diff --git a/diagrams/rendered/ab-storage-layout.png b/diagrams/rendered/ab-storage-layout.png new file mode 100644 index 0000000..fbfdaaf Binary files /dev/null and b/diagrams/rendered/ab-storage-layout.png differ diff --git a/diagrams/rendered/ab-storage-layout.svg b/diagrams/rendered/ab-storage-layout.svg deleted file mode 100644 index 3954b2c..0000000 --- a/diagrams/rendered/ab-storage-layout.svg +++ /dev/null @@ -1,79 +0,0 @@ -A/B storage: logical areas and access responsibilitiesDevice storage (logical areas, not a partition table)Persistent device dataShared boot componentsSeparate update and recovery methodBoot stateNormal slot, trial target, attempts, confirmationSlot A: retained systemKernel + device tree + root filesystemSlot B: update targetKernel + device tree + root filesystemDownload and work areaDisposable preparation filesIdentity and calibrationRestricted accessConfiguration and application dataMust support the retained versionOTA progress, failure blocksand pending reportsInstallerBoot controlOTA manager /confirmation programRunning systemand applicationsreplace inactive slotuse temporary filesexecuteread / save before Linux startsselect matching componentsselect matching componentsrequest trial / confirmthrough platform interfaceread / saveread / writeauthorized access onlyA is running while B is prepared. Preserve A, boot state and device data.Persistent device data survives replacement of either system slot.Shared data is not rolled back by selecting A.Both system versions must understand the recovery records they read.Separate logical areas do not guarantee safe writes or whole-device recovery. \ No newline at end of file diff --git a/diagrams/rendered/ab-trial-boot.png b/diagrams/rendered/ab-trial-boot.png new file mode 100644 index 0000000..cece93f Binary files /dev/null and b/diagrams/rendered/ab-trial-boot.png differ diff --git a/diagrams/rendered/ab-trial-boot.svg b/diagrams/rendered/ab-trial-boot.svg deleted file mode 100644 index 3ee0798..0000000 --- a/diagrams/rendered/ab-trial-boot.svg +++ /dev/null @@ -1,81 +0,0 @@ -A/B trial boot and recoveryA confirmedPrepare BA remains the normal boot choiceB prepared and verifiedB trial pendingSaved target and attempt limitB trial runningUnconfirmedB confirmedRecovery to A pendingA recovery runningA recovery checkedSeparate recovery requiredBoot state is outside A and B.Attempts are consumed before starting B.Invalid records require a platform-definedrecovery path, never implicit confirmation.A must still be compatible with shared data.Do not endlessly alternate failed systems.begin installationabandon incomplete or failed preparationreset during preparation; boot AB is not eligible for trialinstallation and verification completesave trial request through boot controlreset [attempts left > 0]; save attempts left - 1before handing control to Breset before confirmation(power loss or covered watchdog)local checks pass within time limit;save confirmationlocal checks fail; save recovery requestreset; no attempts leftboot control selects A on resetlocal recovery checks pass;save outcomerecovery checks fail or startup fails(platform recovery policy)Preparation interruption assumes the installer preserves A and boot state.State transitions assume valid durable records; torn writes need platform testing.Checks and recovery are local; reports wait for connectivity. \ No newline at end of file diff --git a/diagrams/rendered/ota-architecture.png b/diagrams/rendered/ota-architecture.png new file mode 100644 index 0000000..c545f6a Binary files /dev/null and b/diagrams/rendered/ota-architecture.png differ diff --git a/diagrams/rendered/ota-architecture.svg b/diagrams/rendered/ota-architecture.svg deleted file mode 100644 index 6316e52..0000000 --- a/diagrams/rendered/ota-architecture.svg +++ /dev/null @@ -1,69 +0,0 @@ -OTA roles and device boundaryRelease and deployment servicesDeviceBuild, test and publishArtifact storageDeployment managementOTA managerInstallerBoot controlLocal health checksPersistent update progressand pending reportspublish artifact andverification informationregister release and compatibilityauthorize preparationdownload and verifyrequest trial throughplatform interfaceconfirm after local checks passor request recovery after failuresave / resume progress;queue reports while offlinearrange checks after activationOTA manager -> deployment management: request releases; report running version and outcome.Boot control runs before the OTA manager and handles exhausted trial attempts.Hangs need a covered reset path. Checks and recovery do not require the server.Roles may be combined in one tool. This view uses a system update with trial boot. \ No newline at end of file