the boot entry is the rollback

Replacing a machine's operating system means writing over the only thing that knows how to start it. The boot configuration is not part of the image being installed; it belongs to the machine and to the firmware that reads it. In this work the original boot configuration was recovered rather than replaced — read out of the machine's existing state and grafted back onto the new system — so that the machine's own record of how to start survived the change.

The tension is that a clean installation wants to own everything, and the boot path is the one place where owning everything is a liability. If the new boot configuration is wrong, the machine is not slow or half migrated; it is absent. Recovery then costs a console session or a hosted rescue mode, which is measured in hours of somebody's night rather than in a revert.

The decision, then: treat the firmware's record as state to preserve, and let the boot entry be the rollback unit. Keeping a known-good entry is nearly free — a copy of a small configuration and a stage in the install that reads it before anything is overwritten. What it buys is a machine that can be returned to the state it was in without the image, the network or the person who made the change being available.

What it proves is that a rollback path only counts if it does not depend on the thing that failed.