r-zakarya
0b0f1e3fcd
The manifest asked for fine and coarse location, camera, phone, phone state and external storage - Delphi's defaults, none of them used. On a password vault those are exactly the wrong signals: whoever reads the app's listing saw a request for position and camera with no possible explanation. The list is written by hand now. A trap on the way: naming the substitution marker inside the comment that explains its removal is enough to bring it back. The substitution is textual and does not care that it lands in a comment. The bench credentials are no longer compiled into a release - the local include is debug-only. Verified in the binary in UTF-8 AND UTF-16: Delphi stores strings as UTF-16, so an ASCII grep returned zero on both sides and proved nothing. The log leaves the home screen in release without leaving the application: a 1.5 s press on the status line brings it back. Nothing secret is in it, but a permanent Log button is development noise, and diagnostics must stay reachable for the day something goes wrong remotely. And the Release configuration did not compile at all, which nobody knew: the two self-checks had their declarations under IFDEF DEBUG and their bodies outside. Invisible as long as one only ever builds Debug. Signing is what remains, and the keystore password is the user's to hold.
