1. The patch that had to be reversible

Andy Weir’s The Martian returns as the recalled work because Mark Watney’s hacks are always improvised and always need an undo option. If a modification to the rover’s software or the Hab’s systems makes things worse, he must be able to revert. The desktop’s updates need the same property: every change should be reversible until it has proven itself.

This entry wonders about staged updates and rollback for the desktop.

2. Staging an update

A safe update process has several stages:

  • Download: the update is received and stored, often with checksums and signatures.
  • Verification: the update is checked for integrity, authenticity, and compatibility.
  • Staging: the update is prepared but not yet active.
  • Activation: the update is applied, often by rebooting into a new image or loading a new module.
  • Verification in operation: the platform confirms that the new software behaves correctly.
  • Commit: the update is made permanent; the old image is no longer needed.

Between activation and commit, the platform should be able to roll back to the previous image if something goes wrong.

3. Rollback strategies

Options for rollback include:

  • Dual-bank boot: two complete software images are stored; the bootloader selects one.
  • A/B partitions: the active partition is swapped after a successful boot.
  • Module-level rollback: individual applications can be unloaded and replaced.
  • Parameter rollback: configuration tables can be reverted independently of code.

The desktop’s modular cell architecture suggests a mix: full-image rollback for the bootloader and core, module-level rollback for applications, and parameter rollback for configuration.

4. Watchdogs and dead man’s switches

A failed activation must not leave the platform silent. A watchdog can:

  • Boot the previous image if the new image fails to come up.
  • Count boot attempts and force rollback after a threshold.
  • Notify ground through a minimal beacon if no valid image runs.

5. What this changes

  • Safe autonomous update requires staging, activation, verification, commit, and rollback as distinct steps.
  • The desktop should keep at least one known-good image at all times.
  • The next entry will ask what autonomous software updates need from the desktop architecture.