Secret bytes crossing the trusted provider boundary. Never log or include them in UI/analytics.
Recovery record bounds.
Returns a defensive copy for a trusted storage/encryption adapter.
Redacted representation safe for diagnostic output.