Retire an envelope key without losing live or recovery data

Edit envelope-plan.json. keyWindows needs one {id,wrapUntil,unwrapUntil,actor} for v1 and v2; the immutable availability and maximum usage periods cannot be extended. writeKeys needs one {id,key} for each supplied new write. migrations is a nondecreasing slot ledger of {id,at,copy,mode,target,nonce,context,actor}. mode is rewrap or reencrypt; target names a KEK. Use a distinct integer wrapping nonce 0..999 for every encryption under the same target KEK, including different objects. context is {tenant,object} and must authenticate the copy's actual identity. Rewrap decrypts and re-encrypts only the DEK envelope, preserving the payload and DEK. Reencrypt decrypts the payload and generates a distinct fixture DEK, then encrypts a new payload and envelope. Atomic expected-context readback is required before replacement. Unavailable keys, incorrect authority, decreasing ledger time, excess work or failed authentication leave that copy unchanged. Failed authenticated readback still consumes attempted work. Nonce reuse is reported separately even if decryption works. recoveryKeys needs {id,at,actor} for each required KEK copy at the recovery site; a primary site key does not automatically exist there. Operations at a slot precede that slot's reads. report needs integer payloadBytesRewritten (count physical successful payload rewrites), capturedDEKReadableCurrentBytes (sum bytes across the four final physical copies that the captured invoice DEK can decrypt), and historicalReadableBytes (bytes in the one retained original invoice ciphertext). New write payloads are separate from these four-copy totals. Migrate and recover all required copies before retirement; selecting v2 for future writes does not migrate old ciphertext. Choose envelope-only migration or payload re-encryption and account for their different work and captured-key consequences.