@startuml
title A/B storage: logical areas and access responsibilities
left to right direction
skinparam shadowing false
skinparam monochrome true

actor "Installer" as installer
actor "Boot control" as boot
actor "OTA manager /\nconfirmation program" as manager
actor "Running system\nand applications" as runtime

rectangle "Device storage (logical areas, not a partition table)" {
  rectangle "Shared boot components\nSeparate update and recovery method" as shared
  database "Boot state\nNormal slot, trial target, attempts, confirmation" as state
  rectangle "Slot A: retained system\nKernel + device tree + root filesystem" as A
  rectangle "Slot B: update target\nKernel + device tree + root filesystem" as B
  database "Persistent device data" as data {
    rectangle "Identity and calibration\nRestricted access" as identity
    rectangle "Configuration and application data\nMust support the retained version" as appdata
    rectangle "OTA progress, failure blocks\nand pending reports" as progress
  }
  rectangle "Download and work area\nDisposable preparation files" as work
}

installer --> B : replace inactive slot
installer --> work : use temporary files
boot --> shared : execute
boot --> state : read / save before Linux starts
boot --> A : select matching components
boot --> B : select matching components
manager --> state : request trial / confirm\nthrough platform interface
manager --> progress : read / save
runtime --> appdata : read / write
runtime --> identity : authorized access only

legend bottom
  A is running while B is prepared. Preserve A, boot state and device data.
  Persistent device data survives replacement of either system slot.
  Shared data is not rolled back by selecting A.
  Both system versions must understand the recovery records they read.
  Separate logical areas do not guarantee safe writes or whole-device recovery.
endlegend
@enduml