What it does: Four levels of undo — a single rule, an autoload restore, global Safe Mode, and reset-to-last-good — plus a way to check that the escape hatches still work. Three recovery tiers when the admin is unreachable:

1. define('VELOCITYFORGE_PANIC', true); in wp-config.php — checked before any database read, so it works even when the database is the problem.
2. ?velocityforge_panic= on any URL — flips Safe Mode and rotates the secret. The secret is stored both in an option and in wp-content/.velocityforge-panic, which you can read over SFTP.
3. The Safe Mode toggle — on the Rollback screen, and in the admin bar, on the front end as well as in wp-admin. It goes through VELOCITYFORGE_Rollback_Manager::toggle_safe_mode(), so it lands in the same audit trail as the form, and it is nonce-protected and manage_options-only.

The recovery drill (Free): a button on the Rollback screen runs five independent checks and restores everything it touched:

1. whether VELOCITYFORGE_PANIC is defined right now (informational — there is nothing to write, so it cannot fail);
2. the panic file’s directory round-trips a probe write and delete;
3. a real loopback request to the secret panic route with the real secret — a wrong token would only prove the 403 branch works. The safe-mode option, the stored secret and the on-disk copy of it are captured beforehand and written back byte for byte afterwards, whatever the response was: a drill that leaves the file disagreeing with the database would break the exact SFTP escape hatch it exists to verify;
4. the safe-mode option round-trips: read, flip, read back, restore;
5. the autoload backups table answers a SELECT, row or no row.