@startuml
title Example rollback window across a release lifecycle
skinparam shadowing false
skinparam monochrome true
participant "Release lifecycle" as Release
participant "Rollback policy" as Policy
participant "Shared data" as Data
participant "Slot A" as A

Release -> Policy : Admit B's trial; retain eligible A
Policy -> A : Preserve A and matching artifacts
Policy -> Data : Require A/B-compatible reads and writes
note over Policy,A
  Rollback window open during trial.
end note
Release -> Release : B passes local checks
Release -> Policy : Confirm B
note over Policy,Data
  Confirmation accepts B. It does not itself prove that later
  data changes remain compatible or define a retention period.
end note
opt Product promises rollback after confirmation
  Policy -> A : Continue retaining eligible A
  Policy -> Data : Continue preserving A compatibility
end
Release -> Policy : End promised rollback period
Policy -> Policy : Durably close A's rollback window
note over Policy,A
  If closure is interrupted, never infer an open window
  after its prerequisites have been removed.
end note
opt Incompatible migration required
  Release -> Data : Migrate under a separate recovery procedure
end
opt A becomes the target of a later update
  Release -> A : Reuse under the next update's admission policy
end
note over Policy,A
  A is no longer promised as an ordinary recovery choice.
  Separate recovery and security policy still apply.
  Closure, migration, and slot reuse are distinct events.
end note
@enduml