Partition device flash into two firmware slots (A and B) plus a bootloader that tracks which slot is active and whether the current boot has been confirmed; on unconfirmed boot the bootloader retries then rolls back to the last confirmed slot
Host firmware binaries in cloud storage (e.g., S3 or Azure Blob); publish a new firmware manifest (version, SHA-256 hash, download URL) to a dedicated MQTT topic or device twin desired property when a rollout begins
On the device, validate the manifest signature before downloading; download the binary in chunks to the inactive slot, verifying the SHA-256 hash of each chunk and the full image after completion
Instruct the bootloader to attempt booting from the new slot on next restart; after successful startup, run application-level health checks (connectivity, sensor readings, watchdog ping) before sending a confirm-boot command to the bootloader
Report the new firmware version via the device twin reported properties or a status MQTT topic; the backend marks the device as successfully updated only after receiving the confirmed version report
For staged rollouts, deploy to a canary group (e.g., 5% of fleet) first; monitor error rates and rollback reports before widening the rollout; maintain the ability to push a rollback manifest that reinstates the previous version
Known gotchas
Never overwrite the running firmware slot; writing to the active partition while executing from it causes undefined behavior — always write to the inactive slot and rely on the bootloader swap
A power loss mid-download must not leave the device in an unbootable state; store chunk progress in non-volatile memory and implement download resume rather than restarting from zero on every reconnect
Health check timeout must account for cold-start latency; if the application takes 30 seconds to initialize but the watchdog fires after 15 seconds the device will rollback every update even when the firmware is valid
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp