OTA discipline for a device fleet

Do not update the whole fleet at once. Start with a bench unit and one canary, then a group. Keep the previous image ready for rollback.