I ship JavaScript over the air for a living. The failure mode that still keeps me honest is not a bad button label. It is a bundle that never boots.
When we designed @capgo/capacitor-updater, I did not want a cloud dashboard to be the only undo button. The phone has to decide, by itself, that the new folder of HTML and JS is dead and put the last good folder back. That decision is a handshake. If JavaScript does not complete it, native code rolls the app back. The default window is ten seconds.
This is how that handshake actually works, what a crash looks like versus a hang, and how I test a deliberately broken bundle on a channel before I ever touch production.
The only signal that matters: notifyAppReady()
On every launch the native plugin serves a bundle — either the one that shipped in the binary (builtin) or a zip we downloaded earlier. Serving files is not the same as the app working. The WebView can open index.html and still die in the first module.
