- Cold-launch OTA lockout: checkForAppUpdateOnLaunch lives in HomeRouteScreen's
  effect, so a bad OTA crashing Home before first paint would strand the user
  on a fallback whose update check never ran — and ErrorRecovery's rollback
  only fires for fatals. The Home seam now rethrows when the guarded subtree
  has never committed healthy children, restoring the pre-boundary fatal path
  (rollback + its startup crash log, deliberately not also recorded in the
  render-error log). Any failure after the first successful paint still
  recovers in-session on every screen, Home included.
- workspaceInspectorContentIdentity is a JSON tuple, not a ':'-join: paths
  and ids contain colons, and null previously mapped to the same string a
  real content id of "none" would produce.
- The thread feed boundary resets on cwd changes too: the feed renders the
  worktree setup surface, so a same-thread worktree move is new content.
  threadFeedResetKeys covers it with a test.