How updates work — atomic OTA and automatic rollback

TurtiniOS updates over the air, atomically, and protects itself from bad updates.

How an update applies:
The OS has two boot slots (A/B). A new version is written to the inactive slot while the machine keeps running on the current one. On the next reboot the machine switches to the new slot. Nothing is modified in place, so an update can't leave the system half-patched.

The health gate:
After booting a new version, TurtiniOS runs a health check — are the core services actually up? On a server node it also checks the data layer, the registry, and the web app. If the check passes, the new version is confirmed as the known-good one. If it fails, the machine automatically rolls back to the previous slot on the next boot. In other words: a broken update can't strand a machine — it reverts itself.

What this means for you:
• Updates are hands-off and safe to apply broadly.
• A machine that fails to come up healthy after an update returns to the last version that worked, on its own.
• Your data lives on a separate writable area and survives updates and rollbacks — only the OS image itself swaps.

On disconnected networks, updates are delivered through a local mirror instead of the internet; the same atomic, self-healing mechanism applies.