Roadmap: updates shared between rooms (Paul)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/roadmap.md

@@ -483,3 +483,15 @@ The full proposal is `docs/character-continuity.md`: the character bible, five s
 idents, and placement, cooldown, accessibility and Tots/Kids rules. It assesses the fit with the ident, promo, bumper and
 squeeze-back choice, so there is no second scheduler, and sets a six-phase rollout. Storyboard frames are in
 `design/continuity/`.
+
+## Updates shared between rooms (Paul, 6 November 2026)
+Updates are installed by hand today, over the network with Paul's OK, so a TV that's off misses them until it's reached
+again. Proposed: when one Orbit has a newer version, it offers it to the other Orbits on the Wi-Fi as they come on, through
+the same home-network link as Multiroom.
+- Each TV shows "Orbit x.y.z is ready: Install?". Android always asks before installing an app from outside the Play
+  Store, so it's never silent.
+- A TV that was off gets the update when it's next on. There's no internet, Play Store or server involved.
+- Only on the home network. The package must carry the same signature as the installed Orbit, and must be a newer
+  version; anything else is refused.
+- It keeps the existing install safety: snapshot first, and schedules and bookings never rewritten.
+- It needs Android's "install unknown apps" permission for Orbit, granted once on each TV.