- The launcher watches a committed update for a health period and rolls
  back a runtime that crashes after commit. The launcher protocol stays 3,
  so existing launchers keep running new runtimes.
- Clients hear about the restart before it happens, so they show the update
  as resuming instead of a lost connection.
- The release feed is checked again at the handoff, a newer release replaces
  a staged one, stable skips prereleases, mirrors must use HTTPS, and old
  runtimes are pruned.