[GenericJam]

MOB-493 and MOB-494. The device runtime moves to OTP 29.1.2 with OpenSSL 3.5.9 LTS: new hash otp-d199a49a (published, all five assets). Apps also stop running the host's OTP apps in place of the runtime's.

Why

• The 5c9c69fc runtime is OTP 29.0, which has 47 unpatched OTP advisories, including critical CVE-2026-89422 and CVE-2026-55953 (TLS server authentication), with OpenSSL 3.4.0, end of life since 2026-10-22.
• Even a patched runtime changed nothing on Android. mob_dev pushed the host's ssl into the app's beams dir, which comes first on -pa. Before this change, code:which(ssl) on a Moto G was files/otp/<app>/ssl.beam, the host's 11.7.
• iOS LiveView dev builds compiled no-op ssl and crypto shims into that same dir. The crypto shim has verify/5 -> true and supports/1 -> [], and mix mob.release --ios reused that dir.

What

• @otp_hash d199a49a. bundled_versions.exs gets an entry with otp_version: "29.1.2". Fingerprinting understands android-x86_64.
• No host OTP apps or shims reach the device:
  • Removed: the host-ssl push (deployer, release_android, native_build), the iOS ssl and crypto shims, the Android release crypto stub, the dead deployer crypto shim, and copy_otp_lib of runtime_tools/asn1/public_key on iOS.
  • Deploys and builds delete leftover files: stale_host_ssl_files/0 is the union of host ssl and every cached runtime's ssl, plus crypto.{beam,app}, and honours MOB_CACHE_DIR. The iOS release script deletes them from BEAMS_DIR too.
• The release scripts reproduce the tarballs from a pristine OTP-29.1.2 tag:
  • vendored xcomp confs for all five targets;
  • patch 0003 (iOS {spawn, LinkedInDriver}, previously hand-applied), and the patch 0002 marker fixed;
  • asn1rt_nif.a built through OTP's static_lib;
  • arm32 --disable-year2038.
• publish.sh uploads the x86_64 tarball by default.
• {:mob, "~> 0.9.25"}: older mob hard-codes erts-17.0 and can't boot erts-17.1.1.
• The decision record is decisions/2026-10-22-otp-29.1.2-runtime-no-host-otp-apps.md. CHANGELOG has an Upgrading section.

Verification

• Moto G power 2021, iPhone 17 simulator and physical iPhone SE (test app on mob 0.9.25 plus this branch) all showed:
  • OTP 29.1.2, erts-17.1.1;
  • code:which(ssl) in lib/ssl-11.7.8;
  • OpenSSL 3.5.9;
  • httpc with verify_peer to hex.pm returns 200, and a wrong SNI is rejected.
• The published release assets were downloaded again; their sha256 matches the build outputs.
• mix test: 3167/3167. compile --warnings-as-errors, credo --strict and format pass.
• mix mob.security_scan: 0/73 OTP advisories and 0/61 OpenSSL CVEs apply to d199a49a. The 6 remaining HIGH findings are cache drift on this host and not code: exqlite BEAM 0.43.0 copied into the iOS caches by other apps, and Elixir 1.20.0 in the old 5c9c69fc caches.

Review

Reviewer subagent, because Codex was usage-limited: round 1 DO NOT SHIP, round 2 DO NOT SHIP (iOS crypto shim), round 3 SHIP, delta round SHIP. Every finding is fixed, including the nits (MOB_CACHE_DIR, AGENTS.md erlfmt lines).