Update Installer

docs/MIGRATIONS.md

@@ -6,9 +6,15 @@ The user installer keeps application files in
 `~/.config/jarvis/qvac.config.json`. Memory, voice references, audit logs, and
 generated media remain under their existing Jarvis data directories.
 
-Upgrades replace only the application and extension files. Existing config and
-data are preserved. Run `systemctl --user daemon-reload` after installing a new
-service file, then restart `jarvisd.service`.
+Upgrades stop a running `jarvisd.service`, uninstall the previous GNOME
+extension, and replace `~/.local/share/jarvis-qvac` from a staging directory so
+leftover files from older versions cannot mix with the new tree. Failed staging
+directories next to the install prefix are removed first. Existing config and
+data under `~/.config/jarvis`, `~/.local/share/jarvis`, and the model cache are
+preserved. If the service was running, the installer restarts it after the
+replacement; `--enable` also enables the unit. Run
+`systemctl --user daemon-reload` only when you install the service file by
+hand.
 
 The uninstall command requires `--yes` and preserves data. Add
 `--purge-data` only when the user explicitly wants Jarvis-owned memory, cache,

docs/operations.md

@@ -16,9 +16,11 @@ curl -fsSL https://git.ssh.surf/snxraven/gnome-jarvis/raw/branch/main/packaging/
 ~~~
 
 The installer downloads the self-contained Bare bundle from the `rolling`
-release and delegates to the repository installer. Omit `--enable` to copy
-files without starting the service. Use `JARVIS_SERVER`, `JARVIS_REPO`, and
-`JARVIS_BUNDLE_URL` for a mirror.
+release and delegates to the repository installer. Re-running it replaces the
+previous user-local application and extension trees after stopping
+`jarvisd.service`; config and data stay in place. Omit `--enable` to copy
+files without starting the service unless the daemon was already running.
+Use `JARVIS_SERVER`, `JARVIS_REPO`, and `JARVIS_BUNDLE_URL` for a mirror.
 
 ## Development start