One pass of the re-encryption job: re-seals this process's own rows, then what the store holds under a superseded DEK, then destroys each superseded DEK nothing is sealed under any longer and that has been superseded long enough.
the scheduler's run context
{ superseded, ownRows, resealed, destroyed, remaining }
One pass of the re-encryption job: re-seals this process's own rows, then what the store holds under a superseded DEK, then destroys each superseded DEK nothing is sealed under any longer and that has been superseded long enough.