- Android.bp: sdk_version is empty (platform APIs) but platform_apis
wasn't set, which Soong doesn't just reject cleanly -- it panics.
- PawletCacheService.kt was missing the pawletos.cache.IPawletCacheService
import (different package than the file's own os.pawlet.cache).
- CacheToken.isExpired called CacheTokenVerifier's private parseIso8601,
invisible outside that object; moved it to file scope so both can use it.
Bound service BgUpd consults before downloading component assets:
discovers a trusted cache server (mDNS and/or central lookup, policy-
configurable), verifies its signed CacheToken against a pinned root key,
and hands back a rewritten URL + TLS pin. Three-tier discovery policy
(runtime MDM override -> vendor-baked default -> compiled default).
Pairs with pawletcache-server (the LAN daemon) and BgUpd (the caller).
oxmc