nx_succession_recover.nx

nx_succession_recover.nx -- ATTESTATION-GATED succession recovery: the worst-case path for when the user AND their family are gone (Alzheimer's / sudden death), especially for lawyer clients whose files must outlive both client and attorney. Recovery returns the master secret ONLY when BOTH hold: (1) a QUORUM of succession shares reconstructs it (Shamir, nx_social_recovery) -- e.g. executor + a designated attestor + successor-attorney, held by parties named in the legal instruments; AND (2) a valid ATTESTATION -- an ed25519-signed document (death certificate / incapacity declaration / court order) from the DESIGNATED authority, bound to THIS user+event so a stale/foreign attestation can't be replayed. No valid attestation => no recovery, even if the shares are present. The crypto ENFORCES the legal succession (the authority signs only on real proof); every recovery is meant to be written to the tamper-evident audit log (nx_access_audit). This is policy + cryptography together: the quorum is the cryptographic floor, the attestation is the authorization + audit anchor. license_tier: ORIGINAL (composes nx_social_recovery Shamir + KAT-verified ed25519)