06 - atomic update

diagrams/plantuml/ab-installation-recovery.puml

@@ -0,0 +1,42 @@
+@startuml
+title A/B installation and restart decisions
+skinparam shadowing false
+skinparam monochrome true
+state "A confirmed\nB inactive; no pending trial" as Idle
+state "Intent saved\nWriting B" as Writing
+state "B fully written\nNot yet verified" as Written
+state "B verified\nPrepared state saved" as Prepared
+state "Trial request saved\nOTA progress may still be old" as Requested
+state "Inspect saved boot state\nand target release" as Inspect
+state "Separate recovery policy" as Recovery
+state "Trial boot lifecycle\nSee existing trial boot diagram" as Trial
+
+[*] --> Idle
+Idle --> Writing : save release and target
+Writing --> Written : complete storage writes
+Written --> Prepared : verify expected contents; save prepared state
+Prepared --> Requested : boot control saves trial request
+Requested --> Trial : restart; consume attempt through boot control
+Writing --> Inspect : restart
+Written --> Inspect : restart
+Prepared --> Inspect : restart
+Requested --> Inspect : restart before entering trial lifecycle
+Inspect --> Writing : A selected; B incomplete\nrestart preparation under policy
+Inspect --> Prepared : A selected; B complete\nverify again; save prepared state
+Inspect --> Requested : saved B trial found\nrepair progress; preserve attempt count
+Inspect --> Recovery : no valid boot state
+Written --> Idle : verification fails; abandon B
+Recovery --> [*]
+Trial --> [*]
+
+note right of Inspect
+  Read boot state before writing B.
+  Never infer confirmation from progress.
+  A saved boot request wins over old progress.
+end note
+legend bottom
+  One A-to-B installation. No shared data migration or shared boot update.
+  Writes assume the platform's durability and record validation contract.
+  Trial outcomes and later updates belong to the trial boot lifecycle.
+endlegend
+@enduml