golden: the boot recovery net

golden is the fallback release in Microduck’s update system, and the last line of the boot recovery net.

Three version concepts

Concept	Meaning
current	What is running
The previous one	Where update rollback goes
golden	The always-stable fallback, where reset-to-golden goes

One rule worth remembering

A branch build never becomes golden.

Even when you provision a whole dev board with --ref BRANCH, golden stays the stable release and only current is the branch.

The reasoning is direct: a broken branch as the fallback gives a broken branch a broken lifeline. A fallback is worth having only because it is certain to come up, so it cannot be the unvalidated thing.

When to use it

For a board in a state you can no longer account for:

sudo robotctl update reset-to-golden daemon

This is the last resort. update rollback and update select are the gentler options.

The robot may have used it already

The health gate rolls back on its own, and only the log records it:

robotctl update log
journalctl -b -u robot-boot-check

“I definitely installed the new version” is often answered here.