[shrkz1]

The customer tag-only restart and app-volume replacement can overlap old jobs, callbacks and DB work. This change adds bin/eramba-update for an explicit online/offline image switch: the selected target coordinator drains the supported old runtime while MySQL remains available, holds exclusive ownership through client retirement and the proven app-volume replacement, then initializes/synchronizes fresh code before matching services start.

The helper pins preparation/activation to the selected local image ID, checks rendered and actual coordinator identity, DB/data/source contracts and the exact drained code target before removal or permission. Invalid Compose overrides fail before runtime mutation. Data, MySQL, logs and trigger storage remain; dotenv is parsed as data. No app Docker socket, tag/heartbeat/deadline takeover or ordinary startup migration is introduced. Fresh install requires absent app/data/database volumes; legacy adoption uses the fenced bridge/bootstrap procedure.

Cron runs a continuous native worker with guarded periodic commands and meaningful readiness. Internal callbacks use the private authenticated origin; public Caddy routes only the exact DB-free progress path separately. Containers use isolated Compose identities, including CI checks.

Validation:

• 17 Bats cases, both edition Compose configurations, shell syntax and workflow YAML pass.
• Actual W→X image switch: held native job, PHP descendant, authenticated callback and admitted HTTP all retire before the real migration; queued follow-up runs afterwards, data remains and stale source startup is refused.
• Actual standalone cloud-worker SIGTERM and cron SIGWINCH retain the real held native job/child through normal completion, record normal retirement and restart with a new worker UUID.
• Actual Compose image/DB/data/application/bridge/entrypoint overrides are rejected with container/volume snapshots unchanged. SQL Sleep/statement, coordinator loss/rival, native-parent hard kill/live child and synchronization-failure fixtures remain closed.
• Actual PHAR success/restored/incompatible outcomes are exercised by these focused harnesses against the companion app; auxiliary MCP/trigger/proxy endpoints here are declared transport stubs.

Release dependency: requires the companion app/immutable bridge image. Configure SAFE_UPDATE_TEST_IMAGE to a fixed bridge-capable released image before the repository's full installation CI; no image was published by this PR. Local Docker/shared-volume evidence does not establish EFS/CNI/Argo staging behavior. The final independent integrated review findings are resolved; no merge or deployment is included.

Base: 69a6312 (1.x). Head: 903424d.

The first GitHub run at ca07ed3 exposed the runner's missing ripgrep; the workflow now installs jq/ripgrep before the contract suite. SAFE_UPDATE_TEST_IMAGE is currently unconfigured, so full installation CI intentionally requires the fixed release artifact before proceeding.

Companion app: https://github.com/eramba/eramba/pull/6301.

Companion cloud: https://github.com/eramba/ermb-config/pull/196.