KMS resource names are not validated yet. Envelope encryption, blind indexes and media vault APIs exist in the backend; production KEK paths must come from environment config. Rotate controls stay fail-closed. No permanent media URLs.