47 lines
2.0 KiB
Plaintext
47 lines
2.0 KiB
Plaintext
@startuml
|
|
title Recovery coordination and restart after boot handoff
|
|
skinparam shadowing false
|
|
skinparam monochrome true
|
|
participant "Recovery supervisor" as Supervisor
|
|
database "Recovery journal" as Journal
|
|
participant "Data recovery procedure" as Data
|
|
participant "Boot control" as Boot
|
|
participant "Retained system A" as A
|
|
|
|
Supervisor -> Journal : Save failed release, reason, block,\nrecovery intent and reporting obligation
|
|
Supervisor -> Supervisor : Exclude installs; establish target eligibility
|
|
opt Approved compatible backup needed
|
|
Supervisor -> Data : Restore under its interruption contract
|
|
Data --> Supervisor : Compatible data; loss accounting
|
|
Supervisor -> Journal : Save completed restore and data-loss result
|
|
end
|
|
Supervisor -> Boot : Request recovery boot of A
|
|
Boot -> Boot : Save selection and consumed recovery attempt
|
|
Boot --> Supervisor : Saved state / request result
|
|
... reset can occur before supervisor saves progress ...
|
|
Boot -> A : Handoff under saved boot state
|
|
A -> Supervisor : Start local recovery coordinator
|
|
Supervisor -> Boot : Read authoritative selection and budget
|
|
Boot --> Supervisor : A selected; attempt already consumed
|
|
Supervisor -> Journal : Reconcile progress; do not replenish budget
|
|
Supervisor -> A : Check required local functions with deadline
|
|
alt Checks pass
|
|
A --> Supervisor : Healthy
|
|
Supervisor -> Journal : Save recovery success, running release,\ndata loss and pending report; retain block
|
|
else Checks fail
|
|
A --> Supervisor : Failed
|
|
Supervisor -> Journal : Save recovery failure
|
|
Supervisor -> Supervisor : Enter separate recovery policy
|
|
end
|
|
note over Boot,A
|
|
If A cannot reach checks, the reset path and saved budget
|
|
bound further boots. Exhaustion enters separate recovery.
|
|
end note
|
|
note over Supervisor,Data
|
|
Supervisor available here is an assumption. If restoration must
|
|
precede A's startup, a capable recovery environment must perform it.
|
|
Each component needs its own durable write and restart contract.
|
|
The sequence is not one transaction. Reporting may remain offline.
|
|
end note
|
|
@enduml
|