Renew permission to fetch the same approved artifact, not permission to accept whatever bytes a new URL returns. Keep artifact identity and applicability separate from the short-lived transport locator. A renewed link can restore access while the expected payload digest, size and authorization remain unchanged. This guide uses Amazon S3 presigned-URL behavior documented on 14…
Put an update into a visible thermal hold when the required operating conditions are not established. Release that hold only after fresh, correctly mapped temperature evidence satisfies the product’s qualified recovery rule. Bound the waiting period so an installation cannot cycle forever between “retrying” and “too hot.” This article defines an original updater eligibility state…
Use separate power gates for acquiring an update and entering the stage that must finish without a safe pause. A device may have enough reserve to download a bounded chunk while lacking the qualified reserve for image programming, boot-state changes and recovery. Recheck immediately before that critical stage; an earlier battery reading is not a…
A device that reconnects after a maintenance window should follow an explicit late-execution policy. It may wait for the next approved occurrence, request renewed authorization, or run under a previously approved grace rule. It should not interpret “an update was once assigned” as permission to install at any later time. This guide defines an original…
RAUC adaptive updates can reuse matching local blocks while retaining the complete image in the bundle. Qualify this as an optional transfer optimization, including the cost of building missing indexes and the possibility of a full-copy fallback. It is not a delta that can only reconstruct one specific predecessor image. This guide is pinned to…
Authorize a delta only after verifying the exact base bytes that its patch algorithm expects. A matching release label is insufficient if the device’s image was modified, personalized or rebuilt. After reconstruction, verify the expected output identity before treating the result as an installable candidate. This article uses librsync/rdiff 2.3.4 as a concrete patch-mechanism example…
Parse Retry-After into a validated earliest retry time, then compare that time with the existing campaign deadline. Do not restart the campaign budget when a server asks the client to wait. If the requested delay cannot fit, defer or end the attempt under policy rather than retrying earlier by silently clipping the delay. This guide…
A RAUC install-check hook takes responsibility for compatibility acceptance. It does not simply add another condition after the ordinary compatible-string check. If the hook returns success without enforcing the required compatibility policy, a guard that the product previously relied on can disappear. This guide is pinned to RAUC v1.14 source and documentation. It qualifies a…
Pause new rollout admissions when the evidence no longer justifies expanding exposure. Decide what to do with devices already updating or already running the release through a separate, device-state-aware recovery policy. A fleet pause does not undo an installation, and a rollback command is not a safe universal response to missing telemetry. This guide defines…
Keep canary membership stable by assigning it from a durable device identity and a versioned rollout rule, or by storing an authoritative server-side assignment. Do not draw a fresh cohort on every boot, reconnect or update check. A device that repeatedly reconnects should not receive repeated chances to enter an early rollout. This article defines…