next chapter

diagrams/plantuml/rollback-recovery-sequence.puml

@@ -0,0 +1,46 @@
+@startuml
+title Recovery coordination and restart after boot handoff
+skinparam shadowing false
+skinparam monochrome true
+participant "Recovery supervisor" as Supervisor
+database "Recovery journal" as Journal
+participant "Data recovery procedure" as Data
+participant "Boot control" as Boot
+participant "Retained system A" as A
+
+Supervisor -> Journal : Save failed release, reason, block,\nrecovery intent and reporting obligation
+Supervisor -> Supervisor : Exclude installs; establish target eligibility
+opt Approved compatible backup needed
+  Supervisor -> Data : Restore under its interruption contract
+  Data --> Supervisor : Compatible data; loss accounting
+  Supervisor -> Journal : Save completed restore and data-loss result
+end
+Supervisor -> Boot : Request recovery boot of A
+Boot -> Boot : Save selection and consumed recovery attempt
+Boot --> Supervisor : Saved state / request result
+... reset can occur before supervisor saves progress ...
+Boot -> A : Handoff under saved boot state
+A -> Supervisor : Start local recovery coordinator
+Supervisor -> Boot : Read authoritative selection and budget
+Boot --> Supervisor : A selected; attempt already consumed
+Supervisor -> Journal : Reconcile progress; do not replenish budget
+Supervisor -> A : Check required local functions with deadline
+alt Checks pass
+  A --> Supervisor : Healthy
+  Supervisor -> Journal : Save recovery success, running release,\ndata loss and pending report; retain block
+else Checks fail
+  A --> Supervisor : Failed
+  Supervisor -> Journal : Save recovery failure
+  Supervisor -> Supervisor : Enter separate recovery policy
+end
+note over Boot,A
+  If A cannot reach checks, the reset path and saved budget
+  bound further boots. Exhaustion enters separate recovery.
+end note
+note over Supervisor,Data
+  Supervisor available here is an assumption. If restoration must
+  precede A's startup, a capable recovery environment must perform it.
+  Each component needs its own durable write and restart contract.
+  The sequence is not one transaction. Reporting may remain offline.
+end note
+@enduml