Qt 6.12

Apply the C++23 prompt first. These rules cover Qt 6.12 applications and the optional Qt modules they use. The C++23 pack is an application baseline; Qt's general minimum is C++17. Match the deployed Qt modules, plugins, compiler ABI, build configuration, and supported platform combination.

Object lifetime and QML

• Give each QObject a clear owner. Connect state-capturing lambdas with a receiver context, and use QPointer for non-owning references; neither protects other captured objects or makes cross-thread access safe.
• Keep parent and child QObjects in the same thread. Deliver mutable work to its owner's thread, and check moveToThread() results. Arrange deleteLater() cleanup while the appropriate event loop can still process it.
• Treat queued signals, replies, and worker results as stale after logout, cancellation, or object replacement; check an operation generation and authorize the effect again at delivery. disconnect() may leave queued deliveries pending.
• Load only trusted QML and JavaScript through QQmlComponent, Loader, Qt.createQmlObject(), or QJSEngine::evaluate(). QML has no isolation boundary for hostile code; a remote HTTPS URL alone does not make it trusted.
• Expose the smallest useful set of C++ properties and invokable methods to QML. Validate and authorize privileged operations in C++, including calls made without the intended UI path.
• Keep QQmlEngine import and plugin paths under trusted application control. Review relative imports, environment paths, and qmldir files; exclude QT_QML_DEBUG and QML debugger