Sorry for the slow reply!
Preferably you would want to be able mark “old” as insecure and to be able to disable the automatic rollback.
That makes sense. You probably wouldn’t even have to erase the image, just change/delete the recovery_prefix or rename the kernel or something like that. I guess it depends on how thorough you want to be. It would likely require some extra changes in the mender client either way though. I’ll mention that it would be nice to make the fallback boot selectable and see what they say.
It sounds like we’re on the same page! I’ll write up a comment on GitHub detailing what we’ve discussed. Hopefully they’ll be agreeable. I really appreciate all your help in sorting through this. Have a great day!