X_SEAL_INVALID

a sealed value did not authenticate, or is not a sealed value

the string is not x1.<keyId>.<iv>.<ciphertext> (never sealed, or truncated), or the AES-256-GCM tag rejected it under a key whose id matched: it was sealed for a different purpose, or its bytes changed. AEAD cannot tell those two apart, so the cause names both. Never garbage, never the raw string back

x secrets show --json — confirms the key id in force; a value that failed its tag is unrecoverable and must be re-entered. Never sealed (a column sealed after rows were written): add a new .sealed() column, copy with a backfill(), drop the old one — Entities and migrations