ClickOnce upgrade rollback limits: when does automatic rollback not occur?

Direct answer

Automatic rollback does not occur once the ClickOnce runtime has activated a new version and marked it as current. If a failure or corruption occurs after this activation point, the runtime does not automatically revert to the previous version. Additionally, while the ApplicationDeployment.Rollback API provides a manual recovery path, it is only functional for online ClickOnce applications; offline-installed instances have no supported programmatic rollback mechanism and typically require a full reinstallation.

Established behavior and limits

• Activation Sequence: ClickOnce typically downloads update files before activating the new version. A failure during the download phase usually leaves the previous version intact. However, if the runtime commits the new version as current, any subsequent corruption or failure is not automatically rolled back.
• API Constraints: The ApplicationDeployment.Rollback method (found in System.Deployment.Application) allows an application to restore the previous version. This is strictly limited to online deployments.
• Manifest Configuration: While the .application deployment manifest controls update checks and subscription behavior, there is no widely documented manifest attribute that explicitly "toggles" the automatic rollback guarantee.

Uncertainties and verification

The internal logic the runtime uses to decide when a deployment is "committed" is not fully documented. Behavior may vary across different .NET Framework versions and OS servicing updates. Claims that rollback semantics are identical across all .NET Framework versions (e.g., 2.0 through 4.8) should be treated as unverified and tested against the specific environment in use.

Practical recovery and diagnostics

1. Verify Installation Mode: Determine if the application was published as online-only or available offline. This determines if ApplicationDeployment.Rollback is a viable recovery option.
2. Inspect Manifests: Use Mage.exe or MageUI.exe to examine the .application deployment manifest to verify the published update settings.
3. Analyze Logs: Review the Windows Event Viewer and ClickOnce deployment logs to identify if the failure occurred before or after the activation phase.
4. Offline Recovery: For offline-installed applications in a corrupted state, the only reliable recovery path is a manual uninstall and reinstall via the system's Add/Remove Programs.

One missing diagnostic detail: Is the affected application installed as an online or offline instance? This determines whether a programmatic rollback is possible or if reinstallation is the only path.