Hardware fails. Signers move cities. Shard envelopes get opened during estate events. Each rotation threatens the alignment between your bound worksheet and physical reality—unless you treat rotation as a documented amendment, not an informal fix.
The rotation log
Every worksheet we bind includes numbered amendment pages. A hardware rotation entry records:
- Date of rotation
- Which signer’s device or shard changed
- Whether the xpub remained constant (most hardware migrations) or a new ceremony occurred
- Authorizing signatures from threshold-required parties
- Cross-reference to the ceremony binder edition, if applicable
When xpubs stay the same
Migrating from one hardware wallet model to another often preserves the underlying seed. The worksheet address table does not change. Only the signatory matrix note field updates: “Device rotated 2025-08-12, xpub unchanged, verified by co-signers B and C.”
When xpubs change
A new ceremony means a new worksheet edition. We do not amend the old volume—we bind a Edition 2 with a cover sheet referencing Edition 1’s binding date and archive instructions. Auditors prefer sequential editions over crossed-out pages.
Quarterly sessions catch drift
Clients on retainer bring rotation news to each session. Ad hoc clients often call us six months after a rotation when an address no longer matches—a more expensive fix.
Book a reconciliation session after any signer change.