Liminal Suite v2.0.1

All notable Liminal Suite Android changes are documented here. Release notes for versions before source control was initialized were reconstructed from the archived signed APKs and the development record.

• Scans the official release list for the newest stable Liminal-Suite-v2…apk instead of relying on GitHub's single cross-generation “latest” pointer.
• Keeps v1.15.18 as the legacy package's latest migration bridge while Liminal 2 independently discovers current v2 releases from the same public binary repository.
• Skips draft, prerelease, legacy-package, and unrelated assets before showing an update, preserving exact package/signer verification after download.

Liminal Suite v2.0.0

All notable Liminal Suite Android changes are documented here. Release notes for versions before source control was initialized were reconstructed from the archived signed APKs and the development record.

• Moves Liminal Suite to the permanent io.massdex.liminal application ID, Java namespace, component names, package-scoped actions, tiles, receivers, services, diagnostics, and updater verification under the massdex.io product identity.
• Uses a new product-specific signing identity. This is a side-by-side manual installation, not an in-place update from the legacy app.veil.standby package; all historical releases and the legacy signing identity remain intact.
• Imports the explicit v1.15.18 migration archive for preferences, schedules, appearance choices, and completed local usage history while resetting every live utility/runtime state to a safe stopped state.
• Requires Android-controlled permissions, Accessibility, battery/launch management, exact alarms, Quick Settings tiles, widgets, and special access to be enabled again for the new package after import.
• Restricts future in-app updates to exact Liminal-Suite-v2…apk assets whose package is io.massdex.liminal and whose signing certificate matches the installed v2 app; legacy APKs and unrelated assets fail closed.

Liminal Suite v1.15.18

All notable Liminal Suite Android changes are documented here. Release notes for versions before source control was initialized were reconstructed from the archived signed APKs and the development record.

• Adds an explicit, user-controlled settings export for the move from the legacy app.veil.standby Android identity to Liminal 2 under io.massdex.liminal.
• Transfers preferences, schedules, appearance choices, and completed local usage history while deliberately excluding active overlays, wake-lock state, temporary authentication windows, screen/DND restoration state, and updater downloads.
• Documents the side-by-side migration sequence and the Android-controlled permissions, tiles, widgets, battery management, and exact-alarm access that must be enabled again for the new installation.
• Separates the legacy and Liminal 2 updater asset families so this legacy package never presents the new-package APK as an in-place update.

Liminal Suite v1.15.17

• Moves the in-app update check and release-history feed to the renamed massdex/liminal-android-releases repository while preserving automatic upgrades from v1.15.16 through GitHub's verified repository redirect.
• Restricts accepted update assets to Liminal's exact canonical GitHub release-download path instead of trusting an APK from any GitHub repository.
• Validates release-page links as well as APK links and rejects lookalike owners, repositories, malformed paths, credentials, queries, fragments, and non-HTTPS addresses.
• Updates source, release, security, and publishing documentation to the massdex GitHub identity without changing Liminal's Android application ID or signing identity.

Liminal Suite v1.15.16

• Adds a professional safety-curtain message by default whenever Android cannot restore Gaze's protected app. It explains what happened, confirms that the screen and touches remain protected, and gives the exact configured escape route, including the optional volume-key path when enabled.
• Stages Home/Overview recovery behind one short-lived black activity so Android can finish its reserved system gesture before Liminal brings the existing protected task forward. Recovery uses only two fixed launches and one terminal deadline; it has no polling, repeating handler, watchdog, or background retry loop.
• Treats an accepted task return as success even when Android emits no redundant accessibility event for an already-resumed protected task. A rejected or unavailable target enters the fail-secure curtain without disabling Gaze or locking the device.
• Prevents launcher events exposed while the recovery activity closes from arming another generation after the safety curtain is active, eliminating recovery loops while preserving Gaze's normal authenticated dismissal controls.

Liminal Suite v1.15.15

• Replaces Gaze's fail-open terminal recovery with a fail-secure safety curtain. If Android cannot relaunch the protected app, Gaze remains active and its existing touch-lock overlay turns solid black, blocking both interaction and view without locking the device.
• Keeps the ordinary Gaze dismissal routes available beneath the safety curtain: bottom-hold authentication, the configured volume-key shortcut, and the authenticated upward dismissal gesture continue to work, avoiding both an exposed phone and an unlock/relock loop.
• Aligns Dusk's Quick Settings click path with Ember: the live tile renders the accepted state before persistence, service, notification, or history work; preference persistence no longer performs a blocking disk commit; and a tile click never requests a redundant SystemUI rebind.
• Coalesces external Dusk tile refreshes to one 40 ms listening request and publishes actual compositor attachment directly to a currently open tile, reducing the first-click delay observed after rapid Ember use without adding polling or background work.

Liminal Suite v1.15.14

• Removes Gaze's device-lock fallback, which could create an unlock/Home/relock loop on OEM launchers. Gaze still shields the system transition, uses Back once for a confirmed Overview surface, makes two bounded attempts to restore the protected app, and finishes with one final task return. Gaze stays active when Android accepts that return; it safely lifts itself only when the protected app is no longer launchable.
• Persists Gaze OFF before the safety release so subsequent launcher events cannot arm another recovery while the overlay is stopping. An internal stop fallback still tears down the overlay if an OEM rejects the normal service handoff.
• Makes Dusk publish compositor attachment and teardown directly to the currently listening Quick Settings tile. A tile press renders its accepted state immediately, while real startup success, pending activation, failure, and shutdown replace that optimistic state without polling.
• Retains Dusk's input-free trusted compositor, including working GitHub sign-in and Google account-switcher touches, and leaves Ember's now-responsive runtime and tile path unchanged.

Liminal Suite v1.15.13

• Replaces Dusk's Android 14+ window overlay with a raw accessibility display surface that has no input window or touch channel, keeping obscured-touch-protected controls such as GitHub sign-in and Google account selection usable. Android 13 and earlier retain the trusted accessibility-overlay route; the standard overlay is now an explicitly diagnosed compatibility fallback.
• Makes Dusk compositor state truthful across diagnostics, Home, Quick Settings, capsule, widgets, and popups. Requested-but-unattached Dusk is shown as Pending with a Cancel action instead of being reported as active, and trusted Dusk no longer requires Display over other apps permission.
• Hardens Dusk's service lifecycle against stale commands, sticky restarts, rapid off/on fades, compositor loss, and Android 12?15 foreground-service restrictions. Scheduled starts use an exact user boundary only when Android grants access; otherwise Liminal offers an explicit user-approved activation notification.
• Moves Dusk fades to compositor alpha transactions, redraws its full-screen buffer only when filter content or display geometry changes, and coalesces settings-slider updates to 50 ms with an immediate final-value flush.
• Gives Ember one authoritative desired/runtime state machine. Stale service commands cannot resurrect or extinguish a newer request, older stop callbacks cannot cancel a newer start, and passive Quick Settings binding never launches a foreground service or changes the saved request.
• Distinguishes a live Ember wake lock from an interrupted requested session everywhere. The app, tile, capsule, widgets, and popups now show Interrupted ? Restore when an OEM has reclaimed the runtime, and one explicit tap restores it without first toggling Ember off.
• Removes the tile-click backlog that caused delayed or ignored Ember presses: desired-state writes are asynchronous, external tile refreshes are coalesced, session/history work runs on a short-lived background executor, and the real wake-lock acquisition/release publishes one final synchronized state update.
• Adds a bounded Gaze navigation recovery state machine. Android reserves Home and recent-app gestures from ordinary apps, so Gaze now immediately shields the transition, makes two fixed task-restore attempts, and locks the device if it cannot confirm a safe return instead of falsely claiming it can consume the system gesture.
• Prevents stale Veil/Gaze refresh or authentication intents from recreating an overlay or leaving a detached service alive, and skips unnecessary accessibility policy work while both touch-blocking utilities are inactive.
• Expands regression coverage to 70 focused unit cases for Dusk compositor/automation/runtime policy, Ember runtime/tile convergence, Gaze recovery deadlines, Veil command reconciliation, unlock/swipe behavior, update verification, history bounds, icons, and device-power routing.

Liminal Suite v1.15.12

Trusted Dusk touches and full runtime hardening

• Dusk now uses a trusted, non-touchable Accessibility overlay when Liminal Suite accessibility is enabled, so protected controls such as GitHub sign-in and Google account choosers remain tappable. The standard low-opacity overlay remains as a diagnosed fallback.
• The Accessibility service is now named Liminal Suite and explains the precise Veil, Gaze, and Dusk roles; it still cannot retrieve, read, or store screen content. Ember does not use it.
• Locked Gaze now intercepts the bottom navigation edge, shields any brief Recents/Home transition, and restores the protected task with bounded event-driven recovery.
• Ember's Quick Settings tile now follows app, capsule, widget, popup, service, and tile state; every selected on/off icon pair is redrawn from committed state, with one bounded MagicOS settle retry.
• Ember's direct-app reliability warning can be reviewed, rechecked, confirmed, or durably ignored. Tile, capsule, widget, and popup activation do not show it.
• Permanent reliability polling was removed. Ember verifies on relevant events; Dusk schedules only its next boundary; visible UI listeners and updater polling are lifecycle-scoped.
• Tab pages, widgets, launcher shortcuts, dropdowns, diagnostics, and setup rendering were refined for lower overhead and greater stability.

Verification

• Package: app.veil.standby
• Version: 1.15.12 (43)
• Unit tests: 36 passed, 0 failed
• Android lint: 0 errors
• Debug and release assembly: passed (88 tasks executed)
• Protected-touch runtime matrix: trusted ordinary/protected passed; fallback ordinary passed and protected rejection reproduced; reconnect passed
• Ember runtime matrix: app, tile, and capsule on/off synchronization passed; all four icon families checked
• Gaze runtime matrix: bottom navigation recovery returned to the protected task; opaque recovery shield prevents interaction during the bounded handoff
• APK alignment: verified
• APK signature: v2/v3 verified
• Signing certificate SHA-256: 918c80a2cc5ed5ab7d4aeffca51d5d28256beecef7dcf73df997f50af47fbf73
• APK SHA-256: 32e3da6d02553c0c717dac4130afb63b1fd705fa3d40e3586a4b7718dc0fec77

Liminal Suite v1.15.11

Ember tile parity and Gaze navigation guard

• Ember's Quick Settings interaction now follows the working Dusk tile path: explicit show/dismiss actions and a side-effect-free state renderer.
• Service recovery and dynamic runtime icon replacement no longer run from inside Ember's tile update, preventing re-entrant MagicOS tile updates.
• Locked Gaze now uses the existing optional Accessibility permission to immediately close launcher/recents surfaces that temporarily rise above Android overlay windows.
• The navigation guard yields during Gaze's authenticated dismissal window and does not affect ordinary apps or Veil mode.
• Gaze's bottom hint, accessibility description, and overlay window title now identify Gaze correctly instead of saying Veil.

Verification

• Package: app.veil.standby
• Version: 1.15.11 (42)
• Unit tests: 30 passed
• Android lint: passed
• Debug and release assembly: passed
• APK alignment: verified
• APK signature: v2/v3 verified
• Signing certificate SHA-256: 918c80a2cc5ed5ab7d4aeffca51d5d28256beecef7dcf73df997f50af47fbf73
• APK SHA-256: 9e38f9453cc5bd1ea383e882c789a2bf41467dfc61c227c279c2cc25f4c8b91c