@startuml
title Ordinary rollback policy after a failed system update
skinparam shadowing false
skinparam monochrome true
start
:Save failed release, reason, retry block,
recovery intent and finite budget;
:Exclude competing installation;
if (Rollback window open and
target eligible?) then (yes)
  if (Recovery boot budget remains?) then (yes)
    if (Current data usable by A?) then (yes)
    else (no)
      if (Valid compatible backup and
restore explicitly authorized?) then (yes)
        :Restore through the defined recovery procedure;
        :Retain any data-loss result;
      else (no)
        :Save failure; enter separate recovery policy;
        stop
      endif
    endif
    :Boot control saves consumed attempt
and selects A before handoff;
    if (A reaches checks and passes
within the deadline?) then (yes)
      :Save recovery success and pending report;
      :Retain failed-release block;
      stop
    else (no)
      :Explicit check failure goes to separate recovery;
      :Failure to reach checks uses reset path
and remaining saved budget;
      :Budget exhaustion goes to separate recovery;
      stop
    endif
  else (no)
    :Save exhausted budget; enter separate recovery;
    stop
  endif
else (no)
  :Save ineligible target; enter separate recovery;
  stop
endif
legend bottom
  Target eligibility includes artifacts, shared components, configuration,
  recovery-state compatibility, and permission under security policy.
  Early boot recovery relies on the contract established before trial.
  A backup restore before A boots requires a capable recovery environment.
  This diagram describes policy, not storage atomicity or a rescue implementation.
endlegend
@enduml