Moves a legacy plaintext owner token out of cfw_meta, which any SQL on the object can read and
write, into the sealed store as its hash. Idempotent.
A sealed hash always wins: once one exists, an owner_token row is deleted without being read,
so SQL cannot swap in a token it knows. Before the first adoption a row is the only record of
the token, so it is trusted as it stands.
Moves a legacy plaintext owner token out of
cfw_meta, which any SQL on the object can read and write, into the sealed store as its hash. Idempotent.A sealed hash always wins: once one exists, an
owner_tokenrow is deleted without being read, so SQL cannot swap in a token it knows. Before the first adoption a row is the only record of the token, so it is trusted as it stands.