feat(cpp): sans-IO round engine for the native cold-start round

cpp/update_flow_core/native_round.cpp

@@ -67,14 +67,16 @@ Value StringOr(const Value& value, const char* fallback) {
   return value.IsString() ? value : Value::String(fallback);
 }
 
-// A non-negative integral state counter; anything else reads as 0.
+// A non-negative integral state counter; anything else reads as 0. Capped
+// well inside a 32-bit size_t (armeabi-v7a, x86): converting a double beyond
+// the target's range is undefined.
 size_t Counter(const Value& value) {
   const double number = value.AsNumber();
   if (!value.IsNumber() || !std::isfinite(number) || number < 0) {
     return 0;
   }
-  return number >= 1e15 ? static_cast<size_t>(1e15)
-                        : static_cast<size_t>(number);
+  return number >= 1e9 ? static_cast<size_t>(1e9)
+                       : static_cast<size_t>(number);
 }
 
 // { packageVersion, currentVersion, uuid, rolledBackVersion } — what

cpp/update_flow_core/native_round.h

@@ -7,8 +7,8 @@
 // The pure steps of the native cold-start round (NATIVE_CHECKUPDATE_DESIGN
 // §10), one implementation for the Android, iOS and Harmony orchestrators:
 // what to send, which endpoint to ask next, and everything a commit needs
-// from the answer. HTTP, timeouts, locks, downloads and persistence stay
-// native. JS has no counterpart (its client builds its own request through
+// from the answer. round_engine.h drives these steps; HTTP, locks,
+// downloads and persistence stay native. JS has no counterpart (its client builds its own request through
 // src/updateFlowCore.ts buildCheckRequestBody, which BuildRequestBody
 // mirrors); tests/native-round-vectors.json pins this layer.
 //