How updates work (Update Center)

Updates are a first-class, reversible operation — never a re-install.

The gated flow

1. Check — the panel compares your installed version against the trusted release manifest and shows what's available, with artifact checksums.
2. Prepare — the agent takes a backup, downloads the artifacts, verifies every SHA-256 against its own fetch of the manifest (a caller-supplied URL or checksum is never honored), and stages everything offline. The live panel stays up.
3. Activate — privileged agent activation is an explicit, operator-controlled step.
4. Apply — a controlled swap of the panel tree, idempotent migrations, restart, and a health check — with automatic rollback on failure. The previous tree is retained as a rollback asset.

Guarantees

• Content-addressed artifacts; SHA-256 verified before anything is applied
• Backup before apply; rollback assets retained, not deleted
• install.sh --force is never used for upgrades

You can independently verify any release from your own machine: see Install → verify the release.