Upgrade OpenRig

An upgrade is an observed agent workflow, not a transaction hidden behind one command. Hosts differ, process state drifts, local plugin files accumulate, and the useful response to a failed step depends on what is still alive.

The agent owns the sequence. Stop after every mutation and observe the actual effect before choosing the next step. There is deliberately no end-to-end upgrade subcommand.

Safety model

Keep these planes separate:

• Seats normally live in tmux and can survive a daemon restart.
• The daemon, database, wrappers, and managed plugin projection are the control plane being changed.
• rig down tears down seats. It is not part of a continuity-preserving upgrade.