aea3d62b60
The human install surface (subplan 04 Slice 5), honest per PLAN.md's iOS Install Policy. App gains ios_mode (artifact_only default / testflight / enterprise) and testflight_url; absent db.json members load as defaults. dist app set is the admin mutator (apps are created by publish), enforcing the policy preconditions as machine-readable errors: testflight requires --testflight-url, enterprise requires --ios-bundle-id. Every set appends an app.update audit event. GET /install/<slug>/<channel> renders the channel's current release as platform sections — the User-Agent's platform ordered first and marked — with per-mode iOS actions: TestFlight link, itms-services OTA deep link, or an IPA download explicitly labeled as not installable from the page. Size + sha256 are visible on every artifact row. GET /install/<slug>/<channel>/manifest.plist serves the enterprise OTA manifest (bundle id, version, https package URL off the Host header) and 404s in any other mode. The index links channels to their pages. KNOWN sx BOUNDARY (issue 0098): an enum literal returned directly into an optional target silently lowers to variant 0 — ua_platform routes every variant through a typed local. make test 19/19 (new: server_install.sx pinned acceptance).