error code 3417 - after installing CU for SQL SERVER 2016 SP1
I have started the sql server service from the command line using the trace flag /T902

FROM TRACE FLAGS

902 

Bypasses execution of database upgrade script when installing a Cumulative Update or Service Pack. If you encounter an error during script upgrade mode, it is recommended to contact Microsoft SQL Customer Service and Support (CSS) for further guidance. For more information, see this Microsoft Support article.

WARNING: This trace flag is meant for troubleshooting of failed updates during script upgrade mode, and it is not supported to run it continuously in a production environment. Database upgrade scripts needs to execute successfully for a complete install of Cumulative Updates and Service Packs. Not doing so can cause unexpected issues with your SQL Server instance.

Scope: global only



this is also a good link:
Use Trace Flag 902 to Recover from a Cumulative Update Failure

After that I have looked at my error and it was about applying an update script.



I manually open that file and run it from management studio:

and the real error is:

Msg 15173, Level 16, State 1, Line 63894
Server principal '##MS_AgentSigningCertificate##' has granted one or more permission(s). Revoke the permission(s) before dropping the server principal.
Msg 208, Level 16, State 1, Line 63932
Invalid object name 'dbo.sysssispackagefolders'.



Here is another wonderful contribution by Pinal Dave on the subject:

SQL SERVER – Script level upgrade for database master failed because upgrade step sqlagent100_msdb_upgrade.sql

I have just seen this one:

Failure during install of SQL Server 2016 sp2

after sorting this out,
I will start the sql service again, without the trace flag 902.