# felhom-agent-rollback.service — the OnFailure= target that auto-reverts a crash-looping agent
# self-update (TASK D1; SPIKE-agent-selfupdate-2026-07-05).
#
# Install as /etc/systemd/system/felhom-agent-rollback.service. It is referenced by the
# felhom-agent-limits.conf drop-in's OnFailure= line.
#
# THE PER-CRASH-FIRING REALITY [SF-1]: on systemd 257, OnFailure= fires on EVERY crash of the main
# unit — even while it is merely `activating (auto-restart)`, long before (and regardless of) the
# terminal start-limit `failed` state. During one crash incident this unit therefore runs MANY
# times. That is safe BY DESIGN: the wrapper's rollback verb is pending-marker-guarded — the first
# fire after a bad update reverts the binary and clears the marker; every later fire (and any fire
# with no update in flight at all) is a logged no-op that touches nothing. Consequence: a bad
# update is rolled back at the FIRST crash (~seconds), not after the start-limit burst — the tuned
# start-limit in the drop-in is the terminal BACKSTOP (e.g. an environmental crash loop of the
# known-good binary), not the rollback trigger.
[Unit]
Description=Felhom agent self-update auto-rollback (pending-guarded; fires per crash, no-ops without a pending update)

[Service]
Type=oneshot
ExecStart=/usr/local/sbin/felhom-selfupdate-guarded rollback