Update and Rollback

Update & rollback

Canonical detail: NebulaOS-firmware's Developer Update page.

Three distinct concepts:

• Component updates (Klipper, Moonraker) — LIVE_HARDWARE_VERIFIED via Moonraker's Update Manager, backstopped by an update-health-check supervisor that can roll a component back.
• Whole-image developer update — HISTORICALLY_HARDWARE_VERIFIED as a manual operator sequence. No fully automated release discovery, download, or whole-image updater exists today.
• Future OTA architecture — design-only, not implemented.

Automatic rollback safety net: the very first thing a custom boot does is reset the OTA marker back to stock; only after Klipper/Moonraker are confirmed healthy does it flip forward again. See A/B Slot Model for the exact mechanism and its one known limitation (a kernel/rootfs that never boots far enough for this protection to even run).