Architecture / Active Blocks
Two Firestore paths, one sandboxed runtime, zero network egress from generated code.