reports

Explicitly allowlisted recovery evidence; never export paths, keys or values.