# Plan: Self-Update with Rollback

**Goal:** Maven can update her own code, config, skills (seed files), tool definitions, and integrations while running, with a rollback mechanism if the new state causes failures.

**Done when:**
- `internal/update/` package manages versioned snapshots of the binary + config + models + seeds
- Daemon can fetch a new release artifact (git pull + `go build`, or download a pre-built binary)
- On success: atomically swaps binaries/symlinks and sends SIGHUP to itself for graceful reload
- On failure (daemon crash within a grace window): init/systemd restarts the old binary automatically, or an in-process supervisor detects crash-loop and rolls back
- Rollback is automatic on crash-loop detection (>2 crashes in 5min) — previous known-good snapshot is re-deployed
- All state (sqlite store) is forward/backward compatible within the same schema version (`store.Migrate`)

**Scope:**
- New `internal/update/` package — snapshot manager, downloader, binary swap, health check
- New `cmd/mavend/updater.go` — the imperative orchestration (swap + SIGHUP + watch)
- Reuses `internal/store.Migrate` for schema compatibility
- Config: `update` block in `config.Config` (repo URL, auto-update channel, rollback max crashes)
- New IPC methods: `MethodCheckUpdate`, `MethodApplyUpdate`, `MethodRollback`

**Steps:**
1. Design the update data model: versioned snapshots under `state_dir/updates/v<N>/` — binary, config, models, seeds; current symlink at `state_dir/current`
2. Create `internal/update/checker.go` — checks GitHub releases (or a custom update server) for newer version; compares semver
3. Create `internal/update/downloader.go` — downloads artifact, verifies checksum, extracts to new snapshot dir
4. Create `internal/update/swapper.go` — atomically swaps symlink, sends SIGHUP to self (`syscall.SIGUSR1` or `SIGHUP`)
5. Wire SIGHUP handler in `cmd/mavend/main.go` (already has `signal.NotifyContext` with `SIGHUP`) — re-read config, re-open store, swap phraser/router/delivery without dropping IPC connections
6. Create crash-loop detector in `internal/update/health.go` — watches process start time, counts crashes in window, triggers rollback
7. Add IPC methods `MethodCheckUpdate`, `MethodApplyUpdate`, `MethodRollback` to `internal/ipc/api.go` and wire through `ipc.Server` dispatch
8. Add `update` block to `config.Config` and `deploy/mavend.json`
9. Test rollback: deploy a deliberately broken binary, verify crash-loop detection reverts to previous version