每日新聞摘要

This article continues the TBEG series by focusing on template syntax for Excel report generation. It explains the two marker types—variable markers for substituting data and function markers for operations such as repeat, image insertion, merge, bundle, size, and hideable. The guide shows how repeat can expand rows or columns, how formulas are preserved and auto-adjusted inside repeated regions, and how merge and bundle help keep grouped data and multi-element layouts intact. It also covers collection size, variable use inside formulas, absolute references, and selective field visibility via hideable, along with practical constraints such as non-overlapping ranges and repeat-region limitations.

本文延续 TBEG 系列，重点讲解用于 Excel 报表生成的模板语法。文章先区分两类标记：变量标记用于替换数据值，函数标记则负责 repeat、image、merge、bundle、size 和 hideable 等特殊操作。作者展示了 repeat 如何向下或向右展开，也说明了多行块、空集合 fallback，以及重复区域内公式会自动平移和扩展。文中还介绍 merge 与 bundle 如何保持分组数据和复杂表格布局不散乱，并补充 size、公式中使用变量、绝对引用，以及 hideable 的字段可见性控制与相关限制。

This guide explains how Model Context Protocol (MCP) fits into Android development as a standardized way to connect AI agents with tools, data, and services. It contrasts Android-as-MCP-client architectures with backend-centered deployments, and also introduces Android 16+ AppFunctions as an experimental, Android-specific way to expose app capabilities to authorized callers. The article emphasizes clean separation of concerns: keep MCP logic out of the UI, wrap protocol access behind repositories and interfaces, and use explicit authorization, input validation, least privilege, and user confirmation for high-impact actions. It also covers tool discovery, transports, security risks such as prompt injection, and the importance of server-side secrets for production systems.

本文介绍 Model Context Protocol（MCP）在 Android 开发中的作用：它为 AI agent 访问工具、数据和服务提供标准化方式。文章对比了 Android 作为 MCP client 的架构、以后端为中心的方案，以及 Android 16+ 仍属 experimental 的 AppFunctions，后者可让应用向已授权调用方暴露能力。作者强调要把 MCP 逻辑与 UI 分离，并通过 repository、接口和 Clean Architecture 封装协议访问；同时必须落实最小权限、输入校验、用户确认、服务端密钥保护，还要重视 prompt injection、工具输出验证与权限边界。

The article opens with the author explaining that the app was locked to portrait mode in 2019, so screen adaptation had not been a concern for years. That changed when the app was tested on a foldable device, prompting a fresh look at large-screen behavior and adaptive layouts. The headline suggests the discussion is about Android 17 and Jetpack, but the provided text only includes the introduction and a teaser, so no further technical claims can be confirmed from the excerpt.

文章开头提到，作者在 2019 年将应用锁定为竖屏模式，因此之后很长时间都没有再关注屏幕适配问题。直到上个月在折叠设备上测试应用，才再次面对大屏与自适应布局的挑战。标题显示主题与 Android 17 和 Jetpack 有关，但给出的正文只有开场和导语，因此不能从这段摘录中确认更多技术结论。

This excerpt is only a short teaser for the full article. It says the author was preparing PromptPoster for RevenueCat’s Shipaton in September, but it does not include the main technical discussion, the agent workflow, or any concrete results about Kotlin use cases. As a result, the available text offers only minimal context and no verifiable details beyond the preparation mention.

这段内容只是全文的简短导语。正文仅提到作者在 9 月为 RevenueCat 的 Shipaton 准备 PromptPoster，没有展开主要技术讨论、Agent 工作流程，也没有提供关于 Kotlin 使用场景覆盖率的可验证细节。因此，现有文字只能确认这项准备工作的背景，无法得知更多实现与成果。

This article introduces the Model-View-Controller (MVC) pattern and explains how its three parts work together: the model holds data, the view presents it, and the controller handles interaction. It also looks at why MVC became foundational in early mobile and web development, where separating responsibilities helped structure applications. At the same time, it points out that many modern apps have moved beyond MVC as application architectures evolved.

本文介绍 Model-View-Controller（MVC）模式，并说明 model 负责数据、view 负责呈现、controller 负责处理交互，三者如何分工协作。文章也回顾 MVC 为何在早期移动和网页开发中成为重要架构，因为它有助于分离职责、整理应用结构。同时，文中指出随着应用架构演进，许多现代应用已经逐渐超越 MVC。

The article argues that solo founders and indie hackers in 2026 are increasingly betting on Kotlin Multiplatform (KMP), local-first AI, and unified architecture. The framing suggests a strategy centered on building once and running across multiple platforms, rather than maintaining separate codebases. Based on the available text, the piece positions these technologies as part of an indie hacker advantage, but does not provide further details in the excerpt about implementation, outcomes, or comparisons.

这篇文章认为，到 2026 年，独立创始人和 indie hacker 正在更多押注 Kotlin Multiplatform（KMP）、local-first AI 和统一架构。其核心思路是一次开发、跨多个平台运行，而不是维护多套分离的代码库。就当前可见内容而言，文章将这些技术描绘为独立开发者的优势，但摘录并未展开实现细节、结果或对比结论。

The article describes a personal project in which the author built a Pokédex that selects a Pokémon based on the user’s weather. It frames the work as a modern Android app built with Jetpack Compose and highlights the lessons learned during the process. The subtitle mentions that the project took one week and involved 19 modules plus a context engine, but the available text does not provide further technical details or results beyond that high-level summary.

这篇文章介绍作者完成的一个个人项目：一个会根据用户天气挑选宝可梦的 Pokédex。文章将其描述为使用 Jetpack Compose 开发的现代 Android 应用，并强调作者在构建过程中的收获。副标题提到项目历时一周，包含 19 个模块和一个 context engine；但从目前提供的内容来看，没有更多技术细节或实现结果可进一步展开。

This article centers on Kotlin variables, immutability, and type inference, with a practical emphasis on understanding the difference between val and var. It frames these concepts as part of building robust multiplatform architectures that span Android, iOS, Desktop, and Web. The available text does not provide deeper technical details, examples, or performance claims, so the core takeaway is the article’s focus on foundational Kotlin language choices and their relevance to cross-platform application design.

本文聚焦 Kotlin 的变量、不可变性与类型推断，并以理解 val 与 var 的区别为核心。内容将这些概念放在构建稳健多平台架构的语境中，覆盖 Android、iOS、Desktop 和 Web。由于可见正文仅提供标题式摘要，未包含更深入的技术细节、示例或性能表述，因此可以确认的重点是：文章关注 Kotlin 语言基础选择及其在跨平台应用设计中的意义。

This article says Kotlin/Native’s smallBinary configuration does not run LLVM’s outliner on Kotlin code. It describes a missing LLVM pass and notes that a one-line workaround can be used, but it comes with about a 6% scroll CPU cost. The piece also explains why that workaround is not the default behavior. The available text is brief, so the core message is limited to the issue, the workaround, and its tradeoff.

文章指出，Kotlin/Native 的 smallBinary 配置不会在 Kotlin 代码上运行 LLVM 的 outliner，原因是缺少一个 LLVM pass。作者提到可以用一行代码作为 workaround，但会带来约 6% 的 scroll CPU 开销，因此没有被设为默认方案。由于原文内容很短，核心信息主要就是这个缺失、替代办法，以及对应的成本与取舍。

The article introduces the Single Responsibility Principle (SRP) in Android, stating that a class should have one main responsibility and one reason to change. It presents this idea as a concise takeaway rather than a detailed walkthrough, with the full content continued on Medium.

本文介绍 Android 中的单一职责原则（SRP），核心观点是：一个类应该只有一项主要职责，并且只有一个变更理由。文章以简短方式传达这一概念，并说明完整内容可继续在 Medium 上阅读。

The article explains how the author designed Muffle, an Android app that automates sound profiles without relying on cloud services. A local-only architecture using Room was chosen to avoid privacy risks, compliance burdens, and breach exposure from remote storage. The app uses GeofencingClient, AudioManager, and NotificationManager for on-device triggers and Do Not Disturb control, which keeps it working offline and reduces latency. The author also describes challenges with Android background execution, OEM battery optimizations, overlapping silence rules, and recurring calendar events across time zones. The core lesson is that local persistence can improve both privacy and performance while keeping the app self-contained.

作者介绍了 Muffle 这款 Android App 的架构选择：为了自动化音量与勿扰模式，并避免云服务带来的隐私风险，应用改为完全本地化运行。团队以 Room 作为数据层基础，把地点与日程等信息保存在设备上，从而减少合规与泄露隐患。应用使用 GeofencingClient、AudioManager 和 NotificationManager 在本地处理地理围栏、静音与勿扰状态，因此即使离线也能工作，并降低延迟。文章还总结了 Android 后台执行、厂商电量优化、重叠规则优先级，以及跨时区日历同步的复杂性，结论是本地持久化不仅更隐私，也更高效。

This article lays out a practical OSINT roadmap for Android developers, framing open-source intelligence as the disciplined use of publicly available information rather than hacking. It explains why Android skills such as APIs, DNS, TLS, Git, JSON, networking, and logs map naturally to OSINT workflows. The guide walks through search intelligence, source validation, domain and certificate analysis, public code review, metadata, identity and threat intelligence, CVEs, Android security bulletins, Kotlin automation, and Compose-based tooling. It also emphasizes ethics, evidence-driven verification, and privacy-first design, then closes with project ideas and a 30-day learning plan.

本文为 Android 开发者梳理了一条实用的 OSINT 学习路线，说明开源情报并不是入侵，而是对合法公开信息进行收集、验证和分析。作者指出，Android 开发者本就熟悉 API、DNS、TLS、Git、JSON、网络和日志，因此很适合把这些能力延伸到情报工作。文章依次介绍搜索情报、来源验证、域名与证书分析、公开代码、Metadata、身份与威胁情报、CVE 与 Android 安全公告，以及用 Kotlin 和 Compose 构建自动化工具与仪表板，并强调伦理与隐私优先。

After a vendor removed stale kotlin-stdlib declarations, the nightly build still stayed red because another SDK family was still pinning the same version, and our own published SDKs had the same problem. The investigation moved from cache-trace traps to publication metadata, revealing that POMs and Gradle .module files both needed policy-driven filtering and exclusions. A first fix cleaned direct declarations but missed a transitive path through kotlin-parcelize-runtime; a later correction added the right exclude rules, fixed a naming mistake in .module metadata, and was validated with integration tests, scratch consumers, compilation checks, and runtime smoke tests across multiple Kotlin versions. The result is a proposed stopgap, not a universal compatibility solution.

供应商移除了过时的 kotlin-stdlib 声明后，夜间构建仍然持续红灯，因为另一组 SDK 以及我们自己发布的包也在 pin 同一版本。作者一路追查到发布元数据，发现必须同时治理 POM 和 Gradle .module，并通过策略式过滤与排除规则进行修正。第一版只清掉直接依赖，却漏掉经由 kotlin-parcelize-runtime 传入的路径；随后又修正了 .module 字段名错误和幂等性问题，并借助集成测试、临时 consumer、跨 Kotlin 版本编译与运行验证。这个方案只是临时止血，不是通用兼容性的保证。

The article opens by revisiting the end of the previous installment, which concluded with a vendor fix. That SDK declared kotlin-stdlib 2.3.0, and AGP consistent resolution propagated that version forward. The excerpt sets up the investigation into why the fix appeared to ship without producing the expected change, pointing to lingering “phantom pins” that remained after the update.

这篇文章开头回顾上一期的结尾：问题已经通过供应商修复收束，但实际情况并没有随之改变。原因之一是该 SDK 声明了 kotlin-stdlib 2.3.0，而 AGP 的一致性解析把这个版本继续向下传递。文章因此引出对“幻影钉选”的追查，解释为什么修复已经发出，现象却似乎仍在持续。

AndroidX Security State has gone stable, offering a Kotlin-based way to assess whether a device is patched enough to trust. The piece highlights the practical problem app developers face when trying to answer questions about patch levels, pending updates, and CVEs. Rather than treating device trust as a vague judgment, the article points to a structured approach for checking security state.

AndroidX Security State 已转为 stable，提供一种基于 Kotlin 的方式来检查设备安全状态。文章指出，应用开发者在判断一台手机是否“补丁打得足以信任”时，往往需要处理补丁级别、待更新项和 CVE 等信息，实际并不简单。本文以这一常见需求为切入点，强调用结构化方式查看设备安全状态的重要性。