# P2.2B rollback

This STEP deletes only the explicitly authorized legacy development
identity/business dataset on VM121. It preserves schema/Alembic and the system
egress tables.

Two encrypted backups are created under `/root/router-db-backups/` with the
existing root-only key `/root/.config/wg-access/db-backup.pass`:

1. `wg-access-p22b-history-*.dump.enc` — retained historical copy of the
   pre-retirement development dataset; restore and cleanup are proven on a
   clone before live writers are touched.
2. `wg-access-p22b-rollback-*.dump.enc` — fresh backup created after all known
   DB writers are quiesced; it is independently restored and compared before
   the live DELETE transaction begins.

If any live write has started and `CORE_DATABASE_CHANGE_COMPLETE=false`, the
target script recreates the whole live database from the rollback backup and
verifies Alembic, schema fingerprint, and complete table-data digest before
restoring runtime writers. It never attempts a partial/manual re-insertion of
rows.

If database restore verification fails, runtime writers remain quiesced and
`ROLLBACK_STATUS=FAIL`; do not manually resume them until the database is
recovered from the retained encrypted rollback backup.

After `CORE_DATABASE_CHANGE_COMPLETE=true`, do not restore the legacy dataset
merely because a later runtime-resume/publication/archive phase stops. The
clean baseline has then been independently proven and a continuation must
resume from the first unfinished phase.