I understand, and I agree in those specific cases - those are good examples. The thing is - they are both problems in their own right - the power on issue (which is a h/w power draw problem, we are figuring a way out of it), and the logs being lost problem (which is high on my agenda to fix - I don't want to lose the logs either). I'd rather not add OTA not being completed as another problem, as a work around for problems that I should anyway be fixing
The problem in this specific case is that users aren't around very much. In fact in a test rollout last year, the scenario was that an "admin" might log into the boxes maybe once a month. This is going to be true for most non-technical users. Its important that the device self-manage.
OS updates like on windows etc - they have the advantage that they are on bidirectional links (which helps with correcting for missing updates), and they are not in a resource limited system (which helps with being able to keep and manage multiple update sets). They can also constantly nag users. In the early windows versions, updates weren't this insistent, and we know how few people updated their WinXP systems.
My users can very easily ignore the nags as they are at the end of a remote browser sessions - just close the browser tab - an OS alert you can't ignore very long.
Then, due to resource limits, I cannot allow a situation where a second OTA hits before the previous one was completed via a reboot. Also, not everything can be maintained in two sets - its the base reality of an embedded system like this. So the transitory period before the reboot cannot be avoided - it then becomes critical to minimize that period.
Now - I do want to send an alert to the UI in case a user is actively using it. "click to delay the reboot by 30 minutes. If you do nothing, system will reboot in 2 minutes" - sth like that.
But the problem with that is, right now there is no infrastructure to push any alerts from the backend to the UI. Everything is client-initiated - like all http servers. Its not impossible to add, but its definitely a complex addition.
Its also something I eventually want to add - cause then I can do "new file received" kinda alerts. But its a longer haul process. Right now I am at the stage of making sure the "must have" requirements are all done, then I can move to "nice to have".