ADR-004: Atomic update

Decision: stage, validate, rename then switch pointer. Status: accepted. Why: prevents partial activation. Consequence: locked/cancelled updates retain current version and report diagnostics.