Transactional updates on a small server
The upgrade runs inside a btrfs snapshot of the root; at reboot two renames swap it in, and rollback is the same two renames backwards. Built, measured and put through a 34-item acceptance list on a Secure Boot VM.