docs: document destroy command and add rollback guide

- Add destroy command section to docs/cli-commands.md (options, examples,
  TEXT/JSON output, two-phase behavior, use cases, notes)
- Update command count from 8 to 9 in cli-commands.md
- Add destroy to command overview table and pipeline commands list
- Expand Clean Up Resources walkthrough to cover both destroy and delete
- Add Rollback Workflow to Common Workflows section in cli-commands.md
- Add destroy cleanup step to README.md Quick Start
- Add Rollback Guide link to README.md documentation section
- Add destroy cleanup step to all 6 translated READMEs (pt, fr, it, ja, zh, he)
- Update examples/full-pipeline-lifecycle.sh Step 8 to use destroy
- Update examples/cleanup-demo-resources.sh to use destroy with explanation
- Add new docs/rollback-guide.md covering manual rollback strategies,
  destroy+redeploy clean slate approach, decision tree, catalog/project
  preservation, GitHub Actions automated rollback workflows, and
  bundle-based rollback setup

Author: Shnekit

README.md

@@ -52,6 +52,9 @@ aws-smus-cicd-cli deploy --targets test --manifest manifest.yaml
 
 # Run validation tests
 aws-smus-cicd-cli test --manifest manifest.yaml --targets test
+
+# Clean up when done
+aws-smus-cicd-cli destroy -manifest manifest.yaml --targets test --force
 ```
 
 **See it in action:** [Live GitHub Actions Example](https://github.com/aws/CICD-for-SageMakerUnifiedStudio/actions/runs/17631303500)
@@ -1117,6 +1120,7 @@ genai_dev_workflow:
 ### Guides
 - **[Application Manifest](docs/manifest.md)** - Complete YAML configuration reference
 - **[CLI Commands](docs/cli-commands.md)** - All available commands and options
+- **[Rollback Guide](docs/rollback-guide.md)** - Recover from bad deployments and automate rollback
 - **[Bootstrap Actions](docs/bootstrap-actions.md)** - Automated deployment actions and event-driven workflows
 - **[Substitutions & Variables](docs/substitutions-and-variables.md)** - Dynamic configuration
 - **[Connections Guide](docs/connections.md)** - Configure AWS service integrations

docs/cli-commands.md

@@ -2,7 +2,7 @@
 
 ← [Back to Main README](../README.md)
 
-The SMUS CI/CD CLI provides eight main commands for managing CI/CD pipelines in SageMaker Unified Studio.
+The SMUS CI/CD CLI provides nine main commands for managing CI/CD pipelines in SageMaker Unified Studio.
 
 ## Global Options
 
@@ -50,6 +50,7 @@ aws-smus-cicd-cli describe --manifest manifest.yaml
 | `test` | Run tests for pipeline targets | `aws-smus-cicd-cli test --targets marketing-test-stage` |
 | `integrate` | Integrate with external tools (Q CLI) | `aws-smus-cicd-cli integrate qcli` |
 | `delete` | Remove target environments | `aws-smus-cicd-cli delete --stages marketing-test-stage --force` |
+| `destroy` | Delete all resources deployed by the manifest | `aws-smus-cicd-cli destroy --targets test --force` |
 
 ## Detailed Command Examples
 
@@ -519,7 +520,43 @@ Domain: cicd-test-domain (us-east-1)
 **What this shows:** The test command runs Python tests from the configured test folder against your deployed bundle. Tests receive environment variables with domain ID, project ID, and other context information to validate the deployment. This ensures your pipeline is working correctly after deployment and provides automated validation of your data workflows.
 
 ### 8. Clean Up Resources
+
+Use `delete` to remove the DataZone project only, or `destroy` to remove all deployed resources (QuickSight, S3, Airflow workflows, Glue jobs, catalog resources, and optionally the project).
+
 ```bash
+# Remove all deployed resources for a stage (recommended for full cleanup)
+aws-smus-cicd-cli destroy --targets test --manifest manifest.yaml --force
+```
+**Example Output:**
+```
+🔍 Validating 1 stage(s)...
+  Validating stage 'test'...
+
+📋 Destruction plan:
+
+  Stage: test
+    airflow_workflow:
+      - IntegrationTestMultiTarget_integration-test-test_test_dag
+    s3_prefix:
+      - src
+      - workflows
+
+  Total resources to process: 3
+
+⚠️  WARNING: This will permanently delete the above resources!
+
+🗑️  Starting destruction...
+
+  Stage: test
+
+📊 Destruction Summary
+  test: deleted=3 not_found=0 skipped=0 error=0
+```
+
+**What this shows:** The destroy command removes all resources deployed by the manifest for the targeted stage — Airflow workflows, S3 objects, QuickSight dashboards, Glue jobs, catalog resources, and optionally the DataZone project. It validates first (read-only), prints a full destruction plan, then prompts for confirmation before deleting anything. Use `--force` to skip the prompt in CI/CD pipelines.
+
+```bash
+# Remove only the DataZone project (leaves deployed content in place)
 aws-smus-cicd-cli delete --stages test --manifest manifest.yaml --force
 ```
 **Example Output:**
@@ -537,7 +574,7 @@ Targets to delete:
   ✅ test: Project deleted successfully
 ```
 
-**What this shows:** The delete command removes SageMaker Unified Studio projects and their associated resources. It provides a summary of deletion operations, showing which projects were successfully removed. This is useful for cleaning up test environments and managing resource lifecycle in your CI/CD pipeline.
+**What this shows:** The delete command removes only the SageMaker Unified Studio project and its associated CloudFormation stacks. Use this when you want to remove the project but leave deployed content (S3 files, QuickSight dashboards, etc.) intact.
 
 ```bash
 aws-smus-cicd-cli --help
@@ -553,6 +590,7 @@ aws-smus-cicd-cli --help
 5. **`run`** - Run workflow commands
 6. **`logs`** - Fetch workflow logs from CloudWatch
 7. **`delete`** - Delete projects and environments
+8. **`destroy`** - Destroy all resources deployed by the manifest
 
 ## Command Details
 
@@ -952,6 +990,160 @@ aws-smus-cicd-cli delete -t test --force -o JSON
 - CloudFormation stacks are deleted automatically when projects are removed
 - Use `--async` for faster execution when managing multiple targets
 
+### 9. destroy - Destroy All Deployed Resources
+
+Deletes all resources previously deployed by the manifest: QuickSight dashboards/datasets/data sources, S3 objects at declared target paths, Airflow serverless workflows, workflow-created resources (e.g. Glue jobs), DataZone catalog resources, and optionally the DataZone project. This is the inverse of `deploy`.
+
+> **Note:** `destroy` is distinct from `delete`. The `delete` command only removes the DataZone project. The `destroy` command removes all deployed content resources and conditionally removes the project.
+
+```bash
+aws-smus-cicd-cli destroy [OPTIONS]
+```
+
+#### Options
+
+| Option | Short | Description | Example |
+|--------|-------|-------------|---------|
+| `--manifest` | `-m` | Path to application manifest file (default: `manifest.yaml`) | `--manifest manifest.yaml` |
+| `--targets` | `-t` | Stage name(s) — single or comma-separated (default: all stages) | `--targets test` |
+| `--force` | `-f` | Skip confirmation prompt | `--force` |
+| `--output` | `-o` | Output format: TEXT (default) or JSON | `--output JSON` |
+| `--help` | | Show command help | |
+
+#### Examples
+
+```bash
+# Destroy all stages with confirmation prompt
+aws-smus-cicd-cli destroy --manifest manifest.yaml
+
+# Destroy a specific stage
+aws-smus-cicd-cli destroy --targets test --manifest manifest.yaml
+
+# Destroy multiple stages
+aws-smus-cicd-cli destroy --targets test,prod --manifest manifest.yaml
+
+# Destroy without confirmation (CI/CD pipelines)
+aws-smus-cicd-cli destroy --targets test --force
+
+# Destroy with JSON output for automation
+aws-smus-cicd-cli destroy --targets test --force --output JSON
+```
+
+#### Example Output (TEXT format)
+
+```
+🔍 Validating 1 stage(s)...
+  Validating stage 'test'...
+
+📋 Destruction plan:
+
+  Stage: test
+    airflow_workflow:
+      - MyApp_test-project_my_dag
+    glue_job:
+      - setup-covid-db-job
+      - summary-glue-job
+    quicksight_dashboard:
+      - deployed-test-covid-TotalDeathByCountry
+    quicksight_dataset:
+      - deployed-test-covid-TotalDeathByCountry
+    quicksight_data_source:
+      - deployed-test-covid-TotalDeathByCountry
+    s3_prefix:
+      - dashboard-glue-quick/bundle
+      - repos
+
+  Total resources to process: 7
+
+⚠️  WARNING: This will permanently delete the above resources!
+Are you sure you want to proceed with destruction? [y/n]: y
+
+🗑️  Starting destruction...
+
+  Stage: test
+
+📊 Destruction Summary
+  test: deleted=7 not_found=0 skipped=0 error=0
+```
+
+#### Example Output (JSON format)
+
+```json
+{
+  "application_name": "MyApp",
+  "targets": ["test"],
+  "stages": {
+    "test": [
+      {
+        "resource_type": "airflow_workflow",
+        "resource_id": "MyApp_test-project_my_dag",
+        "status": "deleted",
+        "message": "Workflow deleted"
+      },
+      {
+        "resource_type": "glue_job",
+        "resource_id": "setup-covid-db-job",
+        "status": "deleted",
+        "message": "Glue job deleted"
+      },
+      {
+        "resource_type": "s3_prefix",
+        "resource_id": "dashboard-glue-quick/bundle",
+        "status": "deleted",
+        "message": "S3 objects deleted"
+      }
+    ]
+  }
+}
+```
+
+#### Behavior
+
+The command follows a strict two-phase model:
+
+**Phase 1 — Validation (read-only):**
+- Resolves domain and project IDs via DataZone
+- Resolves S3 connections to determine bucket/prefix targets
+- Enumerates QuickSight resources by prefix and detects collisions
+- Checks for active Airflow workflow runs
+- Fetches and parses workflow YAML files from S3 to discover workflow-created resources (e.g. Glue jobs)
+- Collects ALL errors across ALL stages before aborting — no early exit
+
+**Phase 2 — Destruction (after confirmation):**
+
+Resources are deleted in this fixed dependency order per stage:
+1. Stop active Airflow workflow runs
+2. Delete workflow-created resources (Glue jobs, etc.)
+3. Delete Airflow workflows
+4. Delete bootstrap connections (created by `datazone.create_connection` actions)
+5. Delete QuickSight dashboards → datasets → data sources
+6. Delete S3 objects at declared `targetDirectory` prefixes
+7. Delete catalog resources (glossaries, terms, form types, asset types, assets, data products) in reverse dependency order
+8. Delete DataZone project (only if `project.create: true` in manifest)
+
+**Key behaviors:**
+- **Idempotent**: Resources already absent are logged as `not_found`, not errors. Safe to run multiple times.
+- **Single confirmation gate**: All confirmations happen in one prompt after the full plan is printed.
+- **Active run re-check**: Live workflow run status is re-queried at destruction time to catch runs that started or completed after validation.
+- **Collision detection**: If more QuickSight resources or Airflow workflows match than declared in the manifest, destroy aborts before deleting anything.
+- **Built-in connections protected**: `default.*` connections are never deleted.
+- **Managed catalog resources protected**: Resources with `amazon.datazone.*` namespace are never deleted.
+- **Always synchronous**: No `--async` mode. Each deletion step completes before the next begins.
+- **Catalog warning**: When `deployment_configuration.catalog` is present, all project-owned catalog resources are deleted (not just imported ones). Set `disable: true` under `deployment_configuration.catalog` to skip catalog deletion.
+
+#### Use Cases
+
+- **Clean re-deployment**: Destroy a stage and redeploy from scratch to resolve state drift
+- **Environment teardown**: Remove test or staging environments after validation
+- **Rollback**: Remove a failed deployment before re-deploying a previous version
+- **Project cleanup**: Remove all resources before deleting the project
+
+#### Notes
+- Requires sufficient IAM permissions to list and delete all resource types declared in the manifest (QuickSight, S3, Airflow Serverless, DataZone, Glue)
+- S3 bucket and prefix resolution requires a live DataZone API call — the project must be reachable at destroy time
+- Use `--force` in CI/CD pipelines to skip the interactive confirmation prompt; note that `--force` with `--output JSON` is required since JSON mode cannot prompt interactively
+- The `Resource_Prefix` configured in `deployment_configuration.quicksight.overrideParameters` must be unique to avoid collision errors
+
 ## Global Options
 
 All commands support:
@@ -1000,9 +1192,31 @@ aws-smus-cicd-cli run --workflow my_dag --command "dags list" --targets test
 
 ### Cleanup Workflow
 ```bash
-# Delete test environment
+# Delete test environment (DataZone project only)
 aws-smus-cicd-cli delete -t test --force
 
 # Delete multiple environments
 aws-smus-cicd-cli delete -t test,staging --force --async
+
+# Destroy all deployed resources (QuickSight, S3, Airflow, Glue, catalog, project)
+aws-smus-cicd-cli destroy --targets test --force
+
+# Destroy specific stage for clean re-deployment
+aws-smus-cicd-cli destroy --targets test --manifest manifest.yaml
+```
+
+### Rollback Workflow
+```bash
+# Option 1: Redeploy previous bundle (no destroy needed if no resource conflicts)
+#   Download the versioned bundle, then deploy
+aws s3 cp s3://bucket/bundles/MyApp-v1.2.0.zip ./artifacts/MyApp.zip
+aws-smus-cicd-cli deploy --stages prod --manifest manifest.yaml
+
+# Option 2: Destroy bad deployment then redeploy previous version (clean slate)
+aws-smus-cicd-cli destroy --targets prod --force
+aws s3 cp s3://bucket/bundles/MyApp-v1.2.0.zip ./artifacts/MyApp.zip
+aws-smus-cicd-cli deploy --stages prod --manifest manifest.yaml
+aws-smus-cicd-cli test --stages prod
 ```
+
+**See more:** [Rollback Guide](rollback-guide.md)

docs/langs/fr/README.md

@@ -71,6 +71,9 @@ aws-smus-cicd-cli deploy --targets test --manifest manifest.yaml
 
 # Exécuter les tests de validation
 aws-smus-cicd-cli test --manifest manifest.yaml --targets test
+
+# Nettoyer quand c'est terminé
+aws-smus-cicd-cli destroy --targets test --force
 ```
 
 **Voir en action :** [Live GitHub Actions Example](https://github.com/aws/CICD-for-SageMakerUnifiedStudio/actions/runs/17631303500)

docs/langs/he/README.md

@@ -88,6 +88,9 @@ aws-smus-cicd-cli deploy --targets test --manifest manifest.yaml
 
 # Run validation tests
 aws-smus-cicd-cli test --manifest manifest.yaml --targets test
+
+# Clean up when done
+aws-smus-cicd-cli destroy --targets test --force
 ```
 
 </div>

docs/langs/it/README.md

@@ -65,6 +65,9 @@ aws-smus-cicd-cli deploy --targets test --manifest manifest.yaml
 
 # Run validation tests
 aws-smus-cicd-cli test --manifest manifest.yaml --targets test
+
+# Clean up when done
+aws-smus-cicd-cli destroy --targets test --force
 ```
 
 **Guarda in azione:** [Live GitHub Actions Example](https://github.com/aws/CICD-for-SageMakerUnifiedStudio/actions/runs/17631303500)

docs/langs/ja/README.md

@@ -71,6 +71,9 @@ aws-smus-cicd-cli deploy --targets test --manifest manifest.yaml
 
 # Run validation tests
 aws-smus-cicd-cli test --manifest manifest.yaml --targets test
+
+# Clean up when done
+aws-smus-cicd-cli destroy --targets test --force
 ```
 
 **動作確認:** [Live GitHub Actions Example](https://github.com/aws/CICD-for-SageMakerUnifiedStudio/actions/runs/17631303500)

docs/langs/pt/README.md

@@ -68,6 +68,9 @@ aws-smus-cicd-cli deploy --targets test --manifest manifest.yaml
 
 # Run validation tests
 aws-smus-cicd-cli test --manifest manifest.yaml --targets test
+
+# Clean up when done
+aws-smus-cicd-cli destroy --targets test --force
 ```
 
 **Veja em ação:** [Live GitHub Actions Example](https://github.com/aws/CICD-for-SageMakerUnifiedStudio/actions/runs/17631303500)

docs/langs/zh/README.md

@@ -71,6 +71,9 @@ aws-smus-cicd-cli deploy --targets test --manifest manifest.yaml
 
 # Run validation tests
 aws-smus-cicd-cli test --manifest manifest.yaml --targets test
+
+# Clean up when done
+aws-smus-cicd-cli destroy --targets test --force
 ```
 
 **查看实际运行效果：** [Live GitHub Actions Example](https://github.com/aws/CICD-for-SageMakerUnifiedStudio/actions/runs/17631303500)