Premium multi-device grants: when an admin grants more than one device slot (for example 30 devices), the server no longer lets a stale single-device app-binding check override the approved device list. The same Google account can use the granted device count without the macro runtime stopping with "Security check failed. Runtime was blocked."; real over-limit, blocked-device, expired, revoked, or unapproved-device cases still fail closed.
Admin panel: the premium grant form now includes the device-limit field and applies the requested limit in the same confirmation flow, so an intended "99 days + 30 devices" grant cannot silently remain at 1/1 because the separate device-limit save step was missed.
Premium profile stability: premium duration and device limit granted from the admin panel are now written in the same backend transaction. This prevents a successful-looking grant from keeping the old device limit, producing binding denials on extra devices, and making Premium appear/disappear on the profile screen.
Backend entitlement coverage: checkEntitlement and heartbeat now have a regression contract for multi-device admin grants, and the existing admin-device-limit, Play-billing device-limit, and badge-only entitlement contracts still pass.
Work-area adaptation: Macro Settings now includes an "Adapt to this device" action; macros can rebase to the current resolution/DPI without manually clearing the source profile, while no-code click and region coordinates preserve their real screen positions.
Control-panel work-area safety: when the overlay work-area profile is changed, project coordinates are persisted before the profile is written, so a save failure cannot leave the macro split between old coordinates and a new reference profile.
Overlay work-area adaptation is hardened: imported macros without an explicit work area now rebase to the full target device screen by default in Change Work Area, while users can still narrow the area deliberately. Even when an old/imported macro still says orientation auto, the target orientation is inferred from the source reference ratio; region/target coordinates left behind in the portrait axis by an earlier bad save are repaired to the full landscape device profile. A Xiaomi 2772x1280 screen / 1280x720 source-profile regression test preserves clicks, regions, and image-search scaling as if the macro was authored on the new resolution; raw rebase class names stay hidden and open no-code save failures stop the profile write.
Macro Settings rebase stability: fixed the Android-ICU regex issue that stopped work-area adaptation before coordinate math and showed "Save failed: rebase"; on Xiaomi devices, "Adapt to this device" now runs without the rebase class-load failure. The same action no longer triggers the global Save/scheduled-trigger flow, no longer shows the scheduled-trigger saved toast, and keeps Macro Settings open.
Control-panel helper rail: while the main control panel is dragged, the helper rail is synchronously locked to the main rail on every movement frame, removing the temporary right-side gap that appeared until the drag was released.
Public macro sharing: public macro payloads now carry the reference resolution, DPI, coordinate mode, and game-area ratios; gallery import and version refresh write that profile back, reducing no-code coordinate drift on different devices.
Workspace adaptation accuracy: 'Adapt to this device' and the control-panel workspace change now rebase coordinates through the exact viewport the runtime executes (including the implicit aspect-fit letterbox), fixing off-center click/region drift on devices with a different aspect ratio. Macros without an explicit work area stay adaptive (implicit) after adapting, and Save/Reset with a full-screen selection no longer locks future cross-aspect runs into stretch mode.
Image search survives adaptation: resolution changes and adaptation from Macro Settings now stamp legacy image templates with their capture-time profile first (matching the control-panel path), so old metadata-less templates are no longer searched at the wrong scale after adapting.
Script (Lua) macros protected: saving or adapting with blank fields on a macro without a visual workspace no longer overwrites the declared reference resolution with device values - script coordinates keep auto-scaling at runtime; an explicitly typed resolution is still honored as a deliberate re-declaration.
Stability and sharing fixes: healthy landscape macros can no longer be mis-'repaired' as swapped on a plain save (the default touch entry present on every block no longer pollutes the measurement); the control-panel workspace change is safely refused while the no-code editor is open or crashed with unrecovered work; the helper rail no longer stays misaligned after a panel drag ends; human-like landing (jitter) padding now scales with adaptation; updating a forum macro from an older app version no longer strips the shared reference profile, and a corrupt stored profile no longer blocks macro download.
Forum macro sharing now carries image templates with the macro: on publish, template files (bounded: max 16 templates / 1.5 MB total) are uploaded to secure storage and rebuilt on the importer's device with the same names and their capture-time profile. Public macros with image blocks no longer come back empty with 'image not found' on another device, and updating a macro from an older app version does not strip the stored template set.
Multi-display fixes: coordinate mapping, screenshots, and touch dispatch now share the same target display geometry (secondary-display scenarios on emulators/cloud phones/foldables); moving the control panel to a secondary display stamps workspace profiles with that display's resolution/DPI; nested macro calls (Macro.runWait) get the live game-area resolver too; a half-corrupt reference profile is now completed with the full device profile.
Workspace changes are crash-resilient: project/profile writes are protected by an AtomicFile recovery journal carrying UUID/generation, SHA-256 checksum, and before/after project fingerprints. Recovery recomputes the exact canonical expected-after fingerprint from the persisted rebased project; an unrelated or newer writer causes PROJECT_STATE_MISMATCH instead of being overwritten. Corrupt journal, IO, or profile-commit failures block unsafe continuation, and the previous profile is restored after commit failure.
Full-screen consistency: the code editor and no-code workspace opened from a macro card on the home screen now open full-screen just like the ones opened from the control panel (the status bar and the dead band at the top are gone). The keyboard no longer clips the editor (soft-input resize is preserved), only the real physical display cutout is padded, and full-screen survives rotation and returning from a picker/dialog.
Android 9 and 10 full-screen compatibility: overlays, pickers, galleries, and MH-AI panels apply SHORT_EDGES cutout behavior on API 28-29 and ALWAYS on Android 11+ through one shared helper. Android 7-8 never touch the unsupported cutout API, and physically anchored left/right controls are not incorrectly mirrored in RTL.
Google sign-in: Credential Manager's real 'no eligible Google account on this device' outcome is now distinct from provider failures. A no-account result is recorded at info level and opens the safe fallback sign-in path; genuine credential errors are no longer silently masked as if no account existed.
No-code block infrastructure: structural parity across enum, registry, generator, validator, and documentation is enforced for all 71 registered block types. The versioned v2 field contract closes persisted editor bindings under an explicit schema: unknown or runtime-unconsumed fields are rejected instead of receiving a default binding, with only narrow block-aware dynamic field patterns allowed.
No-code variable and flow fixes: dialog result and outcome variables now use the correct scope; Retry and Wait Until Found match outputs remain available outside their branches; Track Target drift/lost-frame bounds and raw WebSocket, Collection, Map, Event, Run Macro, and Math modes are aligned between validation and code generation.
MH Visual Decision: Pixel Difference and Color Difference now measure real temporal change between consecutive frames instead of contrast between cells in one frame. The baseline resets when region or grid geometry changes, and every cell uses a 5x5 stratified sample in one bulk screen read. AI, BYO, and Hybrid failures stay fail-closed, target coordinates are normalized, and the editor shows only settings used by the selected mode.
Screen capture: MediaProjection is mandatory on Android 7-10 and primary on Android 11+. An extremely low-information projection frame receives one bounded same-moment Accessibility comparison and switches only to a materially richer frame. If both are low-information, a valid dark frame is preserved while a once-per-episode diagnostic warning and metric are emitted. Fail-closed applies only when an earlier rich Accessibility frame proved the projection blank and the next cross-check is inconclusive. This hardening does not claim to add capture support for game or app surfaces that do not expose usable frames through supported Android capture paths.
Scanning memory ownership was hardened: bitmap lease/recycle leaks were closed across screenshot, live-preview, and MH-AI OCR/image/color paths, and the frame cache is bounded. Low-contrast exact-crop image matching recovery and the Math cache namespace collision were fixed.
OCR stop and resource control: Tesseract work is bounded to two workers and two queued entries; a session-scoped cancellation controller issues one stop across before-start, native-running, and result-race windows, while the worker recycles transferred bitmaps. JVM contracts are verified; native-device cancellation latency and corpus certification remain separate open release evidence.
Public macro import/update is crash-transactional: script, encrypted script, image templates, visual project/profile, and guides are staged behind a durable UUID journal; bounded fingerprints and rollback preserve the prior generation. Durable/ephemeral transaction-marker state is tri-state and fails closed when ambiguous. For presentation media, null preserves, explicit blank clears, and a value applies; Library hydration follows the same rule. Gallery/list hydration uses IO+Mutex with generation guards and never mutates script, installed version, or execution state.
Community/backend reliability: immediate FCM dispatch now uses a stable requestId/fingerprint transaction fence, and report terminal state is re-read inside its transaction. Block lists are capped at 500 with a cursor contract; a server-only identity presentation projection, O(1) direct-share quota aggregate, and a 24-hour/cursor-bounded unknown Storage orphan sweep reduce read and retention pressure.
Blocked-user management: Android Activity/ForumFragment and web Forum/ForumTopic/modal now consume 50-entry pageSize/cursor/nextCursor/hasMore pages. Full blocked IDs remain available for feed filtering while details render as real pages without fabricated 'Unknown user' rows. Single-flight, dedupe, load-more/retry/end states, cursor reset after unblock, and stale owner/request rejection are locally verified; no known first-page-only web consumer remains. Live Firebase/browser E2E remains open.
Website performance and product claims: Visual Guide documentation is split into 10 lazy groups, runtime locale chunks load by route, and the navbar logo is about 97% smaller; the real bundle budget measures large content and locale pieces. OCR copy now states that 70 routing codes map to 7 recognizer families instead of presenting them as 70 independently accuracy-certified models.
Localization generation: the Android runtime translation generator preserves format-placeholder multisets, isolates invalid translations for retry and safe source fallback, and restores newline/tab tokens as real characters without double escaping. Bundled release notes now follow the selected app language across all 14 locales, Turkish copy uses native UTF-8 characters instead of ASCII transliteration, and user-facing package examples use neutral target-app placeholders. Key parity, encoding, item-count, and stale-fallback gates now protect the complete release history; native-language review remains an explicit quality gate.
LuaJ/native Lua parity was strengthened for Request, Setting, pointer, RUN_MACRO, and NOTIFY_WEBHOOK. Both Lua code editors now share a responsive, theme-aware 48dp scroll rail that supports touch, mouse, stylus, wheel, keyboard, and accessibility across low/high DPI, compact landscape screens, and RTL app languages. Concurrent saves are serialized, Activity/overlay session ownership is enforced, only the active macro can publish the live script, and the first Undo returns to the loaded baseline. Large-file search is bounded and cancellable, while line-number formatting runs off the UI thread.
No-code landscape editing: Copy and Paste are now distinct, labeled 48dp actions; Paste appears immediately after a copy and stays bound to the correct action when selection or orientation changes.
Code Vault startup, text ingress, and recovery are safer: a reused launch intent cannot bypass the active load gate; BOM-aware strict UTF-8/UTF-16 decoding normalizes line endings and rejects malformed, binary, or oversized content without partial insertion; provider-backed clipboard and document reads run outside the UI thread with stale-result guards. Unreadable drafts and unsafe macro/package paths fail closed. Save & Close waits for durable persistence, a failed save keeps the overlay editor open, and Discard reverses any racing autosave. Back and primary controls retain reliable 48dp accessibility targets.
No-code field edits now participate consistently in Undo and debounced autosave across OCR, system waits, Run Macro, group calls, Try/Catch, For Each, webhooks, and image/color targets; transient search fields do not dirty the project.
Replay editing no longer reads or rewrites recordings on the UI thread: payloads are capped at 4 MiB, saved atomically, show loading/error states, and reject stale panel or project results without replacing the last valid recording.
The control panel becomes non-touchable at zero opacity so an invisible overlay cannot intercept the game. Mirrored displays keep farm-dim/humanize action parity, while scaled primary actions use a bounded minimum-48dp touch router.
Touch-recording serialization and file export now run off the overlay UI thread, reducing pauses when a recording is finished.
Rotation now preserves ordinary in-progress text in centered no-code editor panels. Password/API-key inputs and unknown or transient picker/search fields remain intentionally excluded from restoration and fail closed.
The OCR Value block now distinguishes a real numeric zero from empty, non-numeric, and read-error results. Its legacy numeric output remains compatible while raw text, success, and status variables are exposed; a failed read never compares as a legitimate zero or crashes the macro.
Image, color, text, OCR, popup, and scan-engine fields persist exactly once for a real semantic change, while re-entering the same value creates no redundant autosave or Undo entry. Unknown or unsupported multi-target strategies fail closed in validation and code generation.
Replay recording preserves monotonic timing, historical motion samples, and dense multi-pointer identity; long MOVE streams are bounded to 2,048 points with gesture-safe decimation. Pause or Stop drains active fingers safely, and the event editor maps a picked screen point through the recording's true reference space.
The gallery image editor conflates rapid slider input through a 64 ms latest-only preview pipeline, rejects stale panel work by generation, and caps processing resolution on low-RAM devices. PNG/JPG/JPEG name conflicts, interrupted writes, and old-source deletion failure are protected by one transaction, AtomicFile recovery, and rollback.
Contextual help is now complete across eligible surfaces: no-code block-header actions, block value labels, expanded-field buttons, variable/dialog/Replay/gallery/image-color tools, Dashboard actions, Code Editor controls, and all 12 control-panel actions open concise instructional guidance on long press. Normal taps, selection, drag, text editing, and specialized long-press behavior remain intact.
The block-details arrow still opens or closes values on a normal tap; its first hold stage persistently toggles fast tap-to-open/close mode for no-code block cards, and help opens only if the hold continues. Code Editor and control-panel controls with existing long-press actions likewise preserve their practical first action and show guidance only on a continued hold.
The help-panel UI now scales as one responsive system: panel, body text, touch target, visible close-button size, and X icon stay proportionate on low/high DPI, narrow screens, and portrait/landscape layouts. All 14 app languages and 8 theme profiles apply live, while status and navigation bars remain hidden when help opens or closes over the immersive no-code workspace or Code Editor.
No-code screen-guide lifecycle: when a guide surface is detached, its state is transferred to a fresh surface instead of reattaching the old view; close, reopen, and mirror-reference cleanup also complete safely. This addresses the reported WindowManager retention path for detached guide views.
MH-AI provider truthfulness: when the selected cloud provider cannot answer because of a 401/429, network, model, or readiness failure, the verified local fallback is no longer recorded or labeled as a cloud response. A cloud key becomes live-verified only after a real provider response.
MH-AI no-code write safety: loops, branches, recovery, human-in-loop, retries, and non-linear graphs are no longer flattened into COMMENT blocks and applied as if executable. Unrepresentable graphs fail closed before approval, and the host writer preserves the existing project when an unknown or unsupported executable block reaches its boundary.
MH-AI Observe & Learn coordinate safety: capture-time raw tap pixels are no longer silently converted into click-on-match blocks. Until screen, target-display, rotation, and game-area provenance can map them safely into the macro reference profile, no-code approval and host writes fail closed without replacing the existing workspace.
No-code workspace launch: Dashboard now shows a localized loading surface on the first frame, turns disk-load/build failures into an explicit safe recovery message instead of a blank screen, and coalesces rapid taps into one launch. The control panel distinguishes IDLE, LOADING, OPEN, and FAILED, so a second tap while loading no longer cancels the workspace.
Replay editor layout: the short asynchronous loading row no longer fixes the window to a tiny height; the main editor and event editor fill the available screen. Move up/down, edit, delete, and Pick from screen flows mapped through the recording's true coordinate space remain reachable instead of being hidden in a collapsed panel.
Legal agreements and release notes now use one responsive, theme-aware fast-scroll rail: its thumb can be grabbed or the track can be pressed with mouse, touch, or stylus across low/high DPI, while keyboard and accessibility range actions remain available. The shared rail covers onboarding legal pages, Settings legal documents, single and multi-release dialogs, and the News release-notes feed; native duplicate scrollbars are removed and listeners detach with their host. Dialog height still reserves the measured header and Got it footer, so the confirmation action remains visible on short landscape screens.
No-code block clipboard: after blocks are copied, the green Paste action again uses the standard bag/clipboard paste glyph while retaining its dedicated selection-paste label and green state tint.
Dashboard edge rails: the selected macro's right action bar rounds only its inward-facing left corners, while bottom navigation rounds only its top corners. The attached right and bottom corners stay square; their outer border segments are omitted, removing the thin seam at the display edge. Both rails share one gradient, border, and all 8 theme profiles, preserving the edge-docked look through live theme changes, different DPI/orientations, and safe-area insets.
Guide entry points were clarified: the Dashboard guide entry now opens the saved guide in reader mode, while the guide editor is available beside Export in Macro Settings. Secret-protected macros keep the existing password/admin gate before their guide can be viewed, and both actions retain localized long-press help across all 14 app languages.
Release metadata: the Android app version is advanced to 1.0.37 / versionCode 50 so the app build, in-app changelog, website changelog, and local Google Play text identify the same current release.
1.0.37 release notes are synchronized across the in-app changelog, the web changelog source, and the local Google Play text; Play Console publication is outside this local synchronization claim.
Community sharing and publishing: Shared, Forum, and Public Macros now use the same full-screen, theme-aware panel structure, with a visible close button, accessible selection controls without checkmark icons, and high-contrast text in both selected and unselected states. Editing a forum topic preserves contact visibility unless the user changes it, and removing its thumbnail is handled as an explicit update. Public no-code macro submissions above the 500,000-character visual-project limit are rejected before saving; retries of the same operation reuse one record, and client/server publication durations match from 1 to 30 days.
Community sharing security and resilience: public visual macros are bound to locale-independent code regenerated from the carried no-code project and are locally rescanned before import or version refresh, so a harmless supplied script cannot conceal sensitive visual blocks. Public create and update retries retain a stable operation identity; reusing it with a different payload is rejected, media generations remain unique, and the combined Firestore payload is UTF-8-byte-bounded before Storage work. Oversized, malformed, missing, or truncated scripts, guides, configurations, visual projects, thumbnails, and carried templates fail closed on upload and download; image decoding is dimension-bounded and sampled. Template-upload confirmation now uses the shared themed dialog, a visible close action, and a responsive maximum width. Direct-share reauthentication preserves the remaining recipients and completes counters only after a confirmed result. Forum macro attachments deduplicate by deterministic identity without confusing distinct macros that share a name. Share and forum forms freeze mutable state during active work, reject blank durations and duplicate panels, and use responsive draggable scroll rails across themes and DPI levels. On Android 9 and low-DPI devices, the rail bypasses the unsafe native-scrollbar fade-cache path, preventing the observed platform null-pointer crash.
Universal contextual guidance: standard actions across the app, control panel, galleries, both code-editor entry points, no-code workspace, dialogs, popup panels, and dynamic lists now open concise, task-specific help on press and hold. Controls that already use hold for drag, repeat, selection, rename, or quick toggle preserve their primary behavior and expose Help through a conflict-safe second stage or accessibility action. Help resolves the active language at open time in all 14 locales, follows all eight theme profiles, preserves immersive system bars, and stays bounded across low/high DPI, portrait, and landscape screens.
No-code workspace and control-panel polish: all 71 blocks now have resource-backed guidance in 14 languages, including eight corrected descriptions, with tested contrast across all 8 themes. Legacy unnamed dialog pages resolve live-localized defaults without overwriting explicit names; reference-variable descriptions follow the active language, and code generation uses stable language-neutral ordinals. Safe open panels and the workspace repaint immediately on theme changes without losing gallery tone; accessibility labels and service or permission notifications follow the selected language. Safe minimized, expanded, subpanel, code-chooser, and editor-hidden state survives theme or language rebuilds without reopening temporary game-area or MH-AI panels. A dragged control-panel position is saved once on release, restored only on the same display, clamped to cutout-safe bounds, and not overwritten by rotation. Within the no-code workspace, the right action rail now uses a cleaner, simpler surface; the block-card visibility, rename, and details controls use equal spacing; and tapping outside inline block-name editing saves the name and closes the editor. In landscape, the main workspace's left and right action rails now start flush at the same top edge used by group and action views, with no stacked top inset; portrait spacing and bottom safe-area separation remain unchanged.
MH-AI no-code planning: internal runtime bookkeeping no longer re-enters the planning prompt, so simple requests such as click-then-wait now select representable visual blocks instead of an unsupported Lua action. Graphs that the no-code workspace cannot represent continue to fail closed without replacing the existing project.
Cross-device macro portability: JSON Flow and Lua now refresh the live target-display size and game area on phones, tablets, and secondary displays. Match-derived click, touch, and swipe coordinates are mapped exactly once; no-code panel/HUD and dialog-picked coordinates, coordinate variables, movement/drift thresholds, replay random radius, and template profile/DPI metadata remain in the correct reference space. Adapt to this device and Change Work Area preserve aspect-fit behavior and fail closed before mutating script-only, missing-workspace, or incomplete template/profile data.
Release-note stability hardening: startup, Settings, and News now render each localized bullet as one accessible, theme-aware text row instead of a three-view nested hierarchy. The complete 1.0.37 catalog therefore stays inside a bounded view budget on low-memory and low/high-DPI devices while preserving TalkBack, RTL layout, and all 14 languages. Untrusted live text is capped before it reaches the snapshot cache, and the bundled catalog is parsed only once even when startup, Settings, and News request it at the same time; localized footer actions grow with font scale.
Premium regrant reliability: revoking and then regranting Premium to the same account now clears every revocation marker in the same atomic entitlement write. Server checks, Android, community permissions, and the admin list therefore agree on the active state; delayed custom-claim retries resolve the current entitlement instead of replaying an older grant/revoke command.
Contextual help and web learning center: press-and-hold help now explains each button's real purpose, usage steps, and cautions instead of repeating one generic paragraph for Home, Language, Send Gift, Premium subscription, gallery, and editor actions. Send Gift help explicitly covers a registered recipient email, one month of Premium and Badge, Google Play confirmation, the no-self-gift rule, and delivery after verification. Automatic generic coverage remains only as a safe fallback that authored help can replace. Open guide preserves the selected language and routes directly to the correct /learn topic in all 14 languages; desktop and mobile layouts, light and dark themes, search, category navigation, and parity across all 181 Android-web help keys are regression-tested.
Dashboard edge transitions: the bottom navigation bar keeps its upper/inner edge defined while the surface fades toward the device bottom; the selected macro's right action rail keeps its left/inner edge defined while its shadow fades toward the device right. Edge-attached outer sides no longer expose a seam line. The directional edge treatment remains consistent across all eight theme profiles, low/high DPI, and orientation changes.
Android 11 window and document-viewer stability: when release notes, agreements, or the app guide close, their WebView now leaves the host window before it is safely closed once on the main thread. If Android's WebView rendering process stops unexpectedly, the app switches to local content or safely closes the affected screen. This lowers the chance of overlapping renderer cleanup and rare no-focused-window ANRs during screen transitions.
Direct user-to-user macro sharing now uses the same centered, adaptive composition panel as forum topic creation and public macro publishing. Its width is capped at 640dp on wider screens and uses the available width on smaller displays, without changing sharing behavior.
Immersive editor continuity: the no-code workspace, both Code Editor entry points, MH-AI, contextual help, and their child dialogs and popups now seed full-screen system UI before attachment and restore it synchronously across focus changes. Opening a panel no longer exposes a one-frame status/navigation-bar flash; text input, keyboard, Back handling, and theme/language state remain intact.
No-code block deletion feedback: deleting a block now shows a compact, theme-aware Undo notification with responsive sizing, clear contrast, and a stable touch target across supported resolutions and DPI levels. Undo restores the removed block without interrupting the full-screen workspace.
Performance-aware panel motion: contextual Help, Dashboard, Settings, Code Vault, Forum, and safe no-code popup/modal surfaces now use one lightweight entrance system with short alpha, translation, or scale motion instead of repeated or manufacturer-dependent effects. It respects the system animator preference; low-RAM and battery-saver devices fall back to a brief fade. Critical WindowManager close, rehost, and screen-capture paths remain immediate and unanimated, preserving focus, keyboard, full-screen, and lifecycle safety across supported Android versions. Dashboard notification history now marks only the snapshot that was actually rendered as read; notifications arriving while the panel opens keep their badge, and cached history is parsed once before motion starts so a second JSON parse cannot compete with the first animation frame.
Settings language selector: all 14 interface languages now remain reachable inside a screen-bounded scrollable popup on short, landscape, low/high-DPI, and split-screen layouts. The panel provides a visible scrollbar and supports touch drag, mouse wheel, keyboard, and accessibility scrolling; reopening brings the current language into view, and closing Settings releases the popup safely.
Dashboard macro persistence: a temporarily unreadable encrypted macro registry no longer makes newly created macros disappear after a full app restart. The Dashboard preserves the last visible list and retries with bounded backoff without depending on screen-capture permission; interrupted registry writes restore the previous committed copy, and delete operations fail closed until the registry is readable. New-macro creation rolls back the registry if its script, project, icon, or profile cannot be persisted. Encryption-key persistence and mixed recovery payloads are verified before commit, and malformed or plaintext inner branches fail closed.
Community compose backdrop: New Topic and Public Macro Share now keep the underlying Forum or Public Macros page visible behind the panel with the same controlled dimming as direct user-to-user macro sharing. All three panels use one explicitly defined modal scrim while preserving content contrast, scrolling, close behavior, theme styling, and DPI-adaptive sizing.
Direct macro sharing reliability and complete history: uploads now publish immutable Firestore/Storage payload generations and switch the live pointer only after every byte is ready, so an interrupted update cannot corrupt the previous share. Exact retries, accept, dismiss, owner revoke, and administrator delete are idempotent; expired rows stay hidden. Cursor paging lets Android load more than 50 received or sent shares with bounded progress checks, and the eight-recipient mobile batch limit now matches the server.
Forum transaction safety: account-scoped Android caches and route-, account-, and cursor-guarded web requests prevent stale or late content from appearing for the wrong user. Topic and reply creation, topic editing, voting, owner deletion, reply moderation, topic approval/rejection/pinning/deletion, and report resolution validate an operation ID and expected state inside transactions; an ACK loss or concurrent retry cannot create a second record, counter, trust-score update, moderation-history entry, or audit cost.
Public Macros and Firebase cost control: owner/administrator deletion, approval/rejection, votes, comments, and report resolution use transaction-bound operation IDs and expected state/version checks. Deleted or hidden comments cannot create new reports; same-vote and replay requests complete without writes. Bounded cursors, aggregation quotas, TTL receipts, low Functions instance ceilings, and a synchronized index manifest reduce unnecessary Firestore reads/writes, duplicate audit records, and uncontrolled backend growth.
Google Play purchase and gift reliability: Premium and Badge purchases automatically reconnect Billing, recover owned products after an interrupted checkout, and activate entitlement only after server verification. A one-month Premium/Badge gift is bound to a short-lived, immutable server recipient intent instead of a mutable email or client-derived profile; paid pending gifts remain only in encrypted recovery storage and retry safely after an app restart. Server-side idempotency, contribution records, and refund/void reconciliation preserve unrelated valid time from direct purchases and gifts independently, while invalid product or rollout configuration fails closed.
Account role and entitlement synchronization: Premium, Badge, administrator, and moderator access is now rebuilt from canonical server records in one protected update; other account attributes not managed by Macro Handler remain untouched. Delayed or concurrent retries no longer replay stale roles or entitlements. Regrants, revocations, and permanent-to-time-limited changes converge on the current record; when access is reduced, sessions are invalidated if required so Android, community features, and the admin panel do not retain obsolete access.
Website desktop preview: the home page now includes a 14-language Windows technical preview describing a workspace bound to the selected window and planned support for safe multi-session operation. It clearly states that download, purchase availability, full compatibility, and a release date are not yet promised.
Privacy disclosures: the in-app and web Privacy Policy now explains the purchase and entitlement data used for verification and restoration, clarifies that Google Play handles payment-card details, and states that direct sharing uploads the macro package while public template upload requires separate approval.
No-code editor reliability at scale: large Variables and Dialog pages now render progressively instead of building every card in one frame. Numeric and coordinate fields retain the last valid value and display a corrected value when an entry exceeds its allowed range. Single- and multi-choice fields preserve text defaults and reject ambiguous duplicate, blank, whitespace-padded, or comma-containing options before the macro runs.
Community comment focus: Forum topic replies and Public Macro comments now hide the Dashboard bottom navigation and divider while open, giving conversations more room, especially in landscape. Owner-token lifecycle cleanup safely restores the bottom chrome with the same selected tab after Back, dialog dismissal, or view destruction, and prevents overlapping comment surfaces from revealing the bar early.
Panel scroll-rail spacing: In direct Macro Share, New Topic, Public Macro Share, and Release Notes, the draggable rail now uses a dedicated end gutter instead of overlapping cards or document content. The RTL-aware, density-independent layout preserves the accessible 48dp target, all 8 themes, and mouse, touch, stylus, keyboard, and accessibility controls.
Overlay help-card geometry: Help opened from narrow control-panel and Work Area Settings overlays now resolves against the usable display instead of the host rail, so the complete card, close control, text, and guide action remain visible. Screen-bounded placement is density-independent, multi-display aware, RTL-safe, and preserves immersive system bars across portrait, landscape, low/high DPI, and compact screens.
Authored contextual guidance: Verified actions in Settings, News, and the Dashboard now use distinct, task-specific press-and-hold explanations instead of the generic action paragraph. Dynamic notification, permission, and favorite controls describe their live target or state; every new topic is registered in the matching web learning-center route, follows the selected language across all 14 locales, and inherits all 8 application themes.
Clear technical wording: Screen-capture settings now name Android MediaProjection directly and explain Accessibility-only capture without comparing Macro Handler with other products. Unrelated product names were removed from in-app guidance, web help, and historical release notes. Automated checks keep user-visible text neutral while preserving required platform, AI-provider, official social-channel, and configured-integration names.
Immersive Quick Switch continuity: Selecting a block from Quick Switch or Project Map now keeps the full-screen no-code workspace focused and reapplies immersive system UI immediately after the overlay transition. Status and navigation bars remain hidden through Android and device-specific focus changes.
Premium Cloud Macro Vault: Premium users can manually upload, replace, delete, and restore up to three private macro backups, each limited to 15 MiB, on devices signed in to the same Firebase UID. Backups are user-initiated rather than continuously synchronized. When Premium ends, the vault is retained for a 30-day grace period before automatic cleanup; deleting a backup or the account removes its stored package. Binary ZIP payloads remain in private object storage and are not embedded in the account data-export JSON. The fixed green top accent strip was removed from the import and export source panels. Export > Cloud Vault now shows exactly three theme-aware square slots and starts no operation until the user explicitly selects one: choosing an empty slot uploads the current macro, while choosing an occupied slot asks for confirmation before replacement. If the vault manifest or service is unavailable, upload stays disabled and fails closed.
Remote-trigger protection: FCM tokens used for remote macro triggers are now encrypted at rest on the device. Existing plaintext tokens are migrated to secure storage and scrubbed; if secure storage is unavailable or decryption fails, remote triggering is safely disabled instead of falling back to plaintext.
Community privacy and efficiency: network reports now store a server-keyed pseudonymous fingerprint instead of a reusable raw address identifier. Orphaned report-ledger entries are cleaned up in bounded batches, and public/direct-share block checks inspect only accounts in the visible result set, reducing unnecessary database reads while preserving two-way blocking.
Community participation consent: signed-in users must explicitly accept the current Terms of Service and Community Guidelines before creating or updating forum topics/replies or public macros/comments. Acceptance is revisioned, requested again after policy changes, recorded server-side, and covered by account data export and deletion.
No-code OCR editor and runtime: Text-block OCR settings now use an independent, default-collapsed section. OCR Value exposes multi-region add/delete, region-shape, match-confidence, and scale controls with a full-screen performance hint. Each region is isolated, so an error, blank result, or non-numeric result cannot prevent a later region from providing the first valid number; ordinary Text OCR read failures fail safely without aborting the macro, while stop and execution-budget signals remain fail-fast. OCR families, help, output wording, and editor surfaces follow all 14 app languages and 8 themes.
Google Play refund and entitlement race protection: permanent void tombstones are rechecked transactionally before pending reservations and final purchase-event or entitlement writes. A concurrent retry cannot overwrite a refund or cancellation, report activation success, add pending metadata to a terminal record, or publish entitlement metadata before contribution and terminal-state guards succeed.
Variables and Dialog integrity: project-wide runtime identities are now generated without collisions across the main flow, groups, startup dialogs, and runtime dialogs. Exact-match rename, delete, copy, and import operations atomically update dependent references or fail closed instead of silently leaving stale bindings. Dialog preview runs on a detached model with the same option, default-value, visibility, and result rules as runtime; field edits commit as one validated change. Long Variables and Dialog lists restore a bounded stable anchor before scrolling, while variable controls provide localized, RTL-aware accessibility states and a 48 dp helper target.
Gallery and image-editor reliability: gallery inventory and thumbnail decoding now run off the UI thread with bounded parallelism, lifecycle cancellation, and bitmap recycling. The editor adds synchronized Full, 1:1, 4:3, and 16:9 crop presets plus precise axis controls; edge-connected, alpha-aware background removal and automatic masking preserve enclosed foreground details. Crop and mask surfaces follow all 8 themes, expose accessibility actions and state, and edited-template persistence publishes its update event only with the durable save outcome. Image-editor copy is complete across all 14 app languages.
Cross-device coordinate and capture hardening: custom logical resolutions and DPI now remain separate from compact UI density; imported profiles are validated before any write, stale orientation metadata is repaired without replacing the authored scale, and bound no-code coordinates—including swipe waypoints, decision regions, variables, and dialog defaults—rebase consistently. Flow and Lua reject non-finite coordinate data, native Lua refreshes the live work area, and color, image, text, and OCR scanning, capture-region APIs, pickers, and previews bind every bitmap to its exact display or window geometry. Rotation, window movement, secondary-display mismatch, or stale capture metadata fail closed instead of scanning or tapping the wrong location. This protects coordinate-space correctness; if the target app itself rearranges content, use image, text, OCR, or Accessibility anchors, or adapt the work area.
Control-panel and contextual-help memory stability: closing an independent help window now clears every window listener and callback, so it cannot keep the underlying control panel in memory. When the control panel moves between the app and Accessibility host, removal is verified before ownership is released, and a fresh touch container is created instead of reusing a detached view. A physical-device WindowManager/GC regression verifies that both surfaces become collectible after closing.
Backend cost telemetry: the hourly anomaly job now refreshes two equal rolling Cloud Monitoring windows before detection and stores Firestore billable reads, writes/deletes, and Cloud Function executions as one atomic snapshot pair. Partial responses, stale or malformed counters, unsafe numeric values, and collection failures fail visibly instead of being treated as normal usage; zero-baseline spikes and the UTC visibility-boundary race are covered. Live Monitoring IAM, metric availability, budget, and egress alarms remain deployment validation gates.
No-code workspace modal geometry: every standard panel using the shared centered-panel host—including Replace Block—now centers on the measured scrollable workspace instead of the asymmetric control-rail container. Popup ownership remains independent from visual positioning, physical screen coordinates stay stable in RTL, and legacy platform clipping can no longer shift an already bounded panel after immersive-mode changes. Portrait, landscape, low/high DPI, and custom logical-resolution profiles are covered; intentionally control-anchored tools remain attached to their controls.
Exact no-code text matching: Text-block searches that include digits or meaningful symbols now preserve those characters and require exact term identity instead of fuzzy OCR similarity. A target such as “item10” no longer accepts “item1”, “item11”, “item12”, or “item100”, and “+4” no longer accepts “4”, “-4”, or “+14”; the exact target can still be found inside a longer OCR line. Plain alphabetic searches keep their existing OCR-error tolerance. Short AUTO OCR searches use the requested word's precise bounds before falling back to the containing line, so actions target the correct item. The shared policy covers OCR, Accessibility text-node search, and region text matching.
Website no-code guide visuals: all no-code block screenshots were recaptured with one coherent dark theme, removing light form fields that previously appeared inside dark guide cards. An automated pixel-level check now rejects screenshots with mismatched light surfaces before the website build.
Legal-document visuals: Terms and Privacy screenshots no longer expose raw stylesheet text. The native fallback now extracts only the visible legal content and renders it in the active theme.
Website theme resilience: light and dark mode continue to load and switch correctly when browser storage is blocked or unavailable, instead of breaking the page.
Website brand previews: browser tabs now use centered safe-area favicon artwork that stays clear at small sizes, while shared links use a dedicated 1200x630 Macro Handler social card with complete Open Graph and Twitter image metadata. A versioned preview URL reduces reuse of stale social-network caches.
Onboarding legal layout and state continuity: Short agreement pages now reserve the invisible 48 dp fast-scroll channel only when their content actually needs scrolling, keeping cards horizontally centered across device implementations. Long documents retain the draggable rail for touch, mouse, stylus, keyboard, and accessibility. When the system recreates the screen or the device rotates, the current step, accepted agreements, first-macro choice, and native legal fallback state are preserved instead of restarting or changing the user's selection.
Cross-resolution workspace migration hardening: All structured no-code coordinates and supported literal Add Code/Lua Point, Region, Color, and coordinate-sensitive calls now migrate to the selected reference workspace. Dynamic, ambiguous, noScale, and screen-space constructs fail closed before the project or workspace profile is committed. LuaJ and native Color, Touch, and MultiGesture paths now share the same single-mapping contract, and an unsuccessful persistence operation restores the exact original Add Code source.
Dynamic cloud-display continuity: when a cloud phone, emulator, desktop display override, or OEM changes logical resolution, density, rotation, display, or system-bar insets while Macro Handler is open, overlay relayout now responds only to a real display-fingerprint change, the no-code surface rebuilds when density changes even if orientation does not, and MediaProjection recreates its capture surface when DPI changes at the same pixel size. Region and template capture preserve the exact source offset; Match Score and scan-derived clicks retain display/window capture context and fail closed after stale or tampered geometry instead of tapping another location. Focused regression coverage includes 736x1520 at 300 dpi, 720x1280 at 320 dpi, and 1080x1920 at 320 dpi profiles.
Cloud Vault production-activation safeguard: cloud upload and restore remain fail-closed until production signing, private Storage access, end-to-end restore, egress monitoring, and budget-alert evidence gates are verified. When activation is incomplete, the app reports unavailability instead of starting an upload or silently falling back to a local or unsigned path.
Premium Macro Transfer: one signed macro can be sent to one registered recipient email while each sender has at most one active outgoing transfer and recipient pending-transfer capacity is enforced by the server. It closes on import, rejection, sender cancellation, or expiry; lists are loaded on demand with bounded metadata instead of a live listener. Package verification proves unchanged delivery, not harmless automation, so the sender and declared capabilities must be reviewed before import.
Premium Gmail Macro Transfer (controlled availability): when enabled for the current release and account, a Premium sender can transfer one signed macro package at a time to a verified Google-account email. The outgoing slot stays occupied until the recipient imports or rejects it, the sender cancels it, or the seven-day retention period expires; recipients review pending packages under Import > Macro Transfer. Before import, the app verifies package identity, signature, size, SHA-256 digest, structure, and sensitive-automation risk; the server records completion only after local import succeeds, and both accounts are revalidated as Premium. Packages are limited to 15 MiB and use private object storage, short-lived signed upload/download requests, bounded callable listings, and no continuous synchronization or public database access.
No-code screen-guide ownership: closing a no-code workspace opened from Home now closes its region and screen guides with it. If the workspace was opened by the control panel, the live control-panel session remains the guide owner and preserves region display after the workspace closes. Guides stay hidden behind the panel while the workspace is open, and no orphan window is left behind.
Match Score Test stability: the test and suggestion panel no longer treats temporary screen-capture hiding coordinates as its real layout, so it stays inside the visible work area. Closing the no-code workspace also removes detached test and debug windows, reducing late-callback and WindowManager retention risk.
Continuous system UI protection: No-code, both Code Editor paths, and MH-AI synchronously re-hide attempted status- or navigation-bar reveals with bounded OEM recovery retries. No permanent polling is used, while keyboard, Back, and window focus behavior remain intact.
OCR math accuracy: the Math block and Num.evalOcrMath API normalize localized decimal separators, multiple digit forms, ×/÷/minus variants, and full-width brackets through one safe evaluation path. Invalid input falls back safely, and x/X inside ordinary variable names is not rewritten.