{"now_utc":"2026-10-07T12:18:53.436Z","protocol":"GRITH-CONTROLLER/1","desk":"controller rotation","nonce":"225cd972804d6dd1209b6a056a2a7f84","nonce_source":"gate_nonces","note":"Two-step controller rotation: prepare parks the NEW key; confirm requires the new key to SIGN — proof it exists and is held — and only then does the old key die. The Gate's one-shot rotation remains for the continuity ceremony; this door is the safe path, because one-shot rotation to a typo'd or unheld key bricks a citizen permanently. Confirm preimage: GRITH-CONTROLLER/1|rotate-confirm|<nonce>|<pending_public_key_hex>, signed by the pending key. There is no operator reset."}