From c66b747b0e9aae44a2c414015010ea9c50391c63 Mon Sep 17 00:00:00 2001 From: DevomB Date: Thu, 8 Oct 2026 19:06:00 -0700 Subject: [PATCH] The user guide says apply refuses on any slot but the committed one, and how the refusal's message puts that right #238 made kryptik-update apply run from the committed slot only; the guide's list of refusals named an armed trial, a degraded state and a failed trial. The recovery paragraph's overlong line is rewrapped. --- docs/user-guide.md | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/docs/user-guide.md b/docs/user-guide.md index 1f1bc002..66ab0f9a 100644 --- a/docs/user-guide.md +++ b/docs/user-guide.md @@ -311,9 +311,12 @@ The next boot runs the new slot; `boot-success` judges it (state partition usable, services up, the zone supervisor healthy) and only then makes it the committed boot file. An unhealthy trial reboots into the previous slot by itself. Persistent zone data on `kryptik-state` is never written by any of -this. `apply` refuses while another trial is armed (reboot first) and while -the state partition is degraded; after a trial that failed to boot it -refuses that slot again until you pass `--retry`. +this. `apply` refuses while another trial is armed (reboot first), while the +state partition is degraded, and on any slot but the committed one, such as +one picked in the firmware's boot menu: the refusal says how to boot the +committed slot, or to make the running one committed from the medium. After +a trial that failed to boot it refuses that slot again until you pass +`--retry`. ```sh kryptik-update rollback # back to the other slot, if it is intact @@ -341,10 +344,11 @@ state partition. slot, as the installer does, then commits it. Every byte comes from the medium, and the slot is committed only once it verifies against the root hash the medium's signed kernel carries. A medium whose root or slot kernel -is not that release's is refused with the reason, and nothing is committed. The state partition is not touched, so users -and zone volumes survive. The result is the medium's version, which may be -older than what was installed: the tool names the version it writes but does -not compare it, so read `--status` first. +is not that release's is refused with the reason, and nothing is committed. +The state partition is not touched, so users and zone volumes survive. The +result is the medium's version, which may be older than what was installed: +the tool names the version it writes but does not compare it, so read +`--status` first. A machine that stops responding resets itself after about a minute (the software watchdog's timeout; a hardware watchdog keeps its own): a service