Update core: embedded identity, durable trust promotion, check and observed state

AGENTS.md

@@ -11,8 +11,9 @@ content, history and artifact contents before sharing. Follow `docs/public-devel
 Do not invent a secret store or hide harmless implementation details.
 
 Read `ARCHITECTURE.md`, `docs/decisions.md`, `docs/migration-and-recovery.md` and
-`docs/acceptance.md` before implementation. Read `docs/release-cycle.md` for the
-two distinct test/activation paths, `docs/profile-evidence.md` for optional measurement
+`docs/acceptance.md` before implementation. Read `docs/update.md`, the accepted
+contract for product update, before any distribution work, and `docs/release-cycle.md`
+for the build, qualification and promotion lifecycle and the two distinct test paths, `docs/profile-evidence.md` for optional measurement
 and `docs/hosted-assistance.md` before any hosted advice/execution work. Read
 `docs/content-sync.md`, `docs/workspace-presets.md` and `docs/hosted-entry.md` before
 work on repository synchronization, presets or hosted entry; they record accepted

README.md

@@ -26,6 +26,7 @@ their current supported implementation.
 - [Decisions, alternatives and required amendments](docs/decisions.md)
 - [Migration, upgrade and recovery](docs/migration-and-recovery.md)
 - [Proposed release cycle](docs/release-cycle.md)
+- [Product update contract](docs/update.md)
 - [Selective Launchpad adoption and Doctor direction](docs/legacy-adoption.md)
 - [Developer commands and conventions](docs/development.md)
 - [Future shared marketplace](docs/marketplace.md)

docs/expired-trust-recovery.md

@@ -1,5 +1,9 @@
 # Expired pending trust: implementation work package
 
+> **Superseded for product update (2026-09-19).** The accepted contract for
+> checking, downloading, activating and rolling back a product version is
+> [product update](update.md). The journal-reconstruction work package below is not continued. Its threat analysis of authenticated-but-unpersisted role floors stays valid and is answered by the Check step of the new contract.
+
 Status: deferred automatic-recovery work, not a prerequisite for the controlled
 pilot (scope decision 2026-09-15; see [pilot repair](pilot-repair.md)). Stop expanding
 this work package for pilot readiness. Preserve completed safety checks and retained

docs/machine-handover.md

@@ -106,7 +106,8 @@ edited output, damaged journal, partial write without a receipt or abandoned loc
 requires operator diagnosis. No automatic cleanup or universal recovery is
 promised. Recreating a disposable VM requires separate infrastructure approval.
 
-Product update repair follows [pilot repair](pilot-repair.md): retain accepted TUF
+Product update follows the [product update contract](update.md); until it is
+implemented the pilot installer's [repair runbook](pilot-repair.md) applies: retain accepted TUF
 trust and the previous working product. Folder handover does not change that rule.
 The local filesystem boundary assumes no hostile concurrent same-user/root
 directory replacement; ownership checks are not a sandbox.

docs/pilot-repair.md

@@ -1,5 +1,9 @@
 # Controlled pilot: bounded update failure and explicit repair
 
+> **Superseded for product update (2026-09-19).** The accepted contract for
+> checking, downloading, activating and rolling back a product version is
+> [product update](update.md). This runbook and `product recover` describe the pilot installer that is still the code on `main`; they are not the target mechanism. The preservation principles below (prepare beside the active version, never reset trusted metadata, never bootstrap an established installation again) remain binding.
+
 Accepted scope decision, 2026-09-15. This replaces a requirement to finish general
 automatic expired/inconsistent-transcript recovery before the first usable pilot.
 It is a contract and runbook boundary, not evidence that all scenarios already pass.

docs/release-cycle.md

@@ -1,5 +1,9 @@
 # Build, qualification and activation lifecycle
 
+> **Superseded for product update (2026-09-19).** The accepted contract for
+> checking, downloading, activating and rolling back a product version is
+> [product update](update.md). This document stays binding for the build, qualification and promotion lifecycle, the two test modes, install location and the signing, key-role and expiry requirements. Its update command proposals, pending attempts, metadata journal and replay, and the double active record describe the pilot installer still on `main` and are superseded as the target.
+
 ## Controlled-pilot scope decision — 2026-09-15
 
 Preparation is side-by-side; failed preparation preserves the currently usable