the question about fallback is 'when do I tell the machine that the normal boot succeeded'? At LANL, we learned the best place: as LATE in the boot process as possible, long after LInux is up. You want to be sure, if you set 'booted ok', that it is LINUX that booted ok, not just coreboot. That's a key piece.
Because if coreboot sets 'booted ok', and then the node doesn't boot, that's not doing you much good, is it? We learned that the hard way.
So: only linux boot scripts get to set 'normal booted ok', and that should be the last thing you do and many things get to clear 'normal booted ok', including linux, the payload, and coreboot itself.
But if you do it, of course, you want to always be sure the 'fallback image' is a good one :-)
ron