Framework-free domain and application layer: envelope encryption, per-subject data keys, erasure with a hash-chained erasure log. Zero crypto dependencies (control 18): AES-256-GCM, HMAC-SHA-256 and HKDF come from the JDK.