Embodied agents are increasingly expected to improve over time by updating their executable capabilities rather than rewriting the agent itself. Prior work has separately studied modular capability packaging, capability evolution, and runtime governance. However, a key systems problem remains underexplored: once an embodied capability module evolves into a new version, how can the hosting system deploy it safely without breaking policy constraints, execution assumptions, or recovery guarantees? We formulate governed capability evolution as a first-class systems problem for embodied agents. We propose a lifecycle-aware upgrade framework in which every new capability version is treated as a governed deployment candidate rather than an immediately executable replacement. The framework introduces four upgrade compatibility checks -- interface, policy, behavioral, and recovery -- and organizes them into a staged runtime pipeline comprising candidate validation, sandbox evaluation, shadow deployment, gated activation, online monitoring, and rollback. We evaluate over 6 rounds of capability upgrade with 15 random seeds. Naive upgrade achieves 72.9% task success but drives unsafe activation to 60% by the final round; governed upgrade retains comparable success (67.4%) while maintaining zero unsafe activations across all rounds (Wilcoxon p=0.003). Shadow deployment reveals 40% of regressions invisible to sandbox evaluation alone, and rollback succeeds in 79.8% of post-activation drift scenarios.

翻译：具身智能体日益期望通过更新其可执行能力模块来随时间改进，而非重写智能体本身。已有工作分别研究了模块化能力封装、能力演化和运行时治理。然而，一个关键的系统问题仍未得到充分探索：当具身能力模块演化为新版本后，宿主系统如何在不违反策略约束、执行假设或恢复保证的情况下安全地部署它？我们将受控能力演化定义为具身智能体的首要系统问题。我们提出了一种生命周期感知的升级框架，其中每个新能力版本都被视为受控部署候选，而非立即可执行的替代品。该框架引入了四种升级兼容性检查——接口、策略、行为和恢复——并将它们组织成一个分阶段运行时流水线，包括候选验证、沙盒评估、影子部署、门控激活、在线监控和回滚。我们在6轮能力升级中进行了评估，每轮使用15个随机种子。朴素升级的任务成功率达到72.9%，但在最后一轮驱动不安全激活率达到60%；受控升级保持了相当的成功率（67.4%），同时在所有轮次中保持零不安全激活（Wilcoxon检验p=0.003）。影子部署揭示了40%的沙盒评估无法发现的回归问题，回滚在79.8%的激活后漂移场景中成功。