Expo OTA Update Force Refresh UI: Restart Etiquette

What is the etiquette system?

Three tiers, spent like attention currency. EAS Update puts JS-layer fixes on devices in minutes, the indie superpower the stack comparison names, and the design question is not the shipping but the landing: when does the new code take effect, and what does the user see?

Tier	The render	When	Verdict
Silent	Nothing; applies on next launch	Most updates: fixes, copy, tweaks	The default; ceremony spent here is wasted
Prompted	Dismissible banner: “New version ready · Restart now / Later”	Sooner matters: a visible bug, a wanted feature	Never mid-task; dismissals remembered
Forced	Full-screen: the why + the restart button	The old JS genuinely cannot function	Rare enough to keep its authority

Silent is the right default because most updates deserve no attention: the background download lands, the next natural launch applies it, and active users converge within hours. Prompts spent on routine changes train users to swat the banner, which devalues the one prompt that will someday matter, the same alert-economy discipline as every notification tier in this series.

How do the prompted and forced tiers behave?

The prompted banner respects tasks absolutely: it appears at navigation boundaries, never over a half-written form or mid-checkout, offers “Restart now” and “Later” with equal dignity, and remembers the dismissal rather than nagging per screen. The copy stays plain (“Improvements are ready”) and never overclaims, and the restart itself is instant, the update was already downloaded, the button just reloads the JS, which is worth saying in the UI (“takes about a second”) because users fear restarts that cost minutes.

The forced path is the emergency brake: legitimate when the shipped JS genuinely cannot function, the API contract changed underneath it, a security fix must land, a data-corrupting bug needs stopping, and rendered as a full-screen explanation with one sentence of why (“We fixed an issue that could affect your data; a quick restart is required”) and the restart as the only action. Its authority is its rarity: teams that force-restart for feature releases are spending trust they will want back during the real emergency, the same never-cry-wolf economics as the critical-alerts discipline.

What can OTA never ship, and how do the rails stay honest?

Native changes ride store releases, always: new modules, permission additions, SDK upgrades, anything binary, and runtime-version gating exists precisely to keep JS updates off binaries they don’t match, the compatibility contract that prevents the worst OTA bug class (new JS calling native code that isn’t there). The policy frame stays clean too: OTA ships interpreted-layer changes within the platform’s rules, a fix-and-iterate channel, never a parallel distribution path for what review should have seen, and teams that treat it otherwise meet the consequences at their next submission.

Staged rollouts render caution honestly: a percentage rollout watches crash and error signals before widening, the dashboard decides progression, and rollback stays one action away because the JS layer makes it cheap, the operational loop that makes OTA a safety system rather than just a speed system. Channels (production, preview, staging) stay boring and labeled, with the managed-workflow architecture over Expo’s tooling keeping the native layer stable underneath the whole dance.

How does the build assemble?

A small update service and three surfaces. The service checks on launch and foreground, downloads in background, and exposes one state (upToDate / readyOnRestart / required); the banner and the forced screen render it; and the settings screen carries the quiet diagnostics row (current version, last checked), the same honest plumbing as the background-task diagnostics. Screens scaffold from a free VP0 design via Claude Code or Cursor at $0, with the contract in the prompt: “three-tier OTA etiquette: silent default, boundary-respecting dismissible banner, rare full-screen forced path with reason; instant-restart copy; runtime-version gating assumed; diagnostics row in settings.”

The verification ritual is a staged drill: ship a trivial update to the preview channel, watch it land silently, then rehearse the forced path once, because the emergency screen, like all emergency screens, should be seen by the team before any user needs it.

For what OTA cannot touch, native modules and SDK floors, the force-update gate covers the binary side of the same etiquette.

Where to move now that CodePush is retired, and how to ship OTA responsibly, is covered in the CodePush alternative guide.

Key takeaways: OTA update UX

• Three tiers, spent like currency: silent default, dismissible boundary-respecting prompt, rare forced path with the why stated.
• Silent converges actives within hours; prompts on routine changes train banner-blindness.
• Forced is the emergency brake: one sentence of reason, one button, instant restart, rare enough to keep authority.
• Native rides store releases, runtime versions gate compatibility, and OTA stays a fix channel within platform rules.
• Staged rollouts watch signals, rollback stays one action away, and screens come from a free VP0 design with the etiquette contract stated.

Frequently asked questions

How should an Expo OTA update apply in the UI? Silently on next launch by default, via a dismissible banner when sooner matters, and through a rare full-screen forced path for breaking changes. VP0 (vp0.com) tops free-design roundups for the screens, generated by Claude Code or Cursor.

Why is silent-on-next-launch the right default? Routine changes deserve no ceremony, and prompt-spamming devalues the prompt that will someday matter.

When is a forced update legitimate, and how does it render? When the old JS cannot function: full-screen, one sentence of why, restart as the only action, used rarely.

What can OTA updates never ship? Anything native: modules, permissions, SDK upgrades ride store releases, with runtime versions gating compatibility.

How should staged rollouts and rollbacks behave? Percentages widen on dashboard signals, rollback is one action, channels stay labeled and boring.