[Google Pixel Guides, News, & Discussion] Nateg900t:
I just updated my bootloader unlocked Verizon Pixel 32gb from 26o to 26u. I had TWRP alpha 2 and SuperSU 2.68 SR5 with the stock-safetynet patch kernel running before the update.

I downloaded the full sailfish-nmf26u-factory-b161fe98 file from Google.

Then I used separate slot a and slot b flash-all command files (not entirely clear if/how this differs from the flash-all without -w but it had worked the last time I updated, so I stuck with it.

flash-all-slot-a.bat

@ECHO OFF
:: Copyright 2012 The Android Open Source Project
::
:: Licensed under the Apache License, Version 2.0 (the "License");
:: you may not use this file except in compliance with the License.
:: You may obtain a copy of the License at
::
:: http://www.apache.org/licenses/LICENSE-2.0
::
:: Unless required by applicable law or agreed to in writing, software
:: distributed under the License is distributed on an "AS IS" BASIS,
:: WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
:: See the License for the specific language governing permissions and
:: limitations under the License.

PATH=%PATH%;"%SYSTEMROOT%\System32"
fastboot flash --slot _a bootloader bootloader-sailfish-8996-012001-1611091517.img
fastboot reboot-bootloader
ping -n 5 127.0.0.1 >nul
fastboot flash --slot _a radio radio-sailfish-8996-012511-1611190200.img
fastboot reboot-bootloader
ping -n 5 127.0.0.1 >nul
fastboot update --slot _a --skip-secondary image-sailfish-nmf26u.zip
echo Press any key to exit...
pause >nul
exit

flash-all-slot-b.bat

@ECHO OFF
:: Copyright 2012 The Android Open Source Project
::
:: Licensed under the Apache License, Version 2.0 (the "License");
:: you may not use this file except in compliance with the License.
:: You may obtain a copy of the License at
::
:: http://www.apache.org/licenses/LICENSE-2.0
::
:: Unless required by applicable law or agreed to in writing, software
:: distributed under the License is distributed on an "AS IS" BASIS,
:: WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
:: See the License for the specific language governing permissions and
:: limitations under the License.

PATH=%PATH%;"%SYSTEMROOT%\System32"
fastboot flash --slot _b bootloader bootloader-sailfish-8996-012001-1611091517.img
fastboot reboot-bootloader
ping -n 5 127.0.0.1 >nul
fastboot flash --slot _b radio radio-sailfish-8996-012511-1611190200.img
fastboot reboot-bootloader
ping -n 5 127.0.0.1 >nul
fastboot update --slot _b --skip-secondary image-sailfish-nmf26u.zip
echo Press any key to exit...
pause >nul
exit

I rebooted the phone and checked that the update had applied but didn't have TWRP/root/ safety-net patch.

So I used fastboot to boot into the newer RC1 TWRP, and installed TWRP (which appears to automatically install to both boot_a and boot_b).

I rebooted into TWRP and installed superSU 2.79 SR3 to boot_a but it didn't seem to take after rebooting and checking SuperSU. I had to use the Advanced->File Manager in TWRP and delete fstab.sailfish (even though it's supposedly not supposed to be necessary in this version?) and reinstall. I didn't delete cache/dalvic I think on the second time either.

Then I was able to reinstall the safetynet-patch kernel (https://xdaforums.com/pixel/development/kernel-stock-kernel-safetynet-patch-t3515692) to boot_b (I'm assuming it's only boot_b, although i guess it doesn't matter that much) after rebooting in that slot with TWRP and then booting the bootloader and fastboot flash kernel xxxxxxx

I checked and when booting from boot_b, it passes the Safety net validation and is not rooted, and when booting from slot_a, root works.

The only problem I seem to be having is that TWRP RC1 isn't always able to switch the boot slot, and the only way is to try and reboot into the recovery again and again until it doesn't provide an error about "boot ctrl" when switching the active slot. And sometimes it doesn't offer to decrypt my files and ask for my password, so I have to reboot.