R8 obfuscates androidx.security.crypto + com.google.crypto.tink, which resolve primitives via reflection. Only -dontwarn existed, so release builds silently read an empty token: every API call 401'd and the app showed 'Session expired' (debug builds were unaffected — no minification). Verified on device: release APK before → 401 on WS ticket mint; after → existing token read and session connects with no re-login. Co-authored-by: M57 <hy4ri@users.noreply.github.com>