Add automatic agent updates with verified rollback

README.md

@@ -33,7 +33,7 @@ including SQLite metadata and published game-file storage.
    folder, including its DLC files. Name the library and version, then publish it.
    Uploads work before any host is enrolled.
 2. **Hosts → Add Host**: configure a Debian 12/13 amd64 machine and run its
-   generated enrollment command.
+   generated enrollment command. Automatic agent updates are enabled by default.
 3. Prepare a Plutainer runtime from the host page and download the published
    game-file version to that host from **Game Files**.
 4. Add the exact Plutonium server keys in **Keys**, or supply missing keys when
@@ -44,6 +44,13 @@ including SQLite metadata and published game-file storage.
 See [Native host management](docs/native-hosts.md) for installation, credentials,
 storage, failure recovery, API contracts and the live-host acceptance checklist.
 
+Existing hosts need the current installer once to enable automatic updates.
+Generate it under **Agent access** and rerun it on the same host without
+`--reenroll`; identity and game data are preserved. Thereafter hosts check their
+controller about every five minutes, verify compatible releases and update agent
+code between operations. Failed updates roll back; running game containers
+continue. The host page shows update status and the last check.
+
 ## Fleet and operations
 
 The fleet registry lives in SQLite, independently of host filesystems. Status
@@ -127,7 +134,7 @@ npm run test:agent
 npm run build
 ```
 
-Builds regenerate the downloadable agent and checksum manifest. Local controller
+Builds regenerate the downloadable agent, standalone updater and checksum manifest. Local controller
 metadata defaults to `./data/cherry.db`; use a separate test database when
 exercising enrollment. Production agent transport requires HTTPS.