Find & replace
124
vaulted
The plaintext key leaves the config — replaced with a governed vault reference
Post-quantum encryption
C1 holds only ciphertext