diff --git a/documentation/controller-updates.md b/documentation/controller-updates.md
new file mode 100644
index 0000000..8e0a716
--- /dev/null
+++ b/documentation/controller-updates.md
@@ -0,0 +1,34 @@
+# Controller updates (agentic) — status
+
+**Day-0 controller updates work** as of 2026-06-26 (Phase 1).
+
+## Phase 1 — customer self-update (latest-only) — SHIPPED
+
+felhom-agent **v0.42.0** + felhom-controller **v0.85.0**.
+
+The controller's old in-container self-update (`docker compose -f
+/opt/docker/felhom-controller/docker-compose.yml up -d`) was dead in the LXC architecture — that path
+does not exist in the guest. Phase 1 replaces it:
+
+- The in-guest **controller pulls** the target image (its existing registry token, shared docker socket).
+- The **host agent swaps** it: `POST /controller/swap` rewrites `/etc/felhom-controller-image`, restarts
+  `felhom-controller-bootstrap.service`, verifies the new controller is healthy, and **rolls back** to the
+  previous image if not. The agent is external to the controller container, so it survives the controller
+  being killed mid-swap — which the controller cannot do to itself.
+- The customer "Frissítés telepítése" button drives it (latest-only); the page polls and reloads.
+
+Live-validated on demo 9201: agent-primitive swap `0.77 → 0.84`, rollback on a broken image (reverted to
+`0.84`, guest never left without a controller), and the **real UI button** `0.85.0 → 0.85.1` (in-guest
+pull → agent swap → "Sikeres"). See `felhom-agent/REPORT.md` + `felhom-controller/REPORT.md`.
+
+## Phase 2 — operator fleet control — NEXT (not started)
+
+- Hub **per-customer version floor** (with a default global floor).
+- Operator **desired-version push** across the fleet (hub-driven, not just the customer's latest-only
+  button).
+
+## Independent follow-up — golden freshness
+
+The golden still bakes controller **0.77.0**, so a fresh Day-0 provision starts at 0.77.0 and then needs
+an update. A **golden rebuild at the current controller** is wanted so new provisions start current
+(independent of this feature).