Retain a qualified path from every supported offline starting state to the current target, including any bridge package that upgrades the updater itself. Keeping only the newest firmware can strand a device whose old installer cannot understand the package intended to upgrade it. This guide uses RAUC 1.13’s documented intermediate-update pattern to build an original…
Admit a device to a bootloader campaign only when its recovery capability is proven for that installed unit and the campaign’s failure model. Application A/B slots, an updater reporting online, or a factory recovery success on another board do not establish that this device can recover after its loader stops working. This article defines an…
Make each hook effect repeat-safe or give it a stable deduplication identity and a reconciliation path. A local “done” file cannot, by itself, make an external action happen exactly once across power loss. If an interruption leaves the action’s outcome unknown, stop and resolve that uncertainty instead of blindly repeating irreversible work. This guide covers…
Admit an update against the peak additional allocation on each real storage pool, then reserve that budget through the stages that consume it. A bundle that fits its destination slot can still fail because staging, temporary output, recovery data or concurrent jobs exhaust another filesystem. This guide defines an original runtime admission ledger for a…
A reachable casync index bundle does not prove that the device can obtain all image data required for installation. Qualify the combination of index, actual local seed and accessible chunk stores. The decisive negative test withholds a chunk needed by the selected index and absent from every enabled local source. This guide is pinned to…
Persist a high-water mark for accepted campaign intent, then check it again immediately before installation dispatch. An older job must not become eligible merely because its timer fires late, its download finally finishes, or its retry arrives after a newer campaign. Keep that desired-intent ordering separate from any installation already in progress. This is an…
For a wrapper using RAUC 1.14’s documented D-Bus interface, promise cancellation only before the installation request is dispatched, after all application-owned work has acknowledged that it stopped. Once dispatch may have occurred, report a stop request or an unresolved result rather than claiming the installation was canceled. This is a deliberately conservative contract for one…
Route OTA and local service requests through one admission owner, and keep ownership until the actual installation outcome is reconciled. A client timeout, expired management lease or closed technician window does not establish that the installer has stopped. Letting a second actor take over on that assumption creates ambiguous writes and misleading completion reports. The…
Diagnose the file-access failure before changing the bundle or its permissions. A local bundle can have the expected signature yet still be unsafe to consume if another actor can change its contents. For removable-media updates, qualify where the installer reads the file, who can write it, and which operation is failing. This guide is pinned…
Partition recipients into bounded subsets, then distribute the correct recipient-specific bundle while reusing the same encrypted payload. The release system needs separate identities for payload content, recipient membership and the complete downloadable object. Treating all three as one filename makes both size budgeting and delivery errors harder to detect. This article uses RAUC 1.13 crypt…