Updates

Two modes, never an orphan containers start.

	What it is	When
Directed update	Only the images that changed; prod-up.sh / desplegar-servicio.sh	patch, UI, one service
Bundle cutover	package.sh → scp → install.sh (or ./install.sh over /opt/sis)	release cut, large drift

# Directed, from the laptop (pattern):
tools/ops/desplegar-servicio.sh --remoto -vps-pre society-graph-ui
# An image no-op exits RED (exit 1). The legitimate case:
tools/ops/desplegar-servicio.sh --remoto -vps-pre --permitir-sin-cambio society-telemetry

If the box compose changed but the image did not, --permitir-sin-cambio is the right flag — not a silent success.

Dept-host + SOUL: recreate that service with compose --no-deps, not an institution redeploy.

Agent harness: the pin lives in infra/harness.version. Bumping it rebuilds agents-host / agents-runtime from the pinned source — not a hand upgrade on the VPS.

After a new SIS port: sudo /opt/sis/tools/ops/sis-firewall.sh (idempotent).

Client installation: do not touch geointel-*. reference client: do not touch foreign stacks (kos, someone else's Conversation UI, LLM Router that is not society-LLM Router).

Cutover rollback: each skill's runbook leaves /opt/sis.bak-<TS>. Fresh install (runbook 18) is destructive and talks about an R3 bundle — verify the current tag before following it.