I2720 — majordomus self update re-runs the published installer, and never reimplements it

○READY wave 0 · p0 · implementation profile · parallel safe

Part of safe-self-update — Every mesh node follows the published release by itself, versions meet safely, and a release's provenance can be checked.

Objective

Give every installation one typed command that reports and applies an upgrade to the stable release by running the published install.sh with --version and the installation's own prefix, so the download, verification and swap exist once.

Why

ADR 0161 (owner decision of 2026-10-14) makes a mesh node follow the published release. docs/DISTRIBUTION.md left open whether a self-update reimplements the installer in Rust or re-runs it; ADR 0161 decides it re-runs it, because the installer's digest and size check and its atomic launcher rename are the tested risky part (case 85).

Current state

There is no self-update command; a person reruns install.sh with --version on each machine.

Desired state

A capability self.update with --check (current version, the stable pointer's version, whether an upgrade applies, forward-only and stable-only verdict) and --apply (runs the installer the installation's share/distribution.yaml names, with --version <tag> and the installation's prefix, and reports the installed version read back from the new launcher). It refuses a downgrade, a pre-release and a version the metadata does not list.

Scope

• apps/majordomus-cli/src/capability/builtin
• apps/majordomus-cli/src/release
• share/commands.yaml
• docs/DISTRIBUTION.md
• docs/CLI.md
• test/cases

Out of scope

• A second implementation of download, verification or swap
• Activating the new version in a running server (I2722, I2163)

Dependencies

None. This issue is a root of the graph.

What waits on this

• I2721✕BLOCKED An enrolled mesh node follows the stable pointer by itself
• I2722✕BLOCKED A hub activates a new version under its service manager, checks its health and rolls back by itself
• I2724✕BLOCKED A node without a route to the site takes the archive from a peer and still verifies it itself
• I3178✕BLOCKED A self update killed at any stage leaves a usable installation

Acceptance criteria

• self update --check names the running and the stable version and whether an upgrade applies, without a network write
• self update --apply installs the stable release through install.sh and the new launcher reports it
• A downgrade, a pre-release and an unlisted version are refused with the reason

Validation

• bin/majordomus plan validate
• MJ_TEST_JOBS=4 bash test/run.sh 85_installer <the case this issue adds>

Evidence required

• self_update_wraps_installer_test
• self_update_refuses_downgrade_test

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I2720.yaml. Read it back with majordomus plan show I2720.