53 lines
2.0 KiB
Plaintext
53 lines
2.0 KiB
Plaintext
@startuml
|
|
title A/B trial boot and recovery
|
|
skinparam shadowing false
|
|
skinparam monochrome true
|
|
|
|
state "A confirmed" as A
|
|
state "Prepare B\nA remains the normal boot choice" as Preparing
|
|
state "B prepared and verified" as Prepared
|
|
state "B trial pending\nSaved target and attempt limit" as Pending
|
|
state "B trial running\nUnconfirmed" as Trial
|
|
state "B confirmed" as Confirmed
|
|
state "Recovery to A pending" as Recovering
|
|
state "A recovery running" as Recovery
|
|
state "A recovery checked" as Recovered
|
|
state "Separate recovery required" as Failed
|
|
|
|
[*] --> A
|
|
A --> Preparing : begin installation
|
|
Preparing --> Preparing : reset during preparation; boot A\nB is not eligible for trial
|
|
Preparing --> A : abandon incomplete or failed preparation
|
|
Preparing --> Prepared : installation and verification complete
|
|
Prepared --> Pending : save trial request through boot control
|
|
Pending --> Trial : reset [attempts left > 0]; save attempts left - 1\nbefore handing control to B
|
|
Trial --> Confirmed : local checks pass within time limit;\nsave confirmation
|
|
Trial --> Recovering : local checks fail; save recovery request
|
|
Trial --> Pending : reset before confirmation\n(power loss or covered watchdog)
|
|
Pending --> Recovering : reset; no attempts left
|
|
Recovering --> Recovery : boot control selects A on reset
|
|
Recovery --> Recovered : local recovery checks pass;\nsave outcome
|
|
Recovery --> Failed : recovery checks fail or startup fails\n(platform recovery policy)
|
|
Confirmed --> [*]
|
|
Recovered --> [*]
|
|
Failed --> [*]
|
|
|
|
note right of Pending
|
|
Boot state is outside A and B.
|
|
Attempts are consumed before starting B.
|
|
Invalid records require a platform-defined
|
|
recovery path, never implicit confirmation.
|
|
end note
|
|
|
|
note right of Recovery
|
|
A must still be compatible with shared data.
|
|
Do not endlessly alternate failed systems.
|
|
end note
|
|
|
|
legend bottom
|
|
Preparation interruption assumes the installer preserves A and boot state.
|
|
State transitions assume valid durable records; torn writes need platform testing.
|
|
Checks and recovery are local; reports wait for connectivity.
|
|
endlegend
|
|
@enduml
|