Hey there. Unfortunately, I don’t know the real algorithm, but here are some of my own thoughts.
Dfinity is just a DLT after all. It uses blockchain to store data. Everything that is stored inside this blockchain is stored forever. IC app is just a couple of transactions in these terms - we just know how to interpret them right. App’s API methods invocations are also transactions. API method non-revoke mark is also transaction. When node sees this mark it thinks “now, when I detect any change to that API method, I will reject it, like I reject every other invalid transaction”.
So when you next time update your IC app, a node will run a migration mechanism for it and detect if your change to this app affected marked methods, and if so it will reject such a transaction.