Every application installation and update on a POI device is cryptographically authenticated by the device firmware's approved mechanism, and the developer's guidance tells whoever signs the application to use an SCD under dual control.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.