Never lock everyone out: if no one in scope can pass a required factor, sign-in degrades to password — and that is logged explicitly + shows a banner (never silent). Per person: requiring ≥2 sign-in methods prevents locking out an individual.
Compliance: passkey = phishing-resistant (NIST AAL2/AAL3 · FIDO2, origin-bound) · TOTP = fallback factor · accessible form (WCAG 2.2). Confirm — I build the backend (WebAuthn RP + recovery codes + throttling) and the React UI (TDD).