Lab confirmed by email: application updates within the grant are fine, they added a note to our file. First wave of 10 went through yesterday on LTE (allowed only for those 10). One failed with a signature error because our build script signed the debug image, bootloader refused it as it should. That alone made the setup worth it.