{"record":{"id":"fbaa88f6e6806f8f","repo":"nautechsystems/nautilus_trader","slug":"protected-execution-transaction-has-no-sealed-p","errorCode":null,"errorMessage":"Protected execution transaction {} has no sealed payload","messagePattern":"Protected execution transaction (.+?) has no sealed payload","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/adapters/blockchain/src/execution/client.rs","lineNumber":3630,"sourceCode":"fn open_execution_payload(\n    keys: &PayloadKeySet,\n    policy: PayloadPolicy,\n    intent: &ExecutionIntentRow,\n    hash: &ExecutionTransactionHashRow,\n    reason: &str,\n) -> anyhow::Result<Vec<u8>> {\n    anyhow::ensure!(\n        hash.payload_expected,\n        \"Execution transaction {} has no signed payload\",\n        hash.transaction_hash\n    );\n    anyhow::ensure!(\n        hash.raw_transaction.is_none(),\n        \"Protected execution transaction {} contains plaintext\",\n        hash.transaction_hash\n    );\n    let envelope = hash.sealed_transaction.as_deref().ok_or_else(|| {\n        anyhow::anyhow!(\n            \"Protected execution transaction {} has no sealed payload\",\n            hash.transaction_hash\n        )\n    })?;\n    let context = payload_context(intent, hash, keys.deployment_id())?;\n    let raw_transaction = keys.unseal(envelope, &context)?;\n    log::info!(\n        \"Unsealed execution payload for intent {} transaction {} during {reason}\",\n        intent.id,\n        hash.transaction_hash\n    );\n    authenticate_retained_payload(&raw_transaction, intent, hash, keys.deployment_id())?;\n    if retained_payload_requires_policy(intent, hash, policy)? {\n        authenticate_payload(&raw_transaction, intent, hash, policy, keys.deployment_id())\n            .with_context(|| {\n                format!(\n                    \"execution intent {} transaction {} violates current execution policy\",\n                    intent.id, hash.transaction_hash","sourceCodeStart":3612,"sourceCodeEnd":3648,"githubUrl":"https://github.com/nautechsystems/nautilus_trader/blob/18893faf8b356be3320add8de2f861b0b647cf06/crates/adapters/blockchain/src/execution/client.rs#L3612-L3648","documentation":"When a transaction row declares a protected (sealed) payload, the code requires `sealed_transaction` to hold the sealed envelope bytes. If the envelope is absent, unsealing is impossible and submission aborts. This is the counterpart of the plaintext check: protected rows must carry exactly a sealed payload.","triggerScenarios":"Calling the payload-resolution function with a hash row where `payload_expected` is true, `raw_transaction` is None, but `sealed_transaction` is also None or empty — the sealed envelope was never persisted or was deleted.","commonSituations":"Crash between writing the hash row and persisting the sealed envelope; a cleanup/GC job that removed sealed blobs but not the rows; failed KMS/sealing-service call that was swallowed; restoring rows from a backup without the blob store.","solutions":["Re-run the sealing/signing step to regenerate the envelope and persist it into sealed_transaction.","Check the KMS/sealing service availability and credentials if sealing failed upstream.","Restore the missing envelope from the blob store/backup or rebuild the row by replaying the pipeline.","If the transaction should not be sealed, correct payload_expected/sealing policy rather than fabricating an envelope."],"exampleFix":"// before: row recorded before sealing finished\nstore.record_hash(row)?; // sealed_transaction still None\n\n// after\nrow.sealed_transaction = Some(sealing_service.seal(&signed_tx, &context)?);\nstore.record_hash(row)?;","handlingStrategy":"validation","validationCode":"if hash.payload_expected && hash.raw_transaction.is_none() && hash.sealed_transaction.as_deref().map_or(true, |s| s.is_empty()) {\n    anyhow::bail!(\"tx {} missing sealed envelope; re-seal before submission\", hash.transaction_hash);\n}","typeGuard":"fn has_sealed_payload(hash: &ExecutionTransactionHashRow) -> bool {\n    hash.sealed_transaction.as_deref().map_or(false, |s| !s.is_empty())\n}","tryCatchPattern":"match resolve_payload(keys, policy, intent, hash, reason) {\n    Ok(bytes) => submit(bytes),\n    Err(e) if e.to_string().contains(\"no sealed payload\") => reseed_and_reseal(intent, hash),\n    Err(e) => return Err(e),\n}","preventionTips":["Persist the sealed envelope in the same transaction as the hash row.","Ensure GC jobs never delete envelopes for live rows.","Alert on KMS/sealing-service failures so envelopes aren't silently skipped."],"tags":["encryption","missing-payload","sealed-envelope"],"backgroundTag":"empty-required-field","analyzedSha":"18893faf8b356be3320add8de2f861b0b647cf06","analyzedAt":"2026-09-08T20:49:34.690Z","contentChangedAt":"2026-09-08T20:49:34.690Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}