When is the volume seal updated in macOS Big Sur's Signed System Volume (SSV) scheme?

Question

I know Big Sur employs something like a Merkle Tree to validate the integrity of /System volume, but when does this seal get updated? Are the macOS Installer and Ap