X_SEAL_RESEAL_PENDING

sealed columns still hold values under a retired master key

x doctor: the app declares .sealed() columns and ULTIMATE_SECRETS_RETIRED_KEYS still declares a retired key — a rotation whose re-seal has not finished. Until it has, a lookup column matches through in (…) over every key and its .unique() is only as strong as one key: one value can be stored once per key

re-seal with a backfill() that rewrites each row (update(id, { <column>: row.<column> }) seals under the current key), then x secrets rotate --drop <keyId>