# Safe update design

## Why not a custom A/B bootloader

The DJControl Mix Ultra has 256 KB of internal flash. The stock application
occupies that space, and the STM32 ROM DFU bootloader already lives in system
memory. A custom bootloader would require relocating the application, changing
its vector table, and reserving flash for the bootloader. A full second
application image would not fit.

That makes a true A/B update scheme impractical without external storage or a
compressed/delta update format. The risk of a custom bootloader is higher than
the benefit for this device.

## What we implement instead

A verified update workflow:

1. Read the full 256 KB image over WebUSB DFU.
2. Compare it with the known stock, jog-only, and jog + pitch hashes.
3. Download a backup. For a patched controller, reconstruct the stock image
   before download.
4. Apply only the selected patch bytes, with a hash check before writing.
5. After writing, power-cycle and re-enter DFU.
6. Read the image again and verify the readback hash on the diagnostics page.
7. If anything is wrong, restore the stock image.

## Recovery

- The ROM DFU bootloader is independent of the application image.
- Enter DFU by holding Neural Mix while powering on.
- Keep the stock image and the patch images on disk.
- Do not interrupt power during a write.

## Future options

If a hardware revision adds external flash or a larger MCU, revisit:

- A/B images with rollback.
- Signed update manifests.
- Automatic integrity checks before boot.