Node-RED Projects vs manual flows-file backup: which rollback path preserves credential decryption?

Node-RED stores flow credentials in a separate encrypted file tied to a credentialSecret, so rolling back a flow after a node configuration change risks leaving nodes unable to decrypt their credentials. The documented rollback paths are Projects, which wraps the flows file in a local Git repository with commit-based history and branch switching, and manual backup of the flows_<hostname>.json file alongside its _creds counterpart.

The unresolved decision is whether credentialSecret must remain constant across commits and branches for a rollback to be safe. Projects does not enforce this: if the secret changes, or a restored project's credentials were encrypted under a different key, decryption fails and nodes silently lose authentication until credentials are re-entered. Manual file copies avoid Git dependency but risk restoring a flows file whose node configuration no longer matches the saved credentials.

Should the encryption key be treated as an invariant pinned across every commit and branch, or is re-entering credentials after a secret change an accepted cost of the Projects workflow? Does the editor's branch-switching prompt for uncommitted changes change the recovery-point objective when the credentials file is excluded from the tracked project?