diff --git a/README.md b/README.md
index 6232d54..32aeddb 100644
--- a/README.md
+++ b/README.md
@@ -113,9 +113,33 @@ copilot-web                   # web console → http://localhost:3939  (runs off
 > The full `rantaiclaw setup` also walks channels / MCP, and those sections need network — on a
 > fully offline host stick to `rantaiclaw setup provider`.
 
-**Update** (there is no online update): download a newer `rantai-copilot-airgapped-<version>`
-bundle on a connected machine, transfer it, and re-run `./setup-airgapped.sh`. To build the bundle
-yourself on a connected **same-arch** host: `release/pack-airgapped.sh <rantaiclaw-binary> <tag>`.
+**Update** — there is no online update; `copilot-update` on an airgapped host just prints these
+steps. Download a newer `rantai-copilot-airgapped-<version>` bundle on a connected machine,
+transfer it, and re-run `./setup-airgapped.sh`. To build the bundle yourself on a connected
+**same-arch** host: `release/pack-airgapped.sh <rantaiclaw-binary> <tag>`.
+
+Before upgrading, on the target host — and carry the **previous** bundle in as well, it is your
+only way back:
+```bash
+tar czf ~/rantaiclaw-backup-$(date +%F).tar.gz -C ~ .rantaiclaw
+copilot-web stop
+```
+
+**Rolling back.** The installer copies `config.toml` to `config.toml.pre-<version>` before the new
+binary can touch it, because the config schema migrates one way: after the new binary's first real
+command, an older rantaiclaw refuses the profile outright (`schema_version=N is newer than this
+binary supports`). To go back, restore that copy and re-run the **old** bundle's
+`./setup-airgapped.sh`. `rantaiclaw rollback` will not help you here — it reads snapshots that only
+`rantaiclaw update` creates, and that needs network.
+
+> The full backup above covers what the config snapshot cannot. Neither `sessions/sessions.db` nor
+> `workspace/memory/brain.db` refuses a schema newer than it understands, so an older binary opens
+> one without complaint and would only fail later, at query time, and only if a migration had been
+> destructive. Both schemas are in fact unchanged from 0.8.3-alpha through 0.16.4-alpha — the
+> tarball is what covers you the day that stops holding.
+
+> `setup-airgapped.sh` replaces each skill directory wholesale. If anyone edited files under
+> `~/.rantaiclaw/profiles/<profile>/skills/`, copy them out first.
 
 ### From source (other platforms, or your own RantaiClaw)
 
@@ -124,7 +148,7 @@ For CPUs/OSes the prebuilt bundle doesn't cover, or to use a RantaiClaw you buil
 ```bash
 git clone https://github.com/RantAI-dev/RantAI-Copilot
 cd RantAI-Copilot
-./install.sh            # deploy the skills into your RantaiClaw workspace
+./install.sh            # deploy the skills into your RantaiClaw profile
 rantaiclaw setup        # set your LLM provider + key (if you haven't)
 ./web-ui.sh             # web console → http://localhost:3939  (later installed as: copilot-web)
 ```
@@ -189,11 +213,12 @@ COPILOT_UI_HOST=0.0.0.0 copilot-web    # 2. bind all interfaces → http://<this
 ```
 skill/hypervisor/     # Hypervisor (HCI) ops playbook: SKILL.md, RUNBOOK.md, reference/, scripts/
 tutorials/            # hands-on walkthroughs (hypervisor.md)
-install.sh            # deploy the skills into your RantaiClaw workspace (from source)
+install.sh            # deploy the skills into your RantaiClaw profile (from source)
 web-ui.sh             # one-command launcher for the web console (copilot-web)
 get.sh                # online installer (downloads the prebuilt bundle)
 copilot-uninstall     # remove the Copilot extension (keeps rantaiclaw unless --all)
 release/              # build-bundle.sh + pack-airgapped.sh + bundle files (setup, QUICKSTART)
+tests/                # installer behaviour matrix; airgapped bundle build + offline install
 ROADMAP.md            # planned skills
 ```