OTA updates

An update reaches only the binaries whose native layer it was made for: the runtime version is the fingerprint of the native inputs, each shipping variant bakes its own channel into its binaries, every publish names that channel and its environment, passes the gates and a preflight that proves the runtime is live, and reaches a store channel in stages. Launch never waits for the network, the anti-brick recovery stays on, the app checks again when it returns to the foreground and restarts only on the person's tap. One zero-dependency checker proves the repo side.

Rules that must hold