Failed certificate rotation changes the active credential

A rejected rotation becomes visible after audit failure, and a stale operator can overwrite a later revision. Repair transactional state and optimistic concurrency together.

Work with the stack you want to practice. Your workspace and timer start after you choose.