OTA design: glossary, ADR 0003 (own signature check), plan

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT
This commit is contained in:
2026-10-03 21:27:04 +02:00
co-authored by Claude Opus 5.5
parent 045c7c3e8f
commit e9efbcca4d
3 changed files with 61 additions and 0 deletions
+17
View File
@@ -104,6 +104,22 @@ The Notification raised once per boot when the SD card passes 80% full. Selectin
**Storage Clean-up**:
The screen where the user deletes old Logs and Captures by category and age, with a preview of the space freed. Notes are never offered for deletion.
**Firmware Update**:
Installing a new firmware image without a USB cable: pushed over Wi-Fi from the developer's PC, or read from the SD card.
_Avoid_: flash, upgrade (alone)
**Update File**:
One signed file (`.ota`) that carries a firmware version, its image and a signature. The same file works over Wi-Fi and from the SD card. Anything not signed with the project's key is refused.
_Avoid_: binary, bin
**Probation**:
The state of newly installed firmware until it proves healthy: booted, UI drawn, Services started, 30 s without a crash, and Wi-Fi connected if it's configured. Then it's confirmed for good.
_Avoid_: trial, test mode
**Rollback**:
Returning automatically to the previous firmware when new firmware resets or crashes during Probation.
_Avoid_: revert, downgrade (a downgrade is installing an older version on purpose)
## Relationships
- The **Launcher** starts **Apps**. Exactly one **App** is in the foreground.
@@ -114,6 +130,7 @@ The screen where the user deletes old Logs and Captures by category and age, wit
- A **Sweep** pauses the **Mesh Service**; a **Sniffer** does not.
- Every transmission is bounded by the **Region** and its **Duty Cycle Budget**.
- Past 90% SD usage, **Logs** stop being written; the remaining space is kept for **Captures**. Nothing is deleted without the user's confirmation.
- A **Firmware Update** installs an **Update File**; the new firmware runs on **Probation**, and fails back by **Rollback**.
- A **Node** may be in several **Channels**. A **Direct Message** targets exactly one **Node**.
## Flagged ambiguities