Context:
In order to allow resumable upgrade any atomic operation that is part of the upgrade should be idempotent and fail-safe if it already has been executed. The reason is that logging an operation to be completed may fail in itself and thus a reexecution of any step cannot be avoided in any case.

Best Refer to the anatomoy of an upgrade section in https://docs.google.com/document/d/1ldg2w6On3E5zSLrvsTPxiGXivaaDkNFSeE70edRBitA which operations need to be checked in regards to this.

AT:

• all operations of the upgrade are ensured to be idempotent and fail-safe to be rerun even though completed previously