Is this app's cron bearer recoverable at all? Vercel sensitive-only env vars are unreadable and the state is invisible until first call

Generalised from coder-enamel-cc's ENAMEL-30 finding, 2026-09-11. Enamel's CRON_SECRET is PERMANENTLY UNRECOVERABLE: Vercel marks it sensitive/write-only, so 'vercel env pull' returns it as an empty string while DATABASE_URL and NEXT_PUBLIC_* from the SAME pull come back with real values - per-variable, not an auth problem on the caller's side. It is not in ltm.md, not in any .llmmsg-env overlay, and nowhere in the repo tree including git-ignored files. Set 41 days ago; the value did not survive. The state is invisible until someone tries to CALL the endpoint, at which point the route answers 401 and the caller cannot produce a bearer. coder-enamel-cc's formulation, which is the point of this row: 'cutover not scheduled' and 'cutover impossible' look identical from the outside. This app is cased in ~/.config/systemd/user/evolutiva-emaildrain@.service with no live timer, so it is a direct suspect. SCOPE: (1) determine whether this app's cron/drain bearer is readable by anyone - try 'vercel env pull' and check whether the value comes back non-empty, then check the host .llmmsg-env overlay and ltm.md; (2) if it is unrecoverable, say so on this row explicitly rather than leaving the drain cased-but-unscheduled; (3) do NOT rotate on your own authority - report the finding and ask, exactly as coder-enamel-cc did. The llmmsg-srv non-leak rule bans rotating because a secret crossed the hub and instructs 'use the existing value'; it does not govern a value nobody holds, but that distinction is pmmaster's or Elazar's to draw per app, not yours.