl] = thisQQQApiService
+         val client = buildClient(baseUrl)
+         qqqApiServiceMap[baseUrl] = buildRetrofit(baseUrl, client).create(QQQApiService::class.java)
+         val metaDataClient = client.newBuilder()
+            .callTimeout(metaDataTimeoutMillis, TimeUnit.MILLISECONDS)
+            .readTimeout(metaDataTimeoutMillis, TimeUnit.MILLISECONDS)
+            .build()
+         metaDataApiServiceMap[baseUrl] = buildRetrofit(baseUrl, metaDataClient).create(QQQApiService::class.java)
+         // No call timeout, as before: only the wait for the server's bytes is longer.
+         val processClient = client.newBuilder().slowLinkTimeouts(NetworkTimeouts.PROCESS_STEP_SECONDS).build()
+         processApiServiceMap[baseUrl] = buildRetrofit(baseUrl, processClient).create(QQQApiService::class.java)
+         clientsByServer[baseUrl] = RepositoryClients(client, metaDataClient, processClient)
      }

      // retrofit = buildRetrofit()
@@ -74,11 +100,21 @@ class NetworkQQQRepository(private var baseUrl: String, @Volatile var requestObs

   /*******************************************************************************
    *******************************************************************************/
-   private fun buildRetrofit(baseUrl: String): Retrofit {
+   private fun buildRetrofit(baseUrl: String, client: OkHttpClient): Retrofit {
      return Retrofit.Builder()
         .addConverterFactory(retroJson.asConverterFactory("application/json".toMediaType()))
-         .client(
+         .client(client)
+         .baseUrl(baseUrl)
+         .build()
+   }
+
+   /*******************************************************************************
+    ** Build the shared client (same-origin, session, compatibility and error interceptors) with the small-call limits.
+    *******************************************************************************/
+   private fun buildClient(baseUrl: String): OkHttpClient {
+      return (
            OkHttpClient.Builder()
+               .slowLinkTimeouts()
               .followRedirects(false)
               .followSslRedirects(false)
               .addInterceptor { chain ->
@@ -110,8 +146,6 @@ class NetworkQQQRepository(private var baseUrl: String, @Volatile var requestObs
               .addInterceptor(SameOriginInterceptor())
               .build()
         )
-         .baseUrl(baseUrl)
-         .build()
   }

   /*******************************************************************************
@@ -309,7 +343,13 @@ class NetworkQQQRepository(private var baseUrl: String, @Volatile var requestObs
   override suspend fun getMetaData(
      frontendName: String, frontendVersion: String, applicationName: String, applicationVersion: String
   ): QInstance {
-      return qqqApiServiceMap[baseUrl]!!.getMetaData(frontendName, frontendVersion, applicationName, applicationVersion)
+      try {
+         return metaDataApiServiceMap[baseUrl]!!.getMetaData(frontendName, frontendVersion, applicationName, applicationVersion)
+      } catch (e: InterruptedIOException) {
+         // OkHttp reports read and call timeouts as InterruptedIOException (SocketTimeoutException); the bare "timeout" is not diagnosable.
+         // Coroutine cancellation is a CancellationException, not an IOException, so it is unaffected.
+         throw IOException("Timed out after ${metaDataTimeoutMillis / 1000.0}s loading the server's metadata from ${baseUrl.trimEnd('/')}/qqq/v1/metaData", e)
+      }
   }

   /*******************************************************************************
@@ -321,13 +361,13 @@ class NetworkQQQRepository(private var baseUrl: String, @Volatile var requestObs
   /*******************************************************************************
    *******************************************************************************/
   override suspend fun processInit(processName: String, values: Map<String, Any?>, recordsParam: String?, recordIds: String?, filterJSON: String?, stepTimeoutMillis: Int?): ProcessStepResult {
-      return qqqApiServiceMap[baseUrl]!!.processInit(processName, buildProcessInitOrStepRequestBodyV1(values, recordsParam, recordIds, filterJSON, stepTimeoutMillis))
+      return processApiServiceMap[baseUrl]!!.processInit(processName, buildProcessInitOrStepRequestBodyV1(values, recordsParam, recordIds, filterJSON, stepTimeoutMillis))
   }

   /*******************************************************************************
    *******************************************************************************/
   override suspend fun processStep(processName: String, processUUID: String, stepName: String, values: Map<String, Any?>, stepTimeoutMillis: Int?): ProcessStepResult {
-      return qqqApiServiceMap[baseUrl]!!.processStep(processName, processUUID, stepName, buildProcessInitOrStepRequestBodyV1(values, stepTimeoutMillis = stepTimeoutMillis))
+      return processApiServiceMap[baseUrl]!!.processStep(processName, processUUID, stepName, buildProcessInitOrStepRequestBodyV1(values, stepTimeoutMillis = stepTimeoutMillis))
   }

   /*******************************************************************************
@@ -0,0 +1,55 @@
+/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
+package com.kingsrook.qqq.frontend.android.core.controllers
+
+import java.util.concurrent.TimeUnit
+import okhttp3.OkHttpClient
+
+/*******************************************************************************
+ ** The one set of network limits for every HTTP client in the app, sized for a slow warehouse link.
+ ** A limit that is too short turns a slow answer into a failure; a call that the client abandons also
+ ** closes its connection, so the retry pays for a new TLS handshake on the same slow link.
+ *******************************************************************************/
+object NetworkTimeouts {
+   /*******************************************************************************
+    ** Opening the TCP connection. Kept at OkHttp's default: one round trip, so a server that cannot be
+    ** reached at all is still reported quickly.
+    *******************************************************************************/
+   const val CONNECT_SECONDS = 10L
+
+   /*******************************************************************************
+    ** Small request and response calls: version discovery, branding, logo, reachability, device
+    ** enrollment and status, session heartbeat, sign-in, table and process-status calls.
+    *******************************************************************************/
+   const val SMALL_CALL_SECONDS = 30L
+
+   /*******************************************************************************
+    ** Process init and step. These carry the operator's work: if the client gives up after the server
+    ** has run the step, the operator retries and the work is done twice.
+    *******************************************************************************/
+   const val PROCESS_STEP_SECONDS = 60L
+
+   /*******************************************************************************
+    ** Loading the server's metadata (GET /qqq/v1/metaData): the largest response, and the server takes
+    ** seconds to build it.
+    *******************************************************************************/
+   const val METADATA_LOAD_SECONDS = 60L
+
+   /*******************************************************************************
+    ** Calls whose failure is tolerated and that must never hold the operator: ending the device session
+    ** before sign-out or a server change (the usual reason to change server is that it cannot be reached)
+    ** and live screen frames, which are stale after a few seconds.
+    *******************************************************************************/
+   const val BEST_EFFORT_CALL_SECONDS = 5L
+}
+
+/*******************************************************************************
+ ** Apply the shared connect limit and one read and write limit to a client.
+ *******************************************************************************/
+fun OkHttpClient.Builder.slowLinkTimeouts(seconds: Long = NetworkTimeouts.SMALL_CALL_SECONDS): OkHttpClient.Builder =
+   connectTimeout(NetworkTimeouts.CONNECT_SECONDS, TimeUnit.SECONDS).readTimeout(seconds, TimeUnit.SECONDS).writeTimeout(seconds, TimeUnit.SECONDS)
+
+/*******************************************************************************
+ ** The same, with the whole call (connect, request, response) bounded by the same limit.
+ *******************************************************************************/
+fun OkHttpClient.Builder.slowLinkCallTimeouts(seconds: Long = NetworkTimeouts.SMALL_CALL_SECONDS): OkHttpClient.Builder =
+   slowLinkTimeouts(seconds).callTimeout(seconds, TimeUnit.SECONDS)
@@ -2,7 +2,6 @@
 package com.kingsrook.qqq.frontend.android.core.controllers

 import java.io.IOException
-import java.util.concurrent.TimeUnit
 import kotlinx.serialization.Serializable
 import kotlinx.serialization.json.Json
 import okhttp3.OkHttpClient
@@ -38,8 +37,8 @@ class UiApiCompatibility(
   val server: String, private val requireMobileScanners: Boolean = false,
   private val observer: (RequestOutcome) -> Unit = {}
 ) {
-   private val client = OkHttpClient.Builder().followRedirects(false).followSslRedirects(false)
-      .callTimeout(5, TimeUnit.SECONDS).addInterceptor(RequestOutcomeInterceptor(observer)).build()
+   internal val client = OkHttpClient.Builder().followRedirects(false).followSslRedirects(false)
+      .slowLinkCallTimeouts().addInterceptor(RequestOutcomeInterceptor(observer)).build()

   @Volatile
   private var verified: UiApiVersion? = null
@@ -27,8 +27,9 @@ import kotlinx.serialization.Serializable
 *******************************************************************************/
@Serializable
 data class QHelpContent(
-   val content: String,
-   val format: String,
+   val content: String? = null, // QQQ core now sends summary-only help entries
+   val summary: String? = null,
+   val format: String? = null,
   val roles: Set<String> = emptySet(),
   val contentAsText: String? = null
 ) {
@@ -23,6 +23,7 @@
 package com.kingsrook.qqq.frontend.android.core.model.metadata

 import kotlinx.serialization.Serializable
+import kotlinx.serialization.json.JsonElement

 /*******************************************************************************
 *******************************************************************************/
@@ -30,7 +31,7 @@ import kotlinx.serialization.Serializable
 data class QWidgetMetaData(
   val name: String,
   val label: String? = null,
-   val icon: QIcon? = null,
+   val icon: JsonElement? = null, // QQQ core serializes a widget icon as a plain string (e.g. "troubleshoot"); tolerate an object too
   val type: String,
 ) {
 }
@@ -303,4 +303,60 @@ class NetworkQQQRepositoryTest {
         }
      }
   }
+
+   /*******************************************************************************
+    ** The metadata response is large and slow to build; a response that starts after the old 10 second read timeout must still load.
+    *******************************************************************************/
+   @Test
+   fun metaDataLoadSurvivesAServerThatAnswersAfterTheOldDefaultTimeout() = runBlocking() {
+      MockWebServer().use { server ->
+         server.enqueue(MockResponse().setBody(VERSION_FIXTURE))
+         server.enqueue(MockResponse().setHeadersDelay(11, java.util.concurrent.TimeUnit.SECONDS).setBody("""{"tables":{},"processes":{},"widgets":{},"apps":{}}"""))
+         val origin = server.url("/").toString()
+         val repository = NetworkQQQRepository(origin)
+         repository.setEnvironment(Environment("test", origin))
+         val instance = repository.getMetaData("qqq-android", "1.0", "app", "1.0")
+         assertTrue(instance.tables!!.isEmpty())
+         server.takeRequest()
+         assertEquals("/qqq/v1/metaData", server.takeRequest().requestUrl!!.encodedPath)
+      }
+   }
+
+   /*******************************************************************************
+    ** A metadata timeout names what timed out and the URL, without any query values, tokens or cookies.
+    *******************************************************************************/
+   @Test
+   fun metaDataTimeoutNamesTheMetadataLoadAndUrlWithoutSecrets() = runBlocking() {
+      MockWebServer().use { server ->
+         server.enqueue(MockResponse().setBody(VERSION_FIXTURE))
+         server.enqueue(MockResponse().setHeadersDelay(3, java.util.concurrent.TimeUnit.SECONDS).setBody("{}"))
+         val origin = server.url("/").toString()
+         val repository = NetworkQQQRepository(origin, metaDataTimeoutMillis = 500)
+         repository.setEnvironment(Environment("test", origin))
+         repository.setSessionUUID("fixture-session-value")
+         val failure = runCatching { repository.getMetaData("qqq-android", "1.0", "app", "1.0") }.exceptionOrNull()
+         assertTrue(failure is java.io.IOException)
+         val message = failure!!.message!!
+         assertTrue(message, message.startsWith("Timed out after 0.5s loading the server's metadata from "))
+         assertTrue(message, message.endsWith(origin.trimEnd('/') + "/qqq/v1/metaData"))
+         assertFalse(message.contains("fixture-session-value"))
+         assertFalse(message.contains("?"))
+      }
+   }
+
+   /*******************************************************************************
+    ** Since 1.0.5 other calls also survive a server that answers after the old 10 second read timeout
+    ** (NetworkTimeoutsTest asserts the configured limits).
+    *******************************************************************************/
+   @Test
+   fun otherCallsSurviveAServerThatAnswersAfterTheOldDefaultTimeout() = runBlocking() {
+      MockWebServer().use { server ->
+         server.enqueue(MockResponse().setBody(VERSION_FIXTURE))
+         server.enqueue(MockResponse().setHeadersDelay(12, java.util.concurrent.TimeUnit.SECONDS).setBody("""{"records":[]}"""))
+         val origin = server.url("/").toString()
+         val repository = NetworkQQQRepository(origin)
+         repository.setEnvironment(Environment("test", origin))
+         assertTrue(repository.queryRecords("items", "id", 0, 10).isEmpty())
+      }
+   }
 }
@@ -0,0 +1,76 @@
+/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
+package com.kingsrook.qqq.frontend.android.core.controllers
+
+import com.kingsrook.qqq.frontend.android.core.model.Environment
+import okhttp3.OkHttpClient
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+/*******************************************************************************
+ ** The limits a slow warehouse link depends on. A change to any of them must be deliberate.
+ *******************************************************************************/
+class NetworkTimeoutsTest {
+   /*******************************************************************************
+    ** Connect, read, write and call limits of a client, in milliseconds (0 means no limit).
+    *******************************************************************************/
+   private fun limits(client: OkHttpClient) = listOf(client.connectTimeoutMillis, client.readTimeoutMillis, client.writeTimeoutMillis, client.callTimeoutMillis)
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun theSharedLimitsAreTheDocumentedValues() {
+      assertEquals(10L, NetworkTimeouts.CONNECT_SECONDS)
+      assertEquals(30L, NetworkTimeouts.SMALL_CALL_SECONDS)
+      assertEquals(60L, NetworkTimeouts.PROCESS_STEP_SECONDS)
+      assertEquals(60L, NetworkTimeouts.METADATA_LOAD_SECONDS)
+      assertEquals(5L, NetworkTimeouts.BEST_EFFORT_CALL_SECONDS)
+      assertEquals(NetworkTimeouts.METADATA_LOAD_SECONDS, METADATA_LOAD_TIMEOUT_SECONDS)
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun theHelpersSetConnectReadWriteAndOptionallyTheWholeCall() {
+      assertEquals(listOf(10_000, 30_000, 30_000, 0), limits(OkHttpClient.Builder().slowLinkTimeouts().build()))
+      assertEquals(listOf(10_000, 60_000, 60_000, 0), limits(OkHttpClient.Builder().slowLinkTimeouts(NetworkTimeouts.PROCESS_STEP_SECONDS).build()))
+      assertEquals(listOf(10_000, 30_000, 30_000, 30_000), limits(OkHttpClient.Builder().slowLinkCallTimeouts().build()))
+   }
+
+   /*******************************************************************************
+    ** Version discovery runs before every first request; 5 seconds for the whole call failed start-up on a slow link.
+    *******************************************************************************/
+   @Test
+   fun versionDiscoveryAllowsTheSmallCallLimit() {
+      assertEquals(listOf(10_000, 30_000, 30_000, 30_000), limits(UiApiCompatibility("https://server.example/").client))
+   }
+
+   /*******************************************************************************
+    ** Ordinary calls wait 30 seconds for the server, process init and step 60, the metadata load 60 for the whole call.
+    *******************************************************************************/
+   @Test
+   fun repositoryClientsUseTheSharedLimits() {
+      val origin = "https://server.example/"
+      val repository = NetworkQQQRepository(origin)
+      repository.setEnvironment(Environment("test", origin))
+      val clients = repository.clientsByServer.getValue(origin)
+      assertEquals(listOf(10_000, 30_000, 30_000, 0), limits(clients.standard))
+      assertEquals(listOf(10_000, 60_000, 60_000, 0), limits(clients.process))
+      assertEquals(listOf(10_000, 60_000, 30_000, 60_000), limits(clients.metaData))
+   }
+
+   /*******************************************************************************
+    ** The metadata limit stays a constructor parameter; the other clients do not follow it.
+    *******************************************************************************/
+   @Test
+   fun aCustomMetadataLimitChangesOnlyTheMetadataClient() {
+      val origin = "https://server.example/"
+      val repository = NetworkQQQRepository(origin, metaDataTimeoutMillis = 500)
+      repository.setEnvironment(Environment("test", origin))
+      val clients = repository.clientsByServer.getValue(origin)
+      assertEquals(listOf(10_000, 500, 30_000, 500), limits(clients.metaData))
+      assertEquals(listOf(10_000, 30_000, 30_000, 0), limits(clients.standard))
+      assertEquals(listOf(10_000, 60_000, 60_000, 0), limits(clients.process))
+   }
+}
@@ -0,0 +1,88 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2004-2024.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package com.kingsrook.qqq.frontend.android.core.model.metadata
+
+import kotlinx.serialization.json.Json
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.JsonPrimitive
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/*******************************************************************************
+ ** Current QQQ core serializes widget icons as plain strings and sends
+ ** summary-only help entries; the decoder must accept those shapes and the
+ ** older object/content shapes.
+ *******************************************************************************/
+class MetadataDecodingTest {
+   private val json = Json { ignoreUnknownKeys = true }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun widgetIconAsStringDecodes() {
+      val widget = json.decodeFromString<QWidgetMetaData>("""{"name":"w","type":"table","icon":"troubleshoot"}""")
+      assertEquals(JsonPrimitive("troubleshoot"), widget.icon)
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun widgetIconAsObjectStillDecodes() {
+      val widget = json.decodeFromString<QWidgetMetaData>("""{"name":"w","type":"table","icon":{"name":"troubleshoot"}}""")
+      assertTrue(widget.icon is JsonObject)
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun widgetWithoutIconDecodes() {
+      assertNull(json.decodeFromString<QWidgetMetaData>("""{"name":"w","type":"table"}""").icon)
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun summaryOnlyHelpDecodes() {
+      val help = json.decodeFromString<QHelpContent>("""{"summary":"short help","roles":["ALL_SCREENS"]}""")
+      assertEquals("short help", help.summary)
+      assertNull(help.content)
+      assertNull(help.format)
+   }
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   fun contentHelpStillDecodes() {
+      val help = json.decodeFromString<QHelpContent>("""{"content":"body","format":"TEXT"}""")
+      assertEquals("body", help.content)
+      assertEquals("TEXT", help.format)
+      assertNull(help.summary)
+   }
+}
@@ -30,10 +30,10 @@ plugins {
 publishing {
   repositories {
      maven {
-         name = "githubQqqMavenRegistry"
-         url = uri("https://maven.pkg.github.com/QRun-IO/qqq-maven-registry")
-         // username and password (a personal Github access token) should be specified as
-         // `githubPackagesUsername` and `githubPackagesPassword` Gradle properties
+         // Gitea Maven registry of the repository owner. CI sets giteaMavenUrl, giteaUsername
+         // and giteaPassword (ci-workflows android.yaml, publish-tasks on vX.Y.Z tags).
+         name = "gitea"
+         url = uri(providers.gradleProperty("giteaMavenUrl").getOrElse("https://git.kof22.com/api/packages/QRun-IO/maven"))
         credentials(PasswordCredentials::class)
      }
   }
@@ -132,7 +132,9 @@ class QNavigator(initialController: NavHostController?, val qViewModel: QViewMod
   /*******************************************************************************
    ** Route sign-out through explicit process-exit confirmation so pending work is not silently abandoned.
    *******************************************************************************/
-   fun requestSignOut() = requestLeave("Sign out?", "Sign out", alwaysConfirm = true) { qViewModel.requestLogout() }
+   fun requestSignOut(providerSignOut: com.kingsrook.qqq.frontend.android.mobileapp.ui.authentication.OAuth2LogoutBinding? = null) =
+      if (providerSignOut != null) requestCompanySignOut(providerSignOut)
+      else requestLeave("Sign out?", "Sign out", alwaysConfirm = true) { qViewModel.requestLogout() }

   /*******************************************************************************
    ** The same guarded leave/cancel policy applies to explicitly enabled provider sign-out.
@@ -43,6 +43,13 @@ import kotlin.coroutines.resumeWithException
 *******************************************************************************/
 val LocalOAuth2Discovery = staticCompositionLocalOf<suspend (OAuth2LoginBinding) -> AuthorizationServiceConfiguration> { ::discoverOAuth2 }

+/*******************************************************************************
+ ** Sent with every interactive sign-in next to prompt=login. OIDC max_age=0 independently requires the provider to
+ ** re-authenticate, so a provider session left in the browser cannot silently sign the next person in; the real
+ ** Authentik test showed prompt=login alone reusing retained SSO (docs/AUTHENTICATION.md).
+ *******************************************************************************/
+val OAUTH2_FORCE_REAUTH_PARAMETERS: Map<String, String> = mapOf("max_age" to "0")
+
 /*******************************************************************************
 ** Browser authorization is standard AppAuth; API1.10 exchanges the code and validates the retained original nonce.
 *******************************************************************************/
@@ -93,7 +100,8 @@ fun QOAuth2Login(viewModel: QViewModel, metadata: OAuth2AuthenticationMetaData,
                        val request = AuthorizationRequest.Builder(
                           configuration, binding.clientId, ResponseTypeValues.CODE,
                           Uri.parse(binding.redirectUri)
-                        ).setScope(binding.scopes).setPrompt(binding.prompt).setResponseMode("query").build()
+                        ).setScope(binding.scopes).setPrompt(binding.prompt).setAdditionalParameters(OAUTH2_FORCE_REAUTH_PARAMETERS)
+                           .setResponseMode("query").build()
                        check(request.codeVerifierChallengeMethod == "S256")
                        if (viewModel.beginOAuth2Browser(
                              generation, binding, requireNotNull(request.state),
@@ -24,6 +24,7 @@ import com.kingsrook.qqq.frontend.android.mobileapp.viewmodel.LoadState
 import com.kingsrook.qqq.frontend.android.mobileapp.viewmodel.QViewModel
 import com.kingsrook.qqq.frontend.android.core.model.metadata.authentication.OAuth2AuthenticationMetaData
 import com.kingsrook.qqq.frontend.android.mobileapp.ui.authentication.LocalCompanySignOutEnabled
+import com.kingsrook.qqq.frontend.android.mobileapp.ui.authentication.OAuth2LogoutBinding
 import com.kingsrook.qqq.frontend.android.mobileapp.ui.authentication.oauth2LogoutBinding

 /*******************************************************************************
@@ -34,10 +35,20 @@ val LocalOpenDiagnostics = compositionLocalOf<(() -> Unit)?> { null }
 val LocalBusinessNavigationEnabled = compositionLocalOf { true }

 /*******************************************************************************
- ** Expose account actions while keeping optional company sign-out separate from ordinary local sign-out.
+ ** Expose account actions; sign-out also ends the provider session where the host and server support it.
+ *******************************************************************************/
+/*******************************************************************************
+ ** Sign-out ends the identity-provider session too whenever the host enables it and the server supports it;
+ ** otherwise a session left in the browser silently signs the next sign-in back in. Null means local-only sign-out.
+ *******************************************************************************/
+fun providerSignOutBinding(binding: OAuth2LogoutBinding?, serverSupportsProviderLogout: Boolean): OAuth2LogoutBinding? =
+   if (serverSupportsProviderLogout) binding else null
+
+/*******************************************************************************
+ ** Resolve the provider sign-out binding for the current server, or null when it is disabled or unsupported.
 *******************************************************************************/
@Composable
-internal fun AccountDialog(model: QViewModel, dismiss: () -> Unit) {
+fun rememberProviderSignOutBinding(model: QViewModel): OAuth2LogoutBinding? {
   val companyLogout = if (LocalCompanySignOutEnabled.current)
      ((model.authenticationMetaDataLoadState as? LoadState.Success)?.value as? OAuth2AuthenticationMetaData)?.let {
         oauth2LogoutBinding(it, model.environment.baseUrl, LocalContext.current.packageName)
@@ -53,6 +64,12 @@ internal fun AccountDialog(model: QViewModel, dismiss: () -> Unit) {
         supportsCompanyLogout = false
      }
   }
+   return providerSignOutBinding(companyLogout, supportsCompanyLogout)
+}
+
+@Composable
+internal fun AccountDialog(model: QViewModel, dismiss: () -> Unit) {
+   val providerSignOut = rememberProviderSignOutBinding(model)
   AlertDialog(
      onDismissRequest = dismiss, title = { Text("Account", Modifier.testTag("accountDialog.title")) },
      text = {
@@ -60,13 +77,8 @@ internal fun AccountDialog(model: QViewModel, dismiss: () -> Unit) {
            Text(if (model.isAuthenticated) "Current User:  ${model.sessionUserFullName}" else "Not currently logged in")
            TextButton(enabled = model.isAuthenticated && !model.isLogoutRequested, onClick = {
               dismiss()
-               model.qNavigator.requestSignOut()
+               model.qNavigator.requestSignOut(providerSignOut)
            }) { Text("Sign out") }
-            if (companyLogout != null && supportsCompanyLogout)
-               TextButton(enabled = model.isAuthenticated && !model.isLogoutRequested, onClick = {
-                  dismiss()
-                  model.qNavigator.requestCompanySignOut(companyLogout)
-               }) { Text("Sign out of company") }
         }
      }, confirmButton = { TextButton(onClick = dismiss) { Text("Close") } })
 }
@@ -128,7 +128,7 @@ fun ProcessComponentEditForm(processViewModel: ProcessViewModel, component: QFro
               OutlinedButton(onClick = { processViewModel.loadRemoteOptions(field) }) { Text("Retry choices") }
            }
            semanticFieldHint(field)?.let { Text(it) }
-            field.helpContents.orEmpty().forEach { Text(it.contentAsText ?: plainText(it.content)) }
+            field.helpContents.orEmpty().forEach { Text(it.contentAsText ?: it.content?.let { c -> plainText(c) } ?: it.summary.orEmpty()) }
         }
      }
   }
@@ -13,7 +13,9 @@ import com.kingsrook.qqq.frontend.android.core.model.metadata.authentication.OAu
 import com.kingsrook.qqq.frontend.android.core.model.processes.ProcessStepResult
 import com.kingsrook.qqq.frontend.android.mobileapp.container.QAppContainer
 import com.kingsrook.qqq.frontend.android.mobileapp.data.MockPreferencesDataStore
+import com.kingsrook.qqq.frontend.android.mobileapp.ui.authentication.OAUTH2_FORCE_REAUTH_PARAMETERS
 import com.kingsrook.qqq.frontend.android.mobileapp.ui.authentication.OAuth2LoginBinding
+import com.kingsrook.qqq.frontend.android.mobileapp.ui.horseshoe.providerSignOutBinding
 import com.kingsrook.qqq.frontend.android.mobileapp.ui.authentication.OAuth2LogoutBinding
 import com.kingsrook.qqq.frontend.android.mobileapp.ui.authentication.OAuth2LogoutPhase
 import kotlinx.coroutines.Dispatchers
@@ -145,12 +147,60 @@ class QViewModelLogoutTest {
      assertNull(json.decodeFromString<ManageSessionResponse>("""{"uuid":"s","values":{"user":{"name":"  "}}}""").userName)
   }

+   /*******************************************************************************
+    ** After sign-out (ordinary or provider) a restarted app finds no stored session and does not resume one.
+    *******************************************************************************/
+   @Test
+   fun restartAfterSignOutDoesNotRestoreTheSession() = runTest()
+   {
+      Dispatchers.setMain(StandardTestDispatcher(testScheduler))
+      try {
+         for (provider in listOf(false, true)) {
+            val store = MockPreferencesDataStore()
+            val repository = LogoutRepository()
+            val model = signedInModel(repository, store)
+            assertEquals("session-1", store.preferences[com.kingsrook.qqq.frontend.android.mobileapp.data.SESSION_UUID_KEY])
+            if (provider) assertNotNull(companyLogout(model))
+            else { model.requestLogout(); model.logOut().join() }
+            assertNull(store.preferences[com.kingsrook.qqq.frontend.android.mobileapp.data.SESSION_UUID_KEY]?.takeIf { it.isNotEmpty() })
+            val restartedRepository = LogoutRepository()
+            val restarted = QViewModel(restartedRepository, store)
+            advanceUntilIdle()
+            assertFalse(restarted.isAuthenticated)
+            assertEquals("", restarted.sessionUUID)
+            assertEquals(0, restartedRepository.metaDataCalls)
+         }
+      } finally {
+         Dispatchers.resetMain()
+      }
+   }
+
+   /*******************************************************************************
+    ** Sign-out reaches the identity provider whenever the server supports it, never silently local-only.
+    *******************************************************************************/
+   @Test
+   fun signOutUsesProviderLogoutWhenSupported() {
+      val binding = OAuth2LogoutBinding(loginBinding, REDIRECT)
+      assertEquals(binding, providerSignOutBinding(binding, true))
+      assertNull(providerSignOutBinding(binding, false))
+      assertNull(providerSignOutBinding(null, true))
+   }
+
+   /*******************************************************************************
+    ** Every interactive sign-in forces re-authentication, so a lingering provider session cannot sign the next user in.
+    *******************************************************************************/
+   @Test
+   fun authorizationRequestForcesReauthentication() {
+      assertEquals(mapOf("max_age" to "0"), OAUTH2_FORCE_REAUTH_PARAMETERS)
+      assertEquals("login", loginBinding.prompt)
+   }
+
   /*******************************************************************************
    ** Complete a native browser login against the fake repository so sign-out tests start authenticated.
    *******************************************************************************/
-   private fun TestScope.signedInModel(repository: LogoutRepository): QViewModel {
+   private fun TestScope.signedInModel(repository: LogoutRepository, store: MockPreferencesDataStore = MockPreferencesDataStore()): QViewModel {
      QAppContainer.availableEnvironments = listOf(Environment("Test", SERVER))
-      val model = QViewModel(repository, MockPreferencesDataStore())
+      val model = QViewModel(repository, store)
      advanceUntilIdle()
      val generation = requireNotNull(model.prepareOAuth2Login(loginBinding))
      assertTrue(model.beginOAuth2Browser(generation, loginBinding, STATE, NONCE, VERIFIER))
@@ -182,6 +232,7 @@ class QViewModelLogoutTest {
   private class LogoutRepository : QQQRepository {
      val calls = mutableListOf<String>()
      var activeSession = ""
+      var metaDataCalls = 0

      override suspend fun getAuthenticationMetaData(): BaseAuthenticationMetaData = OAuth2AuthenticationMetaData(
         "oauth", values = OAuth2AuthenticationMetaData.Values(
@@ -214,7 +265,7 @@ class QViewModelLogoutTest {

      override fun setEnvironment(environment: Environment) {}
      override suspend fun manageSession(body: ManageSessionRequest): ManageSessionResponse = error("Not used")
-      override suspend fun getMetaData(frontendName: String, frontendVersion: String, applicationName: String, applicationVersion: String): QInstance = QInstance()
+      override suspend fun getMetaData(frontendName: String, frontendVersion: String, applicationName: String, applicationVersion: String): QInstance { metaDataCalls++; return QInstance() }
      override suspend fun getProcessMetaData(processName: String): QProcessMetaData = error("Not used")
      override suspend fun processInit(processName: String, values: Map<String, Any?>, recordsParam: String?, recordIds: String?, filterJSON: String?, stepTimeoutMillis: Int?): ProcessStepResult = error("Not used")
      override suspend fun processStep(processName: String, processUUID: String, stepName: String, values: Map<String, Any?>, stepTimeoutMillis: Int?): ProcessStepResult = error("Not used")
@@ -9,6 +9,7 @@ import android.os.Build
 import com.kingsrook.qqq.frontend.android.core.controllers.RequestOutcome
 import com.kingsrook.qqq.frontend.android.core.controllers.RequestOutcomeInterceptor
 import com.kingsrook.qqq.frontend.android.core.controllers.SameOriginInterceptor
+import com.kingsrook.qqq.frontend.android.core.controllers.slowLinkTimeouts
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.withContext
 import okhttp3.MediaType.Companion.toMediaType
@@ -22,6 +23,12 @@ import org.json.JSONObject
 *******************************************************************************/
 class EnrollmentConflict : IllegalStateException("Registration already exists but its credentials were not received. Start a new registration and ask the administrator to approve it.")

+/*******************************************************************************
+ ** Device enrollment and status client: small calls with the shared slow-link limits and, as before, no call timeout.
+ *******************************************************************************/
+internal fun deviceApiClient(onRequestOutcome: (RequestOutcome) -> Unit): OkHttpClient = OkHttpClient.Builder().followRedirects(false).followSslRedirects(false)
+   .slowLinkTimeouts().addInterceptor(RequestOutcomeInterceptor(onRequestOutcome)).addInterceptor(SameOriginInterceptor()).build()
+
 /*******************************************************************************
 ** The native QQQ session also authenticates device management.
 *******************************************************************************/
@@ -33,8 +40,7 @@ class DeviceApi(
      private set
   var displayName: String = ""
      private set
-   private val client = OkHttpClient.Builder().followRedirects(false).followSslRedirects(false)
-      .addInterceptor(RequestOutcomeInterceptor(onRequestOutcome)).addInterceptor(SameOriginInterceptor()).build()
+   private val client = deviceApiClient(onRequestOutcome)

   /*******************************************************************************
    ** Check enrollment on demand; approval remains a server-side decision.
@@ -4,10 +4,10 @@ package io.qrun.mobile.scanner
 import com.kingsrook.qqq.frontend.android.core.controllers.UiApiCompatibility
 import com.kingsrook.qqq.frontend.android.core.controllers.MOBILE_SCANNERS_PATH
 import com.kingsrook.qqq.frontend.android.core.controllers.ANDROID_CLIENT
+import com.kingsrook.qqq.frontend.android.core.controllers.slowLinkCallTimeouts
 import java.net.URI
 import java.time.Instant
 import java.util.ArrayDeque
-import java.util.concurrent.TimeUnit
 import kotlin.math.pow
 import kotlinx.coroutines.CancellationException
 import kotlinx.coroutines.Dispatchers
@@ -137,8 +137,8 @@ internal class HostRuntime(private val server: String, val diagnostics: Diagnost
    *******************************************************************************/
   suspend fun verifyCompatibility() = withContext(Dispatchers.IO) { compatibility.verify() }

-   private val client = OkHttpClient.Builder().followRedirects(false).followSslRedirects(false)
-      .callTimeout(5, TimeUnit.SECONDS).build()
+   internal val client = OkHttpClient.Builder().followRedirects(false).followSslRedirects(false)
+      .slowLinkCallTimeouts().build()

   /*******************************************************************************
    ** Bound presentation responses and record safe outcomes while preserving coroutine cancellation.
@@ -3,11 +3,13 @@ package io.qrun.mobile.scanner

 import com.kingsrook.qqq.frontend.android.core.controllers.ANDROID_CLIENT
 import com.kingsrook.qqq.frontend.android.core.controllers.MOBILE_SCANNERS_PATH
+import com.kingsrook.qqq.frontend.android.core.controllers.NetworkTimeouts
 import com.kingsrook.qqq.frontend.android.core.controllers.RequestOutcome
 import com.kingsrook.qqq.frontend.android.core.controllers.RequestOutcomeInterceptor
 import com.kingsrook.qqq.frontend.android.core.controllers.SameOriginInterceptor
 import com.kingsrook.qqq.frontend.android.core.controllers.UiApiCompatibility
 import com.kingsrook.qqq.frontend.android.core.controllers.UiApiException
+import com.kingsrook.qqq.frontend.android.core.controllers.slowLinkCallTimeouts
 import android.os.Build
 import java.io.IOException
 import java.util.concurrent.TimeUnit
@@ -62,8 +64,13 @@ internal class MobileSessionApi(
      fun installedVersions(): Map<String, String?> = mapOf("osVersion" to Build.VERSION.RELEASE, "appVersion" to BuildConfig.VERSION_NAME)
   }

-   private val client = OkHttpClient.Builder().followRedirects(false).followSslRedirects(false)
-      .callTimeout(5, TimeUnit.SECONDS).addInterceptor(RequestOutcomeInterceptor(onOutcome)).addInterceptor(SameOriginInterceptor()).build()
+   // Heartbeats report the device as online; a 5 second limit abandoned any heartbeat a slow link needed longer to deliver.
+   internal val heartbeatClient = OkHttpClient.Builder().followRedirects(false).followSslRedirects(false)
+      .slowLinkCallTimeouts().addInterceptor(RequestOutcomeInterceptor(onOutcome)).addInterceptor(SameOriginInterceptor()).build()
+
+   // Ending the session and live screen frames stay short (see NetworkTimeouts.BEST_EFFORT_CALL_SECONDS).
+   internal val bestEffortClient = heartbeatClient.newBuilder()
+      .callTimeout(NetworkTimeouts.BEST_EFFORT_CALL_SECONDS, TimeUnit.SECONDS).build()

   /*******************************************************************************
    ** Send the current eligible session metadata and accept only the server's bounded lease policy.
@@ -87,7 +94,7 @@ internal class MobileSessionApi(
         "stepName" to state.stepName, "screenLabel" to state.label, "captureBlockedReason" to state.blockedReason
      )
         .forEach { (name, value) -> json.put(name, value ?: JSONObject.NULL) }
-      return SessionHeartbeat.parse(post(session, "/sessions/heartbeat", json, 200))
+      return SessionHeartbeat.parse(post(session, "/sessions/heartbeat", json, 200, heartbeatClient))
   }

   /*******************************************************************************
@@ -112,7 +119,7 @@ internal class MobileSessionApi(
   /*******************************************************************************
    ** Verify compatibility and close bounded responses while connecting coroutine cancellation to the HTTP call.
    *******************************************************************************/
-   private suspend fun post(session: String, path: String, body: JSONObject, expected: Int): String = withContext(Dispatchers.IO)
+   private suspend fun post(session: String, path: String, body: JSONObject, expected: Int, client: OkHttpClient = bestEffortClient): String = withContext(Dispatchers.IO)
   {
      require(session.isNotBlank())
      require(compatibility.server == server)
@@ -30,6 +30,7 @@ import androidx.compose.material3.TextButton
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.CompositionLocalProvider
 import com.kingsrook.qqq.frontend.android.mobileapp.ui.authentication.LocalCompanySignOutEnabled
+import com.kingsrook.qqq.frontend.android.mobileapp.ui.horseshoe.rememberProviderSignOutBinding
 import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.key
 import androidx.compose.runtime.SideEffect
@@ -405,6 +406,7 @@ private fun DeviceGate(
   viewModel: QViewModel, api: DeviceApi, credentials: DeviceCredentials, onApproval: (Boolean) -> Unit,
   content: @Composable () -> Unit
 ) {
+   val providerSignOut = rememberProviderSignOutBinding(viewModel)
   var attempt by remember { mutableIntStateOf(0) }
   var status by remember(viewModel.sessionUUID) { mutableStateOf("CHECKING") }
   var error by remember { mutableStateOf("") }
@@ -444,6 +446,6 @@ private fun DeviceGate(
      Text("Your administrator can edit this device’s name, short name and description in QQQ before approval.")
      Button(enabled = status != "CHECKING", onClick = { attempt++ }) { Text("Check approval") }
      if (enrollmentConflict) Button(onClick = { credentials.restartPendingEnrollment(); attempt++ }) { Text("Start new registration") }
-      Button(onClick = { viewModel.qNavigator.requestSignOut() }) { Text("Sign out") }
+      Button(onClick = { viewModel.qNavigator.requestSignOut(providerSignOut) }) { Text("Sign out") }
   }
 }
@@ -0,0 +1,47 @@
+/* Copyright (c) 2026 QRunIO. SPDX-License-Identifier: Apache-2.0 */
+package io.qrun.mobile.scanner
+
+import com.kingsrook.qqq.frontend.android.core.controllers.NetworkTimeouts
+import com.kingsrook.qqq.frontend.android.core.controllers.UiApiCompatibility
+import okhttp3.OkHttpClient
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+/*******************************************************************************
+ ** The scanner host's own HTTP clients use the shared slow-link limits instead of 5 second call limits.
+ *******************************************************************************/
+class SlowLinkTimeoutsTest {
+   private val server = "https://server.example/"
+
+   /*******************************************************************************
+    ** Connect, read, write and call limits of a client, in milliseconds (0 means no limit).
+    *******************************************************************************/
+   private fun limits(client: OkHttpClient) = listOf(client.connectTimeoutMillis, client.readTimeoutMillis, client.writeTimeoutMillis, client.callTimeoutMillis)
+
+   /*******************************************************************************
+    ** Branding, logo and the reachability check.
+    *******************************************************************************/
+   @Test
+   fun brandingLogoAndReachabilityAllowTheSmallCallLimit() {
+      assertEquals(listOf(10_000, 30_000, 30_000, 30_000), limits(HostRuntime(server).client))
+   }
+
+   /*******************************************************************************
+    ** Device enrollment and status had OkHttp's 10 second defaults and no call limit.
+    *******************************************************************************/
+   @Test
+   fun deviceEnrollmentAndStatusAllowTheSmallCallLimitWithoutACallLimit() {
+      assertEquals(listOf(10_000, 30_000, 30_000, 0), limits(deviceApiClient {}))
+   }
+
+   /*******************************************************************************
+    ** Only the heartbeat gets the longer limit; ending the session and screen frames must not hold the operator.
+    *******************************************************************************/
+   @Test
+   fun heartbeatAllowsTheSmallCallLimitWhileSessionEndAndFramesStayShort() {
+      val api = MobileSessionApi(server, { emptyMap() }, UiApiCompatibility(server, true), deviceInfo = emptyMap())
+      assertEquals(listOf(10_000, 30_000, 30_000, 30_000), limits(api.heartbeatClient))
+      assertEquals(listOf(10_000, 30_000, 30_000, 5_000), limits(api.bestEffortClient))
+      assertEquals(5L, NetworkTimeouts.BEST_EFFORT_CALL_SECONDS)
+   }
+}
@@ -5,4 +5,4 @@ const args = process.argv.slice(2);
 if (args.length !== 4 || args[0] !== '--serial' || args[2] !== '--fixture' || !args[1] || !args[3]) {
   throw new Error('Usage: node scripts/ci/scanner-device-record-photo-e2e.mjs --serial DEVICE_SERIAL --fixture PRIVATE_RECORD_FILES_FIXTURE.json');
 }
-await runScannerE2e({ physical: true, serial: args[1], scenario: 'record-photos', fixture: args[3] });
+await runScannerE2e({ physical: true, serial: args[1], scenario: 'record-photos', fixture: args[3] });
Author	SHA1	Message	Date
james.maesandClaude Fable 5.2	b1912cf59c	fix(network): raise the remaining short limits for slow links (1.0.5, versionCode 7) android / android (push) Failing after 4m1s Details build / android (push) Failing after 4m1s Details 1.0.4 gave the metadata load 60 seconds. Every other call still had a 5 second call limit or OkHttp's 10 second defaults, so a slow warehouse link could still fail start-up, enrollment or a process step. All limits now come from one set, NetworkTimeouts: - connect 10 s (unchanged value, now named) - small calls 30 s: version discovery, branding, logo, reachability and the session heartbeat (were a 5 s call limit); device enrollment and status, sign-in, table and process-status calls (were a 10 s read) - process init and step 60 s read and write, no call limit as before - metadata load 60 s (unchanged) - best-effort calls 5 s (unchanged): ending the device session and live screen frames, so sign-out, Change server and screen viewing never wait on a dead link Not changed: the 3 s bounds around sign-out and the 30 s photo transfer limit. Tests assert the configured limits of every client (NetworkTimeoutsTest, SlowLinkTimeoutsTest); the test that pinned the 10 s default now expects an ordinary call to survive a 12 s answer. Docs: CHANGELOG 1.0.5 candidate; RELEASING, INSTALLATION, SESSION-STATE and TODO record the published 1.0.4 and the 1.0.5 release steps. Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>	2026-11-09 19:35:59 -06:00
james.maes	9bae976138	Merge pull request 'fix(auth): end the identity-provider session on sign-out and force re-authentication on sign-in' (#27 ) from fix/signout-idp-session into main android / android (push) Failing after 3m53s Details build / android (push) Failing after 3m53s Details	2026-11-09 20:10:27 +00:00
james.maesandClaude Sonnet 5.5	b87171cafc	fix(auth): end the identity-provider session on sign-out and force re-authentication on sign-in android / android (push) Failing after 3m53s Details build / android (push) Failing after 3m53s Details Ordinary Sign out cleared only the QQQ session; the provider session left in the browser silently signed the same person back in (prompt=login alone was already observed reusing retained SSO on real Authentik). Sign out now runs the provider end-session flow when the server supports it, and every sign-in also sends max_age=0. Stored-session restore after sign-out was checked: not a cause. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-09 14:10:00 -06:00
james.maes	3b15183f52	Merge pull request 'fix(core): allow 60 s for the metadata load and name the URL on timeout' (#26 ) from fix/metadata-load-timeout into main android / android (push) Failing after 3m47s Details build / android (push) Failing after 3m47s Details	2026-11-09 20:01:50 +00:00
james.maes	b165dd34a8	Merge pull request 'fix(android): accept string widget icons and summary-only help content' (#24 ) from fix/widget-icon-string-main into main android / android (push) Failing after 3m28s Details build / android (push) Failing after 3m28s Details	2026-11-09 20:01:24 +00:00
james.maesandClaude Sonnet 5.5	4467d8ec64	fix(core): allow 60 s for the metadata load and name the URL on timeout android / android (push) Successful in 15m7s Details build / android (push) Successful in 15m7s Details GET /qqq/v1/metaData returns about 1.7 MB and takes the server 4 to 8 s to build; the default 10 s read timeout surfaced as 'Error loading QInstance: timeout' on handhelds. Only the metadata call gets the long limit. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-09 14:01:07 -06:00
james.maesandClaude Sonnet 5.5	9208416fa4	test(android): cover string widget icons and summary-only help decoding android / android (push) Failing after 3m21s Details build / android (push) Failing after 3m21s Details Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-09 07:20:39 -06:00
james.maesandClaude Sonnet 5.5	778ac58612	fix(android): accept string widget icons and summary-only help content from current QQQ core android / android (push) Failing after 3m27s Details build / android (push) Failing after 3m27s Details Core serializes QWidgetMetaData.icon as a string and QHelpContent may carry only a summary; the strict models failed loading the whole instance and echoPrint. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-09 06:19:19 -06:00
james.maes	e8b6be00e8	Merge pull request 'fix: restore main (revert commit that deleted the whole tree)' (#23 ) from fix/restore-main-tree into main android / android (push) Failing after 3m29s Details build / android (push) Failing after 3m29s Details	2026-11-09 12:19:07 +00:00
james.maesandClaude Sonnet 5.5	089f57f759	Revert "ci: first run on ci-workflows v1 (native workflows)" android / android (push) Failing after 3m29s Details build / android (push) Failing after 3m29s Details Commit `1d3847d` deleted the entire tree (2584 files) and added nothing, so main was empty. This restores main to `dc43a6a` (the PR 22 merge) exactly. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-09 06:18:45 -06:00
James MaesandClaude Opus 5.5	1d3847d070	ci: first run on ci-workflows v1 (native workflows) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-08 08:26:19 -06:00
james.maes	dc43a6a747	Merge pull request 'ci: build on the shared ci-workflows Android workflow' (#22 ) from ci/shared-android into main	2026-11-08 13:52:39 +00:00
James MaesandClaude Opus 5.5	21c952ea81	ci: pin the shared workflow to v1 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-08 07:52:19 -06:00
James MaesandClaude Opus 5.5	3bfafa5bac	ci: call the shared workflow from ci-workflows main android / android (push) Successful in 7m2s Details build / android (push) Successful in 7m2s Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-08 07:45:02 -06:00
James MaesandClaude Opus 5.5	8e64d9a83c	style: add the missing final newline (K22-CODE-07) android / android (push) Successful in 6m38s Details build / android (push) Successful in 6m38s Details The source-standards check flags scanner-device-record-photo-e2e.mjs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-08 07:28:48 -06:00
James MaesandClaude Opus 5.5	af38def2d2	ci: build on the shared ci-workflows Android workflow android / android (push) Failing after 16s Details build / android (push) Failing after 16s Details Source checks, JVM unit tests, scanner lint, debug and QA APK assembly and connected emulator tests run on every push via ci-workflows android.yaml. vX.Y.Z tags publish the SDK AARs to the QRun-IO Gitea Maven registry. Removes the retired CircleCI/qqq-orb configuration and the legacy GitHub workflows. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-08 07:28:03 -06:00
james.maes	f739a96f7a	Merge pull request 'ci: remove workflows that call the retired CI system' (#21 ) from retire/old-ci into main	2026-11-07 13:29:37 +00:00
james.maesandClaude Opus 5.5	a2f8f2b5fd	ci: remove workflows that call the retired CI system Owner decision 2026-11-07: only KofTwentyTwo/ci-workflows remains. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 13:29:36 +00:00
james.maes	5ddd5a3317	Merge pull request 'release(scanner): 1.0.2 (versionCode 4) notes and build instructions' (#20 ) from release/scanner-1.0.2-notes into main QRun-IO/ci-policy: ci / fork-guard (push) Skipped Details QRun-IO/ci-policy: native / fork-deny (push) Skipped Details QRun-IO/ci-policy: native / dotnet-0 (push) Skipped Details QRun-IO/ci-policy: ci / Scoped workflow [workflow 9cb8c13124a99d18da83cbcd4faa795859ac9e55] (push) Successful in 5s Details QRun-IO/ci-policy: native / native-result (push) Successful in 4s Details QRun-IO/ci-policy: ci / head-profile (push) Skipped Details QRun-IO/ci-policy: ci / repository-policy (push) Skipped Details QRun-IO/ci-policy: ci / application-template-0 (push) Skipped Details QRun-IO/ci-policy: ci / gradle-1 (push) Skipped Details QRun-IO/ci-policy: ci / java-core-2-head (push) Skipped Details QRun-IO/ci-policy: ci / java-docker-3 (push) Skipped Details QRun-IO/ci-policy: ci / java-docker-3-head (push) Skipped Details QRun-IO/ci-policy: ci / java-docker-4 (push) Skipped Details QRun-IO/ci-policy: ci / java-frontend-browser-5 (push) Skipped Details QRun-IO/ci-policy: ci / java-maven-6 (push) Skipped Details QRun-IO/ci-policy: ci / java-maven-6-head (push) Skipped Details QRun-IO/ci-policy: ci / java-maven-7 (push) Skipped Details QRun-IO/ci-policy: ci / java-maven-7-head (push) Skipped Details QRun-IO/ci-policy: ci / node-8 (push) Skipped Details QRun-IO/ci-policy: ci / node-9 (push) Skipped Details QRun-IO/ci-policy: ci / node-10 (push) Skipped Details QRun-IO/ci-policy: ci / node-playwright-11 (push) Skipped Details QRun-IO/ci-policy: ci / repository-policy-12 (push) Skipped Details QRun-IO/ci-policy: ci / source-config-13 (push) Skipped Details QRun-IO/ci-policy: ci / source-config-14 (push) Skipped Details QRun-IO/ci-policy: ci / original-business (push) Skipped Details QRun-IO/ci-policy: ci / original-mcp (push) Skipped Details QRun-IO/ci-policy: ci / original-voyage (push) Skipped Details QRun-IO/ci-policy: ci / original-cli (push) Skipped Details QRun-IO/ci-policy: ci / not-enrolled (push) Skipped Details QRun-IO/ci-policy: ci / shared-pipeline (push) Skipped Details Shared Android CI / unit-test (push) Successful in 4m7s Details Shared Android CI / android-test (push) Successful in 9m44s Details Shared Android CI / secrets (push) Successful in 19s Details QRun-IO/ci-policy: Shared Android CI / unit-test (push) Successful in 4m10s Details QRun-IO/ci-policy: Shared Android CI / android-test (push) Successful in 9m48s Details QRun-IO/ci-policy: Shared Android CI / secrets (push) Successful in 20s Details Shared Android CI / package (push) Successful in 3m49s Details QRun-IO/ci-policy: Shared Android CI / package (push) Successful in 3m40s Details Shared Android CI / gate (push) Successful in 14s Details QRun Android lifecycle / release (push) Successful in 36m17s Details QRun-IO/ci-policy: Shared Android CI / gate (push) Successful in 14s Details QRun-IO/ci-policy: ci / android-0 (push) Successful in 22m19s Details QRun-IO/ci-policy: ci / ci-result (push) Successful in 4s Details	2026-11-07 01:32:24 +00:00