@coffre/db 0.14.4 → 0.15.0

package/src/migrations/postgres/0029_use_objects.sql

@@ -0,0 +1,887 @@
+-- 0.15's use, correct on three inputs before the switch (docs/design/0.15-plan.md, "use_credential correctness"; the spec: formal/SealedObjects.tla). It only adds: a nullable column, and functions nothing calls before 0.15's switch; 0.14's code serves on it as before.
+-- - A reference's end in a row (T125). 0.14 ends a reference with its vault's `reference.end` entry alone, which 0.15's use never read: its holder kept reading the source, the end logged nowhere 0.15 looks. Now `secret_references.ended_at`, written by `change_input` in the vault's decision that appends the entry, as a change of the holder's object (`secret.write`, source null), and `use_credential` takes a source only from a newest reference row that has not ended.
+-- - A project's archival on its environments (T126). 0.14 takes an environment of an archived project as archived; 0.15's object held the environment's own `archived_at` only, so a use through a fork of an archived project passed `throughOk`. Now each environment's object holds its project's archival apart from its own (`projectArchived`: one bit for both would let a writer clear the environment's own under a valid seal while its project is archived), the app logs `project.archive` on each environment when a project is archived or restored, and `use_credential` reads it.
+-- - A plain value's text under its seal (T129). Its object held no part of the text, so a writer who edited `secret_versions.plaintext` changed the value under a valid seal. Now the object holds its digest, and `use_credential` answers the text, which the vault hashes against it.
+--> statement-breakpoint
+-- Its newest reference row's end (EndInRow): what the holder's object reads, and `change_input` writes in the vault's decision.
+ALTER TABLE "secret_references" ADD COLUMN "ended_at" timestamp with time zone;
+--> statement-breakpoint
+-- The vault reads the objects it changes, a reference's holder's included, whose source is its newest reference row's: reads only, as of every place it decides on (0000's grants).
+GRANT SELECT ON secret_references TO coffre_vault;
+--> statement-breakpoint
+-- The use's row gains the value's text, when plain (its object's digest), each environment's project's archival, apart from its own (ArchivedApart), and the reference row the key and its source read through (ReferenceInObject).
+ALTER TYPE use_row ADD ATTRIBUTE v_plaintext text, ADD ATTRIBUTE e1_project_archived boolean, ADD ATTRIBUTE e2_project_archived boolean, ADD ATTRIBUTE e3_project_archived boolean, ADD ATTRIBUTE e4_project_archived boolean, ADD ATTRIBUTE s_reference uuid, ADD ATTRIBUTE x_reference uuid;
+--> statement-breakpoint
+-- `use_credential` as 0028 made it (its comments and 0024's say how), but for what it reads: a reference's source, and the id of the row it is read through, only while its newest row has not ended; each environment's project's archival, a scalar subquery each, one primary-key probe of `projects` (as left joins of the statement they cost about 0.2 ms of Postgres CPU a use, measured; as subqueries about 0.02 ms); and a plain value's text. And no JIT, ever (`jit = off`): the statement's generic plan, the one the hot login keeps (`plan_cache_mode`), is estimated near `jit_above_cost` (100,000 by default; 0028's at about 97,000 on hot-path-one.md's rig, this one's at about 102,000 with the project reads), and the estimate grows with the tables. Past it, Postgres compiles the plan's expressions at every execution: about 130 ms a use, measured, where the use costs under 2 ms. A setting of the function's, not the login's, so that no deployment's server default can bring it back.
+CREATE OR REPLACE FUNCTION use_credential(
+    p_credential uuid, p_secret uuid, p_request bigint, p_at bigint, p_purpose smallint, p_place uuid, p_mac bytea, p_deadline bigint,
+    p_cover bigint DEFAULT NULL, p_cover_at bigint DEFAULT NULL, p_cover_request bigint DEFAULT NULL, p_known bigint DEFAULT NULL, p_known_mac bytea DEFAULT NULL,
+    p_cap_count integer DEFAULT NULL, p_cap_window bigint DEFAULT NULL
+) RETURNS json
+    LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog, pg_temp SET bytea_output = 'hex' SET jit = off AS $$
+DECLARE
+    r public.use_row;
+    -- The principal's lock held: exclusive (`locked`), to enter its key in the cap's set; shared (`moving`), to move it on.
+    locked boolean := false;
+    moving boolean := false;
+    probe boolean := p_known IS NULL OR p_cap_count IS NULL OR p_cap_window IS NULL;
+    -- A use through a place, or of a key with no value of its own (a reference), reads every input; the others, most
+    -- uses, the plain shape: no place, no source, none of their joins.
+    whole boolean := p_place IS NOT NULL;
+    -- The cached forms' refresh and period, from the cap the isolate passes; the probing forms work theirs out from the cap they read.
+    c_refresh bigint := greatest(1, least(60000, p_cap_window / 10));
+    c_period bigint := p_at - ((p_at % c_refresh) + c_refresh) % c_refresh;
+    -- Whether this session has yet to plan the four statements (T131), and the form the warm-up is at.
+    dry boolean := current_setting('coffre.use_planned', true) IS DISTINCT FROM '0029';
+    form integer := 0;
+    first_probe boolean;
+    first_whole boolean;
+    -- The period this call writes, if it writes the cap's row, and the lock that elects the one use that moves it.
+    b_refresh bigint;
+    b_period bigint;
+    b_lock bigint;
+    b_round integer := 0;
+BEGIN
+    IF p_deadline IS NULL OR p_deadline > p_at + public.deadline_max() THEN r.state := 'late'; RETURN to_json(r); END IF;
+    -- Its Worker's clock ahead by over a minute (0022 says why): checked here at no cost, and again in the statement.
+    IF p_at > (extract(epoch FROM clock_timestamp()) * 1000)::bigint + 60000 THEN r.state := 'ahead'; RETURN to_json(r); END IF;
+    IF dry THEN
+        -- Each form first runs dry, outside the fence, so that its plan is made before this call holds the fence.
+        first_probe := probe;
+        first_whole := whole;
+        probe := true;
+        whole := false;
+    ELSE
+        PERFORM pg_advisory_xact_lock_shared(1668244070, 0);
+    END IF;
+    LOOP
+        IF probe AND NOT whole THEN
+            WITH i AS MATERIALIZED (
+                SELECT n.number AS newest, n.mac AS newest_mac, coalesce(n.number = p_known AND n.mac = p_known_mac, false) AS cached,
+                    f.at_floor, (lpol.payload::jsonb #>> '{value,bulk,count}')::integer AS cap_count, (lpol.payload::jsonb #>> '{value,bulk,windowMs}')::bigint AS cap_window,
+                    lpol.number AS lpol_number, lpol.seal AS p_last,
+                    c.principal AS p, c.kind AS c_kind, c.scope AS c_scope, c.revoked_at IS NOT NULL AS c_revoked,
+                    floor(extract(epoch FROM least(c.expires_at, c.not_after)) * 1000)::bigint AS c_expires, c.seal AS c_seal,
+                    m.status AS m_status, m.owner AS m_owner, m.role AS m_role, m.scope AS m_scope, m.seal AS m_seal,
+                    cfg.r_value, cfg.r_seal, cfg.p_value, cfg.p_seal,
+                    s.project_id AS s_project, s.environment_id AS s_environment, s.current_version_id AS s_version, NULL::uuid AS s_source, NULL::uuid AS s_reference, s.seal AS s_seal,
+                    NULL::uuid AS x_project, NULL::uuid AS x_environment, NULL::uuid AS x_version, NULL::uuid AS x_source, NULL::uuid AS x_reference, NULL::bytea AS x_seal,
+                    sv.envelope_version, sv.ciphertext, sv.iv, sv.auth_tag, sv.wrapped_dek, sv.kek_provider, sv.kek_id, sv.kek_version, sv.sensitive, sv.plaintext IS NOT NULL AS v_plain, sv.plaintext AS v_plaintext,
+                    NULL::uuid AS e1_id, NULL::uuid AS e1_project, NULL::text AS e1_slug, NULL::text AS e1_owner, NULL::uuid AS e1_parent, NULL::boolean AS e1_protected, NULL::boolean AS e1_archived, NULL::boolean AS e1_project_archived, NULL::bytea AS e1_seal,
+                    s.environment_id AS e2_id, e2.project_id AS e2_project, e2.slug AS e2_slug, e2.owner AS e2_owner, e2.parent_id AS e2_parent, e2.protected AS e2_protected, e2.archived_at IS NOT NULL AS e2_archived, (SELECT q.archived_at IS NOT NULL FROM public.projects q WHERE q.id = e2.project_id) AS e2_project_archived, e2.seal AS e2_seal,
+                    NULL::uuid AS e3_id, NULL::uuid AS e3_project, NULL::text AS e3_slug, NULL::text AS e3_owner, NULL::uuid AS e3_parent, NULL::boolean AS e3_protected, NULL::boolean AS e3_archived, NULL::boolean AS e3_project_archived, NULL::bytea AS e3_seal,
+                    CASE WHEN e2.owner IS NOT NULL THEN e2.parent_id END AS e4_id, e4.project_id AS e4_project, e4.slug AS e4_slug, e4.owner AS e4_owner, e4.parent_id AS e4_parent, e4.protected AS e4_protected, e4.archived_at IS NOT NULL AS e4_archived, (SELECT q.archived_at IS NOT NULL FROM public.projects q WHERE q.id = e4.project_id) AS e4_project_archived, e4.seal AS e4_seal,
+                    b.last AS bulk_last,
+                    -- Each input's object key, computed once: a key in a probe's own condition is computed again for every row it reads (0022, decision 3).
+                    public.log_object('credential', p_credential::text) AS k_credential,
+                    public.log_object('principal', c.principal) AS k_member,
+                    public.log_object('secret', p_secret::text) AS k_secret,
+                    public.log_object('environment', s.environment_id::text) AS k_e2,
+                    public.log_object('environment', (CASE WHEN e2.owner IS NOT NULL THEN e2.parent_id END)::text) AS k_e4
+                  FROM (SELECT 1) one
+                  LEFT JOIN LATERAL (SELECT x.number, x.mac FROM public.log_changes x ORDER BY x.number DESC LIMIT 1) n ON true
+                  LEFT JOIN public.log_fence f ON f.only_row
+                  -- The roles and the policy, both rows in one read of their one-page table.
+                  LEFT JOIN LATERAL (
+                      SELECT max(g.value) FILTER (WHERE g.name = 'roles') AS r_value, (array_agg(g.seal) FILTER (WHERE g.name = 'roles'))[1] AS r_seal,
+                             max(g.value) FILTER (WHERE g.name = 'policy') AS p_value, (array_agg(g.seal) FILTER (WHERE g.name = 'policy'))[1] AS p_seal
+                        FROM public.log_config g
+                  ) cfg ON true
+                  -- The cap as the policy's newest change says it (CapSealed): every policy change logs the whole policy as its `value`.
+                  LEFT JOIN LATERAL (
+                      SELECT x.number, x.seal, x.payload FROM public.log_changes x WHERE x.object = public.log_object('policy', 'instance') ORDER BY x.number DESC LIMIT 1
+                  ) lpol ON true
+                  LEFT JOIN public.credentials c ON c.id = p_credential
+                  LEFT JOIN public.vault_members m ON m.principal = c.principal
+                  -- An archived key is gone (`secret.delete`): no object.
+                  LEFT JOIN public.secrets s ON s.id = p_secret AND s.archived_at IS NULL
+                  -- The key's own version, its own environment, and that environment's parent when it is a personal config.
+                  LEFT JOIN public.secret_versions sv ON sv.id = s.current_version_id
+                  LEFT JOIN public.environments e2 ON e2.id = s.environment_id
+                  LEFT JOIN public.environments e4 ON e4.id = e2.parent_id AND e2.owner IS NOT NULL
+                  LEFT JOIN public.log_bulk b ON b.principal = c.principal AND b.secret = p_secret
+                 WHERE NOT dry
+            ),
+            v AS MATERIALIZED (
+                SELECT i.*, cap.refresh, cap.period,
+                    CASE WHEN i.s_project IS NOT NULL AND i.s_version IS NULL THEN 'whole'
+                         WHEN i.at_floor IS NULL OR p_at < i.at_floor OR (extract(epoch FROM clock_timestamp()) * 1000)::bigint > p_deadline THEN 'late'
+                         WHEN p_at > (extract(epoch FROM clock_timestamp()) * 1000)::bigint + 60000 THEN 'ahead'
+                         WHEN i.cap_count IS NULL OR i.cap_window IS NULL THEN 'unconfigured'
+                         WHEN i.p IS NOT NULL AND NOT locked AND NOT coalesce(i.bulk_last > p_at - i.cap_window - cap.refresh, false) THEN 'lock'
+                         WHEN i.p IS NOT NULL AND NOT locked AND NOT moving AND i.bulk_last < cap.period THEN 'share' END AS state,
+                    greatest(lc.number, lm.number, lr.number, i.lpol_number, ls.number, l2.number, l4.number) AS inputs,
+                    lc.seal AS c_last, lm.seal AS m_last, (lm.payload::jsonb ->> 'old')::bigint AS m_old, lr.seal AS r_last, ls.seal AS s_last, NULL::bytea AS x_last,
+                    NULL::bytea AS e1_last, l2.seal AS e2_last, NULL::bytea AS e3_last, l4.seal AS e4_last,
+                    coalesce(i.bulk_last > p_at - i.cap_window - cap.refresh, false) AS is_in,
+                    -- The other keys in the set, up to the cap: read only under the principal's lock, for a key not in it.
+                    CASE WHEN locked AND i.p IS NOT NULL AND NOT coalesce(i.bulk_last > p_at - i.cap_window - cap.refresh, false) THEN (
+                        SELECT count(*)::integer FROM (
+                            SELECT 1 FROM public.log_bulk o
+                             WHERE o.principal = i.p AND o.secret <> p_secret AND o.last > p_at - i.cap_window - cap.refresh - public.deadline_max() - 60000
+                             LIMIT i.cap_count
+                        ) z
+                    ) ELSE 0 END AS n_others,
+                    -- A repeat rides its cover only while every part of this holds: never on a key whose bulk row is missing (CoverFresh).
+                    coalesce(p_cover IS NOT NULL AND i.bulk_last >= cap.period AND p_cover > coalesce(greatest(lc.number, lm.number, lr.number, i.lpol_number, ls.number, l2.number, l4.number), 0)
+                        AND EXISTS (SELECT 1 FROM public.log_uses u WHERE u.at = p_cover_at AND u.request_id = p_cover_request AND u.number = p_cover
+                            AND u.credential = p_credential AND u.secret = p_secret AND u.purpose = p_purpose AND u.place IS NOT DISTINCT FROM p_place), false) AS is_covered
+                  FROM i
+                  CROSS JOIN LATERAL (SELECT greatest(1, least(60000, i.cap_window / 10)) AS refresh) r0
+                  CROSS JOIN LATERAL (SELECT r0.refresh, p_at - ((p_at % r0.refresh) + r0.refresh) % r0.refresh AS period) cap
+                  -- Each input's newest change: one index-only probe each (log_changes_object_idx holds the seal), the principal's
+                  -- with its payload, which names the 0.14 entry it accounts for.
+                  LEFT JOIN LATERAL (SELECT x.number, x.seal FROM public.log_changes x WHERE x.object = i.k_credential ORDER BY x.number DESC LIMIT 1) lc ON true
+                  LEFT JOIN LATERAL (SELECT x.number, x.seal, x.payload FROM public.log_changes x WHERE x.object = i.k_member ORDER BY x.number DESC LIMIT 1) lm ON i.k_member IS NOT NULL
+                  LEFT JOIN LATERAL (SELECT x.number, x.seal FROM public.log_changes x WHERE x.object = public.log_object('roles', 'instance') ORDER BY x.number DESC LIMIT 1) lr ON true
+                  LEFT JOIN LATERAL (SELECT x.number, x.seal FROM public.log_changes x WHERE x.object = i.k_secret ORDER BY x.number DESC LIMIT 1) ls ON true
+                  LEFT JOIN LATERAL (SELECT x.number, x.seal FROM public.log_changes x WHERE x.object = i.k_e2 ORDER BY x.number DESC LIMIT 1) l2 ON i.k_e2 IS NOT NULL
+                  LEFT JOIN LATERAL (SELECT x.number, x.seal FROM public.log_changes x WHERE x.object = i.k_e4 ORDER BY x.number DESC LIMIT 1) l4 ON i.k_e4 IS NOT NULL
+            ),
+            w AS (
+                INSERT INTO public.log_uses (number, at, request_id, credential, secret, purpose, mac, place)
+                SELECT nextval('public.log_number'), p_at, p_request, p_credential, p_secret, p_purpose, p_mac, p_place
+                  FROM v WHERE v.state IS NULL AND NOT v.is_covered
+                RETURNING log_uses.number
+            )
+            SELECT v.state, (SELECT w.number FROM w), CASE WHEN v.state IS NULL AND v.is_covered THEN p_cover END, v.newest, v.newest_mac, v.inputs, true,
+                v.p, v.c_kind, v.c_scope, v.c_revoked, v.c_expires, v.c_seal, v.c_last,
+                v.m_status, v.m_owner, v.m_role, v.m_scope, v.m_seal, v.m_last, v.m_old,
+                (SELECT a.seq FROM public.audit_log a WHERE a.author = 'vault' AND a.subject_principal = v.p AND a.decision = 'allow'
+                    AND a.action IN ('member.add', 'member.restore', 'member.owner', 'member.role', 'member.remove', 'access.grant', 'access.revoke') ORDER BY a.seq DESC LIMIT 1),
+                gr.g_project, gr.g_environment, gr.g_slug, gr.g_role, gr.g_expires,
+                v.r_value, v.r_seal, v.r_last,
+                v.p_value, v.p_seal, v.p_last, v.cap_count, v.cap_window,
+                v.s_project, v.s_environment, v.s_version, v.s_source, v.s_seal, v.s_last,
+                v.x_project, v.x_environment, v.x_version, v.x_source, v.x_seal, v.x_last,
+                v.envelope_version, v.ciphertext, v.iv, v.auth_tag, v.wrapped_dek, v.kek_provider, v.kek_id, v.kek_version, v.sensitive, v.v_plain,
+                v.e1_id, v.e1_project, v.e1_slug, v.e1_owner, v.e1_parent, v.e1_protected, v.e1_archived, v.e1_seal, v.e1_last,
+                v.e2_id, v.e2_project, v.e2_slug, v.e2_owner, v.e2_parent, v.e2_protected, v.e2_archived, v.e2_seal, v.e2_last,
+                v.e3_id, v.e3_project, v.e3_slug, v.e3_owner, v.e3_parent, v.e3_protected, v.e3_archived, v.e3_seal, v.e3_last,
+                v.e4_id, v.e4_project, v.e4_slug, v.e4_owner, v.e4_parent, v.e4_protected, v.e4_archived, v.e4_seal, v.e4_last,
+                v.is_in, v.n_others, v.v_plaintext, v.e1_project_archived, v.e2_project_archived, v.e3_project_archived, v.e4_project_archived, v.s_reference, v.x_reference
+              INTO r
+              FROM v
+              -- The principal's grants as five lists, one entry per grant, lapsed ones included; an environment's grant with its project, which its row finds through `environments`.
+              LEFT JOIN LATERAL (
+                  SELECT array_agg(coalesce(g.project_id, ge.project_id)) AS g_project, array_agg(g.environment_id) AS g_environment,
+                         array_agg(g.environment_slug) AS g_slug, array_agg(g.role) AS g_role, array_agg(g.expires_at) AS g_expires
+                    FROM public.vault_grants g LEFT JOIN public.environments ge ON ge.id = g.environment_id
+                   WHERE g.principal = v.p
+              ) gr ON v.m_status IS NOT NULL;
+        ELSIF probe THEN
+            WITH i AS MATERIALIZED (
+                SELECT n.number AS newest, n.mac AS newest_mac, coalesce(n.number = p_known AND n.mac = p_known_mac, false) AS cached,
+                    f.at_floor, (lpol.payload::jsonb #>> '{value,bulk,count}')::integer AS cap_count, (lpol.payload::jsonb #>> '{value,bulk,windowMs}')::bigint AS cap_window,
+                    lpol.number AS lpol_number, lpol.seal AS p_last,
+                    c.principal AS p, c.kind AS c_kind, c.scope AS c_scope, c.revoked_at IS NOT NULL AS c_revoked,
+                    floor(extract(epoch FROM least(c.expires_at, c.not_after)) * 1000)::bigint AS c_expires, c.seal AS c_seal,
+                    m.status AS m_status, m.owner AS m_owner, m.role AS m_role, m.scope AS m_scope, m.seal AS m_seal,
+                    cfg.r_value, cfg.r_seal, cfg.p_value, cfg.p_seal,
+                    s.project_id AS s_project, s.environment_id AS s_environment, s.current_version_id AS s_version, ref.source_secret_id AS s_source, ref.reference_id AS s_reference, s.seal AS s_seal,
+                    src.project_id AS x_project, src.environment_id AS x_environment, src.current_version_id AS x_version, xref.source_secret_id AS x_source, xref.reference_id AS x_reference, src.seal AS x_seal,
+                    sv.envelope_version, sv.ciphertext, sv.iv, sv.auth_tag, sv.wrapped_dek, sv.kek_provider, sv.kek_id, sv.kek_version, sv.sensitive, sv.plaintext IS NOT NULL AS v_plain, sv.plaintext AS v_plaintext,
+                    ids.e1 AS e1_id, e1.project_id AS e1_project, e1.slug AS e1_slug, e1.owner AS e1_owner, e1.parent_id AS e1_parent, e1.protected AS e1_protected, e1.archived_at IS NOT NULL AS e1_archived, (SELECT q.archived_at IS NOT NULL FROM public.projects q WHERE q.id = e1.project_id) AS e1_project_archived, e1.seal AS e1_seal,
+                    s.environment_id AS e2_id, e2.project_id AS e2_project, e2.slug AS e2_slug, e2.owner AS e2_owner, e2.parent_id AS e2_parent, e2.protected AS e2_protected, e2.archived_at IS NOT NULL AS e2_archived, (SELECT q.archived_at IS NOT NULL FROM public.projects q WHERE q.id = e2.project_id) AS e2_project_archived, e2.seal AS e2_seal,
+                    ids.e3 AS e3_id, e3.project_id AS e3_project, e3.slug AS e3_slug, e3.owner AS e3_owner, e3.parent_id AS e3_parent, e3.protected AS e3_protected, e3.archived_at IS NOT NULL AS e3_archived, (SELECT q.archived_at IS NOT NULL FROM public.projects q WHERE q.id = e3.project_id) AS e3_project_archived, e3.seal AS e3_seal,
+                    CASE WHEN ve.owner IS NOT NULL THEN ve.parent END AS e4_id, e4.project_id AS e4_project, e4.slug AS e4_slug, e4.owner AS e4_owner, e4.parent_id AS e4_parent, e4.protected AS e4_protected, e4.archived_at IS NOT NULL AS e4_archived, (SELECT q.archived_at IS NOT NULL FROM public.projects q WHERE q.id = e4.project_id) AS e4_project_archived, e4.seal AS e4_seal,
+                    b.last AS bulk_last,
+                    -- Each input's object key, computed once: a key in a probe's own condition is computed again for every row it reads (0022, decision 3).
+                    public.log_object('credential', p_credential::text) AS k_credential,
+                    public.log_object('principal', c.principal) AS k_member,
+                    public.log_object('secret', p_secret::text) AS k_secret,
+                    public.log_object('secret', ref.source_secret_id::text) AS k_source,
+                    public.log_object('environment', ids.e1::text) AS k_e1,
+                    public.log_object('environment', s.environment_id::text) AS k_e2,
+                    public.log_object('environment', ids.e3::text) AS k_e3,
+                    public.log_object('environment', (CASE WHEN ve.owner IS NOT NULL THEN ve.parent END)::text) AS k_e4
+                  FROM (SELECT 1) one
+                  LEFT JOIN LATERAL (SELECT x.number, x.mac FROM public.log_changes x ORDER BY x.number DESC LIMIT 1) n ON true
+                  LEFT JOIN public.log_fence f ON f.only_row
+                  -- The roles and the policy, both rows in one read of their one-page table.
+                  LEFT JOIN LATERAL (
+                      SELECT max(g.value) FILTER (WHERE g.name = 'roles') AS r_value, (array_agg(g.seal) FILTER (WHERE g.name = 'roles'))[1] AS r_seal,
+                             max(g.value) FILTER (WHERE g.name = 'policy') AS p_value, (array_agg(g.seal) FILTER (WHERE g.name = 'policy'))[1] AS p_seal
+                        FROM public.log_config g
+                  ) cfg ON true
+                  -- The cap as the policy's newest change says it (CapSealed): every policy change logs the whole policy as its `value`.
+                  LEFT JOIN LATERAL (
+                      SELECT x.number, x.seal, x.payload FROM public.log_changes x WHERE x.object = public.log_object('policy', 'instance') ORDER BY x.number DESC LIMIT 1
+                  ) lpol ON true
+                  LEFT JOIN public.credentials c ON c.id = p_credential
+                  LEFT JOIN public.vault_members m ON m.principal = c.principal
+                  -- An archived key is gone (`secret.delete`): no object.
+                  LEFT JOIN public.secrets s ON s.id = p_secret AND s.archived_at IS NULL
+                  -- A key with no version of its own is a reference while its newest reference row names a source and has not ended (`ended_at`): an ended one's holder reads as no value, no source (`ended`).
+                  LEFT JOIN LATERAL (
+                      SELECT CASE WHEN y.ended_at IS NULL THEN y.source_secret_id END AS source_secret_id, CASE WHEN y.ended_at IS NULL THEN y.id END AS reference_id FROM public.secret_references y WHERE y.secret_id = s.id ORDER BY y.created_seq DESC LIMIT 1
+                  ) ref ON s.current_version_id IS NULL
+                  LEFT JOIN public.secrets src ON src.id = ref.source_secret_id AND src.archived_at IS NULL
+                  LEFT JOIN LATERAL (
+                      SELECT CASE WHEN y.ended_at IS NULL THEN y.source_secret_id END AS source_secret_id, CASE WHEN y.ended_at IS NULL THEN y.id END AS reference_id FROM public.secret_references y WHERE y.secret_id = src.id ORDER BY y.created_seq DESC LIMIT 1
+                  ) xref ON src.current_version_id IS NULL
+                  -- The value's version: the key's own, or its source's.
+                  LEFT JOIN public.secret_versions sv ON sv.id = CASE WHEN ref.source_secret_id IS NULL THEN s.current_version_id ELSE src.current_version_id END
+                  -- The environments `useEnvironments` names, each by the id the rows name, whether or not its row is there: e1 the
+                  -- place read through, e2 the key's own, e3 its value's (a reference's source's) where that is another, and e4
+                  -- the parent of its value's when that is a personal config.
+                  LEFT JOIN LATERAL (
+                      SELECT CASE WHEN p_place IS DISTINCT FROM s.environment_id THEN p_place END AS e1,
+                             CASE WHEN src.environment_id IS DISTINCT FROM s.environment_id THEN src.environment_id END AS e3
+                  ) ids ON true
+                  LEFT JOIN public.environments e1 ON e1.id = ids.e1
+                  LEFT JOIN public.environments e2 ON e2.id = s.environment_id
+                  LEFT JOIN public.environments e3 ON e3.id = ids.e3
+                  -- The value's environment's row: the key's own, unless it is a reference, whose source is elsewhere or gone.
+                  LEFT JOIN LATERAL (
+                      SELECT CASE WHEN ref.source_secret_id IS NULL OR (src.id IS NOT NULL AND ids.e3 IS NULL) THEN e2.owner ELSE e3.owner END AS owner,
+                             CASE WHEN ref.source_secret_id IS NULL OR (src.id IS NOT NULL AND ids.e3 IS NULL) THEN e2.parent_id ELSE e3.parent_id END AS parent
+                  ) ve ON true
+                  LEFT JOIN public.environments e4 ON e4.id = ve.parent AND ve.owner IS NOT NULL
+                  LEFT JOIN public.log_bulk b ON b.principal = c.principal AND b.secret = p_secret
+                 WHERE NOT dry
+            ),
+            v AS MATERIALIZED (
+                SELECT i.*, cap.refresh, cap.period,
+                    CASE WHEN i.at_floor IS NULL OR p_at < i.at_floor OR (extract(epoch FROM clock_timestamp()) * 1000)::bigint > p_deadline THEN 'late'
+                         WHEN p_at > (extract(epoch FROM clock_timestamp()) * 1000)::bigint + 60000 THEN 'ahead'
+                         WHEN i.cap_count IS NULL OR i.cap_window IS NULL THEN 'unconfigured'
+                         WHEN i.p IS NOT NULL AND NOT locked AND NOT coalesce(i.bulk_last > p_at - i.cap_window - cap.refresh, false) THEN 'lock'
+                         WHEN i.p IS NOT NULL AND NOT locked AND NOT moving AND i.bulk_last < cap.period THEN 'share' END AS state,
+                    greatest(lc.number, lm.number, lr.number, i.lpol_number, ls.number, lx.number, l1.number, l2.number, l3.number, l4.number) AS inputs,
+                    lc.seal AS c_last, lm.seal AS m_last, (lm.payload::jsonb ->> 'old')::bigint AS m_old, lr.seal AS r_last, ls.seal AS s_last, lx.seal AS x_last,
+                    l1.seal AS e1_last, l2.seal AS e2_last, l3.seal AS e3_last, l4.seal AS e4_last,
+                    coalesce(i.bulk_last > p_at - i.cap_window - cap.refresh, false) AS is_in,
+                    -- The other keys in the set, up to the cap: read only under the principal's lock, for a key not in it.
+                    CASE WHEN locked AND i.p IS NOT NULL AND NOT coalesce(i.bulk_last > p_at - i.cap_window - cap.refresh, false) THEN (
+                        SELECT count(*)::integer FROM (
+                            SELECT 1 FROM public.log_bulk o
+                             WHERE o.principal = i.p AND o.secret <> p_secret AND o.last > p_at - i.cap_window - cap.refresh - public.deadline_max() - 60000
+                             LIMIT i.cap_count
+                        ) z
+                    ) ELSE 0 END AS n_others,
+                    -- A repeat rides its cover only while every part of this holds: never on a key whose bulk row is missing (CoverFresh).
+                    coalesce(p_cover IS NOT NULL AND i.bulk_last >= cap.period AND p_cover > coalesce(greatest(lc.number, lm.number, lr.number, i.lpol_number, ls.number, lx.number, l1.number, l2.number, l3.number, l4.number), 0)
+                        AND EXISTS (SELECT 1 FROM public.log_uses u WHERE u.at = p_cover_at AND u.request_id = p_cover_request AND u.number = p_cover
+                            AND u.credential = p_credential AND u.secret = p_secret AND u.purpose = p_purpose AND u.place IS NOT DISTINCT FROM p_place), false) AS is_covered
+                  FROM i
+                  CROSS JOIN LATERAL (SELECT greatest(1, least(60000, i.cap_window / 10)) AS refresh) r0
+                  CROSS JOIN LATERAL (SELECT r0.refresh, p_at - ((p_at % r0.refresh) + r0.refresh) % r0.refresh AS period) cap
+                  -- Each input's newest change: one index-only probe each (log_changes_object_idx holds the seal), the principal's
+                  -- with its payload, which names the 0.14 entry it accounts for.
+                  LEFT JOIN LATERAL (SELECT x.number, x.seal FROM public.log_changes x WHERE x.object = i.k_credential ORDER BY x.number DESC LIMIT 1) lc ON true
+                  LEFT JOIN LATERAL (SELECT x.number, x.seal, x.payload FROM public.log_changes x WHERE x.object = i.k_member ORDER BY x.number DESC LIMIT 1) lm ON i.k_member IS NOT NULL
+                  LEFT JOIN LATERAL (SELECT x.number, x.seal FROM public.log_changes x WHERE x.object = public.log_object('roles', 'instance') ORDER BY x.number DESC LIMIT 1) lr ON true
+                  LEFT JOIN LATERAL (SELECT x.number, x.seal FROM public.log_changes x WHERE x.object = i.k_secret ORDER BY x.number DESC LIMIT 1) ls ON true
+                  LEFT JOIN LATERAL (SELECT x.number, x.seal FROM public.log_changes x WHERE x.object = i.k_source ORDER BY x.number DESC LIMIT 1) lx ON i.k_source IS NOT NULL
+                  LEFT JOIN LATERAL (SELECT x.number, x.seal FROM public.log_changes x WHERE x.object = i.k_e1 ORDER BY x.number DESC LIMIT 1) l1 ON i.k_e1 IS NOT NULL
+                  LEFT JOIN LATERAL (SELECT x.number, x.seal FROM public.log_changes x WHERE x.object = i.k_e2 ORDER BY x.number DESC LIMIT 1) l2 ON i.k_e2 IS NOT NULL
+                  LEFT JOIN LATERAL (SELECT x.number, x.seal FROM public.log_changes x WHERE x.object = i.k_e3 ORDER BY x.number DESC LIMIT 1) l3 ON i.k_e3 IS NOT NULL
+                  LEFT JOIN LATERAL (SELECT x.number, x.seal FROM public.log_changes x WHERE x.object = i.k_e4 ORDER BY x.number DESC LIMIT 1) l4 ON i.k_e4 IS NOT NULL
+            ),
+            w AS (
+                INSERT INTO public.log_uses (number, at, request_id, credential, secret, purpose, mac, place)
+                SELECT nextval('public.log_number'), p_at, p_request, p_credential, p_secret, p_purpose, p_mac, p_place
+                  FROM v WHERE v.state IS NULL AND NOT v.is_covered
+                RETURNING log_uses.number
+            )
+            SELECT v.state, (SELECT w.number FROM w), CASE WHEN v.state IS NULL AND v.is_covered THEN p_cover END, v.newest, v.newest_mac, v.inputs, true,
+                v.p, v.c_kind, v.c_scope, v.c_revoked, v.c_expires, v.c_seal, v.c_last,
+                v.m_status, v.m_owner, v.m_role, v.m_scope, v.m_seal, v.m_last, v.m_old,
+                (SELECT a.seq FROM public.audit_log a WHERE a.author = 'vault' AND a.subject_principal = v.p AND a.decision = 'allow'
+                    AND a.action IN ('member.add', 'member.restore', 'member.owner', 'member.role', 'member.remove', 'access.grant', 'access.revoke') ORDER BY a.seq DESC LIMIT 1),
+                gr.g_project, gr.g_environment, gr.g_slug, gr.g_role, gr.g_expires,
+                v.r_value, v.r_seal, v.r_last,
+                v.p_value, v.p_seal, v.p_last, v.cap_count, v.cap_window,
+                v.s_project, v.s_environment, v.s_version, v.s_source, v.s_seal, v.s_last,
+                v.x_project, v.x_environment, v.x_version, v.x_source, v.x_seal, v.x_last,
+                v.envelope_version, v.ciphertext, v.iv, v.auth_tag, v.wrapped_dek, v.kek_provider, v.kek_id, v.kek_version, v.sensitive, v.v_plain,
+                v.e1_id, v.e1_project, v.e1_slug, v.e1_owner, v.e1_parent, v.e1_protected, v.e1_archived, v.e1_seal, v.e1_last,
+                v.e2_id, v.e2_project, v.e2_slug, v.e2_owner, v.e2_parent, v.e2_protected, v.e2_archived, v.e2_seal, v.e2_last,
+                v.e3_id, v.e3_project, v.e3_slug, v.e3_owner, v.e3_parent, v.e3_protected, v.e3_archived, v.e3_seal, v.e3_last,
+                v.e4_id, v.e4_project, v.e4_slug, v.e4_owner, v.e4_parent, v.e4_protected, v.e4_archived, v.e4_seal, v.e4_last,
+                v.is_in, v.n_others, v.v_plaintext, v.e1_project_archived, v.e2_project_archived, v.e3_project_archived, v.e4_project_archived, v.s_reference, v.x_reference
+              INTO r
+              FROM v
+              -- The principal's grants as five lists, one entry per grant, lapsed ones included; an environment's grant with its project, which its row finds through `environments`.
+              LEFT JOIN LATERAL (
+                  SELECT array_agg(coalesce(g.project_id, ge.project_id)) AS g_project, array_agg(g.environment_id) AS g_environment,
+                         array_agg(g.environment_slug) AS g_slug, array_agg(g.role) AS g_role, array_agg(g.expires_at) AS g_expires
+                    FROM public.vault_grants g LEFT JOIN public.environments ge ON ge.id = g.environment_id
+                   WHERE g.principal = v.p
+              ) gr ON v.m_status IS NOT NULL;
+        ELSIF NOT whole THEN
+            -- The isolate's seals, and its cap, read at the change it names: no probe, only whether a change came since
+            -- (then nothing is written: 'reprobe').
+            WITH i AS MATERIALIZED (
+                SELECT n.number AS newest, n.mac AS newest_mac, coalesce(n.number = p_known AND n.mac = p_known_mac, false) AS cached,
+                    f.at_floor,
+                    c.principal AS p, c.kind AS c_kind, c.scope AS c_scope, c.revoked_at IS NOT NULL AS c_revoked,
+                    floor(extract(epoch FROM least(c.expires_at, c.not_after)) * 1000)::bigint AS c_expires, c.seal AS c_seal,
+                    m.status AS m_status, m.owner AS m_owner, m.role AS m_role, m.scope AS m_scope, m.seal AS m_seal,
+                    cfg.r_value, cfg.r_seal, cfg.p_value, cfg.p_seal,
+                    s.project_id AS s_project, s.environment_id AS s_environment, s.current_version_id AS s_version, NULL::uuid AS s_source, NULL::uuid AS s_reference, s.seal AS s_seal,
+                    NULL::uuid AS x_project, NULL::uuid AS x_environment, NULL::uuid AS x_version, NULL::uuid AS x_source, NULL::uuid AS x_reference, NULL::bytea AS x_seal,
+                    sv.envelope_version, sv.ciphertext, sv.iv, sv.auth_tag, sv.wrapped_dek, sv.kek_provider, sv.kek_id, sv.kek_version, sv.sensitive, sv.plaintext IS NOT NULL AS v_plain, sv.plaintext AS v_plaintext,
+                    NULL::uuid AS e1_id, NULL::uuid AS e1_project, NULL::text AS e1_slug, NULL::text AS e1_owner, NULL::uuid AS e1_parent, NULL::boolean AS e1_protected, NULL::boolean AS e1_archived, NULL::boolean AS e1_project_archived, NULL::bytea AS e1_seal,
+                    s.environment_id AS e2_id, e2.project_id AS e2_project, e2.slug AS e2_slug, e2.owner AS e2_owner, e2.parent_id AS e2_parent, e2.protected AS e2_protected, e2.archived_at IS NOT NULL AS e2_archived, (SELECT q.archived_at IS NOT NULL FROM public.projects q WHERE q.id = e2.project_id) AS e2_project_archived, e2.seal AS e2_seal,
+                    NULL::uuid AS e3_id, NULL::uuid AS e3_project, NULL::text AS e3_slug, NULL::text AS e3_owner, NULL::uuid AS e3_parent, NULL::boolean AS e3_protected, NULL::boolean AS e3_archived, NULL::boolean AS e3_project_archived, NULL::bytea AS e3_seal,
+                    CASE WHEN e2.owner IS NOT NULL THEN e2.parent_id END AS e4_id, e4.project_id AS e4_project, e4.slug AS e4_slug, e4.owner AS e4_owner, e4.parent_id AS e4_parent, e4.protected AS e4_protected, e4.archived_at IS NOT NULL AS e4_archived, (SELECT q.archived_at IS NOT NULL FROM public.projects q WHERE q.id = e4.project_id) AS e4_project_archived, e4.seal AS e4_seal,
+                    b.last AS bulk_last
+                  FROM (SELECT 1) one
+                  LEFT JOIN LATERAL (SELECT x.number, x.mac FROM public.log_changes x ORDER BY x.number DESC LIMIT 1) n ON true
+                  LEFT JOIN public.log_fence f ON f.only_row
+                  -- The roles and the policy, both rows in one read of their one-page table.
+                  LEFT JOIN LATERAL (
+                      SELECT max(g.value) FILTER (WHERE g.name = 'roles') AS r_value, (array_agg(g.seal) FILTER (WHERE g.name = 'roles'))[1] AS r_seal,
+                             max(g.value) FILTER (WHERE g.name = 'policy') AS p_value, (array_agg(g.seal) FILTER (WHERE g.name = 'policy'))[1] AS p_seal
+                        FROM public.log_config g
+                  ) cfg ON true
+                  LEFT JOIN public.credentials c ON c.id = p_credential
+                  LEFT JOIN public.vault_members m ON m.principal = c.principal
+                  -- An archived key is gone (`secret.delete`): no object.
+                  LEFT JOIN public.secrets s ON s.id = p_secret AND s.archived_at IS NULL
+                  -- The key's own version, its own environment, and that environment's parent when it is a personal config.
+                  LEFT JOIN public.secret_versions sv ON sv.id = s.current_version_id
+                  LEFT JOIN public.environments e2 ON e2.id = s.environment_id
+                  LEFT JOIN public.environments e4 ON e4.id = e2.parent_id AND e2.owner IS NOT NULL
+                  LEFT JOIN public.log_bulk b ON b.principal = c.principal AND b.secret = p_secret
+                 WHERE NOT dry
+            ),
+            v AS MATERIALIZED (
+                SELECT i.*, c_refresh AS refresh, c_period AS period,
+                    CASE WHEN NOT i.cached THEN 'reprobe'
+                         WHEN i.s_project IS NOT NULL AND i.s_version IS NULL THEN 'whole'
+                         WHEN i.at_floor IS NULL OR p_at < i.at_floor OR (extract(epoch FROM clock_timestamp()) * 1000)::bigint > p_deadline THEN 'late'
+                         WHEN p_at > (extract(epoch FROM clock_timestamp()) * 1000)::bigint + 60000 THEN 'ahead'
+                         WHEN i.p IS NOT NULL AND NOT locked AND NOT coalesce(i.bulk_last > p_at - p_cap_window - c_refresh, false) THEN 'lock'
+                         WHEN i.p IS NOT NULL AND NOT locked AND NOT moving AND i.bulk_last < c_period THEN 'share' END AS state,
+                    coalesce(i.bulk_last > p_at - p_cap_window - c_refresh, false) AS is_in,
+                    -- The other keys in the set, up to the cap: read only under the principal's lock, for a key not in it.
+                    CASE WHEN locked AND i.p IS NOT NULL AND NOT coalesce(i.bulk_last > p_at - p_cap_window - c_refresh, false) THEN (
+                        SELECT count(*)::integer FROM (
+                            SELECT 1 FROM public.log_bulk o
+                             WHERE o.principal = i.p AND o.secret <> p_secret AND o.last > p_at - p_cap_window - c_refresh - public.deadline_max() - 60000
+                             LIMIT p_cap_count
+                        ) z
+                    ) ELSE 0 END AS n_others,
+                    -- A repeat rides its cover only while every part of this holds: never on a key whose bulk row is missing (CoverFresh).
+                    coalesce(p_cover IS NOT NULL AND i.bulk_last >= c_period
+                        AND EXISTS (SELECT 1 FROM public.log_uses u WHERE u.at = p_cover_at AND u.request_id = p_cover_request AND u.number = p_cover
+                            AND u.credential = p_credential AND u.secret = p_secret AND u.purpose = p_purpose AND u.place IS NOT DISTINCT FROM p_place), false) AS is_covered
+                  FROM i
+            ),
+            w AS (
+                INSERT INTO public.log_uses (number, at, request_id, credential, secret, purpose, mac, place)
+                SELECT nextval('public.log_number'), p_at, p_request, p_credential, p_secret, p_purpose, p_mac, p_place
+                  -- The isolate held its cover to the cached seals' numbers when it read them.
+                  FROM v WHERE v.state IS NULL AND NOT v.is_covered
+                RETURNING log_uses.number
+            )
+            SELECT v.state, (SELECT w.number FROM w), CASE WHEN v.state IS NULL AND v.is_covered THEN p_cover END, v.newest, v.newest_mac, NULL::bigint, false,
+                v.p, v.c_kind, v.c_scope, v.c_revoked, v.c_expires, v.c_seal, NULL::bytea,
+                v.m_status, v.m_owner, v.m_role, v.m_scope, v.m_seal, NULL::bytea, NULL::bigint,
+                (SELECT a.seq FROM public.audit_log a WHERE a.author = 'vault' AND a.subject_principal = v.p AND a.decision = 'allow'
+                    AND a.action IN ('member.add', 'member.restore', 'member.owner', 'member.role', 'member.remove', 'access.grant', 'access.revoke') ORDER BY a.seq DESC LIMIT 1),
+                gr.g_project, gr.g_environment, gr.g_slug, gr.g_role, gr.g_expires,
+                v.r_value, v.r_seal, NULL::bytea,
+                v.p_value, v.p_seal, NULL::bytea, p_cap_count, p_cap_window,
+                v.s_project, v.s_environment, v.s_version, v.s_source, v.s_seal, NULL::bytea,
+                v.x_project, v.x_environment, v.x_version, v.x_source, v.x_seal, NULL::bytea,
+                v.envelope_version, v.ciphertext, v.iv, v.auth_tag, v.wrapped_dek, v.kek_provider, v.kek_id, v.kek_version, v.sensitive, v.v_plain,
+                v.e1_id, v.e1_project, v.e1_slug, v.e1_owner, v.e1_parent, v.e1_protected, v.e1_archived, v.e1_seal, NULL::bytea,
+                v.e2_id, v.e2_project, v.e2_slug, v.e2_owner, v.e2_parent, v.e2_protected, v.e2_archived, v.e2_seal, NULL::bytea,
+                v.e3_id, v.e3_project, v.e3_slug, v.e3_owner, v.e3_parent, v.e3_protected, v.e3_archived, v.e3_seal, NULL::bytea,
+                v.e4_id, v.e4_project, v.e4_slug, v.e4_owner, v.e4_parent, v.e4_protected, v.e4_archived, v.e4_seal, NULL::bytea,
+                v.is_in, v.n_others, v.v_plaintext, v.e1_project_archived, v.e2_project_archived, v.e3_project_archived, v.e4_project_archived, v.s_reference, v.x_reference
+              INTO r
+              FROM v
+              -- The principal's grants as five lists, one entry per grant, lapsed ones included; an environment's grant with its project, which its row finds through `environments`.
+              LEFT JOIN LATERAL (
+                  SELECT array_agg(coalesce(g.project_id, ge.project_id)) AS g_project, array_agg(g.environment_id) AS g_environment,
+                         array_agg(g.environment_slug) AS g_slug, array_agg(g.role) AS g_role, array_agg(g.expires_at) AS g_expires
+                    FROM public.vault_grants g LEFT JOIN public.environments ge ON ge.id = g.environment_id
+                   WHERE g.principal = v.p
+              ) gr ON v.m_status IS NOT NULL;
+        ELSE
+            WITH i AS MATERIALIZED (
+                SELECT n.number AS newest, n.mac AS newest_mac, coalesce(n.number = p_known AND n.mac = p_known_mac, false) AS cached,
+                    f.at_floor,
+                    c.principal AS p, c.kind AS c_kind, c.scope AS c_scope, c.revoked_at IS NOT NULL AS c_revoked,
+                    floor(extract(epoch FROM least(c.expires_at, c.not_after)) * 1000)::bigint AS c_expires, c.seal AS c_seal,
+                    m.status AS m_status, m.owner AS m_owner, m.role AS m_role, m.scope AS m_scope, m.seal AS m_seal,
+                    cfg.r_value, cfg.r_seal, cfg.p_value, cfg.p_seal,
+                    s.project_id AS s_project, s.environment_id AS s_environment, s.current_version_id AS s_version, ref.source_secret_id AS s_source, ref.reference_id AS s_reference, s.seal AS s_seal,
+                    src.project_id AS x_project, src.environment_id AS x_environment, src.current_version_id AS x_version, xref.source_secret_id AS x_source, xref.reference_id AS x_reference, src.seal AS x_seal,
+                    sv.envelope_version, sv.ciphertext, sv.iv, sv.auth_tag, sv.wrapped_dek, sv.kek_provider, sv.kek_id, sv.kek_version, sv.sensitive, sv.plaintext IS NOT NULL AS v_plain, sv.plaintext AS v_plaintext,
+                    ids.e1 AS e1_id, e1.project_id AS e1_project, e1.slug AS e1_slug, e1.owner AS e1_owner, e1.parent_id AS e1_parent, e1.protected AS e1_protected, e1.archived_at IS NOT NULL AS e1_archived, (SELECT q.archived_at IS NOT NULL FROM public.projects q WHERE q.id = e1.project_id) AS e1_project_archived, e1.seal AS e1_seal,
+                    s.environment_id AS e2_id, e2.project_id AS e2_project, e2.slug AS e2_slug, e2.owner AS e2_owner, e2.parent_id AS e2_parent, e2.protected AS e2_protected, e2.archived_at IS NOT NULL AS e2_archived, (SELECT q.archived_at IS NOT NULL FROM public.projects q WHERE q.id = e2.project_id) AS e2_project_archived, e2.seal AS e2_seal,
+                    ids.e3 AS e3_id, e3.project_id AS e3_project, e3.slug AS e3_slug, e3.owner AS e3_owner, e3.parent_id AS e3_parent, e3.protected AS e3_protected, e3.archived_at IS NOT NULL AS e3_archived, (SELECT q.archived_at IS NOT NULL FROM public.projects q WHERE q.id = e3.project_id) AS e3_project_archived, e3.seal AS e3_seal,
+                    CASE WHEN ve.owner IS NOT NULL THEN ve.parent END AS e4_id, e4.project_id AS e4_project, e4.slug AS e4_slug, e4.owner AS e4_owner, e4.parent_id AS e4_parent, e4.protected AS e4_protected, e4.archived_at IS NOT NULL AS e4_archived, (SELECT q.archived_at IS NOT NULL FROM public.projects q WHERE q.id = e4.project_id) AS e4_project_archived, e4.seal AS e4_seal,
+                    b.last AS bulk_last
+                  FROM (SELECT 1) one
+                  LEFT JOIN LATERAL (SELECT x.number, x.mac FROM public.log_changes x ORDER BY x.number DESC LIMIT 1) n ON true
+                  LEFT JOIN public.log_fence f ON f.only_row
+                  -- The roles and the policy, both rows in one read of their one-page table.
+                  LEFT JOIN LATERAL (
+                      SELECT max(g.value) FILTER (WHERE g.name = 'roles') AS r_value, (array_agg(g.seal) FILTER (WHERE g.name = 'roles'))[1] AS r_seal,
+                             max(g.value) FILTER (WHERE g.name = 'policy') AS p_value, (array_agg(g.seal) FILTER (WHERE g.name = 'policy'))[1] AS p_seal
+                        FROM public.log_config g
+                  ) cfg ON true
+                  LEFT JOIN public.credentials c ON c.id = p_credential
+                  LEFT JOIN public.vault_members m ON m.principal = c.principal
+                  -- An archived key is gone (`secret.delete`): no object.
+                  LEFT JOIN public.secrets s ON s.id = p_secret AND s.archived_at IS NULL
+                  -- A key with no version of its own is a reference while its newest reference row names a source and has not ended (`ended_at`): an ended one's holder reads as no value, no source (`ended`).
+                  LEFT JOIN LATERAL (
+                      SELECT CASE WHEN y.ended_at IS NULL THEN y.source_secret_id END AS source_secret_id, CASE WHEN y.ended_at IS NULL THEN y.id END AS reference_id FROM public.secret_references y WHERE y.secret_id = s.id ORDER BY y.created_seq DESC LIMIT 1
+                  ) ref ON s.current_version_id IS NULL
+                  LEFT JOIN public.secrets src ON src.id = ref.source_secret_id AND src.archived_at IS NULL
+                  LEFT JOIN LATERAL (
+                      SELECT CASE WHEN y.ended_at IS NULL THEN y.source_secret_id END AS source_secret_id, CASE WHEN y.ended_at IS NULL THEN y.id END AS reference_id FROM public.secret_references y WHERE y.secret_id = src.id ORDER BY y.created_seq DESC LIMIT 1
+                  ) xref ON src.current_version_id IS NULL
+                  -- The value's version: the key's own, or its source's.
+                  LEFT JOIN public.secret_versions sv ON sv.id = CASE WHEN ref.source_secret_id IS NULL THEN s.current_version_id ELSE src.current_version_id END
+                  -- The environments `useEnvironments` names, each by the id the rows name, whether or not its row is there: e1 the
+                  -- place read through, e2 the key's own, e3 its value's (a reference's source's) where that is another, and e4
+                  -- the parent of its value's when that is a personal config.
+                  LEFT JOIN LATERAL (
+                      SELECT CASE WHEN p_place IS DISTINCT FROM s.environment_id THEN p_place END AS e1,
+                             CASE WHEN src.environment_id IS DISTINCT FROM s.environment_id THEN src.environment_id END AS e3
+                  ) ids ON true
+                  LEFT JOIN public.environments e1 ON e1.id = ids.e1
+                  LEFT JOIN public.environments e2 ON e2.id = s.environment_id
+                  LEFT JOIN public.environments e3 ON e3.id = ids.e3
+                  -- The value's environment's row: the key's own, unless it is a reference, whose source is elsewhere or gone.
+                  LEFT JOIN LATERAL (
+                      SELECT CASE WHEN ref.source_secret_id IS NULL OR (src.id IS NOT NULL AND ids.e3 IS NULL) THEN e2.owner ELSE e3.owner END AS owner,
+                             CASE WHEN ref.source_secret_id IS NULL OR (src.id IS NOT NULL AND ids.e3 IS NULL) THEN e2.parent_id ELSE e3.parent_id END AS parent
+                  ) ve ON true
+                  LEFT JOIN public.environments e4 ON e4.id = ve.parent AND ve.owner IS NOT NULL
+                  LEFT JOIN public.log_bulk b ON b.principal = c.principal AND b.secret = p_secret
+                 WHERE NOT dry
+            ),
+            v AS MATERIALIZED (
+                SELECT i.*, c_refresh AS refresh, c_period AS period,
+                    CASE WHEN NOT i.cached THEN 'reprobe'
+                         WHEN i.at_floor IS NULL OR p_at < i.at_floor OR (extract(epoch FROM clock_timestamp()) * 1000)::bigint > p_deadline THEN 'late'
+                         WHEN p_at > (extract(epoch FROM clock_timestamp()) * 1000)::bigint + 60000 THEN 'ahead'
+                         WHEN i.p IS NOT NULL AND NOT locked AND NOT coalesce(i.bulk_last > p_at - p_cap_window - c_refresh, false) THEN 'lock'
+                         WHEN i.p IS NOT NULL AND NOT locked AND NOT moving AND i.bulk_last < c_period THEN 'share' END AS state,
+                    coalesce(i.bulk_last > p_at - p_cap_window - c_refresh, false) AS is_in,
+                    -- The other keys in the set, up to the cap: read only under the principal's lock, for a key not in it.
+                    CASE WHEN locked AND i.p IS NOT NULL AND NOT coalesce(i.bulk_last > p_at - p_cap_window - c_refresh, false) THEN (
+                        SELECT count(*)::integer FROM (
+                            SELECT 1 FROM public.log_bulk o
+                             WHERE o.principal = i.p AND o.secret <> p_secret AND o.last > p_at - p_cap_window - c_refresh - public.deadline_max() - 60000
+                             LIMIT p_cap_count
+                        ) z
+                    ) ELSE 0 END AS n_others,
+                    -- A repeat rides its cover only while every part of this holds: never on a key whose bulk row is missing (CoverFresh).
+                    coalesce(p_cover IS NOT NULL AND i.bulk_last >= c_period
+                        AND EXISTS (SELECT 1 FROM public.log_uses u WHERE u.at = p_cover_at AND u.request_id = p_cover_request AND u.number = p_cover
+                            AND u.credential = p_credential AND u.secret = p_secret AND u.purpose = p_purpose AND u.place IS NOT DISTINCT FROM p_place), false) AS is_covered
+                  FROM i
+            ),
+            w AS (
+                INSERT INTO public.log_uses (number, at, request_id, credential, secret, purpose, mac, place)
+                SELECT nextval('public.log_number'), p_at, p_request, p_credential, p_secret, p_purpose, p_mac, p_place
+                  -- The isolate held its cover to the cached seals' numbers when it read them.
+                  FROM v WHERE v.state IS NULL AND NOT v.is_covered
+                RETURNING log_uses.number
+            )
+            SELECT v.state, (SELECT w.number FROM w), CASE WHEN v.state IS NULL AND v.is_covered THEN p_cover END, v.newest, v.newest_mac, NULL::bigint, false,
+                v.p, v.c_kind, v.c_scope, v.c_revoked, v.c_expires, v.c_seal, NULL::bytea,
+                v.m_status, v.m_owner, v.m_role, v.m_scope, v.m_seal, NULL::bytea, NULL::bigint,
+                (SELECT a.seq FROM public.audit_log a WHERE a.author = 'vault' AND a.subject_principal = v.p AND a.decision = 'allow'
+                    AND a.action IN ('member.add', 'member.restore', 'member.owner', 'member.role', 'member.remove', 'access.grant', 'access.revoke') ORDER BY a.seq DESC LIMIT 1),
+                gr.g_project, gr.g_environment, gr.g_slug, gr.g_role, gr.g_expires,
+                v.r_value, v.r_seal, NULL::bytea,
+                v.p_value, v.p_seal, NULL::bytea, p_cap_count, p_cap_window,
+                v.s_project, v.s_environment, v.s_version, v.s_source, v.s_seal, NULL::bytea,
+                v.x_project, v.x_environment, v.x_version, v.x_source, v.x_seal, NULL::bytea,
+                v.envelope_version, v.ciphertext, v.iv, v.auth_tag, v.wrapped_dek, v.kek_provider, v.kek_id, v.kek_version, v.sensitive, v.v_plain,
+                v.e1_id, v.e1_project, v.e1_slug, v.e1_owner, v.e1_parent, v.e1_protected, v.e1_archived, v.e1_seal, NULL::bytea,
+                v.e2_id, v.e2_project, v.e2_slug, v.e2_owner, v.e2_parent, v.e2_protected, v.e2_archived, v.e2_seal, NULL::bytea,
+                v.e3_id, v.e3_project, v.e3_slug, v.e3_owner, v.e3_parent, v.e3_protected, v.e3_archived, v.e3_seal, NULL::bytea,
+                v.e4_id, v.e4_project, v.e4_slug, v.e4_owner, v.e4_parent, v.e4_protected, v.e4_archived, v.e4_seal, NULL::bytea,
+                v.is_in, v.n_others, v.v_plaintext, v.e1_project_archived, v.e2_project_archived, v.e3_project_archived, v.e4_project_archived, v.s_reference, v.x_reference
+              INTO r
+              FROM v
+              -- The principal's grants as five lists, one entry per grant, lapsed ones included; an environment's grant with its project, which its row finds through `environments`.
+              LEFT JOIN LATERAL (
+                  SELECT array_agg(coalesce(g.project_id, ge.project_id)) AS g_project, array_agg(g.environment_id) AS g_environment,
+                         array_agg(g.environment_slug) AS g_slug, array_agg(g.role) AS g_role, array_agg(g.expires_at) AS g_expires
+                    FROM public.vault_grants g LEFT JOIN public.environments ge ON ge.id = g.environment_id
+                   WHERE g.principal = v.p
+              ) gr ON v.m_status IS NOT NULL;
+        END IF;
+        IF dry THEN
+            -- The forms in turn: probing plain, probing whole, cached plain, cached whole; then the call itself, under the fence.
+            form := form + 1;
+            IF form < 4 THEN
+                probe := form < 2;
+                whole := form % 2 = 1;
+                CONTINUE;
+            END IF;
+            PERFORM set_config('coffre.use_planned', '0029', false);
+            dry := false;
+            probe := first_probe;
+            whole := first_whole;
+            PERFORM pg_advisory_xact_lock_shared(1668244070, 0);
+            CONTINUE;
+        END IF;
+        -- A use the statement took writes its entry or rides its cover, never neither.
+        IF r.state IS NULL AND r.number IS NULL AND r.covered IS NULL THEN
+            RAISE EXCEPTION 'a use wrote no entry and rode no cover' USING ERRCODE = 'XX000';
+        END IF;
+        IF r.state = 'reprobe' THEN probe := true; CONTINUE; END IF;
+        IF r.state = 'whole' THEN whole := true; CONTINUE; END IF;
+        EXIT WHEN r.state IS DISTINCT FROM 'lock' AND r.state IS DISTINCT FROM 'share';
+        -- Its key's bulk row is missing or out of the set: this use may enter it, so it takes its principal's lock exclusive
+        -- and reads again. Or the row is in the set, from an earlier period: this use may move it on, so it takes the lock
+        -- shared, beside the principal's other uses that move a key on, and reads again.
+        -- Holding it shared, a key never leaves the set (SharedStaysInSet) unless a row was put back under it: then the
+        -- call ends, refused as late, rather than ask for the lock exclusive while it holds it shared (two such would
+        -- deadlock).
+        IF r.state = 'lock' AND moving THEN
+            RAISE EXCEPTION 'its key left the cap''s set under the principal''s lock: a row put back' USING ERRCODE = '57014';
+        END IF;
+        IF r.state = 'lock' THEN
+            PERFORM pg_advisory_xact_lock(1668244066, hashtext(r.c_principal));
+            locked := true;
+        ELSE
+            PERFORM pg_advisory_xact_lock_shared(1668244066, hashtext(r.c_principal));
+            moving := true;
+        END IF;
+    END LOOP;
+    -- The cap's row, written only by a call that took the principal's lock, in a statement of its own after the one that
+    -- read, in the same transaction, under the same locks: the uses that read their key fresh, nearly all, run no write.
+    -- A key in the set moves on to this use's period, only ever up. A key entering the set, under the lock exclusive, is
+    -- made or moved on from a window past. Every request counts, whatever the Worker then decides but the cap (HotPathOneStaleBulk).
+    IF r.state IS NULL AND (locked OR moving) THEN
+        b_refresh := greatest(1, least(60000, r.cap_window / 10));
+        b_period := p_at - ((p_at % b_refresh) + b_refresh) % b_refresh;
+        IF r.in_set THEN
+            -- One use moves the key to this period: the one that takes a lock of the key and period's own without waiting.
+            -- The others take it shared, which waits only for that one's end, never for each other, and read the row again,
+            -- locking none: moved, they leave it. An UPDATE that waits on a row another is moving, then finds it moved,
+            -- keeps the row locked to its own commit, and queues the next. If the one moving it rolled back, the others
+            -- elect another the same way, on the lock's next round.
+            LOOP
+                b_lock := hashtextextended(r.c_principal || '/' || p_secret::text || '/' || b_period::text || '/' || b_round::text, 1668244066);
+                IF pg_try_advisory_xact_lock(b_lock) THEN
+                    UPDATE public.log_bulk SET last = b_period WHERE principal = r.c_principal AND secret = p_secret AND last < b_period;
+                    EXIT;
+                END IF;
+                PERFORM pg_advisory_xact_lock_shared(b_lock);
+                EXIT WHEN NOT EXISTS (SELECT 1 FROM public.log_bulk WHERE principal = r.c_principal AND secret = p_secret AND last < b_period);
+                b_round := b_round + 1;
+            END LOOP;
+        ELSIF r.others < r.cap_count THEN
+            INSERT INTO public.log_bulk (principal, secret, last) VALUES (r.c_principal, p_secret, b_period)
+                ON CONFLICT ON CONSTRAINT log_bulk_pkey DO UPDATE SET last = greatest(log_bulk.last, EXCLUDED.last);
+        END IF;
+    END IF;
+    -- The deadline holds in Postgres to the end: a call that ran past it rolls back and writes nothing. The hot login's lock_timeout and statement_timeout bound the waits.
+    IF r.state IS NULL AND (extract(epoch FROM clock_timestamp()) * 1000)::bigint > p_deadline THEN
+        RAISE EXCEPTION 'past its deadline' USING ERRCODE = '57014';
+    END IF;
+    RETURN to_json(r);
+END
+$$;
+--> statement-breakpoint
+-- `change_input` as 0025 made it, but for a key's change, the end of its reference, and an environment's project's archival, held to the project's row; and no JIT (see use_credential's).
+CREATE OR REPLACE FUNCTION change_input(
+    p_kind text, p_id text, p_request text, p_at bigint, p_actor text, p_payload text, p_value text, p_seal_from bytea, p_seal bytea, p_mac bytea
+) RETURNS bigint
+    LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog, pg_temp SET jit = off AS $$
+DECLARE
+    op jsonb := p_payload::jsonb;
+    v jsonb := p_value::jsonb;
+    change text := op ->> 'op';
+    target uuid := public.log_object(p_kind, p_id);
+    n bigint;
+    done integer;
+    member text;
+    held bytea;
+    newest bytea;
+    config jsonb;
+BEGIN
+    -- Its locks in the order 0.14's writers take theirs, so that none waits on the other in a circle until 0.16 (row,
+    -- head, fence: Migration015.tla's RowFirst, ChangeHeadFirst): the member's queue (MEMBER_QUEUE, 0x636f666d) and row
+    -- first, a principal's own or a credential's (0.14's vault locks them before the head, lockMembers; a change made
+    -- inside a 0.14 decision holds them already), then 0.14's head (its app takes it before its rows), then the fence
+    -- (0.14's appends take it after the head, audit_log_fence). The head held, no 0.14 write lands between this change
+    -- and its entry.
+    member := CASE p_kind
+        WHEN 'principal' THEN p_id
+        WHEN 'credential' THEN coalesce(
+            (SELECT c.principal FROM public.credentials c WHERE c.id = p_id::uuid),
+            (SELECT b.principal FROM public.service_bindings b WHERE b.id = p_id::uuid))
+    END;
+    IF member IS NOT NULL THEN
+        PERFORM pg_advisory_xact_lock(1668245101, hashtext(m.principal)) FROM public.vault_members m WHERE m.principal = member FOR NO KEY UPDATE;
+    END IF;
+    PERFORM 1 FROM public.audit_chain_head WHERE only_row FOR UPDATE;
+    -- ChangeLocks: exclusive, so that it waits for every use in flight, and every use after it waits for its commit.
+    PERFORM pg_advisory_xact_lock(1668244070, 0);
+    SELECT c.number INTO n FROM public.log_changes c WHERE c.request_id = p_request;
+    IF FOUND THEN
+        IF NOT EXISTS (
+            SELECT 1 FROM public.log_changes c
+             WHERE c.request_id = p_request AND c.object = target AND c.payload = p_payload AND c.seal IS NOT DISTINCT FROM p_seal
+        ) THEN
+            RAISE EXCEPTION 'request % names another change', p_request USING ERRCODE = 'unique_violation';
+        END IF;
+        RETURN n;
+    END IF;
+    IF NOT (change = 'genesis'
+        OR (p_kind = 'principal' AND change IN ('member.add', 'member.role', 'member.remove', 'member.restore', 'access.grant', 'access.revoke'))
+        OR (p_kind = 'environment' AND change IN ('environment.protect', 'environment.rename', 'environment.archive'))
+        OR (p_kind = 'secret' AND change = 'secret.write')
+        OR (p_kind = 'roles' AND change = 'role.define')
+        OR (p_kind = 'policy' AND change = 'bulk.limit')) THEN
+        RAISE EXCEPTION 'this schema knows no change % to a %', coalesce(change, 'without an op'), p_kind USING ERRCODE = 'invalid_parameter_value';
+    END IF;
+    -- The payload names its object (`ref`), so that a replay knows what each change is to: the column holds only its
+    -- key. The cutover's genesis may leave it out, its value naming it.
+    IF (change <> 'genesis' OR op ? 'ref') AND (op -> 'ref' ->> 'kind' IS DISTINCT FROM p_kind OR op -> 'ref' ->> 'id' IS DISTINCT FROM p_id) THEN
+        RAISE EXCEPTION 'a change names the object it is to: %, %', p_kind, p_id USING ERRCODE = 'invalid_parameter_value';
+    END IF;
+    -- A value is the object as this function writes it: an environment's, which a genesis may leave out to seal the
+    -- row as it is; a key's, the end of its reference (`secret.write`, the one change of a key the vault makes), and
+    -- none at its genesis; the roles' and the policy's, but at their genesis, whose payload holds it. The others' rows
+    -- are written by whoever keeps them, and carry none.
+    IF (CASE
+        WHEN p_kind = 'environment' THEN change <> 'genesis' AND v IS NULL
+        WHEN p_kind = 'secret' THEN (change = 'secret.write') = (v IS NULL)
+        WHEN p_kind IN ('roles', 'policy') THEN (change = 'genesis') = (v IS NOT NULL)
+        ELSE v IS NOT NULL
+    END) THEN
+        RAISE EXCEPTION 'a % change % carries the object it leaves exactly when this function writes it', p_kind, change USING ERRCODE = 'invalid_parameter_value';
+    END IF;
+    -- ChangeChecksSeal: the row's seal is its object's newest change's, or the object has neither yet (one probe, as
+    -- a use makes). A row deleted outright, or a seal no change wrote, is stale too.
+    held := CASE p_kind
+        WHEN 'principal' THEN (SELECT m.seal FROM public.vault_members m WHERE m.principal = p_id)
+        WHEN 'credential' THEN coalesce(
+            (SELECT c.seal FROM public.credentials c WHERE c.id = p_id::uuid),
+            (SELECT b.seal FROM public.service_bindings b WHERE b.id = p_id::uuid))
+        WHEN 'environment' THEN (SELECT e.seal FROM public.environments e WHERE e.id = p_id::uuid)
+        WHEN 'secret' THEN (SELECT x.seal FROM public.secrets x WHERE x.id = p_id::uuid)
+        WHEN 'policy' THEN (SELECT g.seal FROM public.log_config g WHERE g.name = 'policy')
+        WHEN 'roles' THEN (SELECT g.seal FROM public.log_config g WHERE g.name = 'roles')
+    END;
+    newest := (SELECT c.seal FROM public.log_changes c WHERE c.object = target ORDER BY c.number DESC LIMIT 1);
+    IF held IS DISTINCT FROM newest THEN
+        RAISE EXCEPTION 'the % object''s row is not its newest change''s: stale', p_kind USING ERRCODE = 'data_corrupted';
+    END IF;
+    -- ChangeCAS: each write moves the row only from the seal the vault read.
+    CASE p_kind
+        WHEN 'principal' THEN
+            UPDATE public.vault_members SET seal = p_seal WHERE principal = p_id AND seal IS NOT DISTINCT FROM p_seal_from;
+        WHEN 'credential' THEN
+            -- A token's row, or a trust binding's: one kind of object, ids that never meet.
+            UPDATE public.credentials SET seal = p_seal WHERE id = p_id::uuid AND seal IS NOT DISTINCT FROM p_seal_from;
+            GET DIAGNOSTICS done = ROW_COUNT;
+            IF done = 0 THEN
+                UPDATE public.service_bindings SET seal = p_seal WHERE id = p_id::uuid AND seal IS NOT DISTINCT FROM p_seal_from;
+            END IF;
+        WHEN 'environment' THEN
+            IF v IS NULL THEN
+                UPDATE public.environments SET seal = p_seal WHERE id = p_id::uuid AND seal IS NOT DISTINCT FROM p_seal_from;
+            ELSE
+                -- A deleted environment's row keeps its tombstone, `dev~deleted-…` (@coffre/core/schemas's isTombstone),
+                -- and its object the slug before it (objects.ts, environmentObject): an environment deleted stays so,
+                -- its slug is never written again, and none is deleted here; an object's slug holds no tombstone.
+                UPDATE public.environments e
+                   SET slug = CASE WHEN strpos(e.slug, '~') > 0 THEN e.slug ELSE v ->> 'slug' END,
+                       protected = (v ->> 'protected')::boolean,
+                       archived_at = CASE WHEN (v ->> 'archived')::boolean THEN coalesce(e.archived_at, to_timestamp(p_at / 1000.0)) END,
+                       seal = p_seal
+                 WHERE e.id = p_id::uuid AND e.seal IS NOT DISTINCT FROM p_seal_from
+                   AND v ->> 'kind' = 'environment' AND v ->> 'id' = p_id
+                   AND e.project_id = (v ->> 'projectId')::uuid
+                   AND e.parent_id IS NOT DISTINCT FROM (v ->> 'parentId')::uuid
+                   AND e.owner IS NOT DISTINCT FROM v ->> 'owner'
+                   AND (strpos(e.slug, '~') > 0) = (v ->> 'deleted')::boolean
+                   -- Its project's archival is the project's row's, which the app writes, and none once deleted (objects.ts): held,
+                   -- never written here.
+                   AND (v ->> 'projectArchived')::boolean = (strpos(e.slug, '~') = 0 AND EXISTS (SELECT 1 FROM public.projects p WHERE p.id = e.project_id AND p.archived_at IS NOT NULL))
+                   AND strpos(v ->> 'slug', '~') = 0
+                   AND (NOT (v ->> 'deleted')::boolean OR split_part(e.slug, '~', 1) = v ->> 'slug');
+            END IF;
+        WHEN 'secret' THEN
+            IF v IS NULL THEN
+                UPDATE public.secrets SET seal = p_seal WHERE id = p_id::uuid AND seal IS NOT DISTINCT FROM p_seal_from;
+            ELSE
+                -- A reference's end, in the vault's decision that appends 0.14's `reference.end` (EndInRow, EndWithEntry:
+                -- formal/SealedObjects.tla): the holder, a live key with no version of its own, left with no source, and
+                -- its newest reference row ended. That row must stand: its seal, which the check above held to the
+                -- newest change, says the holder reads its source; a row ended or gone under it is not the log's.
+                UPDATE public.secrets x SET seal = p_seal
+                 WHERE x.id = p_id::uuid AND x.seal IS NOT DISTINCT FROM p_seal_from AND x.archived_at IS NULL AND x.current_version_id IS NULL
+                   AND v ->> 'kind' = 'secret' AND v ->> 'id' = p_id AND x.project_id = (v ->> 'projectId')::uuid AND x.environment_id = (v ->> 'environmentId')::uuid
+                   AND v ->> 'version' = '' AND v ->> 'nature' = 'secret' AND v -> 'key' = 'null'::jsonb AND v -> 'digest' = 'null'::jsonb AND v -> 'source' = 'null'::jsonb
+                   AND v -> 'reference' = 'null'::jsonb;
+                GET DIAGNOSTICS done = ROW_COUNT;
+                IF done > 0 THEN
+                    UPDATE public.secret_references y SET ended_at = to_timestamp(p_at / 1000.0)
+                     WHERE y.id = (SELECT z.id FROM public.secret_references z WHERE z.secret_id = p_id::uuid ORDER BY z.created_seq DESC LIMIT 1) AND y.ended_at IS NULL;
+                    GET DIAGNOSTICS done = ROW_COUNT;
+                    IF done = 0 THEN
+                        RAISE EXCEPTION 'the secret object''s reference has no standing row: stale' USING ERRCODE = 'data_corrupted';
+                    END IF;
+                END IF;
+            END IF;
+        WHEN 'policy', 'roles' THEN
+            config := CASE change WHEN 'genesis' THEN op -> 'value' ELSE v END;
+            IF p_id <> 'instance' OR config IS NULL OR jsonb_typeof(config) <> 'object' OR (change = 'genesis' AND p_seal_from IS NOT NULL) THEN
+                RAISE EXCEPTION 'the % object is one, made once from its value and changed from its seal', p_kind USING ERRCODE = 'invalid_parameter_value';
+            END IF;
+            -- Made by its first change (genesis, or the first role defined, the first cap set); moved after from its seal.
+            IF p_seal_from IS NULL THEN
+                INSERT INTO public.log_config (name, value, seal) VALUES (p_kind, config::text, p_seal) ON CONFLICT (name) DO NOTHING;
+            ELSE
+                UPDATE public.log_config SET value = config::text, seal = p_seal WHERE log_config.name = p_kind AND seal = p_seal_from;
+            END IF;
+        ELSE
+            RAISE EXCEPTION 'no object kind %', p_kind USING ERRCODE = 'invalid_parameter_value';
+    END CASE;
+    -- A row gone, a row whose seal is no longer the one read, an environment that is not what the value says it
+    -- stays, or an object made already: nothing was done.
+    GET DIAGNOSTICS done = ROW_COUNT;
+    IF done = 0 THEN RETURN NULL; END IF;
+    INSERT INTO public.log_changes (number, at, request_id, object, actor, payload, seal, mac)
+        VALUES (nextval('public.log_number'), p_at, p_request, target, p_actor, p_payload, p_seal, p_mac)
+        RETURNING number INTO n;
+    RETURN n;
+END
+$$;
+--> statement-breakpoint
+-- `app_change` as 0026 made it, but for `project.archive`: a project archived or restored, a change of each of its environments; and no JIT.
+CREATE OR REPLACE FUNCTION app_change(
+    p_kind text, p_id text, p_request text, p_at bigint, p_actor text, p_payload text, p_seal_from bytea, p_seal bytea, p_mac bytea
+) RETURNS bigint
+    LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog, pg_temp SET jit = off AS $$
+DECLARE
+    op jsonb := p_payload::jsonb;
+    change text := op ->> 'op';
+    target uuid := public.log_object(p_kind, p_id);
+    n bigint;
+    done integer;
+    held bytea;
+    -- An issue of a credential this very transaction wrote (its row's xmin is ours: not a savepoint's, nor a row another committed).
+    -- Never null, whatever is missing (a 0.14 row's call carries no payload, so no op): else the fence.
+    fresh boolean := coalesce(change = 'credential.issue' AND p_kind = 'credential'
+        AND EXISTS (SELECT 1 FROM public.credentials c WHERE c.id = p_id::uuid AND c.xmin = pg_current_xact_id()::xid), false);
+BEGIN
+    PERFORM 1 FROM public.audit_chain_head WHERE only_row FOR UPDATE;
+    -- The issue lock shared (IssueOwnLock); and, but for a fresh issue, the fence exclusive after it (IssueBeforeFence).
+    PERFORM pg_advisory_xact_lock_shared(1668244070, 1);
+    IF NOT fresh THEN PERFORM pg_advisory_xact_lock(1668244070, 0); END IF;
+    held := CASE p_kind
+        WHEN 'credential' THEN (SELECT c.seal FROM public.credentials c WHERE c.id = p_id::uuid)
+        WHEN 'secret' THEN (SELECT x.seal FROM public.secrets x WHERE x.id = p_id::uuid)
+        WHEN 'environment' THEN (SELECT e.seal FROM public.environments e WHERE e.id = p_id::uuid)
+    END;
+    IF p_request IS NULL THEN
+        IF held IS NOT NULL OR EXISTS (SELECT 1 FROM public.log_changes c WHERE c.object = target) THEN
+            RAISE EXCEPTION 'the % object''s row is not its newest change''s: stale', p_kind USING ERRCODE = 'data_corrupted';
+        END IF;
+        RETURN 0;
+    END IF;
+    SELECT c.number INTO n FROM public.log_changes c WHERE c.request_id = p_request;
+    IF FOUND THEN
+        IF NOT EXISTS (
+            SELECT 1 FROM public.log_changes c
+             WHERE c.request_id = p_request AND c.object = target AND c.payload = p_payload AND c.seal IS NOT DISTINCT FROM p_seal
+        ) THEN
+            RAISE EXCEPTION 'request % names another change', p_request USING ERRCODE = 'unique_violation';
+        END IF;
+        RETURN n;
+    END IF;
+    IF NOT ((p_kind = 'credential' AND change IN ('credential.issue', 'credential.revoke', 'credential.renew', 'credential.scope'))
+        OR (p_kind = 'secret' AND change IN ('secret.write', 'secret.delete'))
+        OR (p_kind = 'environment' AND change IN ('environment.create', 'environment.rename', 'environment.archive', 'project.archive', 'environment.delete'))) THEN
+        RAISE EXCEPTION 'the app makes no change % to a %', coalesce(change, 'without an op'), p_kind USING ERRCODE = 'invalid_parameter_value';
+    END IF;
+    IF op -> 'ref' ->> 'kind' IS DISTINCT FROM p_kind OR op -> 'ref' ->> 'id' IS DISTINCT FROM p_id THEN
+        RAISE EXCEPTION 'a change names the object it is to: %, %', p_kind, p_id USING ERRCODE = 'invalid_parameter_value';
+    END IF;
+    -- ChangeChecksSeal.
+    IF held IS DISTINCT FROM (SELECT c.seal FROM public.log_changes c WHERE c.object = target ORDER BY c.number DESC LIMIT 1) THEN
+        RAISE EXCEPTION 'the % object''s row is not its newest change''s: stale', p_kind USING ERRCODE = 'data_corrupted';
+    END IF;
+    -- ChangeCAS.
+    CASE p_kind
+        WHEN 'credential' THEN
+            UPDATE public.credentials SET seal = p_seal WHERE id = p_id::uuid AND seal IS NOT DISTINCT FROM p_seal_from;
+        WHEN 'secret' THEN
+            UPDATE public.secrets SET seal = p_seal WHERE id = p_id::uuid AND seal IS NOT DISTINCT FROM p_seal_from;
+        WHEN 'environment' THEN
+            UPDATE public.environments SET seal = p_seal WHERE id = p_id::uuid AND seal IS NOT DISTINCT FROM p_seal_from;
+    END CASE;
+    GET DIAGNOSTICS done = ROW_COUNT;
+    IF done = 0 THEN RETURN NULL; END IF;
+    INSERT INTO public.log_changes (number, at, request_id, object, actor, payload, seal, mac)
+        VALUES (nextval('public.log_number'), p_at, p_request, target, p_actor, p_payload, p_seal, p_mac)
+        RETURNING number INTO n;
+    RETURN n;
+END
+$$;
+--> statement-breakpoint
+-- A reference's end that changes no object (EndInRow): its row's end alone, written in the vault's decision beside 0.14's `reference.end`, for a reference no live holder stands on (its holder archived, holding a value, or standing on a newer reference), and for a standing one whose holder 0.14's log alone holds (no seal, no change: before the cutover), whose change logs nothing. Without it, a holder archived when its reference was broken would read that reference live again once unarchived (an unarchive seals the holder's object from its rows), and the cutover's genesis would seal an unlogged holder's broken reference live. Never a standing reference of a logged holder, whose end is a change of the holder (`change_input`): refused, loudly, so that its decision fails rather than commit 0.14's entry beside a reference 0.15 still serves. The holder's row is locked first, so that no write unarchives or writes it between the check and the end; the vault's decision holds 0.14's head besides. It takes no fence: no use reads a row it writes as an object's.
+CREATE FUNCTION end_reference(p_reference uuid, p_at bigint) RETURNS boolean
+    LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog, pg_temp SET jit = off AS $$
+DECLARE
+    done integer;
+BEGIN
+    IF p_at IS NULL OR p_at < 0 THEN
+        RAISE EXCEPTION 'a reference ends at a time, ms since the epoch' USING ERRCODE = 'invalid_parameter_value';
+    END IF;
+    PERFORM 1 FROM public.secrets x JOIN public.secret_references y ON y.secret_id = x.id WHERE y.id = p_reference FOR SHARE OF x;
+    IF EXISTS (
+        SELECT 1 FROM public.secret_references y JOIN public.secrets x ON x.id = y.secret_id
+         WHERE y.id = p_reference AND y.ended_at IS NULL AND x.archived_at IS NULL AND x.current_version_id IS NULL
+           AND y.id = (SELECT z.id FROM public.secret_references z WHERE z.secret_id = x.id ORDER BY z.created_seq DESC LIMIT 1)
+           AND (x.seal IS NOT NULL OR EXISTS (SELECT 1 FROM public.log_changes c WHERE c.object = public.log_object('secret', x.id::text)))
+    ) THEN
+        RAISE EXCEPTION 'reference % is its holder''s standing one: its end is a change of the holder', p_reference USING ERRCODE = 'invalid_parameter_value';
+    END IF;
+    -- No row (a write that stored none, abandoned) or one ended already: nothing to do.
+    UPDATE public.secret_references SET ended_at = to_timestamp(p_at / 1000.0) WHERE id = p_reference AND ended_at IS NULL;
+    GET DIAGNOSTICS done = ROW_COUNT;
+    RETURN done > 0;
+END
+$$;
+--> statement-breakpoint
+REVOKE ALL ON FUNCTION end_reference(uuid, bigint) FROM PUBLIC;
+--> statement-breakpoint
+GRANT EXECUTE ON FUNCTION end_reference(uuid, bigint) TO coffre_vault;
+--> statement-breakpoint
+-- No JIT for any function that runs as its owner, those of earlier migrations here (this migration's own say it in their definitions, as every new one must): each plans its statements once a session and keeps them, and an estimate that grows with its tables past jit_above_cost would compile them at every call. use.test.ts holds every such function to it.
+ALTER FUNCTION prune_consumed_tokens(integer) SET jit = off;
+--> statement-breakpoint
+ALTER FUNCTION vault_releases_keep() SET jit = off;
+--> statement-breakpoint
+ALTER FUNCTION prune_vault_releases(integer) SET jit = off;
+--> statement-breakpoint
+ALTER FUNCTION make_day(date) SET jit = off;
+--> statement-breakpoint
+ALTER FUNCTION make_tiles(bigint, bigint) SET jit = off;
+--> statement-breakpoint
+ALTER FUNCTION close_one() SET jit = off;
+--> statement-breakpoint
+ALTER FUNCTION write_checkpoint(bigint, bigint, bigint, bigint, bytea, text, bigint, bytea, text, text[], smallint[], bigint[], bytea[]) SET jit = off;
+--> statement-breakpoint
+ALTER FUNCTION prune_bulk(integer) SET jit = off;
+--> statement-breakpoint
+ALTER FUNCTION log_retention(text, bigint, text, bytea) SET jit = off;
+--> statement-breakpoint
+ALTER FUNCTION log_cut() SET jit = off;
+--> statement-breakpoint
+ALTER FUNCTION drop_day(date) SET jit = off;
+--> statement-breakpoint
+ALTER FUNCTION drop_tiles(bigint) SET jit = off;