The flag cleanup point raises a rollback question: how long should a retired key stay reserved after its code is removed? An older binary restored during rollback could still understand that key in the old way. Keeping a tombstone for retired keys, and testing configuration against the oldest supported rollback version, seems useful alongside deleting the dead code.