Over-the-Air Update
also called OTA, Firmware Update
Updating software on deployed physical devices remotely, where a failed update can require someone to physically visit the device.
The stakes distinguish this from software deployment. A failed server deployment is rolled back in minutes; a failed firmware update can brick a device installed inside a wall, on a pole, or in a customer's home, and the recovery cost is a van and an engineer.
The mechanisms that make it survivable are well established and non-negotiable. A/B partitions: the update is written to the inactive partition and the device switches on next boot, so a corrupt download never overwrites the working image. Signature verification before installation, checked by a bootloader that cannot itself be updated by an unsigned image — otherwise the update channel is a remote code execution path across the whole fleet. Automatic rollback driven by a watchdog, so a device that fails to boot or fails to check in reverts unattended. And resumable transfer, since devices on metered or intermittent links will not complete a large download in one attempt.
The fleet-level discipline mirrors progressive delivery: staged rollout to a small cohort first, with health telemetry gating each expansion. Updating an entire fleet at once has produced some of the most expensive incidents in the industry, and the mitigation costs nothing but patience.
Power loss during write is the failure that must be designed for explicitly, because in the physical world it is routine rather than exceptional.