The rollback check diffed all of migrations/, so a change to the sqlc queries in migrations/queries/ sent the operator down the restore path and discarded household changes made since the pre-deploy point. Compare the versions in the live database's schema_migrations with the top-level *.sql files at the previous SHA instead, the rule internal/store/migrate.go enforces at start-up. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>