Updating lungo
lungochecks the release registry’s charter before it updates itself: the registry is accepted only when<anchor>/charter.jsonverifies against the MachineFabric roots the build carries, names that anchor, and is a release registry of the build’s environment. Every address the update reads comes from the charter.