# Installing QQQ Mobile 1.0.2 (versionCode 4)

> **STATUS: PENDING CANDIDATE. Not a published or stable release. Not yet device-requalified.**
> Signed candidate for controlled signed-APK / MDM distribution. Qualification is incomplete (see [RELEASE-NOTES.md](RELEASE-NOTES.md)). No public download URL exists; use only the file your release owner gives you.

Canonical guides (source of truth where they differ; forge sign-in required):
[INSTALLATION.md](https://git.kof22.com/QRun-IO/qqq-android/src/branch/main/docs/INSTALLATION.md),
[RELEASING.md](https://git.kof22.com/QRun-IO/qqq-android/src/branch/main/docs/RELEASING.md),
[ZEBRA-SCANNING.md](https://git.kof22.com/QRun-IO/qqq-android/src/branch/main/docs/ZEBRA-SCANNING.md).

## Package identity

| Item | Value |
| --- | --- |
| Application ID | `io.qrun.mobile.scanner` |
| Version | 1.0.2, versionCode 4 (min Android 8.0 / API 26) |
| File | `QQQ-Mobile-1.0.2.apk` (15015419 bytes) |
| APK SHA-256 | `8119492239F7D87264B3F48B0B6BF2E7F259942EED1978DEA1D2AB57A9B104F0` |
| Signing certificate SHA-256 | `BDDB2D2F45A5925C643A83ABAF616C1EAB2387DC5CDA7B645A6F4C0D5B17A9FF` |
| Source | `main` at `eeb9f63322c11fddfd81f770e35808c7ff95ca32` |

## 1. Verify before installing

Both checks are required; stop and do not install if either differs.

1. **Checksum:** the file's SHA-256 matches the value above and `SHA256SUMS`. This shows integrity only, not who signed it.
2. **Signer:** `apksigner verify --print-certs` shows one signer whose SHA-256 equals the certificate value above. This is what permits in-place updates.

## 2. Requirements

- Wi-Fi, and your customer's **HTTPS** QQQ server address with a certificate the device already trusts. Release builds reject plain HTTP; never bypass TLS checks.
- Credentials for the sign-in the server offers.

## 3. First install

Open the verified APK from **Files** (allow installs from that app if asked), or push it through MDM as a private app. Over USB, always name the device and never use `-d` or `-t`:

```
adb -s <DEVICE_SERIAL> install QQQ-Mobile-1.0.2.apk
```

## 4. Update in place

A device running a QRun-signed build with a lower versionCode (1.0.1, code 3, or 1.0.0, code 2) updates over it, keeping login and enrollment. Do not uninstall first.

```
adb -s <DEVICE_SERIAL> install -r QQQ-Mobile-1.0.2.apk
```

### Development-signed installs (explicit migration)

A development-signed (debug/demo) install has a different signer, so Android refuses this APK. That is expected. Moving such a device is an explicit, owner-approved one-time migration that **resets app settings, login and device enrollment**; the device must enroll and be approved again. Never do it silently, and do not uninstall or reset a device to work around the refusal without that approval.

## 5. First launch

1. Open **QQQ Mobile** (portrait by default; changeable in Settings, or MDM `qqq_orientation`).
2. Enter the HTTPS server address and tap **Connect**; the app checks API and extension compatibility first.
3. Sign in with the method the server advertises. After browser (OAuth) sign-in the signed-in user's name is shown.
4. The device shows a **Device ID** with status *pending*. A QQQ administrator approves it; then tap **Check approval**.
5. Choose the server's mobile app from **Apps**.

## 6. Scanning and records

On Zebra EMDK devices (TC22, MC9400) the hardware scanner is held only while a scan screen is foregrounded; no DataWedge profile is needed. Each scan goes to the server as the raw barcode with symbology and AIM identifier; the server decides its meaning. Wait for **Saved scan** before the next scan; use **Retry same request** if unsure. Other devices use manual entry. Record browsing and photo actions use Android's system camera and photo picker (no app `CAMERA` permission). Location reporting is optional. See ZEBRA-SCANNING.md.

The app and OS version are reported on every session heartbeat; servers with `mobile-scanners` 1.6.0+ show them on scan receipts after an in-place update.

## 7. Navigation

**Apps** lists the server's mobile apps; Back returns to Apps. **Settings** (opened from the navigation drawer) holds server and device details, orientation, location reporting, licenses and **About**. **Sign out** is in the **Account** dialog (account icon in the top bar) and on the pending-approval screen, and asks for confirmation. For a company (browser) sign-in, sign-out now runs the provider logout before the device session ends, so the browser end-session page opens. The connection footer opens **Diagnostics**.

## 8. Confirm a new device

Footer shows **Connected**; one scan reaches **Saved scan**; sign-out and sign-in work. Native browser sign-in with this production APK, and the 1.0.2 sign-out fix on a device, are not yet qualified (see release notes).