next chapter

diagrams/plantuml/rollback-window.puml

@@ -0,0 +1,43 @@
+@startuml
+title Example rollback window across a release lifecycle
+skinparam shadowing false
+skinparam monochrome true
+participant "Release lifecycle" as Release
+participant "Rollback policy" as Policy
+participant "Shared data" as Data
+participant "Slot A" as A
+
+Release -> Policy : Admit B's trial; retain eligible A
+Policy -> A : Preserve A and matching artifacts
+Policy -> Data : Require A/B-compatible reads and writes
+note over Policy,A
+  Rollback window open during trial.
+end note
+Release -> Release : B passes local checks
+Release -> Policy : Confirm B
+note over Policy,Data
+  Confirmation accepts B. It does not itself prove that later
+  data changes remain compatible or define a retention period.
+end note
+opt Product promises rollback after confirmation
+  Policy -> A : Continue retaining eligible A
+  Policy -> Data : Continue preserving A compatibility
+end
+Release -> Policy : End promised rollback period
+Policy -> Policy : Durably close A's rollback window
+note over Policy,A
+  If closure is interrupted, never infer an open window
+  after its prerequisites have been removed.
+end note
+opt Incompatible migration required
+  Release -> Data : Migrate under a separate recovery procedure
+end
+opt A becomes the target of a later update
+  Release -> A : Reuse under the next update's admission policy
+end
+note over Policy,A
+  A is no longer promised as an ordinary recovery choice.
+  Separate recovery and security policy still apply.
+  Closure, migration, and slot reuse are distinct events.
+end note
+@enduml