The `os` piece gates download/flash/reboot behind on-device keypresses; osup is the same lane with every confirmation pre-agreed, for pushing an update to a box whose keyboard nobody is at (dev-push osup, done). Errors halt on screen; only a verified flash reboots. Claude-Session: https://claude.ai/code/session_01Xju7GpzP6o2JwxtqfKqFiG