A B Slot Model

A/B slot model

Developer documentation. Full detail: docs/A_B_SLOT_MODEL.md — this page is a summary.

The Nebula Pad holds two complete, independent boot slots on the same eMMC:

Partition	Contents	Slot
mmcblk0p5 / p7	Stock kernel / rootfs	Slot 1 (stock, 8MiB / 500MB)
mmcblk0p6 / p8	Custom kernel / rootfs	Slot 2 (custom, same sizes)
mmcblk0p1	OTA boot marker	1MB, shared
mmcblk0p9	rootfs_data (/overlay)	Shared, not duplicated — 300MB ext4
mmcblk0p10	userdata (/usr/data)	Shared, not duplicated — ~6GB ext4

p9/p10 are shared between stock and custom via non-overlapping subdirectory namespaces — switching slots never exposes or overwrites the other side's data.

Two different, complementary marker tools — not competing or inconsistent:

Tool	Side	Semantics
write_ota_marker() in /etc/ota_marker.sh	Custom (NebulaOS's own)	Takes an explicit target (ota:kernel / ota:kernel2)
local_set_next_boot_device() in /etc/ota_bin/ota_local_method.sh	Stock (Creality's own, pre-existing)	Toggles — flips to whichever side you're not currently on

Automatic rollback: S00revert-safety unconditionally resets the marker to stock at the very start of every custom boot; only S99confirm-good, after polling Moonraker for klippy_state == "ready" (up to 30×5s), flips it back forward.

Known limitation: this protection is itself part of the new image's init sequence. If the kernel never boots, or the rootfs never mounts far enough for /sbin/init to run, S00revert-safety never executes. NOT_PROVEN against an intentionally broken kernel/rootfs pair — not addressed by any mechanism in this repo today.

scripts/flash-spare-slot.sh is the canonical, safety-hardened whole-image flasher: always targets slot 2 only, refuses if target == active slot (hardening from a real historical incident), re-checks preflight immediately before any write (no TOCTOU gap), and MD5-verifies on read-back. It does not flip the OTA marker itself.

See also: Developer Install From Stock, Developer Recovery.