# P23D R02 rollback / continuation

Before `CORE_CHANGE_COMPLETE=true`, the target installer automatically restores the previous `docker-compose.override.yml`, removes the new loader and production keyring, removes the just-created protected key backup, and establishes a recovered backend generation.

After `CORE_CHANGE_COMPLETE=true`, do not rerun the target installer or automatically destroy/replace the production key. A late machine-close/publication failure is continuation-only.

The protected production backup root is `/root/router-ops-backups/p23d-credential-keyring` (0700); backup files are 0600 and are never published. A restore procedure must copy a selected backup to a temporary 0600 file, atomically replace `/opt/wg-access/runtime/credential-keyring.json`, then verify backend loader decryptability without printing key bytes.