sorry for jumping late into conversation.
reading through, I'd say:
no need for kernel snap to contain ready boot.img it should contain kernel and ramdisk images. Gadget snap should contain recipe how to build boot image out of it. My reason for this is that on some platforms (mediatek) boot.img and recovery.img are not interchangeable, where difference is only in one flag when assembling image. Also if we need to attache extra command line parameters this would be done once we know them at assembly time. Allows us sharing same kernel on different devices if they only differ in kernel commands….
I'd agree that snap-prepare should be included as soon as we can, as we will need some way to build images as well, and ubuntu-image already relies on snap-prepare there so it actually can save some additional work on build target image side.
Additional idea, would be to re-evaluate need for core snap revision control to be included in kernel command line and controlled from uboot/grub/(fastboot). It's adding complexity and I think we can equally handle whole thing from initrd.
For fallback between boot/recovery images:
My idea was that when we install new kernel snap, we first build recovery image and flash it to recovery partition ( as we know boot partition path is working fine), mark flag we are "testing" and test reboot to "recovery" mode. If recovery boot succeeds snapd will erase "testing" flag, flash (repackage if needed) boot.img to recovery partition to maintain working fallback option, and recovery image will be burned(repackage if needed) to boot partition. This way we get auto fallback for free. Recovery boot is done with non persistent recovery flag through android bootloader, so if it fails, next boot will automatically fallback to boot partition, where we check for "testing" flag, if it's still there we know recovery boot went sideways and kernel snap should be marked as rotten.
And one more thing, which I still need to think more in details.
This all applies to platforms supporting pre Android 7, since Android 7 we will have lot better support from boot loaders, as it supports two boot partition for transactional updates added in Android 7