Ethernet addressing, DHCP roles, Wi-Fi provisioning and recovery when a connection fails. Define user-visible states and diagnostic evidence as well as the successful connection path.
Bound update notifications before allocating their full representation or following their artifact links. A small firmware downloader can still exhaust memory, stack or connection time while parsing a large or deeply nested campaign message. Authentication does not remove the need to bound the work needed to reach an authentication decision. This guide uses an application-defined…
Define reset separately for campaign intent, execution authorization, transfer progress and actual installation state. A settings reset should not accidentally make an old campaign current again, while a lost local download checkpoint should not erase the management system’s knowledge that an approved update remains outstanding. This article proposes a product-level reset contract. RFC 9019 and…
Persist a high-water mark for accepted campaign intent, then check it again immediately before installation dispatch. An older job must not become eligible merely because its timer fires late, its download finally finishes, or its retry arrives after a newer campaign. Keep that desired-intent ordering separate from any installation already in progress. This is an…
Renew permission to fetch the same approved artifact, not permission to accept whatever bytes a new URL returns. Keep artifact identity and applicability separate from the short-lived transport locator. A renewed link can restore access while the expected payload digest, size and authorization remain unchanged. This guide uses Amazon S3 presigned-URL behavior documented on 14…
A device that reconnects after a maintenance window should follow an explicit late-execution policy. It may wait for the next approved occurrence, request renewed authorization, or run under a previously approved grace rule. It should not interpret “an update was once assigned” as permission to install at any later time. This guide defines an original…
Authorize a delta only after verifying the exact base bytes that its patch algorithm expects. A matching release label is insufficient if the device’s image was modified, personalized or rebuilt. After reconstruction, verify the expected output identity before treating the result as an installable candidate. This article uses librsync/rdiff 2.3.4 as a concrete patch-mechanism example…
Parse Retry-After into a validated earliest retry time, then compare that time with the existing campaign deadline. Do not restart the campaign budget when a server asks the client to wait. If the requested delay cannot fit, defer or end the attempt under policy rather than retrying earlier by silently clipping the delay. This guide…
Pause new rollout admissions when the evidence no longer justifies expanding exposure. Decide what to do with devices already updating or already running the release through a separate, device-state-aware recovery policy. A fleet pause does not undo an installation, and a rollback command is not a safe universal response to missing telemetry. This guide defines…
Keep canary membership stable by assigning it from a durable device identity and a versioned rollout rule, or by storing an authoritative server-side assignment. Do not draw a fresh cohort on every boot, reconnect or update check. A device that repeatedly reconnects should not receive repeated chances to enter an early rollout. This article defines…
Use Echo as a narrowly defined admission check: require evidence of request freshness or claimed-address reachability before the server starts the expensive work that depends on that evidence. Keep authentication, authorization, request validation, and resource quotas as separate gates. A valid Echo value does not make an operation permitted. This guide follows RFC 9175 and…