{"record":{"id":"b71a9add3952d378","repo":"nautechsystems/nautilus_trader","slug":"execution-transaction-requires-an-unavailable-p","errorCode":null,"errorMessage":"Execution transaction {} requires an unavailable payload key","messagePattern":"Execution transaction (.+?) requires an unavailable payload key","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/adapters/blockchain/src/cache/database.rs","lineNumber":5237,"sourceCode":"                }\n                original_rows += 1;\n                let intent = load_execution_intent(&mut transaction, hash.intent_id).await?;\n                let raw_transaction = if let (Some(keys), Some(deployment_id)) =\n                    (keys, deployment_id.as_deref())\n                {\n                    anyhow::ensure!(\n                        hash.raw_transaction.is_none(),\n                        \"Protected execution transaction {} contains plaintext\",\n                        hash.id\n                    );\n                    let envelope = hash.sealed_transaction.as_deref().ok_or_else(|| {\n                        anyhow::anyhow!(\n                            \"Protected execution transaction {} has no envelope\",\n                            hash.id\n                        )\n                    })?;\n                    let key_id = envelope_key_id(envelope)?;\n                    anyhow::ensure!(\n                        keys.contains_key(&key_id),\n                        \"Execution transaction {} requires an unavailable payload key\",\n                        hash.id\n                    );\n                    key_ids.insert(alloy::hex::encode(key_id));\n                    let context = payload_context(&intent, hash, deployment_id)?;\n                    keys.unseal(envelope, &context)?\n                } else {\n                    anyhow::ensure!(\n                        hash.sealed_transaction.is_none(),\n                        \"Legacy execution transaction {} contains an envelope\",\n                        hash.id\n                    );\n                    hash.raw_transaction.clone().ok_or_else(|| {\n                        anyhow::anyhow!(\"Legacy execution transaction {} has no plaintext\", hash.id)\n                    })?\n                };\n                authenticate_retained_payload(","sourceCodeStart":5219,"sourceCodeEnd":5255,"githubUrl":"https://github.com/nautechsystems/nautilus_trader/blob/18893faf8b356be3320add8de2f861b0b647cf06/crates/adapters/blockchain/src/cache/database.rs#L5219-L5255","documentation":"The row carries a sealed envelope whose header names a payload key id, but that key id is not present in the PayloadKeySet supplied to the loader. Without the key the envelope cannot be unsealed, so the ensure! fails fast instead of silently dropping the transaction.","triggerScenarios":"Loading protected execution transactions where envelope_key_id(envelope) returns a key id absent from the provided keys map — e.g. the key was rotated out of the config, or a stale/old wrapping key was never imported.","commonSituations":"Key rotation completed on the database side but the node's key configuration still lacks the retired key; a fresh environment missing legacy keys from a secret store; copying a database between deployments with different key inventories.","solutions":["Add the missing payload key (id from the error's key id) to the PayloadKeySet before loading.","Import the retired wrapping key from your secret manager / backup so old envelopes remain decryptable.","Re-run rewrap_execution_payload_storage with a key set that includes both old and new active keys so envelopes are rewrapped to the current key.","Verify key configuration matches execution_payload_state.active_key_id and deployment_id."],"exampleFix":"// before: key set missing retired key\nlet keys = PayloadKeySet::new(active_key);\n// after: include retained old keys during rotation window\nlet keys = PayloadKeySet::builder()\n    .active_key(new_key)\n    .retained_key(old_key) // key id referenced by existing envelopes\n    .build();","handlingStrategy":"fallback","validationCode":"// Ensure all envelope key ids are covered before loading\nfor key_id in collect_envelope_key_ids(&rows)? {\n    if !keys.contains_key(&key_id) {\n        return Err(anyhow!(\"payload key {} missing from key set\", alloy::hex::encode(key_id)));\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep retired wrapping keys in the key set for at least one full rewrap cycle.","Back up wrapping keys in a secret manager before rotation.","Log envelope key ids and diff them against configured key ids at startup."],"tags":["encryption","key-management","database","rust"],"backgroundTag":"missing-credentials","analyzedSha":"18893faf8b356be3320add8de2f861b0b647cf06","analyzedAt":"2026-09-08T20:49:34.690Z","contentChangedAt":"2026-09-08T20:49:34.690Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}