Then my answer is (a) and (b).
You cannot guarantee that the update will succeed at all slaves, so abort/rollback is essential.
So how is this different from the model we have today - only today you will never find out if updates fail on any of your slaves!?