The one unseal: every frozen value must match the working tree and the log must be empty. With dryRun nothing is written.