@coffre/vault 0.10.1 → 0.11.0

package/src/vault.ts

@@ -23,6 +23,7 @@ import {
   normalScope,
   NOTHING,
   ownsInstance,
+  ownsProject,
   PROJECT_ONLY_PERMISSIONS,
   ROLE_ID,
   ROLES,
@@ -38,7 +39,6 @@ import {
   type RoleDefinition,
   type Scope,
   type ServiceAccount,
-  withinCredential,
 } from '@coffre/core/access';
 import { GENESIS_HASH, verifyEntries, type LogKey, type StoredEntry } from '@coffre/core/audit';
 import { checkContext, ownerKey, type SecretContext } from '@coffre/core/envelope';
@@ -60,7 +60,6 @@ import {
   checkpointMessage,
   checkpointVerifier,
   describeAccessFault,
-  handsBack,
   POLICY_REVISION,
   policyRevision,
   type Access,
@@ -101,13 +100,15 @@ import {
 import type { Database, Queryable, Transaction } from '@coffre/db';
 import { isUniqueViolation, isUnreachable, SNAPSHOT } from '@coffre/db/dialect';
 import { everyProjectConversion, newestAccess, reportStands } from '@coffre/db/grants';
-import { appendEntries, lockLogHead, missingEntry, newestAuthentic, newestVaultSeq, type Appended, type Authenticity, type Newest, type NewEntry } from '@coffre/db/log';
+import { appendEntries, lockLogHead, missingEntry, newestAuthentic, type Appended, type Authenticity, type Newest, type NewEntry } from '@coffre/db/log';
 
 import { signer, type Signer } from './checkpoint.ts';
+import { keyRefusals, placeIn, referenceRefusal, refuses, sensitiveRefusals, useOnlyRefusals, type SecretPlace } from './decide.ts';
 import type { ResolvedVaultConfig } from './config.ts';
 import { carries, further, ownEntries, rehash, relink, START, vaultLogKey, VERIFY_BATCH, withCause, type Position } from './log.ts';
 import { apply, replayFault, type LoggedMember, type Replayed } from './replay.ts';
 import { memberMac, rowKey, sameGrants, sealed, standing } from './rows.ts';
+import { snapshot, type Asked, type Snapshot } from './snapshot.ts';
 import * as store from './store.ts';
 import { accessDigest, CHECKPOINT, EMPTY_TALLY, expectedKey, TALLY_VERSION, Walk, type AccessTally, type Expected, type TalliedCheckpoint, type Tally } from './tally.ts';
 import { ACCESS_ACTIONS, type GrantRow, type Member } from './store.ts';
@@ -317,7 +318,7 @@ class Outage {
 }
 
 /** A rewrap that would make a value less sensitive than it is. */
-const LOOSER = 'a value is made less sensitive only by writing it again: an old version comes back, and a key is made stricter, as sensitive as its newest version or more';
+const LOOSER = 'a value is made less sensitive only by writing it again: an old version comes back, and a key is made stricter, as sensitive as its newest version or more; only its current sensitive value is made a secret in place, by an Owner of its project';
 
 function refusal(code: RefusalCode, message: string): Refusal {
   return { code, message };
@@ -334,6 +335,8 @@ const MESSAGES: Record<RefusalCode, string> = {
   ended: 'the reference read through was ended',
   personal: "a personal config's values are its owner's alone",
   sensitive: "a sensitive value is never shown to anyone, Owners included: `coffre run` gives your app a placeholder for it through the credential proxy, and a service account reads it",
+  not_owner_issued: 'a service account reads a sensitive value only on a token or trust binding an Owner of its project issued',
+  use_only: "a workload uses this value through coffre and never holds it: list it in its binding's reads, where the value is held, if it must",
   not_allowed: 'not allowed to change this',
   last_owner: 'the last Owner of the whole instance stays one: make someone else an Owner first',
   invalid: 'not something the rules allow',
@@ -354,6 +357,8 @@ type Decision = {
   members: Map<string, Member>;
   /** The database's clock, read once the members are locked. */
   at: number;
+  /** What the decision reads, in one statement once the members are locked: under the head, unless it takes the head late. */
+  reads: Snapshot;
   log: NewEntry[];
   writes: ((at: number) => Promise<void>)[];
   /** Members whose row or grants the writes change: sealed again once they have run. */
@@ -378,6 +383,13 @@ type Decision = {
   underLock: ((locked: Queryable) => Promise<void>)[];
 };
 
+/**
+ * What a decision reads besides its members' standing, with it (`Snapshot`):
+ * places, references' ends, and the distinct keys a principal would hold
+ * released in the vault's window, with `keys` too: the bulk limit's count.
+ */
+type Reads = Pick<Asked, 'environments' | 'references'> & { released?: { principal: string; keys: readonly string[] } };
+
 /** The actions of the entries the vault writes about keys. */
 type KeyAction = 'secret.read' | 'key.wrap' | 'key.rewrap';
 
@@ -386,13 +398,21 @@ type Correlation = { requestId?: string | null; operationId?: string | null; cre
 
 /**
  * What the one asking holds through the credential their request came in
- * on: no more than its scope (`allows`). A scope that is not one is a bug
- * of the app's, which fails the call.
+ * on: no more than its scope (`allows`), and, a workload's, handed back
+ * only what the scope lists (`useOnly`). A scope that is not one, a kind of
+ * caller its principal cannot be, or a workload with no scope to list what
+ * it reads, is a bug of the app's, which fails the call. None said is an
+ * app older than 0.11, which has no workloads (`Through`).
  */
-function through(standing: Standing, { credentialScope }: Through): Standing {
-  if (credentialScope == null) return standing;
-  if (!isCredentialScope(credentialScope)) throw new Error('credentialScope must be a list of grants, one a place');
-  return { ...standing, live: { ...standing.live, credentialScope }, all: { ...standing.all, credentialScope } };
+function through(standing: Standing, { credentialScope, caller }: Through): Standing {
+  const { principal } = standing;
+  if (caller !== undefined && !(caller === 'person' ? principal.startsWith('user:') : (caller === 'bearer' || caller === 'workload') && principal.startsWith('token:'))) {
+    throw new Error(`caller must be person for a user: principal, bearer or workload for a token: one, got: ${String(caller)}`);
+  }
+  if (caller === 'workload' && credentialScope == null) throw new Error('a workload caller comes with its credential scope, which lists what it reads');
+  if (credentialScope != null && !isCredentialScope(credentialScope)) throw new Error('credentialScope must be a list of grants, one a place');
+  const held = { ...(credentialScope == null ? {} : { credentialScope }), ...(caller === undefined ? {} : { kind: caller }) };
+  return { ...standing, live: { ...standing.live, ...held }, all: { ...standing.all, ...held } };
 }
 
 /** The credential a CI run's request came in on, as its entries record it: copied, never decided on. */
@@ -448,6 +468,22 @@ class VaultService implements Vault {
     return (await store.now(db)) + this.#prepared.options.clockOffset();
   }
 
+  /** A snapshot's clock, as the vault keeps time (`#now`). */
+  #at(reads: Snapshot): number {
+    return reads.at + this.#prepared.options.clockOffset();
+  }
+
+  /** What a decision about `principals` reads, and `asked` besides, in one statement: under the head when `head` is set. */
+  #snapshot(tx: Transaction, principals: readonly string[], asked: Reads, head: boolean): Promise<Snapshot> {
+    const { released, ...rest } = asked;
+    return snapshot(tx, {
+      ...rest,
+      principals,
+      head,
+      ...(released === undefined ? {} : { released: { ...released, windowMs: this.#config.bulkLimit.windowMs, clockOffsetMs: this.#prepared.options.clockOffset() } }),
+    });
+  }
+
   /**
    * Decide in one transaction, with `principals`' rows locked first, then
    * the log's head. A `Refused` or an `Outage` rolls back all but its own
@@ -460,18 +496,18 @@ class VaultService implements Vault {
    * alone takes the head later (`late`), once its key service has answered,
    * which it must not wait on holding it, and decides again then (`#keys`).
    */
-  async #decide<T>(principals: readonly string[], decide: (d: Decision) => Promise<T>, late = false): Promise<Outcome<T>> {
+  async #decide<T>(principals: readonly string[], decide: (d: Decision) => Promise<T>, late = false, asked: Reads = {}): Promise<Outcome<T>> {
     const superseded = await this.#settled();
     if (superseded !== null) return { ok: false, refusal: refusal('wrong_kek', superseded) };
-    return this.#decideNow(principals, decide, late);
+    return this.#decideNow(principals, decide, late, asked);
   }
 
   /** `#decide`, once the vault is settled. */
-  async #decideNow<T>(principals: readonly string[], decide: (d: Decision) => Promise<T>, late = false): Promise<Outcome<T>> {
+  async #decideNow<T>(principals: readonly string[], decide: (d: Decision) => Promise<T>, late = false, asked: Reads = {}): Promise<Outcome<T>> {
     const reports: NewEntry[] = [];
     for (let attempt = 1; ; attempt += 1) {
       try {
-        return await this.#decideOnce(principals, decide, reports, late);
+        return await this.#decideOnce(principals, decide, reports, late, asked);
       } catch (error) {
         // A member who had no row when this decision locked theirs, and has
         // one now: another decision admitted them meanwhile. Again, with it.
@@ -481,15 +517,15 @@ class VaultService implements Vault {
     }
   }
 
-  async #decideOnce<T>(principals: readonly string[], decide: (d: Decision) => Promise<T>, reports: NewEntry[], late: boolean): Promise<Outcome<T>> {
+  async #decideOnce<T>(principals: readonly string[], decide: (d: Decision) => Promise<T>, reports: NewEntry[], late: boolean, asked: Reads): Promise<Outcome<T>> {
     try {
       const result = await this.#db.transaction(async (tx) => {
         await store.boundLockWaits(tx, LOCK_TIMEOUT_MS);
         const members = principals.length === 0 ? new Map<string, Member>() : await store.lockMembers(tx, principals);
-        if (!late) await lockLogHead(tx);
-        // The clock once the locks are held, in a statement of its own: one that waited for a lock is decided as of when it got it.
+        // Then the head, and everything the decision reads, in one statement (`snapshot` says why it holds).
+        const reads = await this.#snapshot(tx, principals, asked, !late);
         const d: Decision = {
-          tx, members, at: await this.#now(tx), log: [], writes: [], touched: new Set(), grants: new Map(), reports, after: [], underLock: [],
+          tx, members, at: this.#at(reads), reads, log: [], writes: [], touched: new Set(), grants: new Map(), reports, after: [], underLock: [],
         };
         const result = await decide(d);
         // A read is logged once per place, whichever way it ends (`readsByPlace`).
@@ -498,7 +534,9 @@ class VaultService implements Vault {
         // Each member's newest access entry, which their row names (rows.ts).
         const accessSeq = new Map<string, bigint>();
         if (entries.length > 0) {
-          const appended = await this.#append(tx, entries, d.underLock);
+          // Under the head the decision's reads took: a remote key's decision takes it late, and reads again with it.
+          if (d.reads.head === null) throw new Error('a decision appends only under the head it read with');
+          const appended = await this.#append(tx, entries, d.underLock, d.reads);
           at = appended.occurredAt;
           entries.forEach((entry, i) => {
             if (isAccessEntry(entry)) accessSeq.set(entry.subjectPrincipal!, appended.seqStart + BigInt(i));
@@ -557,12 +595,12 @@ class VaultService implements Vault {
    * MAC are passed over, and reported: otherwise whoever can insert a row
    * could lock any member out.
    */
-  async #integrity(db: Queryable, principal: string, row: Member | undefined, grants: readonly GrantRow[], reports: NewEntry[]): Promise<Fault | null> {
+  async #integrity(db: Queryable, principal: string, row: Member | undefined, grants: readonly GrantRow[], reports: NewEntry[], reads?: Snapshot): Promise<Fault | null> {
     if (row !== undefined && !this.#sealed(row, grants)) {
       this.#report(reports, principal, 'mac', row.mac.toString('hex'));
       return 'mac';
     }
-    const newest = await this.#newestAccess(db, principal, reports);
+    const newest = await this.#newestAccess(db, principal, reports, reads);
     // No row, and no entry of the vault's own: someone never admitted. No
     // row, but one: one deleted, unless it was admitted since the row was
     // read. Too many forged to see past: neither a row nor the lack of one holds.
@@ -574,8 +612,14 @@ class VaultService implements Vault {
   }
 
   /** The newest access entry about `principal` that carries the vault's MAC (`newestAccess` in @coffre/db/grants). */
-  #newestAccess(db: Queryable, principal: string, reports: NewEntry[]): Promise<Newest> {
-    return newestAccess(db, principal, this.#check(reports, principal));
+  #newestAccess(db: Queryable, principal: string, reports: NewEntry[], reads?: Snapshot): Promise<Newest> {
+    if (reads === undefined || !reads.grants.has(principal)) return newestAccess(db, principal, this.#check(reports, principal));
+    // The snapshot's newest first, read with the rest; the pages before it, as they are asked.
+    const newest = reads.newestAccess.get(principal);
+    return newestAuthentic(
+      (limit, before) => (before === undefined ? Promise.resolve(newest === undefined ? [] : [newest]) : store.accessEntriesAbout(db, principal, limit, before)),
+      this.#check(reports, principal),
+    );
   }
 
   /** Entries in the vault's name told apart by their MACs, each it did not write reported, about `principal`. */
@@ -687,7 +731,7 @@ class VaultService implements Vault {
 
   async #replaceEveryProject(d: Decision, principal: string): Promise<void> {
     const row = d.members.get(principal);
-    const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
+    const subject = await this.#standing(d.tx, principal, row, d.at, d.reports, d.reads);
     if (row === undefined || subject.status !== 'active') return;
     const everyProject = subject.stored.filter((grant) => grant.projectId === null && grant.environmentId === null);
     if (everyProject.length === 0) return;
@@ -833,16 +877,29 @@ class VaultService implements Vault {
    * that an instance still running with the replaced KEK, as during a
    * deploy, cannot write after the rotation.
    */
-  #append(tx: Transaction, entries: readonly NewEntry[], underLock: readonly ((locked: Queryable) => Promise<void>)[] = []): Promise<Appended> {
+  async #append(
+    tx: Transaction,
+    entries: readonly NewEntry[],
+    underLock: readonly ((locked: Queryable) => Promise<void>)[] = [],
+    /** A snapshot that holds the head: what it read under it is read again by nothing. */
+    held?: Snapshot,
+  ): Promise<Appended> {
     const prepared = this.#prepared;
-    return appendEntries(tx, prepared.logKey, entries, async (locked) => {
-      const rotation = await store.latestVaultEntry(locked, [KEY_ROTATE]);
+    const head = held?.head ?? undefined;
+    const appended = await appendEntries(tx, prepared.logKey, entries, async (locked) => {
+      const rotation = head === undefined ? await store.latestVaultEntry(locked, [KEY_ROTATE]) : head.rotation ?? undefined;
       if (rotation !== undefined && !prepared.logKeys.some((key) => key.keyId === rotation.keyId)) {
         prepared.superseded = `the log moved on to ${rotation.keyId}, a key this vault does not hold: a vault given a newer vault key replaced it, and a replaced key writes nothing more`;
         throw new Error(prepared.superseded);
       }
       for (const check of underLock) await check(locked);
-    });
+    }, head === undefined ? undefined : { head, last: head.last, at: held!.at });
+    // The head still held, as this append left it, for the next append of the same transaction: a remote key's intent,
+    // then the decision's reports.
+    if (head !== undefined) {
+      held!.head = { ...head, nextSeq: appended.nextSeq, headHash: appended.headHash, last: { seq: appended.nextSeq - 1n, hash: appended.headHash } };
+    }
+    return appended;
   }
 
   // --- keys -------------------------------------------------------------------
@@ -906,10 +963,10 @@ class VaultService implements Vault {
         secrets: items.map((item) => item.secret),
         // Through a reference, the reader's grants on the holder's environment decide.
         places: sealed.map((seal, i) => seal?.holder ?? items[i]!.secret),
-        vet: ends.length === 0 ? undefined : async (db) => {
-          const ended = await store.endedReferences(db, ends);
-          return sealed.map((seal) => (seal !== null && ended.has(seal.seq) ? 'ended' : null));
-        },
+        // Which items are read through a reference: a sensitive one is never copied, which would move it out of its project.
+        viaReference: sealed.map((seal) => seal !== null),
+        references: ends,
+        vet: ends.length === 0 ? undefined : async (_, reads) => sealed.map((seal) => (seal !== null && reads.ended.has(seal.seq) ? 'ended' : null)),
         remote,
         entry,
         input,
@@ -975,16 +1032,22 @@ class VaultService implements Vault {
         ...keyEntry('key.rewrap', principal, source.secret, 'deny', 'bad_claim', input), secretVersionId: source.id,
       })));
     }
-    // A value is made looser only by writing it again: a sensitive version's key, or one of a secret whose newest is,
-    // is never wrapped again as anything but sensitive, so that a person who may not read it never makes it readable.
-    if (items.some((item, i) => item.secret.sensitive !== true && (loaded.versions[i].secret.sensitive || loaded.versions[i].newestSensitive))) {
+    // A value is made looser only by writing it again: a sensitive value's key, or one of a secret whose newest version
+    // is, is never wrapped again as anything but sensitive, so that a person who may not read it never makes it readable.
+    // Nor a version whose value was made sensitive since, in place: the newest version of its very ciphertext. But for one:
+    // a key's current sensitive value made a secret, in place, by an Owner of its project, who reads it anyway through a
+    // service account they give read (R30). Older versions stay as they were held.
+    const loosens = items.map((item, i) => item.secret.sensitive !== true && loaded.versions[i].secret.sensitive === true && loaded.versions[i].current);
+    const strict = (i: number) => loaded.versions[i].secret.sensitive || loaded.versions[i].heldSensitive || loaded.versions[i].newestSensitive;
+    if (items.some((item, i) => !loosens[i] && item.secret.sensitive !== true && strict(i))) {
       return this.#refuseVersions(principal, 'invalid', loaded.versions.map((source) => ({
         ...keyEntry('key.rewrap', principal, source.secret, 'deny', 'invalid', input), secretVersionId: source.id,
       })), LOOSER);
     }
     const sources = new Map(items.map((item, i) => [item.secret, loaded.versions[i]]));
+    const loosened = new Set(items.flatMap((item, i) => (loosens[i] ? [item.secret] : [])));
     const entry = (secret: SecretRef, decision: 'allow' | 'deny', code: string | null): NewEntry => ({
-      ...keyEntry('key.rewrap', principal, secret, decision, code, input, { from: sources.get(secret)!.secret.version }),
+      ...keyEntry('key.rewrap', principal, secret, decision, code, input, { from: sources.get(secret)!.secret.version, ...(loosened.has(secret) ? { was: 'sensitive' } : {}) }),
       secretVersionId: sources.get(secret)!.id,
     });
     const remote =
@@ -992,11 +1055,19 @@ class VaultService implements Vault {
     return this.#keys(
       {
         action: 'key.rewrap', principal, permission: 'secret.write', secrets: items.map((item) => item.secret), remote, entry, input,
-        // Again in the decision and under the log's head: a sensitive version written since it was loaded is as newest as any.
+        // Again in the decision and under the log's head: a sensitive version written since it was loaded is as newest as any,
+        // a value made sensitive in place since is so, and a value loosened is still its key's current one.
         vet: async (db) => {
           const newest = await store.newestSensitive(db, items.map(({ secret }) => secret.secretId));
-          return items.map(({ secret }) => (secret.sensitive !== true && newest.has(secret.secretId) ? 'invalid' : null));
+          // Each source again: current as the decision had it, its key's pointer and its newest, and its value as held now.
+          const again = new Map((await store.versions(db, items.map(({ secret }) => sources.get(secret)!.id))).map((version) => [version.id, version]));
+          return items.map(({ secret }, i) => {
+            const now = again.get(sources.get(secret)!.id);
+            if (loosens[i]) return now?.current === true ? null : 'invalid';
+            return secret.sensitive !== true && (newest.has(secret.secretId) || now?.heldSensitive === true) ? 'invalid' : null;
+          });
         },
+        owns: loosens,
         // An old value brought back, not the current one, is made live by whoever could have read it: a secret by its
         // readers, a sensitive one, which nobody reads, by those who use it, a plain one by any writer, as it was shown
         // to them. Whatever reads the key next, a reference to it included, then reads what its restorer could. Typing a
@@ -1095,16 +1166,23 @@ class VaultService implements Vault {
       secrets: readonly SecretRef[];
       /** Where each secret's permission is checked, when not where it is: a reference's holder. */
       places?: readonly SecretPlace[];
+      /** The `reference.create` entries `vet` asks about: read with the decision (`Snapshot`'s `ended`). */
+      references?: readonly bigint[];
       /**
        * What else refuses each secret, checked in the decision and again
-       * once the log's head is locked, before its entries append.
+       * once the log's head is locked, before its entries append: from the
+       * decision's reads, or the database.
        */
-      vet?: (db: Queryable) => Promise<(RefusalCode | null)[]>;
+      vet?: (db: Queryable, reads: Snapshot) => Promise<(RefusalCode | null)[]>;
       /**
        * Any one of which each secret takes besides `permission`, where it
        * is, read in the decision and again under the head; none for null.
        */
       needs?: (db: Queryable) => Promise<(readonly Permission[] | null)[]>;
+      /** Each secret that takes besides its reader being an Owner of its project (`ownsProject`): a sensitive value made a secret. */
+      owns?: readonly boolean[];
+      /** Which secrets are read through a reference, by index: a sensitive one of these is never copied (it would leave its project). */
+      viaReference?: readonly boolean[];
       remote: boolean;
       entry: (secret: SecretRef, decision: 'allow' | 'deny', code: string | null) => NewEntry;
       input: Correlation & Through & { purpose?: string; keepsSensitive?: boolean };
@@ -1128,48 +1206,25 @@ class VaultService implements Vault {
     // Each personal config's owner, hashed, by environment, as the decision read them: what its keys' contexts bind.
     const owners = new Map<string, string>();
     const check = async (d: Decision) => {
-      const reader = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports), call.input);
+      const reader = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports, d.reads), call.input);
       // One read of the environments the decision is about, as the store has them, not as the app sent them:
       // each secret's and, for a read through a reference, its holder's. A grant on one slug in every project
       // matches the slug there, and a place deleted on either side opens for none.
       const at = secrets.map((secret, i) => call.places?.[i] ?? secret);
-      const environments = await store.environmentsById(d.tx, [...secrets, ...at].map((place) => place.environmentId));
-      // A personal config's parent, whose read its owner needs.
-      const parents = [...environments.values()].flatMap((environment) => (environment.owner === null || environment.parentId === null ? [] : [environment.parentId]));
-      for (const [id, parent] of await store.environmentsById(d.tx, parents)) environments.set(id, parent);
-      const gone = (place: SecretPlace) => environments.get(place.environmentId)?.deleted ?? false;
+      // Each a personal config is a config of too, whose read its owner needs (`places`).
+      const environments = d.reads.environments;
       owners.clear();
       for (const [id, environment] of environments) if (environment.owner !== null) owners.set(id, ownerKey(environment.owner));
       const needs = call.needs === undefined ? [] : await call.needs(d.tx);
-      const codes: (RefusalCode | null)[] = secrets.map((secret, i) => {
-        const personal = personalRefusal(reader, principal, call.permission, secret, at[i]!, environments);
-        if (personal !== undefined) return personal;
-        const also = needs[i];
-        if (also != null) {
-          const place = placeIn(at[i]!, environments);
-          const refused = also.map((permission) => refuses(reader, permission, place, gone(secret) || gone(at[i]!)));
-          if (refused.every((code) => code !== null)) return refused[0]!;
-        }
-        // Through a reference, the holder's grants decide, its source's never: a reference takes its value and nature
-        // (a sensitive one stays use-only) from its source, and its permissions from where it lives. Its maker held what
-        // the source's nature asks when it was made (`reference`).
-        return refuses(reader, call.permission, placeIn(at[i]!, environments), gone(secret) || gone(at[i]!));
+      let codes = keyRefusals(reader, { principal, permission: call.permission, secrets, at, environments, needs, owns: call.owns });
+      if (call.vet !== undefined && !codes.some((code) => code !== null)) codes = await call.vet(d.tx, d.reads);
+      // Where each value is held, the secret itself, a reference's source or a fork's parent: what a workload lists.
+      codes = useOnlyRefusals(codes, reader, { action, purpose: call.input.purpose, secrets });
+      codes = sensitiveRefusals(codes, reader, {
+        action, principal, purpose: call.input.purpose, keepsSensitive: call.input.keepsSensitive, secrets, viaReference: call.viaReference,
       });
-      if (call.vet !== undefined && !codes.some((code) => code !== null)) {
-        (await call.vet(d.tx)).forEach((code, i) => (codes[i] = code));
-      }
-      // A sensitive value is only ever used for a person, never handed back, by whatever credential of theirs asks. And
-      // a fork copies one, for anyone, a service account too, only where its app says it keeps it sensitive: an app of
-      // 0.9, mid-deploy, would write the copy as a secret its people read.
-      const copying = action === 'secret.read' && call.input.purpose === 'copy';
-      const handedBack = action === 'secret.read' && principal.startsWith('user:') && handsBack({ purpose: call.input.purpose ?? '', keepsSensitive: call.input.keepsSensitive === true });
-      if (handedBack || (copying && call.input.keepsSensitive !== true)) {
-        secrets.forEach((secret, i) => {
-          if (codes[i] === null && secret.sensitive === true) codes[i] = 'sensitive';
-        });
-      }
       let first = codes.find((code) => code !== null) ?? null;
-      if (first === null && action === 'secret.read' && (await this.#overBulkLimit(d, principal, secrets.length))) first = 'bulk_limit';
+      if (first === null && action === 'secret.read' && this.#overBulkLimit(d)) first = 'bulk_limit';
       if (first !== null) {
         throw new Refused(
           refusal(first, MESSAGES[first]),
@@ -1178,6 +1233,12 @@ class VaultService implements Vault {
       }
     };
 
+    // Every decision below reads the places it is about with the reader's standing; a read, the reader's releases too.
+    const reads: Reads = {
+      environments: [...secrets, ...secrets.map((secret, i) => call.places?.[i] ?? secret)].map((place) => place.environmentId),
+      references: call.references ?? [],
+      ...(action === 'secret.read' ? { released: { principal, keys: secrets.map((secret) => secret.secretId) } } : {}),
+    };
     // The intent's own identity; `operationId` is the app's, for the whole action.
     const intentId = call.remote ? randomUUID() : null;
     let intentSeq: bigint | null = null;
@@ -1197,7 +1258,7 @@ class VaultService implements Vault {
     if (call.remote) {
       const intent = await this.#decide([principal], async (d) => {
         await check(d);
-        const at = await this.#now(d.tx);
+        const at = d.at;
         const appended = await this.#append(d.tx, [{
           actor: principal,
           action: 'key.intent',
@@ -1213,9 +1274,9 @@ class VaultService implements Vault {
             ...traced(call.input),
             keys: secrets.map((secret, item) => ({ item, subject: secret.path, secretId: secret.secretId, version: secret.version })),
           }),
-        }]);
+        }], [], d.reads);
         return { seq: appended.seqStart };
-      });
+      }, false, reads);
       if (!intent.ok) return intent;
       intentSeq = intent.seq;
     }
@@ -1242,7 +1303,7 @@ class VaultService implements Vault {
       const { vet } = call;
       if (late && vet !== undefined) {
         d.underLock.push(async (locked) => {
-          const codes = await vet(locked);
+          const codes = await vet(locked, d.reads);
           const first = codes.find((code) => code !== null);
           if (first === undefined || first === null) return;
           throw new Refused(refusal(first, MESSAGES[first]), secrets.map((secret, item) => outcomeEntry(secret, item, 'deny', codes[item] ?? first)));
@@ -1272,13 +1333,13 @@ class VaultService implements Vault {
           // deletion renames its place under it, so one that committed since the
           // check above is seen here, and nothing is released after it.
           // A read through a reference: its holder's place too, which a deletion may have taken.
-          await lockLogHead(d.tx);
           // And as the policy is now, under the head every change to it takes: an environment protected, or a role narrowed,
-          // since the check above is seen here, and nothing it refuses now is released.
+          // since the check above is seen here, and nothing it refuses now is released. All of it read again, holding the head.
+          d.reads = await this.#snapshot(d.tx, [principal], reads, true);
+          d.at = this.#at(d.reads);
           await decided(d);
           const places = secrets.flatMap((secret, i) => [secret, call.places?.[i] ?? secret]);
-          const now = await store.environmentsById(d.tx, places.map((place) => place.environmentId));
-          if (places.some((place) => now.get(place.environmentId)?.deleted ?? false)) {
+          if (places.some((place) => d.reads.environments.get(place.environmentId)?.deleted ?? false)) {
             throw new Refused(refusal('deleted', MESSAGES.deleted), secrets.map((secret, i) => outcomeEntry(secret, i, 'deny', 'deleted')));
           }
         }
@@ -1291,13 +1352,17 @@ class VaultService implements Vault {
       } finally {
         for (const value of done) value.wipe();
       }
-    }, late);
+    }, late, reads);
   }
 
-  /** Whether `n` more keys would take `principal` past the bulk limit; counted under their row's lock, so exactly. */
-  async #overBulkLimit(d: Decision, principal: string, n: number): Promise<boolean> {
-    const { count, windowMs } = this.#config.bulkLimit;
-    return (await store.releasesSince(d.tx, principal, d.at - windowMs)) + n > count;
+  /**
+   * Whether this read's keys would take the reader past the bulk limit: the
+   * distinct keys released to them in the window, these among them. A key
+   * read again exposes nothing new, so it counts once, whatever its version.
+   * Counted under their row's lock, so exactly (`Reads`).
+   */
+  #overBulkLimit(d: Decision): boolean {
+    return d.reads.released > this.#config.bulkLimit.count;
   }
 
   // --- references ---------------------------------------------------------------
@@ -1349,7 +1414,7 @@ class VaultService implements Vault {
     return this.#decide([principal], async (d) => {
       // Under the log's head, which a deletion and every change to the policy take: neither side deleted, nor protected,
       // nor a role narrowed, before this commits.
-      const reader = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports), input);
+      const reader = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports, d.reads), input);
       // Each source's nature, its current version's, under the head: what its maker must hold there.
       const natures = await store.natures(d.tx, [...sources.values()].map((source) => source.secretId));
       // Both sides as the store has them: a grant on a slug matches there, and neither side may be deleted.
@@ -1357,19 +1422,11 @@ class VaultService implements Vault {
         const source = sources.get(item.source.secretId);
         return source === undefined ? [item.holder.environmentId] : [item.holder.environmentId, source.environmentId];
       }));
-      const gone = (place: SecretPlace) => environments.get(place.environmentId)?.deleted ?? false;
       const codes = items.map((item): RefusalCode | null => {
         const source = sources.get(item.source.secretId);
         if (source === undefined || projectOf.get(item.holder.environmentId) !== item.holder.projectId) return 'bad_claim';
         if (source.secretId === item.holder.secretId) return 'invalid';
-        // A personal config's values are bound to its owner: no reference holds one, nor reads one.
-        if (environments.get(item.holder.environmentId)?.owner != null || environments.get(source.environmentId)?.owner != null) return 'personal';
-        // Making one hands its source's value to whoever reads the holder, whatever its nature becomes: its maker reads
-        // it at the source, as any direct access there, and, for a sensitive one, which nobody reads, uses it there too.
-        const at = placeIn(source, environments);
-        return refuses(reader, 'secret.write', placeIn(item.holder, environments), gone(item.holder))
-          ?? refuses(reader, 'secret.read', at, gone(source))
-          ?? (natures.get(source.secretId) === 'sensitive' ? refuses(reader, 'secret.use', at, gone(source)) : null);
+        return referenceRefusal(reader, item.holder, source, environments, natures.get(source.secretId) ?? 'secret');
       });
       const first = codes.find((code) => code !== null) ?? null;
       if (first !== null) throw new Refused(refusal(first, MESSAGES[first]), items.map((item, i) => entry(item, 'deny', codes[i] ?? first)));
@@ -1436,7 +1493,7 @@ class VaultService implements Vault {
     };
     return this.#decide([principal], async (d) => {
       // Under the log's head: two ends of one reference at once, the second finds the first; and the actor's standing stands.
-      const actor = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports), input);
+      const actor = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports, d.reads), input);
       // Ending is allowed in a deleted place: deleting one ends the references into and out of it.
       const environments = await store.environmentsById(d.tx, seals.map((seal) => seal.holder.environmentId));
       const codes: (RefusalCode | null)[] = seals.map((seal) => {
@@ -1552,7 +1609,7 @@ class VaultService implements Vault {
    */
   async #makeOwner(d: Decision, principal: string, reason: 'owners'): Promise<boolean> {
     const row = d.members.get(principal);
-    const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
+    const subject = await this.#standing(d.tx, principal, row, d.at, d.reports, d.reads);
     if (subject.status === 'active' && ownsInstance(subject.live)) return false;
     const tampered = subject.status === 'tampered';
     if (tampered && (await this.#logged(d.tx, principal)) === undefined) return false;
@@ -1584,17 +1641,17 @@ class VaultService implements Vault {
    * What `principal` holds, their row checked first (`#integrity`): a row
    * that fails holds nothing, and is `tampered`.
    */
-  async #standing(db: Queryable, principal: string, row: Member | undefined, at: number, reports: NewEntry[]): Promise<Standing> {
+  async #standing(db: Queryable, principal: string, row: Member | undefined, at: number, reports: NewEntry[], reads?: Snapshot): Promise<Standing> {
     const none = NOTHING;
-    const grants = row === undefined ? [] : await store.grants(db, principal);
-    const fault = await this.#integrity(db, principal, row, grants, reports);
+    const grants = row === undefined ? [] : reads?.grants.get(principal) ?? (await store.grants(db, principal));
+    const fault = await this.#integrity(db, principal, row, grants, reports, reads);
     if (fault !== null) return { principal, status: 'tampered', live: none, all: none, fault, stored: grants };
     if (!PRINCIPAL.test(principal)) return { principal, status: 'unknown', live: none, all: none, fault, stored: grants };
     if (row?.status !== 'active') return { principal, status: row?.status ?? 'unknown', live: none, all: none, fault, stored: grants };
     const held = grants.map((grant) => ({ ...grant, role: grant.role as Role }));
     const { role, scope } = roleOf(principal, row);
     // Every decision about them reads the policy: their roles as an Owner edited them, and which environments are protected.
-    const { policy } = await this.#policyAt(db, reports, at);
+    const { policy } = await this.#policyAt(db, reports, at, reads);
     const service = !principal.startsWith('user:');
     return {
       principal,
@@ -1642,9 +1699,10 @@ class VaultService implements Vault {
   /** `access`, as the rows are now. */
   async #read(principal: string, superseded: string | null): Promise<Access> {
     const read = async (db: Queryable, reports: NewEntry[]) => {
-      const [row, held, at] = await Promise.all([store.member(db, principal), store.grants(db, principal), this.#now(db)]);
-      const fault = await this.#integrity(db, principal, row, held, reports);
-      const { policy } = await this.#policyAt(db, reports, at);
+      const reads = await snapshot(db, { principals: [principal], members: true });
+      const [row, held, at] = [reads.members.get(principal), reads.grants.get(principal)!, this.#at(reads)];
+      const fault = await this.#integrity(db, principal, row, held, reports, reads);
+      const { policy } = await this.#policyAt(db, reports, at, reads);
       return this.#access(principal, row, held, at, fault !== null, policy);
     };
     const found: NewEntry[] = [];
@@ -1724,7 +1782,7 @@ class VaultService implements Vault {
       // renames the place, so the place is as it commits.
       // The roles as the policy defines them now, under the head every change to it takes: a role an Owner made is
       // granted as one that ships, and one deleted meanwhile is granted by nobody.
-      const { policy } = await this.#policyAt(d.tx, d.reports, d.at);
+      const { policy } = await this.#policyAt(d.tx, d.reports, d.at, d.reads);
       for (const change of changes) {
         if (change.role !== null && !isRole(change.role, policy)) throw refused('invalid', `no such role: ${change.role}`);
         if (change.role !== null && change.environmentId !== null && !assignableToEnvironment(change.role, policy)) {
@@ -1748,7 +1806,7 @@ class VaultService implements Vault {
         // An environment by its slug as the store has it, which scopes match.
         return environmentId === null ? { projectId: projectId! } : { projectId: projectId!, environmentId, environmentSlug: environment!.slug };
       });
-      const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports), input);
+      const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports, d.reads), input);
       if (acting.status === 'tampered') throw refused('tampered');
       // Where they manage access, anything; otherwise only a person to a service account (`givesService`).
       const manages = where.every((place) => mayManageAccess(acting.live, place));
@@ -1759,7 +1817,7 @@ class VaultService implements Vault {
       }
 
       const row = d.members.get(principal);
-      const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
+      const subject = await this.#standing(d.tx, principal, row, d.at, d.reports, d.reads);
       if (subject.status === 'tampered') throw refused('tampered', TAMPERED_SUBJECT);
       // A service account admitted with its first grants, as `admit` would: all of it, or none.
       const admitted = input.admit === true && row?.status !== 'active' ? await this.#admitWith(d, acting, principal, row, input) : undefined;
@@ -1859,7 +1917,7 @@ class VaultService implements Vault {
       ]);
     return this.#decide([actor, principal], async (d) => {
       validateCorrelation(input);
-      const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports), input);
+      const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports, d.reads), input);
       if (acting.status === 'tampered') throw refused('tampered');
       // A service account, with no grant yet, any person who could give it one sets up (`setsUpServices`).
       const service = SERVICE.test(principal) && (input.role ?? 'member') === 'member' && input.scope === undefined;
@@ -1872,7 +1930,7 @@ class VaultService implements Vault {
         throw refused('invalid', 'service accounts hold project grants only, never an instance role');
       }
       const row = d.members.get(principal);
-      const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
+      const subject = await this.#standing(d.tx, principal, row, d.at, d.reports, d.reads);
       if (subject.status === 'tampered') throw refused('tampered', TAMPERED_SUBJECT);
       d.touched.add(principal);
       d.grants.set(principal, [...subject.stored]);
@@ -1964,10 +2022,10 @@ class VaultService implements Vault {
       validateCorrelation(input);
       if (!PRINCIPAL.test(principal)) throw refused('invalid', `not a member: ${shownMember(principal)}`);
       const row = d.members.get(principal);
-      const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports), input);
+      const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports, d.reads), input);
       if (acting.status === 'tampered') throw refused('tampered');
       const holder = acting.live;
-      const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
+      const subject = await this.#standing(d.tx, principal, row, d.at, d.reports, d.reads);
       const held = subject.stored;
       if (this.#listed(principal)) throw refused('not_allowed', declaredOwner(principal));
       if (subject.status === 'tampered') {
@@ -2079,14 +2137,19 @@ class VaultService implements Vault {
    * no role holds anything but Owner, otherwise whoever can insert rows
    * could unprotect them. Its edits are then unknown, not none.
    */
-  async #policyAt(db: Queryable, reports: NewEntry[], at: number): Promise<{ policy: Policy; edits: PolicyEdits; readable: boolean }> {
+  async #policyAt(db: Queryable, reports: NewEntry[], at: number, reads?: Snapshot): Promise<{ policy: Policy; edits: PolicyEdits; readable: boolean }> {
+    // The snapshot's newest first, with the rows it protects; the pages before it, as they are asked.
     const entry = await newestAuthentic(
-      (limit, before) => store.newestVaultEntries(db, POLICY, limit, before),
+      (limit, before) => (reads !== undefined && before === undefined
+        ? Promise.resolve(reads.newestPolicy === null ? [] : [reads.newestPolicy])
+        : store.newestVaultEntries(db, POLICY, limit, before)),
       this.#check(reports, null),
     );
     if (entry === 'none') return { policy: DEFAULT_POLICY, edits: NO_EDITS, readable: true };
     const edits = typeof entry === 'string' ? null : readEdits(JSON.parse(entry.metadata) as { policy?: unknown });
-    return edits === null ? { policy: CLOSED_POLICY, edits: NO_EDITS, readable: false } : { policy: await livePolicy(db, edits, at), edits, readable: true };
+    if (edits === null) return { policy: CLOSED_POLICY, edits: NO_EDITS, readable: false };
+    const rows = entry === reads?.newestPolicy ? reads.environments : await store.environmentsById(db, edits.protected.map((place) => place.environmentId));
+    return { policy: livePolicy(rows, edits, at), edits, readable: true };
   }
 
   changePolicy(input: ChangePolicyInput): Promise<Outcome<{ policy: Policy; seq: number | null }>> {
@@ -2109,14 +2172,15 @@ class VaultService implements Vault {
       new Refused(refusal(code, message), [entry('deny', { change: describeChange(change) }, code)]);
     return this.#decide([actor], async (d) => {
       validateCorrelation(input);
-      const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports), input);
+      const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports, d.reads), input);
       if (acting.status === 'tampered') throw refused('tampered');
       if (acting.status !== 'active') throw refused(acting.status === 'removed' ? 'removed' : 'not_a_member');
       // Under the log's head, as the actor's standing above: two changes at once each start from the one before. One the
       // caller weighed from a revision of the policy, its newest change and its protected environments' rows, starts
       // from that one, or is refused, to be asked again: a protected prod renamed since is a policy changed too.
-      const newest = await newestVaultSeq(d.tx, POLICY);
-      const { policy: before, edits, readable } = await this.#policyAt(d.tx, d.reports, d.at);
+      // The newest change in the vault's name, read with the decision, as the app reads it: by its number, unchecked.
+      const newest = d.reads.newestPolicy?.seq ?? null;
+      const { policy: before, edits, readable } = await this.#policyAt(d.tx, d.reports, d.at, d.reads);
       if (revision !== undefined && policyRevision(newest, before) !== revision) throw refused('policy_changed');
       const owner = acting.live.credentialScope == null && ownsInstance(acting.live);
       // Unreadable, its edits are unknown: a change made from none would erase every protection and role edit the forged
@@ -2180,15 +2244,16 @@ class VaultService implements Vault {
           next.protected = [...next.protected, ...change.environmentIds.filter((id) => !known.has(id)).map((environmentId) => ({ projectId: change.projectId, environmentId, at: d.at }))]
             .sort((a, b) => (a.environmentId < b.environmentId ? -1 : 1));
         } else {
-          // Unprotecting widens what people hold there: an Owner of the whole instance's to do (R15).
-          if (!owner) throw refused('not_allowed', 'only an Owner of the whole instance unprotects an environment');
-          next.protected = next.protected.filter((place) => !change.environmentIds.includes(place.environmentId));
+          // Unprotecting widens what people hold there: an Owner of the project's to do, or of the whole instance's (R30).
+          // It takes off only what the project protects: a fork's id, with no row yet, is another project's to unprotect.
+          if (!ownsProject(acting.live, change.projectId)) throw refused('not_allowed', 'only an Owner of its project, or of the whole instance, unprotects an environment');
+          next.protected = next.protected.filter((place) => place.projectId !== change.projectId || !change.environmentIds.includes(place.environmentId));
         }
       } else {
         throw refused('invalid', 'a change is to a role, an instance role, or protection');
       }
       // The policy now, and the newest change, which it is as of: this one's, when it changed anything.
-      const answer = { policy: await livePolicy(d.tx, next, d.at), seq: newest === null ? null : Number(newest) };
+      const answer = { policy: livePolicy(await store.environmentsById(d.tx, next.protected.map((place) => place.environmentId)), next, d.at), seq: newest === null ? null : Number(newest) };
       if (!readable || JSON.stringify(next) !== JSON.stringify(edits)) {
         const made = entry('allow', { policy: next, change: describeChange(change), before: describeBefore(change, before) });
         d.log.push(made);
@@ -2213,7 +2278,7 @@ class VaultService implements Vault {
       new Refused(refusal(code, message), [entry('deny', { serviceAccounts: input.settings?.serviceAccounts ?? null }, code)]);
     return this.#decide([actor], async (d) => {
       validateCorrelation(input);
-      const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports), input);
+      const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports, d.reads), input);
       if (acting.status === 'tampered') throw refused('tampered');
       if (!runsInstance(acting.live)) throw refused('not_allowed', "only admins and owners of the whole instance change its settings");
       if (!isScope(input.settings?.serviceAccounts)) throw refused('invalid', 'who sets up service accounts is a scope: { projects, environments }, each all, only or except');
@@ -3051,64 +3116,6 @@ function viaDetail(via: Via, seal: Sealed | null): Record<string, unknown> {
   };
 }
 
-/** An environment a secret is in, or that holds a reference to one. */
-type SecretPlace = { projectId: string; environmentId: string };
-
-/**
- * Where a decision checks a permission: an environment, with its slug as
- * the store has it when it was read and is in the project claimed;
- * otherwise none, which no grant on a slug matches.
- */
-function placeIn(place: SecretPlace, environments: ReadonlyMap<string, { projectId: string; slug: string }>): Place {
-  const environment = environments.get(place.environmentId);
-  const slug = environment?.projectId === place.projectId ? environment.slug : null;
-  return { projectId: place.projectId, environmentId: place.environmentId, environmentSlug: slug };
-}
-
-/**
- * Why `reader` may not do `permission` at `where`, or null if they may. A
- * deleted place is refused before any grant is asked, so no kind of grant,
- * on the project, the environment or every project, can reach into one.
- */
-/**
- * A key of a personal config is its owner's alone (docs/design/forking.md,
- * section 4): no grant or role opens or wraps it, an Owner's included,
- * only its owner, while they read the environment it is a config of,
- * whatever the call is. Nor does any reference reach into or out of one.
- * Undefined for a key of any other environment, decided as ever.
- */
-function personalRefusal(
-  reader: Standing,
-  principal: string,
-  permission: Permission,
-  secret: SecretPlace,
-  at: SecretPlace,
-  environments: ReadonlyMap<string, store.EnvironmentRow>,
-): RefusalCode | null | undefined {
-  const own = environments.get(secret.environmentId);
-  const held = at.environmentId === secret.environmentId ? own : environments.get(at.environmentId);
-  if (own?.owner == null && held?.owner == null) return undefined;
-  if (own !== held || principal !== own?.owner || own.parentId === null) return 'personal';
-  const parent = placeIn({ projectId: secret.projectId, environmentId: own.parentId }, environments);
-  // Its owner reads what they wrote while they read or use the environment it configures (R8).
-  const gone = own.deleted || (environments.get(own.parentId)?.deleted ?? true);
-  const refused = refuses(reader, 'secret.use', parent, gone) === null ? null : refuses(reader, 'secret.read', parent, gone);
-  if (refused !== null) return refused;
-  // The credential's scope caps the owner still: their viewer token on the parent reads, and wraps no key. Reading their
-  // own values takes use there: a Contributor's handle reads what its owner wrote, and nothing of the parent's.
-  return withinCredential(reader.live, permission === 'secret.read' ? 'secret.use' : permission, parent) ? null : 'no_grant';
-}
-
-function refuses(reader: Standing, permission: Permission, where: Place, deleted: boolean): RefusalCode | null {
-  if (reader.status === 'tampered') return 'tampered';
-  if (reader.status === 'removed') return 'removed';
-  if (reader.status === 'unknown') return 'not_a_member';
-  if (deleted) return 'deleted';
-  if (allows(reader.live, permission, where)) return null;
-  // Would a grant that has lapsed have covered it?
-  return allows(reader.all, permission, where) ? 'expired' : 'no_grant';
-}
-
 /**
  * An entry about a key. A new secret's row is not committed when its key is
  * wrapped, so a wrap names the secret in its payload; the others name it.
@@ -3320,8 +3327,7 @@ function readEdits(stored: { policy?: unknown }): PolicyEdits | null {
  * keeps its slug, which a scoped instance role's filters read. The edits
  * keep them all: no write is needed.
  */
-async function livePolicy(db: Queryable, edits: PolicyEdits, at: number): Promise<Policy> {
-  const rows = await store.environmentsById(db, edits.protected.map((place) => place.environmentId));
+function livePolicy(rows: ReadonlyMap<string, store.EnvironmentRow>, edits: PolicyEdits, at: number): Policy {
   const live = edits.protected.filter((place) => {
     const row = rows.get(place.environmentId);
     return row === undefined ? at - place.at < UNWRITTEN_FORK_MS : !row.deleted;