ARCHITECTURE
Two roles, one contract address.
The Primary role authorizes routine actions. The separately stored Recovery role can authorize replacement without requiring assets to move to a new Vault address. The exact permissions and contract invariants will be documented per deployed version.