• What a buyer downloads. The operator transfer pack. Schema engos.upgrade.pack/v1. Import in the workspace under Updates. Listed on /updates.
• Air-gap room. A room that cannot call home takes the hashed JSON pack on removable media. Pack Adapter drops unknown fields. SHA-256 is a digest so the operator can prove the bytes, not a notified-body opinion. Air-gap is an option, not a claimed default deploy.
• What a buyer does not download. The sales-host source zip is how we restore this website. It is not a commercial object and is not listed for purchase.
• Adapter. Known keys stay. Unknown fields drop. HITL translator, not Avro-as-product. Analog at /tools/packadapter.
• Seal. SHA-256 chain SAMPLE. Extractor proposes. Linker never merges. A human seals. Not WORM.
• Art. 50. Operational desk. A digest is not a notified-body letter.

Air-gap is an option, not a claimed default deploy. Contract conversation: talk to a human.