The description told on-call to try the recovery key as a last resort, while RUNBOOK Step 4 in the same change (and upstream: recovery keys are "purely an authorization mechanism") says it cannot unseal an auto-sealed server. Say what actually helps: fix the Secret, restart the pod. Also drop a duplicate root-token computation in restore_openbao. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>