53 lines
1.7 KiB
Plaintext
53 lines
1.7 KiB
Plaintext
@startuml
|
|
title Ordinary rollback policy after a failed system update
|
|
skinparam shadowing false
|
|
skinparam monochrome true
|
|
start
|
|
:Save failed release, reason, retry block,
|
|
recovery intent and finite budget;
|
|
:Exclude competing installation;
|
|
if (Rollback window open and
|
|
target eligible?) then (yes)
|
|
if (Recovery boot budget remains?) then (yes)
|
|
if (Current data usable by A?) then (yes)
|
|
else (no)
|
|
if (Valid compatible backup and
|
|
restore explicitly authorized?) then (yes)
|
|
:Restore through the defined recovery procedure;
|
|
:Retain any data-loss result;
|
|
else (no)
|
|
:Save failure; enter separate recovery policy;
|
|
stop
|
|
endif
|
|
endif
|
|
:Boot control saves consumed attempt
|
|
and selects A before handoff;
|
|
if (A reaches checks and passes
|
|
within the deadline?) then (yes)
|
|
:Save recovery success and pending report;
|
|
:Retain failed-release block;
|
|
stop
|
|
else (no)
|
|
:Explicit check failure goes to separate recovery;
|
|
:Failure to reach checks uses reset path
|
|
and remaining saved budget;
|
|
:Budget exhaustion goes to separate recovery;
|
|
stop
|
|
endif
|
|
else (no)
|
|
:Save exhausted budget; enter separate recovery;
|
|
stop
|
|
endif
|
|
else (no)
|
|
:Save ineligible target; enter separate recovery;
|
|
stop
|
|
endif
|
|
legend bottom
|
|
Target eligibility includes artifacts, shared components, configuration,
|
|
recovery-state compatibility, and permission under security policy.
|
|
Early boot recovery relies on the contract established before trial.
|
|
A backup restore before A boots requires a capable recovery environment.
|
|
This diagram describes policy, not storage atomicity or a rescue implementation.
|
|
endlegend
|
|
@enduml
|