{"record":{"id":"227af283e5a88cd9","repo":"nautechsystems/nautilus_trader","slug":"execution-payload-storage-is-in-operation-mainte-227af2","errorCode":null,"errorMessage":"Execution payload storage is in {operation} maintenance, not ready for rewrap","messagePattern":"Execution payload storage is in (.+?) maintenance, not ready for rewrap","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/adapters/blockchain/src/cache/database.rs","lineNumber":5384,"sourceCode":"                if current_id == *keys.active_key_id() {\n                    transaction\n                        .commit()\n                        .await\n                        .context(\"failed to complete no-op execution payload rewrap\")?;\n                    return Ok(());\n                }\n                sqlx::query(\n                    \"UPDATE execution_payload_state \\\n                     SET operation = 'rewrap', active_key_id = $1, progress_id = 0, updated_at = NOW() \\\n                     WHERE component = 'signed_transactions'\",\n                )\n                .bind(keys.active_key_id().as_slice())\n                .execute(&mut *transaction)\n                .await\n                .context(\"failed to record execution payload rewrap target\")?;\n            }\n            \"rewrap\" => validate_execution_payload_state(&state, keys)?,\n            operation => anyhow::bail!(\n                \"Execution payload storage is in {operation} maintenance, not ready for rewrap\"\n            ),\n        }\n        sqlx::query(\n            \"INSERT INTO execution_payload_key_state (key_id, seals) VALUES ($1, 0) \\\n             ON CONFLICT (key_id) DO NOTHING\",\n        )\n        .bind(keys.active_key_id().as_slice())\n        .execute(&mut *transaction)\n        .await\n        .context(\"failed to initialize rewrap target key state\")?;\n        transaction\n            .commit()\n            .await\n            .context(\"failed to commit execution payload rewrap state\")?;\n        Ok(())\n    }\n","sourceCodeStart":5366,"sourceCodeEnd":5402,"githubUrl":"https://github.com/nautechsystems/nautilus_trader/blob/18893faf8b356be3320add8de2f861b0b647cf06/crates/adapters/blockchain/src/cache/database.rs#L5366-L5402","documentation":"begin_execution_payload_rewrap starts a key-rotation (rewrap) of sealed execution payloads. It accepts state.operation of 'ready' (start a new rewrap) or 'rewrap' (resume), but any other maintenance operation — such as 'migrate' or 'rollback' — means storage is mid-transition and cannot begin a rewrap. The library bails to prevent overlapping maintenance operations corrupting payload protection state.","triggerScenarios":"Invoking the rewrap command (begin_execution_payload_rewrap) while execution_payload_state.operation is 'migrate' or 'rollback' — e.g. initial encryption migration not yet finished, or a previous rollback in progress, and an operator attempts to rotate keys on top of it.","commonSituations":"Operator skipped the initial migration step and ran key rotation immediately; concurrent maintenance jobs on the same database; an unfinished rollback from a downgrade attempt still recorded in the state table; automation schedules colliding.","solutions":["Wait for / complete the current maintenance operation ('migrate' batches until ready, or finish 'rollback') before starting the rewrap","If a rollback is intended to supersede rotation, cancel the rewrap attempt instead of forcing it","Inspect execution_payload_state.operation to confirm current phase and re-run the rewrap command once it reads 'ready'","Serialize maintenance tasks so only one rotation/migration/rollback runs at a time"],"exampleFix":"// before: rewrap attempted during unfinished migration\nbegin_execution_payload_rewrap(&keys).await?;\n// after: run migration to completion first\nwhile !migrate_execution_payload_batch(&keys, BATCH).await? {}\nbegin_execution_payload_rewrap(&keys).await?;","handlingStrategy":"validation","validationCode":"let op: String = sqlx::query_scalar(\n    \"SELECT operation FROM execution_payload_state WHERE component = 'signed_transactions'\")\n    .fetch_one(&pool).await?;\nanyhow::ensure!(matches!(op.as_str(), \"ready\" | \"rewrap\"),\n    \"cannot rewrap while storage operation is '{op}'\");","typeGuard":"fn rewrap_allowed(operation: &str) -> bool {\n    matches!(operation, \"ready\" | \"rewrap\")\n}","tryCatchPattern":"match db.begin_execution_payload_rewrap(&keys).await {\n    Err(e) if e.to_string().contains(\"not ready for rewrap\") => {\n        // finish current migrate/rollback, then retry rewrap\n    }\n    r => r?,\n}","preventionTips":["Only rotate keys from 'ready' state; verify operation first","Run one maintenance operation at a time via a locked scheduler","Complete initial migration before scheduling rotation","Record maintenance start/finish in an ops log to detect stuck states"],"tags":["rust","database","encryption","key-rotation","maintenance"],"backgroundTag":"invalid-state-transition","analyzedSha":"18893faf8b356be3320add8de2f861b0b647cf06","analyzedAt":"2026-09-08T20:49:34.690Z","contentChangedAt":"2026-09-08T20:49:34.690Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}