06 - atomic update

diagrams/plantuml/ab-installation-recovery.puml

@@ -0,0 +1,42 @@
+@startuml
+title A/B installation and restart decisions
+skinparam shadowing false
+skinparam monochrome true
+state "A confirmed\nB inactive; no pending trial" as Idle
+state "Intent saved\nWriting B" as Writing
+state "B fully written\nNot yet verified" as Written
+state "B verified\nPrepared state saved" as Prepared
+state "Trial request saved\nOTA progress may still be old" as Requested
+state "Inspect saved boot state\nand target release" as Inspect
+state "Separate recovery policy" as Recovery
+state "Trial boot lifecycle\nSee existing trial boot diagram" as Trial
+
+[*] --> Idle
+Idle --> Writing : save release and target
+Writing --> Written : complete storage writes
+Written --> Prepared : verify expected contents; save prepared state
+Prepared --> Requested : boot control saves trial request
+Requested --> Trial : restart; consume attempt through boot control
+Writing --> Inspect : restart
+Written --> Inspect : restart
+Prepared --> Inspect : restart
+Requested --> Inspect : restart before entering trial lifecycle
+Inspect --> Writing : A selected; B incomplete\nrestart preparation under policy
+Inspect --> Prepared : A selected; B complete\nverify again; save prepared state
+Inspect --> Requested : saved B trial found\nrepair progress; preserve attempt count
+Inspect --> Recovery : no valid boot state
+Written --> Idle : verification fails; abandon B
+Recovery --> [*]
+Trial --> [*]
+
+note right of Inspect
+  Read boot state before writing B.
+  Never infer confirmation from progress.
+  A saved boot request wins over old progress.
+end note
+legend bottom
+  One A-to-B installation. No shared data migration or shared boot update.
+  Writes assume the platform's durability and record validation contract.
+  Trial outcomes and later updates belong to the trial boot lifecycle.
+endlegend
+@enduml

diagrams/plantuml/ab-installation-sequence.puml

@@ -0,0 +1,48 @@
+@startuml
+title A/B preparation and activation
+skinparam shadowing false
+skinparam monochrome true
+participant "OTA manager" as Manager
+participant Installer
+database "Slot B" as B
+database "OTA progress" as Progress
+participant "Boot control" as Boot
+
+note over Manager, Boot
+  A is confirmed. B is inactive. No earlier trial is pending.
+  One installer owns B. A and shared data are preserved.
+end note
+Manager -> Progress : Save intent: release and target B
+Manager -> Installer : Prepare B
+Installer -> B : Write release
+Installer -> B : Complete required storage operations
+Installer -> B : Read and verify installed contents
+Installer --> Manager : Verified expected release
+note over Manager, Boot
+  Reset before activation: boot A.
+  Inspect B and verify again before a new activation request.
+end note
+Manager -> Progress : Save prepared release B
+Manager -> Boot : Save trial request for B
+Boot -> Boot : Persist target and attempt limit
+note right of Boot
+  Interrupted state write:
+  read valid old or new state,
+  or enter defined recovery.
+end note
+Boot --> Manager : Trial request saved
+note over Manager, Boot
+  Reset here: boot control may start B.
+  Old OTA progress must not cause a rewrite or fresh attempts.
+end note
+Manager -> Progress : Save trial-requested result
+Manager -> Boot : Restart into trial
+ref over Manager, Boot
+  Existing A/B trial boot, checks, and confirmation diagram
+end ref
+legend bottom
+  Success path only. Any error stops forward progress and requires state inspection.
+  Arrows assume completed durable operations under the platform storage contract.
+  A saved trial request is not confirmation.
+endlegend
+@enduml