Two single-KEK custodians decide each blob: already-current rows are left byte-untouched, previous-sealed rows re-seal through dedicated guarded UPDATEs (never UpsertActor, whose DO UPDATE freezes tombstoned actors — exactly the keys scrubs still need), and unreadable blobs fail loudly in place under a wrong-key/malformed/contended taxonomy while the walk completes its inventory. service_keys is scoped to the plc-rotation row; the plaintext service-actor row is never read. Keyset pagination throughout; the ServiceKeys create-once doc now distinguishes re-wrapping the envelope from rotating the key. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>