>I think attempting to automatically "undo" partially failed distributed operations is fraught with danger. We once tried it, and decided against it because 1

>I think attempting to automatically "undo" partially failed distributed operations is fraught with danger. We once tried it, and decided against it because 1) in practice rollbacks were rarely properly tested and were full of bugs 2) we had a few incidents when a rollback overwrote everything with stale data Manual intervention is probably the safest way.