X_SEAL_KEY_UNKNOWN
Means
a sealed value names a master key this process does not declare
Typical cause
a retired key was dropped (x secrets rotate --drop <keyId>) before the re-seal backfill() finished, or the value was copied from another environment. The cause names the value's key id and lists the declared ids, current first
Fix
x secrets edit — put the retired key back in ULTIMATE_SECRETS_RETIRED_KEYS until the re-seal backfill() has finished