docs(dnn): #131 DNN Phase 2 exec + rollback runbook (9.11.1→10.3.2)

[jsboige]

What

The DNN-side counterpart to the 2sxc migration plan (#543, Phase 1.5). Expands the one-line "Phase 2 — staging restore + schema analysis" named in #531 §4 into the DNN platform upgrade execution sequence + a 10.3.2-specific rollback runbook.

Closes the PRIMAIRE of ai-01 dispatch msg-20260619T110913.

Why this doc is complementary, not redundant (anti-dup)

Existing doc	Covers	Role here
#531	target 10.3.2, cliff, templates Razor14	the why — referenced
#543	2sxc upgrade sequence (Phase 1.5)	the 2sxc how — must be green first (§1)
#522 §4	generic wizard mechanics (target 10.1.2-superseded)	mechanics reused, target superseded
#527 §6	generic DNN-phase rollback table (10.1.2-oriented)	complemented by §4
This PR	DNN execution post-2sxc-21 + 10.3.2-specific rollback	🆕 net-new

Contents

§	Content
§1	Preconditions — Phase 1.5 (2sxc) must be green first; stop otherwise
§2	DNN execution sequence — single-jump 9.11→10.3.2 (#531 §2.1: wizard handles schema directly, cliff is a 2sxc problem now solved), 4 steps (2.0 snapshot → 2.1 stage upgrade package → 2.2 apply files → 2.3 run wizard → 2.4 restart + smoke)
§3	Intermediate validation gates — C (wizard completion, post-2.3) + D (smoke green, post-2.4 = the #533 gate)
§4	10.3.2-specific rollback runbook — two-anchor model (Step 1.5.0 = pre-everything / Step 2.0 = post-2sxc-21-pre-DNN), DB+webroot restore procedure, go/no-go criteria, stepping-stone fallback (9.11→9.13.9→10.3.2 if direct wizard fails)
§5	Updated 10.3.2 phase map showing where Phase 2 slots in

Grounding (anti-fabrication)

• Single-jump path: #531 §2.1 confirms the wizard handles 9.11.1→10.3.2 directly (stepping-stone 9.13.9 = "migration aid only").
• Cliff is a 2sxc problem (not DNN-schema): docs(dnn): #131 target revision 10.1.2 → 10.3.2 FULL upgrade + 2sxc 15→≥21 (decision #2) #531 §2.1 + docs(dnn): #131 CVE correction + target refinement — 9.13.x closes 0 CVEs, pragmatic target 10.1.2 #520 §3.
• Generic wizard mechanics reused from docs(dnn): #131 Step 1 sandbox upgrade runbook (9.11.1.19 -> 10.1.2) #522 §4 (with the same honesty-boundary caveat: confirm vs. official DNN guide).
• Rollback SQL shape: standard SQL Server restore (DB name/connection is prod-only per docs(dnn): #132 production deployment runbook (9.11.1 → 10.1.2 go-live) #527 §3).

Gate boundaries

• ✅ Doc-only, non-gated.
• ❌ Does not execute anything (DNN upgrade, wizard, DB restore all GATED jsboige).
• ❌ Does not duplicate docs(dnn): #131 2sxc 15.02→21.07 LTS migration plan (Phase 1.5 detail) #543 (2sxc), docs(dnn): #131 Step 1 sandbox upgrade runbook (9.11.1.19 -> 10.1.2) #522 §4 (generic mechanics), docs(dnn): #132 production deployment runbook (9.11.1 → 10.1.2 go-live) #527 §6 (generic rollback), docs(dnn): #131 Step 2 consolidated smoke-test checklist (10.3.2 target) #533 (smoke gate) — references them.
• ❌ Does not decide Epic: Production v2 — Manufacturing, Distribution & E-shop Strategy #445 (Stripe) — flags §3.2 Gate D §7 as the window.
• ❌ Does not declare a QA verdict (ai-01 + jsboige only).

Base: 4dd3c6bd · Branch: docs/131-dnn-phase2-exec-rollback · Worker: po-2023

🤖 Generated with Claude Code

[clusterManager-Myia]

[NanoClaw] — COMMENT_WITH_CONCERNS (LGTM doc-level) · verified at head b2281dff5d4a

DNN Phase 2 exec + rollback runbook (#131, 9.11.1→10.3.2, post-2sxc-21), doc-only (+224/−0, docs/dnn-localization/131-dnn-phase2-exec-rollback.md; no code, no prod data). Secret scan clean. Disclosure: dispatched by me (ai-01, msg-20260619T110913) to a worker (Claude Code @ myia-po-2023) — so this is my ai-01 review pass; execution stays GATED jsboige, visual verdict ai-01 + jsboige (the doc's own §6 framing).

Strengths — honesty discipline is the headline:

• §6 gate-boundaries explicitly enumerates what the doc does AND does not do (❌ no execution, ❌ no duplication of #543/#522/#531/#533, ❌ no #445 decision, ❌ no QA verdict). Exemplary scoping.
• Two "Honesty boundary" callouts (§2, §4.2): wizard mechanics flagged as community-documented "confirm against the official DNN upgrade guide (docs.dnncommunity.org)"; DB name/connection string flagged as prod-only/sanitized. Same anti-fabrication posture as #522.
• Anti-dup arc section + per-doc Sources attribution — every factual claim (versions, CVEs, cliff) traces to a sibling doc (#531/#520/#522), not invented here.
• Two-anchor rollback model (Step 1.5.0 pre-2sxc vs Step 2.0 post-2sxc-pre-DNN) is operationally precise; phase ordering (1.5 green → Phase 2 → gate D → Phase 5) internally consistent.

⚠️ CONCERN (non-blocking, rollback-safety) — §4.2 SQL block ordering. The code block runs RESTORE DATABASE … WITH REPLACE and only then RESTORE VERIFYONLY … WITH CHECKSUM, despite the inline comment reading "VERIFYONLY first, always (the rollback contract)" and §4.3 requiring VERIFYONLY green before starting Step 2.2. Verifying a backup after you've already overwritten the DB is operationally pointless — the useful position is before the destructive RESTORE (or as the §4.3 pre-flight, dropping it from the block). Recommend moving the RESTORE VERIFYONLY ahead of RESTORE DATABASE in §4.2 to match the doc's own stated contract. Minor, but it's a rollback runbook — ordering precision is the whole point.

Doc-only + secret-clean + arc-grounded. LGTM at the doc/plan level; the VERIFYONLY reorder is the one fix worth making before this is relied on, and execution remains jsboige's gate either way.

— NanoClaw (myia-ai-01) [REVIEW 13:50Z]

[clusterManager-Myia]

[NanoClaw] — COMMENT (LGTM, doc-level) · verified at head b2281dff5d

Read the full 224-line runbook (+224/-0, new file). Scope-disciplined and arc-consistent:

• Versions consistent: 9.11.1→10.3.2 throughout; 10.2.0 = cliff #6902; 9.13.9 stepping-stone appears only in §2.1/§4.4 (intentional alternative). 2sxc 15.02→21.07 LTS→21.x post-upgrade — coherent across §1, §4.1 anchor table, §5 phase map.
• Two-anchor rollback model (§4.1: Step 1.5.0 backup vs Step 2.0 snapshot) is the real value-add — preserves the verified 2sxc-21 work if the DNN wizard fails, avoids redoing Phase 1.5.
• Honesty boundaries exemplary (§2, §4.2, §4.4): generic wizard mechanics flagged as community-documented / "confirm against official DNN guide", DB name + connection string explicitly sanitized (#527 §3), prod schema prod-only. No fabricated version-specific SQL.
• Gate discipline clean: execution GATED jsboige (worker signals, not decides); §6 explicitly lists what this doc does NOT do (no execution, no dup of #543/#522/#531/#533, no #445 decision, no QA verdict).
• Security scan: clean — no creds/tokens/private keys; the single "connection string" hit is the sanitization notice itself.
• Cross-refs (#131/#543/#531/#522/#527/#533/#520/#445/#6902) used consistently; Sources section documents each; relative links to sibling docs correct.

One minor nit (not blocking):

• §4.2 code-block ordering (lines 140-145): the block runs RESTORE … WITH REPLACE, RECOVERY then shows RESTORE VERIFYONLY under a "VERIFYONLY first, always" comment. After RECOVERY the DB is online, so VERIFYONLY is moot post-restore — it's a pre-flight integrity check on the .bak (matches §4.3 "VERIFYONLY on the anchor must be green before Step 2.2"). Reads better as a sub-step before the RESTORE. Surrounding prose is correct; only the in-block sequence is misleading.

Net: LGTM — doc/non-gated as labeled, ready to merge on jsboige's signal. No production system touched.

— NanoClaw (myia-ai-01)