@coffre/vault 0.10.0 → 0.10.2

package/dist/{vault-COqZ12ny.js → vault-66Xf0Hw1.js}

@@ -1,155 +1,15 @@
-import { ACCESS_ACTIONS, POLICY_REVISION, checkpointMessage, checkpointVerifier, describeAccessFault, handsBack, policyRevision } from "@coffre/core/vault";
+import { ACCESS_ACTIONS, ACCESS_ACTIONS as ACCESS_ACTIONS$1, POLICY_REVISION, checkpointMessage, checkpointVerifier, describeAccessFault, handsBack, policyRevision } from "@coffre/core/vault";
 import { DEK_BYTES, KEY_CHECK, KEY_CHECK_CONTEXT, KEY_CHECK_VALUE, KekBadClaimError, KekCancelledError, KekUnavailableError, LocalKekProvider } from "@coffre/core/kek";
-import { createHmac, hkdfSync, randomUUID, timingSafeEqual } from "node:crypto";
-import { tablesOf } from "@coffre/db";
+import { createHash, createHmac, hkdfSync, randomUUID, timingSafeEqual } from "node:crypto";
+import { prepared, tablesOf } from "@coffre/db";
 import { DEFAULT_POLICY, EVERYWHERE, EVERY_ENVIRONMENT, FIXED_ROLES, INSTANCE_ROLES, NOTHING, PROJECT_ONLY_PERMISSIONS, ROLES, ROLE_ID, UNWRITTEN_FORK_MS, allows, assignableToEnvironment, definitionProblem, givesService, grantKind, isBuiltinRole, isCredentialScope, isInstanceRole, isRole, isScope, managesService, mayManageAccess, normalDefinition, normalScope, ownsInstance, runsInstance, setsUpServices, unscoped, withinCredential } from "@coffre/core/access";
 import { GENESIS_HASH, deriveLogKey, verifyEntries } from "@coffre/core/audit";
 import { checkContext, ownerKey } from "@coffre/core/envelope";
-import { shownMember } from "@coffre/core/schemas";
-import { SNAPSHOT, clockMillis, engineOf, forUpdate, isUniqueViolation, tombstone, truth } from "@coffre/db/dialect";
+import { TOMBSTONE, shownMember } from "@coffre/core/schemas";
+import { SNAPSHOT, clockMillis, engineOf, forUpdate, isUniqueViolation, isUnreachable, rowsOf, tombstone, truth } from "@coffre/db/dialect";
 import { accessEntriesAbout, everyProjectConversion, insertGrant, liveProjects, newestAccess, readGrants, reportStands, roleColumns, storedRole } from "@coffre/db/grants";
-import { LOOK_BACK, appendEntries, entryColumns, lockLogHead, newestAuthentic, newestVaultEntries, newestVaultSeq, withinBytes } from "@coffre/db/log";
-import { and, asc, count, desc, eq, gt, gte, inArray, isNotNull, isNull, lt, lte, or, sql } from "drizzle-orm";
-//#region src/accounting.ts
-const KEY_ACTIONS = /* @__PURE__ */ new Set([
-	"secret.read",
-	"key.wrap",
-	"key.rewrap"
-]);
-/**
-* Every key operation's intent and its outcomes, entry by entry, oldest
-* first, as the full check reads the vault's entries (`add`); then what is
-* still open (`result`). The chain can hold while a process died between an
-* intent and its outcomes: only a missed deadline is a fault.
-*/
-var KeyAccounting = class {
-	#intents = /* @__PURE__ */ new Map();
-	#ids = /* @__PURE__ */ new Set();
-	#fault = null;
-	add(entry) {
-		if (this.#fault !== null || entry.author !== "vault") return;
-		const broken = (reason) => {
-			this.#fault = {
-				ok: false,
-				failedAtSeq: Number(entry.seq),
-				reason
-			};
-		};
-		if (entry.action === "key.intent") {
-			const parsed = parseIntent(entry);
-			if (typeof parsed === "string") return broken(parsed);
-			if (this.#ids.has(parsed.intentId)) return broken("key intent repeats an operation identity");
-			this.#ids.add(parsed.intentId);
-			if (parsed.keys.length > 0) this.#intents.set(entry.seq, {
-				...parsed,
-				entry,
-				seen: /* @__PURE__ */ new Set()
-			});
-		} else if (KEY_ACTIONS.has(entry.action) && entry.relatedSeq !== null) {
-			const parsed = parseOutcome(entry);
-			if (typeof parsed === "string") return broken(parsed);
-			const intent = this.#intents.get(parsed.relatedSeq);
-			for (const outcome of parsed.items) {
-				const key = intent?.keys[outcome.item];
-				if (intent === void 0 || key === void 0 || intent.seen.has(outcome.item)) return broken("key outcome does not identify one item of its intent");
-				if (parsed.intentId !== intent.intentId || entry.actor !== intent.entry.actor || entry.action !== intent.operation) return broken("key outcome belongs to another operation");
-				if (outcome.secretId !== key.secretId || outcome.version !== key.version || outcome.subject !== key.subject) return broken("key outcome does not match its intended secret");
-				intent.seen.add(outcome.item);
-			}
-			if (intent !== void 0 && intent.seen.size === intent.keys.length) this.#intents.delete(intent.entry.seq);
-		}
-	}
-	/** The first fault, or the batches still under way at `at`: live calls can finish after the snapshot. */
-	result(at) {
-		if (this.#fault !== null) return this.#fault;
-		const intents = [...this.#intents.values()];
-		const overdue = intents.filter((intent) => intent.expiresAt <= at).sort((a, b) => a.expiresAt - b.expiresAt);
-		if (overdue.length === 0) return {
-			ok: true,
-			pending: intents.length
-		};
-		const reason = overdue.map((intent) => {
-			const missing = intent.keys.length - intent.seen.size;
-			return `key intent ${intent.intentId} is overdue: ${missing} of ${intent.keys.length} outcomes missing`;
-		}).join("; ");
-		return {
-			ok: false,
-			failedAtSeq: Number(overdue[0].entry.seq),
-			reason
-		};
-	}
-};
-function parseIntent(entry) {
-	const detail = payload(entry.metadata);
-	if (detail === null) return "key intent has no valid accounting payload";
-	const { intent, operation, expiresAt } = detail;
-	if (typeof intent !== "string") return "key intent has no operation identity";
-	if (typeof operation !== "string" || !KEY_ACTIONS.has(operation)) return "key intent has an invalid operation";
-	if (typeof expiresAt !== "number" || !Number.isSafeInteger(expiresAt) || expiresAt < entry.occurredAt) return "key intent has no valid deadline";
-	if (!Array.isArray(detail.keys)) return "key intent has no valid item list";
-	const keys = [];
-	for (const [index, value] of detail.keys.entries()) {
-		const key = record(value);
-		if (key === null || key.item !== index) return "key intent items are not numbered in order";
-		const { secretId, version, subject } = key;
-		if (typeof secretId !== "string" || typeof subject !== "string") return "key intent item has no secret identity";
-		if (typeof version !== "number" || !Number.isSafeInteger(version) || version < 1) return "key intent item has no valid version";
-		keys.push({
-			item: index,
-			secretId,
-			version,
-			subject
-		});
-	}
-	return {
-		intentId: intent,
-		operation,
-		expiresAt,
-		keys
-	};
-}
-function parseOutcome(entry) {
-	const detail = payload(entry.metadata);
-	if (detail === null) return "key outcome has no valid accounting payload";
-	const { intent } = detail;
-	if (typeof intent !== "string" || entry.relatedSeq === null) return "key outcome has no intent identity";
-	const many = detail.secrets;
-	if (many !== void 0 && (!Array.isArray(many) || many.length === 0)) return "key outcome has no valid item list";
-	const listed = many === void 0 ? [{
-		...detail,
-		secretId: entry.secretId ?? detail.secretId
-	}] : many.map(record);
-	const items = [];
-	for (const one of listed) {
-		if (one === null) return "key outcome has no valid item list";
-		const { item, secretId, version, subject } = one;
-		if (typeof item !== "number" || !Number.isSafeInteger(item) || item < 0) return "key outcome has no valid item number";
-		if (typeof secretId !== "string" || typeof subject !== "string") return "key outcome has no secret identity";
-		if (typeof version !== "number" || !Number.isSafeInteger(version) || version < 1) return "key outcome has no valid version";
-		items.push({
-			item,
-			secretId,
-			version,
-			subject
-		});
-	}
-	return {
-		intentId: intent,
-		relatedSeq: entry.relatedSeq,
-		items
-	};
-}
-function payload(text) {
-	try {
-		return record(JSON.parse(text));
-	} catch {
-		return null;
-	}
-}
-function record(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
-}
-//#endregion
+import { LogHeadMismatch, appendEntries, entryColumns, lockLogHead, missingEntry, newestAuthentic, newestVaultEntries, withinBytes } from "@coffre/db/log";
+import { and, asc, desc, eq, gt, gte, inArray, isNotNull, isNull, lt, lte, or, sql } from "drizzle-orm";
 //#region src/checkpoint.ts
 const PKCS8_ED25519 = [
 	48,
@@ -193,10 +53,10 @@ async function boundLockWaits(tx, ms) {
 }
 /** The database's clock, now. */
 async function now(db) {
-	const { auditChainHead } = tablesOf(db);
-	const [{ at }] = await db.select({ at: clockMillis(db) }).from(auditChainHead);
+	const [{ at }] = await clock(db);
 	return at;
 }
+const clock = prepared((db) => db.select({ at: clockMillis(db) }).from(tablesOf(db).auditChainHead));
 function memberColumns(db) {
 	const { vaultMembers } = tablesOf(db);
 	return {
@@ -215,7 +75,7 @@ function memberColumns(db) {
 	};
 }
 /** A member as their row says (`storedRole`). */
-function memberOf({ owner, role, scope, ...row }) {
+function memberOf$1({ owner, role, scope, ...row }) {
 	return {
 		...row,
 		...storedRole({
@@ -234,13 +94,16 @@ function storedChange(change) {
 	};
 }
 async function member(db, principal) {
-	const { vaultMembers } = tablesOf(db);
-	const [row] = await db.select(memberColumns(db)).from(vaultMembers).where(eq(vaultMembers.principal, principal));
-	return row === void 0 ? void 0 : memberOf(row);
+	const [row] = await memberRow(db, { principal });
+	return row === void 0 ? void 0 : memberOf$1(row);
 }
+const memberRow = prepared((db) => {
+	const { vaultMembers } = tablesOf(db);
+	return db.select(memberColumns(db)).from(vaultMembers).where(eq(vaultMembers.principal, sql.placeholder("principal")));
+});
 async function allMembers(db) {
 	const { vaultMembers } = tablesOf(db);
-	return (await db.select(memberColumns(db)).from(vaultMembers).orderBy(asc(vaultMembers.principal))).map(memberOf);
+	return (await db.select(memberColumns(db)).from(vaultMembers).orderBy(asc(vaultMembers.principal))).map(memberOf$1);
 }
 /**
 * The rows that say their member is an active Owner of the whole instance
@@ -250,7 +113,7 @@ async function allMembers(db) {
 */
 async function instanceOwners(db) {
 	const { vaultMembers } = tablesOf(db);
-	return (await db.select(memberColumns(db)).from(vaultMembers).where(and(eq(vaultMembers.status, "active"), eq(vaultMembers.role, "owner"))).orderBy(asc(vaultMembers.principal))).map(memberOf).filter(ownsInstance);
+	return (await db.select(memberColumns(db)).from(vaultMembers).where(and(eq(vaultMembers.status, "active"), eq(vaultMembers.role, "owner"))).orderBy(asc(vaultMembers.principal))).map(memberOf$1).filter(ownsInstance);
 }
 /**
 * Lock these members' rows for the rest of the transaction, in one order
@@ -261,7 +124,7 @@ async function instanceOwners(db) {
 async function lockMembers(tx, principals) {
 	const { vaultMembers } = tablesOf(tx);
 	const rows = await forUpdate(tx, tx.select(memberColumns(tx)).from(vaultMembers).where(inArray(vaultMembers.principal, [...new Set(principals)])).orderBy(asc(vaultMembers.principal)), "no key update");
-	return new Map(rows.map((row) => [row.principal, memberOf(row)]));
+	return new Map(rows.map((row) => [row.principal, memberOf$1(row)]));
 }
 /**
 * Add `row`. A principal has one row: when two decisions admit the same
@@ -358,19 +221,6 @@ async function everyProjectHolders(db) {
 	const { vaultGrants } = tablesOf(db);
 	return (await db.selectDistinct({ principal: vaultGrants.principal }).from(vaultGrants).where(and(isNull(vaultGrants.projectId), isNull(vaultGrants.environmentId))).orderBy(asc(vaultGrants.principal))).map((row) => row.principal);
 }
-/** The action of an entry that releases a key, which the bulk limit counts. */
-const RELEASE = "secret.read";
-/**
-* How many keys the vault has released to `principal` since `after`: one
-* for an entry about one secret, and as many as it lists for one about
-* several (`secrets`), a read logged once per place.
-*/
-async function releasesSince(db, principal, after) {
-	const { auditLog } = tablesOf(db);
-	const listed = engineOf(db) === "postgres" ? sql`jsonb_array_length((${auditLog.metadata})::jsonb -> 'secrets')` : sql`json_array_length(${auditLog.metadata}, '$.secrets')`;
-	const [{ n }] = await db.select({ n: sql`SUM(COALESCE(${listed}, 1))` }).from(auditLog).where(and(eq(auditLog.author, "vault"), eq(auditLog.actor, principal), eq(auditLog.action, RELEASE), eq(auditLog.decision, "allow"), gt(auditLog.occurredAt, after)));
-	return Number(n ?? 0);
-}
 /** Rows of the log as the chain's codec reads them: `author` and `decision` are checked by the table. */
 function stored(rows) {
 	return rows;
@@ -405,16 +255,6 @@ async function hashesAt(db, seqs) {
 }
 /** How many entries' hashes one query asks for: a checkpoint every five minutes is tens of thousands of a year. */
 const HASHES_AT_ONCE = 5e3;
-/**
-* Whether every entry from the first through `seq` is there. Seqs are the
-* primary key, so the count is `seq + 1` exactly when none is missing: one
-* pass over the key's index, never the entries.
-*/
-async function complete(db, seq) {
-	const { auditLog } = tablesOf(db);
-	const [{ n }] = await db.select({ n: count() }).from(auditLog).where(and(gte(auditLog.seq, 0n), lte(auditLog.seq, seq)));
-	return BigInt(n) === seq + 1n;
-}
 /** The entry at `seq`'s hash, or undefined when there is none. */
 async function hashAt(db, seq) {
 	const { auditLog } = tablesOf(db);
@@ -529,10 +369,55 @@ async function latestVaultEntry(db, actions) {
 	const [row] = await db.select(entryColumns(db)).from(auditLog).where(and(eq(auditLog.author, "vault"), inArray(auditLog.action, [...actions]), eq(auditLog.decision, "allow"))).orderBy(desc(auditLog.seq)).limit(1);
 	return row === void 0 ? void 0 : stored([row])[0];
 }
+/**
+* The vault's newest checkpoint that keeps a tally, allowed, or undefined:
+* one written since 0.10.1, which names the last entry of the prefix it
+* signs as related (`related_seq`); those before name none.
+*/
+async function latestTallied(db) {
+	const { auditLog } = tablesOf(db);
+	const [row] = await db.select(entryColumns(db)).from(auditLog).where(and(eq(auditLog.author, "vault"), eq(auditLog.action, "audit.checkpoint"), eq(auditLog.decision, "allow"), isNotNull(auditLog.relatedSeq))).orderBy(desc(auditLog.seq)).limit(1);
+	return row === void 0 ? void 0 : stored([row])[0];
+}
+/** The vault's newest `audit.checkpoint` entry, signed or refused, or undefined. */
+async function newestCheckpointEntry(db) {
+	const { auditLog } = tablesOf(db);
+	const [row] = await db.select(entryColumns(db)).from(auditLog).where(and(eq(auditLog.author, "vault"), eq(auditLog.action, "audit.checkpoint"))).orderBy(desc(auditLog.seq)).limit(1);
+	return row === void 0 ? void 0 : stored([row])[0];
+}
+/**
+* The vault's checkpoints that keep a tally after entry `after` and through
+* `through`, oldest first, whole: as many as `BATCH_BYTES` of what they say
+* holds, but always one. A reader asks again after the last.
+*/
+async function talliedWithin(db, after, through, limit) {
+	const { auditLog } = tablesOf(db);
+	const tallied = and(eq(auditLog.author, "vault"), eq(auditLog.action, "audit.checkpoint"), eq(auditLog.decision, "allow"), isNotNull(auditLog.relatedSeq), gt(auditLog.seq, after), lte(auditLog.seq, through));
+	const batch = await withinBytes(db, tallied, limit);
+	if (batch === null) return [];
+	return stored(await db.select(entryColumns(db)).from(auditLog).where(and(tallied, gte(auditLog.seq, batch.from), lte(auditLog.seq, batch.to))).orderBy(asc(auditLog.seq)));
+}
+/** The vault's newest refusal of `action` with `code` after entry `after`, or undefined: one range of the (author, action, seq) index. */
+async function newestRefusal(db, action, code, after) {
+	const { auditLog } = tablesOf(db);
+	const [row] = await db.select(entryColumns(db)).from(auditLog).where(and(eq(auditLog.author, "vault"), eq(auditLog.action, action), gt(auditLog.seq, after), eq(auditLog.decision, "deny"), eq(auditLog.code, code))).orderBy(desc(auditLog.seq)).limit(1);
+	return row === void 0 ? void 0 : stored([row])[0];
+}
+/** Up to `limit` of the vault's checkpoints that keep a tally after entry `after`, oldest first: each one's entry, and the last entry it signs. */
+async function talliedAfter(db, after, limit) {
+	const { auditLog } = tablesOf(db);
+	return (await db.select({
+		seq: auditLog.seq,
+		signs: auditLog.relatedSeq
+	}).from(auditLog).where(and(eq(auditLog.author, "vault"), eq(auditLog.action, "audit.checkpoint"), eq(auditLog.decision, "allow"), isNotNull(auditLog.relatedSeq), gt(auditLog.seq, after))).orderBy(asc(auditLog.seq)).limit(limit)).map(({ seq, signs }) => ({
+		seq,
+		signs
+	}));
+}
 /** The vault's newest allowed access entry about each member who has one. */
 async function newestAccessEntries(db) {
 	const { auditLog } = tablesOf(db);
-	const newest = db.select({ seq: sql`max(${auditLog.seq})` }).from(auditLog).where(and(eq(auditLog.author, "vault"), inArray(auditLog.action, [...ACCESS_ACTIONS]), eq(auditLog.decision, "allow"))).groupBy(auditLog.subjectPrincipal);
+	const newest = db.select({ seq: sql`max(${auditLog.seq})` }).from(auditLog).where(and(eq(auditLog.author, "vault"), inArray(auditLog.action, [...ACCESS_ACTIONS$1]), eq(auditLog.decision, "allow"))).groupBy(auditLog.subjectPrincipal);
 	const rows = stored(await db.select(entryColumns(db)).from(auditLog).where(inArray(auditLog.seq, newest)));
 	return new Map(rows.flatMap((row) => row.subjectPrincipal === null ? [] : [[row.subjectPrincipal, row]]));
 }
@@ -621,86 +506,158 @@ async function versions(db, ids) {
 function vaultLogKey(signingKey) {
 	return deriveLogKey("vault", signingKey);
 }
-/** Before the first entry: nothing verified yet. */
-const UNVERIFIED = {
-	nextSeq: 0n,
-	hash: GENESIS_HASH,
-	vaultEntries: 0,
-	vaultKeys: []
+/** Before the first entry. */
+const START = {
+	seq: -1n,
+	hash: GENESIS_HASH
 };
-/** The further of two anchors, when two calls verified at once. */
+/** The further of two positions, when two calls walked at once. */
 function further(a, b) {
-	return b.nextSeq > a.nextSeq ? b : a;
+	return b.seq > a.seq ? b : a;
 }
 /** Entries read at once, at most, and no more than `BATCH_BYTES` of what they say: well within a Worker's memory, and a fifth of the round trips of 1000. */
 const VERIFY_BATCH = 5e3;
 /**
-* Check the chain, a batch in memory at a time, and return where it is now
-* verified to. Three parts:
-*
-* - `shown`, the page a reader is looking at: each entry against its own
-*   hash and MAC;
-* - `anchor`, the head at the last check: still there, unchanged. A rewrite
-*   of anything before it, chained again to hide, changes its hash;
-* - every entry after the anchor, or from the first.
+* Walk the chain on from `from`, a batch in memory at a time, through `to`
+* or the log's last entry, and no more than `limit` entries: every link and
+* hash recomputed, each of the vault's entries by its MAC, its keys moving
+* only forward, and each fed to `walk`. Where it got to, and whether that
+* is as far as it was to go: a walk cut short by `limit` goes on from there
+* another time.
 *
-* So a view rehashes only what is new since the last one. What it leaves
-* out is an entry before the anchor edited in place, not chained again, and
-* not on the page: a full check, which starts from `UNVERIFIED`, finds that,
-* as does the first view after a start, which has no anchor. `onBatch` sees
-* each batch once it has verified, for checks that read the same entries.
+* It takes `from` as given: whether the log still holds it is the caller's
+* to check, with the other heads it must hold, in one read.
 */
-async function verifyChain(db, logKeys, shown, anchor, onBatch = () => {}) {
-	const broken = (failedAtSeq, reason) => ({
-		verification: {
-			ok: false,
-			failedAtSeq: Number(failedAtSeq),
-			reason: withCause(reason)
-		},
-		anchor
-	});
-	const keys = {
-		keys: logKeys,
-		chainOnly: ["app"]
-	};
-	for (const row of [...shown].sort((a, b) => a.seq < b.seq ? -1 : 1)) {
-		const result = verifyEntries([row], {
-			...keys,
-			startSeq: row.seq,
-			startPrevHash: row.prevHash
+async function rehash(db, logKeys, from, walk, { to, limit = Infinity }) {
+	let at = from;
+	for (let left = limit;;) {
+		if (to !== void 0 && at.seq >= to) return {
+			ok: true,
+			at,
+			done: true
+		};
+		if (left <= 0) return {
+			ok: true,
+			at,
+			done: !(await entriesFrom(db, at.seq + 1n, 1)).some((entry) => to === void 0 || entry.seq <= to)
+		};
+		let batch = await entriesFrom(db, at.seq + 1n, Math.min(VERIFY_BATCH, left));
+		if (to !== void 0) batch = batch.filter((entry) => entry.seq <= to);
+		if (batch.length === 0) return {
+			ok: true,
+			at,
+			done: to === void 0
+		};
+		const result = verifyEntries(batch, {
+			keys: logKeys,
+			chainOnly: ["app"],
+			startSeq: at.seq + 1n,
+			startPrevHash: at.hash
 		});
-		if (!result.ok) return broken(result.failedAtSeq, result.reason);
+		if (!result.ok) return {
+			ok: false,
+			failedAtSeq: Number(result.failedAtSeq),
+			reason: withCause(result.reason)
+		};
+		for (const entry of batch) {
+			const moved = entry.author === "vault" ? walk.add(entry, logKeys[0].keyId) : null;
+			if (moved !== null) return {
+				ok: false,
+				failedAtSeq: Number(moved.failedAtSeq),
+				reason: moved.reason
+			};
+		}
+		at = {
+			seq: result.nextSeq - 1n,
+			hash: result.head
+		};
+		left -= batch.length;
 	}
-	if (anchor.nextSeq > 0n && !(await hashAt(db, anchor.nextSeq - 1n))?.equals(anchor.hash)) return broken(anchor.nextSeq - 1n, "changed since the vault last verified it");
-	let verified = anchor;
-	for (;;) {
-		const batch = await entriesFrom(db, verified.nextSeq, VERIFY_BATCH);
+}
+/**
+* The chain again from `from`, through `to` and no more than `limit`
+* entries: each hash recomputed from its entry and each link checked, and
+* nothing else, so a stretch costs a hash an entry. What a checkpoint does
+* in the background to the prefixes signed before (`#scrub` in vault.ts):
+* each entry's MAC was checked when it was signed over, and its hash pins
+* it since, so all that can change behind a signed prefix and keep the
+* chain is an entry edited in place, its stored hash left, which its hash
+* finds.
+*/
+async function relink(db, from, to, limit) {
+	let at = from;
+	while (at.seq < to && limit > 0) {
+		const batch = (await entriesFrom(db, at.seq + 1n, Math.min(VERIFY_BATCH, limit))).filter((entry) => entry.seq <= to);
 		if (batch.length === 0) break;
 		const result = verifyEntries(batch, {
-			...keys,
-			startSeq: verified.nextSeq,
-			startPrevHash: verified.hash
+			keys: [],
+			chainOnly: ["app", "vault"],
+			startSeq: at.seq + 1n,
+			startPrevHash: at.hash
 		});
-		if (!result.ok) return broken(result.failedAtSeq, result.reason);
-		const moved = forward(batch, verified.vaultKeys, logKeys[0].keyId);
-		if ("failedAtSeq" in moved) return broken(moved.failedAtSeq, moved.reason);
-		onBatch(batch);
-		verified = {
-			nextSeq: result.nextSeq,
-			hash: result.head,
-			vaultEntries: verified.vaultEntries + result.authenticated,
-			vaultKeys: moved.keys
+		if (!result.ok) return {
+			ok: false,
+			failedAtSeq: Number(result.failedAtSeq),
+			reason: result.reason
+		};
+		at = {
+			seq: result.nextSeq - 1n,
+			hash: result.head
 		};
+		limit -= batch.length;
 	}
 	return {
-		verification: {
-			ok: true,
-			entries: verified.vaultEntries
-		},
-		anchor: verified
+		ok: true,
+		at
 	};
 }
 /**
+* The vault's own entries after `after`, through `to` or its last, no more
+* than `limit` of them, oldest first: each against its own hash, and by its
+* MAC, over the link it names, its keys moving only forward, each fed to
+* `walk`. The links between entries are the caller's to recompute, as the
+* app does over the same stretch. The last it read, and whether that is as
+* far as it was to go.
+*/
+async function ownEntries(db, logKeys, after, walk, { to, limit = Infinity }) {
+	for (let left = limit;;) {
+		if (left <= 0) return {
+			ok: true,
+			at: after,
+			done: !(await vaultEntriesAfter(db, after, 1)).some((entry) => to === void 0 || entry.seq <= to)
+		};
+		let batch = await vaultEntriesAfter(db, after, Math.min(VERIFY_BATCH, left));
+		if (to !== void 0) batch = batch.filter((entry) => entry.seq <= to);
+		if (batch.length === 0) return {
+			ok: true,
+			at: after,
+			done: true
+		};
+		for (const entry of batch) {
+			const result = verifyEntries([entry], {
+				startSeq: entry.seq,
+				startPrevHash: entry.prevHash,
+				keys: logKeys
+			});
+			if (!result.ok) return {
+				ok: false,
+				failedAtSeq: Number(result.failedAtSeq),
+				reason: withCause(result.reason)
+			};
+		}
+		for (const entry of batch) {
+			const moved = walk.add(entry, logKeys[0].keyId);
+			if (moved !== null) return {
+				ok: false,
+				failedAtSeq: Number(moved.failedAtSeq),
+				reason: moved.reason
+			};
+		}
+		after = batch[batch.length - 1].seq;
+		left -= batch.length;
+	}
+}
+/**
 * The vault's keys only move forward. Once its entries move from one key to
 * the next, the one before writes no more; once they reach `current`, the
 * key it writes with now, no other key writes again. So a key it replaced,
@@ -979,43 +936,662 @@ function grantSet(grants) {
 		grant.grantedBy
 	]).map((tuple) => JSON.stringify(tuple)).sort();
 }
-/** Whether two reads of a member's grants are the same set, as the MAC sees them. */
-function sameGrants(a, b) {
-	const [x, y] = [grantSet(a), grantSet(b)];
-	return x.length === y.length && x.every((tuple, i) => tuple === y[i]);
+/** Whether two reads of a member's grants are the same set, as the MAC sees them. */
+function sameGrants(a, b) {
+	const [x, y] = [grantSet(a), grantSet(b)];
+	return x.length === y.length && x.every((tuple, i) => tuple === y[i]);
+}
+/**
+* A member's instance role and its scope, as the MAC covers them: as 0.4
+* did, whether they are an owner, for a Member or an Admin everywhere, so
+* that every row 0.4 sealed holds as it is; otherwise the role and the
+* scope, which no row of 0.4 can match.
+*/
+function standing(member) {
+	const scope = normalScope(member.scope);
+	if (unscoped(scope) && (member.role === "member" || member.role === "admin")) return member.role === "admin";
+	return [member.role, scope];
+}
+function memberMac(key, member, grants) {
+	const held = grantSet(grants);
+	const tuple = [
+		"coffre.vault.member.v1",
+		member.principal,
+		member.status,
+		standing(member),
+		member.generation,
+		member.accessSeq.toString(),
+		member.createdAt,
+		member.createdBy,
+		member.statusChangedAt,
+		member.statusChangedBy,
+		held
+	];
+	return createHmac("sha256", key).update(JSON.stringify(tuple)).digest();
+}
+/** Whether `member`'s MAC is the vault's, over this row and these grants. */
+function sealed(key, member, grants) {
+	const expected = memberMac(key, member, grants);
+	return member.mac.length === expected.length && timingSafeEqual(member.mac, expected);
+}
+//#endregion
+//#region src/snapshot.postgres.ts
+/** An entry of `audit_log` aliased `e`, as JSON (`RawEntry`): whole numbers past 2^53 as text, bytes as hex. */
+const ENTRY$1 = sql.raw(`json_build_object(
+  'seq', e.seq::text, 'author', e.author, 'keyId', e.key_id, 'occurredAt', e.occurred_at, 'actor', e.actor, 'action', e.action,
+  'decision', e.decision, 'code', e.code, 'subjectPrincipal', e.subject_principal, 'projectId', e.project_id,
+  'environmentId', e.environment_id, 'secretId', e.secret_id, 'secretVersionId', e.secret_version_id,
+  'operationId', e.operation_id, 'requestId', e.request_id, 'sourceIp', e.source_ip, 'relatedSeq', e.related_seq::text,
+  'metadata', e.metadata, 'prevHash', encode(e.prev_hash, 'hex'), 'mac', encode(e.mac, 'hex'), 'hash', encode(e.hash, 'hex'))`);
+const NOW$1 = sql.raw("(extract(epoch from clock_timestamp()) * 1000)::bigint");
+/** `snapshot`'s statement on Postgres: one row, one JSON column. Each part reads one index range. */
+function snapshotQuery$1(asked) {
+	const principals = sql`${sql.param([...asked.principals])}::text[]`;
+	const environments = sql`${sql.param([...asked.environments ?? []])}::uuid[]`;
+	const references = sql`${sql.param((asked.references ?? []).map(String))}::bigint[]`;
+	const actions = sql`${sql.param([...ACCESS_ACTIONS])}::text[]`;
+	const tomb = `%${TOMBSTONE}%`;
+	const released = asked.released;
+	const head = asked.head === true ? sql`, head AS (SELECT next_seq, head_hash FROM audit_chain_head WHERE only_row FOR UPDATE SKIP LOCKED)` : sql``;
+	return sql`
+    WITH policy AS (
+      SELECT * FROM audit_log WHERE author = 'vault' AND action = 'policy.change' AND decision = 'allow' ORDER BY seq DESC LIMIT 1
+    )${head}
+    SELECT json_build_object(
+      'at', ${NOW$1},
+      'head', ${asked.head === true ? sql`(SELECT json_build_object('nextSeq', next_seq::text, 'hash', encode(head_hash, 'hex')) FROM head)` : sql`NULL`},
+      'last', ${asked.head === true ? sql`(SELECT json_build_object('seq', seq::text, 'hash', encode(hash, 'hex')) FROM audit_log ORDER BY seq DESC LIMIT 1)` : sql`NULL`},
+      'rotation', ${asked.head === true ? sql`(SELECT ${ENTRY$1} FROM audit_log e WHERE author = 'vault' AND action = 'key.rotate' AND decision = 'allow' ORDER BY seq DESC LIMIT 1)` : sql`NULL`},
+      'members', ${asked.members === true ? sql`(SELECT coalesce(json_agg(json_build_object(
+            'principal', principal, 'status', status, 'owner', owner, 'role', role, 'scope', scope, 'generation', generation,
+            'createdAt', created_at, 'createdBy', created_by, 'statusChangedAt', status_changed_at, 'statusChangedBy', status_changed_by,
+            'accessSeq', access_seq::text, 'mac', encode(mac, 'hex'))), '[]') FROM vault_members WHERE principal = ANY(${principals}))` : sql`'[]'::json`},
+      'grants', (
+        SELECT coalesce(json_agg(json_build_object(
+          'principal', g.principal, 'projectId', coalesce(g.project_id, env.project_id), 'environmentId', g.environment_id,
+          'environmentSlug', g.environment_slug, 'role', g.role, 'expiresAt', g.expires_at, 'grantedAt', g.granted_at, 'grantedBy', g.granted_by)), '[]')
+        FROM vault_grants g LEFT JOIN environments env ON env.id = g.environment_id
+        WHERE g.principal = ANY(${principals})
+      ),
+      'access', (
+        SELECT coalesce(json_agg(${ENTRY$1}), '[]')
+        FROM unnest(${principals}) AS asked (principal)
+        CROSS JOIN LATERAL (
+          SELECT * FROM audit_log
+          WHERE author = 'vault' AND subject_principal = asked.principal AND action = ANY(${actions}) AND decision = 'allow'
+          ORDER BY seq DESC LIMIT 1
+        ) e
+      ),
+      'policy', (SELECT ${ENTRY$1} FROM policy e),
+      'environments', (
+        SELECT coalesce(json_agg(json_build_object(
+          'id', env.id, 'projectId', env.project_id, 'slug', env.slug, 'owner', env.owner, 'parentId', env.parent_id,
+          'deleted', env.slug LIKE ${tomb} OR project.slug LIKE ${tomb},
+          'archived', env.archived_at IS NOT NULL OR project.archived_at IS NOT NULL)), '[]')
+        FROM environments env JOIN projects project ON project.id = env.project_id
+        -- One list of ids, each found by the primary key.
+        WHERE env.id = ANY(ARRAY(
+          SELECT unnest(${environments})
+          UNION SELECT parent_id FROM environments WHERE id = ANY(${environments}) AND owner IS NOT NULL
+          -- What the newest policy protects, by the ids its JSON names; one that is no UUID names nothing.
+          UNION SELECT (place #>> '{}')::uuid FROM policy, jsonb_path_query(policy.metadata::jsonb, '$.policy.protected[*].environmentId') AS place
+          WHERE (place #>> '{}') ~* '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
+        ))
+      ),
+      'ended', (
+        SELECT coalesce(json_agg(related_seq::text), '[]') FROM audit_log
+        WHERE author = 'vault' AND action = 'reference.end' AND decision = 'allow' AND related_seq = ANY(${references})
+      ),
+      'released', ${released === void 0 ? sql`0` : sql`(
+          SELECT count(DISTINCT key) FROM (
+            -- A read of one key names it; of several at one place, lists them (readsByPlace, vault.ts). An entry, or an
+            -- item of its list, that names no key, which only a forged entry is, counts as one key of its own.
+            SELECT coalesce(e.secret_id::text, CASE jsonb_typeof(one -> 'secretId') WHEN 'string' THEN one ->> 'secretId' END, 'entry:' || e.seq) FROM audit_log e
+            -- Each item of a list, never what lax paths would make of an object; silent, as strict paths fail on what is missing.
+            LEFT JOIN LATERAL jsonb_path_query(CASE WHEN e.secret_id IS NULL THEN e.metadata::jsonb END, 'strict $.secrets ? (@.type() == "array")[*]', '{}', true) AS one ON true
+            WHERE e.author = 'vault' AND e.actor = ${released.principal} AND e.action = 'secret.read' AND e.decision = 'allow'
+              AND e.occurred_at > ${NOW$1} + ${released.clockOffsetMs} - ${released.windowMs}
+            UNION ALL SELECT unnest(${sql.param([...released.keys])}::text[])
+          ) AS released (key)
+        )`}
+    ) AS snapshot`;
+}
+//#endregion
+//#region src/snapshot.sqlite.ts
+/**
+* An entry of `audit_log` aliased `e`, as JSON (`RawEntry`), bytes as hex.
+* A JSON value loses its type leaving a subquery, so whoever takes one
+* from a subquery wraps it in `json(…)`.
+*/
+const ENTRY = sql.raw(`json_object(
+  'seq', e.seq, 'author', e.author, 'keyId', e.key_id, 'occurredAt', e.occurred_at, 'actor', e.actor, 'action', e.action,
+  'decision', e.decision, 'code', e.code, 'subjectPrincipal', e.subject_principal, 'projectId', e.project_id,
+  'environmentId', e.environment_id, 'secretId', e.secret_id, 'secretVersionId', e.secret_version_id,
+  'operationId', e.operation_id, 'requestId', e.request_id, 'sourceIp', e.source_ip, 'relatedSeq', e.related_seq,
+  'metadata', e.metadata, 'prevHash', hex(e.prev_hash), 'mac', hex(e.mac), 'hash', hex(e.hash))`);
+const NOW = sql.raw(`CAST(unixepoch('subsec') * 1000 AS INTEGER)`);
+/**
+* `snapshot`'s statement on SQLite, the same as on Postgres. Nothing is
+* locked: one transaction runs at a time (connect.ts), so the head is the
+* last entry's.
+*/
+function snapshotQuery(asked) {
+	const principals = JSON.stringify(asked.principals);
+	const environments = JSON.stringify(asked.environments ?? []);
+	const references = JSON.stringify((asked.references ?? []).map(Number));
+	const actions = JSON.stringify(ACCESS_ACTIONS);
+	const tomb = `%${TOMBSTONE}%`;
+	const released = asked.released;
+	const head = asked.head === true;
+	return sql`
+    WITH policy AS (
+      SELECT * FROM audit_log WHERE author = 'vault' AND action = 'policy.change' AND decision = 'allow' ORDER BY seq DESC LIMIT 1
+    )
+    SELECT json_object(
+      'at', ${NOW},
+      'head', ${head ? sql`json((SELECT json_object('nextSeq', next_seq, 'hash', hex(head_hash)) FROM audit_chain_head WHERE only_row))` : sql`NULL`},
+      'last', ${head ? sql`json((SELECT json_object('seq', seq, 'hash', hex(hash)) FROM audit_log ORDER BY seq DESC LIMIT 1))` : sql`NULL`},
+      'rotation', ${head ? sql`json((SELECT ${ENTRY} FROM audit_log e WHERE author = 'vault' AND action = 'key.rotate' AND decision = 'allow' ORDER BY seq DESC LIMIT 1))` : sql`NULL`},
+      'members', json(${asked.members === true ? sql`(SELECT json_group_array(json_object(
+            'principal', principal, 'status', status, 'owner', owner, 'role', role, 'scope', scope, 'generation', generation,
+            'createdAt', created_at, 'createdBy', created_by, 'statusChangedAt', status_changed_at, 'statusChangedBy', status_changed_by,
+            'accessSeq', access_seq, 'mac', hex(mac))) FROM vault_members WHERE principal IN (SELECT value FROM json_each(${principals})))` : sql`'[]'`}),
+      'grants', json((
+        SELECT json_group_array(json_object(
+          'principal', g.principal, 'projectId', coalesce(g.project_id, env.project_id), 'environmentId', g.environment_id,
+          'environmentSlug', g.environment_slug, 'role', g.role, 'expiresAt', g.expires_at, 'grantedAt', g.granted_at, 'grantedBy', g.granted_by))
+        FROM vault_grants g LEFT JOIN environments env ON env.id = g.environment_id
+        WHERE g.principal IN (SELECT value FROM json_each(${principals}))
+      )),
+      'access', json((
+        SELECT json_group_array(json(newest)) FROM (
+          SELECT (
+            SELECT ${ENTRY} FROM audit_log e
+            WHERE author = 'vault' AND subject_principal = asked.value AND action IN (SELECT value FROM json_each(${actions})) AND decision = 'allow'
+            ORDER BY seq DESC LIMIT 1
+          ) AS newest
+          FROM json_each(${principals}) AS asked
+        ) WHERE newest IS NOT NULL
+      )),
+      'policy', json((SELECT ${ENTRY} FROM policy e)),
+      'environments', json((
+        SELECT json_group_array(json_object(
+          'id', env.id, 'projectId', env.project_id, 'slug', env.slug, 'owner', env.owner, 'parentId', env.parent_id,
+          'deleted', env.slug LIKE ${tomb} OR project.slug LIKE ${tomb},
+          'archived', env.archived_at IS NOT NULL OR project.archived_at IS NOT NULL))
+        FROM environments env JOIN projects project ON project.id = env.project_id
+        WHERE env.id IN (SELECT value FROM json_each(${environments}))
+          OR env.id IN (SELECT parent_id FROM environments WHERE id IN (SELECT value FROM json_each(${environments})) AND owner IS NOT NULL)
+          OR env.id IN (
+            SELECT json_extract(place.value, '$.environmentId')
+            FROM policy, json_each(policy.metadata, '$.policy.protected') AS place
+            -- Of a forged entry's, an element that is no object names nothing: json_extract would fail on a string.
+            WHERE json_valid(policy.metadata) AND json_type(policy.metadata, '$.policy.protected') = 'array' AND place.type = 'object'
+          )
+      )),
+      'ended', json((
+        SELECT json_group_array(related_seq) FROM audit_log
+        WHERE author = 'vault' AND action = 'reference.end' AND decision = 'allow' AND related_seq IN (SELECT value FROM json_each(${references}))
+      )),
+      'released', ${released === void 0 ? sql`0` : sql`(
+          SELECT count(DISTINCT key) FROM (
+            -- A read of one key names it; of several at one place, lists them (readsByPlace, vault.ts). An entry, or an
+            -- item of its list, that names no key, which only a forged entry is, counts as one key of its own.
+            SELECT coalesce(e.secret_id, CASE WHEN one.type = 'object' AND json_type(one.value, '$.secretId') = 'text' THEN json_extract(one.value, '$.secretId') END, 'entry:' || e.seq) AS key
+            FROM audit_log e
+            LEFT JOIN json_each(CASE WHEN e.secret_id IS NULL AND json_type(e.metadata, '$.secrets') = 'array' THEN e.metadata END, '$.secrets') AS one
+            WHERE e.author = 'vault' AND e.actor = ${released.principal} AND e.action = 'secret.read' AND e.decision = 'allow'
+              AND e.occurred_at > ${NOW} + ${released.clockOffsetMs} - ${released.windowMs}
+            UNION ALL SELECT value FROM json_each(${JSON.stringify(released.keys)})
+          )
+        )`}
+    ) AS snapshot`;
+}
+//#endregion
+//#region src/snapshot.ts
+async function snapshot(db, asked) {
+	const read = () => readOnce(db, asked);
+	const first = await read();
+	if (asked.head !== true || first.head !== null && current(first.head)) return first;
+	if (first.head === null) await lockLogHead(db);
+	const again = await read();
+	if (again.head === null) throw new Error("the log's head, held by this transaction, was read as held by another");
+	if (!current(again.head)) throw new LogHeadMismatch(`the log's head says entry ${again.head.nextSeq} comes next, but the log ends ${again.head.last === null ? "empty" : `at entry ${again.head.last.seq}`}, or with another hash`);
+	return again;
+}
+/** Whether the head names the last entry the same statement saw: nothing was appended between its snapshot and its lock. */
+function current(head) {
+	if (head.last === null) return head.nextSeq === 0n;
+	return head.nextSeq === head.last.seq + 1n && head.headHash.equals(head.last.hash);
+}
+async function readOnce(db, asked) {
+	const query = (engineOf(db) === "postgres" ? snapshotQuery$1 : snapshotQuery)(asked);
+	const [row] = await rowsOf(db, query);
+	const raw = typeof row.snapshot === "string" ? JSON.parse(row.snapshot) : row.snapshot;
+	return {
+		at: Number(raw.at),
+		members: new Map(raw.members.map((member) => [member.principal, memberOf(member)])),
+		grants: new Map(asked.principals.map((principal) => [principal, raw.grants.filter((grant) => grant.principal === principal).map(grantOf)])),
+		newestAccess: new Map(raw.access.map((entry) => [entry.subjectPrincipal, entryOf(entry)])),
+		newestPolicy: raw.policy === null ? null : entryOf(raw.policy),
+		environments: new Map(raw.environments.map(({ id, ...environment }) => [id, {
+			...environment,
+			deleted: Boolean(environment.deleted),
+			archived: Boolean(environment.archived)
+		}])),
+		ended: new Set(raw.ended.map((seq) => BigInt(seq))),
+		released: Number(raw.released ?? 0),
+		head: raw.head === null ? null : {
+			nextSeq: BigInt(raw.head.nextSeq),
+			headHash: Buffer.from(raw.head.hash, "hex"),
+			last: raw.last === null ? null : {
+				seq: BigInt(raw.last.seq),
+				hash: Buffer.from(raw.last.hash, "hex")
+			},
+			rotation: raw.rotation === null ? null : entryOf(raw.rotation)
+		}
+	};
+}
+/** An entry as the chain's codec reads it, from what `entryJson` wrote. */
+function entryOf(raw) {
+	return {
+		...raw,
+		seq: BigInt(raw.seq),
+		author: raw.author,
+		occurredAt: Number(raw.occurredAt),
+		relatedSeq: raw.relatedSeq === null ? null : BigInt(raw.relatedSeq),
+		prevHash: Buffer.from(raw.prevHash, "hex"),
+		mac: Buffer.from(raw.mac, "hex"),
+		hash: Buffer.from(raw.hash, "hex")
+	};
+}
+function grantOf(raw) {
+	return {
+		...raw,
+		expiresAt: raw.expiresAt === null ? null : Number(raw.expiresAt),
+		grantedAt: Number(raw.grantedAt)
+	};
+}
+function memberOf({ owner, ...raw }) {
+	return memberOf$1({
+		...raw,
+		owner: owner === true || owner === 1,
+		generation: Number(raw.generation),
+		createdAt: Number(raw.createdAt),
+		statusChangedAt: Number(raw.statusChangedAt),
+		accessSeq: BigInt(raw.accessSeq),
+		mac: Buffer.from(raw.mac, "hex")
+	});
+}
+//#endregion
+//#region src/accounting.ts
+const KEY_ACTIONS = /* @__PURE__ */ new Set([
+	"secret.read",
+	"key.wrap",
+	"key.rewrap"
+]);
+/**
+* Every key operation's intent and its outcomes, entry by entry, oldest
+* first, as a walk reads the vault's entries (`add`); then what is still
+* open (`result`). The chain can hold while a process died between an
+* intent and its outcomes: only a missed deadline is a fault.
+*
+* A walk resumes from a checkpoint's `state()`: the batches open there, and
+* nothing of those that closed. So an intent's identity is checked against
+* those still open and those since, not every one the log ever held: a
+* closed batch takes no more outcomes in any case, since each names its
+* intent's entry.
+*/
+var KeyAccounting = class {
+	#intents = /* @__PURE__ */ new Map();
+	#ids = /* @__PURE__ */ new Set();
+	#fault = null;
+	constructor(from = {
+		intents: [],
+		fault: null
+	}) {
+		for (const { seq, seen, ...open } of from.intents) {
+			this.#intents.set(BigInt(seq), {
+				...open,
+				seq: BigInt(seq),
+				seen: new Set(seen)
+			});
+			this.#ids.add(open.intentId);
+		}
+		this.#fault = from.fault === null ? null : {
+			ok: false,
+			...from.fault
+		};
+	}
+	/** Where it stands, to resume from: the batches open, oldest first. */
+	state() {
+		return {
+			intents: [...this.#intents.values()].sort((a, b) => a.seq < b.seq ? -1 : 1).map(({ seq, seen, ...open }) => ({
+				...open,
+				seq: Number(seq),
+				seen: [...seen].sort((a, b) => a - b)
+			})),
+			fault: this.#fault === null ? null : {
+				failedAtSeq: this.#fault.failedAtSeq,
+				reason: this.#fault.reason
+			}
+		};
+	}
+	add(entry) {
+		if (this.#fault !== null || entry.author !== "vault") return;
+		const broken = (reason) => {
+			this.#fault = {
+				ok: false,
+				failedAtSeq: Number(entry.seq),
+				reason
+			};
+		};
+		if (entry.action === "key.intent") {
+			const parsed = parseIntent(entry);
+			if (typeof parsed === "string") return broken(parsed);
+			if (this.#ids.has(parsed.intentId)) return broken("key intent repeats an operation identity");
+			this.#ids.add(parsed.intentId);
+			if (parsed.keys.length > 0) this.#intents.set(entry.seq, {
+				...parsed,
+				seq: entry.seq,
+				actor: entry.actor,
+				seen: /* @__PURE__ */ new Set()
+			});
+		} else if (KEY_ACTIONS.has(entry.action) && entry.relatedSeq !== null) {
+			const parsed = parseOutcome(entry);
+			if (typeof parsed === "string") return broken(parsed);
+			const intent = this.#intents.get(parsed.relatedSeq);
+			for (const outcome of parsed.items) {
+				const key = intent?.keys[outcome.item];
+				if (intent === void 0 || key === void 0 || intent.seen.has(outcome.item)) return broken("key outcome does not identify one item of its intent");
+				if (parsed.intentId !== intent.intentId || entry.actor !== intent.actor || entry.action !== intent.operation) return broken("key outcome belongs to another operation");
+				if (outcome.secretId !== key.secretId || outcome.version !== key.version || outcome.subject !== key.subject) return broken("key outcome does not match its intended secret");
+				intent.seen.add(outcome.item);
+			}
+			if (intent !== void 0 && intent.seen.size === intent.keys.length) this.#intents.delete(intent.seq);
+		}
+	}
+	/** The first fault, or the batches still under way at `at`: live calls can finish after the snapshot. */
+	result(at) {
+		if (this.#fault !== null) return this.#fault;
+		const intents = [...this.#intents.values()];
+		const overdue = intents.filter((intent) => intent.expiresAt <= at).sort((a, b) => a.expiresAt - b.expiresAt);
+		if (overdue.length === 0) return {
+			ok: true,
+			pending: intents.length
+		};
+		const reason = overdue.map((intent) => {
+			const missing = intent.keys.length - intent.seen.size;
+			return `key intent ${intent.intentId} is overdue: ${missing} of ${intent.keys.length} outcomes missing`;
+		}).join("; ");
+		return {
+			ok: false,
+			failedAtSeq: Number(overdue[0].seq),
+			reason
+		};
+	}
+};
+function parseIntent(entry) {
+	const detail = payload(entry.metadata);
+	if (detail === null) return "key intent has no valid accounting payload";
+	const { intent, operation, expiresAt } = detail;
+	if (typeof intent !== "string") return "key intent has no operation identity";
+	if (typeof operation !== "string" || !KEY_ACTIONS.has(operation)) return "key intent has an invalid operation";
+	if (typeof expiresAt !== "number" || !Number.isSafeInteger(expiresAt) || expiresAt < entry.occurredAt) return "key intent has no valid deadline";
+	if (!Array.isArray(detail.keys)) return "key intent has no valid item list";
+	const keys = [];
+	for (const [index, value] of detail.keys.entries()) {
+		const key = record(value);
+		if (key === null || key.item !== index) return "key intent items are not numbered in order";
+		const { secretId, version, subject } = key;
+		if (typeof secretId !== "string" || typeof subject !== "string") return "key intent item has no secret identity";
+		if (typeof version !== "number" || !Number.isSafeInteger(version) || version < 1) return "key intent item has no valid version";
+		keys.push({
+			item: index,
+			secretId,
+			version,
+			subject
+		});
+	}
+	return {
+		intentId: intent,
+		operation,
+		expiresAt,
+		keys
+	};
+}
+function parseOutcome(entry) {
+	const detail = payload(entry.metadata);
+	if (detail === null) return "key outcome has no valid accounting payload";
+	const { intent } = detail;
+	if (typeof intent !== "string" || entry.relatedSeq === null) return "key outcome has no intent identity";
+	const many = detail.secrets;
+	if (many !== void 0 && (!Array.isArray(many) || many.length === 0)) return "key outcome has no valid item list";
+	const listed = many === void 0 ? [{
+		...detail,
+		secretId: entry.secretId ?? detail.secretId
+	}] : many.map(record);
+	const items = [];
+	for (const one of listed) {
+		if (one === null) return "key outcome has no valid item list";
+		const { item, secretId, version, subject } = one;
+		if (typeof item !== "number" || !Number.isSafeInteger(item) || item < 0) return "key outcome has no valid item number";
+		if (typeof secretId !== "string" || typeof subject !== "string") return "key outcome has no secret identity";
+		if (typeof version !== "number" || !Number.isSafeInteger(version) || version < 1) return "key outcome has no valid version";
+		items.push({
+			item,
+			secretId,
+			version,
+			subject
+		});
+	}
+	return {
+		intentId: intent,
+		relatedSeq: entry.relatedSeq,
+		items
+	};
+}
+function payload(text) {
+	try {
+		return record(JSON.parse(text));
+	} catch {
+		return null;
+	}
+}
+function record(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+//#endregion
+//#region src/tally.ts
+/** Before the first entry. */
+const EMPTY_TALLY = {
+	entries: 0,
+	keys: [],
+	accounting: {
+		intents: [],
+		fault: null
+	},
+	access: {
+		members: [],
+		grants: [],
+		newest: []
+	},
+	replayFault: null
+};
+/** The digest of what `access` says, over its canonical form. */
+function accessDigest(access) {
+	return createHash("sha256").update(canonical(access)).digest("hex");
 }
 /**
-* A member's instance role and its scope, as the MAC covers them: as 0.4
-* did, whether they are an owner, for a Member or an Admin everywhere, so
-* that every row 0.4 sealed holds as it is; otherwise the role and the
-* scope, which no row of 0.4 can match.
+* What two tallies are compared by, so that they match whatever order
+* their maps were built in: the members and grants by their digest, which
+* a stretch passing many checkpoints computes once a change; and a fault by
+* where it was found, since the words for it may change from one release
+* to the next.
 */
-function standing(member) {
-	const scope = normalScope(member.scope);
-	if (unscoped(scope) && (member.role === "member" || member.role === "admin")) return member.role === "admin";
-	return [member.role, scope];
+function tallyKey({ accounting, entries, keys, replayFault }, digest) {
+	return canonical({
+		entries,
+		keys,
+		replayFault,
+		accounting: {
+			...accounting,
+			fault: accounting.fault?.failedAtSeq ?? null
+		},
+		access: digest
+	});
 }
-function memberMac(key, member, grants) {
-	const held = grantSet(grants);
-	const tuple = [
-		"coffre.vault.member.v1",
-		member.principal,
-		member.status,
-		standing(member),
-		member.generation,
-		member.accessSeq.toString(),
-		member.createdAt,
-		member.createdBy,
-		member.statusChangedAt,
-		member.statusChangedBy,
-		held
-	];
-	return createHmac("sha256", key).update(JSON.stringify(tuple)).digest();
+/**
+* What a walk must come to at a checkpoint, from the tally it keeps: its
+* members and grants by the digest it keeps of them, never read.
+*/
+function expectedKey(stored) {
+	return tallyKey(stored, stored.access.digest);
 }
-/** Whether `member`'s MAC is the vault's, over this row and these grants. */
-function sealed(key, member, grants) {
-	const expected = memberMac(key, member, grants);
-	return member.mac.length === expected.length && timingSafeEqual(member.mac, expected);
+/**
+* The vault's entries walked, oldest first, each after its MAC was checked,
+* gathered into what the checks after the walk need: the tally it started
+* from, carried on.
+*/
+var Walk = class {
+	accounting;
+	replayed;
+	/** Each member's newest allowed access entry, by seq. */
+	newestAccess;
+	/** The first access entry the replay could not apply. */
+	replayFault;
+	/** The vault's entries so far, those before the walk included. */
+	entries;
+	/** The vault's log keys, as the log moved through them. */
+	keys;
+	/** The checkpoints walked, each to be checked against its signature and the prefix it signed once the walk ends: what it signed, and nothing it keeps beside. */
+	checkpoints = [];
+	/** The tallies the walk must come to as it passes them, oldest first (`expect`). */
+	#expected = [];
+	/** The first it did not come to, and why. */
+	mismatch = null;
+	/** The digest of the members and grants as the walk has them, until an access entry changes them. */
+	#digest = null;
+	/** The digest of the members and grants as the walk has them: the tally's it started from, until an access entry. */
+	digest() {
+		return this.#digest ??= accessDigest(this.tally().access);
+	}
+	/** The tally but for its members and grants, which `digest` stands for. */
+	#unaccessed() {
+		return {
+			entries: this.entries,
+			keys: [...this.keys],
+			accounting: this.accounting.state(),
+			replayFault: this.replayFault
+		};
+	}
+	/** `digest` is that of `from`'s members and grants, when the caller has it: a beat with no access entry hashes none. */
+	constructor(from, digest) {
+		this.#digest = digest ?? null;
+		this.accounting = new KeyAccounting(from.accounting);
+		this.replayed = {
+			members: new Map(from.access.members.map((member) => [member.principal, {
+				...member,
+				accessSeq: BigInt(member.accessSeq)
+			}])),
+			held: /* @__PURE__ */ new Map()
+		};
+		for (const grant of from.access.grants) {
+			const held = this.replayed.held.get(grant.principal) ?? /* @__PURE__ */ new Map();
+			this.replayed.held.set(grant.principal, held);
+			held.set(placeKey$1(grant), { ...grant });
+		}
+		this.newestAccess = new Map(from.access.newest.map(([principal, seq]) => [principal, BigInt(seq)]));
+		this.replayFault = from.replayFault;
+		this.entries = from.entries;
+		this.keys = from.keys;
+	}
+	/**
+	* Hold the walk to these tallies, each as the walk stands once it has
+	* read every entry through the prefix's end: before the vault's next
+	* entry, since only the vault's change a tally, or at `finish`.
+	*/
+	expect(expected) {
+		this.#expected = [...expected].sort((a, b) => a.through < b.through ? -1 : 1);
+	}
+	/** The tallies expected through `through`, held to the walk. */
+	finish(through) {
+		this.#reach(through + 1n);
+	}
+	#reach(before) {
+		while (this.#expected.length > 0 && this.#expected[0].through < before) {
+			const expected = this.#expected.shift();
+			if (this.mismatch !== null) continue;
+			if ("unreadable" in expected) this.mismatch = {
+				entry: expected.entry,
+				reason: expected.unreadable
+			};
+			else if (tallyKey(this.#unaccessed(), this.digest()) !== expected.key) this.mismatch = {
+				entry: expected.entry,
+				reason: "the tally this checkpoint keeps does not follow from the log before it"
+			};
+		}
+	}
+	/**
+	* One of the vault's entries, its MAC checked, in the log's order: a
+	* fault when it is under a key the vault had moved past (`forward`).
+	*/
+	add(entry, current) {
+		this.#reach(entry.seq);
+		const moved = forward([entry], this.keys, current);
+		if ("failedAtSeq" in moved) return moved;
+		this.keys = moved.keys;
+		this.entries += 1;
+		this.accounting.add(entry);
+		if (entry.decision !== "allow") return null;
+		if (ACCESS.has(entry.action)) {
+			this.#digest = null;
+			this.replayFault ??= apply(this.replayed, entry);
+			if (entry.subjectPrincipal !== null) this.newestAccess.set(entry.subjectPrincipal, entry.seq);
+		} else if (entry.action === "audit.checkpoint") {
+			const { seq, hash, signedAt, keyId, signature } = JSON.parse(entry.metadata);
+			this.checkpoints.push({
+				entry: {
+					seq: entry.seq,
+					keyId: entry.keyId,
+					relatedSeq: entry.relatedSeq
+				},
+				checkpoint: {
+					seq,
+					hash,
+					signedAt,
+					keyId,
+					signature
+				}
+			});
+		}
+		return null;
+	}
+	/** Where the walk stands, to resume from. */
+	tally() {
+		const byPrincipal = (entries) => [...entries].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+		return {
+			entries: this.entries,
+			keys: [...this.keys],
+			accounting: this.accounting.state(),
+			access: {
+				members: byPrincipal(this.replayed.members).map(([, member]) => ({
+					...member,
+					accessSeq: Number(member.accessSeq)
+				})),
+				grants: byPrincipal(this.replayed.held).flatMap(([, held]) => byPrincipal(held).map(([, grant]) => grant)),
+				newest: byPrincipal(this.newestAccess).map(([principal, seq]) => [principal, Number(seq)])
+			},
+			replayFault: this.replayFault
+		};
+	}
+};
+/** The action of the vault's entry that signs a prefix of the log. */
+const CHECKPOINT = "audit.checkpoint";
+const ACCESS = new Set(ACCESS_ACTIONS$1);
+/** JSON with every object's keys sorted: one text for one value, however it was built. */
+function canonical(value) {
+	return JSON.stringify(value, (_, inner) => inner !== null && typeof inner === "object" && !Array.isArray(inner) ? Object.fromEntries(Object.entries(inner).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) : inner);
 }
 //#endregion
 //#region src/vault.ts
@@ -1025,9 +1601,13 @@ async function prepareVault(config, options = {}) {
 		...await keysOf(config.signingKeys),
 		options: {
 			keyBudgetMs: options.keyBudgetMs ?? KEY_BUDGET_MS,
-			clockOffset: options.clockOffset ?? (() => 0)
+			clockOffset: options.clockOffset ?? (() => 0),
+			walks: {
+				...WALKS,
+				...options.walks
+			}
 		},
-		verified: UNVERIFIED,
+		verified: START,
 		reported: /* @__PURE__ */ new Set(),
 		since: null,
 		superseded: null,
@@ -1076,8 +1656,6 @@ const UNSEALED = {
 };
 /** Why a change to a tampered member is refused. */
 const TAMPERED_SUBJECT = "this member's record failed the vault's integrity check: remove them to start over";
-/** The action of the vault's entry that signs a prefix of the log. */
-const CHECKPOINT = "audit.checkpoint";
 /** The action of the vault's entry that holds the instance's settings, and changes them (`settings`). */
 const SETTINGS = "settings.change";
 /** The settings before anyone changed them: people set up service accounts anywhere they hold access. */
@@ -1122,12 +1700,6 @@ function declaredOwner(principal) {
 const NOT_THEIRS = "a person gives a service account at most what they hold, where the instance lets them set one up, and only to one whose every grant they hold";
 /** Who asks for checkpoints: the app's scheduled job. */
 const SCHEDULER = "system:coffre-scheduler";
-/**
-* How often a checkpoint recomputes the chain from its first entry: the
-* first of each hour, by the vault's clock. The others resume from the
-* prefix the last one signed (`#recompute`).
-*/
-const FULL_RECOMPUTE_MS = 36e5;
 /** A refusal and the entries that record it. */
 var Refused = class {
 	refusal;
@@ -1229,6 +1801,24 @@ var VaultService = class {
 	async #now(db) {
 		return await now(db) + this.#prepared.options.clockOffset();
 	}
+	/** A snapshot's clock, as the vault keeps time (`#now`). */
+	#at(reads) {
+		return reads.at + this.#prepared.options.clockOffset();
+	}
+	/** What a decision about `principals` reads, and `asked` besides, in one statement: under the head when `head` is set. */
+	#snapshot(tx, principals, asked, head) {
+		const { released, ...rest } = asked;
+		return snapshot(tx, {
+			...rest,
+			principals,
+			head,
+			...released === void 0 ? {} : { released: {
+				...released,
+				windowMs: this.#config.bulkLimit.windowMs,
+				clockOffsetMs: this.#prepared.options.clockOffset()
+			} }
+		});
+	}
 	/**
 	* Decide in one transaction, with `principals`' rows locked first, then
 	* the log's head. A `Refused` or an `Outage` rolls back all but its own
@@ -1241,34 +1831,35 @@ var VaultService = class {
 	* alone takes the head later (`late`), once its key service has answered,
 	* which it must not wait on holding it, and decides again then (`#keys`).
 	*/
-	async #decide(principals, decide, late = false) {
+	async #decide(principals, decide, late = false, asked = {}) {
 		const superseded = await this.#settled();
 		if (superseded !== null) return {
 			ok: false,
 			refusal: refusal("wrong_kek", superseded)
 		};
-		return this.#decideNow(principals, decide, late);
+		return this.#decideNow(principals, decide, late, asked);
 	}
 	/** `#decide`, once the vault is settled. */
-	async #decideNow(principals, decide, late = false) {
+	async #decideNow(principals, decide, late = false, asked = {}) {
 		const reports = [];
 		for (let attempt = 1;; attempt += 1) try {
-			return await this.#decideOnce(principals, decide, reports, late);
+			return await this.#decideOnce(principals, decide, reports, late, asked);
 		} catch (error) {
 			if (attempt < 3 && (error instanceof Retry || isUniqueViolation(error))) continue;
 			throw error;
 		}
 	}
-	async #decideOnce(principals, decide, reports, late) {
+	async #decideOnce(principals, decide, reports, late, asked) {
 		try {
 			const result = await this.#db.transaction(async (tx) => {
 				await boundLockWaits(tx, LOCK_TIMEOUT_MS);
 				const members = principals.length === 0 ? /* @__PURE__ */ new Map() : await lockMembers(tx, principals);
-				if (!late) await lockLogHead(tx);
+				const reads = await this.#snapshot(tx, principals, asked, !late);
 				const d = {
 					tx,
 					members,
-					at: await this.#now(tx),
+					at: this.#at(reads),
+					reads,
 					log: [],
 					writes: [],
 					touched: /* @__PURE__ */ new Set(),
@@ -1282,7 +1873,8 @@ var VaultService = class {
 				let at = d.at;
 				const accessSeq = /* @__PURE__ */ new Map();
 				if (entries.length > 0) {
-					const appended = await this.#append(tx, entries, d.underLock);
+					if (d.reads.head === null) throw new Error("a decision appends only under the head it read with");
+					const appended = await this.#append(tx, entries, d.underLock, d.reads);
 					at = appended.occurredAt;
 					entries.forEach((entry, i) => {
 						if (isAccessEntry(entry)) accessSeq.set(entry.subjectPrincipal, appended.seqStart + BigInt(i));
@@ -1347,12 +1939,12 @@ var VaultService = class {
 	* MAC are passed over, and reported: otherwise whoever can insert a row
 	* could lock any member out.
 	*/
-	async #integrity(db, principal, row, grants, reports) {
+	async #integrity(db, principal, row, grants, reports, reads) {
 		if (row !== void 0 && !this.#sealed(row, grants)) {
 			this.#report(reports, principal, "mac", row.mac.toString("hex"));
 			return "mac";
 		}
-		const newest = await this.#newestAccess(db, principal, reports);
+		const newest = await this.#newestAccess(db, principal, reports, reads);
 		const seq = typeof newest !== "string" ? newest.seq : newest === "unreached" ? void 0 : null;
 		if (row === void 0 ? seq === null : seq === row.accessSeq) return null;
 		if (row === void 0 && await member(db, principal) !== void 0) throw new Retry();
@@ -1360,8 +1952,10 @@ var VaultService = class {
 		return "stale";
 	}
 	/** The newest access entry about `principal` that carries the vault's MAC (`newestAccess` in @coffre/db/grants). */
-	#newestAccess(db, principal, reports) {
-		return newestAccess(db, principal, this.#check(reports, principal));
+	#newestAccess(db, principal, reports, reads) {
+		if (reads === void 0 || !reads.grants.has(principal)) return newestAccess(db, principal, this.#check(reports, principal));
+		const newest = reads.newestAccess.get(principal);
+		return newestAuthentic((limit, before) => before === void 0 ? Promise.resolve(newest === void 0 ? [] : [newest]) : accessEntriesAbout(db, principal, limit, before), this.#check(reports, principal));
 	}
 	/** Entries in the vault's name told apart by their MACs, each it did not write reported, about `principal`. */
 	#check(reports, principal) {
@@ -1372,14 +1966,17 @@ var VaultService = class {
 	}
 	/** Whether `entry` carries the vault's MAC: under any of its keys before `since`, and only its current one from there. */
 	#authentic(entry) {
-		const { logKeys, since } = this.#prepared;
-		const keys = since !== null && entry.seq >= since ? logKeys.slice(0, 1) : logKeys;
 		return verifyEntries([entry], {
 			startSeq: entry.seq,
 			startPrevHash: entry.prevHash,
-			keys
+			keys: this.#keysFor(entry)
 		}).ok;
 	}
+	/** The vault's log keys an entry may be under: any of them before `since`, and only its current one from there. */
+	#keysFor(entry) {
+		const { logKeys, since } = this.#prepared;
+		return since !== null && entry.seq >= since ? logKeys.slice(0, 1) : logKeys;
+	}
 	/**
 	* Whether `row`, with these grants, carries the MAC of the vault's row
 	* key, or of one it replaced before the rotation sealed every row again
@@ -1456,7 +2053,7 @@ var VaultService = class {
 	}
 	async #replaceEveryProject(d, principal) {
 		const row = d.members.get(principal);
-		const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
+		const subject = await this.#standing(d.tx, principal, row, d.at, d.reports, d.reads);
 		if (row === void 0 || subject.status !== "active") return;
 		const everyProject = subject.stored.filter((grant) => grant.projectId === null && grant.environmentId === null);
 		if (everyProject.length === 0) return;
@@ -1608,16 +2205,31 @@ var VaultService = class {
 	* that an instance still running with the replaced KEK, as during a
 	* deploy, cannot write after the rotation.
 	*/
-	#append(tx, entries, underLock = []) {
+	async #append(tx, entries, underLock = [], held) {
 		const prepared = this.#prepared;
-		return appendEntries(tx, prepared.logKey, entries, async (locked) => {
-			const rotation = await latestVaultEntry(locked, [KEY_ROTATE]);
+		const head = held?.head ?? void 0;
+		const appended = await appendEntries(tx, prepared.logKey, entries, async (locked) => {
+			const rotation = head === void 0 ? await latestVaultEntry(locked, [KEY_ROTATE]) : head.rotation ?? void 0;
 			if (rotation !== void 0 && !prepared.logKeys.some((key) => key.keyId === rotation.keyId)) {
 				prepared.superseded = `the log moved on to ${rotation.keyId}, a key this vault does not hold: a vault given a newer vault key replaced it, and a replaced key writes nothing more`;
 				throw new Error(prepared.superseded);
 			}
 			for (const check of underLock) await check(locked);
+		}, head === void 0 ? void 0 : {
+			head,
+			last: head.last,
+			at: held.at
 		});
+		if (head !== void 0) held.head = {
+			...head,
+			nextSeq: appended.nextSeq,
+			headHash: appended.headHash,
+			last: {
+				seq: appended.nextSeq - 1n,
+				hash: appended.headHash
+			}
+		};
+		return appended;
 	}
 	async unwrap(input) {
 		const { principal } = input;
@@ -1674,10 +2286,8 @@ var VaultService = class {
 			permission: input.purpose === "use" ? "secret.use" : "secret.read",
 			secrets: items.map((item) => item.secret),
 			places: sealed.map((seal, i) => seal?.holder ?? items[i].secret),
-			vet: ends.length === 0 ? void 0 : async (db) => {
-				const ended = await endedReferences(db, ends);
-				return sealed.map((seal) => seal !== null && ended.has(seal.seq) ? "ended" : null);
-			},
+			references: ends,
+			vet: ends.length === 0 ? void 0 : async (_, reads) => sealed.map((seal) => seal !== null && reads.ended.has(seal.seq) ? "ended" : null),
 			remote,
 			entry,
 			input
@@ -1858,11 +2468,9 @@ var VaultService = class {
 		});
 		const owners = /* @__PURE__ */ new Map();
 		const check = async (d) => {
-			const reader = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports), call.input);
+			const reader = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports, d.reads), call.input);
 			const at = secrets.map((secret, i) => call.places?.[i] ?? secret);
-			const environments = await environmentsById(d.tx, [...secrets, ...at].map((place) => place.environmentId));
-			const parents = [...environments.values()].flatMap((environment) => environment.owner === null || environment.parentId === null ? [] : [environment.parentId]);
-			for (const [id, parent] of await environmentsById(d.tx, parents)) environments.set(id, parent);
+			const environments = d.reads.environments;
 			const gone = (place) => environments.get(place.environmentId)?.deleted ?? false;
 			owners.clear();
 			for (const [id, environment] of environments) if (environment.owner !== null) owners.set(id, ownerKey(environment.owner));
@@ -1878,7 +2486,7 @@ var VaultService = class {
 				}
 				return refuses(reader, call.permission, placeIn(at[i], environments), gone(secret) || gone(at[i]));
 			});
-			if (call.vet !== void 0 && !codes.some((code) => code !== null)) (await call.vet(d.tx)).forEach((code, i) => codes[i] = code);
+			if (call.vet !== void 0 && !codes.some((code) => code !== null)) (await call.vet(d.tx, d.reads)).forEach((code, i) => codes[i] = code);
 			const copying = action === "secret.read" && call.input.purpose === "copy";
 			if (action === "secret.read" && principal.startsWith("user:") && handsBack({
 				purpose: call.input.purpose ?? "",
@@ -1887,9 +2495,17 @@ var VaultService = class {
 				if (codes[i] === null && secret.sensitive === true) codes[i] = "sensitive";
 			});
 			let first = codes.find((code) => code !== null) ?? null;
-			if (first === null && action === "secret.read" && await this.#overBulkLimit(d, principal, secrets.length)) first = "bulk_limit";
+			if (first === null && action === "secret.read" && this.#overBulkLimit(d)) first = "bulk_limit";
 			if (first !== null) throw new Refused(refusal(first, MESSAGES[first]), secrets.map((secret, i) => entry(secret, "deny", codes[i] ?? first)));
 		};
+		const reads = {
+			environments: [...secrets, ...secrets.map((secret, i) => call.places?.[i] ?? secret)].map((place) => place.environmentId),
+			references: call.references ?? [],
+			...action === "secret.read" ? { released: {
+				principal,
+				keys: secrets.map((secret) => secret.secretId)
+			} } : {}
+		};
 		const intentId = call.remote ? randomUUID() : null;
 		let intentSeq = null;
 		const outcomeEntry = (secret, item, decision, code) => {
@@ -1908,7 +2524,7 @@ var VaultService = class {
 		if (call.remote) {
 			const intent = await this.#decide([principal], async (d) => {
 				await check(d);
-				const at = await this.#now(d.tx);
+				const at = d.at;
 				return { seq: (await this.#append(d.tx, [{
 					actor: principal,
 					action: "key.intent",
@@ -1928,21 +2544,25 @@ var VaultService = class {
 							version: secret.version
 						}))
 					})
-				}])).seqStart };
-			});
+				}], [], d.reads)).seqStart };
+			}, false, reads);
 			if (!intent.ok) return intent;
 			intentSeq = intent.seq;
 		}
-		return this.#decide([principal], async (d) => {
+		const late = call.remote;
+		const decided = async (d) => {
 			try {
 				await check(d);
 			} catch (error) {
 				if (error instanceof Refused) throw new Refused(error.refusal, secrets.map((secret, item) => outcomeEntry(secret, item, "deny", error.entries[item].code ?? error.refusal.code)));
 				throw error;
 			}
+		};
+		return this.#decide([principal], async (d) => {
+			await decided(d);
 			const { vet } = call;
-			if (vet !== void 0) d.underLock.push(async (locked) => {
-				const codes = await vet(locked);
+			if (late && vet !== void 0) d.underLock.push(async (locked) => {
+				const codes = await vet(locked, d.reads);
 				const first = codes.find((code) => code !== null);
 				if (first === void 0 || first === null) return;
 				throw new Refused(refusal(first, MESSAGES[first]), secrets.map((secret, item) => outcomeEntry(secret, item, "deny", codes[item] ?? first)));
@@ -1957,16 +2577,12 @@ var VaultService = class {
 				if (unanswered > 0) throw new Outage(new KekUnavailableError(`the key service did not answer for ${unanswered} of ${secrets.length} keys`, outcomes.some((outcome) => !outcome.ok && outcome.code === "kms_uncertain")), entries());
 				if (expired) throw new Outage(new KekUnavailableError("key operation exceeded its deadline"), entries());
 				if (done.length < outcomes.length) throw new Refused(refusal("bad_claim", MESSAGES.bad_claim), entries());
-				await lockLogHead(d.tx);
-				try {
-					await check(d);
-				} catch (error) {
-					if (error instanceof Refused) throw new Refused(error.refusal, secrets.map((secret, item) => outcomeEntry(secret, item, "deny", error.entries[item].code ?? error.refusal.code)));
-					throw error;
+				if (late) {
+					d.reads = await this.#snapshot(d.tx, [principal], reads, true);
+					d.at = this.#at(d.reads);
+					await decided(d);
+					if (secrets.flatMap((secret, i) => [secret, call.places?.[i] ?? secret]).some((place) => d.reads.environments.get(place.environmentId)?.deleted ?? false)) throw new Refused(refusal("deleted", MESSAGES.deleted), secrets.map((secret, i) => outcomeEntry(secret, i, "deny", "deleted")));
 				}
-				const places = secrets.flatMap((secret, i) => [secret, call.places?.[i] ?? secret]);
-				const now = await environmentsById(d.tx, places.map((place) => place.environmentId));
-				if (places.some((place) => now.get(place.environmentId)?.deleted ?? false)) throw new Refused(refusal("deleted", MESSAGES.deleted), secrets.map((secret, i) => outcomeEntry(secret, i, "deny", "deleted")));
 				const released = secrets.map((secret, i) => outcomeEntry(secret, i, "allow", null));
 				d.log.push(...released);
 				const answer = result(done);
@@ -1975,12 +2591,16 @@ var VaultService = class {
 			} finally {
 				for (const value of done) value.wipe();
 			}
-		}, true);
+		}, late, reads);
 	}
-	/** Whether `n` more keys would take `principal` past the bulk limit; counted under their row's lock, so exactly. */
-	async #overBulkLimit(d, principal, n) {
-		const { count, windowMs } = this.#config.bulkLimit;
-		return await releasesSince(d.tx, principal, d.at - windowMs) + n > count;
+	/**
+	* Whether this read's keys would take the reader past the bulk limit: the
+	* distinct keys released to them in the window, these among them. A key
+	* read again exposes nothing new, so it counts once, whatever its version.
+	* Counted under their row's lock, so exactly (`Reads`).
+	*/
+	#overBulkLimit(d) {
+		return d.reads.released > this.#config.bulkLimit.count;
 	}
 	/**
 	* Make each holder a reference to its source: the actor writes the holder
@@ -2030,7 +2650,7 @@ var VaultService = class {
 			};
 		};
 		return this.#decide([principal], async (d) => {
-			const reader = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports), input);
+			const reader = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports, d.reads), input);
 			const natures$1 = await natures(d.tx, [...sources.values()].map((source) => source.secretId));
 			const environments = await environmentsById(d.tx, items.flatMap((item) => {
 				const source = sources.get(item.source.secretId);
@@ -2109,7 +2729,7 @@ var VaultService = class {
 			return seals.map((seal) => done.has(seal.seq) ? "ended" : null);
 		};
 		return this.#decide([principal], async (d) => {
-			const actor = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports), input);
+			const actor = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports, d.reads), input);
 			const environments = await environmentsById(d.tx, seals.map((seal) => seal.holder.environmentId));
 			const codes = seals.map((seal) => {
 				const holder = refuses(actor, "secret.write", placeIn(seal.holder, environments), false);
@@ -2210,7 +2830,7 @@ var VaultService = class {
 	*/
 	async #makeOwner(d, principal, reason) {
 		const row = d.members.get(principal);
-		const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
+		const subject = await this.#standing(d.tx, principal, row, d.at, d.reports, d.reads);
 		if (subject.status === "active" && ownsInstance(subject.live)) return false;
 		const tampered = subject.status === "tampered";
 		if (tampered && await this.#logged(d.tx, principal) === void 0) return false;
@@ -2264,10 +2884,10 @@ var VaultService = class {
 	* What `principal` holds, their row checked first (`#integrity`): a row
 	* that fails holds nothing, and is `tampered`.
 	*/
-	async #standing(db, principal, row, at, reports) {
+	async #standing(db, principal, row, at, reports, reads) {
 		const none = NOTHING;
-		const grants$1 = row === void 0 ? [] : await grants(db, principal);
-		const fault = await this.#integrity(db, principal, row, grants$1, reports);
+		const grants$1 = row === void 0 ? [] : reads?.grants.get(principal) ?? await grants(db, principal);
+		const fault = await this.#integrity(db, principal, row, grants$1, reports, reads);
 		if (fault !== null) return {
 			principal,
 			status: "tampered",
@@ -2297,7 +2917,7 @@ var VaultService = class {
 			role: grant.role
 		}));
 		const { role, scope } = roleOf(principal, row);
-		const { policy } = await this.#policyAt(db, reports, at);
+		const { policy } = await this.#policyAt(db, reports, at, reads);
 		const service = !principal.startsWith("user:");
 		return {
 			principal,
@@ -2357,13 +2977,17 @@ var VaultService = class {
 	/** `access`, as the rows are now. */
 	async #read(principal, superseded) {
 		const read = async (db, reports) => {
-			const [row, held, at] = await Promise.all([
-				member(db, principal),
-				grants(db, principal),
-				this.#now(db)
-			]);
-			const fault = await this.#integrity(db, principal, row, held, reports);
-			const { policy } = await this.#policyAt(db, reports, at);
+			const reads = await snapshot(db, {
+				principals: [principal],
+				members: true
+			});
+			const [row, held, at] = [
+				reads.members.get(principal),
+				reads.grants.get(principal),
+				this.#at(reads)
+			];
+			const fault = await this.#integrity(db, principal, row, held, reports, reads);
+			const { policy } = await this.#policyAt(db, reports, at, reads);
 			return this.#access(principal, row, held, at, fault !== null, policy);
 		};
 		const found = [];
@@ -2438,7 +3062,7 @@ var VaultService = class {
 				const expiresAt = change.expiresAt === null ? null : Date.parse(change.expiresAt);
 				if (Number.isNaN(expiresAt) || expiresAt !== null && expiresAt <= d.at) throw refused("invalid", "an end date must be in the future");
 			}
-			const { policy } = await this.#policyAt(d.tx, d.reports, d.at);
+			const { policy } = await this.#policyAt(d.tx, d.reports, d.at, d.reads);
 			for (const change of changes) {
 				if (change.role !== null && !isRole(change.role, policy)) throw refused("invalid", `no such role: ${change.role}`);
 				if (change.role !== null && change.environmentId !== null && !assignableToEnvironment(change.role, policy)) throw refused("invalid", `${change.role} can only be granted on a project`);
@@ -2454,13 +3078,13 @@ var VaultService = class {
 					environmentSlug: environment.slug
 				};
 			});
-			const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports), input);
+			const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports, d.reads), input);
 			if (acting.status === "tampered") throw refused("tampered");
 			const manages = where.every((place) => mayManageAccess(acting.live, place));
 			if (!manages && !(SERVICE.test(principal) && PERSON.test(actor))) throw refused("not_allowed");
 			if (actor === principal && changes.some((change) => change.role !== null)) throw refused("not_allowed", "nobody grants themselves a role: ask another admin");
 			const row = d.members.get(principal);
-			const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
+			const subject = await this.#standing(d.tx, principal, row, d.at, d.reports, d.reads);
 			if (subject.status === "tampered") throw refused("tampered", TAMPERED_SUBJECT);
 			const admitted = input.admit === true && row?.status !== "active" ? await this.#admitWith(d, acting, principal, row, input) : void 0;
 			if (admitted === void 0 && row?.status === "removed") throw refused("removed");
@@ -2560,7 +3184,7 @@ var VaultService = class {
 		const refused = (code, message = MESSAGES[code]) => new Refused(refusal(code, message), [accessEntry(actor, "member.add", principal, "deny", input, asked, code)]);
 		return this.#decide([actor, principal], async (d) => {
 			validateCorrelation(input);
-			const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports), input);
+			const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports, d.reads), input);
 			if (acting.status === "tampered") throw refused("tampered");
 			const service = SERVICE.test(principal) && (input.role ?? "member") === "member" && input.scope === void 0;
 			if (!runsInstance(acting.live)) await this.#setsUp(d, acting, service, refused);
@@ -2573,7 +3197,7 @@ var VaultService = class {
 			};
 			if (wanted !== void 0 && wanted.role !== "member" && !principal.startsWith("user:")) throw refused("invalid", "service accounts hold project grants only, never an instance role");
 			const row = d.members.get(principal);
-			const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
+			const subject = await this.#standing(d.tx, principal, row, d.at, d.reports, d.reads);
 			if (subject.status === "tampered") throw refused("tampered", TAMPERED_SUBJECT);
 			d.touched.add(principal);
 			d.grants.set(principal, [...subject.stored]);
@@ -2674,10 +3298,10 @@ var VaultService = class {
 			validateCorrelation(input);
 			if (!PRINCIPAL.test(principal)) throw refused("invalid", `not a member: ${shownMember(principal)}`);
 			const row = d.members.get(principal);
-			const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports), input);
+			const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports, d.reads), input);
 			if (acting.status === "tampered") throw refused("tampered");
 			const holder = acting.live;
-			const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
+			const subject = await this.#standing(d.tx, principal, row, d.at, d.reports, d.reads);
 			const held = subject.stored;
 			if (this.#listed(principal)) throw refused("not_allowed", declaredOwner(principal));
 			if (subject.status === "tampered") {
@@ -2760,7 +3384,7 @@ var VaultService = class {
 	* the default: otherwise whoever can insert rows could open it again.
 	*/
 	async #settingsAt(db, reports) {
-		const entry = await newestAuthentic((before) => newestVaultEntries(db, SETTINGS, LOOK_BACK.page, before), this.#check(reports, null));
+		const entry = await newestAuthentic((limit, before) => newestVaultEntries(db, SETTINGS, limit, before), this.#check(reports, null));
 		if (entry === "none") return DEFAULT_SETTINGS;
 		if (typeof entry === "string") return CLOSED_SETTINGS;
 		const { serviceAccounts } = JSON.parse(entry.metadata);
@@ -2781,20 +3405,21 @@ var VaultService = class {
 	* no role holds anything but Owner, otherwise whoever can insert rows
 	* could unprotect them. Its edits are then unknown, not none.
 	*/
-	async #policyAt(db, reports, at) {
-		const entry = await newestAuthentic((before) => newestVaultEntries(db, POLICY, LOOK_BACK.page, before), this.#check(reports, null));
+	async #policyAt(db, reports, at, reads) {
+		const entry = await newestAuthentic((limit, before) => reads !== void 0 && before === void 0 ? Promise.resolve(reads.newestPolicy === null ? [] : [reads.newestPolicy]) : newestVaultEntries(db, POLICY, limit, before), this.#check(reports, null));
 		if (entry === "none") return {
 			policy: DEFAULT_POLICY,
 			edits: NO_EDITS,
 			readable: true
 		};
 		const edits = typeof entry === "string" ? null : readEdits(JSON.parse(entry.metadata));
-		return edits === null ? {
+		if (edits === null) return {
 			policy: CLOSED_POLICY,
 			edits: NO_EDITS,
 			readable: false
-		} : {
-			policy: await livePolicy(db, edits, at),
+		};
+		return {
+			policy: livePolicy(entry === reads?.newestPolicy ? reads.environments : await environmentsById(db, edits.protected.map((place) => place.environmentId)), edits, at),
 			edits,
 			readable: true
 		};
@@ -2819,11 +3444,11 @@ var VaultService = class {
 		const refused = (code, message = MESSAGES[code]) => new Refused(refusal(code, message), [entry("deny", { change: describeChange(change) }, code)]);
 		return this.#decide([actor], async (d) => {
 			validateCorrelation(input);
-			const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports), input);
+			const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports, d.reads), input);
 			if (acting.status === "tampered") throw refused("tampered");
 			if (acting.status !== "active") throw refused(acting.status === "removed" ? "removed" : "not_a_member");
-			const newest = await newestVaultSeq(d.tx, POLICY);
-			const { policy: before, edits, readable } = await this.#policyAt(d.tx, d.reports, d.at);
+			const newest = d.reads.newestPolicy?.seq ?? null;
+			const { policy: before, edits, readable } = await this.#policyAt(d.tx, d.reports, d.at, d.reads);
 			if (revision !== void 0 && policyRevision(newest, before) !== revision) throw refused("policy_changed");
 			const owner = acting.live.credentialScope == null && ownsInstance(acting.live);
 			if (!readable && !owner) throw refused("not_allowed", "the vault cannot read its own policy: only an Owner of the whole instance writes it again, from the roles as they ship");
@@ -2879,7 +3504,7 @@ var VaultService = class {
 				}
 			} else throw refused("invalid", "a change is to a role, an instance role, or protection");
 			const answer = {
-				policy: await livePolicy(d.tx, next, d.at),
+				policy: livePolicy(await environmentsById(d.tx, next.protected.map((place) => place.environmentId)), next, d.at),
 				seq: newest === null ? null : Number(newest)
 			};
 			if (!readable || JSON.stringify(next) !== JSON.stringify(edits)) {
@@ -2911,7 +3536,7 @@ var VaultService = class {
 		const refused = (code, message = MESSAGES[code]) => new Refused(refusal(code, message), [entry("deny", { serviceAccounts: input.settings?.serviceAccounts ?? null }, code)]);
 		return this.#decide([actor], async (d) => {
 			validateCorrelation(input);
-			const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports), input);
+			const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports, d.reads), input);
 			if (acting.status === "tampered") throw refused("tampered");
 			if (!runsInstance(acting.live)) throw refused("not_allowed", "only admins and owners of the whole instance change its settings");
 			if (!isScope(input.settings?.serviceAccounts)) throw refused("invalid", "who sets up service accounts is a scope: { projects, environments }, each all, only or except");
@@ -3077,63 +3702,162 @@ var VaultService = class {
 		}
 		return checks;
 	}
-	/** The last checkpoint the vault signed, and the entry that holds it: its newest allowed `audit.checkpoint`. */
-	async #latest(db) {
-		const row = await latestVaultEntry(db, [CHECKPOINT]);
-		return row === void 0 ? null : {
-			checkpoint: JSON.parse(row.metadata),
-			seq: row.seq,
-			keyId: row.keyId
+	/**
+	* Where a walk of the log resumes: the first entry (`start`), a
+	* checkpoint's entry that keeps a tally, or the newest such entry, the
+	* first entry while there is none. The entry must be the vault's, by its
+	* MAC, and its tally whole: the members and grants it keeps, or the
+	* earlier checkpoint it names keeps, match the digest it carries.
+	*
+	* Its signature is left to the walk: the entry comes after the prefix it
+	* signs, so a walk from there reads it, as it reads every other.
+	*/
+	async #resume(db, from) {
+		if (from === "start") return FIRST_ENTRY;
+		const entry = from === "newest" ? await latestTallied(db) : (await entriesAt(db, [from])).get(from);
+		if (entry === void 0) return from === "newest" ? FIRST_ENTRY : {
+			ok: false,
+			failedAtSeq: Number(from),
+			reason: "no checkpoint at this entry"
 		};
+		return (await this.#resumeEach(db, [entry]))[0];
+	}
+	/** `#resume` for each of these checkpoint entries, the entries their members and grants are kept in read at once. */
+	async #resumeEach(db, entries) {
+		const reads = entries.map((entry) => this.#tallied(entry));
+		const named = reads.flatMap((read) => typeof read !== "string" && "at" in read.tally.access ? [BigInt(read.tally.access.at)] : []);
+		const carriers = new Map([...await entriesAt(db, named)].map(([seq, held]) => [seq, this.#tallied(held)]));
+		return entries.map((entry, i) => {
+			const broken = (reason) => ({
+				ok: false,
+				failedAtSeq: Number(entry.seq),
+				reason
+			});
+			const read = reads[i];
+			if (typeof read === "string") return broken(read);
+			let carrier = entry.seq;
+			let { access } = read.tally;
+			if ("at" in access) {
+				carrier = BigInt(access.at);
+				const holder = carrier < entry.seq ? carriers.get(carrier) : void 0;
+				if (holder === void 0 || typeof holder === "string" || "at" in holder.tally.access) return broken(`its tally keeps its members and grants in entry ${carrier}, which holds none`);
+				access = holder.tally.access;
+			}
+			const kept = {
+				members: access.members,
+				grants: access.grants,
+				newest: access.newest
+			};
+			if (keptDigest(access) !== read.tally.access.digest) return broken("its tally's members and grants do not match their digest");
+			return {
+				ok: true,
+				entry: entry.seq,
+				at: {
+					seq: BigInt(read.seq),
+					hash: Buffer.from(read.hash, "hex")
+				},
+				tally: {
+					...read.tally,
+					access: kept
+				},
+				digest: read.tally.access.digest,
+				carrier,
+				scrub: read.scrub === null ? null : {
+					at: positionOf(read.scrub.at),
+					end: positionOf(read.scrub.end)
+				}
+			};
+		});
+	}
+	/** A checkpoint's entry that keeps a tally, as it says, or why it is not one the vault wrote. */
+	#tallied(entry) {
+		const not = "not a checkpoint of the vault's that keeps a tally";
+		if (entry.author !== "vault" || entry.action !== "audit.checkpoint" || entry.decision !== "allow" || entry.relatedSeq === null) return not;
+		const authentic = verifyEntries([entry], {
+			startSeq: entry.seq,
+			startPrevHash: entry.prevHash,
+			keys: this.#keysFor(entry)
+		});
+		if (!authentic.ok) return withCause(authentic.reason);
+		const read = metadataOf(entry);
+		if (read?.tally?.v !== 1 || read.scrub === void 0 || typeof read.seq !== "number" || BigInt(read.seq) !== entry.relatedSeq) return not;
+		return read;
+	}
+	/** Which of `heads` the log still holds where they were, in one read. */
+	async #holding(db, heads) {
+		const hashes = await hashesAt(db, [...new Set(heads.filter((head) => head.seq >= 0).map((head) => BigInt(head.seq)))]);
+		return (head) => head.hash === GENESIS_HASH.toString("hex") || hashes.get(BigInt(head.seq))?.toString("hex") === head.hash;
 	}
 	/**
-	* The chain recomputed to its last entry, for a checkpoint to sign: from
-	* its first entry at the first checkpoint of each hour, and otherwise from
-	* the prefix the last checkpoint signed, if that one was signed this hour.
+	* Sign the log up to its last entry, from the newest checkpoint's tally.
 	*
-	* Resuming never signs what the vault did not recompute. The vault
-	* recomputed the last checkpoint's prefix itself, from entry 0 at the
-	* hour's first checkpoint and onward at each one since, and the entry
-	* that holds it is the first one checked again, by its MAC. The next
-	* signature extends that same chain.
+	* In one snapshot, and without the log's lock, so that no append waits on
+	* it: every member's row checked, since rows changed around the vault
+	* write nothing to the log; the prefix the newest checkpoint signed still
+	* there, its hash where it was, which a rewrite chained again changes, and
+	* every entry of it, which a cut changes; the chain recomputed from there,
+	* every hash from content and every vault entry by its MAC, no further
+	* than one walk (`walks.checkpoint`); and a stretch of the prefixes signed
+	* before rehashed (`#scrub`). Then, under the lock, the entries appended
+	* since the snapshot, so that it signs the head.
 	*
-	* What resuming does not do is recompute the rows of that prefix again.
-	* They can change while the hash stored at its end stays, so it first
-	* checks the two things that are cheap: that hash is still there, which a
-	* prefix rewritten and chained again changes, and every entry of the
-	* prefix is, which a cut changes. Either failing, it recomputes from entry
-	* 0, which names what broke. An entry edited in place, its hash left as
-	* it was, is the one change left to the next full pass, within the hour.
-	*
-	* It resumes only from a checkpoint under the key the vault writes with
-	* now: once the log reaches that key, no other writes again (`forward`).
-	* After a rotation, the next pass is full.
+	* A walk cut short signs where it got to, behind the head: the log after
+	* an upgrade from 0.10.0, whose checkpoints kept no tally, is signed again
+	* from the first entry, one walk a call, and `/readyz` stays red until the
+	* checkpoints reach the newest heartbeat.
 	*/
-	async #recompute(tx) {
-		const { logKeys } = this.#prepared;
-		const latest = await this.#latest(tx);
-		const hour = (ms) => Math.floor(ms / FULL_RECOMPUTE_MS);
-		if (!(latest !== null && latest.keyId === logKeys[0].keyId && latest.seq === BigInt(latest.checkpoint.seq) + 1n && hour(Date.parse(latest.checkpoint.signedAt)) === hour(await this.#now(tx)) && await carries(tx, latest.checkpoint) && await complete(tx, BigInt(latest.checkpoint.seq)))) return verifyChain(tx, logKeys, [], UNVERIFIED);
-		const { seq, hash } = latest.checkpoint;
-		return verifyChain(tx, logKeys, [], {
-			nextSeq: BigInt(seq) + 1n,
-			hash: Buffer.from(hash, "hex"),
-			vaultEntries: 0,
-			vaultKeys: [logKeys[0].keyId]
-		});
-	}
 	async checkpoint() {
 		await this.#settled();
-		const { wrongKek } = this.#prepared;
+		const { wrongKek, logKeys } = this.#prepared;
+		const { walks } = this.#prepared.options;
 		const found = [];
-		const whole = await this.#db.transaction(async (tx) => {
+		let seen = null;
+		const walked = await this.#db.transaction(async (tx) => {
+			seen = (await newestCheckpointEntry(tx))?.seq ?? null;
 			await this.#sweep(tx, found);
-			return this.#recompute(tx);
+			const from = await this.#resume(tx, "newest");
+			if (!from.ok) return from;
+			const signed = headOf(from.at);
+			if (!(await this.#holding(tx, [signed]))(signed)) return {
+				ok: false,
+				failedAtSeq: null,
+				reason: `the log up to entry ${signed.seq} is not the prefix the last checkpoint signed`
+			};
+			const gap = await missingEntry(tx, from.at.seq);
+			if (gap !== null) return {
+				ok: false,
+				failedAtSeq: Number(gap.found),
+				reason: `sequence gap: expected seq ${gap.expected}, found ${gap.found}`
+			};
+			const walk = new Walk(from.tally, from.digest);
+			const chain = await rehash(tx, logKeys, from.at, walk, { limit: walks.checkpoint });
+			if (!chain.ok) return chain;
+			const unsigned = await this.#checkpointFault(tx, walk.checkpoints);
+			if (unsigned !== null) return unsigned;
+			return {
+				ok: true,
+				from,
+				tally: walk.tally(),
+				digest: walk.digest(),
+				at: chain.at,
+				done: chain.done
+			};
 		}, SNAPSHOT);
+		let scrub = {
+			ok: true,
+			next: walked.ok ? walked.from.scrub : null
+		};
+		let stalled = null;
+		if (walked.ok) try {
+			scrub = await this.#db.transaction((tx) => this.#scrub(tx, walked.from), SNAPSHOT);
+		} catch (error) {
+			if (!isUnreachable(error) && !timedOut(error)) throw error;
+			stalled = `the rehash of the past did not run, and goes on where it was next time: ${error.message}`;
+		}
 		return this.#decide([], async (d) => {
 			for (const entry of found) if (!d.reports.includes(entry)) d.reports.push(entry);
 			const head = await lockLogHead(d.tx);
-			const latest = await this.#latest(d.tx);
+			const latest = await latestVaultEntry(d.tx, [CHECKPOINT]);
 			const refused = (code, detail, message = MESSAGES[code]) => new Refused(refusal(code, message), [{
 				actor: SCHEDULER,
 				action: CHECKPOINT,
@@ -3143,21 +3867,57 @@ var VaultService = class {
 			}]);
 			if (head.nextSeq === 0n) throw new Refused(refusal("invalid", "the log is empty"), []);
 			if (wrongKek !== null) throw refused("wrong_kek", { reason: wrongKek }, wrongKek);
-			if (!whole.verification.ok) throw refused("log_broken", {
-				failedAtSeq: whole.verification.failedAtSeq,
-				reason: whole.verification.reason
+			if (!walked.ok) throw refused("log_broken", {
+				failedAtSeq: walked.failedAtSeq,
+				reason: walked.reason
 			});
-			if (latest !== null && latest.seq === head.nextSeq - 1n) return { checkpoint: latest.checkpoint };
-			if (latest !== null && !await carries(d.tx, latest.checkpoint)) throw refused("log_broken", { reason: `the log up to entry ${latest.checkpoint.seq} is not the prefix the last checkpoint signed` });
-			const { verification: held, anchor: verified } = await verifyChain(d.tx, this.#prepared.logKeys, [], whole.anchor);
-			if (!held.ok) throw refused("log_broken", {
-				failedAtSeq: held.failedAtSeq,
-				reason: held.reason
+			if (!scrub.ok) throw refused("log_broken", {
+				failedAtSeq: scrub.failedAtSeq,
+				reason: scrub.reason
 			});
-			if (verified.nextSeq !== head.nextSeq || !verified.hash.equals(head.headHash)) throw refused("log_broken", { reason: "the chain head does not name the last entry" });
+			const newest = latest === void 0 ? null : JSON.parse(latest.metadata);
+			if (stalled !== null || ((await newestCheckpointEntry(d.tx))?.seq ?? null) !== seen) {
+				const standing = await this.#standingRefusal(d.tx);
+				if (standing !== null) throw refused("log_broken", standing);
+				if (stalled === null && newest !== null) return { checkpoint: signedPart(newest) };
+			}
+			if (newest !== null && latest.seq === head.nextSeq - 1n && latest.relatedSeq === latest.seq - 1n) return { checkpoint: signedPart(newest) };
+			if (newest !== null && !await carries(d.tx, newest)) throw refused("log_broken", { reason: `the log up to entry ${newest.seq} is not the prefix the last checkpoint signed` });
+			const walk = new Walk(walked.tally, walked.digest);
+			let { at } = walked;
+			if (walked.done) {
+				if (!await carries(d.tx, headOf(at))) throw refused("log_broken", {
+					failedAtSeq: Number(at.seq),
+					reason: `the log up to entry ${at.seq} changed while the vault walked it`
+				});
+				const rest = await rehash(d.tx, logKeys, at, walk, {});
+				if (!rest.ok) throw refused("log_broken", {
+					failedAtSeq: rest.failedAtSeq,
+					reason: rest.reason
+				});
+				const unsigned = await this.#checkpointFault(d.tx, walk.checkpoints);
+				if (unsigned !== null) throw refused("log_broken", {
+					failedAtSeq: unsigned.failedAtSeq,
+					reason: unsigned.reason
+				});
+				at = rest.at;
+				if (at.seq !== head.nextSeq - 1n || !at.hash.equals(head.headHash)) throw refused("log_broken", { reason: "the chain head does not name the last entry" });
+			} else if (!await carries(d.tx, headOf(at))) throw refused("log_broken", { reason: `the log up to entry ${at.seq} changed while the vault walked it` });
+			if (newest !== null && latest.relatedSeq !== null && latest.relatedSeq >= at.seq) return { checkpoint: signedPart(newest) };
+			this.#prepared.verified = further(this.#prepared.verified, at);
+			const tally = walk.tally();
+			const digest = walk.digest();
+			const { from } = walked;
+			const access = digest === from.digest && from.carrier !== null ? {
+				digest,
+				at: Number(from.carrier)
+			} : {
+				digest,
+				...tally.access
+			};
 			const signed = {
-				seq: Number(verified.nextSeq - 1n),
-				hash: verified.hash.toString("hex"),
+				seq: Number(at.seq),
+				hash: at.hash.toString("hex"),
 				signedAt: iso(d.at)
 			};
 			const checkpoint = {
@@ -3165,15 +3925,85 @@ var VaultService = class {
 				keyId: this.#prepared.signer.keyId,
 				signature: await this.#prepared.signer.sign(checkpointMessage(signed))
 			};
+			const lap = scrub.next === null ? null : {
+				at: headOf(scrub.next.at),
+				end: headOf(scrub.next.end)
+			};
+			const kept = {
+				...checkpoint,
+				tally: {
+					v: 1,
+					...tally,
+					access
+				},
+				scrub: lap
+			};
 			d.log.push({
 				actor: SCHEDULER,
 				action: CHECKPOINT,
 				decision: "allow",
-				metadata: JSON.stringify(checkpoint)
+				relatedSeq: at.seq,
+				metadata: JSON.stringify(kept)
 			});
-			return { checkpoint };
+			return stalled === null ? { checkpoint } : {
+				checkpoint,
+				warning: stalled
+			};
 		});
 	}
+	/**
+	* The prefixes signed before, rehashed a stretch at a time, in laps: a lap
+	* runs from the first entry to the prefix the newest checkpoint signed
+	* when it began, which it keeps (`end`), `walks.scrub` entries a call, each
+	* hash recomputed from its entry and each link checked (`relink`); the
+	* next lap runs to the prefix signed then. A checkpoint resumes from the
+	* newest one's tally and never reads what it signed again, and an entry
+	* before it edited in place, its stored hash left as it was, keeps the
+	* chain: this is what finds it, within two laps at most, each the length
+	* of the log when it began over `walks.scrub` beats, however fast the log
+	* grows meanwhile. The lap as it goes on, null between laps.
+	*/
+	async #scrub(db, newest) {
+		const lap = newest.scrub ?? {
+			at: START,
+			end: newest.at
+		};
+		if (lap.end.seq < 0n) return {
+			ok: true,
+			next: null
+		};
+		const relinked = await relink(db, lap.at, lap.end.seq, this.#prepared.options.walks.scrub);
+		if (!relinked.ok) return relinked;
+		if (relinked.at.seq < lap.end.seq) return {
+			ok: true,
+			next: {
+				at: relinked.at,
+				end: lap.end
+			}
+		};
+		if (!relinked.at.hash.equals(lap.end.hash)) return {
+			ok: false,
+			failedAtSeq: Number(lap.end.seq),
+			reason: `the log up to entry ${lap.end.seq} is not the prefix a checkpoint signed`
+		};
+		return {
+			ok: true,
+			next: null
+		};
+	}
+	/**
+	* The newest refusal for a broken log since the newest checkpoint was
+	* signed, by the vault's MAC, as it said: it stands, for every
+	* verification and checkpoint, until a checkpoint is signed, which takes
+	* the check that found it running again and passing. A refusal of
+	* another kind since, a wrong KEK, hides none.
+	*/
+	async #standingRefusal(db) {
+		const signed = await latestVaultEntry(db, [CHECKPOINT]);
+		const refused = await newestRefusal(db, CHECKPOINT, "log_broken", signed?.seq ?? -1n);
+		if (refused === void 0 || !this.#authentic(refused)) return null;
+		return JSON.parse(refused.metadata);
+	}
 	async about() {
 		await this.#settled();
 		const { signers, since } = this.#prepared;
@@ -3202,65 +4032,181 @@ var VaultService = class {
 			checks
 		};
 	}
-	verifyLog(input) {
-		return this.#verifyAll(input.upTo ?? null);
-	}
 	/**
-	* The whole log, in one snapshot and one pass over the vault's entries:
-	* each by its MAC, the keys it moved through, and what the other checks
-	* need of it, gathered as it goes (`Findings`); then every checkpoint, the
-	* heads that must still be there, the key batches accounted for, and the
-	* members and grants replayed.
+	* The log from a checkpoint's tally, in one snapshot: the vault's
+	* entries since, each by its MAC, the keys it moved through, and what the
+	* other checks need of it (`Walk`); then every checkpoint walked, the
+	* heads that must still be there, and, for a walk that ends at the
+	* present, the key batches accounted for and the members and grants
+	* replayed against their rows.
 	*
 	* With `upTo`, the head the app verified to, the links and hashes of the
-	* chain are the app's to recompute, as it just has, over its own snapshot,
-	* through that head; `carries(upTo)` ties this snapshot to that one. So
-	* the vault reads only its own entries, each checked against its own hash
-	* and MAC over the link it names. Without `upTo`, nobody else recomputed
-	* the chain: the vault reads it all, and rehashes every link.
+	* chain are the app's to recompute, as it just has, over its own
+	* snapshot, through that head; holding `upTo` ties this snapshot to that
+	* one. So the vault reads only its own entries, each checked against its
+	* own hash and MAC over the link it names. Without `upTo`, nobody else
+	* recomputed the chain: the vault reads it all, and rehashes every link,
+	* no further than one walk (`walks.verify`).
 	*/
-	async #verifyAll(upTo) {
+	async verifyLog(input) {
 		await this.#settled();
+		const upTo = input.upTo ?? null;
+		const { logKeys } = this.#prepared;
+		const { walks } = this.#prepared.options;
 		return this.#db.transaction(async (tx) => {
 			const remembered = this.#prepared.verified;
-			const findings = new Findings();
-			const read = upTo === null ? await this.#rehashed(tx, findings) : await this.#ownEntries(tx, findings);
-			if (!read.ok) return read;
-			const heads = [...upTo === null ? [] : [upTo], ...findings.checkpoints.map(({ checkpoint }) => checkpoint)];
-			const rememberedHead = remembered.nextSeq > 0n ? {
-				seq: Number(remembered.nextSeq - 1n),
-				hash: remembered.hash.toString("hex")
-			} : null;
-			if (rememberedHead !== null) heads.push(rememberedHead);
-			const hashes = await hashesAt(tx, [...new Set(heads.map((head) => BigInt(head.seq)))]);
-			const holds = (head) => head.hash === GENESIS_HASH.toString("hex") || hashes.get(BigInt(head.seq))?.toString("hex") === head.hash;
+			const from = await this.#resume(tx, input.from === void 0 ? "newest" : input.from === "start" ? "start" : BigInt(input.from));
+			if (!from.ok) return from;
+			const to = input.to === void 0 ? null : BigInt(input.to);
+			const ends = to === null ? null : (await entriesAt(tx, [to])).get(to)?.relatedSeq ?? -1n;
+			if (ends !== null && (ends <= from.at.seq || upTo !== null && BigInt(upTo.seq) !== ends)) return {
+				ok: false,
+				failedAtSeq: Number(to),
+				reason: "not a checkpoint after the one the walk starts from, whose prefix ends where the app verified to"
+			};
+			if (!(await this.#holding(tx, [headOf(from.at)]))(headOf(from.at))) return {
+				ok: false,
+				failedAtSeq: Number(from.entry),
+				reason: `the log up to entry ${from.at.seq} is not the prefix this checkpoint signed: it was rewritten`
+			};
+			const gap = await missingEntry(tx, from.at.seq);
+			if (gap !== null) return {
+				ok: false,
+				failedAtSeq: Number(gap.found),
+				reason: `sequence gap: expected seq ${gap.expected}, found ${gap.found}`
+			};
+			const walk = new Walk(from.tally, from.digest);
+			const passed = (await talliedAfter(tx, from.entry ?? -1n, walks.verify)).filter(({ seq }) => to === null || seq <= to);
+			if (to !== null && passed.at(-1)?.seq !== to) return {
+				ok: false,
+				failedAtSeq: Number(to),
+				reason: `a stretch passes no more than ${walks.verify} checkpoints: end one sooner`
+			};
+			const holding = /* @__PURE__ */ new Map();
+			const carried = async (carrier) => {
+				if (!holding.has(carrier)) {
+					const entry = (await entriesAt(tx, [carrier])).get(carrier);
+					const read = entry === void 0 ? "missing" : this.#tallied(entry);
+					holding.set(carrier, typeof read === "string" || "at" in read.tally.access ? null : keptDigest(read.tally.access));
+				}
+				return holding.get(carrier);
+			};
+			const expected = [];
+			let endSigned = null;
+			for (let after = from.entry ?? -1n, last = passed.at(-1)?.seq; last !== void 0 && after < last;) {
+				const batch = await talliedWithin(tx, after, last, walks.verify + 1);
+				if (batch.length === 0) break;
+				for (const entry of batch) {
+					const read = this.#tallied(entry);
+					const point = {
+						entry: entry.seq,
+						through: entry.relatedSeq
+					};
+					if (typeof read === "string") {
+						expected.push({
+							...point,
+							unreadable: read
+						});
+						continue;
+					}
+					if (entry.seq === to) endSigned = read.hash;
+					const { access } = read.tally;
+					if (!("at" in access)) holding.set(entry.seq, keptDigest(access));
+					const kept = "at" in access ? BigInt(access.at) < entry.seq ? await carried(BigInt(access.at)) : null : holding.get(entry.seq);
+					expected.push(kept === access.digest ? {
+						...point,
+						key: expectedKey(read.tally)
+					} : {
+						...point,
+						unreadable: kept === null ? `its tally keeps its members and grants in entry ${"at" in access ? access.at : entry.seq}, which holds none` : "its tally's members and grants do not match their digest"
+					});
+				}
+				after = batch.at(-1).seq;
+			}
+			walk.expect(expected);
+			let through = from.at.seq;
+			let reached = headOf(from.at).hash;
+			let present = false;
+			if (upTo === null) {
+				const chain = await rehash(tx, logKeys, from.at, walk, ends === null ? { limit: walks.verify } : { to: ends });
+				if (!chain.ok) return chain;
+				[through, reached, present] = [
+					chain.at.seq,
+					headOf(chain.at).hash,
+					chain.done && ends === null
+				];
+				this.#prepared.verified = further(this.#prepared.verified, chain.at);
+			} else {
+				const own = await ownEntries(tx, logKeys, from.at.seq, walk, ends === null ? { limit: walks.verify } : { to: ends });
+				if (!own.ok) return own;
+				if (!own.done && input.from === void 0) return {
+					ok: false,
+					failedAtSeq: null,
+					reason: `the vault verifies no more than ${walks.verify} of its entries a call, and its checkpoints are catching up: update the app`
+				};
+				const short = own.at < BigInt(upTo.seq) ? own.at : BigInt(upTo.seq) - 1n;
+				[through, reached, present] = [
+					own.done ? BigInt(upTo.seq) : short,
+					upTo.hash,
+					own.done && ends === null
+				];
+			}
+			walk.finish(ends ?? through);
+			const rememberedHead = remembered.seq >= 0n ? headOf(remembered) : null;
+			const heads = [...upTo === null ? [] : [upTo], ...rememberedHead === null ? [] : [rememberedHead]];
+			const holds = await this.#holding(tx, [...heads, ...walk.checkpoints.map(({ checkpoint }) => checkpoint)]);
 			if (upTo !== null && !holds(upTo)) return {
 				ok: false,
 				failedAtSeq: upTo.seq,
 				reason: "not the entry the app verified up to: the log changed between the two checks"
 			};
-			const unsigned = await this.#checkpointFault(findings, holds);
+			const unsigned = await this.#checkpointFault(tx, walk.checkpoints, holds);
 			if (unsigned !== null) return unsigned;
 			if (rememberedHead !== null && !holds(rememberedHead)) return {
 				ok: false,
 				failedAtSeq: rememberedHead.seq,
 				reason: "changed since the vault last verified it"
 			};
+			if (walk.mismatch !== null) return {
+				ok: false,
+				failedAtSeq: Number(walk.mismatch.entry),
+				reason: walk.mismatch.reason
+			};
+			if (ends !== null) {
+				if (upTo === null && through !== ends || endSigned !== reached) return {
+					ok: false,
+					failedAtSeq: Number(to),
+					reason: `the log up to entry ${ends} is not the prefix this checkpoint signed: it was rewritten`
+				};
+				return {
+					ok: true,
+					entries: walk.entries,
+					through: Number(ends)
+				};
+			}
+			const standing = await this.#standingRefusal(tx);
+			if (standing !== null) return {
+				ok: false,
+				failedAtSeq: standing.failedAtSeq ?? null,
+				reason: `the last checkpoint was refused: ${standing.reason ?? "the log is broken"}`
+			};
+			const verified = {
+				ok: true,
+				entries: walk.entries,
+				through: Number(through)
+			};
+			if (!present) return verified;
 			const at = await this.#now(tx);
-			const accounting = findings.accounting.result(at);
+			const accounting = walk.accounting.result(at);
 			if (!accounting.ok) return accounting;
 			const [rows, held] = await Promise.all([allMembers(tx), grants(tx)]);
-			const fault = this.#unsealed(rows, held, findings.newestAccess) ?? findings.replayFault ?? replayFault(findings.replayed, rows, held, at);
+			const fault = this.#unsealed(rows, held, walk.newestAccess) ?? walk.replayFault ?? replayFault(walk.replayed, rows, held, at);
 			if (fault !== null) return {
 				ok: false,
 				failedAtSeq: null,
 				reason: describeAccessFault(fault),
 				fault
 			};
-			const verified = {
-				ok: true,
-				entries: findings.entries
-			};
 			return accounting.pending === 0 ? verified : {
 				...verified,
 				pending: accounting.pending
@@ -3268,55 +4214,15 @@ var VaultService = class {
 		}, SNAPSHOT);
 	}
 	/**
-	* The vault's own entries, oldest first: each against its own hash, and by
-	* its MAC, over the link it names, which the app checked; and the vault's
-	* keys moving only forward through them.
-	*/
-	async #ownEntries(tx, findings) {
-		const { logKeys } = this.#prepared;
-		let keys = [];
-		for (let after = -1n;;) {
-			const batch = await vaultEntriesAfter(tx, after, VERIFY_BATCH);
-			if (batch.length === 0) return { ok: true };
-			for (const entry of batch) {
-				const result = verifyEntries([entry], {
-					startSeq: entry.seq,
-					startPrevHash: entry.prevHash,
-					keys: logKeys
-				});
-				if (!result.ok) return {
-					ok: false,
-					failedAtSeq: Number(result.failedAtSeq),
-					reason: withCause(result.reason)
-				};
-			}
-			const moved = forward(batch, keys, logKeys[0].keyId);
-			if ("failedAtSeq" in moved) return {
-				ok: false,
-				failedAtSeq: Number(moved.failedAtSeq),
-				reason: moved.reason
-			};
-			keys = moved.keys;
-			for (const entry of batch) findings.add(entry);
-			after = batch[batch.length - 1].seq;
-		}
-	}
-	/** The whole chain from its first entry: every link and hash, the vault's MACs; the furthest verified is kept for checkpoints. */
-	async #rehashed(tx, findings) {
-		const { verification, anchor } = await verifyChain(tx, this.#prepared.logKeys, [], UNVERIFIED, (batch) => {
-			for (const entry of batch) if (entry.author === "vault") findings.add(entry);
-		});
-		if (!verification.ok) return verification;
-		this.#prepared.verified = further(this.#prepared.verified, anchor);
-		return { ok: true };
-	}
-	/**
-	* Every checkpoint, not only the newest: each signed by the key whose log
-	* key wrote its entry, over a prefix the log still holds (`holds`), entry
-	* for entry. Its entry's MAC is checked by now, and one under a key the
-	* vault replaced comes before the rotation.
+	* Every checkpoint walked, not only the newest: each signed by the key
+	* whose log key wrote its entry, over a prefix the log still holds,
+	* entry for entry, which one that keeps a tally names as related. Its
+	* entry's MAC is checked by now, and one under a key the vault replaced
+	* comes before the rotation.
 	*/
-	async #checkpointFault(findings, holds) {
+	async #checkpointFault(db, checkpoints, known) {
+		if (checkpoints.length === 0) return null;
+		const holds = known ?? await this.#holding(db, checkpoints.map(({ checkpoint }) => checkpoint));
 		const { logKeys, signers } = this.#prepared;
 		const verifiers = /* @__PURE__ */ new Map();
 		const signed = (checkpoint, by) => {
@@ -3324,14 +4230,13 @@ var VaultService = class {
 			if (verifier === void 0) verifiers.set(by.keyId, verifier = checkpointVerifier(by.publicKey));
 			return verifier.then((verify) => verify(checkpoint));
 		};
-		const { checkpoints } = findings;
 		for (let from = 0; from < checkpoints.length; from += SIGNATURES_AT_ONCE) {
 			const chunk = checkpoints.slice(from, from + SIGNATURES_AT_ONCE);
 			const faults = await Promise.all(chunk.map(async ({ entry, checkpoint }) => {
 				const by = signers[logKeys.findIndex((key) => key.keyId === entry.keyId)];
 				if (by?.keyId !== checkpoint.keyId) return `a checkpoint signed under ${checkpoint.keyId}, in an entry written under ${entry.keyId}: each key signs only its own`;
 				if (!await signed(checkpoint, by)) return "a checkpoint the vault did not sign";
-				if (BigInt(checkpoint.seq) >= entry.seq || !holds(checkpoint)) return `the log up to entry ${checkpoint.seq} is not the prefix this checkpoint signed: it was rewritten`;
+				if (BigInt(checkpoint.seq) >= entry.seq || !holds(checkpoint) || entry.relatedSeq !== null && entry.relatedSeq !== BigInt(checkpoint.seq)) return `the log up to entry ${checkpoint.seq} is not the prefix this checkpoint signed: it was rewritten`;
 				return null;
 			}));
 			const at = faults.findIndex((fault) => fault !== null);
@@ -3345,8 +4250,8 @@ var VaultService = class {
 	}
 	/**
 	* The first member whose row fails its MAC, or names an older access
-	* entry than the log's newest about them (`newest`, from the full check's
-	* pass, where each entry's MAC was checked).
+	* entry than the log's newest about them (`newest`, from the walk, where
+	* each entry's MAC was checked, on from the tally).
 	*/
 	#unsealed(rows, held, newest) {
 		for (const row of rows) {
@@ -3365,44 +4270,71 @@ var VaultService = class {
 		return null;
 	}
 };
+/** Whether a statement was cancelled for taking too long: Postgres's `query_canceled`, a statement timeout among them. */
+function timedOut(error) {
+	for (let cause = error; typeof cause === "object" && cause !== null; cause = cause.cause) if (cause.code === "57014") return true;
+	return false;
+}
+const FIRST_ENTRY = {
+	ok: true,
+	entry: null,
+	at: START,
+	tally: EMPTY_TALLY,
+	digest: accessDigest(EMPTY_TALLY.access),
+	carrier: null,
+	scrub: null
+};
 /**
-* What one pass over the vault's entries gathers for the other checks of a
-* full verification, so that the log is read once: the key batches, the
-* access entries replayed, each member's newest, and the checkpoints. Each
-* entry comes after its MAC was checked.
+* A walk rehashes, MACs and replays some 40 µs of CPU an entry, and 95
+* with V8's optimizer off, as on a cold isolate: 10,000 entries is a beat
+* of catching up, about a second, and a team's instance writes fewer than
+* a thousand a day. The rehash of the past is a hash an entry, 14 µs warm
+* and 55 cold, beside two reads: 100 entries keep it near 6 ms a beat.
 */
-var Findings = class {
-	accounting = new KeyAccounting();
-	replayed = {
-		members: /* @__PURE__ */ new Map(),
-		held: /* @__PURE__ */ new Map()
-	};
-	/** The first access entry the replay could not apply. */
-	replayFault = null;
-	/** Each member's newest allowed access entry, by seq. */
-	newestAccess = /* @__PURE__ */ new Map();
-	/** Every allowed checkpoint, with its entry's seq and key: tens of thousands a year, so nothing more of it. */
-	checkpoints = [];
-	/** The vault's entries read. */
-	entries = 0;
-	add(entry) {
-		this.entries += 1;
-		this.accounting.add(entry);
-		if (entry.decision !== "allow") return;
-		if (ACCESS.has(entry.action)) {
-			this.replayFault ??= apply(this.replayed, entry);
-			if (entry.subjectPrincipal !== null) this.newestAccess.set(entry.subjectPrincipal, entry.seq);
-		} else if (entry.action === CHECKPOINT) this.checkpoints.push({
-			entry: {
-				seq: entry.seq,
-				keyId: entry.keyId
-			},
-			checkpoint: JSON.parse(entry.metadata)
-		});
-	}
+const WALKS = {
+	checkpoint: 1e4,
+	scrub: 100,
+	verify: 1e4
 };
-const ACCESS = new Set(ACCESS_ACTIONS);
-/** Checkpoint signatures checked at once, in a full verification. */
+/** The digest of the members and grants a checkpoint keeps whole, beside the digest it says they have. */
+function keptDigest({ members, grants, newest }) {
+	return accessDigest({
+		members,
+		grants,
+		newest
+	});
+}
+/** Each checkpoint entry's metadata, parsed once however many times it is asked about: one may hold every member and grant. */
+const parsed = /* @__PURE__ */ new WeakMap();
+function metadataOf(entry) {
+	if (!parsed.has(entry)) parsed.set(entry, JSON.parse(entry.metadata));
+	return parsed.get(entry);
+}
+/** A head, as an entry keeps it, as a walk goes on from it. */
+function positionOf(head) {
+	return {
+		seq: BigInt(head.seq),
+		hash: Buffer.from(head.hash, "hex")
+	};
+}
+/** A position as the log's heads are named, in hex. */
+function headOf(position) {
+	return {
+		seq: Number(position.seq),
+		hash: position.hash.toString("hex")
+	};
+}
+/** What a checkpoint's signature covers, and nothing it keeps beside it. */
+function signedPart({ seq, hash, signedAt, keyId, signature }) {
+	return {
+		seq,
+		hash,
+		signedAt,
+		keyId,
+		signature
+	};
+}
+/** Checkpoint signatures checked at once. */
 const SIGNATURES_AT_ONCE = 256;
 /** Settle every operation before releasing the member lock, including cancelled requests. */
 async function settle(operations, budgetMs) {
@@ -3729,7 +4661,7 @@ function oneRead(group) {
 }
 /** Whether `entry` changes a member's access: what their row's `access_seq` names. */
 function isAccessEntry(entry) {
-	return entry.decision === "allow" && entry.subjectPrincipal !== void 0 && entry.subjectPrincipal !== null && ACCESS_ACTIONS.includes(entry.action);
+	return entry.decision === "allow" && entry.subjectPrincipal !== void 0 && entry.subjectPrincipal !== null && ACCESS_ACTIONS$1.includes(entry.action);
 }
 /** An entry about a member's access. */
 function accessEntry(actor, action, principal, decision, correlation, detail, code = null) {
@@ -3833,8 +4765,7 @@ function readEdits(stored) {
 * keeps its slug, which a scoped instance role's filters read. The edits
 * keep them all: no write is needed.
 */
-async function livePolicy(db, edits, at) {
-	const rows = await environmentsById(db, edits.protected.map((place) => place.environmentId));
+function livePolicy(rows, edits, at) {
 	const live = edits.protected.filter((place) => {
 		const row = rows.get(place.environmentId);
 		return row === void 0 ? at - place.at < UNWRITTEN_FORK_MS : !row.deleted;