Reads exactly DATABASE_URL, BRIDGE_KEK and BRIDGE_KEK_PREVIOUS (the migrate principle: a rotation must never be blocked by unrelated config), validates before dialling, blames precisely, refuses equal keys (one key in both variables would read exactly like the zero-run gate), logs the per-table inventory, and exits nonzero whenever the walk could not move every blob. Compose forwards BRIDGE_KEK_PREVIOUS (inert when unset); DEPLOY §6 carries the runbook, FOLLOWUPS closes the blocker and files the adjacent lost-escrow-row hazard. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>