Base per-CPS-unit keys and the AACS 2.1 forensic index set are now two explicit trait operations instead of one overloaded get_uk whose return count was implicit. keydb serves unit keys (forensic opts out via the default); online implements both; MultiSource drives both in order. Teed up for 1.4.5. Local WIP baseline.