Can your recovery plan survive one shared failure?
A two-of-three handoff can look resilient until two shares depend on the same site, power system, or custodian. Declare the dependencies, remove one, and inspect the result.
Illustrated example with declared inputs. The lab does not verify physical placement, read or upload evidence, or replace a cryptographic recovery drill.
From placement to rehearsal
Make dependencies visible.
The model is useful when its inputs are explicit. A surviving share count is a result of your declared scenario, not a verification of a vault or a guarantee that the handoff will work.
01
Declare placement
Assign each share to a site, infrastructure system, and custodian in the simulation.
02
Rehearse a loss
Remove a shared dependency and see which shares remain available together.
03
Take a plan forward
Export the declared scenario for review and a separate real-world recovery drill.
Use the result as a review prompt. Confirm actual physical placement, access, independent failure domains, and reconstruction in a separately controlled recovery drill. The browser simulation does not read or upload evidence.
