@@ -92,9 +92,19 @@ The hosting `WebView` is configured with:
 - `setDomStorageEnabled(false)` — no localStorage / IndexedDB inside
   the prover sandbox
 
-The WebView runs in its own renderer process
-(`android:process=":prover"` in the manifest) so a renderer
-compromise does not give the attacker the rest of the app.
+**Process isolation — DEFERRED to W4+.** The W3 build hosts the
+WebView inline in the main activity's process (see
+[`WebViewMobileProver.kt`](../android/app/src/main/java/dev/zeroauth/android/prover/WebViewMobileProver.kt)
+class doc). Moving the WebView into its own
+`android:process=":prover"` activity requires a Messenger or AIDL
+binder layer between MainActivity and the prover process, which is
+its own day-of-work. The deferred state is documented inline in
+[`AndroidManifest.xml`](../android/app/src/main/AndroidManifest.xml)
+and acknowledged by threat-model row
+[A-17](../docs/threat_model.md). For the W3 demo the WebView's CSP +
+asset hash-pinning + Android process sandboxing carry the
+defense-in-depth; the dedicated `:prover` process is the next-class
+upgrade.
 
 ### Build-time integrity gate
 
 
@@ -16,12 +16,15 @@
                 unlock paths (BiometricGate is stubbed for now).
 
   Components:
-    * .MainActivity  — single-activity host, Compose root.
-    * .prover.ProverActivity  (NOT YET PRESENT) — will run in
-                android:process=":prover" per ADR-0010 once the
-                WebView snarkjs bundle lands. Manifest entry stubbed
-                below as a commented block so the next sprint can
-                uncomment + flesh out.
+    * .MainActivity  — single-activity host, Compose root. Hosts the
+                WebViewMobileProver inline in the main process today
+                (see TODO in WebViewMobileProver.kt and the "Deferred:
+                WebView process isolation" note in ADR-0010 §"WebView
+                is process-isolated and CSP-locked"). Process
+                isolation is gated on the IPC plumbing — a Messenger
+                or AIDL binder between MainActivity and a future
+                ProverActivity running android:process=":prover".
+                Scheduled work, not stubbed scaffolding.
 
   No <queries> needed today — no package introspection.
 -->
@@ -61,26 +64,30 @@
         </activity>
 
         <!--
-          Prover activity placeholder — uncomment + flesh out in the prover-glue
-          sprint task. android:process=":prover" puts the WebView renderer
-          in a dedicated process so a renderer compromise cannot reach
-          the main process where the Keystore-bound credential lives
-          (ADR-0010, "WebView is process-isolated and CSP-locked").
+          DEFERRED: dedicated prover activity in android:process=":prover".
+
+          ADR-0010 §"WebView is process-isolated and CSP-locked" calls for
+          hosting the snarkjs WebView in its own OS process. The W3 prover
+          (WebViewMobileProver.kt) currently lives inline in the main
+          activity's process because the IPC plumbing — Messenger / AIDL
+          binder between MainActivity and a future ProverActivity — is its
+          own ~day-of-work and we shipped W3 without it. Threat model
+          A-17 acknowledges the residual risk: a WebView renderer
+          compromise has line-of-sight into the main process where the
+          Keystore-unwrapped biometric secret lives during proof
+          generation.
+
+          To uncomment when the IPC layer lands (W4+):
 
           <activity
               android:name=".prover.ProverActivity"
               android:exported="false"
               android:process=":prover"
               android:theme="@style/Theme.ZeroAuth.Prover" />
-        -->
 
-        <!--
-          WebView asset loader provider placeholder — once we ship
-          assets/prover/* (ADR-0010), the prover activity will host an
-          androidx.webkit.WebViewAssetLoader that serves the bundled
-          snarkjs.min.js + .wasm + .zkey over an https://appassets.androidplatform.net
-          origin. No <provider> registration is needed for that — calling
-          this out so the next engineer doesn't add one by reflex.
+          (The asset loader at https://appassets.androidplatform.net is
+          configured per-WebView by WebViewMobileProver — no manifest
+          provider needed even after the move.)
         -->
 
     </application>
 
@@ -137,6 +137,7 @@ Cross-device verification flow: a desktop opens a session, a phone scans the QR
 | `POST` | `/v1/proof-pairing/sessions/:id/submit` | `proof_pairing:claim` | Desktop submits the proof + public signals it scanned from the phone. Body: `{ did, proof, publicSignals, clientMeta? }`. Returns `{ session, tokens }`. |
 | `GET` | `/v1/proof-pairing/sessions/:id/stream` | `proof_pairing:create` + `session_bind` cookie | Server-Sent Events. Events: `session_created`, `session_bound`, `session_expired`, `session_error`. Connection closes after a terminal event. |
 | `GET` | `/v1/proof-pairing/sessions/:id` | `proof_pairing:create` + `session_bind` cookie | Polling fallback for clients without `EventSource`. |
+| `GET` | `/v1/proof-pairing/sessions/:id/public` | none (per-IP rate-limited 30/min) | Unauthenticated freshness read. Returns only `{ id, state, expiresAt }` so the Android app can short-circuit a ceremony after a stale QR was scanned. Uniform `404 pairing_session_not_found` for every rejection class (A-25). Cache-Control: no-store. |
 
 `POST /sessions` response (also sets `Set-Cookie: zeroauth_pair_bind=…; HttpOnly; Secure; SameSite=Strict; Path=/v1/proof-pairing/; Max-Age=300`):
 ```json
@@ -158,10 +159,22 @@ Cross-device verification flow: a desktop opens a session, a phone scans the QR
   "did": "did:zeroauth:demo:7a3c9f5b8e1d2a4c6f0b9e3d5a7c1f8b",
   "proof": { "pi_a":[…], "pi_b":[…], "pi_c":[…], "protocol":"groth16", "curve":"bn128" },
   "publicSignals": ["<commitment>", "<didHashSession>", "<identityBinding>"],
-  "clientMeta": { "appVersion": "0.1.0", "platform": "android", "model": "Pixel 7a", "proofMs": 4820, "playIntegrityVerdict": "MEETS_STRONG_INTEGRITY" }
+  "clientMeta": { "appVersion": "0.1.0", "platform": "android", "model": "Pixel 7a", "proofMs": 4820, "playIntegrityVerdict": "MEETS_STRONG_INTEGRITY", "rawScan": "za:proof:1:<base64url-of-gzip-cbor>" }
 }
 ```
 
+**`clientMeta.rawScan` short-key schema.** The Android app encodes the proof QR as `gzip(cbor({ s, p, ps, d, m }))` to fit under the 1500-byte QR-capacity ceiling (ADR-0009 §5). The desktop relays the raw scan string into `clientMeta.rawScan` unchanged; backend audit + analytics decoders need to know the field-shortening map:
+
+| Short key | Long key in this contract | Type |
+|---|---|---|
+| `s` | `session.id` | string (UUIDv4) |
+| `p` | `proof` | `{ a, b, c, protocol, curve }` (same shape, also short-keyed: `a` = `pi_a`, `b` = `pi_b`, `c` = `pi_c`) |
+| `ps` | `publicSignals` | string[3] (`[commitment, didHashSession, identityBinding]`) |
+| `d` | `did` | string |
+| `m` | `clientMeta` | `{ av, pl, md, ms, pi }` where `av` = `appVersion`, `pl` = `platform`, `md` = `model`, `ms` = `proofMs`, `pi` = `playIntegrityVerdict` |
+
+Decoded forms are byte-equal to the long-keyed JSON above; the desktop's submit handler reconstructs the long-keyed body before posting if it needs to call `/submit` itself, so server-side handlers can rely on the documented long-keyed shape and treat `clientMeta.rawScan` as an opaque audit token.
+
 `POST .../submit` success — `200 OK`:
 ```json
 {
 
@@ -10,12 +10,14 @@
  */
 
 import { Router, Request, Response } from 'express';
+import rateLimit from 'express-rate-limit';
 import { authenticateTenantApiKey, getTenantContext } from '../../middleware/tenant-auth';
 import { logger } from '../../services/logger';
 import {
   createSession,
   submitProof,
   getSession,
+  getSessionPublicMinimal,
   subscribeStream,
   streamHeartbeatMs,
   PairingSessionNotFound,
@@ -277,4 +279,46 @@ router.get('/sessions/:id',
   },
 );
 
+// ─── Public freshness read ─────────────────────────────────────────────
+//
+// Unauthenticated read returning ONLY { id, state, expiresAt }. The
+// Android app uses it to short-circuit a doomed ceremony when the user
+// scans a desktop QR after it has already expired — phone gets the
+// signal without exposing the desktop's API key. Per-IP rate-limited
+// to defeat enumeration at scale; service layer pads latency to the
+// LATENCY_FLOOR_MS to defeat A-26.
+const publicReadLimiter = rateLimit({
+  windowMs: 60_000,
+  max: 30,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { error: 'rate_limit_exceeded' },
+});
+
+router.get('/sessions/:id/public',
+  publicReadLimiter,
+  async (req: Request, res: Response) => {
+    try {
+      const sessionId = String(req.params.id);
+      const session = await getSessionPublicMinimal(sessionId);
+      // Hint to caches: this is per-session and short-lived; never store.
+      res.setHeader('Cache-Control', 'no-store');
+      res.status(200).json({ session });
+    } catch (err) {
+      const mapped = mapError(err);
+      if (mapped.status === 500) {
+        logger.error('proof-pairing: getSessionPublicMinimal failed', {
+          error: (err as Error).message,
+        });
+      }
+      // Uniform 404 for every rejection class — A-25 enumeration safety.
+      // Public callers see only "not found", never "exists but blocked".
+      res.status(404).json({
+        error: 'pairing_session_not_found',
+        message: 'No such session.',
+      });
+    }
+  },
+);
+
 export default router;
@@ -127,6 +127,21 @@ export interface SessionPublicView {
   did?: string;
 }
 
+/**
+ * Strictly-public view returned by `GET /sessions/:id/public`. No
+ * tenant context, no bind cookie, no PII — only the freshness signal
+ * the Android app needs to decide whether to bother prompting the user
+ * for biometric. Everything in this shape is information the phone
+ * already knows from the QR payload or could re-derive locally. The
+ * endpoint exists purely so the phone can short-circuit a doomed
+ * ceremony when the user scans a QR after it has already expired.
+ */
+export interface SessionPublicMinimalView {
+  id: string;
+  state: ProofPairingState;
+  expiresAt: string;
+}
+
 export interface SubmitResult {
   session: SessionPublicView;
   verification: { id: string };
@@ -664,6 +679,49 @@ export async function submitProof(
   }
 }
 
+/**
+ * Public read for the Android app — no tenant context, no bind cookie.
+ * Returns only `{ id, state, expiresAt }` so the phone can decide
+ * whether the session is worth a biometric prompt. Looks up the row
+ * by ID alone (no tenant filter), which is safe because:
+ *
+ *   - the returned shape has no tenant identifier and no PII;
+ *   - session IDs are UUIDv4 (~122 bits of entropy);
+ *   - the route is per-IP rate-limited at 30 req/min/IP (route layer);
+ *   - latency is padded to LATENCY_FLOOR_MS to defeat A-26.
+ *
+ * A `PairingSessionNotFound` thrown here maps to a uniform 404 — the
+ * route layer must not distinguish "session doesn't exist" from any
+ * other rejection class. See A-25 in `docs/threat_model.md`.
+ */
+export async function getSessionPublicMinimal(
+  sessionId: string,
+): Promise<SessionPublicMinimalView> {
+  const startMs = Date.now();
+  try {
+    const pool = getPool();
+    const result = await pool.query<ProofPairingSession>(
+      `SELECT id, state, expires_at
+         FROM proof_pairing_sessions
+        WHERE id = $1`,
+      [sessionId],
+    );
+    const row = result.rows[0];
+    if (!row) {
+      throw new PairingSessionNotFound();
+    }
+    return {
+      id: row.id,
+      state: row.state,
+      expiresAt: row.expires_at instanceof Date
+        ? row.expires_at.toISOString()
+        : String(row.expires_at),
+    };
+  } finally {
+    await padToFloor(startMs);
+  }
+}
+
 export async function getSession(
   sessionId: string,
   tenantId: string,
 
@@ -128,6 +128,7 @@ jest.mock('../src/middleware/tenant-auth', () => ({
 const createSessionMock = jest.fn();
 const submitProofMock = jest.fn();
 const getSessionMock = jest.fn();
+const getSessionPublicMinimalMock = jest.fn();
 const subscribeStreamMock = jest.fn();
 
 jest.mock('../src/services/proof-pairing', () => {
@@ -148,6 +149,7 @@ jest.mock('../src/services/proof-pairing', () => {
     createSession: (...args: unknown[]) => createSessionMock(...args),
     submitProof: (...args: unknown[]) => submitProofMock(...args),
     getSession: (...args: unknown[]) => getSessionMock(...args),
+    getSessionPublicMinimal: (...args: unknown[]) => getSessionPublicMinimalMock(...args),
     subscribeStream: (...args: unknown[]) => subscribeStreamMock(...args),
     expireOverdueSessions: jest.fn(),
     streamHeartbeatMs: 15000,
@@ -587,3 +589,45 @@ describe('audit', () => {
     expect(crossTenantAuditRecorded).toBe(true);
   });
 });
+
+describe('GET /v1/proof-pairing/sessions/:id/public', () => {
+  const id = uuid();
+
+  it('200 with { session: { id, state, expiresAt } } on a known session — no auth required', async () => {
+    getSessionPublicMinimalMock.mockResolvedValueOnce({
+      id,
+      state: 'issued',
+      expiresAt: '2026-12-01T00:00:00.000Z',
+    });
+    const res = await request(app).get(`/v1/proof-pairing/sessions/${id}/public`);
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual({
+      session: { id, state: 'issued', expiresAt: '2026-12-01T00:00:00.000Z' },
+    });
+    expect(res.headers['cache-control']).toBe('no-store');
+    // Exactly the three public fields — no userId, no boundAt, no did,
+    // no tenant identifier. Public callers must never receive PII.
+    expect(res.body.session.userId).toBeUndefined();
+    expect(res.body.session.boundAt).toBeUndefined();
+    expect(res.body.session.did).toBeUndefined();
+  });
+
+  it('404 pairing_session_not_found for unknown id (uniform with all other rejections — A-25)', async () => {
+    getSessionPublicMinimalMock.mockRejectedValueOnce(new PairingSessionNotFound('no such row'));
+    const res = await request(app).get(`/v1/proof-pairing/sessions/${uuid()}/public`);
+    expect(res.status).toBe(404);
+    expect(res.body.error).toBe('pairing_session_not_found');
+  });
+
+  it('does not require Authorization or session_bind cookie', async () => {
+    // Spy that the route ever consults tenant auth would land here; we
+    // assert by reaching the service mock without setting either auth
+    // primitive.
+    getSessionPublicMinimalMock.mockResolvedValueOnce({
+      id, state: 'consumed', expiresAt: '2026-12-01T00:00:00.000Z',
+    });
+    const res = await request(app).get(`/v1/proof-pairing/sessions/${id}/public`);
+    expect(res.status).toBe(200);
+    expect(getSessionPublicMinimalMock).toHaveBeenLastCalledWith(id);
+  });
+});