next chapter

diagrams/plantuml/rollback-policy.puml

@@ -0,0 +1,52 @@
+@startuml
+title Ordinary rollback policy after a failed system update
+skinparam shadowing false
+skinparam monochrome true
+start
+:Save failed release, reason, retry block,
+recovery intent and finite budget;
+:Exclude competing installation;
+if (Rollback window open and
+target eligible?) then (yes)
+  if (Recovery boot budget remains?) then (yes)
+    if (Current data usable by A?) then (yes)
+    else (no)
+      if (Valid compatible backup and
+restore explicitly authorized?) then (yes)
+        :Restore through the defined recovery procedure;
+        :Retain any data-loss result;
+      else (no)
+        :Save failure; enter separate recovery policy;
+        stop
+      endif
+    endif
+    :Boot control saves consumed attempt
+and selects A before handoff;
+    if (A reaches checks and passes
+within the deadline?) then (yes)
+      :Save recovery success and pending report;
+      :Retain failed-release block;
+      stop
+    else (no)
+      :Explicit check failure goes to separate recovery;
+      :Failure to reach checks uses reset path
+and remaining saved budget;
+      :Budget exhaustion goes to separate recovery;
+      stop
+    endif
+  else (no)
+    :Save exhausted budget; enter separate recovery;
+    stop
+  endif
+else (no)
+  :Save ineligible target; enter separate recovery;
+  stop
+endif
+legend bottom
+  Target eligibility includes artifacts, shared components, configuration,
+  recovery-state compatibility, and permission under security policy.
+  Early boot recovery relies on the contract established before trial.
+  A backup restore before A boots requires a capable recovery environment.
+  This diagram describes policy, not storage atomicity or a rescue implementation.
+endlegend
+@enduml