rollback on upgrade failure