Version and licence boundary
The reviewed licensed product already has installation-bound licence/update checks. The newer source additionally exposes System → System updates and an optional update-discovery preference. Use the matching approved released core; newer-source optional discovery does not remove the mandatory main-product licence from the licensed distribution.
An active administrator needs updates.manage, enrolled MFA and current password confirmation for protected actions. Reuse the existing genuine installation identity. Never select Prepare new identity over an activated installation, copy another domain's private keys or regenerate authority trust to recover a download.
Check and review
Confirm the configured canonical HTTPS domain, public installation key and genuine Orbit entitlement. Activation/setup uses the existing approved ORBITSETUP1 process. An approved main entitlement and update scope determine actual release rights; preparing a public key alone grants none.
Check for updates obtains a fresh verified descriptor for that exact installation/product/version. Cached notices are presentation only. Review version, notes, package format, size, checksum and update rights. Automatic hourly discovery is optional in the newer workspace and never automatically downloads or installs; its enabling administrator must remain authorised.
Download is not install
A download uses fresh authority permission plus an installation-signed request proof bound to exact method/URL/body/token. It streams privately and verifies response type, size and SHA-256. Invalid/truncated downloads are removed. Transport permission is separate from the release publisher signature and exact file inventory.
Download and verify only leaves installation for review. Download and install is available only for an actually published compatible signed-core-update delta. The existing signed updater checks trusted publisher, inventory and exact local baseline, then queues its independent worker. A queued success message is not a completed install; inspect signed installation history.
Full distributions and database changes
Full signed-source/installation archives cannot be fed into the delta engine or silently overwritten over a running installation. Use the administrator maintenance/replacement procedure and preserve private identity/data. The file-only updater does not apply database migrations; coordinate separately reviewed additive schema work and readiness checks before resuming workers.
Recovery
Keep original .env, APP_KEY, database, storage, licence identity, exact release and rollback evidence. A domain/entitlement/key change needs the approved Orbit process. If activation or a download response is uncertain, inspect that same installation before replacing grants. Product update checks do not change merchant/registrar/server settings or establish production provider acceptance.