The OTA Updater is the only component allowed to change what software runs on the gateway. The cloud never pushes bits directly; instead it announces an update, and the updater pulls it, proves it is genuine, and applies it to a spare slot it can roll back to.
Beta: A/B rollback
The A/B slot strategy is currently rolling out across hardware revisions. Older single-slot gateways fall back to a verify-then-replace path without automatic rollback, so this component is marked beta until the fleet is fully on dual-slot images.
Every artifact is checked against an Ed25519 signature over TLS-fetched bytes. A failed signature aborts the update — nothing is written to a boot slot.
The new image is written to the inactive slot. The running system is never mutated in place, so a bad flash cannot brick the box.
After booting the new slot the device runs a health check window. Only a clean pass commits the slot; a failure (or watchdog reboot) flips back to the known-good slot automatically.
This component is the device-side terminus of the firmware rollout: