Install

Snapshot + recreate the mem container on a new tag.

Strict checks BEFORE forwarding to the sidecar:

• Origin guard (default-closed).
• Stable semver tag.
• confirm matches tag (the type-to-confirm contract).
• Reject downgrades and same-version applies (catch operator misclicks).

The sidecar runs free-space precheck + lock acquisition + snapshot + recreate detached and returns 202 immediately. The UI polls /check to learn when the new tag is live.

curl -X POST "https://example.com/admin/upgrade/install" \  -H "Content-Type: application/json" \  -d '{    "tag": "string",    "confirm": "string"  }'

{}

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "input": null,
      "ctx": {}
    }
  ]
}