A deployment corrupts rows in an RDS database at 14:10. Automated backups are enabled, and 14:09 is inside the available point-in-time recovery window. The team must recover to immediately before the corruption and preserve the current instance for investigation. Which procedure should it follow?

1. Promote the Multi-AZ standby because it will not contain the erroneous writes.
2. Restore a new DB instance to 14:09, validate it, and update application connections during a controlled cutover.
3. Run point-in-time recovery in place so the original endpoint rolls back while existing transactions remain connected.
4. Restore only the most recent manual snapshot regardless of its creation time.