# X_SEAL_RESEAL_PENDING

## Means

sealed columns still hold values under a retired master key

## Typical cause

`x doctor`: the app declares `.sealed()` columns and `ULTIMATE_SECRETS_RETIRED_KEYS` still declares a retired key — a rotation whose re-seal has not finished. Until it has, a `lookup` column matches through `in (…)` over every key and its `.unique()` is only as strong as one key: one value can be stored once per key

## Fix

re-seal with a `backfill()` that rewrites each row (`update(id, { <column>: row.<column> })` seals under the current key), then `x secrets rotate --drop <keyId>`

[Encrypted secrets](/error-codes#encrypted-secrets)