P23C rollback before core completion is automatic on VM121:
- restore exact previous `/opt/wg-access/backend/app/api/admin.py`;
- remove new `app/services/domain_v2.py`;
- remove new `app/services/credential_crypto.py`;
- wait for backend health.
After target semantic PASS/core completion, late Machine Git/report failures are continuation-only; do not automatically delete the accepted source change.
No live database rollback exists because P23C does not mutate live DB or schema.