From 9405e00baa6ee8eec77a1aed03a7ef731c2a232f Mon Sep 17 00:00:00 2001
From: SimpleTest <simpletestxxx@gmail.com>
Date: Sat, 8 Aug 2026 19:05:20 +0300
Subject: [PATCH] Fix Android App Link verification intent

---
 docs/verification.md                     | 9 +++++++++
 scripts/quality.sh                       | 5 +++++
 scripts/verify-play-installed-android.sh | 1 +
 3 files changed, 15 insertions(+)

diff --git a/docs/verification.md b/docs/verification.md
index 9cbe169..6d1a37e 100644
--- a/docs/verification.md
+++ b/docs/verification.md
@@ -2096,6 +2096,15 @@ promoted.
   certificate, with `whoneedhelp.com` in Android's verified domain state. Its
   installer is absent, so this is explicitly a sideloaded-build observation
   and not Play-delivered evidence.
+- A read-only installed-build verifier now requires the exact expected version,
+  `com.android.vending` installer, a supplied Play App Signing SHA-256 identity,
+  verified `whoneedhelp.com` domain state, and production App Link resolution to
+  `MainActivity`. The physical device confirmed that Android resolves the link
+  to `MainActivity` when both the `DEFAULT` and `BROWSABLE` intent categories
+  are supplied. A regression gate rejects an incomplete category set,
+  sideloaded installer, upload-only certificate, unverified domain, or browser
+  resolution. The current sideloaded package therefore intentionally cannot
+  satisfy the Play-delivery gate.
 - The already-authenticated Chrome dev-port instance exposed two Play Console
   pages, including the Who Need Help internal-release preparation page.
   Playwright connected to its DevTools WebSocket but could not import the 94
diff --git a/scripts/quality.sh b/scripts/quality.sh
index 5331e62..027f10d 100755
--- a/scripts/quality.sh
+++ b/scripts/quality.sh
@@ -564,6 +564,11 @@ REPORT
 REPORT
     ;;
   "shell cmd package")
+    if [[ " $* " != *" -c android.intent.category.DEFAULT "* ]] ||
+      [[ " $* " != *" -c android.intent.category.BROWSABLE "* ]]; then
+      echo "App Link resolution omitted a required intent category." >&2
+      exit 1
+    fi
     printf '%s\n' "${FAKE_PLAY_ACTIVITY:-org.whoneedhelp.mobile/.MainActivity}"
     ;;
   *)
diff --git a/scripts/verify-play-installed-android.sh b/scripts/verify-play-installed-android.sh
index 6d69dd6..abecd6b 100755
--- a/scripts/verify-play-installed-android.sh
+++ b/scripts/verify-play-installed-android.sh
@@ -167,6 +167,7 @@ fi
 resolved_activity=$(
   adb_device shell cmd package resolve-activity --brief \
     -a android.intent.action.VIEW \
+    -c android.intent.category.DEFAULT \
     -c android.intent.category.BROWSABLE \
     -d "$app_link_url" |
     tr -d '\r'