Prove your recovery works — then refuse the risky change until it does. Zero-config drif…