{"record":{"id":"55067c068e12194d","repo":"nautechsystems/nautilus_trader","slug":"unprotected-execution-payload-storage-contains-se","errorCode":null,"errorMessage":"Unprotected execution payload storage contains {sealed_rows} sealed row(s)","messagePattern":"Unprotected execution payload storage contains (.+?) sealed row\\(s\\)","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"critical","filePath":"crates/adapters/blockchain/src/cache/database.rs","lineNumber":4813,"sourceCode":"        )\n        .bind(EXECUTION_PAYLOAD_COMPONENT)\n        .fetch_optional(&mut *transaction)\n        .await\n        .context(\"failed to recheck execution payload marker\")?;\n        if marker.is_some() {\n            transaction\n                .rollback()\n                .await\n                .context(\"failed to release concurrent payload activation\")?;\n            return Ok(());\n        }\n        let sealed_rows = sqlx::query_scalar::<_, i64>(\n            \"SELECT COUNT(*) FROM execution_transaction_hash WHERE sealed_transaction IS NOT NULL\",\n        )\n        .fetch_one(&mut *transaction)\n        .await\n        .context(\"failed to inspect pre-activation envelopes\")?;\n        anyhow::ensure!(\n            sealed_rows == 0,\n            \"Unprotected execution payload storage contains {sealed_rows} sealed row(s)\"\n        );\n\n        for statement in [\n            \"\n            CREATE OR REPLACE FUNCTION execution_transaction_payload_fence()\n            RETURNS TRIGGER AS $$\n            DECLARE payload_operation TEXT;\n            BEGIN\n                IF NEW.raw_transaction IS NOT NULL\n                   AND (TG_OP = 'INSERT'\n                        OR OLD.raw_transaction IS NULL\n                        OR NEW.raw_transaction IS DISTINCT FROM OLD.raw_transaction) THEN\n                    SELECT operation INTO payload_operation\n                    FROM execution_payload_state\n                    WHERE component = 'signed_transactions';\n                    IF NOT (","sourceCodeStart":4795,"sourceCodeEnd":4831,"githubUrl":"https://github.com/nautechsystems/nautilus_trader/blob/18893faf8b356be3320add8de2f861b0b647cf06/crates/adapters/blockchain/src/cache/database.rs#L4795-L4831","documentation":"During activation of protected execution payload storage, the library checks whether any execution_transaction_hash rows already have sealed_transaction set. Sealed (encrypted) rows existing before protection is activated cannot be authenticated against any deployment key set, so activation aborts to avoid adopting unverifiable ciphertext.","triggerScenarios":"Calling the activation path when execution_transaction_hash contains rows with sealed_transaction IS NOT NULL but the schema version marker is absent (unprotected storage already received sealed payloads).","commonSituations":"A database was partially activated previously then rolled back while data persisted; rows were inserted by a deployment with different keys; manual tampering or a broken migration left sealed rows behind.","solutions":["Purge or re-key the sealed rows: either delete the sealed rows (if the plaintext copies are authoritative) or migrate them using the original keys before re-attempting activation","Determine which deployment sealed the rows and restore/rotate keys accordingly","Restore a consistent pre-corruption backup of execution_transaction_hash","Never hand-edit sealed payloads; use the library's migration path with the correct PayloadKeySet"],"exampleFix":"-- inspect offending rows\nSELECT id FROM execution_transaction_hash WHERE sealed_transaction IS NOT NULL;\n-- remove or migrate them before activation, e.g. delete only if plaintext is authoritative\nDELETE FROM execution_transaction_hash WHERE sealed_transaction IS NOT NULL AND raw_transaction IS NOT NULL;","handlingStrategy":"try-catch","validationCode":"let sealed: i64 = sqlx::query_scalar(\n    \"SELECT COUNT(*) FROM execution_transaction_hash WHERE sealed_transaction IS NOT NULL\",\n).fetch_one(&pool).await?;\nif sealed > 0 {\n    anyhow::bail!(\"{sealed} pre-activation sealed rows must be purged or re-keyed before activation\");\n}","typeGuard":null,"tryCatchPattern":"if let Err(e) = activate_payload_storage(&db, &keys).await {\n    if let Some(n) = extract_sealed_row_count(&e.to_string()) {\n        // locate and remediate those rows, then retry activation\n    } else { return Err(e); }\n}","preventionTips":["Never roll back an activation transaction while leaving data rows behind","Seal rows only through the protected (activated) storage path","Audit the table for sealed_transaction values before re-activating a database","Keep keys and deployment ids consistent across environments"],"tags":["database","encryption","data-integrity"],"backgroundTag":"internal-invariant-violation","analyzedSha":"18893faf8b356be3320add8de2f861b0b647cf06","analyzedAt":"2026-09-08T20:49:34.690Z","contentChangedAt":"2026-09-08T20:49:34.690Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}