feat/#28 (#29)

Co-authored-by: Sayan Datta <sayan@Sayans-MacBook-Air.local>
Reviewed-on: sagnik/Project_Velocity#29

.Agent Context/Sprint 1/Sayan Multi-Surface and Oracle Delivery Pack/delivery_log.md

@@ -19,9 +19,11 @@
   - Compose app shell
   - Navigation graph
   - Dashboard, Inventory, Oracle, Sentinel, and Settings feature stubs
-- Added iPhone edge app scaffold under `iOS/velocity-edge-phone/`
-  - SwiftUI app entry
+- Added dedicated iPhone edge app source tree under `iOS/velocity-iphone/`
+  - SwiftUI app entry and tab shell
+  - Shared Velocity-styled phone UI tokens and cards
   - Alerts, Lead Summary, Communications, Notes, Transcriptions, Settings
+  - Live backend auth, notes, transcript, memory, alerts, and heartbeat wiring
 - Added Android phone edge scaffold under `android-edge-phone/`
   - Compose app shell
   - Alerts, Lead Summary, Communications, Notes, Transcriptions, Settings
@@ -57,14 +59,38 @@
   - `iOS/velocity/velocity/Features/Calendar/CalendarView.swift`
   - `iOS/velocity/velocity/Core/Networking/VelocityAPIClient.swift`
   - `iOS/velocity/velocity/Core/Config/AppConfig.swift`
+- Completed a broader iOS production hardening pass:
+  - `iOS/velocity/velocity/Core/Config/AppConfig.swift` now defaults to `https://api.desineuron.in` instead of a stale instance IP
+  - `iOS/velocity/velocity/Core/Networking/VelocityAPIClient.swift` now reads live inventory summaries in addition to leads, events, alerts, and calendar
+  - `iOS/velocity/velocity/Core/State/AppStore.swift` no longer seeds fabricated dashboard, visitor, chat, or oracle state and now hydrates a live shared snapshot
+  - `iOS/velocity/velocity/Features/Dashboard/DashboardView.swift` now renders live lead, inventory, calendar, and alert posture instead of synthetic KPIs and AI chat
+  - `iOS/velocity/velocity/Features/Oracle/OracleView.swift` now uses live pipeline, live communication timelines, and live calendar events; unavailable Oracle modes are shown truthfully instead of mock canvases
+  - `iOS/velocity/velocity/Features/Sentinel/SentinelView.swift` now disables visitor analytics until a real Sentinel feed exists and shows live operator urgency instead of fake biometric metrics
+  - `iOS/velocity/velocity/Features/Settings/SettingsView.swift` now reflects real backend/auth/runtime state
+  - `iOS/velocity/velocity/Features/Inventory/InventoryView.swift` no longer renders the simulator-only fake AR sun overlay in the active production path
+- Completed the Android mobile hardening pass:
+  - `android-tablet/` now includes a live backend client, Gradle runtime config fields, internet permission, and live-backed Dashboard, Inventory, Oracle, Sentinel, and Settings surfaces
+  - `android-edge-phone/` now includes a live mobile-edge client, Gradle runtime config fields, internet permission, and live-backed Alerts, Lead Summary, Communications, Notes, Transcriptions, and Settings surfaces
+  - Android Notes now writes to the real `POST /api/mobile-edge/notes` route when credentials are configured
+  - Android Sentinel surfaces are now explicitly truthful about missing production biometric feeds instead of implying live analytics
+- Completed the dedicated iPhone edge production source pass:
+  - `iOS/velocity-iphone/` now supersedes the earlier lightweight edge scaffold and is the single iPhone source of truth
+  - Added a dedicated standalone Xcode project at `iOS/velocity-iphone/velocity-iphone.xcodeproj` so the phone app can now be opened and tested directly in Xcode
+  - Added `iOS/velocity-iphone/Assets.xcassets` with app icon and accent color catalog plumbing required by the standalone target
+  - `iOS/velocity-iphone/Core/Networking/VelocityEdgeAPIClient.swift` now uses live `/api/auth/login`, `/api/leads`, `/api/mobile-edge/alerts`, `/api/mobile-edge/events`, `/api/mobile-edge/memory`, `/api/mobile-edge/notes`, `/api/mobile-edge/transcripts/{eventId}`, and `/api/mobile-edge/session`
+  - `iOS/velocity-iphone/Core/State/EdgeAppStore.swift` now manages live shared phone state for the edge surface and refreshes note, transcript, and alert context after writes
+  - `iOS/velocity-iphone/Core/UI/EdgeTheme.swift` now preserves the iPad Velocity styling language while adapting cards and layout to narrow iPhone width
+  - `iOS/velocity-iphone/Features/Alerts/EdgeAlertsView.swift` now uses an adaptive metric grid suitable for phone resolution instead of a tablet-like fixed row
+  - iPhone edge screens now auto-refresh live state periodically so the app behaves like an active operator surface instead of a one-shot fetch
+  - `backend/api/routes_mobile_edge.py` session heartbeat handling was fixed so `iphone_edge` and other mobile surfaces update an active session window instead of creating redundant session rows on every heartbeat
+  - Removed the superseded `iOS/velocity-edge-phone/` scaffold after confirming nothing useful remained outside the stronger `velocity-iphone` source tree
 
 ### MVP limits still in place
 
-- Android projects are scaffolds only; they are not yet wired to shared API clients, auth, or install registration.
-- The iPhone edge scaffold is source-first and does not yet include a dedicated `.xcodeproj` target.
+- The `iOS/velocity-iphone/` source tree now includes a dedicated standalone `.xcodeproj`, but full `xcodebuild` verification still depends on a machine with full Xcode, simulator runtimes, signing configuration, and live credentials.
 - The WebOS admin page is mounted into the live Vite shell and can now stage bounded actions against the backend audit trail; auto-execution remains intentionally out of scope.
-- The iPad Communications and Calendar views read live backend data, but the broader iPad app still contains other legacy mock-backed modules outside this residual slice.
-- The active WebOS runtime path has been hardened away from mock/demo behavior, but deeper non-WebOS workstream items remain out of scope for this pass, especially legacy iPad modules and simulator-only inventory/AR helpers on iOS.
+- The iPad production shell no longer uses fabricated dashboard/oracle/sentinel state, but some specialist inventory helpers remain beyond the current source hardening pass; on iPhone, the main remaining gaps are host-side build verification, signing, and supplying final production app-icon artwork rather than feature wiring.
+- Android mobile surfaces now read live data, but full device verification still requires Gradle on the host and real credentials in Gradle properties.
 - Oracle template seed metadata needs correction: `_meta.total_seed_examples` does not match the actual seed example count in `backend/oracle/oracle_template_seed_db.json`.
 - Sprint-1 documentation artifacts called for in the delivery pack are still missing as committed repo outputs, including the residual audit artifact and contract/package documentation.
 
@@ -75,7 +101,15 @@
 - SQL parse sanity check on extension migration
 - `npx tsc --noEmit` for the WebOS app after live-auth and no-mock hardening changes
 - `python3 -m py_compile` for backend auth and route modules after role/session hardening
+- `swiftc -parse` over the active iPad Swift source set after mobile production hardening
+- `swiftc -parse` over the complete `iOS/velocity-iphone/` source tree
+- `plutil -lint` for `iOS/velocity-iphone/Info.plist`
+- `plutil -lint` for `iOS/velocity-iphone/velocity-iphone.xcodeproj/project.pbxproj`
+- `python3 -m py_compile backend/api/routes_mobile_edge.py` after fixing surface session heartbeat behavior
+- XML validation for both Android manifests
+- Kotlin delimiter sanity checks over `android-tablet` and `android-edge-phone` source trees
+- Full `xcodebuild` and Gradle assembly were not run on this host because full Xcode and Gradle are not installed here
 
 ### Recommended next implementation step
 
- WebOS is now the strongest completed surface. The next implementation step should move fully to iOS and Android completion while preserving the live backend/auth patterns established here.
+ WebOS and the primary iPad/Android/iPhone source surfaces are now aligned around live backend truthfulness. The next implementation step should be dedicated device/build-host verification across the standalone `iOS/velocity-iphone/velocity-iphone.xcodeproj`, the existing iPad target, and the Android builds with live credentials.