SwiftUI 27

Apply these rules to iPhone and iPad apps using SwiftUI from an iOS and iPadOS 27 SDK in Xcode 27, after the included iOS SDK 27 and Swift 6.4 baselines; they were checked against the stable 27.0 SDK. Xcode permits iOS/iPadOS deployment targets from 15 through 27; check each symbol's availability and preserve the same security policy in older-runtime implementations. The new document protocols and image-request/session APIs below require iOS/iPadOS 27.0.

Account state and asynchronous work

• Keep authentication and authorization changes in explicit model operations. Xcode 27's @State macro avoids repeatedly evaluating an initial value for retained state, with this behavior back-deployed to iOS/iPadOS 17. Do not rely on view reconstruction or a state initializer to refresh credentials or permissions. When an account changes, replace account-owned models and reset the authenticated subtree's identity with .id(sessionGeneration) where needed, including its navigation and presentation state. If an initializer supplies account-specific @State, omit a competing declaration-site initial value: it can cause the initializer value to be discarded; initialization still does not refresh retained state.
• Expose only necessary mutable properties through Binding and @Bindable; pass values for read-only display. Recheck authorization in the operation invoked by a Button, menu, swipe action, or binding setter. .disabled, hidden controls, and an observable role property govern UI behavior and cannot authorize access to an object or server operation.
• Keep credentials