---
"@type": Article
"@id": "https://helloloam.dev/principles/no-update-stress"
"@source": "https://helloloam.dev/data/article/no-update-stress.json"
"@stamp": "2026-10-22T12:55:58+00:00"
about:
  "@type": DefinedTerm
  "@id": "https://helloloam.dev/data/definedterm/no-update-stress.json"
  name: No update stress
  identifier: no-update-stress
  inDefinedTermSet:
    "@type": DefinedTermSet
    "@id": "https://helloloam.dev/data/definedtermset/gives-you.json"
    name: Gives you
    identifier: gives-you
author: {"@id":"https://helloloam.dev/#organization"}
datePublished: "2026-10-03"
description: An update replaces parts of the engine and never touches your site. It checks itself before it takes over, and undoes itself if a page it rendered stops working.
headline: No update stress
identifier: no-update-stress
inLanguage: en
publisher: {"@id":"https://helloloam.dev/#organization"}
url: "https://helloloam.dev/principles/no-update-stress"
---

# No update stress

## Why updates hurt elsewhere

With most content systems, updating is when things break — so people postpone updates, and postponed updates are how sites get compromised. Loam is built so that an update is not an event: routine, small, and undone by itself when it goes wrong.

## The engine is one folder, your site another

Content, templates, images and keys live in their own folders, and an update never touches them. It can change what the engine renders from your data; it cannot change your data. No plugins to fall out of step, no database to migrate — and the site's configuration describes the site, not the engine, so a newer engine reads the same file.

## Whole parts, never loose files

The engine is made of five members — core, docs, edit, setup and shell. An update swaps a member as a whole, because a member is tested as a whole. You can take all five, or only the ones you need; members that must speak the same version move together, or nothing moves at all.

## Signed releases

`loam update` takes only a release signed by loam, checked against the trust anchor your site holds — an anchor no release can replace. The download is checked against its checksum before it is unpacked. A tarball that does not verify is never opened.

## It checks its own work

Right before the swap, the old engine renders a handful of your pages — the home page, each language, one page per type. Right after, the new engine renders the same pages again. If a page that worked stops working, the update undoes itself on the spot and names the page. A page that was already broken is reported, but never blocks. Either way, a line lands in the site's journal.

## Someone chooses the moment

An update never runs by itself. It is one command on the server, chosen by a person: Braaf runs it on the sites it maintains, and on your own server you run the same command. What loam removes is the cost of updating, so keeping current is routine instead of a project.

## What it costs

A licence. It buys the stream of signed releases and support — not the right to run what you have. A site without one keeps running, offline, without a check, for as long as you like; it just does not pull new features. Security fixes stay free for every registered site, on every supported line. And an update is a moment someone has to choose: a site should never update itself into a state nobody has looked at.