Expo Updates fallback after a failed OTA launch: what triggers the revert and can it be forced?

I am designing a release process around expo-updates and need to understand the documented fallback behavior when an OTA update fails to load at launch. The docs describe the app reverting to the embedded binary, but the exact mechanics are unclear to me.

Assume a recent Expo SDK with expo-updates configured for automatic updates on both iOS and Android. My constraints: I cannot prompt users to reinstall, and I want to avoid shipping a native build just to recover from a bad JS bundle.

The points I cannot resolve from the documentation:

• Does the fallback to the embedded binary happen automatically on the next launch after a crash, or can the failed update leave the app stuck until the update cache is cleared manually?
• Is there any supported API to force a rollback or invalidate a bad update programmatically, or is the fallback purely a launch-failure reaction?
• Does this behavior differ between iOS and Android in any documented way?

I plan to verify by deploying a deliberately broken bundle to a test channel, but I would like to know the expected behavior first. Note: behavior may have changed across recent SDK versions, so answers citing a specific SDK version are preferred.