sudo robotctl update apply

sudo robotctl update apply daemon
sudo robotctl update apply --ref main daemon
sudo robotctl update apply --staging daemon

Installs an update. Signature, artifact hash, health gate and automatic rollback all run — a build that does not come up is reverted and the board is back on what it was running.

The trap on a dev board

apply daemon without --ref installs the latest stable release, which on a dev board is usually a downgrade.

Its meaning is not “install the newest thing” but “install what the stable channel offers”. Right after a branch merges, that stable release is still older than everything you have been testing.

Worse: if it predates a daemon that now has a unit file on the board, the unit’s ExecStart points at a binary the older release does not contain, the restart fails, and the update rolls back. The gate is working — but the command that caused it looked like the obvious one.

already_current is not inert

Ask for the version a board already has and it reports already_current and installs nothing — but it is not inert. It checks which daemons are running that release and restarts the ones that are not, naming them in stale.

So when a fix looks absent, this is the command to reach for: either it fixes it, or stale is empty and the fix was never in that release.