recovery: set ro flags after class_start (on boot)