Separate package information from installation

A repository supplies packages and metadata describing them. Refreshing
metadata changes local information. An installation transaction can
change installed software and its dependencies. A candidate is the
version currently selected for possible installation, not proof that
installation occurred. Read the fictional decision below.

The decision card is fictional, not actual apt output.
Worked decision: update fetches repository metadata; policy displays
available/installed information; install requests named package(s).
Activity record: approved Ubuntu repository set; metadata refresh
completed; fictional curl upgrade candidate exists; no install or
upgrade requested. Does that alone establish installed curl changed?
No versions, package sizes or successful real transactions are claimed.
Live candidate steps inside owned guest only:
apt-cache policy curl
sudo apt update
apt-cache policy curl
sudo apt install curl  (optional; review transaction before accepting)
curl --version        (only if curl is installed)
Never add a third-party repository, pipe a download to a shell or use -y.
Question: apt update completed; was every available upgrade installed?