sum-update

Run ./bin/sumctl update apply from the installation directory as the registered coordinator. It stages the release, validates the bundle against manifests and task schemas, switches the default symlink under a lock, and fast-forwards a clean checkout.

Run ./bin/sumctl update rollback to restore the recorded previous known-good runtime. Use --to SHA or --to checkout for an explicit approved target; rollback never restores task databases or rewinds worktrees.

No. Only the registered coordinator pane may run apply, rollback, or recover. Developer and worker sessions are refused, and candidate code in a task worktree cannot publish into the installation.

Commands already started finish on the runtime they resolved, and worker briefs use absolute sumctl paths that keep working. New dispatches use the new default, and running sessions pick up changes through the rolling refresh flow.

Inspect update status for the activation.pending record, then run update recover --generation GENERATION for that exact saved generation. If the selected helper cannot start, run the recovery argv recorded in .local/activation.json instead of ./bin/sumctl.

Apply refuses when the bundle fails manifest, schema, or Herdr version checks, when a pending activation exists, or when the ref is not merged into the default branch. The refusal names each exact incompatibility and leaves the old selection serving.