It's the distinction between attempting an automatic recovery under application control, and the philosophy of the badness happened; get out NOW failure design.

It's the distinction between attempting an automatic recovery under application control, and the philosophy of the badness happened; get out NOW failure design. In complex systems, there's always the assumed potential for untoward behavior from unanticipated recovery environments; the handling of recovery can be a bigger problem than a complete failure. In these environments, clean failures are preferable. And staging the recovery processing can be preferred. This goes as far as staging application start-up and sequencing the component server reboots manually. Yes, manually.