Field note
Field update rehearsals before customers become the test lab
Why staging a failed OTA on purpose teaches more than another green-path demo.
Demo updates that always succeed train optimism, not operations. Before a customer fleet depends on your pipeline, rehearse the ugly paths: power loss, wrong image, rolled-back bootslot, and support scripts that must run at 2 a.m.
Script the failure
Document who pulls the plug, who watches serial logs, and what “recoverable” means in customer language. If recovery requires a jig only available in your lab, say so in the risk register before sales promises universal OTA.
Time the human steps
Measure how long signing, uploading, and verifying take with the people who will actually do them. Tooling claims and human calendars rarely match on the first try.
Close with a go/no-go
End the rehearsal with an explicit decision: ship the update policy, narrow the cohort, or block until a gap closes. Ambiguous “we learned a lot” endings waste the rehearsal.