I wrote up every permission the app asks for, reading them back out of the built package rather than off the source manifest. That is the only version a reader can check, and it caught something the source would not have.
Three of the network permissions are unexercisable. Not “probably unused” — there are four places in the whole app that ask the system for a service, and none of them is the one those permissions gate. The reason written beside them has been stale for a while.
They stay, named as dead, because dropping a permission out of a shipped app deserves its own decision record, not a silent edit.
Then I proved the audit can fail: a deliberately tampered copy, with a hostname and a boat name planted in it, tripped all six checks. An audit that has only ever passed has told you nothing.