# iOS Hardening Notes

The local Xcode prerequisite gate now passes with Xcode 26.5 and the iOS 26.5 simulator runtime.

Validated commands:

```bash
DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer scripts/check-ios-prereqs.sh
DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer xcodebuild -scheme TeleTuiIOSApp -destination 'generic/platform=iOS Simulator' build
```

Implemented hardening hooks:

- `SessionLifecycleCoordinator` suspends polling while the app is backgrounded.
- Account switches increment a session generation counter.
- Events are accepted only when both account id and generation match the active session, preventing stale events from a previous account from reaching view models.

Manual smoke still required after real TDLib device setup:

1. Auth with real Telegram credentials.
2. Load chats, open multiple chats, send/edit/delete/reply/forward/react.
3. Background and foreground during history load and media download.
4. Switch accounts rapidly while receiving updates.
5. Confirm no stale events from the previous account mutate the active account.