A whole slew of changes, almost all entirely in terms of additions.

Slightly edited version of the email I sent to William describing
what I'd do:

DownloadUpdate(train, directory)
	Download, if necessary, the LATEST update for train; download
	delta packages if possible.  Checks to see if the existing content
	is the right version.  In addition to the current caching code, it
	will also stash the current sequence when it downloads; this will
	allow it to determine if a reboot into a different boot environment
	has happened.  This will remove the existing content if it decides
	it has to redownload for any reason.

PendingUpdates(directory)
	Return a list (a la CheckForUpdates handler right now) of
	changes between the currently installed system and the
	downloaded contents in <directory>.  If <directory>'s values
	are incomplete or invalid for whatever reason, return
	None.  "Incomplete" means a necessary file for upgrading
	from the current system is not present; "Invalid" means that
	one part of it is invalid -- manifest is not valid, signature isn't
	valid, checksum for a file is invalid, or the stashed sequence
	number is not the running sequence number.

ApplyUpdate(directory, install_handler = None)
	This is essentially what Update does now, but i'll pick a different
	name because there are so many moving parts I will have to
	phase it out incrementally.  As with PendingUpdates(), it will
	have to verify the contents before it actually installs them, so
	the same questions about what to do with incomplete or
	invalid content applies.

Internally, there are also VerifyUpdate(directory), which
will verify the manifest, check that all the package files are there and
have the right checksum, and verify the stashed sequence, and
RemoveUpdate(directory), which will do the obvious.