Module upgrade 

rk upgrade: a landed target takes a newer payload.

A front over the engine: the plan is computed with the upgrade intent, and on --apply the engine executes exactly its operations through one staged transaction with the record last. Three digests decide each file: the baseline the record keeps — the payload as it stood at landing — the bytes on disk now, and this binary’s candidate, rendered under the recorded parameters. A rendered file nobody touched is rewritten; one the target edited is a conflict, and every conflict is collected before the whole upgrade refuses in one run. There is no merge: the two outcomes are a clean write and a refusal, because a wrong guess in a release workflow is discovered at the next release.

Functions

run

Upgrade the landed target to this binary’s payload.