AhanaLock seals your files with PUZZLE-AUTH. Wrong key stays closed. Print a spare-key sheet for your drawer — not a bypass of someone else's computer.
ahanalock_cli.py lock file --key 'phrase' → .aarm. Strict HMAC. Wrong key fails closed.
Same phrase opens it. No phrase, no file. Fun: the spare-key HTML is a paper envelope.
spare-key --print-phrase writes a one-page sheet. Offline. Yours. Not email.
Use the OS recovery key / live USB you already own. Seal those recovery codes in AhanaLock. We do not crack other people's logins.
Process: pack software in a .aarm → AEAD wrapper (AES-256-GCM or ChaCha20-Poly1305: encrypt + tamper tag) plus PUZZLE-AUTH spare key → ship .lock.aarm. Field unit opens to a temp pack and serve_aarm --mega. Not a passkey. Not uncrackable. AQ1B inside is not rewritten. Digest: SEALED_AARM_DEPLOY_AEAD.md
Keep: vendor recovery key, printed spare phrase, sealed notes of your accounts. Skip: dumping someone else's password, bypassing BitLocker you do not own, exploits. Complements Sign (agreements) and Clear (request-only ops).