exportStateSealed

The sealed resumable state (decision 0078, anchor B): the same bytes as exportState, authenticated under the attached SecureStore key so that an attacker who can rewrite the state file cannot forge the anti-rollback generation, with the store's rollback counter bound alongside. Restore with connectWithStateSealed or signInWithStateSealed. Requires attachSecureStore first (or a sealed restore, which attaches it); errors otherwise. Against a file-rewriter this refuses a forged generation and, via the per-send counter, a state older than the latest send.

The seal authenticates but does not encrypt: the bytes still carry secrets and must be stored encrypted at rest.