In-app brain/runtime update from all surfaces (desktop, iOS, web)

[arul28]

Why

ADE already has the full brain self-update engine: ade brain update (checksum-verified pre-signed assets, preflight-before-restart, staged atomic promote + rollback, auto-detected launchd/systemd/Windows restart, decoupled from the desktop-app version, hardened by #868). But it is only reachable by typing the command in a local/remote shell — it is not a sync remote command and has no iOS/web surface. Competitor t3code exposes remote brain self-update from the phone.

Two update targets (keep distinct)

• Desktop APP (Electron shell) → electron-updater; only the desktop can swap its own running binary.
• Brain / RUNTIME (headless daemon / sync host) → what phones/web connect to; the right thing to update remotely.

Approach (~80% already built)

1. Register a runtime.update sync/RPC command wrapping runBrainUpdateCommand; add to the SyncRemoteCommandAction union (shared/types/sync.ts) + syncRemoteCommandService.
2. Surface update-status.json (staging→staged→applying→restarting→succeeded/failed) + current/available version over sync; ride the bounded-reconnect from Make remote connections recover reliably #867/Make remote sessions recover reliably under load #869 across the restart.
3. Put updateAvailable in the connection/config payload so clients badge without polling.
4. Per-surface UI: desktop "brain update available" indicator; iOS Settings/Machine "Update" row + progress sheet; web banner + button.
5. Authz: paired+authenticated client + a runtime:update capability scope + confirm dialog; rely on existing preflight + rollback.

Open decision

Do we also want to trigger the desktop-APP (Electron) update remotely, or only the brain? (Can't hot-swap the app a user is actively viewing from their phone.)

Acceptance

• From iOS and web: trigger a remote brain update, watch staged progress, graceful reconnect, rollback on failed preflight.

Related

ADE-100 (brain shutdown guard — same serviceManager/restart surface). Source: t3code remote self-update (cloud/selfUpdate.ts, pinnedRuntime.ts).

[linear-code]

ADE-127