pve-cephx-rotate-service-keys: one mon down with corrupt store while client.admin is staged — how to rebuild the mon?

[PMX151]

I recently started the Ceph key migration and after getting part way though I had to pause as there was some other housekeeping needed doing to get everything aligned ready to finish the job. However, in the meantime one of the monitors has error'd/stopped so now I am stuck in some chicken and egg/catch 22 situation. Both processes (Ceph key rotation and and monitor restore) kind of say the other shouldn't be done before it finishes but both processes need doing before each other!

Full details: 3-node PVE + Ceph 19.2.6, following the aes → aes256k migration. Cluster-owned keys are done (PASS: Every service key uses 'aes256k'). I then staged client.admin with --rotate-all-storage-keys --rotate-admin-key --apply. Refreshing consumers has barely started (about 27 sessions still on the old key).

Separately, mon.pve3 won't start. Its RocksDB store is corrupted: Corruption: block checksum mismatch ... store.db/184870.sst, so it aborts with ceph_abort_msg("failed to write to db"). The other two mons are healthy (63 MB stores) and in quorum. pve3 also has a dead OSD with BlueFS corruption, which looks like the aftermath of a watchdog hard reset on 18 Sep.

The dry run now warns that not every monitor can keep two client keys valid, and that I shouldn't add or downgrade monitors while a key is staged. I ran --abort-staged-key client.admin --apply. Step 1 passed ("restored managed copies of 'client.admin' to its current key"), but rollback verification is incomplete until every monitor answers, so --confirm-abort-clients-refreshed can't run.

What is the supported way to get pve3's mon back? Is pveceph mon destroy pve3 followed by pveceph mon create safe while the key is staged and the abort is half-done? Or must the rotation be fully resolved first, and if so, how, with one mon unable to answer?

pveversion and ceph versions output below:

pve-manager: 9.2.20 (running version: 9.2.20/49318c671b82f31e)
ceph: 19.2.6-pve4
ceph-fuse: 19.2.6-pve4

{
    "mon": {
"ceph version 19.2.6 (7198987e0613d69ffb68c62f59cf70ce51a10eb7) squid (stable)": 3
},
"mgr": {
"ceph version 19.2.6 (7198987e0613d69ffb68c62f59cf70ce51a10eb7) squid (stable)": 3
},
"osd": {
"ceph version 19.2.6 (7198987e0613d69ffb68c62f59cf70ce51a10eb7) squid (stable)": 5
},
"overall": {
"ceph version 19.2.6 (7198987e0613d69ffb68c62f59cf70ce51a10eb7) squid (stable)": 11
}
}