T. Device APIs: networking, storage, permissions and app state
•
fetch and XHR are polyfilled, and native requests are not subject to browser CORS
•
iOS App Transport Security and the Android network security config reject plain HTTP by default
•
a socket is supported, but the OS may suspend it when the app backgrounds
•
an unencrypted key-value store returning promises, not a synchronous object
•
tokens belong in the iOS Keychain or Android Keystore, never in AsyncStorage
•
the sandbox's persistent directory versus the disposable one the OS may evict under storage pressure, and what belongs in each
•
a file is addressed by a file:// URI, and every read, write, download and info call returns a promise
•
image, camera and document pickers hand back a URI and a cancelled result, and writing to the device gallery is a separate permission
•
uploading a local file by URI, shrinking it before it leaves the device, and deleting the temporary copy afterwards
•
active, background and the iOS-only inactive state, and what each means
•
opening an external URL, and the scheme declaration canOpenURL requires
•
getInitialURL handles a launch from a link; the event listener handles a warm one
•
requesting at runtime, and handling the never-ask-again result
•
a missing Info.plist purpose string crashes the app when the permission is requested
•
notifications, sensors, haptics and the clipboard come from native modules, not from the web APIs of the same name
•
a push token identifies one INSTALL, can change, and is useless until your server has stored it
•
foreground, background and quit each deliver differently, and who shows the notification changes with them
•
routing data travels in the payload, and the cold-start tap is the one most often left unhandled
•
scheduled on-device versus pushed from a server, plus Android channels, categories and badges
•
fetch rejects only on network failure, so an HTTP 404 or 500 resolves normally and the status must be checked by hand
•
loading, error, empty and success are four distinct states a screen has to render, and forgetting one is what strands a spinner
•
cache-then-revalidate, query keys, optimistic updates and invalidating after a mutation
•
aborting on unmount, discarding stale responses when two requests race, and debouncing input before it reaches the network
•
reading from a local cache first and replaying queued mutations once connectivity returns
•
the OS decides whether and when registered background work runs, so nothing the product needs can depend on it having run
•
timers, sockets, playback and location all have to be released, and unsaved state written, before the process can be suspended or killed
•
the foreground transition is where stale data, dropped sockets and expired sessions get repaired in one place
•
a duration survives backgrounding only when it is recomputed from a stored timestamp, because JS timers are throttled or stopped
•
one configured client with a baseURL, and interceptors as the single place auth headers, 401-refresh and error normalization belong
•
a request needs a deadline, and a retry needs bounded, increasing, jittered delays instead of a tight loop
•
asking for exactly the fields a screen needs, and what a normalized client cache buys over ad-hoc response storage
•
WebSocket, SSE and polling differ in direction, latency and what they cost a mobile radio
•
authenticating at the handshake, and rebuilding the subscription state a dropped mobile socket loses