After the last incident we think that we have to set clear rules for rollbacks so the discussion about it is a little less. The votes we gathered on this topic are shown here.

It should be clear that no one really wants a rollback ever to happen. But sometimes things happen that are not in our hands. But no we dont plan on having another rollback at all in the rest of our admin life.

1. The rollback will always be to the latest tick possible.
2. No armies will be recalled.
3. Time of tick start to run again will be determined in some steps:
a) if within 12h after the server is up again the ticks will start to run at exact same time of the day, as the ticks went down (so bascially a 1 day break)
b) if the server is down only for a short time the time between server back up and tick start will be around as much as the time the server was down.

A few examples.
I) We get DDOS attacked and have to take the server down. In most cases this takes 12h. After that we rollback and bring the server back. By the time we take the server down we already know which database dumps were good and which not so we will announce the start of ticks for the next day at the time of day at which the attacks happened.
II) A bug messes up our database. Sledge takes server down to rollback. If he makes it to bring it back up the same tick it went down the ticks will start running right away (we basically only skipped one tick then). If server is down for 2 hours to do rollback then after server is back up we will skip 2 ticks before we start ticks again.

This probably doesnt cover all possible cases but if those happen we will come as close to these rules as possible. The only discussable thing then is when to start ticks again. Highest goal is to start the ticks at the same time of day as server went down. If that is too long away then rule b) applies. What could happen is that in case a) the time between server back up and tick start is only very short. In that case we might delay the tick start by 1 or 2 hours. Since these rules are set you know a full day in advance that the ticks will start running again at that set time.

Specifically to our last case. Attacks started at around 14:00. Tick 140 just happened. The database dumps are at :15 so the dump of tick 140 happened at 14:15 when the attacks were already going. Thats why we cant use tick 140. We notice the attacks and take the server down. Within one or two hours we are in a position to tell which tick was good and we announce rollback to tick 139 and tick start at 14:00 the next day. Sledge would check in the morning if attacks had really stopped and do the rollback before that. So somewhere in the morning (around 8:00 it happened) the server would have come back up, giving everyone enough time to do what they already had.

Would be great, but i can access db-dumps only server is up again. So i will know which db-dump is ok after server is up again. Means we will take a secure point of databasedump, if someting is damaged.

Yes I forgot this. People complained that we sholdnt bring the server back up before the rollback so no one could see into the future (if ticks still ran and server comes up for a few minutes then they could take a look at the news). There is a reason why we do that which you just heard from Sledge.

We will try to find a way around that but when its not possible its not possible.

I am quite sure we have a slight clue which dumps were ok and which were not at the beginning of the attack. So we will announce very early (everyone who knows how it works can tell for themselves) at around which tick it will continue. Ofc that can be +/-1 tick.