@d82adc62 I was mostly thinking of callstack package checks when making reflection calls. E.g. if ("androidx." in callstackPackages) 

 But the app could have renamed the packages 

 @d82adc62 @87c34046 There is a mechanism in the platform for AndroidX libraries to relax SDK restrictions (but it would apply to any code in the APK, not just the AndroidX code): https://source.android.com/docs/core/runtime/signed-config

Not sure whether it's actually used in practice - I can't see any references to android.settings.global in the AndroidX repo, but it's possible it's injected during the release/build process. 

 @535ec9d7 @d82adc62 Interesting! If I understand right, there's a receiver that triggers on package install, scans the manifest for this key (and an associated signature) and then applies an updated config globally, for all apps? https://cs.android.com/android/platform/superproject/+/master:frameworks/base/services/core/java/com/android/server/signedconfig/GlobalSettingsConfigApplicator.java;l=98;drc=e2b2432bc64fbbca667f11c79d0dc5e4f627284b

Looks like this is a way to dynamically relax more APIs at the device level, maybe? 

 @87c34046 @d82adc62 Yep, looks like it. I guess the idea is that there's a single config for all of AndroidX with a monotonically increasing version then.