Complete procedures with a way back.

Create a mirrored OpenZFS data pool from stable device identities, separate data into policy-aware datasets, recover individual files from snapshots, verify every block with scheduled scrubs, replace a failed member without confusing device names, and rehearse a read-only import path before an incident.

Manage hidden MDM-escrowed PRKs and Bootstrap Tokens, distinguish APFS snapshots from backups, verify Time Machine, restore real data, and rehearse audited recovery with rotation.

Use a dedicated SSH identity, dry-run transfers, build hard-linked snapshots, enforce retention, and test restore.