Deep links and universal links

Every link that opens the app (a custom scheme, an iOS universal link, an Android App Link; cold start or warm) passes one synchronous gate that opens only allow-listed routes with checked values. Verified hosts flow from one contract into the app config of every variant and into the hosted apple-app-site-association and assetlinks.json files. A checker replays hostile URLs through the app's own gate. Verified on 2026-10-14 with Expo SDK 57 (expo 57.0.26), expo-router 57.0.24 and expo-linking 57.0.11 in Jest inside the real router and with npx expo config; not yet driven on a device.

Rules that must hold