mobile-developmentlisted

# Mobile development Mobile code runs on devices you don't control: old OS versions, killed processes, flaky networks, strict stores. Verify on an emulator or simulator, and say what was never run on a real device. Platform details: - `references/android.md`: Gradle, Compose, emulator, signing, Play. - `references/ios.md`: Xcode, SwiftUI, simulator, signing, App Store. ## Always - **Follow the project's architecture**, for example MVVM/MVI with unidirectional state, the DI framework, and the navigation library. New screens copy an existing screen's structure. - **Lifecycle:** assume the process can die at any moment. - Persist in-progress user input. - Restore state after process death and configuration change. - Never do I/O on the main thread. - Cancel work with the screen's scope. - **Network:** - timeouts; - retries only for idempotent calls; - an offline state in the UI; - no blocking spinner without a cancel. - Cache deliberately. - **Permissions:** request them in context, at the moment of use, and handle denial and "don't ask again". Declare only the permissions you use. - **Security:** - secrets never ship in the binary (anything in the app can be extracted); - tokens go in Keystore/Keychain-backed storage; - TLS validation stays on; - deep links and intents are validated; - WebViews are locked down. See security-review and OWASP MASVS. - **Accessibility and i18n:** - content descriptions or labels; - dynamic type and font scalin