Rollback

Purpose #

Describe the only recovery story this package will stand behind: restore a pre-change dump and run binaries that match that dump. This is not a certified rollback product.

What rollback is not #

• zwallctl update rollback / POST /api/v1/update-campaigns/{id}/rollback — updater, NOT_SUPPORTED for production
• Installing an older release onto a newer schema
• Hosting .../hosting-profile-transition/rollback as a general Manager rollback (it is a profile-transition sibling, NOT_VERIFIED per pair)

Procedure if migrate has **not** applied #

Keep the previous binaries and units. Fix the verifier or bundle. Do not start a half-admitted Manager.

Procedure if migrate **has** applied #

1. Stop Manager (and, if you will restore the live database name, stop writers).
2. Restore the pre-migrate dump into an isolated database first using scripts/restore_db.sh (script existence only; not a certified DR product).
3. If isolated verification passes, restore onto the Manager database name with RESTORE_DROP_RECREATE only after you have confirmed the name.
4. Restore Enterprise license identity and systemd credentials from the same backup generation.
5. Place the old Manager/Agent/eBPF artifacts that produced that dump.
6. Start units. Verify health, login, Agents.

If you no longer have matching old artifacts, this package cannot invent a recovery.

Verification #

• restored_schema_version matches the dump .meta
• /health/ready
• login
• Agent list
• Enterprise license status if licensed

Do not #

• Do not claim RTO.
• Do not reverse-migrate.
• Do not keep new eBPF objects with an old Manager as a supported mix.

Related documentation #

• Upgrade support boundary
• Backup
• Restore/DR remains unresolved. Detailed restore flags are provided separately to Enterprise customers.