The Custody Review

In 1935, the US Army Air Corps watched its most advanced bomber — Boeing's Model 299, soon to be the B-17 — climb, stall, and crash on a routine demonstration flight, killing its pilot, the service's chief of flight testing. The investigation found nothing wrong with the aeroplane: the crew had simply forgotten to release a control lock, one small step among the hundreds the new machine demanded. A newspaper called it "too much airplane for one man to fly". The Air Corps' answer was not more training or a simpler bomber — it was a piece of paper. The pilot's checklist was born from that crash, and it exists because of a truth that applies exactly to the custody arrangement you have built across the last nine modules: competence does not prevent omission. Procedure does.

You now operate the household equivalent of a complex aircraft: a signer chosen for verifiability, steel in two places, perhaps a separated passphrase, perhaps a node, perhaps a quorum, and a sealed letter your executor can walk. Every one of those components was correct on the day it was built — and Module 8's twelfth failure mode says the day it was built is the only day you can be sure of. Houses change, people drift, vendors fold, firmware ages, families grow. The arrangement does not fail loudly; it rots silently while continuing to look exactly as it did. The defence is the same one aviation found: a written procedure, run on a schedule, precisely because you are competent and therefore tempted to skip it.

Start with an honest score. The interactive scorecard below asks eight blunt questions — where the coins actually are, where the backup actually lives, whether you could recover after a fire tonight, whether one person can be forced to move everything, who knows what you hold, what happens if you die tomorrow, whether any of it is written down, and when you last tested a full recovery. It scores you into one of three verdicts and points at the module that fixes your weakest answer. Take it before reading on, and note the number: the score is not a grade, it is a baseline, and next year's review is measured against it.

Then place yourself on the maturity ladder, because the failure files show holders skipping rungs as often as stalling on them. The rungs, in order: coins in your own single-sig keys with a tested steel backup; a passphrase with its own separated backup, if your threat model earns it; airgapped signing; your own node behind the wallet; a 2-of-3 quorum across vendors and buildings; and a rehearsed inheritance plan over the whole thing. Two rules govern the climb. Upward: take one rung at a time, and fund it small until the drill is boring. And honestly: a rung you cannot confidently operate makes you less safe than the rung below it — the forgotten passphrase and the lost descriptor are both stories about climbing past your competence.

The annual review itself is an hour, once a year, on a date you will keep — a birthday, a new year, a halving anniversary. The drill: run a recovery from one backup with a test amount, exactly as Module 3 taught; verify every location reference in the sealed letter is still true; check firmware and verify its signature; re-read the inheritance plan against the family that exists now; retake the scorecard and compare numbers; and review who learned about your holdings this year, because the answer is never nobody. Write the date and the score on the worksheet. An hour a year is the entire maintenance bill for an arrangement built to outlast you.

And that is the school. You arrived at Module 1 with a number on someone else's database; you leave operating a system in which your keys sign, your node verifies, no single failure ends the story, and the coins outlive you by design. None of it required trust in this school either — every claim here is checkable, every drill provable with your own hands, which is the only kind of security bitcoin ever promised. Trust, but verify — and verify on a schedule.