The list of downloadable on-device models is now fetched from our server instead of being compiled into the app, so a new model can be listed without shipping a release. The built-in list stays in the APK as the offline floor - if the fetch, the parse or the schema version fails, the app falls back to it and is never left with nothing. Each entry now says whether it comes from our own mirror or from HuggingFace, and flags any model whose checksum is not published. The automatic first-run pick is still restricted to mirrored, sha256-verified models, which is the constraint ADR VOL-008 exists to hold.