@startuml
title OTA roles and device boundary
left to right direction
skinparam shadowing false
skinparam monochrome true
skinparam packageStyle rectangle

package "Release and deployment services" {
  component "Build, test and publish" as release
  component "Artifact storage" as artifacts
  component "Deployment management" as deployment
}

package "Device" {
  component "OTA manager" as manager
  component "Installer" as installer
  component "Boot control" as boot
  component "Local health checks" as checks
  database "Persistent update progress\nand pending reports" as progress
}

release --> artifacts : publish artifact and\nverification information
release --> deployment : register release and compatibility
manager --> deployment
manager --> installer : authorize preparation
installer --> artifacts : download and verify
manager --> boot : request trial through\nplatform interface
checks --> boot : confirm after local checks pass\nor request recovery after failure
manager --> progress : save / resume progress;\nqueue reports while offline
manager --> checks : arrange checks after activation

legend bottom
  OTA manager -> deployment management: request releases; report running version and outcome.
  Boot control runs before the OTA manager and handles exhausted trial attempts.
  Hangs need a covered reset path. Checks and recovery do not require the server.
  Roles may be combined in one tool. This view uses a system update with trial boot.
endlegend
@enduml