Split the retained ledger registry into a real pre-nvattest v1 with 16 top-level keys and today's v2 with 17 top-level keys, and set CURRENT_LEDGER_SCHEMA_VERSION to 2. Route every nvattest ledger-section and evidence-directory consumer through explicit version-conditioned paths using retained_ledger_schema_declares_nvattest. Derive required_entries and the expected_inventory failure string from the resolved version, and make _report resolve the ledger version before judging inventory. Recovering v1 retained evidence now reports retained-pre-nvattest-candidate-valid, which the unchanged publisher gate refuses. No on-disk retained bytes are rewritten.