In the code column — proguard-rules.pro. Once R8 is on, it removes unused code and renames classes to a, b, c… Less code, harder to reverse. But there's a trap: some libraries look classes up by name (reflection) — if R8 renames them, they can't be found. Those must be kept (-keep).

Pica's stack needs four groups of keep rules:

• kotlinx.serialization — all our DTOs (MenuItemDto, AuthRequest, OrderDto…). Serializers are generated and found reflectively.
• Retrofit — service interface methods are read via reflection.
• Room — generated code references entities/DAOs.
• Stripe — the SDK's internal classes.

(This rule set is the standard one for this stack; the real Pica proguard-rules.pro doesn't exist, because its release has R8 off.)

Verify. Build the release and run it on a real device:

./gradlew assembleRelease      # → app/build/outputs/apk/release/app-release.apk
# or an App Bundle for the Play Store:
./gradlew bundleRelease        # → app-release.aab

The app should behave exactly like the debug build: the menu loads, login works, payment goes through.

Gotcha (release only!). Enable R8 without keep rules and the debug build is fine, but the release build crashes at runtime:

kotlinx.serialization.SerializationException:
Serializer for class 'MenuItemDto' is not found.

Because R8 renamed MenuItemDto and its generated serializer, and serialization looks for them by their original name. The bug is invisible in debug — so always test the actual release build, not just debug.