Reseals the Plane-2 credential without touching the backend descriptor or immutability. Required scope: admin.tenant.key-backend.byok.declare.

A call that supplies a real credential cannot currently succeed: it answers 503. The one exception is a body whose primary secret is the write-only mask sentinel: that is the documented "leave the sealed credential unchanged" no-op, which runs no self-test, reseals nothing and answers 200. The reseal is gated on a self-test of the CANDIDATE credential, and the only per-tenant reachability probe this platform has is addressed by TENANT ID — it resolves the credential the tenant's row NAMES, which during a rotation is the credential being replaced. Round-tripping that one and answering PASSED would let an unverified credential commit over a working one, so the self-test refuses a rotation candidate outright instead of attesting the wrong credential. The refusal is the safe outcome; restoring a real rotation self-test needs a probe contract that can NAME the credential to authenticate with, which is an open decision with its own unsealing-oracle surface.

Do not read the 503 as transient. It carries Retry-After because the status code does, and a retry will not clear it. While the backend is pre-bind (NOT_DECLARED or DECLARED_PENDING_BIND) the supported correction is to DELETE the declaration and re-declare it with the corrected credential. Once the backend is ACTIVE there is no self-service path and the condition must be escalated.