@startuml
title A/B installation and restart decisions
skinparam shadowing false
skinparam monochrome true
state "A confirmed\nB inactive; no pending trial" as Idle
state "Intent saved\nWriting B" as Writing
state "B fully written\nNot yet verified" as Written
state "B verified\nPrepared state saved" as Prepared
state "Trial request saved\nOTA progress may still be old" as Requested
state "Inspect saved boot state\nand target release" as Inspect
state "Separate recovery policy" as Recovery
state "Trial boot lifecycle\nSee existing trial boot diagram" as Trial

[*] --> Idle
Idle --> Writing : save release and target
Writing --> Written : complete storage writes
Written --> Prepared : verify expected contents; save prepared state
Prepared --> Requested : boot control saves trial request
Requested --> Trial : restart; consume attempt through boot control
Writing --> Inspect : restart
Written --> Inspect : restart
Prepared --> Inspect : restart
Requested --> Inspect : restart before entering trial lifecycle
Inspect --> Writing : A selected; B incomplete\nrestart preparation under policy
Inspect --> Prepared : A selected; B complete\nverify again; save prepared state
Inspect --> Requested : saved B trial found\nrepair progress; preserve attempt count
Inspect --> Recovery : no valid boot state
Written --> Idle : verification fails; abandon B
Recovery --> [*]
Trial --> [*]

note right of Inspect
  Read boot state before writing B.
  Never infer confirmation from progress.
  A saved boot request wins over old progress.
end note
legend bottom
  One A-to-B installation. No shared data migration or shared boot update.
  Writes assume the platform's durability and record validation contract.
  Trial outcomes and later updates belong to the trial boot lifecycle.
endlegend
@enduml