# P23B rollback boundary

Before `CORE_DATABASE_CHANGE_COMPLETE=true`, the VM121 target worker owns rollback:

1. restore the entire live PostgreSQL database from the separately created and restore-proved encrypted rollback backup;
2. restore the three pre-P23B source files from the private source backup and verify their exact pre-step SHA256 values;
3. only after both DB and source rollback are proven, restore writer/runtime states.

Do not use Alembic downgrade: 0003 is intentionally forward-only.

After independent live readback proves 0003 schema, preserved zero business data, unchanged egress system data and exact compatible source SHA values, the core is complete. Failures after that boundary (runtime recovery, Machine Git close, publication/archive) are continuation work and must not destructively restore the pre-0003 database/source.

Encrypted DB backups and the backup passphrase are private and are never placed in public STEP payloads.