# ADR 0028. v1 recovery is codes, passkeys, and linked factors

## Status
Accepted (as listed in the decisions index).

Spec §19 requires recovery without email or SMS, including operator-assisted
recovery with a cooling-off period. Inventing a staff take-over now would let
an operator or support key own a PlayerPal Account, which §19 forbids.

## Decision

v1 recovery is Player-held factors only:

- one-time recovery codes (already Nest-owned)
- additional passkeys (encouraged, not a signup gate)
- an already-linked social method
- an existing password, only after a recovery-scoped session

Device loss: revoke other portal sessions from a remaining device; if none
remain, consume a recovery code, enrol a new passkey, and revoke other
sessions on that upgrade. Social email match still must not recover an
Account (ADR 0012, ADR 0019).

Operator-assisted recovery is out of scope until a workforce identity domain
exists and a later ADR defines cooling-off, dual control, and audit. Staff
may list or revoke portal sessions; they must not reset credentials or take
ownership.

## Consequences

- Account UX should prompt for recovery-code confirm and a second passkey
  after first login, without blocking play.
- Password reset stays recovery-code or existing-device, never email or SMS.
- [docs/authentication.md](../authentication.md) no longer treats
  operator-assisted recovery as an unspecified v1 requirement.