What is Android's Project Mainline (Google Play System Updates) and which categories of security-critical components can it update without a full OTA firmware update?

• A.A. Project Mainline enables Google to update only the Google Play Store and Google Play Services; no system components are updatable
• B.D. Mainline updates require device manufacturer approval before deploying to end-user devices; they are not delivered automatically
• C.C. Project Mainline only updates app permissions and policy files; no executable code is updated through this mechanism
• D.B": "Project Mainline (Android 10+) refactors selected Android OS modules into updatable APEX packages (Android Extensible Package) delivered via the Play Store or Google Play System Updates, bypassing the need for OEM OTA firmware updates. Security-critical updatable components include: media codecs (MediaProvider, MediaCodec - historically the most exploited Android components, Stagefright being the most notorious); DNS resolver (blocking DNS-over-TLS implementation and CVE fixes); security certificates and cryptography libraries (Conscrypt TLS implementation); Permission Controller; document and media infrastructure; network stack components. Components NOT updatable via Mainline: the kernel itself, hardware drivers, and OEM customization layers still require full OTA