What is Android's Project Mainline (Google Play System Updates) and which categories of security-critical components can it update without a full OTA firmware update?

• A.Mainline modules are staged by Google, and each one waits on the device manufacturer's approval before it reaches end users (the OEM signs the APEX with its own key); the mechanism shortens the OTA queue without removing the OEM from it, and the components it covers are the ones a full firmware image would replace
• B.Project Mainline (Android 10+) refactors selected Android OS modules into updatable APEX packages (Android Extensible Package) delivered via the Play Store or Google Play System Updates, bypassing the need for OEM OTA firmware updates. Security-critical updatable components include: media codecs (MediaProvider, MediaCodec - historically the most exploited Android components, Stagefright being the most notorious); DNS resolver (blocking DNS-over-TLS implementation and CVE fixes); security certificates and cryptography libraries (Conscrypt TLS implementation); Permission Controller; document and media infrastructure; network stack components. Components NOT updatable via Mainline: the kernel itself, hardware drivers, and OEM customization layers still require full OTA