@coffre/vault 0.10.0 → 0.10.2

package/src/vault.ts

@@ -99,17 +99,18 @@ import {
   type WrappedKey,
 } from '@coffre/core/vault';
 import type { Database, Queryable, Transaction } from '@coffre/db';
-import { isUniqueViolation, SNAPSHOT } from '@coffre/db/dialect';
+import { isUniqueViolation, isUnreachable, SNAPSHOT } from '@coffre/db/dialect';
 import { everyProjectConversion, newestAccess, reportStands } from '@coffre/db/grants';
-import { appendEntries, LOOK_BACK, lockLogHead, newestAuthentic, newestVaultSeq, type Appended, type Authenticity, type Newest, type NewEntry } from '@coffre/db/log';
+import { appendEntries, lockLogHead, missingEntry, newestAuthentic, type Appended, type Authenticity, type Newest, type NewEntry } from '@coffre/db/log';
 
-import { KeyAccounting } from './accounting.ts';
 import { signer, type Signer } from './checkpoint.ts';
 import type { ResolvedVaultConfig } from './config.ts';
-import { carries, forward, further, UNVERIFIED, vaultLogKey, VERIFY_BATCH, verifyChain, withCause, type Anchor } from './log.ts';
+import { carries, further, ownEntries, rehash, relink, START, vaultLogKey, VERIFY_BATCH, withCause, type Position } from './log.ts';
 import { apply, replayFault, type LoggedMember, type Replayed } from './replay.ts';
 import { memberMac, rowKey, sameGrants, sealed, standing } from './rows.ts';
+import { snapshot, type Asked, type Snapshot } from './snapshot.ts';
 import * as store from './store.ts';
+import { accessDigest, CHECKPOINT, EMPTY_TALLY, expectedKey, TALLY_VERSION, Walk, type AccessTally, type Expected, type TalliedCheckpoint, type Tally } from './tally.ts';
 import { ACCESS_ACTIONS, type GrantRow, type Member } from './store.ts';
 
 export type VaultOptions = {
@@ -120,6 +121,8 @@ export type VaultOptions = {
   keyBudgetMs?: number;
   /** Milliseconds added to the database's clock where the vault decides by it. Tests move time with it. */
   clockOffset?: () => number;
+  /** How far one call walks the log (`WALKS`); tests shorten them. */
+  walks?: Partial<Walks>;
 };
 
 /**
@@ -140,9 +143,9 @@ export type PreparedVault = {
   logKey: LogKey;
   /** Each signing key's log key: those after the first verify only entries before `since`. */
   logKeys: LogKey[];
-  options: Required<VaultOptions>;
-  /** How far the log is verified; `verifyChain` in log.ts. The furthest any call got to. */
-  verified: Anchor;
+  options: Required<Omit<VaultOptions, 'walks'>> & { walks: Walks };
+  /** How far the chain is rehashed, by any call of this process: its head must still be there. */
+  verified: Position;
   /** What member rows are sealed under now; rows.ts. */
   rowKey: Buffer;
   /** Each signing key's row key: those after the first vouch for rows only until `since`, when the rows are sealed again. */
@@ -169,8 +172,8 @@ export async function prepareVault(config: ResolvedVaultConfig, options: VaultOp
   return {
     config,
     ...(await keysOf(config.signingKeys)),
-    options: { keyBudgetMs: options.keyBudgetMs ?? KEY_BUDGET_MS, clockOffset: options.clockOffset ?? (() => 0) },
-    verified: UNVERIFIED,
+    options: { keyBudgetMs: options.keyBudgetMs ?? KEY_BUDGET_MS, clockOffset: options.clockOffset ?? (() => 0), walks: { ...WALKS, ...options.walks } },
+    verified: START,
     reported: new Set(),
     since: null,
     superseded: null,
@@ -227,9 +230,6 @@ const UNSEALED = { accessSeq: 0n, mac: Buffer.alloc(32) };
 /** Why a change to a tampered member is refused. */
 const TAMPERED_SUBJECT = "this member's record failed the vault's integrity check: remove them to start over";
 
-/** The action of the vault's entry that signs a prefix of the log. */
-const CHECKPOINT = 'audit.checkpoint';
-
 /** The action of the vault's entry that holds the instance's settings, and changes them (`settings`). */
 const SETTINGS = 'settings.change';
 
@@ -289,13 +289,6 @@ const NOT_THEIRS = 'a person gives a service account at most what they hold, whe
 /** Who asks for checkpoints: the app's scheduled job. */
 const SCHEDULER = 'system:coffre-scheduler';
 
-/**
- * How often a checkpoint recomputes the chain from its first entry: the
- * first of each hour, by the vault's clock. The others resume from the
- * prefix the last one signed (`#recompute`).
- */
-const FULL_RECOMPUTE_MS = 60 * 60 * 1000;
-
 /** A refusal and the entries that record it. */
 class Refused {
   readonly refusal: Refusal;
@@ -362,6 +355,8 @@ type Decision = {
   members: Map<string, Member>;
   /** The database's clock, read once the members are locked. */
   at: number;
+  /** What the decision reads, in one statement once the members are locked: under the head, unless it takes the head late. */
+  reads: Snapshot;
   log: NewEntry[];
   writes: ((at: number) => Promise<void>)[];
   /** Members whose row or grants the writes change: sealed again once they have run. */
@@ -386,6 +381,13 @@ type Decision = {
   underLock: ((locked: Queryable) => Promise<void>)[];
 };
 
+/**
+ * What a decision reads besides its members' standing, with it (`Snapshot`):
+ * places, references' ends, and the distinct keys a principal would hold
+ * released in the vault's window, with `keys` too: the bulk limit's count.
+ */
+type Reads = Pick<Asked, 'environments' | 'references'> & { released?: { principal: string; keys: readonly string[] } };
+
 /** The actions of the entries the vault writes about keys. */
 type KeyAction = 'secret.read' | 'key.wrap' | 'key.rewrap';
 
@@ -456,6 +458,22 @@ class VaultService implements Vault {
     return (await store.now(db)) + this.#prepared.options.clockOffset();
   }
 
+  /** A snapshot's clock, as the vault keeps time (`#now`). */
+  #at(reads: Snapshot): number {
+    return reads.at + this.#prepared.options.clockOffset();
+  }
+
+  /** What a decision about `principals` reads, and `asked` besides, in one statement: under the head when `head` is set. */
+  #snapshot(tx: Transaction, principals: readonly string[], asked: Reads, head: boolean): Promise<Snapshot> {
+    const { released, ...rest } = asked;
+    return snapshot(tx, {
+      ...rest,
+      principals,
+      head,
+      ...(released === undefined ? {} : { released: { ...released, windowMs: this.#config.bulkLimit.windowMs, clockOffsetMs: this.#prepared.options.clockOffset() } }),
+    });
+  }
+
   /**
    * Decide in one transaction, with `principals`' rows locked first, then
    * the log's head. A `Refused` or an `Outage` rolls back all but its own
@@ -468,18 +486,18 @@ class VaultService implements Vault {
    * alone takes the head later (`late`), once its key service has answered,
    * which it must not wait on holding it, and decides again then (`#keys`).
    */
-  async #decide<T>(principals: readonly string[], decide: (d: Decision) => Promise<T>, late = false): Promise<Outcome<T>> {
+  async #decide<T>(principals: readonly string[], decide: (d: Decision) => Promise<T>, late = false, asked: Reads = {}): Promise<Outcome<T>> {
     const superseded = await this.#settled();
     if (superseded !== null) return { ok: false, refusal: refusal('wrong_kek', superseded) };
-    return this.#decideNow(principals, decide, late);
+    return this.#decideNow(principals, decide, late, asked);
   }
 
   /** `#decide`, once the vault is settled. */
-  async #decideNow<T>(principals: readonly string[], decide: (d: Decision) => Promise<T>, late = false): Promise<Outcome<T>> {
+  async #decideNow<T>(principals: readonly string[], decide: (d: Decision) => Promise<T>, late = false, asked: Reads = {}): Promise<Outcome<T>> {
     const reports: NewEntry[] = [];
     for (let attempt = 1; ; attempt += 1) {
       try {
-        return await this.#decideOnce(principals, decide, reports, late);
+        return await this.#decideOnce(principals, decide, reports, late, asked);
       } catch (error) {
         // A member who had no row when this decision locked theirs, and has
         // one now: another decision admitted them meanwhile. Again, with it.
@@ -489,14 +507,15 @@ class VaultService implements Vault {
     }
   }
 
-  async #decideOnce<T>(principals: readonly string[], decide: (d: Decision) => Promise<T>, reports: NewEntry[], late: boolean): Promise<Outcome<T>> {
+  async #decideOnce<T>(principals: readonly string[], decide: (d: Decision) => Promise<T>, reports: NewEntry[], late: boolean, asked: Reads): Promise<Outcome<T>> {
     try {
       const result = await this.#db.transaction(async (tx) => {
         await store.boundLockWaits(tx, LOCK_TIMEOUT_MS);
         const members = principals.length === 0 ? new Map<string, Member>() : await store.lockMembers(tx, principals);
-        if (!late) await lockLogHead(tx);
+        // Then the head, and everything the decision reads, in one statement (`snapshot` says why it holds).
+        const reads = await this.#snapshot(tx, principals, asked, !late);
         const d: Decision = {
-          tx, members, at: await this.#now(tx), log: [], writes: [], touched: new Set(), grants: new Map(), reports, after: [], underLock: [],
+          tx, members, at: this.#at(reads), reads, log: [], writes: [], touched: new Set(), grants: new Map(), reports, after: [], underLock: [],
         };
         const result = await decide(d);
         // A read is logged once per place, whichever way it ends (`readsByPlace`).
@@ -505,7 +524,9 @@ class VaultService implements Vault {
         // Each member's newest access entry, which their row names (rows.ts).
         const accessSeq = new Map<string, bigint>();
         if (entries.length > 0) {
-          const appended = await this.#append(tx, entries, d.underLock);
+          // Under the head the decision's reads took: a remote key's decision takes it late, and reads again with it.
+          if (d.reads.head === null) throw new Error('a decision appends only under the head it read with');
+          const appended = await this.#append(tx, entries, d.underLock, d.reads);
           at = appended.occurredAt;
           entries.forEach((entry, i) => {
             if (isAccessEntry(entry)) accessSeq.set(entry.subjectPrincipal!, appended.seqStart + BigInt(i));
@@ -564,12 +585,12 @@ class VaultService implements Vault {
    * MAC are passed over, and reported: otherwise whoever can insert a row
    * could lock any member out.
    */
-  async #integrity(db: Queryable, principal: string, row: Member | undefined, grants: readonly GrantRow[], reports: NewEntry[]): Promise<Fault | null> {
+  async #integrity(db: Queryable, principal: string, row: Member | undefined, grants: readonly GrantRow[], reports: NewEntry[], reads?: Snapshot): Promise<Fault | null> {
     if (row !== undefined && !this.#sealed(row, grants)) {
       this.#report(reports, principal, 'mac', row.mac.toString('hex'));
       return 'mac';
     }
-    const newest = await this.#newestAccess(db, principal, reports);
+    const newest = await this.#newestAccess(db, principal, reports, reads);
     // No row, and no entry of the vault's own: someone never admitted. No
     // row, but one: one deleted, unless it was admitted since the row was
     // read. Too many forged to see past: neither a row nor the lack of one holds.
@@ -581,8 +602,14 @@ class VaultService implements Vault {
   }
 
   /** The newest access entry about `principal` that carries the vault's MAC (`newestAccess` in @coffre/db/grants). */
-  #newestAccess(db: Queryable, principal: string, reports: NewEntry[]): Promise<Newest> {
-    return newestAccess(db, principal, this.#check(reports, principal));
+  #newestAccess(db: Queryable, principal: string, reports: NewEntry[], reads?: Snapshot): Promise<Newest> {
+    if (reads === undefined || !reads.grants.has(principal)) return newestAccess(db, principal, this.#check(reports, principal));
+    // The snapshot's newest first, read with the rest; the pages before it, as they are asked.
+    const newest = reads.newestAccess.get(principal);
+    return newestAuthentic(
+      (limit, before) => (before === undefined ? Promise.resolve(newest === undefined ? [] : [newest]) : store.accessEntriesAbout(db, principal, limit, before)),
+      this.#check(reports, principal),
+    );
   }
 
   /** Entries in the vault's name told apart by their MACs, each it did not write reported, about `principal`. */
@@ -595,9 +622,13 @@ class VaultService implements Vault {
 
   /** Whether `entry` carries the vault's MAC: under any of its keys before `since`, and only its current one from there. */
   #authentic(entry: StoredEntry): boolean {
+    return verifyEntries([entry], { startSeq: entry.seq, startPrevHash: entry.prevHash, keys: this.#keysFor(entry) }).ok;
+  }
+
+  /** The vault's log keys an entry may be under: any of them before `since`, and only its current one from there. */
+  #keysFor(entry: StoredEntry): LogKey[] {
     const { logKeys, since } = this.#prepared;
-    const keys = since !== null && entry.seq >= since ? logKeys.slice(0, 1) : logKeys;
-    return verifyEntries([entry], { startSeq: entry.seq, startPrevHash: entry.prevHash, keys }).ok;
+    return since !== null && entry.seq >= since ? logKeys.slice(0, 1) : logKeys;
   }
 
   /**
@@ -690,7 +721,7 @@ class VaultService implements Vault {
 
   async #replaceEveryProject(d: Decision, principal: string): Promise<void> {
     const row = d.members.get(principal);
-    const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
+    const subject = await this.#standing(d.tx, principal, row, d.at, d.reports, d.reads);
     if (row === undefined || subject.status !== 'active') return;
     const everyProject = subject.stored.filter((grant) => grant.projectId === null && grant.environmentId === null);
     if (everyProject.length === 0) return;
@@ -836,16 +867,29 @@ class VaultService implements Vault {
    * that an instance still running with the replaced KEK, as during a
    * deploy, cannot write after the rotation.
    */
-  #append(tx: Transaction, entries: readonly NewEntry[], underLock: readonly ((locked: Queryable) => Promise<void>)[] = []): Promise<Appended> {
+  async #append(
+    tx: Transaction,
+    entries: readonly NewEntry[],
+    underLock: readonly ((locked: Queryable) => Promise<void>)[] = [],
+    /** A snapshot that holds the head: what it read under it is read again by nothing. */
+    held?: Snapshot,
+  ): Promise<Appended> {
     const prepared = this.#prepared;
-    return appendEntries(tx, prepared.logKey, entries, async (locked) => {
-      const rotation = await store.latestVaultEntry(locked, [KEY_ROTATE]);
+    const head = held?.head ?? undefined;
+    const appended = await appendEntries(tx, prepared.logKey, entries, async (locked) => {
+      const rotation = head === undefined ? await store.latestVaultEntry(locked, [KEY_ROTATE]) : head.rotation ?? undefined;
       if (rotation !== undefined && !prepared.logKeys.some((key) => key.keyId === rotation.keyId)) {
         prepared.superseded = `the log moved on to ${rotation.keyId}, a key this vault does not hold: a vault given a newer vault key replaced it, and a replaced key writes nothing more`;
         throw new Error(prepared.superseded);
       }
       for (const check of underLock) await check(locked);
-    });
+    }, head === undefined ? undefined : { head, last: head.last, at: held!.at });
+    // The head still held, as this append left it, for the next append of the same transaction: a remote key's intent,
+    // then the decision's reports.
+    if (head !== undefined) {
+      held!.head = { ...head, nextSeq: appended.nextSeq, headHash: appended.headHash, last: { seq: appended.nextSeq - 1n, hash: appended.headHash } };
+    }
+    return appended;
   }
 
   // --- keys -------------------------------------------------------------------
@@ -909,10 +953,8 @@ class VaultService implements Vault {
         secrets: items.map((item) => item.secret),
         // Through a reference, the reader's grants on the holder's environment decide.
         places: sealed.map((seal, i) => seal?.holder ?? items[i]!.secret),
-        vet: ends.length === 0 ? undefined : async (db) => {
-          const ended = await store.endedReferences(db, ends);
-          return sealed.map((seal) => (seal !== null && ended.has(seal.seq) ? 'ended' : null));
-        },
+        references: ends,
+        vet: ends.length === 0 ? undefined : async (_, reads) => sealed.map((seal) => (seal !== null && reads.ended.has(seal.seq) ? 'ended' : null)),
         remote,
         entry,
         input,
@@ -1098,11 +1140,14 @@ class VaultService implements Vault {
       secrets: readonly SecretRef[];
       /** Where each secret's permission is checked, when not where it is: a reference's holder. */
       places?: readonly SecretPlace[];
+      /** The `reference.create` entries `vet` asks about: read with the decision (`Snapshot`'s `ended`). */
+      references?: readonly bigint[];
       /**
        * What else refuses each secret, checked in the decision and again
-       * once the log's head is locked, before its entries append.
+       * once the log's head is locked, before its entries append: from the
+       * decision's reads, or the database.
        */
-      vet?: (db: Queryable) => Promise<(RefusalCode | null)[]>;
+      vet?: (db: Queryable, reads: Snapshot) => Promise<(RefusalCode | null)[]>;
       /**
        * Any one of which each secret takes besides `permission`, where it
        * is, read in the decision and again under the head; none for null.
@@ -1131,15 +1176,13 @@ class VaultService implements Vault {
     // Each personal config's owner, hashed, by environment, as the decision read them: what its keys' contexts bind.
     const owners = new Map<string, string>();
     const check = async (d: Decision) => {
-      const reader = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports), call.input);
+      const reader = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports, d.reads), call.input);
       // One read of the environments the decision is about, as the store has them, not as the app sent them:
       // each secret's and, for a read through a reference, its holder's. A grant on one slug in every project
       // matches the slug there, and a place deleted on either side opens for none.
       const at = secrets.map((secret, i) => call.places?.[i] ?? secret);
-      const environments = await store.environmentsById(d.tx, [...secrets, ...at].map((place) => place.environmentId));
-      // A personal config's parent, whose read its owner needs.
-      const parents = [...environments.values()].flatMap((environment) => (environment.owner === null || environment.parentId === null ? [] : [environment.parentId]));
-      for (const [id, parent] of await store.environmentsById(d.tx, parents)) environments.set(id, parent);
+      // Each a personal config is a config of too, whose read its owner needs (`places`).
+      const environments = d.reads.environments;
       const gone = (place: SecretPlace) => environments.get(place.environmentId)?.deleted ?? false;
       owners.clear();
       for (const [id, environment] of environments) if (environment.owner !== null) owners.set(id, ownerKey(environment.owner));
@@ -1159,7 +1202,7 @@ class VaultService implements Vault {
         return refuses(reader, call.permission, placeIn(at[i]!, environments), gone(secret) || gone(at[i]!));
       });
       if (call.vet !== undefined && !codes.some((code) => code !== null)) {
-        (await call.vet(d.tx)).forEach((code, i) => (codes[i] = code));
+        (await call.vet(d.tx, d.reads)).forEach((code, i) => (codes[i] = code));
       }
       // A sensitive value is only ever used for a person, never handed back, by whatever credential of theirs asks. And
       // a fork copies one, for anyone, a service account too, only where its app says it keeps it sensitive: an app of
@@ -1172,7 +1215,7 @@ class VaultService implements Vault {
         });
       }
       let first = codes.find((code) => code !== null) ?? null;
-      if (first === null && action === 'secret.read' && (await this.#overBulkLimit(d, principal, secrets.length))) first = 'bulk_limit';
+      if (first === null && action === 'secret.read' && this.#overBulkLimit(d)) first = 'bulk_limit';
       if (first !== null) {
         throw new Refused(
           refusal(first, MESSAGES[first]),
@@ -1181,6 +1224,12 @@ class VaultService implements Vault {
       }
     };
 
+    // Every decision below reads the places it is about with the reader's standing; a read, the reader's releases too.
+    const reads: Reads = {
+      environments: [...secrets, ...secrets.map((secret, i) => call.places?.[i] ?? secret)].map((place) => place.environmentId),
+      references: call.references ?? [],
+      ...(action === 'secret.read' ? { released: { principal, keys: secrets.map((secret) => secret.secretId) } } : {}),
+    };
     // The intent's own identity; `operationId` is the app's, for the whole action.
     const intentId = call.remote ? randomUUID() : null;
     let intentSeq: bigint | null = null;
@@ -1200,7 +1249,7 @@ class VaultService implements Vault {
     if (call.remote) {
       const intent = await this.#decide([principal], async (d) => {
         await check(d);
-        const at = await this.#now(d.tx);
+        const at = d.at;
         const appended = await this.#append(d.tx, [{
           actor: principal,
           action: 'key.intent',
@@ -1216,14 +1265,19 @@ class VaultService implements Vault {
             ...traced(call.input),
             keys: secrets.map((secret, item) => ({ item, subject: secret.path, secretId: secret.secretId, version: secret.version })),
           }),
-        }]);
+        }], [], d.reads);
         return { seq: appended.seqStart };
-      });
+      }, false, reads);
       if (!intent.ok) return intent;
       intentSeq = intent.seq;
     }
 
-    return this.#decide([principal], async (d) => {
+    // Under the reader's row: the check, the key operations, and their outcome. With a key in memory, under the
+    // log's head too, from the start (`#decideOnce`): what the check read stands until the commit, as every change it
+    // reads appends under the head, and the head waits on nothing slow. With a key service, which nothing may wait on
+    // holding the head, the head is taken once the keys are open, and what the check read is read again under it.
+    const late = call.remote;
+    const decided = async (d: Decision) => {
       try {
         await check(d);
       } catch (error) {
@@ -1233,11 +1287,14 @@ class VaultService implements Vault {
         }
         throw error;
       }
+    };
+    return this.#decide([principal], async (d) => {
+      await decided(d);
       // A reference ended while this decided refuses it, rather than a read logged after its end.
       const { vet } = call;
-      if (vet !== undefined) {
+      if (late && vet !== undefined) {
         d.underLock.push(async (locked) => {
-          const codes = await vet(locked);
+          const codes = await vet(locked, d.reads);
           const first = codes.find((code) => code !== null);
           if (first === undefined || first === null) return;
           throw new Refused(refusal(first, MESSAGES[first]), secrets.map((secret, item) => outcomeEntry(secret, item, 'deny', codes[item] ?? first)));
@@ -1262,25 +1319,20 @@ class VaultService implements Vault {
         if (done.length < outcomes.length) {
           throw new Refused(refusal('bad_claim', MESSAGES.bad_claim), entries());
         }
-        // Again under the log's head, the append's, taken a statement early: a
-        // deletion renames its place under it, so one that committed since the
-        // check above is seen here, and nothing is released after it.
-        // A read through a reference: its holder's place too, which a deletion may have taken.
-        await lockLogHead(d.tx);
-        // And as the policy is now, under the head every change to it takes: an environment protected, or a role narrowed,
-        // since the check above is seen here, and nothing it refuses now is released.
-        try {
-          await check(d);
-        } catch (error) {
-          if (error instanceof Refused) {
-            throw new Refused(error.refusal, secrets.map((secret, item) => outcomeEntry(secret, item, 'deny', error.entries[item].code ?? error.refusal.code)));
+        if (late) {
+          // Again under the log's head, the append's, taken a statement early: a
+          // deletion renames its place under it, so one that committed since the
+          // check above is seen here, and nothing is released after it.
+          // A read through a reference: its holder's place too, which a deletion may have taken.
+          // And as the policy is now, under the head every change to it takes: an environment protected, or a role narrowed,
+          // since the check above is seen here, and nothing it refuses now is released. All of it read again, holding the head.
+          d.reads = await this.#snapshot(d.tx, [principal], reads, true);
+          d.at = this.#at(d.reads);
+          await decided(d);
+          const places = secrets.flatMap((secret, i) => [secret, call.places?.[i] ?? secret]);
+          if (places.some((place) => d.reads.environments.get(place.environmentId)?.deleted ?? false)) {
+            throw new Refused(refusal('deleted', MESSAGES.deleted), secrets.map((secret, i) => outcomeEntry(secret, i, 'deny', 'deleted')));
           }
-          throw error;
-        }
-        const places = secrets.flatMap((secret, i) => [secret, call.places?.[i] ?? secret]);
-        const now = await store.environmentsById(d.tx, places.map((place) => place.environmentId));
-        if (places.some((place) => now.get(place.environmentId)?.deleted ?? false)) {
-          throw new Refused(refusal('deleted', MESSAGES.deleted), secrets.map((secret, i) => outcomeEntry(secret, i, 'deny', 'deleted')));
         }
         const released = secrets.map((secret, i) => outcomeEntry(secret, i, 'allow', null));
         d.log.push(...released);
@@ -1291,13 +1343,17 @@ class VaultService implements Vault {
       } finally {
         for (const value of done) value.wipe();
       }
-    }, true);
+    }, late, reads);
   }
 
-  /** Whether `n` more keys would take `principal` past the bulk limit; counted under their row's lock, so exactly. */
-  async #overBulkLimit(d: Decision, principal: string, n: number): Promise<boolean> {
-    const { count, windowMs } = this.#config.bulkLimit;
-    return (await store.releasesSince(d.tx, principal, d.at - windowMs)) + n > count;
+  /**
+   * Whether this read's keys would take the reader past the bulk limit: the
+   * distinct keys released to them in the window, these among them. A key
+   * read again exposes nothing new, so it counts once, whatever its version.
+   * Counted under their row's lock, so exactly (`Reads`).
+   */
+  #overBulkLimit(d: Decision): boolean {
+    return d.reads.released > this.#config.bulkLimit.count;
   }
 
   // --- references ---------------------------------------------------------------
@@ -1349,7 +1405,7 @@ class VaultService implements Vault {
     return this.#decide([principal], async (d) => {
       // Under the log's head, which a deletion and every change to the policy take: neither side deleted, nor protected,
       // nor a role narrowed, before this commits.
-      const reader = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports), input);
+      const reader = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports, d.reads), input);
       // Each source's nature, its current version's, under the head: what its maker must hold there.
       const natures = await store.natures(d.tx, [...sources.values()].map((source) => source.secretId));
       // Both sides as the store has them: a grant on a slug matches there, and neither side may be deleted.
@@ -1436,7 +1492,7 @@ class VaultService implements Vault {
     };
     return this.#decide([principal], async (d) => {
       // Under the log's head: two ends of one reference at once, the second finds the first; and the actor's standing stands.
-      const actor = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports), input);
+      const actor = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports, d.reads), input);
       // Ending is allowed in a deleted place: deleting one ends the references into and out of it.
       const environments = await store.environmentsById(d.tx, seals.map((seal) => seal.holder.environmentId));
       const codes: (RefusalCode | null)[] = seals.map((seal) => {
@@ -1552,7 +1608,7 @@ class VaultService implements Vault {
    */
   async #makeOwner(d: Decision, principal: string, reason: 'owners'): Promise<boolean> {
     const row = d.members.get(principal);
-    const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
+    const subject = await this.#standing(d.tx, principal, row, d.at, d.reports, d.reads);
     if (subject.status === 'active' && ownsInstance(subject.live)) return false;
     const tampered = subject.status === 'tampered';
     if (tampered && (await this.#logged(d.tx, principal)) === undefined) return false;
@@ -1584,17 +1640,17 @@ class VaultService implements Vault {
    * What `principal` holds, their row checked first (`#integrity`): a row
    * that fails holds nothing, and is `tampered`.
    */
-  async #standing(db: Queryable, principal: string, row: Member | undefined, at: number, reports: NewEntry[]): Promise<Standing> {
+  async #standing(db: Queryable, principal: string, row: Member | undefined, at: number, reports: NewEntry[], reads?: Snapshot): Promise<Standing> {
     const none = NOTHING;
-    const grants = row === undefined ? [] : await store.grants(db, principal);
-    const fault = await this.#integrity(db, principal, row, grants, reports);
+    const grants = row === undefined ? [] : reads?.grants.get(principal) ?? (await store.grants(db, principal));
+    const fault = await this.#integrity(db, principal, row, grants, reports, reads);
     if (fault !== null) return { principal, status: 'tampered', live: none, all: none, fault, stored: grants };
     if (!PRINCIPAL.test(principal)) return { principal, status: 'unknown', live: none, all: none, fault, stored: grants };
     if (row?.status !== 'active') return { principal, status: row?.status ?? 'unknown', live: none, all: none, fault, stored: grants };
     const held = grants.map((grant) => ({ ...grant, role: grant.role as Role }));
     const { role, scope } = roleOf(principal, row);
     // Every decision about them reads the policy: their roles as an Owner edited them, and which environments are protected.
-    const { policy } = await this.#policyAt(db, reports, at);
+    const { policy } = await this.#policyAt(db, reports, at, reads);
     const service = !principal.startsWith('user:');
     return {
       principal,
@@ -1642,9 +1698,10 @@ class VaultService implements Vault {
   /** `access`, as the rows are now. */
   async #read(principal: string, superseded: string | null): Promise<Access> {
     const read = async (db: Queryable, reports: NewEntry[]) => {
-      const [row, held, at] = await Promise.all([store.member(db, principal), store.grants(db, principal), this.#now(db)]);
-      const fault = await this.#integrity(db, principal, row, held, reports);
-      const { policy } = await this.#policyAt(db, reports, at);
+      const reads = await snapshot(db, { principals: [principal], members: true });
+      const [row, held, at] = [reads.members.get(principal), reads.grants.get(principal)!, this.#at(reads)];
+      const fault = await this.#integrity(db, principal, row, held, reports, reads);
+      const { policy } = await this.#policyAt(db, reports, at, reads);
       return this.#access(principal, row, held, at, fault !== null, policy);
     };
     const found: NewEntry[] = [];
@@ -1724,7 +1781,7 @@ class VaultService implements Vault {
       // renames the place, so the place is as it commits.
       // The roles as the policy defines them now, under the head every change to it takes: a role an Owner made is
       // granted as one that ships, and one deleted meanwhile is granted by nobody.
-      const { policy } = await this.#policyAt(d.tx, d.reports, d.at);
+      const { policy } = await this.#policyAt(d.tx, d.reports, d.at, d.reads);
       for (const change of changes) {
         if (change.role !== null && !isRole(change.role, policy)) throw refused('invalid', `no such role: ${change.role}`);
         if (change.role !== null && change.environmentId !== null && !assignableToEnvironment(change.role, policy)) {
@@ -1748,7 +1805,7 @@ class VaultService implements Vault {
         // An environment by its slug as the store has it, which scopes match.
         return environmentId === null ? { projectId: projectId! } : { projectId: projectId!, environmentId, environmentSlug: environment!.slug };
       });
-      const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports), input);
+      const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports, d.reads), input);
       if (acting.status === 'tampered') throw refused('tampered');
       // Where they manage access, anything; otherwise only a person to a service account (`givesService`).
       const manages = where.every((place) => mayManageAccess(acting.live, place));
@@ -1759,7 +1816,7 @@ class VaultService implements Vault {
       }
 
       const row = d.members.get(principal);
-      const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
+      const subject = await this.#standing(d.tx, principal, row, d.at, d.reports, d.reads);
       if (subject.status === 'tampered') throw refused('tampered', TAMPERED_SUBJECT);
       // A service account admitted with its first grants, as `admit` would: all of it, or none.
       const admitted = input.admit === true && row?.status !== 'active' ? await this.#admitWith(d, acting, principal, row, input) : undefined;
@@ -1859,7 +1916,7 @@ class VaultService implements Vault {
       ]);
     return this.#decide([actor, principal], async (d) => {
       validateCorrelation(input);
-      const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports), input);
+      const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports, d.reads), input);
       if (acting.status === 'tampered') throw refused('tampered');
       // A service account, with no grant yet, any person who could give it one sets up (`setsUpServices`).
       const service = SERVICE.test(principal) && (input.role ?? 'member') === 'member' && input.scope === undefined;
@@ -1872,7 +1929,7 @@ class VaultService implements Vault {
         throw refused('invalid', 'service accounts hold project grants only, never an instance role');
       }
       const row = d.members.get(principal);
-      const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
+      const subject = await this.#standing(d.tx, principal, row, d.at, d.reports, d.reads);
       if (subject.status === 'tampered') throw refused('tampered', TAMPERED_SUBJECT);
       d.touched.add(principal);
       d.grants.set(principal, [...subject.stored]);
@@ -1964,10 +2021,10 @@ class VaultService implements Vault {
       validateCorrelation(input);
       if (!PRINCIPAL.test(principal)) throw refused('invalid', `not a member: ${shownMember(principal)}`);
       const row = d.members.get(principal);
-      const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports), input);
+      const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports, d.reads), input);
       if (acting.status === 'tampered') throw refused('tampered');
       const holder = acting.live;
-      const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
+      const subject = await this.#standing(d.tx, principal, row, d.at, d.reports, d.reads);
       const held = subject.stored;
       if (this.#listed(principal)) throw refused('not_allowed', declaredOwner(principal));
       if (subject.status === 'tampered') {
@@ -2052,7 +2109,7 @@ class VaultService implements Vault {
    */
   async #settingsAt(db: Queryable, reports: NewEntry[]): Promise<Settings> {
     const entry = await newestAuthentic(
-      (before) => store.newestVaultEntries(db, SETTINGS, LOOK_BACK.page, before),
+      (limit, before) => store.newestVaultEntries(db, SETTINGS, limit, before),
       this.#check(reports, null),
     );
     if (entry === 'none') return DEFAULT_SETTINGS;
@@ -2079,14 +2136,19 @@ class VaultService implements Vault {
    * no role holds anything but Owner, otherwise whoever can insert rows
    * could unprotect them. Its edits are then unknown, not none.
    */
-  async #policyAt(db: Queryable, reports: NewEntry[], at: number): Promise<{ policy: Policy; edits: PolicyEdits; readable: boolean }> {
+  async #policyAt(db: Queryable, reports: NewEntry[], at: number, reads?: Snapshot): Promise<{ policy: Policy; edits: PolicyEdits; readable: boolean }> {
+    // The snapshot's newest first, with the rows it protects; the pages before it, as they are asked.
     const entry = await newestAuthentic(
-      (before) => store.newestVaultEntries(db, POLICY, LOOK_BACK.page, before),
+      (limit, before) => (reads !== undefined && before === undefined
+        ? Promise.resolve(reads.newestPolicy === null ? [] : [reads.newestPolicy])
+        : store.newestVaultEntries(db, POLICY, limit, before)),
       this.#check(reports, null),
     );
     if (entry === 'none') return { policy: DEFAULT_POLICY, edits: NO_EDITS, readable: true };
     const edits = typeof entry === 'string' ? null : readEdits(JSON.parse(entry.metadata) as { policy?: unknown });
-    return edits === null ? { policy: CLOSED_POLICY, edits: NO_EDITS, readable: false } : { policy: await livePolicy(db, edits, at), edits, readable: true };
+    if (edits === null) return { policy: CLOSED_POLICY, edits: NO_EDITS, readable: false };
+    const rows = entry === reads?.newestPolicy ? reads.environments : await store.environmentsById(db, edits.protected.map((place) => place.environmentId));
+    return { policy: livePolicy(rows, edits, at), edits, readable: true };
   }
 
   changePolicy(input: ChangePolicyInput): Promise<Outcome<{ policy: Policy; seq: number | null }>> {
@@ -2109,14 +2171,15 @@ class VaultService implements Vault {
       new Refused(refusal(code, message), [entry('deny', { change: describeChange(change) }, code)]);
     return this.#decide([actor], async (d) => {
       validateCorrelation(input);
-      const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports), input);
+      const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports, d.reads), input);
       if (acting.status === 'tampered') throw refused('tampered');
       if (acting.status !== 'active') throw refused(acting.status === 'removed' ? 'removed' : 'not_a_member');
       // Under the log's head, as the actor's standing above: two changes at once each start from the one before. One the
       // caller weighed from a revision of the policy, its newest change and its protected environments' rows, starts
       // from that one, or is refused, to be asked again: a protected prod renamed since is a policy changed too.
-      const newest = await newestVaultSeq(d.tx, POLICY);
-      const { policy: before, edits, readable } = await this.#policyAt(d.tx, d.reports, d.at);
+      // The newest change in the vault's name, read with the decision, as the app reads it: by its number, unchecked.
+      const newest = d.reads.newestPolicy?.seq ?? null;
+      const { policy: before, edits, readable } = await this.#policyAt(d.tx, d.reports, d.at, d.reads);
       if (revision !== undefined && policyRevision(newest, before) !== revision) throw refused('policy_changed');
       const owner = acting.live.credentialScope == null && ownsInstance(acting.live);
       // Unreadable, its edits are unknown: a change made from none would erase every protection and role edit the forged
@@ -2188,7 +2251,7 @@ class VaultService implements Vault {
         throw refused('invalid', 'a change is to a role, an instance role, or protection');
       }
       // The policy now, and the newest change, which it is as of: this one's, when it changed anything.
-      const answer = { policy: await livePolicy(d.tx, next, d.at), seq: newest === null ? null : Number(newest) };
+      const answer = { policy: livePolicy(await store.environmentsById(d.tx, next.protected.map((place) => place.environmentId)), next, d.at), seq: newest === null ? null : Number(newest) };
       if (!readable || JSON.stringify(next) !== JSON.stringify(edits)) {
         const made = entry('allow', { policy: next, change: describeChange(change), before: describeBefore(change, before) });
         d.log.push(made);
@@ -2213,7 +2276,7 @@ class VaultService implements Vault {
       new Refused(refusal(code, message), [entry('deny', { serviceAccounts: input.settings?.serviceAccounts ?? null }, code)]);
     return this.#decide([actor], async (d) => {
       validateCorrelation(input);
-      const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports), input);
+      const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports, d.reads), input);
       if (acting.status === 'tampered') throw refused('tampered');
       if (!runsInstance(acting.live)) throw refused('not_allowed', "only admins and owners of the whole instance change its settings");
       if (!isScope(input.settings?.serviceAccounts)) throw refused('invalid', 'who sets up service accounts is a scope: { projects, environments }, each all, only or except');
@@ -2363,73 +2426,137 @@ class VaultService implements Vault {
 
   // --- checkpoints and the log --------------------------------------------------
 
-  /** The last checkpoint the vault signed, and the entry that holds it: its newest allowed `audit.checkpoint`. */
-  async #latest(db: Queryable): Promise<{ checkpoint: Checkpoint; seq: bigint; keyId: string } | null> {
-    const row = await store.latestVaultEntry(db, [CHECKPOINT]);
-    return row === undefined ? null : { checkpoint: JSON.parse(row.metadata) as Checkpoint, seq: row.seq, keyId: row.keyId };
+  /**
+   * Where a walk of the log resumes: the first entry (`start`), a
+   * checkpoint's entry that keeps a tally, or the newest such entry, the
+   * first entry while there is none. The entry must be the vault's, by its
+   * MAC, and its tally whole: the members and grants it keeps, or the
+   * earlier checkpoint it names keeps, match the digest it carries.
+   *
+   * Its signature is left to the walk: the entry comes after the prefix it
+   * signs, so a walk from there reads it, as it reads every other.
+   */
+  async #resume(db: Queryable, from: 'start' | 'newest' | bigint): Promise<Resumed | Broken> {
+    if (from === 'start') return FIRST_ENTRY;
+    const entry = from === 'newest' ? await store.latestTallied(db) : (await store.entriesAt(db, [from])).get(from);
+    if (entry === undefined) return from === 'newest' ? FIRST_ENTRY : { ok: false, failedAtSeq: Number(from), reason: 'no checkpoint at this entry' };
+    return (await this.#resumeEach(db, [entry]))[0]!;
+  }
+
+  /** `#resume` for each of these checkpoint entries, the entries their members and grants are kept in read at once. */
+  async #resumeEach(db: Queryable, entries: readonly StoredEntry[]): Promise<(Resumed | Broken)[]> {
+    const reads = entries.map((entry) => this.#tallied(entry));
+    const named = reads.flatMap((read) => (typeof read !== 'string' && 'at' in read.tally.access ? [BigInt(read.tally.access.at)] : []));
+    const carriers = new Map([...(await store.entriesAt(db, named))].map(([seq, held]) => [seq, this.#tallied(held)]));
+    return entries.map((entry, i): Resumed | Broken => {
+      const broken = (reason: string): Broken => ({ ok: false, failedAtSeq: Number(entry.seq), reason });
+      const read = reads[i]!;
+      if (typeof read === 'string') return broken(read);
+      let carrier = entry.seq;
+      let { access } = read.tally;
+      if ('at' in access) {
+        carrier = BigInt(access.at);
+        const holder = carrier < entry.seq ? carriers.get(carrier) : undefined;
+        if (holder === undefined || typeof holder === 'string' || 'at' in holder.tally.access) {
+          return broken(`its tally keeps its members and grants in entry ${carrier}, which holds none`);
+        }
+        access = holder.tally.access;
+      }
+      const kept = { members: access.members, grants: access.grants, newest: access.newest };
+      if (keptDigest(access) !== read.tally.access.digest) return broken("its tally's members and grants do not match their digest");
+      return {
+        ok: true,
+        entry: entry.seq,
+        at: { seq: BigInt(read.seq), hash: Buffer.from(read.hash, 'hex') },
+        tally: { ...read.tally, access: kept },
+        digest: read.tally.access.digest,
+        carrier,
+        scrub: read.scrub === null ? null : { at: positionOf(read.scrub.at), end: positionOf(read.scrub.end) },
+      };
+    });
+  }
+
+  /** A checkpoint's entry that keeps a tally, as it says, or why it is not one the vault wrote. */
+  #tallied(entry: StoredEntry): TalliedCheckpoint | string {
+    const not = "not a checkpoint of the vault's that keeps a tally";
+    if (entry.author !== 'vault' || entry.action !== CHECKPOINT || entry.decision !== 'allow' || entry.relatedSeq === null) return not;
+    const authentic = verifyEntries([entry], { startSeq: entry.seq, startPrevHash: entry.prevHash, keys: this.#keysFor(entry) });
+    if (!authentic.ok) return withCause(authentic.reason);
+    const read = metadataOf(entry) as Partial<TalliedCheckpoint> | null;
+    if (read?.tally?.v !== TALLY_VERSION || read.scrub === undefined || typeof read.seq !== 'number' || BigInt(read.seq) !== entry.relatedSeq) return not;
+    return read as TalliedCheckpoint;
+  }
+
+  /** Which of `heads` the log still holds where they were, in one read. */
+  async #holding(db: Queryable, heads: readonly LogHead[]): Promise<(head: LogHead) => boolean> {
+    const hashes = await store.hashesAt(db, [...new Set(heads.filter((head) => head.seq >= 0).map((head) => BigInt(head.seq)))]);
+    return (head) => head.hash === GENESIS_HASH.toString('hex') || hashes.get(BigInt(head.seq))?.toString('hex') === head.hash;
   }
 
   /**
-   * The chain recomputed to its last entry, for a checkpoint to sign: from
-   * its first entry at the first checkpoint of each hour, and otherwise from
-   * the prefix the last checkpoint signed, if that one was signed this hour.
+   * Sign the log up to its last entry, from the newest checkpoint's tally.
    *
-   * Resuming never signs what the vault did not recompute. The vault
-   * recomputed the last checkpoint's prefix itself, from entry 0 at the
-   * hour's first checkpoint and onward at each one since, and the entry
-   * that holds it is the first one checked again, by its MAC. The next
-   * signature extends that same chain.
+   * In one snapshot, and without the log's lock, so that no append waits on
+   * it: every member's row checked, since rows changed around the vault
+   * write nothing to the log; the prefix the newest checkpoint signed still
+   * there, its hash where it was, which a rewrite chained again changes, and
+   * every entry of it, which a cut changes; the chain recomputed from there,
+   * every hash from content and every vault entry by its MAC, no further
+   * than one walk (`walks.checkpoint`); and a stretch of the prefixes signed
+   * before rehashed (`#scrub`). Then, under the lock, the entries appended
+   * since the snapshot, so that it signs the head.
    *
-   * What resuming does not do is recompute the rows of that prefix again.
-   * They can change while the hash stored at its end stays, so it first
-   * checks the two things that are cheap: that hash is still there, which a
-   * prefix rewritten and chained again changes, and every entry of the
-   * prefix is, which a cut changes. Either failing, it recomputes from entry
-   * 0, which names what broke. An entry edited in place, its hash left as
-   * it was, is the one change left to the next full pass, within the hour.
-   *
-   * It resumes only from a checkpoint under the key the vault writes with
-   * now: once the log reaches that key, no other writes again (`forward`).
-   * After a rotation, the next pass is full.
+   * A walk cut short signs where it got to, behind the head: the log after
+   * an upgrade from 0.10.0, whose checkpoints kept no tally, is signed again
+   * from the first entry, one walk a call, and `/readyz` stays red until the
+   * checkpoints reach the newest heartbeat.
    */
-  async #recompute(tx: Queryable): Promise<{ verification: LogVerification; anchor: Anchor }> {
-    const { logKeys } = this.#prepared;
-    const latest = await this.#latest(tx);
-    const hour = (ms: number) => Math.floor(ms / FULL_RECOMPUTE_MS);
-    const resumable =
-      latest !== null &&
-      latest.keyId === logKeys[0].keyId &&
-      latest.seq === BigInt(latest.checkpoint.seq) + 1n &&
-      hour(Date.parse(latest.checkpoint.signedAt)) === hour(await this.#now(tx)) &&
-      (await carries(tx, latest.checkpoint)) &&
-      (await store.complete(tx, BigInt(latest.checkpoint.seq)));
-    if (!resumable) return verifyChain(tx, logKeys, [], UNVERIFIED);
-    const { seq, hash } = latest.checkpoint;
-    const signed: Anchor = { nextSeq: BigInt(seq) + 1n, hash: Buffer.from(hash, 'hex'), vaultEntries: 0, vaultKeys: [logKeys[0].keyId] };
-    return verifyChain(tx, logKeys, [], signed);
-  }
-
-  async checkpoint(): Promise<Outcome<{ checkpoint: Checkpoint }>> {
+  async checkpoint(): Promise<Outcome<{ checkpoint: Checkpoint; warning?: string }>> {
     await this.#settled();
     // A KEK found wrong turns readiness red: the checkpoint is refused. It does no key work of its
     // own, so it writes nothing more and never waits on a key service; a check under way, or none yet, is no verdict.
-    const { wrongKek } = this.#prepared;
-    // Then, in one snapshot and without the log's lock, so that no append
-    // waits on it: every member's row checked, since rows changed around the
-    // vault write nothing to the log; and the chain recomputed, every hash
-    // from content and every vault entry by its MAC, from the first entry
-    // once an hour, since an entry cut from the middle leaves the hashes
-    // around a later checkpoint as they were (`#recompute`).
+    const { wrongKek, logKeys } = this.#prepared;
+    const { walks } = this.#prepared.options;
     const found: NewEntry[] = [];
-    const whole = await this.#db.transaction(async (tx) => {
+    // The newest checkpoint entry, signed or refused, as this call's snapshot found it.
+    let seen: bigint | null = null;
+    const walked = await this.#db.transaction(async (tx) => {
+      seen = (await store.newestCheckpointEntry(tx))?.seq ?? null;
       await this.#sweep(tx, found);
-      return this.#recompute(tx);
+      const from = await this.#resume(tx, 'newest');
+      if (!from.ok) return from;
+      const signed = headOf(from.at);
+      if (!(await this.#holding(tx, [signed]))(signed)) {
+        return { ok: false as const, failedAtSeq: null, reason: `the log up to entry ${signed.seq} is not the prefix the last checkpoint signed` };
+      }
+      const gap = await missingEntry(tx, from.at.seq);
+      if (gap !== null) return { ok: false as const, failedAtSeq: Number(gap.found), reason: `sequence gap: expected seq ${gap.expected}, found ${gap.found}` };
+      const walk = new Walk(from.tally, from.digest);
+      const chain = await rehash(tx, logKeys, from.at, walk, { limit: walks.checkpoint });
+      if (!chain.ok) return chain;
+      const unsigned = await this.#checkpointFault(tx, walk.checkpoints);
+      if (unsigned !== null) return unsigned;
+      return { ok: true as const, from, tally: walk.tally(), digest: walk.digest(), at: chain.at, done: chain.done };
     }, SNAPSHOT);
+    // The past rehashed, in a snapshot of its own. The database failing it leaves the stretch for the
+    // next call, where it was, and the checkpoint is signed all the same, saying why (`warning`); a bug
+    // throws, as anywhere else.
+    let scrub: Scrubbed = { ok: true, next: walked.ok ? walked.from.scrub : null };
+    let stalled: string | null = null;
+    if (walked.ok) {
+      try {
+        scrub = await this.#db.transaction((tx) => this.#scrub(tx, walked.from), SNAPSHOT);
+      } catch (error) {
+        // Only the database not answering, or a statement it gave up on: anything else is coffre's to fix.
+        if (!isUnreachable(error) && !timedOut(error)) throw error;
+        stalled = `the rehash of the past did not run, and goes on where it was next time: ${(error as Error).message}`;
+      }
+    }
     return this.#decide([], async (d) => {
       for (const entry of found) if (!d.reports.includes(entry)) d.reports.push(entry);
       // Checkpoints one at a time, each against the one before.
       const head = await lockLogHead(d.tx);
-      const latest = await this.#latest(d.tx);
+      const latest = await store.latestVaultEntry(d.tx, [CHECKPOINT]);
       const refused = (code: RefusalCode, detail: Record<string, unknown>, message = MESSAGES[code]) =>
         new Refused(refusal(code, message), [
           { actor: SCHEDULER, action: CHECKPOINT, decision: 'deny', code, metadata: JSON.stringify(detail) },
@@ -2437,33 +2564,104 @@ class VaultService implements Vault {
       // Logging the refusal would give the next call something to sign.
       if (head.nextSeq === 0n) throw new Refused(refusal('invalid', 'the log is empty'), []);
       if (wrongKek !== null) throw refused('wrong_kek', { reason: wrongKek }, wrongKek);
-      if (!whole.verification.ok) {
-        throw refused('log_broken', { failedAtSeq: whole.verification.failedAtSeq, reason: whole.verification.reason });
+      if (!walked.ok) throw refused('log_broken', { failedAtSeq: walked.failedAtSeq, reason: walked.reason });
+      if (!scrub.ok) throw refused('log_broken', { failedAtSeq: scrub.failedAtSeq, reason: scrub.reason });
+      const newest = latest === undefined ? null : (JSON.parse(latest.metadata) as Checkpoint);
+      // Another call checkpointed, or refused to, since this one's snapshot, or this one's rehash of the past
+      // could not run: what it would sign over is not what it checked. A refusal for a broken log stands,
+      // and a checkpoint signed meanwhile is the newest prefix; the next call starts from them.
+      if (stalled !== null || ((await store.newestCheckpointEntry(d.tx))?.seq ?? null) !== seen) {
+        const standing = await this.#standingRefusal(d.tx);
+        if (standing !== null) throw refused('log_broken', standing);
+        if (stalled === null && newest !== null) return { checkpoint: signedPart(newest) };
       }
-      // Nothing since the last one: it is still the newest prefix.
-      if (latest !== null && latest.seq === head.nextSeq - 1n) return { checkpoint: latest.checkpoint };
+      // Nothing since the last one, which signed every entry before its own: it is still the newest prefix.
+      if (newest !== null && latest!.seq === head.nextSeq - 1n && latest!.relatedSeq === latest!.seq - 1n) return { checkpoint: signedPart(newest) };
       // Under the lock, the rest: the prefix signed last still where it was,
-      // and every entry since the snapshot. A rewrite is never signed over.
-      if (latest !== null && !(await carries(d.tx, latest.checkpoint))) {
-        throw refused('log_broken', { reason: `the log up to entry ${latest.checkpoint.seq} is not the prefix the last checkpoint signed` });
+      // and every entry since the snapshot, unless the walk is catching up,
+      // when what it walked must still be there. A rewrite is never signed over.
+      if (newest !== null && !(await carries(d.tx, newest))) {
+        throw refused('log_broken', { reason: `the log up to entry ${newest.seq} is not the prefix the last checkpoint signed` });
       }
-      const { verification: held, anchor: verified } = await verifyChain(d.tx, this.#prepared.logKeys, [], whole.anchor);
-      if (!held.ok) throw refused('log_broken', { failedAtSeq: held.failedAtSeq, reason: held.reason });
-      // It signs the entry it verified to, which the head, locked, must name.
-      if (verified.nextSeq !== head.nextSeq || !verified.hash.equals(head.headHash)) {
-        throw refused('log_broken', { reason: 'the chain head does not name the last entry' });
+      const walk = new Walk(walked.tally, walked.digest);
+      let { at } = walked;
+      if (walked.done) {
+        // Where the snapshot's walk ended still has the hash it found there: what follows links to it.
+        if (!(await carries(d.tx, headOf(at)))) {
+          throw refused('log_broken', { failedAtSeq: Number(at.seq), reason: `the log up to entry ${at.seq} changed while the vault walked it` });
+        }
+        const rest = await rehash(d.tx, logKeys, at, walk, {});
+        if (!rest.ok) throw refused('log_broken', { failedAtSeq: rest.failedAtSeq, reason: rest.reason });
+        const unsigned = await this.#checkpointFault(d.tx, walk.checkpoints);
+        if (unsigned !== null) throw refused('log_broken', { failedAtSeq: unsigned.failedAtSeq, reason: unsigned.reason });
+        at = rest.at;
+        // It signs the entry it verified to, which the head, locked, must name.
+        if (at.seq !== head.nextSeq - 1n || !at.hash.equals(head.headHash)) {
+          throw refused('log_broken', { reason: 'the chain head does not name the last entry' });
+        }
+      } else if (!(await carries(d.tx, headOf(at)))) {
+        throw refused('log_broken', { reason: `the log up to entry ${at.seq} changed while the vault walked it` });
       }
-      const signed = { seq: Number(verified.nextSeq - 1n), hash: verified.hash.toString('hex'), signedAt: iso(d.at) };
+      // Another call signed as far, or further, while this one walked behind the head: that is the newest prefix, never one shorter.
+      if (newest !== null && latest!.relatedSeq !== null && latest!.relatedSeq >= at.seq) return { checkpoint: signedPart(newest) };
+      this.#prepared.verified = further(this.#prepared.verified, at);
+      const tally = walk.tally();
+      // Its members and grants once, in the first checkpoint after they change; the others name that one.
+      const digest = walk.digest();
+      const { from } = walked;
+      const access = digest === from.digest && from.carrier !== null ? { digest, at: Number(from.carrier) } : { digest, ...tally.access };
+      const signed = { seq: Number(at.seq), hash: at.hash.toString('hex'), signedAt: iso(d.at) };
       const checkpoint = {
         ...signed,
         keyId: this.#prepared.signer.keyId,
         signature: await this.#prepared.signer.sign(checkpointMessage(signed)),
       };
-      d.log.push({ actor: SCHEDULER, action: CHECKPOINT, decision: 'allow', metadata: JSON.stringify(checkpoint) });
-      return { checkpoint };
+      const lap = scrub.next === null ? null : { at: headOf(scrub.next.at), end: headOf(scrub.next.end) };
+      const kept: TalliedCheckpoint = { ...checkpoint, tally: { v: TALLY_VERSION, ...tally, access }, scrub: lap };
+      d.log.push({ actor: SCHEDULER, action: CHECKPOINT, decision: 'allow', relatedSeq: at.seq, metadata: JSON.stringify(kept) });
+      return stalled === null ? { checkpoint } : { checkpoint, warning: stalled };
     });
   }
 
+  /**
+   * The prefixes signed before, rehashed a stretch at a time, in laps: a lap
+   * runs from the first entry to the prefix the newest checkpoint signed
+   * when it began, which it keeps (`end`), `walks.scrub` entries a call, each
+   * hash recomputed from its entry and each link checked (`relink`); the
+   * next lap runs to the prefix signed then. A checkpoint resumes from the
+   * newest one's tally and never reads what it signed again, and an entry
+   * before it edited in place, its stored hash left as it was, keeps the
+   * chain: this is what finds it, within two laps at most, each the length
+   * of the log when it began over `walks.scrub` beats, however fast the log
+   * grows meanwhile. The lap as it goes on, null between laps.
+   */
+  async #scrub(db: Queryable, newest: Resumed): Promise<Scrubbed> {
+    const lap = newest.scrub ?? { at: START, end: newest.at };
+    if (lap.end.seq < 0n) return { ok: true, next: null };
+    const relinked = await relink(db, lap.at, lap.end.seq, this.#prepared.options.walks.scrub);
+    if (!relinked.ok) return relinked;
+    if (relinked.at.seq < lap.end.seq) return { ok: true, next: { at: relinked.at, end: lap.end } };
+    // A lap ends at the prefix a checkpoint signed, or it was not the chain the checkpoints signed.
+    if (!relinked.at.hash.equals(lap.end.hash)) {
+      return { ok: false, failedAtSeq: Number(lap.end.seq), reason: `the log up to entry ${lap.end.seq} is not the prefix a checkpoint signed` };
+    }
+    return { ok: true, next: null };
+  }
+
+  /**
+   * The newest refusal for a broken log since the newest checkpoint was
+   * signed, by the vault's MAC, as it said: it stands, for every
+   * verification and checkpoint, until a checkpoint is signed, which takes
+   * the check that found it running again and passing. A refusal of
+   * another kind since, a wrong KEK, hides none.
+   */
+  async #standingRefusal(db: Queryable): Promise<{ failedAtSeq?: number | null; reason?: string } | null> {
+    const signed = await store.latestVaultEntry(db, [CHECKPOINT]);
+    const refused = await store.newestRefusal(db, CHECKPOINT, 'log_broken', signed?.seq ?? -1n);
+    if (refused === undefined || !this.#authentic(refused)) return null;
+    return JSON.parse(refused.metadata) as { failedAtSeq?: number | null; reason?: string };
+  }
+
   async about(): Promise<{ checkpointKeys: Record<string, CheckpointKey>; owners: string[]; rootAdmins: [] }> {
     await this.#settled();
     const { signers, since } = this.#prepared;
@@ -2487,41 +2685,123 @@ class VaultService implements Vault {
     return { current: { kekProvider: provider, kekId: keyId }, checks };
   }
 
-  verifyLog(input: VerifyLogInput): Promise<LogVerification> {
-    return this.#verifyAll(input.upTo ?? null);
-  }
-
   /**
-   * The whole log, in one snapshot and one pass over the vault's entries:
-   * each by its MAC, the keys it moved through, and what the other checks
-   * need of it, gathered as it goes (`Findings`); then every checkpoint, the
-   * heads that must still be there, the key batches accounted for, and the
-   * members and grants replayed.
+   * The log from a checkpoint's tally, in one snapshot: the vault's
+   * entries since, each by its MAC, the keys it moved through, and what the
+   * other checks need of it (`Walk`); then every checkpoint walked, the
+   * heads that must still be there, and, for a walk that ends at the
+   * present, the key batches accounted for and the members and grants
+   * replayed against their rows.
    *
    * With `upTo`, the head the app verified to, the links and hashes of the
-   * chain are the app's to recompute, as it just has, over its own snapshot,
-   * through that head; `carries(upTo)` ties this snapshot to that one. So
-   * the vault reads only its own entries, each checked against its own hash
-   * and MAC over the link it names. Without `upTo`, nobody else recomputed
-   * the chain: the vault reads it all, and rehashes every link.
+   * chain are the app's to recompute, as it just has, over its own
+   * snapshot, through that head; holding `upTo` ties this snapshot to that
+   * one. So the vault reads only its own entries, each checked against its
+   * own hash and MAC over the link it names. Without `upTo`, nobody else
+   * recomputed the chain: the vault reads it all, and rehashes every link,
+   * no further than one walk (`walks.verify`).
    */
-  async #verifyAll(upTo: LogHead | null): Promise<LogVerification> {
+  async verifyLog(input: VerifyLogInput): Promise<LogVerification> {
     await this.#settled();
-    return this.#db.transaction(async (tx) => {
+    const upTo = input.upTo ?? null;
+    const { logKeys } = this.#prepared;
+    const { walks } = this.#prepared.options;
+    return this.#db.transaction(async (tx): Promise<LogVerification> => {
       const remembered = this.#prepared.verified;
-      const findings = new Findings();
-      const read = upTo === null ? await this.#rehashed(tx, findings) : await this.#ownEntries(tx, findings);
-      if (!read.ok) return read;
-      // Each head the log must still hold, in one read: the app's, every checkpoint's, and the last this vault rehashed.
-      const heads: LogHead[] = [...(upTo === null ? [] : [upTo]), ...findings.checkpoints.map(({ checkpoint }) => checkpoint)];
-      const rememberedHead = remembered.nextSeq > 0n ? { seq: Number(remembered.nextSeq - 1n), hash: remembered.hash.toString('hex') } : null;
-      if (rememberedHead !== null) heads.push(rememberedHead);
-      const hashes = await store.hashesAt(tx, [...new Set(heads.map((head) => BigInt(head.seq)))]);
-      const holds = (head: LogHead) => head.hash === GENESIS_HASH.toString('hex') || hashes.get(BigInt(head.seq))?.toString('hex') === head.hash;
+      const from = await this.#resume(tx, input.from === undefined ? 'newest' : input.from === 'start' ? 'start' : BigInt(input.from));
+      if (!from.ok) return from;
+      // Where a stretch ends, the last entry its checkpoint names: that checkpoint, and each it passes on the
+      // way, are held to the walk as it gets there, so a fault on the way is named where it is.
+      const to = input.to === undefined ? null : BigInt(input.to);
+      const ends = to === null ? null : (await store.entriesAt(tx, [to])).get(to)?.relatedSeq ?? -1n;
+      if (ends !== null && (ends <= from.at.seq || (upTo !== null && BigInt(upTo.seq) !== ends))) {
+        return { ok: false, failedAtSeq: Number(to), reason: 'not a checkpoint after the one the walk starts from, whose prefix ends where the app verified to' };
+      }
+      // The prefix the walk starts from still there, as it was signed, and whole: a rewrite chained again
+      // changes its hash, and a cut its count.
+      if (!(await this.#holding(tx, [headOf(from.at)]))(headOf(from.at))) {
+        return { ok: false, failedAtSeq: Number(from.entry), reason: `the log up to entry ${from.at.seq} is not the prefix this checkpoint signed: it was rewritten` };
+      }
+      const gap = await missingEntry(tx, from.at.seq);
+      if (gap !== null) return { ok: false, failedAtSeq: Number(gap.found), reason: `sequence gap: expected seq ${gap.expected}, found ${gap.found}` };
+      // Every checkpoint after it whose prefix the walk may pass, a stretch's end among them, signed while
+      // the app walked or not: each tally is held to the walk where it gets there (`Walk.expect`).
+      const walk = new Walk(from.tally, from.digest);
+      const later = await store.talliedAfter(tx, from.entry ?? -1n, walks.verify);
+      const passed = later.filter(({ seq }) => to === null || seq <= to);
+      if (to !== null && passed.at(-1)?.seq !== to) {
+        return { ok: false, failedAtSeq: Number(to), reason: `a stretch passes no more than ${walks.verify} checkpoints: end one sooner` };
+      }
+      // Each one's tally as what the walk must come to, a few at a time, so that members and grants kept whole
+      // in many of them are never all in memory: the digest it keeps of them stands for them.
+      // Each one's members and grants are as its digest says, kept whole in it or in the earlier checkpoint it
+      // names, each such checkpoint read once: what a walk resuming from it would find.
+      const holding = new Map<bigint, string | null>();
+      const carried = async (carrier: bigint): Promise<string | null> => {
+        if (!holding.has(carrier)) {
+          const entry = (await store.entriesAt(tx, [carrier])).get(carrier);
+          const read = entry === undefined ? 'missing' : this.#tallied(entry);
+          holding.set(carrier, typeof read === 'string' || 'at' in read.tally.access ? null : keptDigest(read.tally.access));
+        }
+        return holding.get(carrier)!;
+      };
+      const expected: Expected[] = [];
+      // The hash the stretch's own checkpoint signed, as it is read among the others.
+      let endSigned: string | null = null;
+      for (let after = from.entry ?? -1n, last = passed.at(-1)?.seq; last !== undefined && after < last; ) {
+        const batch = await store.talliedWithin(tx, after, last, walks.verify + 1);
+        if (batch.length === 0) break;
+        for (const entry of batch) {
+          const read = this.#tallied(entry);
+          const point = { entry: entry.seq, through: entry.relatedSeq! };
+          if (typeof read === 'string') {
+            expected.push({ ...point, unreadable: read });
+            continue;
+          }
+          if (entry.seq === to) endSigned = read.hash;
+          const { access } = read.tally;
+          if (!('at' in access)) holding.set(entry.seq, keptDigest(access));
+          const kept = 'at' in access ? (BigInt(access.at) < entry.seq ? await carried(BigInt(access.at)) : null) : holding.get(entry.seq)!;
+          expected.push(kept === access.digest
+            ? { ...point, key: expectedKey(read.tally) }
+            : { ...point, unreadable: kept === null ? `its tally keeps its members and grants in entry ${'at' in access ? access.at : entry.seq}, which holds none` : "its tally's members and grants do not match their digest" });
+        }
+        after = batch.at(-1)!.seq;
+      }
+      walk.expect(expected);
+      // How far the walk got, the hash there, and whether that is the present: the rows and the key batches
+      // are held to the log only when the walk read every entry of the vault's there is.
+      let through = from.at.seq;
+      let reached = headOf(from.at).hash;
+      let present = false;
+      if (upTo === null) {
+        const chain = await rehash(tx, logKeys, from.at, walk, ends === null ? { limit: walks.verify } : { to: ends });
+        if (!chain.ok) return chain;
+        [through, reached, present] = [chain.at.seq, headOf(chain.at).hash, chain.done && ends === null];
+        this.#prepared.verified = further(this.#prepared.verified, chain.at);
+      } else {
+        // On past the app's head, to the vault's last entry in this snapshot: the rows are as they are at
+        // this one's. The app's head bounds what is verified; the vault's own walk, what the rows meet.
+        const own = await ownEntries(tx, logKeys, from.at.seq, walk, ends === null ? { limit: walks.verify } : { to: ends });
+        if (!own.ok) return own;
+        // An app older than 0.10.1 names no `from`, and takes an ok for the whole of `upTo`: it gets one only for that.
+        if (!own.done && input.from === undefined) {
+          return { ok: false, failedAtSeq: null, reason: `the vault verifies no more than ${walks.verify} of its entries a call, and its checkpoints are catching up: update the app` };
+        }
+        // Short of its own last entry, it has not held the rows to the log: never say it verified all the app did.
+        const short = own.at < BigInt(upTo.seq) ? own.at : BigInt(upTo.seq) - 1n;
+        [through, reached, present] = [own.done ? BigInt(upTo.seq) : short, upTo.hash, own.done && ends === null];
+      }
+      walk.finish(ends ?? through);
+      // Each head the log must still hold, in one read: the app's, every
+      // checkpoint's walked, and the last this vault rehashed.
+      const rememberedHead = remembered.seq >= 0n ? headOf(remembered) : null;
+      const heads = [...(upTo === null ? [] : [upTo]), ...(rememberedHead === null ? [] : [rememberedHead])];
+      const holds = await this.#holding(tx, [...heads, ...walk.checkpoints.map(({ checkpoint }) => checkpoint)]);
       if (upTo !== null && !holds(upTo)) {
         return { ok: false, failedAtSeq: upTo.seq, reason: 'not the entry the app verified up to: the log changed between the two checks' };
       }
-      const unsigned = await this.#checkpointFault(findings, holds);
+      const unsigned = await this.#checkpointFault(tx, walk.checkpoints, holds);
       if (unsigned !== null) return unsigned;
       // What this vault last verified must still be there: whoever holds
       // its key can seal a rewrite, but cannot put back the head it saw. A
@@ -2529,57 +2809,46 @@ class VaultService implements Vault {
       if (rememberedHead !== null && !holds(rememberedHead)) {
         return { ok: false, failedAtSeq: rememberedHead.seq, reason: 'changed since the vault last verified it' };
       }
+      if (walk.mismatch !== null) return { ok: false, failedAtSeq: Number(walk.mismatch.entry), reason: walk.mismatch.reason };
+      if (ends !== null) {
+        // The walk ends at the prefix the stretch's checkpoint signed, by its hash too: a chain made again from before it is not.
+        if ((upTo === null && through !== ends) || endSigned !== reached) {
+          return { ok: false, failedAtSeq: Number(to), reason: `the log up to entry ${ends} is not the prefix this checkpoint signed: it was rewritten` };
+        }
+        return { ok: true, entries: walk.entries, through: Number(ends) };
+      }
+      // A checkpoint refused since the newest was signed, for a broken log: what it found, the stretch of the
+      // past it rehashed among it, which no walk from a tally reads again.
+      const standing = await this.#standingRefusal(tx);
+      if (standing !== null) {
+        return { ok: false, failedAtSeq: standing.failedAtSeq ?? null, reason: `the last checkpoint was refused: ${standing.reason ?? 'the log is broken'}` };
+      }
+      const verified = { ok: true as const, entries: walk.entries, through: Number(through) };
+      if (!present) return verified;
       const at = await this.#now(tx);
-      const accounting = findings.accounting.result(at);
+      const accounting = walk.accounting.result(at);
       if (!accounting.ok) return accounting;
       const [rows, held] = await Promise.all([store.allMembers(tx), store.grants(tx)]);
-      const fault = this.#unsealed(rows, held, findings.newestAccess) ?? findings.replayFault ?? replayFault(findings.replayed, rows, held, at);
+      const fault = this.#unsealed(rows, held, walk.newestAccess) ?? walk.replayFault ?? replayFault(walk.replayed, rows, held, at);
       if (fault !== null) return { ok: false, failedAtSeq: null, reason: describeAccessFault(fault), fault };
-      const verified = { ok: true as const, entries: findings.entries };
       return accounting.pending === 0 ? verified : { ...verified, pending: accounting.pending };
     }, SNAPSHOT);
   }
 
   /**
-   * The vault's own entries, oldest first: each against its own hash, and by
-   * its MAC, over the link it names, which the app checked; and the vault's
-   * keys moving only forward through them.
+   * Every checkpoint walked, not only the newest: each signed by the key
+   * whose log key wrote its entry, over a prefix the log still holds,
+   * entry for entry, which one that keeps a tally names as related. Its
+   * entry's MAC is checked by now, and one under a key the vault replaced
+   * comes before the rotation.
    */
-  async #ownEntries(tx: Queryable, findings: Findings): Promise<{ ok: true } | Extract<LogVerification, { ok: false }>> {
-    const { logKeys } = this.#prepared;
-    let keys: readonly string[] = [];
-    for (let after = -1n; ; ) {
-      const batch = await store.vaultEntriesAfter(tx, after, VERIFY_BATCH);
-      if (batch.length === 0) return { ok: true };
-      for (const entry of batch) {
-        const result = verifyEntries([entry], { startSeq: entry.seq, startPrevHash: entry.prevHash, keys: logKeys });
-        if (!result.ok) return { ok: false, failedAtSeq: Number(result.failedAtSeq), reason: withCause(result.reason) };
-      }
-      const moved = forward(batch, keys, logKeys[0]!.keyId);
-      if ('failedAtSeq' in moved) return { ok: false, failedAtSeq: Number(moved.failedAtSeq), reason: moved.reason };
-      keys = moved.keys;
-      for (const entry of batch) findings.add(entry);
-      after = batch[batch.length - 1]!.seq;
-    }
-  }
-
-  /** The whole chain from its first entry: every link and hash, the vault's MACs; the furthest verified is kept for checkpoints. */
-  async #rehashed(tx: Queryable, findings: Findings): Promise<{ ok: true } | Extract<LogVerification, { ok: false }>> {
-    const { verification, anchor } = await verifyChain(tx, this.#prepared.logKeys, [], UNVERIFIED, (batch) => {
-      for (const entry of batch) if (entry.author === 'vault') findings.add(entry);
-    });
-    if (!verification.ok) return verification;
-    this.#prepared.verified = further(this.#prepared.verified, anchor);
-    return { ok: true };
-  }
-
-  /**
-   * Every checkpoint, not only the newest: each signed by the key whose log
-   * key wrote its entry, over a prefix the log still holds (`holds`), entry
-   * for entry. Its entry's MAC is checked by now, and one under a key the
-   * vault replaced comes before the rotation.
-   */
-  async #checkpointFault(findings: Findings, holds: (head: LogHead) => boolean): Promise<Extract<LogVerification, { ok: false }> | null> {
+  async #checkpointFault(
+    db: Queryable,
+    checkpoints: Walk['checkpoints'],
+    known?: (head: LogHead) => boolean,
+  ): Promise<Broken | null> {
+    if (checkpoints.length === 0) return null;
+    const holds = known ?? (await this.#holding(db, checkpoints.map(({ checkpoint }) => checkpoint)));
     const { logKeys, signers } = this.#prepared;
     // Each signer's key imported once, for this check only.
     const verifiers = new Map<string, Promise<(checkpoint: Checkpoint) => Promise<boolean>>>();
@@ -2588,7 +2857,6 @@ class VaultService implements Vault {
       if (verifier === undefined) verifiers.set(by.keyId, (verifier = checkpointVerifier(by.publicKey)));
       return verifier.then((verify) => verify(checkpoint));
     };
-    const { checkpoints } = findings;
     for (let from = 0; from < checkpoints.length; from += SIGNATURES_AT_ONCE) {
       const chunk = checkpoints.slice(from, from + SIGNATURES_AT_ONCE);
       // The signatures of a chunk at once, where crypto runs beside the code; the first fault, in the log's order.
@@ -2596,7 +2864,7 @@ class VaultService implements Vault {
         const by = signers[logKeys.findIndex((key) => key.keyId === entry.keyId)];
         if (by?.keyId !== checkpoint.keyId) return `a checkpoint signed under ${checkpoint.keyId}, in an entry written under ${entry.keyId}: each key signs only its own`;
         if (!(await signed(checkpoint, by))) return 'a checkpoint the vault did not sign';
-        if (BigInt(checkpoint.seq) >= entry.seq || !holds(checkpoint)) {
+        if (BigInt(checkpoint.seq) >= entry.seq || !holds(checkpoint) || (entry.relatedSeq !== null && entry.relatedSeq !== BigInt(checkpoint.seq))) {
           return `the log up to entry ${checkpoint.seq} is not the prefix this checkpoint signed: it was rewritten`;
         }
         return null;
@@ -2609,8 +2877,8 @@ class VaultService implements Vault {
 
   /**
    * The first member whose row fails its MAC, or names an older access
-   * entry than the log's newest about them (`newest`, from the full check's
-   * pass, where each entry's MAC was checked).
+   * entry than the log's newest about them (`newest`, from the walk, where
+   * each entry's MAC was checked, on from the tally).
    */
   #unsealed(rows: readonly Member[], held: readonly GrantRow[], newest: ReadonlyMap<string, bigint>): AccessFault | null {
     for (const row of rows) {
@@ -2622,40 +2890,80 @@ class VaultService implements Vault {
   }
 }
 
+type Broken = Extract<LogVerification, { ok: false }>;
+
 /**
- * What one pass over the vault's entries gathers for the other checks of a
- * full verification, so that the log is read once: the key batches, the
- * access entries replayed, each member's newest, and the checkpoints. Each
- * entry comes after its MAC was checked.
+ * Where a walk of the log resumes: the checkpoint's entry (null for the
+ * first entry), the end of the prefix it signed, the tally through there,
+ * its members and grants' digest and the entry that keeps them, and where
+ * the background rehash goes on from (`#scrub`).
  */
-class Findings {
-  readonly accounting = new KeyAccounting();
-  readonly replayed: Replayed = { members: new Map(), held: new Map() };
-  /** The first access entry the replay could not apply. */
-  replayFault: AccessFault | null = null;
-  /** Each member's newest allowed access entry, by seq. */
-  readonly newestAccess = new Map<string, bigint>();
-  /** Every allowed checkpoint, with its entry's seq and key: tens of thousands a year, so nothing more of it. */
-  readonly checkpoints: { entry: { seq: bigint; keyId: string }; checkpoint: Checkpoint }[] = [];
-  /** The vault's entries read. */
-  entries = 0;
-
-  add(entry: StoredEntry): void {
-    this.entries += 1;
-    this.accounting.add(entry);
-    if (entry.decision !== 'allow') return;
-    if (ACCESS.has(entry.action)) {
-      this.replayFault ??= apply(this.replayed, entry);
-      if (entry.subjectPrincipal !== null) this.newestAccess.set(entry.subjectPrincipal, entry.seq);
-    } else if (entry.action === CHECKPOINT) {
-      this.checkpoints.push({ entry: { seq: entry.seq, keyId: entry.keyId }, checkpoint: JSON.parse(entry.metadata) as Checkpoint });
-    }
+type Resumed = {
+  ok: true;
+  entry: bigint | null;
+  at: Position;
+  tally: Tally;
+  digest: string;
+  carrier: bigint | null;
+  scrub: Lap | null;
+};
+
+/** A lap of the rehash of the past: the last entry rehashed, and the prefix it rehashes to, signed when it began. */
+type Lap = { at: Position; end: Position };
+
+/** Whether a statement was cancelled for taking too long: Postgres's `query_canceled`, a statement timeout among them. */
+function timedOut(error: unknown): boolean {
+  for (let cause = error; typeof cause === 'object' && cause !== null; cause = (cause as { cause?: unknown }).cause) {
+    if ((cause as { code?: unknown }).code === '57014') return true;
   }
+  return false;
+}
+
+/** Where the next rehash of the past goes on from, null for the first entry; or what it found. */
+type Scrubbed = { ok: true; next: Lap | null } | Broken;
+
+const FIRST_ENTRY: Resumed = { ok: true, entry: null, at: START, tally: EMPTY_TALLY, digest: accessDigest(EMPTY_TALLY.access), carrier: null, scrub: null };
+
+/** How far one call walks the log, in entries: a checkpoint's walk from the last, its rehash of the past, and a verification's own walk. */
+export type Walks = { checkpoint: number; scrub: number; verify: number };
+
+/**
+ * A walk rehashes, MACs and replays some 40 µs of CPU an entry, and 95
+ * with V8's optimizer off, as on a cold isolate: 10,000 entries is a beat
+ * of catching up, about a second, and a team's instance writes fewer than
+ * a thousand a day. The rehash of the past is a hash an entry, 14 µs warm
+ * and 55 cold, beside two reads: 100 entries keep it near 6 ms a beat.
+ */
+const WALKS: Walks = { checkpoint: 10_000, scrub: 100, verify: 10_000 };
+
+/** The digest of the members and grants a checkpoint keeps whole, beside the digest it says they have. */
+function keptDigest({ members, grants, newest }: AccessTally): string {
+  return accessDigest({ members, grants, newest });
 }
 
-const ACCESS = new Set<string>(ACCESS_ACTIONS);
+/** Each checkpoint entry's metadata, parsed once however many times it is asked about: one may hold every member and grant. */
+const parsed = new WeakMap<StoredEntry, unknown>();
+function metadataOf(entry: StoredEntry): unknown {
+  if (!parsed.has(entry)) parsed.set(entry, JSON.parse(entry.metadata));
+  return parsed.get(entry);
+}
+
+/** A head, as an entry keeps it, as a walk goes on from it. */
+function positionOf(head: LogHead): Position {
+  return { seq: BigInt(head.seq), hash: Buffer.from(head.hash, 'hex') };
+}
+
+/** A position as the log's heads are named, in hex. */
+function headOf(position: Position): LogHead {
+  return { seq: Number(position.seq), hash: position.hash.toString('hex') };
+}
+
+/** What a checkpoint's signature covers, and nothing it keeps beside it. */
+function signedPart({ seq, hash, signedAt, keyId, signature }: Checkpoint): Checkpoint {
+  return { seq, hash, signedAt, keyId, signature };
+}
 
-/** Checkpoint signatures checked at once, in a full verification. */
+/** Checkpoint signatures checked at once. */
 const SIGNATURES_AT_ONCE = 256;
 
 /** Settle every operation before releasing the member lock, including cancelled requests. */
@@ -3075,8 +3383,7 @@ function readEdits(stored: { policy?: unknown }): PolicyEdits | null {
  * keeps its slug, which a scoped instance role's filters read. The edits
  * keep them all: no write is needed.
  */
-async function livePolicy(db: Queryable, edits: PolicyEdits, at: number): Promise<Policy> {
-  const rows = await store.environmentsById(db, edits.protected.map((place) => place.environmentId));
+function livePolicy(rows: ReadonlyMap<string, store.EnvironmentRow>, edits: PolicyEdits, at: number): Policy {
   const live = edits.protected.filter((place) => {
     const row = rows.get(place.environmentId);
     return row === undefined ? at - place.at < UNWRITTEN_FORK_MS : !row.deleted;