{"record":{"id":"9ae646b289b1132a","repo":"nautechsystems/nautilus_trader","slug":"protected-execution-transaction-has-no-envelope","errorCode":null,"errorMessage":"Protected execution transaction {} has no envelope","messagePattern":"Protected execution transaction (.+?) has no envelope","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/adapters/blockchain/src/cache/database.rs","lineNumber":5231,"sourceCode":"                    anyhow::ensure!(\n                        hash.raw_transaction.is_none() && hash.sealed_transaction.is_none(),\n                        \"Replacement execution transaction {} retains signed bytes\",\n                        hash.id\n                    );\n                    continue;\n                }\n                original_rows += 1;\n                let intent = load_execution_intent(&mut transaction, hash.intent_id).await?;\n                let raw_transaction = if let (Some(keys), Some(deployment_id)) =\n                    (keys, deployment_id.as_deref())\n                {\n                    anyhow::ensure!(\n                        hash.raw_transaction.is_none(),\n                        \"Protected execution transaction {} contains plaintext\",\n                        hash.id\n                    );\n                    let envelope = hash.sealed_transaction.as_deref().ok_or_else(|| {\n                        anyhow::anyhow!(\n                            \"Protected execution transaction {} has no envelope\",\n                            hash.id\n                        )\n                    })?;\n                    let key_id = envelope_key_id(envelope)?;\n                    anyhow::ensure!(\n                        keys.contains_key(&key_id),\n                        \"Execution transaction {} requires an unavailable payload key\",\n                        hash.id\n                    );\n                    key_ids.insert(alloy::hex::encode(key_id));\n                    let context = payload_context(&intent, hash, deployment_id)?;\n                    keys.unseal(envelope, &context)?\n                } else {\n                    anyhow::ensure!(\n                        hash.sealed_transaction.is_none(),\n                        \"Legacy execution transaction {} contains an envelope\",\n                        hash.id","sourceCodeStart":5213,"sourceCodeEnd":5249,"githubUrl":"https://github.com/nautechsystems/nautilus_trader/blob/18893faf8b356be3320add8de2f861b0b647cf06/crates/adapters/blockchain/src/cache/database.rs#L5213-L5249","documentation":"In the protected load path, a row correctly has no plaintext, but its sealed_transaction column is NULL, so there is no envelope to unseal. The loader requires every protected row to carry an envelope and aborts with this anyhow error otherwise.","triggerScenarios":"Loading execution transactions with keys and deployment_id active while a row has raw_transaction IS NULL and sealed_transaction IS NULL (both payload columns empty).","commonSituations":"A crash during the rewrap left a row half-migrated (plaintext deleted before the envelope was written); the sealing writer failed silently; rows restored from a partial backup.","solutions":["Locate the row by id and re-seal its payload from a source of truth (e.g. re-derive from the execution intent) using the rewrap tooling.","Restore the affected rows from a database backup taken before the failed rewrap.","Check application/writer logs around the time the row was written for a failed envelope-sealing step.","If the row is legitimately payload-less, mark it payload_expected=false so it is handled by the replacement-row path."],"exampleFix":"// Corrupt protected row\n{ id: \"0xdef\", raw_transaction: null, sealed_transaction: null }\n// after re-seal\n{ id: \"0xdef\", raw_transaction: null, sealed_transaction: \"0x<sealed envelope bytes>\" }","handlingStrategy":"validation","validationCode":"-- Protected rows missing both payload forms\nSELECT id FROM execution_transactions\nWHERE raw_transaction IS NULL AND sealed_transaction IS NULL\n  AND payload_expected = true;","typeGuard":null,"tryCatchPattern":"let envelope = match row.sealed_transaction {\n    Some(env) => env,\n    None => return Err(anyhow!(\"row {} missing envelope; re-seal required\", row.id)),\n};","preventionTips":["Write plaintext and sealed envelope atomically in one transaction during migration.","Alert on rewrap batches that report partial row counts.","Verify backups include sealed_transaction columns."],"tags":["database","encryption","missing-data","rust"],"backgroundTag":"resource-not-found","analyzedSha":"18893faf8b356be3320add8de2f861b0b647cf06","analyzedAt":"2026-09-08T20:49:34.690Z","contentChangedAt":"2026-09-08T20:49:34.690Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}