fix(deploy): verify iOS BEAM overrides

AGENTS.md

@@ -41,6 +41,15 @@ mix test --exclude integration # skip the device-dependent ones
   `narrow_platforms_for_device/2` and is the single source of truth for both
   build and deploy. Bypass it and you'll get either spurious "No device
   matched" warnings (deploy) or builds for the wrong platform (build).
+- **Deployment BEAM discovery follows Mix's active paths.** Use
+  `Mix.Project.build_path/0` for dependency output and
+  `Mix.Project.compile_path/0` for every application BEAM, including modules
+  compiled from `erlc_paths`. Hard-coding `_build/dev` can push a stale,
+  incomplete override that shadows the complete application bundle.
+- **Physical iOS BEAM overrides must be exact and self-verifying.** The app
+  prefers `Documents/otp/<app>` over its complete signed bundle. Replace that
+  directory rather than incrementally merging it, require `<app>.beam` before
+  transfer, and verify the received bootstrap bytes before restarting.
 - **`xcodebuild` errors get rewritten** to actionable hints by
   `diagnose_xcodebuild_failure/1` in `mob.provision`. Apple's verbatim text is
   preserved alongside our hint so the snippet stays google-able. Add new

CHANGELOG.md

@@ -10,6 +10,36 @@ Full module documentation: [hexdocs.pm/mob_dev](https://hexdocs.pm/mob_dev).
 
 ## [Unreleased]
 
+### Fixed
+- **`mix mob.deploy` no longer drops dependencies reachable only through
+  `extra_applications`.** The runtime filter stopped consulting the project's
+  own `.app` file, so a dep declared `runtime: false` and opted back in via
+  `extra_applications:` — the documented idiom — was silently never pushed. The
+  app booted and died with `undef` on first use. The project's `.app` is
+  traversed again, with dev-only deps subtracted afterwards rather than by
+  skipping the traversal.
+- BEAM discovery follows `Mix.Project.build_path/0` and `compile_path/0` instead
+  of a hardcoded `_build/dev`, so a non-dev `MIX_ENV` or a custom `:build_path`
+  is honoured. Projects using `build_per_environment: false` previously pushed
+  no dependency BEAMs at all.
+- `mix mob.deploy` from an umbrella root now reports that mob does not support
+  umbrellas instead of leaking a raw `Mix.Project.app_path/1` error.
+- A physical-iOS deploy targeting a WiFi-only device returns a per-device error
+  instead of throwing past the run and aborting every other device's summary.
+- iOS staging directories are PID-qualified, so two concurrent deploys cannot
+  delete each other's staging mid-copy.
+
+### Changed
+- **Physical iOS overrides are now replaced, not merged**
+  (`devicectl --remove-existing-content`), and the transfer is verified before
+  the app is restarted. Note the trade-off: because `mob_beam.m` prefers
+  `Documents/otp/<app>` on directory existence alone, a transfer interrupted
+  after the copy begins leaves an incomplete override that the next launch will
+  still prefer over the signed bundle. There is no rollback — `devicectl` has no
+  delete verb, and an empty directory is still preferred — so the deploy now
+  says so explicitly and names the recoveries (re-run the deploy, or reinstall).
+
+
 ### Added
 - **`mix mob.doctor` warns when a project still carries the pre-MOB-104 sheet
   dismissal wiring.** An app generated before the fix routes

android/app/src/main/res/values/styles.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <style name="AppTheme" parent="android:style/Theme.NoTitleBar">
+        <item name="android:windowBackground">@android:color/black</item>
+        <item name="android:windowAnimationStyle">@null</item>
+        <item name="android:windowNoTitle">true</item>
+    </style>
+</resources>

android/app/src/main/res/xml/file_provider_paths.xml

@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<paths>
+    <!-- Camera capture temp files (mob_cam_*.jpg / mob_cam_*.mp4) -->
+    <cache-path name="mob_camera" path="." />
+    <!-- Audio recording temp files -->
+    <cache-path name="mob_audio" path="." />
+</paths>

android/app/src/main/res/xml/network_security_config.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <!-- Allow cleartext HTTP to localhost for the local Phoenix LiveView endpoint -->
+    <domain-config cleartextTrafficPermitted="true">
+        <domain includeSubdomains="false">127.0.0.1</domain>
+        <domain includeSubdomains="false">localhost</domain>
+    </domain-config>
+</network-security-config>

android/gradle/wrapper/gradle-wrapper.properties

@@ -0,0 +1,7 @@
+distributionBase=GRADLE_USER_HOME
+distributionPath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.2.1-bin.zip
+networkTimeout=10000
+validateDistributionUrl=true
+zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists