# Controller updates (agentic) — status

**Day-0 controller updates work** as of 2026-06-26 (Phase 1).

## Phase 1 — customer self-update (latest-only) — SHIPPED

felhom-agent **v0.42.0** + felhom-controller **v0.85.0**.

The controller's old in-container self-update (`docker compose -f
/opt/docker/felhom-controller/docker-compose.yml up -d`) was dead in the LXC architecture — that path
does not exist in the guest. Phase 1 replaces it:

- The in-guest **controller pulls** the target image (its existing registry token, shared docker socket).
- The **host agent swaps** it: `POST /controller/swap` rewrites `/etc/felhom-controller-image`, restarts
  `felhom-controller-bootstrap.service`, verifies the new controller is healthy, and **rolls back** to the
  previous image if not. The agent is external to the controller container, so it survives the controller
  being killed mid-swap — which the controller cannot do to itself.
- The customer "Frissítés telepítése" button drives it (latest-only); the page polls and reloads.

Live-validated on demo 9201: agent-primitive swap `0.77 → 0.84`, rollback on a broken image (reverted to
`0.84`, guest never left without a controller), and the **real UI button** `0.85.0 → 0.85.1` (in-guest
pull → agent swap → "Sikeres"). See `felhom-agent/REPORT.md` + `felhom-controller/REPORT.md`.

## Phase 2 — operator fleet control — NEXT (not started)

- Hub **per-customer version floor** (with a default global floor).
- Operator **desired-version push** across the fleet (hub-driven, not just the customer's latest-only
  button).

## Independent follow-up — golden freshness

The golden still bakes controller **0.77.0**, so a fresh Day-0 provision starts at 0.77.0 and then needs
an update. A **golden rebuild at the current controller** is wanted so new provisions start current
(independent of this feature).