cage
Updates are transactions against a slot you are not currently running. Install, seal, boot, promote — or roll back.
The disk carries two btrfs subvolumes. An update composes a new generation into the inactive one, non-destructively; the running system is untouched for the whole operation. The bootloader default moves only after the new slot has actually booted and passed its checks. If it does not, the default never moved, and the next boot is the machine you had yesterday.
The netboot artifact and an installed slot are the same kind of object: a signed unified kernel image. The installer is a server you run on a machine you already have, which makes the network the install medium rather than a USB stick.
This is what makes a rolling, always-newest-upstream distribution reasonable to run on a machine you care about. Tracking upstream closely is only safe when being wrong is cheap.