What it does: Four levels of undo — a single rule, an autoload restore, global Safe Mode, and reset-to-last-good — plus a way to check that the escape hatches still work. Three recovery tiers when the admin is unreachable:

1. define('VELOCITYFORGE_PANIC', true); in wp-config.php — checked before any database read, so it works even when the database is the problem.
2. ?velocityforge_panic= on any URL — flips Safe Mode and rotates the secret. The secret is stored in an option and shown on the Rollback screen: copy the URL somewhere outside the site before you need it. It is never written to a file in wp-content.
3. The Safe Mode toggle — on the Rollback screen, and in the admin bar, on the front end as well as in wp-admin. It goes through VELOCITYFORGE_Rollback_Manager::toggle_safe_mode(), so it lands in the same audit trail as the form, and it is nonce-protected and manage_options-only.

The recovery drill (Free): the Check recovery paths button on the Rollback screen runs four independent checks and restores everything it touched:

1. whether VELOCITYFORGE_PANIC is defined right now (informational — there is nothing to write, so it cannot fail);
2. a real loopback request to the secret panic route with a one-off secret, because a wrong token would only prove the 403 branch works. The safe-mode option and the real secret are captured beforehand and written back exactly afterwards, whatever the response was;
3. the safe-mode option round-trips: read, flip, read back, restore;
4. the autoload backups table answers a SELECT, row or no row.