What can cause getExtras() to return null on the Intent posted back by PackageInstaller.Session.commit()

Trying to implement a nice user interface to install packages distributed on a USB stick, and followed this example:

https://android.googlesource.com/platform/development/+/refs/heads/main/samples/ApiDemos/src/com/example/android/apis/content/InstallApkSessionApi.java

The issue I'm seeing is that in onNewIntent, I do get back the Intent that I wrapped in PendingIntent and passed to session.commit(). However, when it comes, the extras such as PackageInstaller.EXTRA_STATUS, PackageInstaller.EXTRA_STATUS_MESSAGE, and Intent.EXTRA_INTENT are missing, and getExtras() returns null. If I attach extras, then getExtras() returns a bundle but I see only the extras I added myself.

Can anyone explain why this might be happening?

I've also tried registering a callback to the PackageInstaller instance and then I get only SessionCallback.onCreated() and SessionCallback.onActiveChanged(). I suspect it's waiting for me to handle the PackageInstaller.STATUS_PENDING_USER_ACTION, but I can't read the status nor fetch the EXTRA_INTENT that accompanies this message.

The example calls

PendingIntent.getActivity(context, 0, intent, 0);

but 0 is not a legal value of flags (the fourth parameter) on modern Android. Android Studio and the documentation suggest using PendingIntent.FLAG_IMMUTABLE and imply that other flags create security problems, but FLAG_IMMUTABLE causes the behavior observed of missing extras data.

You have to use FLAG_MUTABLE.

I also considered bypassing the extras Bundle and accessing the needed data through getSessionInfo(), but while the progress and messages are available there, the user-confirmation Intent is not. You need the extras.