@coffre/vault 0.14.5 → 0.15.0

package/src/vault.ts

@@ -1,3 +1,4 @@
+import { EXCHANGE_SKEW_SECONDS, RunProofRefused, UPLOADED_KEYS, verifyProof, verifyRunToken, WORKLOAD_SIGN_IN_PATH, type RunProof, type WorkloadProfile } from '@coffre/core/identity';
 import { randomUUID, timingSafeEqual } from 'node:crypto';
 
 import {
@@ -5,7 +6,6 @@ import {
   assignableToEnvironment,
   DEFAULT_POLICY,
   definitionProblem,
-  EVERY_ENVIRONMENT,
   EVERYWHERE,
   FIXED_ROLES,
   givesService,
@@ -14,6 +14,7 @@ import {
   INSTANCE_ROLES,
   isBuiltinRole,
   isCredentialScope,
+  type CredentialScope,
   isInstanceRole,
   isRole,
   isScope,
@@ -29,7 +30,6 @@ import {
   ROLES,
   runsInstance,
   setsUpServices,
-  UNWRITTEN_FORK_MS,
   type Holdings,
   type InstanceRole,
   type Permission,
@@ -39,8 +39,11 @@ import {
   type RoleDefinition,
   type Scope,
   type ServiceAccount,
+  type ServiceSetting,
+  readScope,
 } from '@coffre/core/access';
 import { GENESIS_HASH, verifyEntries, type LogKey, type StoredEntry } from '@coffre/core/audit';
+import { openPair, type LogEntry, type PairNotes } from '@coffre/core/merkle';
 import { checkContext, ownerKey, type SecretContext } from '@coffre/core/envelope';
 import { shownMember } from '@coffre/core/schemas';
 import {
@@ -58,11 +61,23 @@ import {
 } from '@coffre/core/kek';
 import {
   checkpointMessage,
+  REFUSAL_MESSAGES,
   checkpointVerifier,
   describeAccessFault,
   POLICY_REVISION,
-  accessRevision,
+  answerFrom,
+  CLOSED_POLICY,
+  live,
+  PRINCIPAL,
+  CLOSED_SETTINGS,
+  livePolicy,
+  NO_EDITS,
   policyRevision,
+  readEdits,
+  roleOf,
+  settingsFrom,
+  view,
+  type PolicyEdits,
   type Access,
   type AccessChange,
   type AccessFault,
@@ -79,43 +94,84 @@ import {
   type LogVerification,
   type Outcome,
   type PolicyChange,
+  type Prepared,
+  type PrepareInput,
   type Purpose,
   type ReferenceInput,
   type Refusal,
   type RefusalCode,
   type RemoveInput,
+  type IssueTokenInput,
+  type ChangeBindingsInput,
+  type ChangeBindingsOutcome,
+  type CutoverInput,
+  type CutoverOutcome,
+  type ChangeBindingsRefusal,
+  type IssueTokenOutcome,
+  type IssueTokenRefusal,
+  type RevokeCredentialInput,
+  type RevokeCredentialOutcome,
   type RewrapInput,
   type SecretRef,
   type SetAccessInput,
   type SetSettingsInput,
   type Settings,
+  type Sealing,
+  type SignInInput,
+  type SignInOutcome,
+  type SignInRefusal,
   type Through,
   type UnwrapInput,
   USE_METADATA_LENGTH,
   type Unwrapped,
+  type UseInput,
+  type NamedUseInput,
+  type UseManyInput,
+  type UseManyOutcome,
+  type NamedUseOutcome,
+  type UseOutcome,
   type UseRecord,
   type Wrapped,
   type Vault,
   type Via,
+  type ReadsVerification,
+  type TreeVerification,
   type VerifyLogInput,
+  type VouchedEntry,
+  type VouchInput,
   type WrapInput,
   type WrappedKey,
+  VOUCHED_AT_ONCE,
 } from '@coffre/core/vault';
 import type { Database, Queryable, Transaction } from '@coffre/db';
 import { isUnavailable, isUniqueViolation, SNAPSHOT } from '@coffre/db/dialect';
-import { everyProjectConversion, newestAccess, reportStands } from '@coffre/db/grants';
-import { appendEntries, lockLogHead, lockLogHeadQueued, missingEntry, newestAuthentic, type Appended, type Authenticity, type Newest, type NewEntry } from '@coffre/db/log';
+import { everyProjectConversion, newestAccess, reportStands, roleColumns, storedRole } from '@coffre/db/grants';
+import { appendEntries, holdFence, holdIssues, lockLogHead, lockLogHeadQueued, missingEntry, newestAuthentic, type Appended, type Authenticity, type Newest, type NewEntry } from '@coffre/db/log';
 
+import { Changes, keptObjects, Moved, NotLogged, prepareChanges, type ChangeKeys } from './changes.ts';
 import { signer, type Signer } from './checkpoint.ts';
-import { keyRefusals, placeIn, referenceRefusal, refuses, sensitiveRefusals, useOnlyRefusals, type SecretPlace } from './decide.ts';
+import { CutoverRefused, cutoverPayload, cutoverRow, genesisCalls, Moved as VouchMoved, planCutover } from './cutover.ts';
+import { bindingsCall, changeBindings, checkBinding, checkChangeBindings, checkIssue, issueCall, issueToken, revokeCredential, signIn, weighIssue, weighService, type Answer, type IssueRead } from './credentials.ts';
+import { bindingObject, credentialObject } from './objects.ts';
+import { proveIn, type SealThrough } from './checkpointer.ts';
+import { keyRefusals, placeIn, readerOf, referenceRefusal, refuses, sensitiveRefusals, useOnlyRefusals, type Reader, type SecretPlace } from './decide.ts';
 import type { ResolvedVaultConfig } from './config.ts';
+import { limitChange, noEdits, objectKey, POLICY_REF, ROLES_REF, sealed as sealedObject, sealKey, type CredentialInput, type EnvironmentInput, type Input, type Op, type PrincipalInput, type Ref } from './inputs.ts';
+import { TICK_MS } from './log-checkpointer.ts';
+import { authentic, changeEntry, logMacKey, useEntry as usedEntry, type LogMacKey } from './log-entry.ts';
+import { logStore } from './log-store.ts';
+import { checkReads, cursorHolds, readHolds, type ReadRow } from './reads.ts';
 import { carries, further, ownEntries, rehash, relink, START, vaultLogKey, VERIFY_BATCH, withCause, type Position } from './log.ts';
 import { apply, replayFault, type LoggedMember, type Replayed } from './replay.ts';
+import { principalObject } from './objects.ts';
 import { memberMac, rowKey, sameGrants, sealed, standing } from './rows.ts';
 import { snapshot, type Asked, type Snapshot } from './snapshot.ts';
 import * as store from './store.ts';
 import { accessDigest, CHECKPOINT, EMPTY_TALLY, expectedKey, TALLY_VERSION, Walk, type AccessTally, type Expected, type TalliedCheckpoint, type Tally } from './tally.ts';
-import { ACCESS_ACTIONS, type GrantRow, type Member } from './store.ts';
+import { ACCESS_ACTIONS, type EnvironmentRow, type EnvironmentSeal, type GrantRow, type Member } from './store.ts';
+import { use, UseCache, useLimits, useMany, useNamed, type UseLimits, type UsePath } from './use.ts';
+import { verifierKeys, verifyTrees, type VerifierKeys } from './verifier.ts';
+
 
 export type VaultOptions = {
   /**
@@ -127,8 +183,51 @@ export type VaultOptions = {
   clockOffset?: () => number;
   /** How far one call walks the log (`WALKS`); tests shorten them. */
   walks?: Partial<Walks>;
+  /**
+   * Which log the vault keeps (0.15's plan, "Behind one switch"): 0.15's,
+   * the default since its flip (plan PR 10), where each decision that
+   * changes an input also logs it as a change of 0.15's log (`changes.ts`),
+   * or 0.14's alone, for the suites until 0.16 removes it. Not a
+   * deployment's to set: once cut over, the database refuses 0.14's writes.
+   */
+  log?: '0.14' | '0.15';
+  /**
+   * Under 0.15's log, what a change waits for before it answers: its entry
+   * sealed in a signed checkpoint, and witnessed or past the witnesses'
+   * bound (R51): the checkpointer's `sealThrough` (checkpointer.ts). A
+   * change whose entry it does not seal fails, though committed. Required
+   * under 0.15's log.
+   */
+  sealThrough?: SealThrough;
+  /**
+   * Under 0.15's log, the pairs held where no database writer reaches: the
+   * signer's memory (`durableHeldOutside` on Workers, the Node runner's
+   * `heldOutside`), later a witness's. The verifier holds every walk to
+   * them; without, a database rolled back whole to an earlier pair would
+   * verify until the signer's next tick refuses it (verifier.ts). Required
+   * under 0.15's log, as `sealThrough` is (T151).
+   */
+  heldOutside?: () => Promise<readonly PairNotes[]>;
+  /**
+   * Under 0.15's log, whether the checkpointer seals (T169), bounded: what
+   * `sealing()` answers, and `/readyz` asks. The Node runner's `sealing`;
+   * on Workers the entrypoint asks the object itself. Without, it seals.
+   */
+  sealing?: () => Promise<Sealing> | Sealing;
+  /**
+   * 0.15's uses, per isolate (use.ts): how many calls in flight at once, by
+   * default the hot path's pool, `connections`, and how long a cover holds.
+   */
+  uses?: Partial<UseLimits> & { connections?: number };
+  /**
+   * Whether a call's I/O ends with its request, as on Workers, where a call whose request has ended may never settle:
+   * then a use's place in admission lapses past its deadline, settled or not (use.ts, `HELD_PAST_DEADLINE_MS`), its
+   * connection closed by then (cloudflare.ts). Not a deployment's to set.
+   */
+  callsEndWithRequest?: boolean;
 };
 
+
 /**
  * A vault's configuration made ready to use, once per process, or once per
  * isolate on Workers: its signer, its log key, and how far it has verified
@@ -147,7 +246,23 @@ export type PreparedVault = {
   logKey: LogKey;
   /** Each signing key's log key: those after the first verify only entries before `since`. */
   logKeys: LogKey[];
-  options: Required<Omit<VaultOptions, 'walks'>> & { walks: Walks };
+  options: Required<Omit<VaultOptions, 'walks' | 'log' | 'sealThrough' | 'heldOutside' | 'sealing' | 'uses' | 'callsEndWithRequest'>> & { walks: Walks };
+  /**
+   * 0.15's log, when it is on: the keys its changes are sealed and MACed
+   * with, from the vault's signing keys, and what each waits on to answer.
+   * Null under 0.14's alone.
+   */
+  log015: (ChangeKeys & { sealThrough: SealThrough; heldOutside: () => Promise<readonly PairNotes[]>; sealing: () => Promise<Sealing> | Sealing }) | null;
+  /** Whether this process wrote its bulk cap into 0.15's log, or found it there (`#limit`). */
+  limited: boolean;
+  /** Whether 0.15's log is cut over from 0.14, as this process found it (`cutover`): until then, nothing of 0.15's runs. */
+  cutover: boolean;
+  /**
+   * Whether this process found 0.15's log's cutover written, sealed or not
+   * yet (`#settled`): from then on every environment row is sealed, and the
+   * vault checks each one it decides on (`#placeFault`).
+   */
+  marked: boolean;
   /** How far the chain is rehashed, by any call of this process: its head must still be there. */
   verified: Position;
   /** What member rows are sealed under now; rows.ts. */
@@ -170,6 +285,12 @@ export type PreparedVault = {
    * then everyone the deployment names made an Owner (`#declare`).
    */
   converted: boolean;
+  /** What 0.15's verifier checks the log with (verifier.ts), once a call first needs them. */
+  verifier: VerifierKeys | null;
+  /** The log's MAC key under each signing key, which `vouch` checks an entry with: made once a call first needs them. */
+  vouchKeys?: LogMacKey[];
+  /** This isolate's 0.15 uses: their admission count, seal cache and covers (use.ts). */
+  uses: UseCache;
 };
 
 export async function prepareVault(config: ResolvedVaultConfig, options: VaultOptions = {}): Promise<PreparedVault> {
@@ -177,6 +298,12 @@ export async function prepareVault(config: ResolvedVaultConfig, options: VaultOp
     config,
     ...(await keysOf(config.signingKeys)),
     options: { keyBudgetMs: options.keyBudgetMs ?? KEY_BUDGET_MS, clockOffset: options.clockOffset ?? (() => 0), walks: { ...WALKS, ...options.walks } },
+    log015: (options.log ?? '0.15') === '0.15' ? log015(config.signingKeys, options.sealThrough, options.heldOutside, options.sealing) : null,
+    limited: false,
+    cutover: false,
+    marked: false,
+    verifier: null,
+    uses: new UseCache(useLimits(options.uses?.connections ?? DEFAULT_CONNECTIONS, options.uses), { callsEndWithRequest: options.callsEndWithRequest === true }),
     verified: START,
     reported: new Set(),
     since: null,
@@ -187,6 +314,18 @@ export async function prepareVault(config: ResolvedVaultConfig, options: VaultOp
   };
 }
 
+/** 0.15's change keys from the vault's signing keys, the first sealing and MACing, each checking a seal. */
+function log015(
+  seeds: readonly Uint8Array[],
+  sealThrough: SealThrough | undefined,
+  heldOutside: (() => Promise<readonly PairNotes[]>) | undefined,
+  sealing: (() => Promise<Sealing> | Sealing) = () => ({ ok: true }),
+): NonNullable<PreparedVault['log015']> {
+  if (sealThrough === undefined) throw new Error("0.15's log answers a change once its entry is sealed (R51): give the vault the checkpointer's sealThrough");
+  if (heldOutside === undefined) throw new Error("0.15's log is verified against the pairs held where no database writer reaches: give the vault the checkpointer's heldOutside");
+  return { seals: seeds.map((seed) => sealKey(seed)), mac: logMacKey(seeds[0]!), sealThrough, heldOutside, sealing };
+}
+
 /** The vault's own keys, from each of its signing keys, the one it signs with first. */
 async function keysOf(seeds: readonly Uint8Array[]) {
   const signers = await Promise.all(seeds.map((seed) => signer(seed)));
@@ -195,9 +334,16 @@ async function keysOf(seeds: readonly Uint8Array[]) {
   return { signer: signers[0], signers, logKey: logKeys[0], logKeys, rowKey: rowKeys[0], rowKeys };
 }
 
-/** The vault over `db`. Cheap: on Workers, one per call, over that call's connections. */
-export function openVault(db: Database, prepared: PreparedVault): Vault {
-  return new VaultService(db, prepared);
+/** A pool's connections, unless its transport says (pg's default). */
+const DEFAULT_CONNECTIONS = 10;
+
+/**
+ * The vault over `db`, and, for 0.15's uses, over `hot`, the hot path's own
+ * login (`coffre_vault_hot`: its lock and statement timeouts, generic
+ * plans; schema 0022). Cheap: on Workers, one per call, over that call's connections.
+ */
+export function openVault(db: Database, prepared: PreparedVault, hot?: Database): Required<Vault> {
+  return new VaultService(db, prepared, hot);
 }
 
 /** Every key operation of one call, together: a removal waits at most this long for a read at KMS. */
@@ -255,9 +401,6 @@ function within(deadline: number | undefined, ms: number): number {
   return Math.min(ms, left);
 }
 
-/** A member: `user:<email>` or `token:<name>`. */
-const PRINCIPAL = /^(user|token):[^\s:][^\s]*$/;
-
 /** A person, and a service account: only a person sets one up (`givesService`). */
 const PERSON = /^user:/;
 const SERVICE = /^token:/;
@@ -265,6 +408,14 @@ const SERVICE = /^token:/;
 /** Who acts for the vault itself, as when it makes an Owner its deployment names. */
 const VAULT_ACTOR = 'system:vault';
 
+/** The cutover's own entry in 0.14's log (`cutover`): the head its change in 0.15's names, or, denied, why it did not cut over. */
+const CUTOVER = 'log.cutover';
+
+/** Genesis changes a statement: eleven parameters each, well within Postgres's 65,535 a statement. */
+const GENESIS_BATCH = 2000;
+
+const NOT_CUT_OVER = "0.15's log is not cut over from 0.14 yet: the app asks the vault to (`cutover`) before anything else";
+
 // A KEK's check: a known value, the size of a data key, wrapped under it in
 // a context no secret has (the nil UUID), and kept in a `key.check` entry
 // (@coffre/core/kek). Opening it again tells the vault its KEK is the one
@@ -280,53 +431,45 @@ const KEY_ROTATE = 'key.rotate';
 /** A new member row, before the decision seals it (`#seal`). */
 const UNSEALED = { accessSeq: 0n, mac: Buffer.alloc(32) };
 
-/** Why a change to a tampered member is refused. */
-const TAMPERED_SUBJECT = "this member's record failed the vault's integrity check: remove them to start over";
-
-/** The action of the vault's entry that holds the instance's settings, and changes them (`settings`). */
-const SETTINGS = 'settings.change';
-
-/** The settings before anyone changed them: people set up service accounts anywhere they hold access. */
-const DEFAULT_SETTINGS: Settings = { serviceAccounts: EVERYWHERE };
+/** A member's object in 0.15's log (inputs.ts). */
+function memberRef(principal: string) {
+  return { kind: 'principal' as const, id: principal };
+}
 
-/** The action of the vault's entry that holds the instance's access policy, and changes it (`policy`). */
-const POLICY = 'policy.change';
+/** An instance role and its scope as a member's row gives them back (`roleColumns`, then `storedRole`): what 0.15's ops carry, so that the object they make is the row's. */
+function asStored(role: InstanceRole, scope: Scope): { role: InstanceRole; scope: Scope } {
+  return storedRole(roleColumns(role, scope));
+}
 
-/**
- * What a `policy.change` entry keeps: the roles an Owner edited or made,
- * each whole, and the protected environments. A role as it ships is kept by
- * none, so a release that changes a default changes it where nobody edited it.
- */
-type PolicyEdits = { roles: Record<string, RoleDefinition>; instanceRoles: Partial<Record<InstanceRole, RoleDefinition>>; protected: ProtectedPlace[] };
+/** A grant's place, and what it holds, as a member's object in 0.15's log has it. */
+function inputGrant(grant: Pick<GrantRow, 'projectId' | 'environmentId' | 'environmentSlug' | 'role' | 'expiresAt'>) {
+  return { projectId: grant.projectId, environmentId: grant.environmentId, environmentSlug: grant.environmentSlug, role: grant.role, expiresAt: grant.expiresAt };
+}
 
 /**
- * A protected environment, with its project's id, what a grant on the whole
- * project reaches of it, and when it was protected, by the vault's clock:
- * an id with no row ten minutes later is a fork that was never written.
+ * The environments an issue was weighed on, each once, with the slug it was weighed with first: what `issue_token`
+ * holds under the issue lock (IssuePolicyHeld).
  */
-type ProtectedPlace = { projectId: string; environmentId: string; at: number };
+function weighed(slugs: readonly { environmentId: string; slug: string | null }[]): { environmentId: string; slug: string | null }[] {
+  const seen = new Set<string>();
+  return slugs.filter(({ environmentId }) => !seen.has(environmentId) && seen.add(environmentId) !== undefined);
+}
 
+function placeOf(grant: store.Place) {
+  return { projectId: grant.projectId ?? null, environmentId: grant.environmentId ?? null, environmentSlug: grant.environmentSlug ?? null };
+}
 
-const NO_EDITS: PolicyEdits = { roles: {}, instanceRoles: {}, protected: [] };
+/** Why a change to a tampered member is refused. */
+const TAMPERED_SUBJECT = "this member's record failed the vault's integrity check: remove them to start over";
 
-/** A role holding nothing, which every role but Owner is under the closed policy. */
-const NOTHING_HELD = (definition: RoleDefinition): RoleDefinition => ({ ...definition, permissions: [], protected: [] });
+/** Why a decision on a place whose row is not as 0.15's log holds it is refused (T159): the row, not the member, is at fault. */
+const TAMPERED_PLACE = "an environment it is about failed the vault's integrity check: its row is not as the log holds it";
 
-/**
- * The policy when the log has some, but none the vault wrote within reach:
- * whoever inserted rows may have hidden an Owner's narrowing, so no role
- * holds anything, a service account's neither, but Owner, which holds
- * everything always and so may write the policy again.
- */
-const CLOSED_POLICY: Policy = {
-  roles: Object.fromEntries(Object.entries(ROLES).map(([id, definition]) => [id, id === 'owner' ? definition : NOTHING_HELD(definition)])),
-  instanceRoles: Object.fromEntries(Object.entries(INSTANCE_ROLES).map(([id, definition]) => [id, id === 'owner' ? definition : NOTHING_HELD(definition)])) as Policy['instanceRoles'],
-  protected: [EVERY_ENVIRONMENT],
-  protectedIn: {},
-};
+/** The action of the vault's entry that holds the instance's settings, and changes them (`settings`). */
+const SETTINGS = 'settings.change';
 
-/** The settings when the log has some, but none the vault wrote within reach: people set up no service accounts. */
-const CLOSED_SETTINGS: Settings = { serviceAccounts: { projects: { only: [] }, environments: 'all' } };
+/** The action of the vault's entry that holds the instance's access policy, and changes it (`policy`). */
+const POLICY = 'policy.change';
 
 /** Why a change to who is an Owner, scoped or not, is refused to anyone else: Owners make and unmake Owners. */
 const OWNERS_ONLY = 'only an Owner of the whole instance makes someone an Owner, or changes or removes one';
@@ -359,6 +502,9 @@ class Retry {}
 /** What each `vault.tampered` entry reports, to mark it logged once committed. */
 const REPORTED = new WeakMap<NewEntry, string>();
 
+/** Each environment row's check, once made (`#placeFault`): one HMAC a row, however many parts of a decision read it. */
+const PLACE_FAULTS = new WeakMap<EnvironmentSeal, 'tampered' | 'stale' | null>();
+
 /** A key service that did not answer, and the entries that record what it did do. */
 class Outage {
   readonly error: unknown;
@@ -377,29 +523,6 @@ function refusal(code: RefusalCode, message: string): Refusal {
   return { code, message };
 }
 
-const MESSAGES: Record<RefusalCode, string> = {
-  removed: 'this member was removed',
-  not_a_member: 'not a member',
-  no_grant: 'no grant covers this',
-  expired: 'the grant that covered this has expired',
-  bulk_limit: 'too many secrets read in too short a time',
-  bad_claim: 'the key does not belong to this secret',
-  deleted: 'this project or environment was deleted',
-  ended: 'the reference read through was ended',
-  personal: "a personal config's values are its owner's alone",
-  sensitive: "a sensitive value is never shown to anyone, Owners included: `coffre run` gives your app a placeholder for it through the credential proxy, and a service account reads it",
-  not_owner_issued: 'a service account reads a sensitive value only on a token or trust binding an Owner of its project issued',
-  use_only: "a workload uses this value through coffre and never holds it: list it in its binding's reads, where the value is held, if it must",
-  not_allowed: 'not allowed to change this',
-  last_owner: 'the last Owner of the whole instance stays one: make someone else an Owner first',
-  invalid: 'not something the rules allow',
-  policy_changed: "the instance's roles or protected environments changed while this was asked: try again",
-  access_changed: 'what this member holds changed since the read was decided: try again',
-  log_broken: 'the vault log does not hold from the last checkpoint',
-  wrong_kek: "this vault's key does not open the data it holds",
-  tampered: "this member's record failed the vault's integrity check",
-};
-
 /**
  * A decision in progress: its transaction, the member rows it locked, its
  * time, and what it will commit. Changes to members and grants wait until
@@ -435,6 +558,8 @@ type Decision = {
    * was deciding. A `Refused` there refuses the decision.
    */
   underLock: ((locked: Queryable) => Promise<void>)[];
+  /** Under 0.15's log, the changes its writes make, each staged beside its write (`changes.ts`); null under 0.14's alone. */
+  changes: Changes | null;
 };
 
 /**
@@ -523,11 +648,64 @@ class VaultService implements Vault {
   readonly #db: Database;
   readonly #prepared: PreparedVault;
   readonly #config: ResolvedVaultConfig;
+  readonly #hot: Database | undefined;
 
-  constructor(db: Database, prepared: PreparedVault) {
+  constructor(db: Database, prepared: PreparedVault, hot?: Database) {
     this.#db = db;
     this.#prepared = prepared;
     this.#config = prepared.config;
+    this.#hot = hot;
+  }
+
+  /** 0.15's use (use.ts), on the hot path's login. */
+  async use(input: UseInput): Promise<UseOutcome> {
+    return use(this.#usePath(), input);
+  }
+
+  /** 0.15's use as the request names it (use.ts, `useNamed`), on the hot path's login. */
+  async useNamed(input: NamedUseInput): Promise<NamedUseOutcome> {
+    return useNamed(this.#usePath(), input);
+  }
+
+  /** A request's several keys as one call (use.ts, `useMany`; T167), on the hot path's login. */
+  async useMany(input: UseManyInput): Promise<UseManyOutcome> {
+    return useMany(this.#usePath(), input);
+  }
+
+  /** What 0.15's uses run on, every way they are asked (use.ts, `UsePath`). */
+  #usePath(): UsePath {
+    // Behind the switch: a vault keeping 0.14's log alone has no 0.15 objects to decide on.
+    const { log015, uses: cache } = this.#prepared;
+    if (log015 === null) throw new Error("0.15's uses need 0.15's log: the vault's log option is '0.14'");
+    if (this.#hot === undefined) throw new Error("0.15's uses need the hot path's login: configure the vault's hotDatabase");
+    // An isolate's first uses read the cutover's marker (`#cutOverYet`) within their admission, as any call holds a connection.
+    const ready = this.#prepared.cutover ? undefined : () => this.#cutOverYet();
+    return {
+      db: this.#hot, sealKeys: log015.seals, macKey: log015.mac, keks: this.#config.keks, cache, ...(ready === undefined ? {} : { ready }),
+      oldWrite: (principal, old, through) => this.#oldWrite(principal, old, through),
+    };
+  }
+
+  /**
+   * Whether 0.14's newest access entry about `principal` that carries the
+   * vault's MAC, at or below `through`, is past `old`, what the principal's
+   * newest change accounts for (Migration015.tla's UsesSeeOldWrites, of the
+   * newest authentic write): asked by a use whose probe found `through` in
+   * the vault's name past it, which, but for a write the cutover refused to
+   * let land, is one forged there. Read from `through` down, never above: the
+   * use's statement committed before this reads, and a change's entry since
+   * is none it decided on (review r1). Each forged one is passed over; past
+   * `LOOK_BACK` of them, the use is refused as if it were not. It writes
+   * nothing: no report, which would wait for 0.14's head, or for the
+   * vault's settling, past the use's deadline (reviews r3, r4). The next
+   * decision about the principal reports what is forged (`#integrity`).
+   */
+  async #oldWrite(principal: string, old: bigint | null, through: bigint): Promise<boolean> {
+    // On Workers the use's vault is opened over its one hot connection (cloudflare.ts, `openVault(hot, prepared, hot)`):
+    // this reads on it, never a second connection in the call.
+    const newest = await newestAccess(this.#db, principal, { authentic: (entry) => this.#authentic(entry), forged: () => {} }, through);
+    if (newest === 'unreached') return true;
+    return typeof newest !== 'string' && (old === null || newest.seq > old);
   }
 
   async #now(db: Queryable): Promise<number> {
@@ -546,6 +724,7 @@ class VaultService implements Vault {
       ...rest,
       principals,
       head,
+      seals: this.#checksPlaces(),
       // A read waits for the head in one of a few places in line, or is refused at once.
       ...(reading ? { waiters: READ_HEAD_WAITERS } : {}),
       ...(released === undefined ? {} : { released: { ...released, windowMs: this.#config.bulkLimit.windowMs, clockOffsetMs: this.#prepared.options.clockOffset(), cap: this.#config.bulkLimit.count } }),
@@ -574,6 +753,8 @@ class VaultService implements Vault {
 
   /** `#decide`, once the vault is settled. */
   async #decideNow<T>(principals: readonly string[], decide: (d: Decision) => Promise<T>, how: How = {}): Promise<Outcome<T>> {
+    // Every decision of 0.15's log's after its cutover, whichever path it comes by (`#declare`, `#convert`, `#limit`).
+    await this.#cutOverYet();
     const reports: NewEntry[] = [];
     // A read's call is due from its first decision, unless its caller set when.
     const due = how.reads === true ? { ...how, deadline: how.deadline ?? Date.now() + READ_DEADLINE_MS } : how;
@@ -583,7 +764,8 @@ class VaultService implements Vault {
       } catch (error) {
         // A member who had no row when this decision locked theirs, and has
         // one now: another decision admitted them meanwhile. Again, with it.
-        if (attempt < 3 && (error instanceof Retry || isUniqueViolation(error))) continue;
+        // A 0.15 change's row moved from the seal it read (ChangeCAS): read it again (ChangeRereads).
+        if (attempt < 3 && (error instanceof Retry || error instanceof Moved || isUniqueViolation(error))) continue;
         throw error;
       }
     }
@@ -591,15 +773,19 @@ class VaultService implements Vault {
 
   async #decideOnce<T>(principals: readonly string[], decide: (d: Decision) => Promise<T>, reports: NewEntry[], { late = false, asked = {}, reads: shared = false, deadline }: How): Promise<Outcome<T>> {
     try {
-      const result = await this.#db.transaction(async (tx) => {
+      const committed = await this.#db.transaction(async (tx) => {
         await store.boundLockWaits(tx, shared ? within(deadline, READ_LOCK_TIMEOUT_MS) : LOCK_TIMEOUT_MS, shared);
         const members = principals.length === 0 ? new Map<string, Member>() : await store.lockMembers(tx, principals, shared);
         // Then the head, and everything the decision reads, in one statement (`snapshot` says why it holds).
         const reads = await this.#snapshot(tx, principals, asked, !late, shared);
+        const log015 = this.#prepared.log015;
         const d: Decision = {
           tx, members, at: this.#at(reads), reads, log: [], writes: [], touched: new Set(), grants: new Map(), reports, after: [], underLock: [],
+          changes: log015 === null ? null : new Changes(log015),
         };
         const result = await decide(d);
+        // Each object 0.15's log will change, read and checked before the writes change its rows.
+        await d.changes?.prepare(tx);
         // A read is logged once per place, whichever way it ends (`readsByPlace`).
         const entries = [...reports, ...readsByPlace(d.log)];
         let at = d.at;
@@ -620,12 +806,27 @@ class VaultService implements Vault {
         const sealing = new Set([...d.touched, ...accessSeq.keys()]);
         // Under a share lock, a write to the row would wait for every other read holding it, and they for it.
         if (shared && sealing.size > 0) throw new Error('a read changes no member, and seals no row');
-        for (const principal of sealing) await this.#seal(d, principal, accessSeq.get(principal));
-        return result;
+        const written = new Map<string, Input>();
+        for (const principal of sealing) {
+          const resealed = await this.#seal(d, principal, accessSeq.get(principal));
+          if (resealed === null) continue;
+          written.set(objectKey(memberRef(principal)), resealed.object);
+          d.changes?.cite(memberRef(principal), resealed.accessSeq);
+        }
+        // Last: the fence, which they take exclusive (0.14's append took it already, OldWritesFence), is held from
+        // here to the commit, so as few round trips as can be. The append comes first, and its trigger took the issue
+        // lock before the fence (0026): a change taking the fence before the issue lock would wait in a circle with the
+        // barrier, which takes them in that order (Migration015.tla, IssueBeforeFence).
+        const numbers = d.changes === null ? [] : await d.changes.commit(tx, at, written);
+        return { result, numbers };
       });
       this.#reported(reports);
-      return { ok: true, ...result };
-    } catch (error) {
+      // A change answers once its entries are sealed (R51; HotPathOne's CommitBeforeAnswer): the newest of them, with
+      // every number below it.
+      if (committed.numbers.length > 0) await this.#prepared.log015!.sealThrough(committed.numbers.reduce((a, b) => (a > b ? a : b)));
+      return { ok: true, ...committed.result };
+    } catch (caught) {
+      const error = caught instanceof NotLogged ? this.#notLogged(reports, caught) : caught;
       if (!(error instanceof Refused || error instanceof Outage)) throw error;
       const entries = [...reports, ...readsByPlace(error.entries)];
       if (entries.length > 0) {
@@ -649,19 +850,23 @@ class VaultService implements Vault {
    * naming `accessSeq`, their newest access entry, when it wrote one. The
    * table must hold exactly that: a grant written around the vault while it
    * decided (its row lock does not stop one) is refused, with the decision,
-   * rather than sealed in.
+   * rather than sealed in. It answers the member's object as the rows now
+   * hold it, and the access entry their row names, for 0.15's log.
    */
-  async #seal(d: Decision, principal: string, accessSeq: bigint | undefined): Promise<void> {
+  async #seal(d: Decision, principal: string, accessSeq: bigint | undefined): Promise<{ object: PrincipalInput; accessSeq: bigint } | null> {
     const row = await store.member(d.tx, principal);
-    if (row === undefined) return;
+    if (row === undefined) return null;
     const decided = d.grants.get(principal);
     if (decided === undefined) throw new Error(`sealing ${principal} without the grants this decision verified`);
     if (!sameGrants(await store.grants(d.tx, principal), decided)) {
       this.#report(d.reports, principal, 'mac', row.mac.toString('hex'));
-      throw new Refused(refusal('tampered', MESSAGES.tampered), []);
+      throw new Refused(refusal('tampered', REFUSAL_MESSAGES.tampered), []);
     }
     const next = { ...row, accessSeq: accessSeq ?? row.accessSeq };
     await store.updateMember(d.tx, principal, { accessSeq: next.accessSeq, mac: memberMac(this.#prepared.rowKey, next, decided) });
+    // The member's object as the rows hold it now, which 0.15's change of it must have left, and the access entry its
+    // row names, which that change accounts for (`changes.ts`).
+    return { object: principalObject(row, decided), accessSeq: next.accessSeq };
   }
 
   /**
@@ -688,6 +893,89 @@ class VaultService implements Vault {
     return 'stale';
   }
 
+  /**
+   * Whether the vault checks the environment rows it decides on against
+   * 0.15's log (T159): under it, once its cutover is written, which seals
+   * every row. Every read of them asks their seals then (`seals`).
+   */
+  #checksPlaces(): boolean {
+    const { log015, cutover, marked } = this.#prepared;
+    return log015 !== null && (cutover || marked);
+  }
+
+  /**
+   * Why environment `id`'s row, as a decision read it, is not as 0.15's log
+   * holds it (T159; R53, every decision input sealed): its seal is not the
+   * vault's over its object (`tampered`: re-parented, renamed, its tombstone
+   * set or cleared around the log), or not its object's newest change's
+   * (`stale`: put back from before a change, or written with none). A live
+   * object in a project whose slug is a tombstone is `tampered` too: a
+   * project's deletion under 0.15's log deletes each of its environments, as
+   * the cutover sealed them, so only a writer leaves one so (review r2). Each
+   * is reported, once, as a change refused on it is (`#notLogged`), the row's
+   * and not any member's. Null when it is as the log holds it, and for a row
+   * read without its seals: under 0.14's log alone, or before the cutover.
+   */
+  #placeFault(id: string, row: EnvironmentRow, reports: NewEntry[]): 'tampered' | 'stale' | null {
+    const read = row.sealed;
+    if (read === undefined) return null;
+    let fault = PLACE_FAULTS.get(read);
+    if (fault === undefined) {
+      fault = !sealedObject(this.#prepared.log015!.seals, { kind: 'environment', id }, read.object, read.seal) || (row.deleted && !read.object.deleted) ? 'tampered'
+        : read.newest === null || !read.newest.equals(read.seal!) ? 'stale' : null;
+      PLACE_FAULTS.set(read, fault);
+    }
+    if (fault !== null) this.#report(reports, null, fault === 'tampered' ? 'mac' : 'stale', `log.environment:${id}`);
+    return fault;
+  }
+
+  /**
+   * A member's grants whose places hold: each on an environment, on a row
+   * as 0.15's log holds it, which its project is read from (the grant's row
+   * names none of its own). One on a row that is not, or on no row, holds
+   * nothing (T159): where it is is a writer's. Their other grants stand.
+   * Each row from `rows` when there, else read, with its seals.
+   */
+  async #heldGrants(db: Queryable, grants: readonly GrantRow[], reports: NewEntry[], rows?: ReadonlyMap<string, EnvironmentRow>): Promise<GrantRow[]> {
+    if (!this.#checksPlaces()) return [...grants];
+    const ids = [...new Set(grants.flatMap((grant) => (grant.environmentId === null ? [] : [grant.environmentId])))];
+    const missing = ids.filter((id) => !rows?.has(id));
+    const read = missing.length === 0 ? new Map<string, EnvironmentRow>() : await store.environmentsById(db, missing, { seals: true });
+    const faulty = new Set(ids.filter((id) => {
+      const row = rows?.get(id) ?? read.get(id);
+      if (row !== undefined) return this.#placeFault(id, row, reports) !== null;
+      this.#report(reports, null, 'stale', `log.environment:${id}`);
+      return true;
+    }));
+    return grants.filter((grant) => grant.environmentId === null || !faulty.has(grant.environmentId));
+  }
+
+  /**
+   * Refuse a decision about places whose rows are not as 0.15's log holds
+   * them (`#placeFault`), each reported: what it would decide on them is a
+   * writer's (T159). Ids with no row are left to the decision, which knows
+   * no such place.
+   */
+  #placesHold(rows: ReadonlyMap<string, EnvironmentRow>, ids: Iterable<string>, reports: NewEntry[]): void {
+    let hold = true;
+    for (const id of new Set(ids)) {
+      const row = rows.get(id);
+      if (row !== undefined && this.#placeFault(id, row, reports) !== null) hold = false;
+    }
+    if (!hold) throw new Refused(refusal('tampered', TAMPERED_PLACE), []);
+  }
+
+  /**
+   * The policy `edits` make over the rows of the environments they protect
+   * (`livePolicy`), a row not as 0.15's log holds it taken as still
+   * protected, its slug unknown: one deleted or renamed around the log
+   * narrows what anyone holds there, never widens it (T159).
+   */
+  #livePolicy(rows: ReadonlyMap<string, EnvironmentRow>, edits: PolicyEdits, at: number, reports: NewEntry[]): Policy {
+    const held = new Map([...rows].map(([id, row]) => [id, this.#placeFault(id, row, reports) === null ? row : { ...row, slug: null, deleted: false }]));
+    return livePolicy(held, edits, at);
+  }
+
   /** The newest access entry about `principal` that carries the vault's MAC (`newestAccess` in @coffre/db/grants). */
   #newestAccess(db: Queryable, principal: string, reports: NewEntry[], reads?: Snapshot): Promise<Newest> {
     if (reads === undefined || !reads.grants.has(principal)) return newestAccess(db, principal, this.#check(reports, principal));
@@ -745,6 +1033,18 @@ class VaultService implements Vault {
     reports.push(entry);
   }
 
+  /**
+   * A change refused because 0.15's log does not hold its object as its row
+   * is (`changes.ts`): a row put back, or written around the vault. Reported
+   * as a tampered row is, and refused: adoption or a reseal (plan PR 9)
+   * makes it the log's again, never a change on top of it.
+   */
+  #notLogged(reports: NewEntry[], error: NotLogged): Refused {
+    const { ref } = error;
+    this.#report(reports, ref?.kind === 'principal' ? ref.id : null, error.fault === 'tampered' ? 'mac' : 'stale', ref === null ? 'log.object' : `log.${ref.kind}:${ref.id}`);
+    return new Refused(refusal('tampered', error.message), []);
+  }
+
   /** Mark these reports as logged, once their transaction has committed. */
   #reported(reports: readonly NewEntry[]): void {
     for (const entry of reports) {
@@ -773,8 +1073,15 @@ class VaultService implements Vault {
     // database; calls that race settle it alike, and a rotation they race
     // to write goes in once (`#rotate`).
     if (prepared.since === null && prepared.superseded === null) await this.#settle();
+    // Under 0.15's log, nothing of its own before the cutover (`cutover`): the conversion and the Owners it names, and
+    // the bulk cap, after it, as decisions of 0.15's log.
+    if (prepared.superseded === null && prepared.log015 !== null && !prepared.cutover && !prepared.marked) {
+      if (!(await store.cutOver(this.#db))) return prepared.superseded;
+      prepared.marked = true;
+    }
     // A log with no entry of the vault's holds nothing to convert, and stays empty until someone acts.
     if (prepared.superseded === null && prepared.since !== null && !prepared.converted) await this.#convert();
+    if (prepared.superseded === null && prepared.log015 !== null && !prepared.limited) await this.#limit();
     return prepared.superseded;
   }
 
@@ -806,6 +1113,30 @@ class VaultService implements Vault {
     this.#prepared.converted = await this.#declare(this.#config.owners.map((email) => `user:${email}`));
   }
 
+  /**
+   * Under 0.15's log, the deployment's bulk cap written into it before the
+   * vault serves anything (plan PR 3, `limitChange`): a `bulk.limit` change
+   * whenever the log's policy says otherwise, as any change, under the head
+   * and the fence. Uses read the cap from it (CapSealed), never from the
+   * configuration. Once per process; until it lands, each call tries again.
+   * A cap the log already holds is read first, with no lock: every isolate
+   * that starts finds it there, and takes neither 0.14's head nor the fence
+   * for it, which every other start would queue behind (PR 5b's bench).
+   */
+  async #limit(): Promise<void> {
+    const { row: logged } = await store.readObject(this.#db, POLICY_REF as Ref & { kind: 'policy' });
+    if (limitChange(logged?.kind === 'policy' ? logged : null, this.#config.bulkLimit) === null) {
+      this.#prepared.limited = true;
+      return;
+    }
+    const outcome = await this.#decideNow([], async (d) => {
+      const { row } = await store.readObject(d.tx, POLICY_REF as Ref & { kind: 'policy' });
+      const op = limitChange(row?.kind === 'policy' ? row : null, this.#config.bulkLimit);
+      if (op !== null) d.changes!.stage(POLICY_REF as Ref & { kind: 'policy' }, op, VAULT_ACTOR);
+    });
+    if (outcome.ok) this.#prepared.limited = true;
+  }
+
   async #replaceEveryProject(d: Decision, principal: string): Promise<void> {
     const row = d.members.get(principal);
     const subject = await this.#standing(d.tx, principal, row, d.at, d.reports, d.reads);
@@ -813,9 +1144,11 @@ class VaultService implements Vault {
     const everyProject = subject.stored.filter((grant) => grant.projectId === null && grant.environmentId === null);
     if (everyProject.length === 0) return;
     if (await reportStands(d.tx, principal, this.#check(d.reports, principal))) return;
-    // The projects there are now, read under the log's head, which a deletion holds.
+    // The projects there are now, read under the log's head, which a deletion holds; each environment by its slug as 0.15's
+    // log holds its row (T159, review r7): a grant on a slug in every project becomes one on each place that answers to
+    // it, never on one a writer renamed into it.
     const before = roleOf(principal, row);
-    const conversion = everyProjectConversion(principal, before.role, subject.stored, d.at, await store.liveProjects(d.tx));
+    const conversion = everyProjectConversion(principal, before.role, subject.stored, d.at, await this.#livePlaces(d));
     const after = { role: conversion.role, scope: conversion.scope };
     const replacedBy = { role: after.role, scope: after.scope, grants: conversion.grants.length };
     d.grants.set(principal, [...subject.stored]);
@@ -829,6 +1162,7 @@ class VaultService implements Vault {
 
     for (const grant of everyProject) {
       drop(grant);
+      d.changes?.stage(memberRef(principal), { op: 'access.revoke', place: placeOf(grant) }, VAULT_ACTOR);
       // A lapsed one goes with no entry: it changes nothing anyone holds.
       if (!live(grant, d.at)) continue;
       const narrowed = conversion.narrowed.filter((loss) => loss.grant.environmentSlug === grant.environmentSlug);
@@ -849,6 +1183,7 @@ class VaultService implements Vault {
         reason: 'every-project',
       }));
       d.writes.push(() => store.updateMember(d.tx, principal, after));
+      d.changes?.stage(memberRef(principal), { op: 'member.role', ...asStored(after.role, after.scope) }, VAULT_ACTOR);
     }
     for (const given of conversion.grants) {
       const place = { projectId: given.projectId, environmentId: given.environmentId, environmentSlug: null };
@@ -860,6 +1195,7 @@ class VaultService implements Vault {
         await store.insertGrant(d.tx, grant);
         d.grants.get(principal)!.push(grant);
       });
+      d.changes?.stage(memberRef(principal), { op: 'access.grant', grant: inputGrant({ ...place, role: given.role, expiresAt: given.expiresAt }) }, VAULT_ACTOR);
       d.log.push({
         ...accessEntry(VAULT_ACTOR, 'access.grant', principal, 'allow', correlation, {
           role: given.role,
@@ -952,7 +1288,8 @@ class VaultService implements Vault {
    * is to a key it does not hold: a vault given a newer KEK has replaced
    * this one, which writes nothing more. Checked under the head's lock, so
    * that an instance still running with the replaced KEK, as during a
-   * deploy, cannot write after the rotation.
+   * deploy, cannot write after the rotation. Under 0.15's log, its entries
+   * say so (`log015`): once cut over, the log refuses a write without it.
    */
   async #append(
     tx: Transaction,
@@ -970,7 +1307,7 @@ class VaultService implements Vault {
         throw new Error(prepared.superseded);
       }
       for (const check of underLock) await check(locked);
-    }, head === undefined ? undefined : { head, last: head.last, at: held!.at });
+    }, head === undefined ? undefined : { head, last: head.last, at: held!.at }, [], prepared.log015 !== null);
     // The head still held, as this append left it, for the next append of the same transaction: a remote key's intent,
     // then the decision's reports.
     if (head !== undefined) {
@@ -997,7 +1334,14 @@ class VaultService implements Vault {
     const items = loaded.versions.map((version) => ({ ...version, secret: { ...version.secret } }));
     validateItems(items, 'wrapped');
     const sealed = await this.#referencesAt(vias);
-    const forks = await store.environmentsById(this.#db, throughs.flatMap((through) => (through === null ? [] : [through])));
+    // Settled first, as a decision is: a new process learns here whether the log is cut over, and so whether a fork's row
+    // is held to its seal (review r1).
+    await this.#settled();
+    const forks = await store.environmentsById(this.#db, throughs.flatMap((through) => (through === null ? [] : [through])), { seals: this.#checksPlaces() });
+    // A fork whose row is not as 0.15's log holds it is no place to read through (T159), reported.
+    const forkReports: NewEntry[] = [];
+    for (const [id, fork] of forks) if (this.#placeFault(id, fork, forkReports) !== null) forks.delete(id);
+    await this.#record(forkReports);
     // A reference reads only the current version of the source its entry names.
     const viaOk = items.map((item, i) => vias[i] === null || (sealed[i] !== null && sealed[i]!.source.secretId === item.secret.secretId && item.current));
     // A fork an inherited value is read in is a live environment of the same project as the value's, and not its own,
@@ -1230,12 +1574,12 @@ class VaultService implements Vault {
     principal: string,
     code: 'bad_claim' | 'deleted' | 'invalid',
     entries: NewEntry[],
-    { message = MESSAGES[code], asked }: { message?: string; asked?: string } = {},
+    { message = REFUSAL_MESSAGES[code], asked }: { message?: string; asked?: string } = {},
   ): Promise<Outcome<never>> {
     return this.#decide([principal], async (d) => {
       if (asked !== undefined) {
         const standing = await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports, d.reads);
-        if (this.#revisionOf(standing, d) !== asked) throw new Refused(refusal('access_changed', MESSAGES.access_changed), []);
+        if (this.#revisionOf(standing, d) !== asked) throw new Refused(refusal('access_changed', REFUSAL_MESSAGES.access_changed), []);
       }
       throw new Refused(refusal(code, message), entries);
     }, { reads: true });
@@ -1323,7 +1667,7 @@ class VaultService implements Vault {
       const standing = await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports, d.reads);
       // A read decided on an earlier answer about its reader, only while that is still the answer: nothing read, nothing logged.
       const asked = call.input.accessRevision;
-      if (asked !== undefined && this.#revisionOf(standing, d) !== asked) throw new Refused(refusal('access_changed', MESSAGES.access_changed), []);
+      if (asked !== undefined && this.#revisionOf(standing, d) !== asked) throw new Refused(refusal('access_changed', REFUSAL_MESSAGES.access_changed), []);
       const reader = through(standing, call.input);
       // One read of the environments the decision is about, as the store has them, not as the app sent them:
       // each secret's and, for a read through a reference, its holder's. A grant on one slug in every project
@@ -1331,6 +1675,9 @@ class VaultService implements Vault {
       const at = secrets.map((secret, i) => call.places?.[i] ?? secret);
       // Each a personal config is a config of too, whose read its owner needs (`places`).
       const environments = d.reads.environments;
+      // Each as 0.15's log holds its row (T159): its project, its slug, its tombstone, a personal config's owner and parent.
+      const decided = [...secrets, ...at].map((place) => place.environmentId);
+      this.#placesHold(environments, [...decided, ...decided.flatMap((id) => (environments.get(id)?.owner == null ? [] : [environments.get(id)!.parentId!]))], d.reports);
       owners.clear();
       for (const [id, environment] of environments) if (environment.owner !== null) owners.set(id, ownerKey(environment.owner));
       const needs = call.needs === undefined ? [] : await call.needs(d.tx);
@@ -1345,7 +1692,7 @@ class VaultService implements Vault {
       if (first === null && action === 'secret.read' && this.#overBulkLimit(d)) first = 'bulk_limit';
       if (first !== null) {
         throw new Refused(
-          refusal(first, MESSAGES[first]),
+          refusal(first, REFUSAL_MESSAGES[first]),
           secrets.map((secret, i) => entry(secret, 'deny', codes[i] ?? first)),
         );
       }
@@ -1427,7 +1774,7 @@ class VaultService implements Vault {
           const codes = await vet(locked, d.reads);
           const first = codes.find((code) => code !== null);
           if (first === undefined || first === null) return;
-          throw new Refused(refusal(first, MESSAGES[first]), secrets.map((secret, item) => outcomeEntry(secret, item, 'deny', codes[item] ?? first)));
+          throw new Refused(refusal(first, REFUSAL_MESSAGES[first]), secrets.map((secret, item) => outcomeEntry(secret, item, 'deny', codes[item] ?? first)));
         });
       }
       const { outcomes, expired } = await settle(operations((secret) => context(secret, owners.get(secret.environmentId))), within(deadline, this.#prepared.options.keyBudgetMs));
@@ -1447,7 +1794,7 @@ class VaultService implements Vault {
         }
         if (expired) throw new Outage(new KekUnavailableError('key operation exceeded its deadline'), entries());
         if (done.length < outcomes.length) {
-          throw new Refused(refusal('bad_claim', MESSAGES.bad_claim), entries());
+          throw new Refused(refusal('bad_claim', REFUSAL_MESSAGES.bad_claim), entries());
         }
         if (late) {
           // Again under the log's head, the append's, taken a statement early: a
@@ -1461,7 +1808,7 @@ class VaultService implements Vault {
           await decided(d);
           const places = secrets.flatMap((secret, i) => [secret, call.places?.[i] ?? secret]);
           if (places.some((place) => d.reads.environments.get(place.environmentId)?.deleted ?? false)) {
-            throw new Refused(refusal('deleted', MESSAGES.deleted), secrets.map((secret, i) => outcomeEntry(secret, i, 'deny', 'deleted')));
+            throw new Refused(refusal('deleted', REFUSAL_MESSAGES.deleted), secrets.map((secret, i) => outcomeEntry(secret, i, 'deny', 'deleted')));
           }
         }
         const released = secrets.map((secret, i) => outcomeEntry(secret, i, 'allow', null));
@@ -1544,15 +1891,18 @@ class VaultService implements Vault {
       const environments = await store.environmentsById(d.tx, items.flatMap((item) => {
         const source = sources.get(item.source.secretId);
         return source === undefined ? [item.holder.environmentId] : [item.holder.environmentId, source.environmentId];
-      }));
+      }), { seals: this.#checksPlaces() });
+      // Each as 0.15's log holds its row (T159).
+      this.#placesHold(environments, environments.keys(), d.reports);
       const codes = items.map((item): RefusalCode | null => {
         const source = sources.get(item.source.secretId);
-        if (source === undefined || projectOf.get(item.holder.environmentId) !== item.holder.projectId) return 'bad_claim';
+        // The holder's project as the row this decision checked says it (review r4): the read before only names the entry.
+        if (source === undefined || environments.get(item.holder.environmentId)?.projectId !== item.holder.projectId) return 'bad_claim';
         if (source.secretId === item.holder.secretId) return 'invalid';
         return referenceRefusal(reader, item.holder, source, environments, natures.get(source.secretId) ?? 'secret');
       });
       const first = codes.find((code) => code !== null) ?? null;
-      if (first !== null) throw new Refused(refusal(first, MESSAGES[first]), items.map((item, i) => entry(item, 'deny', codes[i] ?? first)));
+      if (first !== null) throw new Refused(refusal(first, REFUSAL_MESSAGES[first]), items.map((item, i) => entry(item, 'deny', codes[i] ?? first)));
       const entries = items.map((item) => entry(item, 'allow', null));
       d.log.push(...entries);
       const answer = { seqs: [] as number[] };
@@ -1573,7 +1923,9 @@ class VaultService implements Vault {
     validateCorrelation(input);
     if (reason !== 'replaced' && reason !== 'broken' && reason !== 'abandoned') throw new Error('a reference ends replaced, broken or abandoned');
     const vias = input.items.map((item) => validateVia(item)!);
-    if (vias.some((via) => via === null) || new Set(vias.map((via) => via.seq)).size !== vias.length) throw new Error('each reference to end, once');
+    if (vias.some((via) => via === null) || new Set(vias.map((via) => via.seq)).size !== vias.length || new Set(vias.map((via) => via!.reference)).size !== vias.length) {
+      throw new Error('each reference to end, once');
+    }
     if (vias.length === 0) return { ok: true, seqs: [] };
     const sealed = await this.#referencesAt(vias);
     // A holder's row is committed after its reference is sealed, if the write went through: an end names it only then.
@@ -1606,31 +1958,111 @@ class VaultService implements Vault {
     });
     if (sealed.some((seal) => seal === null)) {
       return this.#decide([principal], async () => {
-        throw new Refused(refusal('bad_claim', MESSAGES.bad_claim), vias.map((via, i) => entry(via, sealed[i]!, 'deny', 'bad_claim')));
+        throw new Refused(refusal('bad_claim', REFUSAL_MESSAGES.bad_claim), vias.map((via, i) => entry(via, sealed[i]!, 'deny', 'bad_claim')));
       });
     }
     const seals = sealed as Sealed[];
+    // Ended already: by an authentic end only. A forged one (a row with the vault's name and no valid MAC) refuses a
+    // read, the safe side there (`endedReferences`); here it would stop a genuine break, and with 0.15's log leave the
+    // holder serving, its end written nowhere (review r9).
     const ended = async (db: Queryable) => {
-      const done = await store.endedReferences(db, seals.map((seal) => seal.seq));
+      const done = new Set((await store.referenceEnds(db, seals.map((seal) => seal.seq))).filter((end) => this.#authentic(end)).map((end) => end.relatedSeq!));
       return seals.map((seal) => (done.has(seal.seq) ? ('ended' as const) : null));
     };
     return this.#decide([principal], async (d) => {
       // Under the log's head: two ends of one reference at once, the second finds the first; and the actor's standing stands.
       const actor = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports, d.reads), input);
       // Ending is allowed in a deleted place: deleting one ends the references into and out of it.
-      const environments = await store.environmentsById(d.tx, seals.map((seal) => seal.holder.environmentId));
-      const codes: (RefusalCode | null)[] = seals.map((seal) => {
-        const holder = refuses(actor, 'secret.write', placeIn(seal.holder, environments), false);
-        // Abandoning is its maker's alone, for a write of theirs that stored nothing: the vault
-        // never reads the app's rows, so whose seal it is decides, and no one else's end says it.
+      const environments = await store.environmentsById(d.tx, seals.map((seal) => seal.holder.environmentId), { seals: this.#checksPlaces() });
+      // Each as 0.15's log holds its row (T159).
+      this.#placesHold(environments, environments.keys(), d.reports);
+      // Who may end each: write where it is held; for a break, managing the source's project's access too; abandoning,
+      // its maker alone, for a write of theirs that stored nothing (the vault never reads the app's rows, so whose
+      // seal it is decides, and no one else's end says it).
+      const mayEnd = (reader: Reader, places: ReadonlyMap<string, { projectId: string; slug: string }>) => seals.map((seal): RefusalCode | null => {
+        const holder = refuses(reader, 'secret.write', placeIn(seal.holder, places), false);
         if (reason === 'abandoned' && seal.createdBy !== principal) return 'not_allowed';
-        // Replacing or abandoning is the holder's side: write where it is held.
         if (holder === null || reason !== 'broken') return holder;
-        return refuses(actor, 'grant.manage', { projectId: seal.source.projectId }, false) === null ? null : holder;
+        return refuses(reader, 'grant.manage', { projectId: seal.source.projectId }, false) === null ? null : holder;
       });
+      const codes: (RefusalCode | null)[] = mayEnd(actor, environments);
+      // With 0.15's log, also as 0.15 decides it, on sealed objects alone (R53): the actor's principal object, the
+      // roles object and each holder environment's object, each as its log has it and checked against its seal
+      // (`readerOf`, as a use's reader). 0.14's reader reads rows no seal covers (an environment's slug, a project's
+      // tombstone, the protection they make): a writer who swapped one could let a member end what they may not
+      // (reviews r10 and r11). An end needs both to allow it, so an unsealed row can only refuse one. An object the log
+      // does not bear out refuses the end. Per reference: one whose holder environment, or the actor, 0.14's log alone
+      // holds (before the cutover) is 0.14's reader's alone, and no other reference of the call with it (review r12).
+      const allowed14 = !codes.some((code) => code !== null);
+      if (d.changes !== null && allowed14) {
+        const member = await d.changes.held(d.tx, { kind: 'principal', id: principal });
+        const roles = await d.changes.held(d.tx, ROLES_REF as Ref & { kind: 'roles' });
+        const places = new Map<string, EnvironmentInput>();
+        for (const id of new Set(seals.map((seal) => seal.holder.environmentId))) {
+          const held = await d.changes.held(d.tx, { kind: 'environment', id });
+          if (held.log === 'live' && held.object.kind === 'environment') places.set(id, held.object);
+        }
+        if (member.log !== 'unlogged') {
+          const account = member.log === 'live' && member.object.kind === 'principal' ? member.object : null;
+          // The way the actor came in, as a reader takes it: its kind and scope (its generation weighs nothing here).
+          const credential: CredentialInput = {
+            kind: 'credential', id: principal, principal, caller: input.caller, scope: input.credentialScope ?? null, expiresAt: null, revoked: false, generation: account?.generation ?? 0,
+          };
+          const reader = readerOf(account, credential, roles.log === 'live' && roles.object.kind === 'roles' ? roles.object : noEdits(), places.values(), d.at);
+          mayEnd(reader, places).forEach((code, i) => {
+            if (places.has(seals[i]!.holder.environmentId)) codes[i] = code;
+          });
+        }
+      }
       if (!codes.some((code) => code !== null)) (await ended(d.tx)).forEach((code, i) => (codes[i] = code));
       const first = codes.find((code) => code !== null) ?? null;
-      if (first !== null) throw new Refused(refusal(first, MESSAGES[first]), vias.map((via, i) => entry(via, seals[i]!, 'deny', codes[i] ?? first)));
+      if (first !== null) throw new Refused(refusal(first, REFUSAL_MESSAGES[first]), vias.map((via, i) => entry(via, seals[i]!, 'deny', codes[i] ?? first)));
+      // With 0.15's log, each reference ended ends in its row, beside 0.14's entry, in this transaction (0029;
+      // formal/SealedObjects.tla, EndInRow and EndWithEntry). Decided only on what the vault authenticates (R53): that
+      // it has not ended is 0.14's log's (`ended` above), and what its holder reads is the holder's object, as its log
+      // has it and checked against its seal (`heldByLog`: ReferenceInObject, LivenessFromLog), never its rows, which
+      // a writer may rename, plant or mark archived. A holder whose rows the log does not bear out refuses the end
+      // (`tampered`, `stale`).
+      // - A holder whose object reads its source through this reference changes: `secret.write`, no source, whose
+      //   newest row, this one, `change_input` ends.
+      // - Any other ends this row alone, by its id (`end_reference`): an abandoned reference's stored none, and its
+      //   end touches no other. A holder with no object has only rows, which decide nothing here: 0.14's alone
+      //   before the cutover, which holds each reference row to 0.14's `reference.create` and `reference.end` (plan
+      //   PR 9); or archived, whose unarchive restores what its log last sealed (`keptObjects`, T134), never its rows.
+      // - So an archived holder whose kept object reads through this reference has that object ended too: written
+      //   ended, then deleted again, still no object (EndWhileArchived). Otherwise its unarchive would restore it
+      //   live, the row's end cleared by a writer, or refuse an honest one for the end in its rows. Its rows must make
+      //   the kept object, as a live holder's must make its sealed one: else the end is refused, reported.
+      if (d.changes !== null) {
+        const changes = d.changes;
+        const rows: string[] = [];
+        const staged = new Set<string>();
+        const end = (ref: Ref & { kind: 'secret' }, at: { projectId: string; environmentId: string }, archived: boolean) => {
+          if (staged.has(ref.id)) return;
+          staged.add(ref.id);
+          changes.stage(ref, { op: 'secret.write', projectId: at.projectId, environmentId: at.environmentId, version: '', nature: 'secret', key: null, digest: null, source: null, reference: null }, principal);
+          if (archived) changes.stage(ref, { op: 'secret.delete' }, principal);
+        };
+        for (const [i, { holder }] of seals.entries()) {
+          const reference = vias[i]!.reference;
+          const ref = { kind: 'secret' as const, id: holder.secretId };
+          const held = await changes.held(d.tx, ref);
+          if (held.log === 'live' && held.object.kind === 'secret' && held.object.reference === reference) {
+            end(ref, holder, false);
+            continue;
+          }
+          if (held.log === 'gone') {
+            const kept = await changes.kept(d.tx, ref);
+            if (kept?.kind === 'secret' && kept.reference === reference) {
+              // Its rows must make that object, or its end would write none of them: refused, reported, as a live one's.
+              await changes.rowsAsKept(d.tx, ref, kept);
+              end(ref, kept, true);
+            }
+          }
+          rows.push(reference);
+        }
+        if (rows.length > 0) d.writes.push((at) => store.endReferenceRows(d.tx, rows, at));
+      }
       const entries = vias.map((via, i) => entry(via, seals[i]!, 'allow', null));
       d.log.push(...entries);
       const answer = { seqs: [] as number[] };
@@ -1693,6 +2125,8 @@ class VaultService implements Vault {
    * and is asked about again at each of their requests. Whether it ran.
    */
   async #declare(principals: readonly string[]): Promise<boolean> {
+    // Under 0.15's log, no Owner made before the cutover: nothing of the log's precedes its change (AnchorHolds).
+    if (!(await this.#cutOverNow())) return false;
     const at = await this.#now(this.#db);
     const due: string[] = [];
     for (const principal of principals) {
@@ -1740,7 +2174,13 @@ class VaultService implements Vault {
     const owner = { role: 'owner' as const, scope: EVERYWHERE };
     d.grants.set(principal, [...subject.stored]);
     d.touched.add(principal);
-    if (tampered) await this.#startOver(d, VAULT_ACTOR, principal, row, subject.fault!, correlation, (code, message) => new Refused(refusal(code, message ?? MESSAGES[code]), []));
+    if (tampered) await this.#startOver(d, VAULT_ACTOR, principal, row, subject.fault!, correlation, (code, message) => new Refused(refusal(code, message ?? REFUSAL_MESSAGES[code]), []));
+    // Started over, their row is one 0.15's log does not hold, and changes nothing there: adoption or a reseal does
+    // (plan PR 9). Otherwise, the change the writes below make.
+    if (!tampered) {
+      const op = row === undefined ? 'member.add' : row.status === 'removed' ? 'member.restore' : 'member.role';
+      d.changes?.stage(memberRef(principal), { op, ...asStored(owner.role, owner.scope) }, VAULT_ACTOR);
+    }
     if (row === undefined && !tampered) {
       d.log.push(accessEntry(VAULT_ACTOR, 'member.add', principal, 'allow', correlation, { ...owner, reason }));
       d.writes.push((at) => store.insertMember(d.tx, {
@@ -1771,7 +2211,8 @@ class VaultService implements Vault {
     if (fault !== null) return { principal, status: 'tampered', live: none, all: none, fault, stored: grants };
     if (!PRINCIPAL.test(principal)) return { principal, status: 'unknown', live: none, all: none, fault, stored: grants };
     if (row?.status !== 'active') return { principal, status: row?.status ?? 'unknown', live: none, all: none, fault, stored: grants };
-    const held = grants.map((grant) => ({ ...grant, role: grant.role as Role }));
+    // What they hold: their grants but those on a place whose row is not as 0.15's log holds it (T159). Kept as stored.
+    const held = (await this.#heldGrants(db, grants, reports, reads?.environments)).map((grant) => ({ ...grant, role: grant.role as Role }));
     const { role, scope } = roleOf(principal, row);
     // Every decision about them reads the policy: their roles as an Owner edited them, and which environments are protected.
     const { policy } = await this.#policyAt(db, reports, at, reads);
@@ -1787,25 +2228,16 @@ class VaultService implements Vault {
   }
 
   #access(principal: string, row: Member | undefined, held: readonly GrantRow[], at: number, tampered: boolean, policy: Policy): Access {
-    const active = PRINCIPAL.test(principal) && !tampered && row?.status === 'active';
-    const access: Access = {
-      principal,
-      status: tampered ? 'tampered' : !PRINCIPAL.test(principal) ? 'unknown' : (row?.status ?? 'unknown'),
-      generation: row?.generation ?? 0,
-      ...(active ? roleOf(principal, row) : { role: 'member', scope: EVERYWHERE }),
-      grants: active ? held.filter((grant) => live(grant, at) && grantKind(grant) !== null).map(view) : [],
-      since: row ? iso(row.statusChangedAt) : null,
-      by: row?.statusChangedBy ?? null,
-      policy,
-    };
-    return { ...access, revision: accessRevision(access) };
+    return answerFrom(principal, row, held, at, tampered, policy);
   }
 
   /** The revision of what `access` would answer about a standing a decision read: none but an active member's matches a kept answer. */
   #revisionOf(standing: Standing, d: Decision): string | null {
     const { policy } = standing.live;
     if (standing.status !== 'active' || policy === undefined) return null;
-    return this.#access(standing.principal, d.members.get(standing.principal), standing.stored, d.at, false, policy).revision!;
+    // Its grants that hold, as `access` answers them (`#heldGrants`): those `all` keeps.
+    const held = standing.stored.filter((grant) => grant.environmentId === null || standing.all.grants.some((kept) => kept.environmentId === grant.environmentId));
+    return this.#access(standing.principal, d.members.get(standing.principal), held, d.at, false, policy).revision!;
   }
 
   /**
@@ -1830,11 +2262,13 @@ class VaultService implements Vault {
   /** `access`, as the rows are now. */
   async #read(principal: string, superseded: string | null): Promise<Access> {
     const read = async (db: Queryable, reports: NewEntry[]) => {
-      const reads = await snapshot(db, { principals: [principal], members: true });
+      const reads = await snapshot(db, { principals: [principal], members: true, seals: this.#checksPlaces() });
       const [row, held, at] = [reads.members.get(principal), reads.grants.get(principal)!, this.#at(reads)];
       const fault = await this.#integrity(db, principal, row, held, reports, reads);
+      // Their grants but those on a place whose row is not as 0.15's log holds it, which hold nothing (T159).
+      const holding = fault === null ? await this.#heldGrants(db, held, reports, reads.environments) : held;
       const { policy } = await this.#policyAt(db, reports, at, reads);
-      return this.#access(principal, row, held, at, fault !== null, policy);
+      return this.#access(principal, row, holding, at, fault !== null, policy);
     };
     const found: NewEntry[] = [];
     const quick = await read(this.#db, found).catch((error: unknown) => {
@@ -1882,7 +2316,7 @@ class VaultService implements Vault {
     const action = changes.every((change) => change.role === null) ? 'access.revoke' : 'access.grant';
     // One place refused is shown where it is, to whoever reads that place's log; an invalid one may be no place at all.
     const [only] = changes.length === 1 ? changes : [];
-    const refused = (code: RefusalCode, message = MESSAGES[code]) => {
+    const refused = (code: RefusalCode, message = REFUSAL_MESSAGES[code]) => {
       const where = only === undefined || code === 'invalid' ? { ids: {}, detail: {} } : located(only);
       return new Refused(refusal(code, message), [{
         ...accessEntry(actor, action, principal, 'deny', input, { changes: input.changes, ...where.detail }, code),
@@ -1920,11 +2354,10 @@ class VaultService implements Vault {
           throw refused('invalid', `${change.role} can only be granted on a project`);
         }
       }
-      const known = await store.places(
-        d.tx,
-        changes.map((change) => change.projectId!),
-        changes.flatMap((change) => (change.environmentId === null ? [] : [change.environmentId])),
-      );
+      const named = changes.flatMap((change) => (change.environmentId === null ? [] : [change.environmentId]));
+      const known = await store.places(d.tx, changes.map((change) => change.projectId!), named, { seals: this.#checksPlaces() });
+      // Each environment by its project and slug as 0.15's log holds its row (T159): what a grant there is weighed on.
+      this.#placesHold(known.environments, named, d.reports);
       const where: Place[] = changes.map(({ projectId, environmentId, role }) => {
         const environment = environmentId === null ? undefined : known.environments.get(environmentId);
         if (!known.projects.has(projectId!) || (environmentId !== null && environment?.projectId !== projectId)) {
@@ -1958,7 +2391,7 @@ class VaultService implements Vault {
         // The setting as of the log's head, which a change to it takes too.
         const setting = (await this.#settingsAt(d.tx, d.reports)).serviceAccounts;
         // One just admitted holds nothing yet, and is theirs.
-        const account = admitted !== undefined || row === undefined ? { grants: [], admittedBy: actor } : await this.#account(d.tx, subject, row);
+        const account = admitted !== undefined || row === undefined ? { grants: [], admittedBy: actor } : await this.#account(d.tx, subject, row, d.reads, d.reports);
         // Each place's new role they must hold, and what it held before: taking a grant away is changing it.
         const gives = changes.every((change, i) => {
           const before = subject.live.grants.find((grant) => placeKey({ ...grant, environmentSlug: null }) === placeKey(change));
@@ -1981,7 +2414,7 @@ class VaultService implements Vault {
    * not run the instance sets one up as they would through `admit`.
    */
   async #admitWith(d: Decision, acting: Standing, principal: string, row: Member | undefined, input: SetAccessInput): Promise<Admitted> {
-    const refused = (code: RefusalCode, message = MESSAGES[code]) =>
+    const refused = (code: RefusalCode, message = REFUSAL_MESSAGES[code]) =>
       new Refused(refusal(code, message), [accessEntry(acting.principal, 'member.add', principal, 'deny', input, { changes: input.changes }, code)]);
     if (!SERVICE.test(principal)) throw refused('invalid', 'only a service account is admitted with its grants: a person, by an instance role');
     if (!runsInstance(acting.live)) await this.#setsUp(d, acting, true, refused);
@@ -2023,6 +2456,7 @@ class VaultService implements Vault {
 
     if (change.role === null) {
       clear();
+      if (existing !== undefined) d.changes?.stage(memberRef(principal), { op: 'access.revoke', place: placeOf(place) }, actor);
       if (current === undefined) return 'unchanged';
       entry('access.revoke', null);
       return 'revoked';
@@ -2035,6 +2469,8 @@ class VaultService implements Vault {
       await store.insertGrant(d.tx, grant);
       d.grants.get(principal)!.push(grant);
     });
+    // In place of whatever it held there, lapsed or not, as clearing it then inserting this does.
+    d.changes?.stage(memberRef(principal), { op: 'access.grant', grant: inputGrant({ ...placeOf(place), role, expiresAt }) }, actor);
     entry('access.grant', role);
     return current === undefined ? 'created' : 'updated';
   }
@@ -2042,7 +2478,7 @@ class VaultService implements Vault {
   admit(input: AdmitInput): Promise<Outcome<Admitted>> {
     const { actor, principal } = input;
     const asked = input.role === undefined ? {} : { role: input.role, scope: input.scope ?? EVERYWHERE };
-    const refused = (code: RefusalCode, message = MESSAGES[code]) =>
+    const refused = (code: RefusalCode, message = REFUSAL_MESSAGES[code]) =>
       new Refused(refusal(code, message), [
         accessEntry(actor, 'member.add', principal, 'deny', input, asked, code),
       ]);
@@ -2082,6 +2518,7 @@ class VaultService implements Vault {
       if (changed) {
         d.log.push(accessEntry(actor, 'member.role', principal, 'allow', input, { role: wanted.role, scope: wanted.scope, previousRole: row.role, previousScope: row.scope }));
         d.writes.push(() => store.updateMember(d.tx, principal, { role: wanted.role, scope: wanted.scope }));
+        d.changes?.stage(memberRef(principal), { op: 'member.role', ...asStored(wanted.role, wanted.scope) }, actor);
         return { created: false, ...wanted, generation: row.generation };
       }
       return { created: false, role: row.role, scope: row.scope, generation: row.generation };
@@ -2097,11 +2534,30 @@ class VaultService implements Vault {
    */
   async #setsUp(d: Decision, acting: Standing, service: boolean, refused: (code: RefusalCode, message?: string) => Refused): Promise<void> {
     const setting = (await this.#settingsAt(d.tx, d.reports)).serviceAccounts;
-    if (!service || !PERSON.test(acting.principal) || !setsUpServices(acting.live, setting, placesOf(await store.liveProjects(d.tx)))) {
+    if (!service || !PERSON.test(acting.principal) || !setsUpServices(acting.live, setting, placesOf(await this.#livePlaces(d)))) {
       throw refused('not_allowed', 'only admins and owners of the whole instance may add people or set their roles, and a service account takes access somewhere the instance lets people set one up');
     }
   }
 
+  /**
+   * Every live project and its environments, each environment by its
+   * project, slug and tombstone as 0.15's log holds its row (T159): one that
+   * is not is no place anyone sets a service account up in, nor that a
+   * grant on every project of 0.4 becomes one on. Each read once,
+   * in the statement whose rows are checked, so what is checked is what is
+   * weighed (review r3: a row renamed between two reads, and back).
+   */
+  async #livePlaces(d: Decision): Promise<Awaited<ReturnType<typeof store.liveProjects>>> {
+    const projects = await store.liveProjects(d.tx);
+    if (!this.#checksPlaces()) return projects;
+    const rows = await store.environmentsById(d.tx, 'all', { seals: true });
+    const held = [...rows].filter(([id, row]) => this.#placeFault(id, row, d.reports) === null && !row.deleted);
+    return projects.map((project) => ({
+      id: project.id,
+      environments: held.filter(([, row]) => row.projectId === project.id).map(([id, row]) => ({ id, slug: row.slug })).sort((a, b) => (a.id < b.id ? -1 : 1)),
+    }));
+  }
+
   /**
    * Admit `principal`, who has no row or a removed one: a fresh start, as a
    * member unless given a role (`wanted`), at the generation a removal
@@ -2123,6 +2579,7 @@ class VaultService implements Vault {
     if (wanted?.role === 'owner' && !ownsInstance(acting.live)) throw refused('not_allowed', OWNERS_ONLY);
     const { role, scope } = wanted ?? { role: 'member' as const, scope: EVERYWHERE };
     d.log.push(accessEntry(actor, row === undefined ? 'member.add' : 'member.restore', principal, 'allow', correlation, { role, scope }));
+    d.changes?.stage(memberRef(principal), { op: row === undefined ? 'member.add' : 'member.restore', ...asStored(role, scope) }, actor);
     d.writes.push(async (at) => {
       if (row === undefined) {
         await store.insertMember(d.tx, {
@@ -2147,7 +2604,7 @@ class VaultService implements Vault {
 
   remove(input: RemoveInput): Promise<Outcome<{ revoked: Grant[]; generation: number }>> {
     const { actor, principal } = input;
-    const refused = (code: RefusalCode, message = MESSAGES[code]) =>
+    const refused = (code: RefusalCode, message = REFUSAL_MESSAGES[code]) =>
       new Refused(refusal(code, message), [accessEntry(actor, 'member.remove', principal, 'deny', input, {}, code)]);
     return this.#decide([actor, principal], async (d) => {
       validateCorrelation(input);
@@ -2166,7 +2623,7 @@ class VaultService implements Vault {
       if (!runsInstance(holder)) {
         // A service account its manager removes: they reach everything it holds (`managesService`).
         const theirs = SERVICE.test(principal) && PERSON.test(actor) && row?.status === 'active' &&
-          managesService(holder, (await this.#settingsAt(d.tx, d.reports)).serviceAccounts, actor, await this.#account(d.tx, subject, row));
+          managesService(holder, (await this.#settingsAt(d.tx, d.reports)).serviceAccounts, actor, await this.#account(d.tx, subject, row, d.reads, d.reports));
         if (!theirs) throw refused('not_allowed', 'only admins and owners of the whole instance may remove members, and a service account whoever manages it');
       }
       if (row?.status !== 'active') throw refused(row === undefined ? 'not_a_member' : 'removed');
@@ -2188,6 +2645,11 @@ class VaultService implements Vault {
       }
       const generation = row.generation + 1;
       d.log.push(accessEntry(actor, 'member.remove', principal, 'allow', input, { revoked: revoked.length, generation }));
+      // In 0.15's log, what the writes below do, op by op: every grant revoked, lapsed ones too, the role back to a
+      // Member's, then the removal.
+      for (const grant of held) d.changes?.stage(memberRef(principal), { op: 'access.revoke', place: placeOf(grant) }, actor);
+      if (row.role !== 'member') d.changes?.stage(memberRef(principal), { op: 'member.role', ...asStored('member', EVERYWHERE) }, actor);
+      d.changes?.stage(memberRef(principal), { op: 'member.remove' }, actor);
       d.touched.add(principal);
       d.writes.push(async (at) => {
         await store.deleteGrants(d.tx, principal);
@@ -2210,8 +2672,15 @@ class VaultService implements Vault {
    * environment by its slug, which the setting's scope matches, and who
    * admitted it, as its row says.
    */
-  async #account(db: Queryable, subject: Standing, row: Member): Promise<ServiceAccount> {
-    const slugs = await store.environmentsById(db, subject.live.grants.flatMap((grant) => (grant.environmentId === null ? [] : [grant.environmentId])));
+  async #account(db: Queryable, subject: Standing, row: Member, reads: Snapshot, reports: NewEntry[]): Promise<ServiceAccount> {
+    // Every place it holds a grant on, lapsed ones too, as 0.15's log holds its row (T159): one that is not holds nothing,
+    // and so would leave the account easier to manage, not harder. Refused instead.
+    const ids = subject.stored.flatMap((grant) => (grant.environmentId === null ? [] : [grant.environmentId]));
+    // The decision's own read of them, their grants' places among it once 0.15's log is cut over (`asked.seals`); else read.
+    const missing = ids.filter((id) => !reads.environments.has(id));
+    const slugs = missing.length === 0 ? reads.environments : new Map([...reads.environments, ...await store.environmentsById(db, missing, { seals: this.#checksPlaces() })]);
+    if (this.#checksPlaces() && ids.some((id) => !slugs.has(id))) throw new Refused(refusal('tampered', TAMPERED_PLACE), []);
+    this.#placesHold(slugs, ids, reports);
     return {
       grants: subject.live.grants.map((grant) => ({
         role: grant.role,
@@ -2239,15 +2708,16 @@ class VaultService implements Vault {
    * entries and none of its own within reach, the setting is closed, never
    * the default: otherwise whoever can insert rows could open it again.
    */
-  async #settingsAt(db: Queryable, reports: NewEntry[]): Promise<Settings> {
+  async #settingsAt(db: Queryable, reports: NewEntry[], reads?: Snapshot): Promise<Settings> {
+    // A snapshot's newest first, when it read it (`asked.settings`); the pages before it, as they are asked.
     const entry = await newestAuthentic(
-      (limit, before) => store.newestVaultEntries(db, SETTINGS, limit, before),
+      (limit, before) => (reads?.newestSettings !== undefined && before === undefined
+        ? Promise.resolve(reads.newestSettings === null ? [] : [reads.newestSettings])
+        : store.newestVaultEntries(db, SETTINGS, limit, before)),
       this.#check(reports, null),
     );
-    if (entry === 'none') return DEFAULT_SETTINGS;
-    if (typeof entry === 'string') return CLOSED_SETTINGS;
-    const { serviceAccounts } = JSON.parse(entry.metadata) as { serviceAccounts?: unknown };
-    return isScope(serviceAccounts) ? { serviceAccounts } : CLOSED_SETTINGS;
+    if (entry === 'none') return settingsFrom(null);
+    return typeof entry === 'string' ? CLOSED_SETTINGS : settingsFrom(entry.metadata);
   }
 
   // --- the instance's access policy -------------------------------------------
@@ -2268,7 +2738,7 @@ class VaultService implements Vault {
    * no role holds anything but Owner, otherwise whoever can insert rows
    * could unprotect them. Its edits are then unknown, not none.
    */
-  async #policyAt(db: Queryable, reports: NewEntry[], at: number, reads?: Snapshot): Promise<{ policy: Policy; edits: PolicyEdits; readable: boolean }> {
+  async #policyAt(db: Queryable, reports: NewEntry[], at: number, reads?: Snapshot): Promise<{ policy: Policy; edits: PolicyEdits; readable: boolean; seq: bigint | null }> {
     // The snapshot's newest first, with the rows it protects; the pages before it, as they are asked.
     const entry = await newestAuthentic(
       (limit, before) => (reads !== undefined && before === undefined
@@ -2276,11 +2746,13 @@ class VaultService implements Vault {
         : store.newestVaultEntries(db, POLICY, limit, before)),
       this.#check(reports, null),
     );
-    if (entry === 'none') return { policy: DEFAULT_POLICY, edits: NO_EDITS, readable: true };
+    if (entry === 'none') return { policy: DEFAULT_POLICY, edits: NO_EDITS, readable: true, seq: null };
     const edits = typeof entry === 'string' ? null : readEdits(JSON.parse(entry.metadata) as { policy?: unknown });
-    if (edits === null) return { policy: CLOSED_POLICY, edits: NO_EDITS, readable: false };
-    const rows = entry === reads?.newestPolicy ? reads.environments : await store.environmentsById(db, edits.protected.map((place) => place.environmentId));
-    return { policy: livePolicy(rows, edits, at), edits, readable: true };
+    if (edits === null) return { policy: CLOSED_POLICY, edits: NO_EDITS, readable: false, seq: null };
+    const rows = entry === reads?.newestPolicy
+      ? reads.environments
+      : await store.environmentsById(db, edits.protected.map((place) => place.environmentId), { seals: this.#checksPlaces() });
+    return { policy: this.#livePolicy(rows, edits, at, reports), edits, readable: true, seq: (entry as StoredEntry).seq };
   }
 
   changePolicy(input: ChangePolicyInput): Promise<Outcome<{ policy: Policy; seq: number | null }>> {
@@ -2299,7 +2771,7 @@ class VaultService implements Vault {
       ...at,
       metadata: JSON.stringify({ ...detail, ...traced(input) }),
     });
-    const refused = (code: RefusalCode, message = MESSAGES[code]) =>
+    const refused = (code: RefusalCode, message = REFUSAL_MESSAGES[code]) =>
       new Refused(refusal(code, message), [entry('deny', { change: describeChange(change) }, code)]);
     return this.#decide([actor], async (d) => {
       validateCorrelation(input);
@@ -2319,6 +2791,8 @@ class VaultService implements Vault {
       if (!readable && !owner) throw refused('not_allowed', "the vault cannot read its own policy: only an Owner of the whole instance writes it again, from the roles as they ship");
       // Those the policy no longer holds stay out: a deleted environment's id, and an unwritten fork's past its window,
       // neither of which comes back, the window being one a fork writes its row well within.
+      // What 0.15's log changes with it: the roles object, or each environment whose protection moves.
+      const changes: { ref: Ref & { kind: 'roles' | 'environment' }; op: Op }[] = [];
       const next: PolicyEdits = {
         roles: { ...edits.roles },
         instanceRoles: { ...edits.instanceRoles },
@@ -2346,6 +2820,7 @@ class VaultService implements Vault {
             throw refused('invalid', `${change.role} is granted on environments: as it ships, it holds a project-wide permission, which would make those grants incoherent`);
           }
           delete table[change.role];
+          changes.push({ ref: ROLES_REF as Ref & { kind: 'roles' }, op: { op: 'role.define', table: instance ? 'instanceRoles' : 'roles', role: change.role, definition: null } });
         } else {
           const problem = definitionProblem(change.definition);
           if (problem !== null) throw refused('invalid', problem);
@@ -2357,6 +2832,7 @@ class VaultService implements Vault {
           const shipped = instance ? INSTANCE_ROLES[change.role as InstanceRole] : isBuiltinRole(change.role) ? ROLES[change.role] : undefined;
           if (shipped !== undefined && JSON.stringify(normalDefinition(shipped)) === JSON.stringify(definition)) delete table[change.role];
           else table[change.role] = definition;
+          changes.push({ ref: ROLES_REF as Ref & { kind: 'roles' }, op: { op: 'role.define', table: instance ? 'instanceRoles' : 'roles', role: change.role, definition } });
         }
       } else if (change?.kind === 'protect') {
         if (typeof change.projectId !== 'string' || !UUID.test(change.projectId) || !Array.isArray(change.environmentIds) || change.environmentIds.length === 0
@@ -2366,28 +2842,52 @@ class VaultService implements Vault {
         if (!(await store.projectLive(d.tx, change.projectId))) throw refused('invalid', 'no such project');
         at.projectId = change.projectId;
         // Each a live environment of the project, or none yet: a fork's id, protected before its row is written.
-        const found = await store.environmentsById(d.tx, change.environmentIds);
+        const found = await store.environmentsById(d.tx, change.environmentIds, { seals: this.#checksPlaces() });
+        // Each as 0.15's log holds its row (T159, review r1): its project and whether it was deleted decide what changes, and
+        // a tombstone set around the log would keep a protection's end from its object. One the log has never held (no
+        // seal, no change) is 0.14's alone, which the change path takes as such.
+        this.#placesHold(found, [...found].flatMap(([id, row]) => (row.sealed?.seal == null && row.sealed?.newest == null ? [] : [id])), d.reports);
         if ([...found.values()].some((environment) => environment.projectId !== change.projectId)) throw refused('invalid', 'each environment is one of the project\'s');
         if (change.environmentIds.length === 1 && found.has(change.environmentIds[0]!)) at.environmentId = change.environmentIds[0];
+        // An environment whose object 0.15's log changes with this: one with a row, not deleted (`environment.protect`).
+        const live015 = (id: string) => found.get(id)?.deleted === false;
         if (change.protected) {
           if (!allows(acting.live, 'environment.manage', { projectId: change.projectId })) throw refused('not_allowed', 'protecting an environment takes managing its project\'s environments');
           const known = new Set(next.protected.map((place) => place.environmentId));
+          // An id with no row yet, a fork's, is no object of 0.15's log: its creation carries its protection (plan PR 4b).
+          // A deleted one changes no more there: 0.14 keeps its id in the edits, which its policy reads past.
+          for (const id of change.environmentIds) if (!known.has(id) && live015(id)) changes.push({ ref: { kind: 'environment', id }, op: { op: 'environment.protect', protected: true } });
           next.protected = [...next.protected, ...change.environmentIds.filter((id) => !known.has(id)).map((environmentId) => ({ projectId: change.projectId, environmentId, at: d.at }))]
             .sort((a, b) => (a.environmentId < b.environmentId ? -1 : 1));
         } else {
           // Unprotecting widens what people hold there: an Owner of the project's to do, or of the whole instance's (R30).
           // It takes off only what the project protects: a fork's id, with no row yet, is another project's to unprotect.
           if (!ownsProject(acting.live, change.projectId)) throw refused('not_allowed', 'only an Owner of its project, or of the whole instance, unprotects an environment');
+          for (const place of next.protected) {
+            if (place.projectId === change.projectId && change.environmentIds.includes(place.environmentId) && live015(place.environmentId)) {
+              changes.push({ ref: { kind: 'environment', id: place.environmentId }, op: { op: 'environment.protect', protected: false } });
+            }
+          }
           next.protected = next.protected.filter((place) => place.projectId !== change.projectId || !change.environmentIds.includes(place.environmentId));
         }
       } else {
         throw refused('invalid', 'a change is to a role, an instance role, or protection');
       }
       // The policy now, and the newest change, which it is as of: this one's, when it changed anything.
-      const answer = { policy: livePolicy(await store.environmentsById(d.tx, next.protected.map((place) => place.environmentId)), next, d.at), seq: newest === null ? null : Number(newest) };
+      const answer = {
+        policy: this.#livePolicy(await store.environmentsById(d.tx, next.protected.map((place) => place.environmentId), { seals: this.#checksPlaces() }), next, d.at, d.reports),
+        seq: newest === null ? null : Number(newest),
+      };
       if (!readable || JSON.stringify(next) !== JSON.stringify(edits)) {
+        // With 0.15's log, ordered against the vault's issues in flight, which check the policy under the issue lock shared:
+        // exclusive, its rows written, before its append's trigger takes the fence (`holdIssues`).
+        if (this.#prepared.log015 !== null) await holdIssues(d.tx);
         const made = entry('allow', { policy: next, change: describeChange(change), before: describeBefore(change, before) });
         d.log.push(made);
+        for (const { ref, op } of changes) d.changes?.stage(ref, op, actor);
+        d.after.push((seqOf) => {
+          for (const { ref } of changes) d.changes?.cite(ref, BigInt(seqOf(made)));
+        });
         d.after.push((seqOf) => (answer.seq = seqOf(made)));
       }
       return answer;
@@ -2405,7 +2905,7 @@ class VaultService implements Vault {
       requestId: input.requestId ?? null,
       metadata: JSON.stringify({ ...detail, ...traced(input) }),
     });
-    const refused = (code: RefusalCode, message = MESSAGES[code]) =>
+    const refused = (code: RefusalCode, message = REFUSAL_MESSAGES[code]) =>
       new Refused(refusal(code, message), [entry('deny', { serviceAccounts: input.settings?.serviceAccounts ?? null }, code)]);
     return this.#decide([actor], async (d) => {
       validateCorrelation(input);
@@ -2691,7 +3191,7 @@ class VaultService implements Vault {
       // Checkpoints one at a time, each against the one before.
       const head = await lockLogHead(d.tx);
       const latest = await store.latestVaultEntry(d.tx, [CHECKPOINT]);
-      const refused = (code: RefusalCode, detail: Record<string, unknown>, message = MESSAGES[code]) =>
+      const refused = (code: RefusalCode, detail: Record<string, unknown>, message = REFUSAL_MESSAGES[code]) =>
         new Refused(refusal(code, message), [
           { actor: SCHEDULER, action: CHECKPOINT, decision: 'deny', code, metadata: JSON.stringify(detail) },
         ]);
@@ -2847,7 +3347,7 @@ class VaultService implements Vault {
     return JSON.parse(refused.metadata) as { failedAtSeq?: number | null; reason?: string };
   }
 
-  async about(): Promise<{ checkpointKeys: Record<string, CheckpointKey>; owners: string[]; rootAdmins: [] }> {
+  async about(): Promise<{ checkpointKeys: Record<string, CheckpointKey>; owners: string[]; rootAdmins: []; log?: '0.15'; uses?: true; batchUses?: true; sealing?: true; credentials?: true; issues?: true }> {
     await this.#settled();
     const { signers, since } = this.#prepared;
     // A key it replaced vouches only for prefixes before its first entry under the current one: none, before it has one.
@@ -2857,7 +3357,682 @@ class VaultService implements Vault {
       owners: [...this.#config.owners],
       // For an app of 0.5 while it runs beside this vault: there are none, and its lists and checks need the field.
       rootAdmins: [],
+      // With it, the vault makes sign-ins through bindings and revokes credentials itself (credentials.ts).
+      ...(this.#prepared.log015 === null ? {} : { log: '0.15' as const, sealing: true as const, credentials: true as const, issues: true as const, binds: true as const }),
+      // 0.15's uses need its log and the hot path's login: the app opens values through them only then (`use`).
+      // A request's several keys in one call too (`useMany`, T167), said so that an app newer than its vault asks for it
+      // only of a vault that has it.
+      ...(this.#prepared.log015 === null || this.#hot === undefined ? {} : { uses: true as const, batchUses: true as const }),
+    };
+  }
+
+  /**
+   * 0.15's cutover from 0.14 (cutover.ts; plan PR 9; formal/Migration015.tla).
+   * Done once: the marker read with no lock first, so that each isolate's
+   * start stalls nothing once it is. Without `input`, where 0.14's chain is
+   * verified from, for the app to check its own entries from there.
+   *
+   * With it: 0.14's chain walked on from its newest checkpoint, outside any
+   * transaction (VerifyChain); then one transaction, under every member's
+   * row, 0.14's head, the issue lock shared and the fence (RowFirst,
+   * CutoverHeadLock, CutoverIssueFirst, CutoverFence), the marker read again
+   * (Marker), the rest of the chain to the head, what the app checked still
+   * the chain's and nothing of the app's since (VouchedHeld), every row read
+   * and checked (`planCutover`), the places 0.14 deleted made as 0.15 leaves
+   * them, each object's genesis, its own 0.14 entry, `log.cutover`, and the
+   * cutover's change naming it. Answers once that change is sealed (R51).
+   */
+  async cutover(input?: CutoverInput | null): Promise<CutoverOutcome> {
+    const log015 = this.#log015();
+    const prepared = this.#prepared;
+    if (prepared.cutover || (await this.#cutoverSealed())) {
+      prepared.cutover = true;
+      return { ok: true, done: true };
+    }
+    if (prepared.since === null && prepared.superseded === null) await this.#settle();
+    if (prepared.superseded !== null) return { ok: false, refused: 'refused', why: prepared.superseded };
+    const from = await this.#resume(this.#db, 'newest');
+    if (!from.ok) return this.#cutoverRefused(`0.14's chain does not verify at entry ${from.failedAtSeq}: ${from.reason}`);
+    const mark = { seq: from.at.seq.toString(), hash: from.at.hash.toString('hex') };
+    // Over RPC or a socket, no input arrives as null.
+    if (input == null) return { ok: true, done: false, from: mark };
+    // The app checked its entries from where this walk starts, or another checkpoint came since: it checks again.
+    if (input.checked?.from?.seq !== mark.seq || input.checked.from.hash !== mark.hash) return { ok: false, refused: 'moved', why: "0.14's newest checkpoint is not the one the app checked from" };
+    // 0.14's chain whole, outside any transaction (VerifyChain): the prefix its newest checkpoint signed, rehashed from the
+    // first entry, which must come to the hash it signed (an entry edited, deleted or moved before it does not: review
+    // r4), each entry there MAC'd when that checkpoint was signed; then the entries since, by the vault's MACs. Once a
+    // cutover: hashes alone, no MAC, no tally.
+    const signed = await relink(this.#db, START, from.at.seq, Infinity);
+    if (!signed.ok) return this.#cutoverRefused(`0.14's chain does not verify at entry ${signed.failedAtSeq}: ${signed.reason}`);
+    if (signed.at.seq !== from.at.seq || !signed.at.hash.equals(from.at.hash)) return this.#cutoverRefused(`0.14's chain up to entry ${from.at.seq} is not the prefix its newest checkpoint signed`);
+    const walked = await this.#walkOn(from, Infinity);
+    if (!walked.ok) return this.#cutoverRefused(`0.14's chain does not verify at entry ${walked.failedAtSeq}: ${walked.reason}`);
+    const reports: NewEntry[] = [];
+    let number: bigint;
+    try {
+      number = await this.#db.transaction((tx) => this.#cutOver(tx, input, walked, reports));
+    } catch (error) {
+      if (error instanceof VouchMoved || error instanceof Retry) return { ok: false, refused: 'moved', why: error instanceof VouchMoved ? error.message : 'a member was admitted meanwhile' };
+      if (error instanceof CutoverRefused) return this.#cutoverRefused(error.message);
+      throw error;
+    }
+    this.#reported(reports);
+    // Done once sealed (R51), whichever vault's change it is: one found under the locks too.
+    await log015.sealThrough(number);
+    prepared.cutover = true;
+    return { ok: true, done: true };
+  }
+
+  /** The cutover's transaction (`cutover`): its change's number, another vault's if it cut over first. */
+  async #cutOver(tx: Transaction, input: CutoverInput, walked: Walked, reports: NewEntry[]): Promise<bigint> {
+    const log015 = this.#log015();
+    const { logKeys } = this.#prepared;
+    await store.boundLockWaits(tx, LOCK_TIMEOUT_MS);
+    const principals = (await store.allMembers(tx)).map((row) => row.principal);
+    const rows = principals.length === 0 ? new Map<string, Member>() : await store.lockMembers(tx, principals);
+    const head = await lockLogHead(tx);
+    await holdFence(tx);
+    const found = await store.cutoverNumber(tx);
+    if (found !== null) return found;
+    if ((await store.allMembers(tx)).length !== rows.size) throw new Retry();
+    // 0.14's chain, to the head it holds: what the walk read still there, and the rest by the vault's MACs.
+    if (!(await carries(tx, headOf(walked.at)))) throw new CutoverRefused(`the log up to entry ${walked.at.seq} changed while the vault walked it`);
+    const walk = new Walk(walked.tally, walked.digest);
+    const rest = await rehash(tx, logKeys, walked.at, walk, {});
+    if (!rest.ok) throw new CutoverRefused(`0.14's chain does not verify at entry ${rest.failedAtSeq}: ${rest.reason}`);
+    const unsigned = await this.#checkpointFault(tx, walk.checkpoints);
+    if (unsigned !== null) throw new CutoverRefused(`0.14's chain does not verify at entry ${unsigned.failedAtSeq}: ${unsigned.reason}`);
+    if (rest.at.seq !== head.nextSeq - 1n || !rest.at.hash.equals(head.headHash)) throw new CutoverRefused("0.14's chain head does not name its last entry");
+    // What the app checked by its MACs is the chain's, and it wrote nothing since: what it vouched for stands (VouchedHeld).
+    const to = { seq: Number(input.checked.to.seq), hash: input.checked.to.hash };
+    if (!Number.isSafeInteger(to.seq) || to.seq < -1 || BigInt(to.seq) > rest.at.seq || !(await carries(tx, to))) throw new VouchMoved("the chain the app checked is not 0.14's now");
+    if (await store.appEntriesAfter(tx, BigInt(to.seq))) throw new VouchMoved('the app wrote to 0.14\'s log since it vouched for its rows');
+
+    const at = await this.#now(tx);
+    const { edits, readable, seq: policySeq } = await this.#policyAt(tx, reports, at);
+    if (!readable) throw new CutoverRefused("0.14's newest policy is not the vault's: its roles and protection are not known");
+    const logged = await store.loggedObjects(tx);
+    const held = new Map<string, GrantRow[]>();
+    for (const grant of await store.grants(tx)) held.set(grant.principal, [...(held.get(grant.principal) ?? []), grant]);
+    const seals = await store.memberSeals(tx);
+    // Each member's newest access entry, all in one read: a row whose MAC holds and names it, the vault's, is as 0.14's
+    // `#integrity` takes it; any other is checked by it, one read each, and reported.
+    const newest = await store.newestAccessEntries(tx);
+    const members = [];
+    for (const member of rows.values()) {
+      const grants = held.get(member.principal) ?? [];
+      const seal = seals.get(member.principal) ?? null;
+      // A member 0.15's log holds already is its log's: not checked as 0.14's again.
+      const fresh = seal === null && !logged.has(objectKey(memberRef(member.principal)));
+      const entry = newest.get(member.principal);
+      const plain = entry !== undefined && entry.seq === member.accessSeq && this.#authentic(entry) && this.#sealed(member, grants);
+      members.push({ member, grants, seal, genuine: !fresh || plain || (await this.#integrity(tx, member.principal, member, grants, reports)) === null });
+    }
+    const secrets = await store.everySecret(tx);
+    const references = await this.#referencesMade(tx, secrets);
+    const plan = planCutover({
+      logged,
+      config: await store.configRows(tx),
+      members,
+      edits,
+      policySeq,
+      bulk: this.#config.bulkLimit,
+      projects: await store.everyProject(tx),
+      environments: await store.everyEnvironment(tx),
+      secrets,
+      references,
+      input,
+      credentials: await store.credentialsAt(tx, input.credentials.map((columns) => columns.id)),
+      bindings: await store.bindingsAt(tx, input.bindings.map((columns) => columns.id)),
+      connections: await store.connectionsAt(tx, input.connections.map((columns) => columns.id)),
+    });
+    // Reported as a change refused on them would be (`#notLogged`), once: a member's by their check (`#integrity`).
+    for (const { ref, fault } of plan.skipped) if (ref.kind !== 'principal') this.#report(reports, null, fault === 'tampered' ? 'mac' : 'stale', `log.${ref.kind}:${ref.id}`);
+
+    await store.endReferenceRows(tx, plan.ends, at);
+    await store.cutoverPlaces(tx, at, plan.rename, plan.archive);
+    // Its own entry last, the head its change names (the anchor): the trigger's issue lock and fence held already.
+    const appended = await this.#append(tx, [...reports, {
+      actor: VAULT_ACTOR, action: CUTOVER, decision: 'allow',
+      metadata: JSON.stringify({ from: { seq: walked.from.at.seq.toString(), hash: walked.from.at.hash.toString('hex') }, sealed: plan.genesis.length + plan.bindings.length, skipped: plan.skipped.length }),
+    }]);
+    const calls = genesisCalls(log015, plan.genesis, at);
+    for (let i = 0; i < calls.length; i += GENESIS_BATCH) {
+      const numbers = await store.changeInputs(tx, calls.slice(i, i + GENESIS_BATCH));
+      if (numbers.some((n) => n === null)) throw new VouchMoved('an object\'s row moved under the cutover\'s locks');
+    }
+    for (const call of genesisCalls(log015, plan.bindings, at)) {
+      if ((await store.sealBinding(tx, call)) === null) throw new VouchMoved(`the binding ${call.ref.id}'s row moved under the cutover's locks`);
+    }
+    const anchor = { seq: appended.nextSeq - 1n, hash: appended.headHash };
+    return store.logCutover(tx, cutoverRow(log015, at, cutoverPayload(anchor, walked.from.at)));
+  }
+
+  /**
+   * Each key's newest reference row's `reference.create`, by its number:
+   * whether it is the vault's, by its MAC, about that row, holder and
+   * source; and whether an authentic `reference.end` ended it.
+   */
+  async #referencesMade(db: Queryable, secrets: readonly store.SecretRead[]): Promise<Map<string, { authentic: boolean; ended: boolean }>> {
+    const rows = secrets.flatMap((secret) => (secret.reference === null ? [] : [{ secret, reference: secret.reference }]));
+    const made = await store.entriesAt(db, rows.map(({ reference }) => reference.createdSeq));
+    // An entry of these the vault's MAC does not hold is damaged history, read under the cutover's locks: refused, never
+    // taken for no end (a reference 0.14 holds ended would be sealed live: review r4) nor for no reference.
+    const damaged = (entry: StoredEntry) => {
+      throw new CutoverRefused(`0.14's ${entry.action} at entry ${entry.seq} does not carry the vault's MAC: its history is damaged`);
     };
+    const ends = await store.referenceEnds(db, rows.map(({ reference }) => reference.createdSeq));
+    for (const entry of ends) if (!this.#authentic(entry)) damaged(entry);
+    const ended = new Set(ends.map((entry) => entry.relatedSeq!.toString()));
+    return new Map(rows.map(({ secret, reference }) => {
+      const entry = made.get(reference.createdSeq);
+      const created = entry !== undefined && entry.author === 'vault' && entry.action === 'reference.create' && entry.decision === 'allow';
+      if (created && !this.#authentic(entry)) damaged(entry);
+      const sealed = !created ? null : sealedReference(entry, reference.id);
+      // The holder where the vault made it: a row moved around it, its id and reference row kept, would read the source
+      // from another place, where 0.14's read through it is refused.
+      const authentic = sealed !== null && sealed.holder.secretId === secret.id && sealed.holder.projectId === secret.projectId
+        && sealed.holder.environmentId === secret.environmentId && sealed.source.secretId === reference.source;
+      return [reference.createdSeq.toString(), { authentic, ended: ended.has(reference.createdSeq.toString()) }];
+    }));
+  }
+
+  /** A cutover refused, recorded once a process (`log.cutover`, denied), and answered. */
+  async #cutoverRefused(why: string): Promise<CutoverOutcome> {
+    const reports: NewEntry[] = [];
+    const key = `cutover|${why}`;
+    if (!this.#prepared.reported.has(key)) {
+      const entry: NewEntry = { actor: VAULT_ACTOR, action: CUTOVER, decision: 'deny', code: 'log_broken', metadata: JSON.stringify({ reason: why }) };
+      REPORTED.set(entry, key);
+      reports.push(entry);
+    }
+    if (reports.length > 0) await this.#db.transaction((tx) => this.#append(tx, reports));
+    this.#reported(reports);
+    return { ok: false, refused: 'refused', why };
+  }
+
+  /**
+   * Under 0.15's log, that it is cut over from 0.14 (`cutover`): nothing of
+   * 0.15's is decided, changed or used before, so that the cutover's change
+   * precedes every other (AnchorHolds) and nothing decides on rows it has
+   * not sealed. The marker read once, with no lock, until it is there.
+   */
+  async #cutOverYet(): Promise<void> {
+    if (!(await this.#cutOverNow())) throw new Error(NOT_CUT_OVER);
+  }
+
+  /** Whether the vault may serve 0.15's log: kept by 0.14's alone, or cut over, its change sealed (`#cutoverSealed`). */
+  async #cutOverNow(): Promise<boolean> {
+    const prepared = this.#prepared;
+    if (prepared.log015 === null || prepared.cutover) return true;
+    if (!(await this.#cutoverSealed())) return false;
+    prepared.cutover = true;
+    return true;
+  }
+
+  /**
+   * Whether the log is cut over, its change sealed: the marker read with no
+   * lock, then, found, its seal waited for (R51), as the vault that wrote it
+   * waits before it answers. Committed and not sealed yet, as when that vault
+   * waits or failed before its seal, it serves nothing until it is. Sealed
+   * long ago, as it is but in a deployment's first moments, a pair this
+   * vault's key signed past it says so (T169): an isolate's first calls, its
+   * uses among them, ask no checkpointer, which may be the one thing that
+   * does not answer.
+   */
+  async #cutoverSealed(): Promise<boolean> {
+    const number = await store.cutoverNumber(this.#db);
+    if (number === null) return false;
+    if (!(await this.#signedPast(number))) await this.#log015().sealThrough(number);
+    return true;
+  }
+
+  /**
+   * Whether the database's newest checkpoint is a pair this vault's key signed in whose changes tree change `number`
+   * is proved, as its seal proves it: a pair covering its number may cover a gap a writer moved the change into
+   * (review r1). Anything short of that goes to the seal, which alarms on what it refuses.
+   */
+  async #signedPast(number: bigint): Promise<boolean> {
+    const store = logStore(this.#db);
+    const newest = await store.newest();
+    if (newest === null || newest.upto < number) return false;
+    const pair = await openPair(newest.notes, (await this.#verifierKeys()).verifiers);
+    if (pair === null || pair.upto !== newest.upto) return false;
+    const proof = await proveIn(store, number, { pair, notes: newest.notes }, { tree: 'changes' }).catch(() => null);
+    return proof !== null;
+  }
+
+  /**
+   * The app's changes, sealed (`prepareChanges`, plan PR 4b): no lock,
+   * nothing written, and no read but, for an unarchive, what its key's log
+   * last sealed (`keptObjects`, T134); but the report of a row that is not
+   * the vault's, which refuses them all (`tampered`, `stale`), as a decision
+   * of its own would.
+   */
+  async prepare(input: PrepareInput): Promise<Outcome<Prepared>> {
+    const log015 = this.#log015();
+    if (typeof input?.actor !== 'string' || input.actor.length === 0 || !Array.isArray(input.changes)) throw new Error('prepare takes an actor and the changes the app will write');
+    // Before the cutover, a change of 0.14's rows alone, which logs nothing (`prepareChanges`): what the app key's
+    // rotation makes as it signs sessions out, which the app's door finishes before it cuts over (review r3). One that
+    // makes an object, or changes one the log holds, waits for the cutover.
+    if (input.changes.some((change) => change.before === null || change.before.seal !== null)) await this.#cutOverYet();
+    try {
+      const restored = input.changes.flatMap((change) => (change.kind === 'secret' && change.restores === true ? [{ kind: 'secret' as const, id: change.id }] : []));
+      const kept = restored.length === 0 ? new Map() : await keptObjects(log015.seals, this.#db, restored);
+      return { ok: true, changes: prepareChanges(log015, Date.now() + this.#prepared.options.clockOffset(), input.actor, input.changes, kept) };
+    } catch (error) {
+      if (!(error instanceof NotLogged)) throw error;
+      const reports: NewEntry[] = [];
+      const refused = this.#notLogged(reports, error);
+      await this.#record(reports);
+      return { ok: false, refusal: refused.refusal };
+    }
+  }
+
+  /** A sign-in through a trust binding, made by the vault (credentials.ts, T149): one statement, then the seal wait (R51). */
+  async signIn(input: SignInInput): Promise<SignInOutcome> {
+    const log015 = this.#log015();
+    await this.#cutOverYet();
+    const at = Date.now() + this.#prepared.options.clockOffset();
+    // The proof, verified here on the sealed binding (D148): what the credential is held to comes of the token, not the app.
+    const proven = await this.#proven(log015, input, at);
+    if ('refused' in proven) return proven;
+    const answer = await signIn(this.#db, log015, at, proven);
+    if (answer.number == null) return { ok: false, refused: answer.state as Exclude<SignInRefusal, 'proof'> };
+    const sealed = await log015.sealThrough(BigInt(answer.number));
+    return { ok: true, number: answer.number, witnessed: sealed.witnessed ?? null };
+  }
+
+  /**
+   * A credential revoked by the vault (credentials.ts, T149): one statement,
+   * then the seal wait. A row whose seal is not the vault's, or not its
+   * object's newest change's, is reported, as `prepare` reports one; one
+   * whose policy moved since its revoke was weighed is refused, nothing
+   * reported.
+   */
+  async revokeCredential(input: RevokeCredentialInput): Promise<RevokeCredentialOutcome> {
+    const log015 = this.#log015();
+    await this.#cutOverYet();
+    const notLogged = async (error: NotLogged) => {
+      const reports: NewEntry[] = [];
+      this.#notLogged(reports, error);
+      await this.#record(reports);
+      return { ok: false as const, refused: error.fault };
+    };
+    let answer: Answer;
+    try {
+      answer = await revokeCredential(this.#db, log015, Date.now() + this.#prepared.options.clockOffset(), input);
+    } catch (error) {
+      if (error instanceof NotLogged) return notLogged(error);
+      throw error;
+    }
+    if (answer.state === 'stale') return notLogged(new NotLogged({ kind: 'credential', id: input.before.columns.id }, 'stale'));
+    if (answer.state === 'moved' || answer.state === 'busy' || answer.state === 'policy') return { ok: false, refused: answer.state };
+    if (answer.number == null) throw new Error('revoke_credential answered neither a change nor why it made none');
+    const sealed = await log015.sealThrough(BigInt(answer.number));
+    return { ok: true, number: answer.number, witnessed: sealed.witnessed ?? null };
+  }
+
+  /**
+   * What of a sign-in the vault checks itself (D148, PR 3b; formal/Lifecycle.tla's
+   * VaultVerifiesToken, AudienceSealed, Fetched), asking no one: only on a
+   * binding whose seal is its own (BindingSealed: the issuer, keys, audience
+   * and claims it trusts are the ones a manager made it with); a workload's
+   * DPoP proof, whose key's thumbprint names the session's key, the
+   * credential's `jkt` and, where its platform lets the caller choose the
+   * token's audience, that audience, never the app's; and, when the sealed
+   * binding carries its issuer's keys, the token, on those keys
+   * (`verifyRunToken`), the sign-in's spend, times and run then taken from
+   * it. A binding of keys its issuer publishes, which the vault does not
+   * fetch, and a proof that is no ID token (an AWS signed request) take the
+   * app's word for the token, as their binding's seal says.
+   */
+  async #proven(log015: NonNullable<PreparedVault['log015']>, input: SignInInput, at: number): Promise<SignInInput | { ok: false; refused: 'unsealed' } | { ok: false; refused: 'proof'; reason: string; message: string; kid: string | null }> {
+    const binding = checkBinding(input?.binding?.columns);
+    const seal = typeof input.binding.seal === 'string' ? Buffer.from(input.binding.seal, 'base64') : null;
+    if (seal === null || binding.revoked || binding.principal !== input.principal || !sealedObject(log015.seals, { kind: 'binding', id: binding.id }, bindingObject(binding), seal)) {
+      return { ok: false, refused: 'unsealed' };
+    }
+    const refuse = (reason: string, message: string, kid: string | null = null) => ({ ok: false as const, refused: 'proof' as const, reason, message, kid });
+    const { idToken, dpop } = input;
+    if ((idToken !== null && (typeof idToken?.token !== 'string' || typeof idToken.jwks !== 'string')) || (dpop !== null && typeof dpop !== 'string')) {
+      throw new Error('a sign-in names the run\'s ID token and its binding\'s uploaded keys, or neither, and a DPoP proof or none');
+    }
+    const workload = input.credential.kind === 'workload';
+    // A workload's key: the one its DPoP proof is signed by, for this instance's sign-in, by the binding's own origin.
+    let jkt: string | null = null;
+    if (workload) {
+      if (dpop === null) return refuse('dpop', 'a DPoP header, a proof signed by the key the session will be bound to, comes with the sign-in');
+      const proof = await verifyProof(dpop, { method: 'POST', url: `${new URL(binding.origin).origin}${WORKLOAD_SIGN_IN_PATH}`, skewSeconds: EXCHANGE_SKEW_SECONDS, now: at });
+      if (!proof.ok) return refuse('dpop', `the DPoP proof does not hold: ${proof.message}`);
+      jkt = proof.jkt;
+      if (input.credential.jkt !== jkt) return refuse('dpop', 'the session is bound to the key its DPoP proof is signed by, no other');
+    } else if (dpop !== null) {
+      return refuse('malformed', 'a CI run\'s sign-in takes no DPoP proof');
+    }
+    // The token the vault verifies itself only on keys its binding's seal digests: it fetches none (Lifecycle.tla's Fetched).
+    if (!binding.jwksUri.startsWith(UPLOADED_KEYS)) {
+      if (idToken !== null) return refuse('malformed', 'a binding of keys its issuer publishes takes the app\'s word for its token, which the vault does not verify');
+      return input;
+    }
+    if (idToken === null) return refuse('malformed', 'a sign-in through a binding of uploaded keys comes with its token, for the vault to verify');
+    let proven: RunProof;
+    try {
+      const run = { profile: binding.profile as WorkloadProfile, issuer: binding.issuer, origin: binding.origin, jwksUri: binding.jwksUri, jwks: idToken.jwks, claims: binding.claims, policy: binding.policy };
+      proven = await verifyRunToken(idToken.token, run, { now: new Date(at), workload: jkt === null ? null : { jkt } });
+    } catch (error) {
+      if (error instanceof RunProofRefused) return refuse(error.reason, error.message, error.kid);
+      throw error;
+    }
+    if (workload && proven.notAfter !== null && input.credential.notAfter !== null && input.credential.notAfter > proven.notAfter) {
+      return refuse('expired', 'the session ends no later than the token it was signed in with');
+    }
+    return {
+      ...input,
+      spent: proven.spent === null ? null : proven.spent.toString('base64'),
+      validUntil: proven.validUntil,
+      record: { ...input.record, issuer: binding.issuer, run: proven.run },
+    };
+  }
+
+  /**
+   * A token issued by the vault (credentials.ts, T149 PR 2; formal/Lifecycle.tla's
+   * IssueRead, IssueRows): what it is weighed on read, the issuer and the
+   * account in one snapshot and the credential the request came in on
+   * beside it, each row checked as `access` checks it; the issue weighed
+   * with the app's own rules on those reads (`weighIssue`); then one
+   * statement that holds the rows as read, and the seal wait. Nothing is
+   * held between the read and the statement. A row that moved in between
+   * (IssuerCAS) has it read and weighed again, as the model's IssueCheck
+   * does, up to three times; then `moved`, and the app asks again.
+   */
+  async issueToken(input: IssueTokenInput): Promise<IssueTokenOutcome> {
+    const log015 = this.#log015();
+    await this.#settled();
+    await this.#cutOverYet();
+    const scope = checkIssue(input);
+    for (let tries = 0; ; tries += 1) {
+      const outcome = await this.#issueOnce(log015, input, scope);
+      if (outcome.ok || outcome.refused !== 'moved' || tries === 2) return outcome;
+    }
+  }
+
+  async #issueOnce(log015: NonNullable<PreparedVault['log015']>, input: IssueTokenInput, scope: CredentialScope): Promise<IssueTokenOutcome> {
+    const read = await this.#issuerRead(log015, { ...input, scope, service: input.credential.kind === 'service' });
+    if ('refused' in read) return read;
+    const why = weighIssue(input, scope, read.holder, read.places, read.via?.columns ?? null, read.issue.at, read.service);
+    if (why !== null) {
+      await this.#record(read.reports);
+      return { ok: false, refused: 'refused', why };
+    }
+    await this.#record(read.reports);
+    const answer = await issueToken(this.#db, issueCall(log015, input, read.issue));
+    if (answer.number == null) return { ok: false, refused: answer.state === 'expired' ? 'refused' : answer.state as IssueTokenRefusal, ...(answer.state === 'expired' ? { why: 'its end is past' } : {}) };
+    const sealedAt = await log015.sealThrough(BigInt(answer.number));
+    return { ok: true, number: answer.number, witnessed: sealedAt.witnessed ?? null };
+  }
+
+  /**
+   * What a grant to `principal` by `actor` is weighed on, read and checked
+   * as `access` checks each row (a token's issue, PR 2; a binding's, PR 3a):
+   * the members, their grants, the policy, a service's setting and the
+   * places in one snapshot, the credential the request came in on beside it;
+   * then the issuer's standing through that credential, the account's, and
+   * the scope's places. A refusal records what the reads reported; else the
+   * caller records them before it writes.
+   */
+  async #issuerRead(
+    log015: NonNullable<PreparedVault['log015']>,
+    input: Pick<IssueTokenInput, 'actor' | 'via' | 'principal' | 'generation' | 'actorAccess' | 'policy'> & { scope: CredentialScope; service: boolean },
+  ): Promise<{ ok: false; refused: IssueTokenRefusal; why?: string } | {
+    issue: IssueRead; holder: Holdings; places: (Place | null)[]; via: Awaited<ReturnType<typeof store.issuingCredential>>;
+    service: { setting: ServiceSetting | null; account: ServiceAccount } | null; reports: NewEntry[];
+  }> {
+    const { actor, principal, scope } = input;
+    const environmentIds = [...new Set([
+      ...scope.flatMap((grant) => (grant.environmentId == null ? [] : [grant.environmentId])),
+      ...input.policy.protected.map(({ environmentId }) => environmentId),
+    ])];
+    const reports: NewEntry[] = [];
+    // The members, their grants, the policy, the setting and the places in one statement; the credential beside it.
+    const [reads, via] = await Promise.all([
+      snapshot(this.#db, { principals: [...new Set([actor, principal])], members: true, settings: input.service, environments: environmentIds, seals: this.#checksPlaces() }),
+      input.via === null ? Promise.resolve(null) : store.issuingCredential(this.#db, input.via),
+    ]);
+    // The settings from the snapshot's newest entry; the pages before it read only when it fails its check.
+    const settings = input.service ? await this.#settingsAt(this.#db, reports, reads) : null;
+    const at = this.#at(reads);
+    const refuse = async (refused: IssueTokenRefusal, why?: string) => {
+      await this.#record(reports);
+      return { ok: false as const, refused, ...(why === undefined ? {} : { why }) };
+    };
+    // Each environment read, as 0.15's log holds its row (T159): a protected one that is not stays protected, its slug
+    // unknown, as `access` answers it (`#livePolicy`); one the scope names refuses the issue; a member's grant on one
+    // holds nothing (`#standing`), and the account's refuses whoever manages it (`#account`).
+    const faulty = new Set([...reads.environments].flatMap(([id, row]) => (this.#placeFault(id, row, reports) === null ? [] : [id])));
+    // The policy the app weighed the scope on, as `policyStill` holds a write to it: one moved since says so, first.
+    const newestPolicy = reads.newestPolicy === null ? null : String(reads.newestPolicy.seq);
+    const renamed = input.policy.protected.some(({ environmentId, slug }) => {
+      const environment = reads.environments.get(environmentId);
+      return (environment === undefined || faulty.has(environmentId) || environment.deleted ? null : environment.slug) !== slug;
+    });
+    if (newestPolicy !== input.policy.seq || renamed) return refuse('policy');
+    const actorRow = reads.members.get(actor);
+    const acting = await this.#standing(this.#db, actor, actorRow, at, reports, reads);
+    if (acting.status !== 'active' || actorRow === undefined) return refuse('ended');
+    if (input.actorAccess !== null && actorRow.accessSeq.toString() !== input.actorAccess) return refuse('access');
+    // The credential the request came in on: the log's (its seal the vault's, and its object's newest change's), live, its issuer's.
+    let viaScope: CredentialScope | null = null;
+    if (input.via !== null) {
+      if (via === null) return refuse('ended');
+      // One 0.14 made, which the log never held, has nothing the vault can authenticate: the app issues on it as before.
+      if (via.seal === null && via.newest === null) return refuse('unlogged');
+      const object = credentialObject(via.columns);
+      const logged = via.seal !== null && via.newest !== null && via.newest.equals(via.seal) && sealedObject(log015.seals, { kind: 'credential', id: input.via }, object, via.seal);
+      if (!logged || via.columns.principal !== actor || via.columns.revoked || (via.columns.expiresAt ?? Infinity) <= at || via.columns.generation !== actorRow.generation) {
+        return refuse('ended');
+      }
+      viaScope = object.scope;
+    }
+    const caller = actor.startsWith('user:') ? 'person' as const : via?.columns.kind === 'workload' ? 'workload' as const : 'bearer' as const;
+    const holder = through(acting, { credentialScope: viaScope, caller }).live;
+    const principalRow = reads.members.get(principal);
+    const subject = principal === actor ? acting : await this.#standing(this.#db, principal, principalRow, at, reports, reads);
+    if (subject.status !== 'active' || principalRow === undefined || principalRow.generation !== input.generation) {
+      return refuse(principal === actor ? 'ended' : 'gone');
+    }
+    if (scope.some((grant) => grant.environmentId != null && faulty.has(grant.environmentId))) return refuse('refused', TAMPERED_PLACE);
+    // Each place by its environment's slug, which scopes match: one deleted, or of another project, is no place. The
+    // protected ones' slugs are held to the policy under the issue lock (`issue_token`), but those whose rows are not as
+    // the log holds them, which it weighed with none: no slug moves that.
+    const places = scope.map((grant): Place | null => {
+      if (grant.environmentId == null) return { projectId: grant.projectId! };
+      const environment = reads.environments.get(grant.environmentId);
+      return environment === undefined || environment.deleted || environment.projectId !== grant.projectId
+        ? null
+        : { projectId: grant.projectId!, environmentId: grant.environmentId, environmentSlug: environment.slug };
+    });
+    let service: { setting: ServiceSetting | null; account: ServiceAccount } | null = null;
+    try {
+      if (settings !== null) service = { setting: settings.serviceAccounts, account: await this.#account(this.#db, subject, principalRow, reads, reports) };
+    } catch (error) {
+      if (error instanceof Refused) return refuse('refused', error.refusal.message);
+      throw error;
+    }
+    return {
+      holder, places, via, service, reports,
+      issue: {
+        at,
+        actor: { generation: actorRow.generation, accessSeq: actorRow.accessSeq },
+        principal: { generation: principalRow.generation, accessSeq: principalRow.accessSeq },
+        via: via === null ? null : { columns: via.columns, seal: via.seal },
+        // The protected environments' slugs, and the scope's as weighed: none moves before the number (Fable on PR 2).
+        slugs: weighed([
+          ...input.policy.protected.filter(({ environmentId }) => !faulty.has(environmentId)),
+          ...places.flatMap((place) => (place?.environmentId == null ? [] : [{ environmentId: place.environmentId, slug: place.environmentSlug ?? null }])),
+          // The places of the account's grants, by whose slugs `#account` weighed who manages it (review r2).
+          ...(service === null ? [] : subject.live.grants.flatMap((grant) => {
+            const row = grant.environmentId === null ? undefined : reads.environments.get(grant.environmentId);
+            return row === undefined ? [] : [{ environmentId: grant.environmentId!, slug: row.deleted ? null : row.slug }];
+          })),
+        ]),
+      },
+    };
+  }
+
+
+  /**
+   * A service's bindings changed by the vault (credentials.ts, T149 PR 3a;
+   * formal/Lifecycle.tla's bind, as an issue, and unbind): a binding made is
+   * weighed as a service token's issue is, on the same reads (`#issuerRead`,
+   * `weighService`), and those it ends, with every credential they issued,
+   * must be the log's (their seals the vault's). One statement, which holds
+   * all of it as read (`change_bindings`), then the seal wait. A row that
+   * moved meanwhile answers `moved`: the app reads again, as the rows it
+   * ends are its reads.
+   */
+  async changeBindings(input: ChangeBindingsInput): Promise<ChangeBindingsOutcome> {
+    const log015 = this.#log015();
+    await this.#settled();
+    await this.#cutOverYet();
+    checkChangeBindings(input);
+    const { actor, make } = input;
+    let read: IssueRead | null = null;
+    let reports: NewEntry[] = [];
+    if (make !== null) {
+      const scope = readScope(make.scope);
+      if (scope === null || scope.length === 0) throw new Error('a binding made reaches what its scope names, at least one place');
+      const weighed = await this.#issuerRead(log015, {
+        actor, via: input.via, principal: make.principal, generation: make.generation, actorAccess: input.actorAccess, policy: input.policy, scope, service: true,
+      });
+      if ('refused' in weighed) return weighed;
+      const why = make.createdBy !== actor.slice(actor.indexOf(':') + 1) ? 'a binding names who made it, its maker'
+        : weighed.places.some((place) => place === null) ? 'a place the binding names is no longer there'
+        : weighService(actor, make.principal, scope, weighed.holder, weighed.places as Place[], weighed.service);
+      if (why !== null) {
+        await this.#record(weighed.reports);
+        return { ok: false, refused: 'refused', why };
+      }
+      read = weighed.issue;
+      reports = weighed.reports;
+    }
+    const call = bindingsCall(log015, input, read?.at ?? Date.now() + this.#prepared.options.clockOffset(), read);
+    await this.#record(reports);
+    if ('refused' in call) return { ok: false, refused: call.refused };
+    const answer = await changeBindings(this.#db, call);
+    if (answer.number == null) return { ok: false, refused: answer.state as ChangeBindingsRefusal };
+    // Only rows the log never held were ended: no change of the log's to wait for.
+    if (answer.number === '0') return { ok: true, number: '0', witnessed: null };
+    const sealedAt = await log015.sealThrough(BigInt(answer.number));
+    return { ok: true, number: answer.number, witnessed: sealedAt.witnessed ?? null };
+  }
+
+  /** Once entry `number` is sealed and witnessed, or its witnesses past their 2 s (R51): what a change the app made waits for. */
+  async waitSealed(input: { number: string }): Promise<Outcome<{ witnessed: boolean | null }>> {
+    const log015 = this.#log015();
+    if (typeof input?.number !== 'string' || !/^[1-9][0-9]{0,18}$/.test(input.number)) throw new Error('waitSealed takes an entry\'s number, in decimal');
+    const sealed = await log015.sealThrough(BigInt(input.number));
+    return { ok: true, witnessed: sealed.witnessed ?? null };
+  }
+
+  /**
+   * 0.15's log checked (verifier.ts): the newest pair and every entry above
+   * it, held to the pairs held outside. With 0.14's log alone, there is
+   * none to check. The signer remembers a pair before the database has it
+   * (RememberFirst), so a check that lands in between finds the database
+   * behind (`Verdict.behind`): it is checked again 50 ms later, then a
+   * tick later (reviews r4, r5). A rollback is still behind then.
+   */
+  /** Whether 0.15's checkpointer seals (T169): what `/readyz` asks. Under 0.14's log alone, nothing waits on one. */
+  async sealing(): Promise<Sealing> {
+    const log015 = this.#prepared.log015;
+    if (log015 === null) return { ok: true };
+    try {
+      return await log015.sealing();
+    } catch (error) {
+      return { ok: false, reason: (error as Error).message };
+    }
+  }
+
+  async verifyTrees(): Promise<TreeVerification> {
+    await this.#settled();
+    if (this.#prepared.log015 === null) return { kept: false };
+    const anchors = await this.#prepared.log015.heldOutside();
+    const keys = await this.#verifierKeys();
+    const walk = () => verifyTrees(this.#db, keys, { anchors });
+    let walked = await walk();
+    // The signer's write lands a moment after it remembers: asked again soon, then once more a tick later, for a write
+    // that failed and is made again at the next tick (PR 8 review r5).
+    for (const wait of [50, TICK_MS + 250]) {
+      if (!walked.behind) break;
+      await new Promise((resolve) => setTimeout(resolve, wait));
+      walked = await walk();
+    }
+    // What crosses to the app: the verdict, never the retry's signal.
+    const { behind: _behind, ...verdict } = walked;
+    return verdict;
+  }
+
+  /**
+   * The entries of 0.15's log, as an audit page read them, whose MAC holds
+   * under none of the vault's signing keys over the columns it shows (T166):
+   * forged, or edited, around coffre. A malformed one is named too. Pure
+   * CPU: about 3 µs an entry, `VOUCHED_AT_ONCE` at most.
+   */
+  async vouch(input: VouchInput): Promise<{ forged: string[] }> {
+    const entries: unknown = (input as { entries?: unknown } | undefined)?.entries;
+    if (!Array.isArray(entries) || entries.length > VOUCHED_AT_ONCE) throw new Error(`vouch takes up to ${VOUCHED_AT_ONCE} entries`);
+    const macs = (this.#prepared.vouchKeys ??= this.#config.signingKeys.map((seed) => logMacKey(seed)));
+    return {
+      forged: entries.flatMap((entry: VouchedEntry) => {
+        const named = typeof entry?.number === 'string' ? entry.number : '?';
+        if (entry?.tree === 'cursor') {
+          const at = typeof entry.through === 'string' && /^[0-9]{1,19}$/.test(entry.through) && typeof entry.pair === 'string' && /^[0-9]{1,19}$/.test(entry.pair) && Number.isSafeInteger(entry.at);
+          const mac = entry.mac === null ? null : typeof entry.mac === 'string' && /^[0-9a-f]{32}$/.test(entry.mac) ? Buffer.from(entry.mac, 'hex') : undefined;
+          const cursor = at && mac !== undefined ? { through: BigInt(entry.through), pair: BigInt(entry.pair), at: entry.at, mac } : null;
+          return cursor !== null && macs.some((key) => cursorHolds(key, cursor)) ? [] : [named];
+        }
+        if (entry?.tree === 'reads') {
+          const read = vouchedRead(entry);
+          return read !== null && macs.some((key) => readHolds(key, read)) ? [] : [named];
+        }
+        const logged = vouchedEntry(entry as Exclude<VouchedEntry, { tree: 'reads' | 'cursor' }>);
+        return logged !== null && macs.some((key) => authentic(key)(logged)) ? [] : [named];
+      }),
+    };
+  }
+
+  /**
+   * A stretch of the reads' check (reads.ts, `checkReads`): from `start`, or
+   * a stretch's `next` (a pair's number), in a snapshot of its own. Flat:
+   * a checkpoint's range, whatever the log's length.
+   */
+  async verifyReads(input: { from: string }): Promise<ReadsVerification> {
+    await this.#settled();
+    if (this.#prepared.log015 === null) return { kept: false };
+    const from = (input as { from?: unknown } | undefined)?.from;
+    const at = typeof from === 'string' ? /^(?:start|([0-9]{1,19}))$/.exec(from) : null;
+    if (at === null) throw new Error('verifyReads starts at start, or at a stretch\'s next');
+    const keys = await this.#verifierKeys();
+    const checked = await this.#db.transaction((tx) => checkReads(logStore(tx as unknown as Database), keys, at[1] === undefined ? 0n : BigInt(at[1])), SNAPSHOT);
+    return {
+      kept: true,
+      ok: checked.problems.length === 0,
+      problems: checked.problems,
+      through: String(checked.through),
+      listed: String(checked.listed),
+      next: checked.next === null ? null : String(checked.next),
+    };
+  }
+
+  async #verifierKeys(): Promise<VerifierKeys> {
+    return (this.#prepared.verifier ??= await verifierKeys(this.#config.signingKeys));
+  }
+
+  #log015(): NonNullable<PreparedVault['log015']> {
+    const log015 = this.#prepared.log015;
+    if (log015 === null) throw new Error("this vault keeps 0.14's log: the app writes its rows as 0.14 does (`about().log`)");
+    return log015;
   }
 
   async keyChecks(): Promise<KeyChecks> {
@@ -3077,6 +4252,9 @@ class VaultService implements Vault {
 
 type Broken = Extract<LogVerification, { ok: false }>;
 
+/** 0.14's chain as the cutover walked it from its newest checkpoint, outside any transaction (`#walkOn`). */
+type Walked = { from: Resumed; tally: Tally; digest: string; at: Position };
+
 /**
  * Where a walk of the log resumes: the checkpoint's entry (null for the
  * first entry), the end of the prefix it signed, the tally through there,
@@ -3468,10 +4646,6 @@ function accessEntry(
   };
 }
 
-function live(grant: GrantRow, at: number): boolean {
-  return grant.expiresAt === null || grant.expiresAt > at;
-}
-
 /**
  * Where an entry about a grant says it is: its project and environment; or,
  * for a grant on every project of 0.4, neither, and the place as a path in
@@ -3497,67 +4671,10 @@ function placeKey(place: store.Place): string {
   return place.projectId !== null ? `project:${place.projectId}` : `every-project:${place.environmentSlug ?? ''}`;
 }
 
-/** A member's instance role, as their row has it: service accounts are members, whatever a row says. */
-function roleOf(principal: string, row: Member): { role: InstanceRole; scope: Scope } {
-  return principal.startsWith('user:') ? { role: row.role, scope: row.scope } : { role: 'member', scope: EVERYWHERE };
-}
-
-function view(grant: GrantRow): Grant {
-  return {
-    projectId: grant.projectId,
-    environmentId: grant.environmentId,
-    role: grant.role as Role,
-    expiresAt: grant.expiresAt === null ? null : iso(grant.expiresAt),
-    grantedAt: iso(grant.grantedAt),
-    grantedBy: grant.grantedBy,
-  };
-}
-
 function iso(ms: number): string {
   return new Date(ms).toISOString();
 }
 
-/** A policy entry's edits, checked as the vault wrote them, or null for any that does not hold. */
-function readEdits(stored: { policy?: unknown }): PolicyEdits | null {
-  const edits = stored.policy as Partial<PolicyEdits> | undefined;
-  if (typeof edits !== 'object' || edits === null) return null;
-  const { roles, instanceRoles, protected: protectedIds } = edits;
-  if (typeof roles !== 'object' || roles === null || typeof instanceRoles !== 'object' || instanceRoles === null || !Array.isArray(protectedIds)) return null;
-  const defined = (table: object) => Object.values(table).every((definition) => definitionProblem(definition as RoleDefinition) === null);
-  if (!defined(roles) || !defined(instanceRoles) || Object.keys(instanceRoles).some((role) => !isInstanceRole(role))) return null;
-  if (protectedIds.some((place) => typeof place !== 'object' || place === null || !UUID.test((place as ProtectedPlace).projectId) || !UUID.test((place as ProtectedPlace).environmentId)
-    || !Number.isSafeInteger((place as ProtectedPlace).at))) return null;
-  return { roles: roles as Record<string, RoleDefinition>, instanceRoles: instanceRoles as PolicyEdits['instanceRoles'], protected: protectedIds as ProtectedPlace[] };
-}
-
-/**
- * The policy `edits` say as of `at`: the roles as they ship, each edited
- * one replaced and each made one added; and the protected environments, but
- * for those deleted since, the project around one's included: a deleted
- * prod protects nothing, and holds nobody back from giving a service
- * account a role on all of its project (`givesService`). A fork's id with
- * no row yet stays, protected before it is written, ten minutes: one with
- * none after that is a fork refused or abandoned, never written. Each
- * keeps its slug, which a scoped instance role's filters read. The edits
- * keep them all: no write is needed.
- */
-function livePolicy(rows: ReadonlyMap<string, store.EnvironmentRow>, edits: PolicyEdits, at: number): Policy {
-  const live = edits.protected.filter((place) => {
-    const row = rows.get(place.environmentId);
-    return row === undefined ? at - place.at < UNWRITTEN_FORK_MS : !row.deleted;
-  });
-  const slugOf = (place: ProtectedPlace) => rows.get(place.environmentId)?.slug ?? null;
-  return {
-    roles: { ...ROLES, ...edits.roles },
-    instanceRoles: { ...INSTANCE_ROLES, ...edits.instanceRoles },
-    protected: live.map((place) => place.environmentId),
-    protectedIn: live.reduce<Record<string, { environmentId: string; slug: string | null }[]>>(
-      (byProject, place) => ({ ...byProject, [place.projectId]: [...(byProject[place.projectId] ?? []), { environmentId: place.environmentId, slug: slugOf(place) }] }),
-      {},
-    ),
-  };
-}
-
 /** A change, as its entry names it. */
 function describeChange(change: PolicyChange | undefined): Record<string, unknown> | null {
   if (change === undefined || change === null || typeof change !== 'object') return null;
@@ -3599,3 +4716,32 @@ function serialisable(wrapped: { kekProvider: string; kekId: string; kekVersion:
 function base64(bytes: Uint8Array): string {
   return Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength).toString('base64');
 }
+
+/** An entry as `vouch` was given it, as the trees take it; null for one of no shape a row has. */
+function vouchedEntry(entry: Exclude<VouchedEntry, { tree: 'reads' | 'cursor' }>): LogEntry | null {
+  const hex = (value: unknown) => (typeof value === 'string' && /^(?:[0-9a-f]{2})*$/.test(value) ? Buffer.from(value, 'hex') : null);
+  const text = (value: unknown) => typeof value === 'string';
+  if (typeof entry !== 'object' || entry === null || !text(entry.number) || !/^[0-9]{1,19}$/.test(entry.number) || !Number.isSafeInteger(entry.at) || !text(entry.requestId)) return null;
+  const mac = hex(entry.mac);
+  if (mac === null) return null;
+  const number = BigInt(entry.number);
+  if (entry.tree === 'changes') {
+    const seal = entry.seal === null ? null : hex(entry.seal);
+    if (!text(entry.object) || !text(entry.actor) || !text(entry.payload) || (entry.seal !== null && seal === null)) return null;
+    return changeEntry({ number, at: entry.at, requestId: entry.requestId, object: entry.object, actor: entry.actor, payload: entry.payload, seal, mac });
+  }
+  if (entry.tree !== 'uses' || !/^[0-9]{1,19}$/.test(entry.requestId) || !text(entry.credential) || !text(entry.secret) || !Number.isSafeInteger(entry.purpose)
+    || (entry.place !== null && !text(entry.place))) return null;
+  return usedEntry({ number, at: entry.at, requestId: BigInt(entry.requestId), credential: entry.credential, secret: entry.secret, purpose: entry.purpose, place: entry.place, mac });
+}
+
+/** A read as `vouch` was given it (`log_reads`, T166); null for one of no shape the projector writes. */
+function vouchedRead(entry: Extract<VouchedEntry, { tree: 'reads' }>): ReadRow | null {
+  const id = (value: unknown) => typeof value === 'string' && value.length > 0;
+  const maybe = (value: unknown): value is string | null => value === null || id(value);
+  const mac = typeof entry.mac === 'string' && /^[0-9a-f]{32}$/.test(entry.mac) ? Buffer.from(entry.mac, 'hex') : null;
+  if (mac === null || typeof entry.number !== 'string' || !/^[0-9]{1,19}$/.test(entry.number) || !Number.isSafeInteger(entry.at) || !Number.isSafeInteger(entry.purpose)
+    || !id(entry.credential) || !id(entry.principal) || !id(entry.secret) || !id(entry.environment) || !id(entry.project)
+    || !maybe(entry.place) || !maybe(entry.source) || !maybe(entry.sourceEnvironment) || !maybe(entry.sourceProject) || !maybe(entry.version)) return null;
+  return { ...entry, number: BigInt(entry.number), mac };
+}