nilsandClaude Opus 5.5
a4f4ec12a3
The image gets a second, empty store slot. systemd-sysupdate (wrapped as router-update) installs a new version into the slot not in use: both store partitions, then the UKI with boot counting, verified against a signed SHA256SUMS. system.build.update holds a version's files. Counted boots must pass router-healthy (the router's units plus router.image.healthChecks, each checked on its own) to reach boot-complete.target; otherwise the box reboots, and once the tries are used up systemd-boot falls back to the previous version. checks.image now installs v2 into the empty slot, boots and blesses it, refuses a tampered update, and rolls a broken v3 back to v2. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>