update

docs/deployment.md

@@ -116,18 +116,24 @@ curl --fail "http://${TAPM_LISTEN_ADDR}/health/ready"
 
 There is no local application state and no session affinity requirement.
 
-For later updates, run the repository update helper on one webserver at a time:
+For later updates, run the repository update helper from either webserver:
 
 ```sh
 /opt/idssys/ta-deployment-broker/update.sh
 ```
 
-The helper fetches and compares the current tracked branch with its upstream. If
-both commits match, it exits without touching Docker. When an update exists, it
-fast-forwards the branch, rebuilds the image, applies any pending migrations,
-recreates the broker container, and waits up to 150 seconds for its Docker
-health check. It refuses to pull over tracked local changes or from a detached,
-untracked, locally-ahead, or diverged branch.
+The helper updates and health-checks the local broker first, then connects as
+`root` to the other broker (`10.10.1.121` or `10.10.1.122`) and performs the
+same local-only check there. This provides a sequential rolling update from
+either node. An unreachable peer is skipped with a warning; a reachable peer
+whose update fails causes the command to fail.
+
+Each node fetches and compares its current tracked branch with its upstream. If
+both commits match, that node's Docker services are untouched. When an update
+exists, the helper fast-forwards the branch, rebuilds the image, applies pending
+migrations, recreates the broker container, and waits up to 150 seconds for its
+Docker health check. It refuses tracked local changes and detached, untracked,
+locally-ahead, or diverged branches.
 
 ## 7. HAProxy health check