What happened
OuranoOS declared Android permissions it did not need. They were deleted from AndroidManifest.xml. The next release bundle contained exactly the same permissions as before (checked 2 September 2026).
Why
Android merges the app's manifest with every dependency's manifest. A plugin that declares a permission reinjects it during the merge. Deleting the line in the app's manifest removes the app's request for the permission, not the plugin's.
Finding the culprit
build/app/outputs/logs/manifest-merger-release-report.txt
grep -A3 "uses-permission#android.permission.X" names the module: ADDED from [:plugin_name].
Real cases in OuranoOS: a file-opening plugin declared READ_MEDIA_IMAGES/VIDEO/AUDIO (unneeded when files open from the app's private directory through its own provider); a camera plugin declared RECORD_AUDIO (unneeded for still capture).
Removing it for real
In the app's manifest, with the tools namespace declared:
<uses-permission android:name="android.permission.X" tools:node="remove" />
Verifying
On the built bundle, not the source: extract the merged manifest from the AAB and read the permission list. The ecosystem's release scripts now do this, because the source manifest is not what ships.
The general form
This is the same shape as Engineering Notes #5: a change to the source that the build silently overrides. The check belongs on the artefact.
From the OuranoOS release preparation, 2026-09-02.