scottjones wrote that if the change stopped before the key change ran, and the owner then enrolled a recovery key, entering the old password at the rerun removed the recovery key, and entering the recovery key removed the old password's slot. He wrote that the journal cannot tell these apart.

The pull request says that when the disk holds the old password's slot plus one added slot, the rerun asks for the new password, and for the old one too if the new one was entered first. The pull request says a slot is removed only once the new password opens the added slot and the old password opens the old slot, and that otherwise nothing is removed and the rerun says how to settle the disk by hand.

scottjones wrote that the journal holds no check value for the new password, so whatever is typed at the new-password prompt is taken as the new one. He wrote that the password entered first is the one kept, and that the other slot is removed. The pull request leaves the real-machine checks unchecked.