[theanmolsharma]

What this adds

Forced upgrade. The update server can now set the oldest native build each platform may run. A build below it shows "Update required" with one button to its store, in place of the app.

• Set it with node scripts/ota/minimum-build.mjs --channel production --ios N --android M --upload deploy@…. A platform you leave out keeps its live value. The script shows live → new and asks you to type yes before uploading (--yes skips it).
• It's served at GET /policy as unsigned JSON. Store links are built into the app (constants/links.ts), so the JSON can only carry numbers.
• The app checks once per launch. It reads the saved answer before the unlock screen mounts, so a blocked launch never shows a Face ID prompt, and the block holds offline.

OTA update screen. When the launch check finds an update, the app is held on "Updating Shroud" until the download is done, then shows Restart. The restart goes through a native reload screen in the theme colours.

• If the download fails, the user can Try again or Continue on current version. Continue is also offered after 60 s of downloading, so a stalled connection never locks anyone out of their wallet.
• A roll-back asks for the restart straight away. Replayed old roll-backs are ignored.
• The bar is indeterminate. Compression stays on, and with it expo-updates can't report byte progress: Android's CompressionInterceptor strips Content-Length before the progress listener sees it. The screen switches to a real percentage by itself if the last file ever reports bytes.

Both screens take the navigator's place rather than covering it. AppLock stays outside on purpose, so a re-lock survives them. Both are off in development and under Detox.

Also in this PR

• refactor(ui): LockScreen and the update screens share LogoScreenLayout, and SyncScreen uses the new ProgressBar. Both render pixel-identical to before at the default text size, and now scroll at the largest sizes.
• upload() bug fix: a pointer or policy rewritten within the same second at the same size was skipped by rsync's quick check. This applies to channel pointers too. These small files are now compared with --checksum.

Runtime version

There are no native, app.json or package.json changes. The iOS and Android fingerprints match master (bf3ea9ab…, b8c6efb0…), so this can ship over the air to installed builds. That's also why the new script isn't an npm script: package.json scripts are part of the fingerprint. Only builds that already run this code can be blocked.

Before merging / using it

• Redeploy update-server (adds /policy). The script refuses to upload until the server serves it.
• Check on an EAS preview build: publish to preview → Updating → Restart; airplane mode mid-download → Try again / Continue; ota:rollback → Restart; preview minimum above the build → blocked, store opens, still blocked offline, 0 unblocks.
• Raise a minimum only once the new build is live in its store (100% rollout on Play), and never past an OS version the blocked builds support. RELEASE.md has the rules.
• The screen can take over after unlock on a slow connection. That trade-off is documented in UpdateGate and RELEASE.md.
• The policy request goes over clearnet even in Tor-only mode, to the same host as the existing update check. This is documented.

Testing

• 637 unit tests and 39 update-server tests pass; lint and tsc are clean. The new tests cover the policy module, the OTA state machine, the screens and the gate, the server route, the CLI helpers, and the same-second upload regression (which fails without the fix).
• The CLI was run end to end against a local server: set both, change one, no-op, refusal without --yes, and a malformed file returning a logged 500.
• iOS simulator: every state in light and dark mode and at large text sizes, and the status bar with the app's theme forced against the system's.
• Android emulator: the status bar fix, reproduced without it.
• Not yet run: a real release build downloading a signed update (see the checklist above).

🤖 Generated with Claude Code