# OL-4255 — Update sanity check failed
> The staging binary's `--version` output did not contain the version
> the registry advertised. Catches truncated downloads, wrong-arch
> binaries, and signed-but-unbuilt artefacts.
## When this fires
- Download truncation that snuck past SRI (rare — SRI runs first).
- Binary built for the wrong architecture but signed by a trusted key
(would also have failed `verify`, so this is rare in practice).
- Release CI signed an artefact that doesn't match the tag's version.
## How to fix it
1. Re-run `openlatch-provider update --apply --yes`. A re-download
often clears partial-write artefacts.
2. If repeatable, file an issue with the staging binary's actual
`--version` output and the version the registry advertised — that
pair tells maintainers exactly which CI step misfired.
## Related
- Sanity-check is the last gate before swap (per
`.claude/rules/auto-update.md` invariant 2).