-- The same second seal for a pair credential (novox/hq ADR 0085, amended).
--
-- 0023 gave a module's own secrets an operator-sealed copy. A secret the vault provides to a module
-- is not an own secret -- it is the credential of the consumer-vault pair -- and so were the
-- credentials every provider grants. Without this, a vault-provided password could be rotated and
-- audited but not recovered, which is a vault that keeps everything except what it was for.

alter table secret
    add column operator_sealed text,
    add column operator_key    text;