Similar to the discussion in #782 -- we can gate the calls to Destroy and Provision of the new nodes and continuation to the next target of update with checks against the health of the node (via Flavor) and against the stored status/ plan described above.
See https://github.com/docker/infrakit/issues/783#issuecomment-348612516
This issue is to track this aspect: