X_SECRETS_PLAINTEXT_INVALID
Means
the decrypted secrets are not a flat map of env values
Typical cause
an x secrets edit buffer saved as something other than one flat JSON object, a key that is not an environment variable name, or an empty value. Refused before sealing, so a file that opens always installs
Fix
x secrets edit — the buffer is {"SESSION_SECRET": "s3cr3t"}