remove testing == stable mirror anachronism.  don't do transcation stuff in lower level update_foo().

Check for suspicious characters in commands.  Write out a list of source-version uploads.  More substs for headers in advisory