@coffre/vault 0.9.0 → 0.10.1

package/src/vault.ts

@@ -3,25 +3,39 @@ import { randomUUID, timingSafeEqual } from 'node:crypto';
 import {
   allows,
   assignableToEnvironment,
+  DEFAULT_POLICY,
+  definitionProblem,
+  EVERY_ENVIRONMENT,
   EVERYWHERE,
+  FIXED_ROLES,
   givesService,
+  guarded,
   grantKind,
+  INSTANCE_ROLES,
+  isBuiltinRole,
   isCredentialScope,
   isInstanceRole,
   isRole,
   isScope,
   managesService,
   mayManageAccess,
+  normalDefinition,
   normalScope,
   NOTHING,
   ownsInstance,
+  PROJECT_ONLY_PERMISSIONS,
+  ROLE_ID,
+  ROLES,
   runsInstance,
   setsUpServices,
+  UNWRITTEN_FORK_MS,
   type Holdings,
   type InstanceRole,
   type Permission,
   type Place,
+  type Policy,
   type Role,
+  type RoleDefinition,
   type Scope,
   type ServiceAccount,
   withinCredential,
@@ -46,11 +60,14 @@ import {
   checkpointMessage,
   checkpointVerifier,
   describeAccessFault,
-  HANDED_BACK,
+  handsBack,
+  POLICY_REVISION,
+  policyRevision,
   type Access,
   type AccessChange,
   type AccessFault,
   type AdmitInput,
+  type ChangePolicyInput,
   type Admitted,
   type Checkpoint,
   type CheckpointKey,
@@ -61,6 +78,7 @@ import {
   type LogHead,
   type LogVerification,
   type Outcome,
+  type PolicyChange,
   type Purpose,
   type ReferenceInput,
   type Refusal,
@@ -73,6 +91,7 @@ import {
   type Settings,
   type Through,
   type UnwrapInput,
+  type Wrapped,
   type Vault,
   type Via,
   type VerifyLogInput,
@@ -80,17 +99,17 @@ import {
   type WrappedKey,
 } from '@coffre/core/vault';
 import type { Database, Queryable, Transaction } from '@coffre/db';
-import { isUniqueViolation, SNAPSHOT } from '@coffre/db/dialect';
+import { isUniqueViolation, isUnreachable, SNAPSHOT } from '@coffre/db/dialect';
 import { everyProjectConversion, newestAccess, reportStands } from '@coffre/db/grants';
-import { appendEntries, LOOK_BACK, lockLogHead, newestAuthentic, type Appended, type Authenticity, type Newest, type NewEntry } from '@coffre/db/log';
+import { appendEntries, lockLogHead, missingEntry, newestAuthentic, newestVaultSeq, type Appended, type Authenticity, type Newest, type NewEntry } from '@coffre/db/log';
 
-import { KeyAccounting } from './accounting.ts';
 import { signer, type Signer } from './checkpoint.ts';
 import type { ResolvedVaultConfig } from './config.ts';
-import { carries, forward, further, UNVERIFIED, vaultLogKey, VERIFY_BATCH, verifyChain, withCause, type Anchor } from './log.ts';
+import { carries, further, ownEntries, rehash, relink, START, vaultLogKey, VERIFY_BATCH, withCause, type Position } from './log.ts';
 import { apply, replayFault, type LoggedMember, type Replayed } from './replay.ts';
 import { memberMac, rowKey, sameGrants, sealed, standing } from './rows.ts';
 import * as store from './store.ts';
+import { accessDigest, CHECKPOINT, EMPTY_TALLY, expectedKey, TALLY_VERSION, Walk, type AccessTally, type Expected, type TalliedCheckpoint, type Tally } from './tally.ts';
 import { ACCESS_ACTIONS, type GrantRow, type Member } from './store.ts';
 
 export type VaultOptions = {
@@ -101,6 +120,8 @@ export type VaultOptions = {
   keyBudgetMs?: number;
   /** Milliseconds added to the database's clock where the vault decides by it. Tests move time with it. */
   clockOffset?: () => number;
+  /** How far one call walks the log (`WALKS`); tests shorten them. */
+  walks?: Partial<Walks>;
 };
 
 /**
@@ -121,9 +142,9 @@ export type PreparedVault = {
   logKey: LogKey;
   /** Each signing key's log key: those after the first verify only entries before `since`. */
   logKeys: LogKey[];
-  options: Required<VaultOptions>;
-  /** How far the log is verified; `verifyChain` in log.ts. The furthest any call got to. */
-  verified: Anchor;
+  options: Required<Omit<VaultOptions, 'walks'>> & { walks: Walks };
+  /** How far the chain is rehashed, by any call of this process: its head must still be there. */
+  verified: Position;
   /** What member rows are sealed under now; rows.ts. */
   rowKey: Buffer;
   /** Each signing key's row key: those after the first vouch for rows only until `since`, when the rows are sealed again. */
@@ -150,8 +171,8 @@ export async function prepareVault(config: ResolvedVaultConfig, options: VaultOp
   return {
     config,
     ...(await keysOf(config.signingKeys)),
-    options: { keyBudgetMs: options.keyBudgetMs ?? KEY_BUDGET_MS, clockOffset: options.clockOffset ?? (() => 0) },
-    verified: UNVERIFIED,
+    options: { keyBudgetMs: options.keyBudgetMs ?? KEY_BUDGET_MS, clockOffset: options.clockOffset ?? (() => 0), walks: { ...WALKS, ...options.walks } },
+    verified: START,
     reported: new Set(),
     since: null,
     superseded: null,
@@ -208,15 +229,48 @@ const UNSEALED = { accessSeq: 0n, mac: Buffer.alloc(32) };
 /** Why a change to a tampered member is refused. */
 const TAMPERED_SUBJECT = "this member's record failed the vault's integrity check: remove them to start over";
 
-/** The action of the vault's entry that signs a prefix of the log. */
-const CHECKPOINT = 'audit.checkpoint';
-
 /** The action of the vault's entry that holds the instance's settings, and changes them (`settings`). */
 const SETTINGS = 'settings.change';
 
 /** The settings before anyone changed them: people set up service accounts anywhere they hold access. */
 const DEFAULT_SETTINGS: Settings = { serviceAccounts: EVERYWHERE };
 
+/** The action of the vault's entry that holds the instance's access policy, and changes it (`policy`). */
+const POLICY = 'policy.change';
+
+/**
+ * What a `policy.change` entry keeps: the roles an Owner edited or made,
+ * each whole, and the protected environments. A role as it ships is kept by
+ * none, so a release that changes a default changes it where nobody edited it.
+ */
+type PolicyEdits = { roles: Record<string, RoleDefinition>; instanceRoles: Partial<Record<InstanceRole, RoleDefinition>>; protected: ProtectedPlace[] };
+
+/**
+ * A protected environment, with its project's id, what a grant on the whole
+ * project reaches of it, and when it was protected, by the vault's clock:
+ * an id with no row ten minutes later is a fork that was never written.
+ */
+type ProtectedPlace = { projectId: string; environmentId: string; at: number };
+
+
+const NO_EDITS: PolicyEdits = { roles: {}, instanceRoles: {}, protected: [] };
+
+/** A role holding nothing, which every role but Owner is under the closed policy. */
+const NOTHING_HELD = (definition: RoleDefinition): RoleDefinition => ({ ...definition, permissions: [], protected: [] });
+
+/**
+ * The policy when the log has some, but none the vault wrote within reach:
+ * whoever inserted rows may have hidden an Owner's narrowing, so no role
+ * holds anything, a service account's neither, but Owner, which holds
+ * everything always and so may write the policy again.
+ */
+const CLOSED_POLICY: Policy = {
+  roles: Object.fromEntries(Object.entries(ROLES).map(([id, definition]) => [id, id === 'owner' ? definition : NOTHING_HELD(definition)])),
+  instanceRoles: Object.fromEntries(Object.entries(INSTANCE_ROLES).map(([id, definition]) => [id, id === 'owner' ? definition : NOTHING_HELD(definition)])) as Policy['instanceRoles'],
+  protected: [EVERY_ENVIRONMENT],
+  protectedIn: {},
+};
+
 /** The settings when the log has some, but none the vault wrote within reach: people set up no service accounts. */
 const CLOSED_SETTINGS: Settings = { serviceAccounts: { projects: { only: [] }, environments: 'all' } };
 
@@ -234,13 +288,6 @@ const NOT_THEIRS = 'a person gives a service account at most what they hold, whe
 /** Who asks for checkpoints: the app's scheduled job. */
 const SCHEDULER = 'system:coffre-scheduler';
 
-/**
- * How often a checkpoint recomputes the chain from its first entry: the
- * first of each hour, by the vault's clock. The others resume from the
- * prefix the last one signed (`#recompute`).
- */
-const FULL_RECOMPUTE_MS = 60 * 60 * 1000;
-
 /** A refusal and the entries that record it. */
 class Refused {
   readonly refusal: Refusal;
@@ -269,6 +316,9 @@ class Outage {
   }
 }
 
+/** A rewrap that would make a value less sensitive than it is. */
+const LOOSER = 'a value is made less sensitive only by writing it again: an old version comes back, and a key is made stricter, as sensitive as its newest version or more';
+
 function refusal(code: RefusalCode, message: string): Refusal {
   return { code, message };
 }
@@ -283,10 +333,11 @@ const MESSAGES: Record<RefusalCode, string> = {
   deleted: 'this project or environment was deleted',
   ended: 'the reference read through was ended',
   personal: "a personal config's values are its owner's alone",
-  stand_ins: "people use this instance's values through stand-ins, never as values: `coffre run` gives your app them; a service account reads values",
+  sensitive: "a sensitive value is never shown to anyone, Owners included: `coffre run` gives your app a placeholder for it through the credential proxy, and a service account reads it",
   not_allowed: 'not allowed to change this',
   last_owner: 'the last Owner of the whole instance stays one: make someone else an Owner first',
   invalid: 'not something the rules allow',
+  policy_changed: "the instance's roles or protected environments changed while this was asked: try again",
   log_broken: 'the vault log does not hold from the last checkpoint',
   wrong_kek: "this vault's key does not open the data it holds",
   tampered: "this member's record failed the vault's integrity check",
@@ -398,23 +449,29 @@ class VaultService implements Vault {
   }
 
   /**
-   * Decide in one transaction, with `principals`' rows locked first. A
-   * `Refused` or an `Outage` rolls back all but its own entries, which
-   * commit on their own: then the refusal is the answer, and the outage
-   * fails the call.
+   * Decide in one transaction, with `principals`' rows locked first, then
+   * the log's head. A `Refused` or an `Outage` rolls back all but its own
+   * entries, which commit on their own: then the refusal is the answer, and
+   * the outage fails the call.
+   *
+   * Every change to the policy, the settings, a member or a place appends
+   * under the head, so whatever the decision reads of them stands until it
+   * commits: no decision acts on a policy read before it. A key operation
+   * alone takes the head later (`late`), once its key service has answered,
+   * which it must not wait on holding it, and decides again then (`#keys`).
    */
-  async #decide<T>(principals: readonly string[], decide: (d: Decision) => Promise<T>): Promise<Outcome<T>> {
+  async #decide<T>(principals: readonly string[], decide: (d: Decision) => Promise<T>, late = false): Promise<Outcome<T>> {
     const superseded = await this.#settled();
     if (superseded !== null) return { ok: false, refusal: refusal('wrong_kek', superseded) };
-    return this.#decideNow(principals, decide);
+    return this.#decideNow(principals, decide, late);
   }
 
   /** `#decide`, once the vault is settled. */
-  async #decideNow<T>(principals: readonly string[], decide: (d: Decision) => Promise<T>): Promise<Outcome<T>> {
+  async #decideNow<T>(principals: readonly string[], decide: (d: Decision) => Promise<T>, late = false): Promise<Outcome<T>> {
     const reports: NewEntry[] = [];
     for (let attempt = 1; ; attempt += 1) {
       try {
-        return await this.#decideOnce(principals, decide, reports);
+        return await this.#decideOnce(principals, decide, reports, late);
       } catch (error) {
         // A member who had no row when this decision locked theirs, and has
         // one now: another decision admitted them meanwhile. Again, with it.
@@ -424,11 +481,13 @@ class VaultService implements Vault {
     }
   }
 
-  async #decideOnce<T>(principals: readonly string[], decide: (d: Decision) => Promise<T>, reports: NewEntry[]): Promise<Outcome<T>> {
+  async #decideOnce<T>(principals: readonly string[], decide: (d: Decision) => Promise<T>, reports: NewEntry[], late: boolean): Promise<Outcome<T>> {
     try {
       const result = await this.#db.transaction(async (tx) => {
         await store.boundLockWaits(tx, LOCK_TIMEOUT_MS);
         const members = principals.length === 0 ? new Map<string, Member>() : await store.lockMembers(tx, principals);
+        if (!late) await lockLogHead(tx);
+        // The clock once the locks are held, in a statement of its own: one that waited for a lock is decided as of when it got it.
         const d: Decision = {
           tx, members, at: await this.#now(tx), log: [], writes: [], touched: new Set(), grants: new Map(), reports, after: [], underLock: [],
         };
@@ -529,9 +588,13 @@ class VaultService implements Vault {
 
   /** Whether `entry` carries the vault's MAC: under any of its keys before `since`, and only its current one from there. */
   #authentic(entry: StoredEntry): boolean {
+    return verifyEntries([entry], { startSeq: entry.seq, startPrevHash: entry.prevHash, keys: this.#keysFor(entry) }).ok;
+  }
+
+  /** The vault's log keys an entry may be under: any of them before `since`, and only its current one from there. */
+  #keysFor(entry: StoredEntry): LogKey[] {
     const { logKeys, since } = this.#prepared;
-    const keys = since !== null && entry.seq >= since ? logKeys.slice(0, 1) : logKeys;
-    return verifyEntries([entry], { startSeq: entry.seq, startPrevHash: entry.prevHash, keys }).ok;
+    return since !== null && entry.seq >= since ? logKeys.slice(0, 1) : logKeys;
   }
 
   /**
@@ -630,7 +693,6 @@ class VaultService implements Vault {
     if (everyProject.length === 0) return;
     if (await reportStands(d.tx, principal, this.#check(d.reports, principal))) return;
     // The projects there are now, read under the log's head, which a deletion holds.
-    await lockLogHead(d.tx);
     const before = roleOf(principal, row);
     const conversion = everyProjectConversion(principal, before.role, subject.stored, d.at, await store.liveProjects(d.tx));
     const after = { role: conversion.role, scope: conversion.scope };
@@ -790,6 +852,7 @@ class VaultService implements Vault {
   async unwrap(input: UnwrapInput): Promise<Outcome<{ keys: string[] }>> {
     const { principal } = input;
     validateText(input.purpose);
+    if (input.keepsSensitive !== undefined && typeof input.keepsSensitive !== 'boolean') throw new Error('keepsSensitive is true, false or absent');
     const vias = input.items.map((item) => validateVia(item.via));
     const throughs = input.items.map((item) => validateThrough(item.through));
     const loaded = await this.#versions(input, 'secret.read', { purpose: input.purpose });
@@ -838,7 +901,8 @@ class VaultService implements Vault {
       {
         action: 'secret.read',
         principal,
-        permission: 'secret.read',
+        // The proxy's use opens a value for coffre to use for its reader, never to hand back: `secret.use`. Anything else reads.
+        permission: input.purpose === 'use' ? 'secret.use' : 'secret.read',
         secrets: items.map((item) => item.secret),
         // Through a reference, the reader's grants on the holder's environment decide.
         places: sealed.map((seal, i) => seal?.holder ?? items[i]!.secret),
@@ -867,7 +931,7 @@ class VaultService implements Vault {
     );
   }
 
-  async wrap(input: WrapInput): Promise<Outcome<{ wrapped: WrappedKey[]; seqs: number[] }>> {
+  async wrap(input: WrapInput): Promise<Outcome<Wrapped>> {
     const { principal, items } = input;
     validateItems(items, 'key');
     validateText(principal);
@@ -893,11 +957,11 @@ class VaultService implements Vault {
             dek.fill(0);
           }
         }),
-      (done) => ({ wrapped: done.map(({ wrapped }) => wrapped), seqs: [] as number[] }),
+      (done) => ({ wrapped: done.map(({ wrapped }) => wrapped), seqs: [] as number[], sensitive: items.map(({ secret }) => secret.sensitive === true) }),
     );
   }
 
-  async rewrap(input: RewrapInput): Promise<Outcome<{ wrapped: WrappedKey[]; seqs: number[] }>> {
+  async rewrap(input: RewrapInput): Promise<Outcome<Wrapped>> {
     const { principal } = input;
     const loaded = await this.#versions(input, 'key.rewrap');
     if (!loaded.ok) return loaded;
@@ -911,6 +975,13 @@ class VaultService implements Vault {
         ...keyEntry('key.rewrap', principal, source.secret, 'deny', 'bad_claim', input), secretVersionId: source.id,
       })));
     }
+    // A value is made looser only by writing it again: a sensitive version's key, or one of a secret whose newest is,
+    // is never wrapped again as anything but sensitive, so that a person who may not read it never makes it readable.
+    if (items.some((item, i) => item.secret.sensitive !== true && (loaded.versions[i].secret.sensitive || loaded.versions[i].newestSensitive))) {
+      return this.#refuseVersions(principal, 'invalid', loaded.versions.map((source) => ({
+        ...keyEntry('key.rewrap', principal, source.secret, 'deny', 'invalid', input), secretVersionId: source.id,
+      })), LOOSER);
+    }
     const sources = new Map(items.map((item, i) => [item.secret, loaded.versions[i]]));
     const entry = (secret: SecretRef, decision: 'allow' | 'deny', code: string | null): NewEntry => ({
       ...keyEntry('key.rewrap', principal, secret, decision, code, input, { from: sources.get(secret)!.secret.version }),
@@ -919,10 +990,26 @@ class VaultService implements Vault {
     const remote =
       this.#remote(this.#config.keks.primary) || items.some(({ wrapped }) => this.#remote(this.#config.keks.providerOf(wrapped)));
     return this.#keys(
-      { action: 'key.rewrap', principal, permission: 'secret.write', secrets: items.map((item) => item.secret), remote, entry, input },
+      {
+        action: 'key.rewrap', principal, permission: 'secret.write', secrets: items.map((item) => item.secret), remote, entry, input,
+        // Again in the decision and under the log's head: a sensitive version written since it was loaded is as newest as any.
+        vet: async (db) => {
+          const newest = await store.newestSensitive(db, items.map(({ secret }) => secret.secretId));
+          return items.map(({ secret }) => (secret.sensitive !== true && newest.has(secret.secretId) ? 'invalid' : null));
+        },
+        // An old value brought back, not the current one, is made live by whoever could have read it: a secret by its
+        // readers, a sensitive one, which nobody reads, by those who use it, a plain one by any writer, as it was shown
+        // to them. Whatever reads the key next, a reference to it included, then reads what its restorer could. Typing a
+        // value, or tightening the current one, takes no more than writing.
+        needs: async (db) => {
+          const restored = await store.restoredNatures(db, items.map(({ secret }) => ({ secretId: secret.secretId, from: sources.get(secret)!.id })));
+          return restored.map((nature) => (nature === 'secret' ? ['secret.read'] as const : nature === 'sensitive' ? ['secret.use'] as const : null));
+        },
+      },
       (contextOf) =>
         items.map(({ secret, wrapped }) => async (operation: KeyOperation) => {
-          const key = await this.#open(wrapped, contextOf(secret), operation);
+          // Opened as the source was written, sensitive or not, and wrapped as the new version is.
+          const key = await this.#open(wrapped, contextOf(sources.get(secret)!.secret), operation);
           if (key === null) return null;
           try {
             return { wrapped: serialisable(await this.#config.keks.wrap(key, contextOf(secret), operation)), wipe: () => {} };
@@ -930,7 +1017,7 @@ class VaultService implements Vault {
             key.fill(0);
           }
         }),
-      (done) => ({ wrapped: done.map(({ wrapped }) => wrapped), seqs: [] as number[] }),
+      (done) => ({ wrapped: done.map(({ wrapped }) => wrapped), seqs: [] as number[], sensitive: items.map(({ secret }) => secret.sensitive === true) }),
     );
   }
 
@@ -968,9 +1055,9 @@ class VaultService implements Vault {
     return { ok: true, versions: ids.map((id) => found.get(id)!) };
   }
 
-  async #refuseVersions(principal: string, code: 'bad_claim' | 'deleted', entries: NewEntry[]): Promise<Outcome<never>> {
+  async #refuseVersions(principal: string, code: 'bad_claim' | 'deleted' | 'invalid', entries: NewEntry[], message = MESSAGES[code]): Promise<Outcome<never>> {
     return this.#decide([principal], async () => {
-      throw new Refused(refusal(code, MESSAGES[code]), entries);
+      throw new Refused(refusal(code, message), entries);
     });
   }
 
@@ -1013,9 +1100,14 @@ class VaultService implements Vault {
        * once the log's head is locked, before its entries append.
        */
       vet?: (db: Queryable) => Promise<(RefusalCode | null)[]>;
+      /**
+       * Any one of which each secret takes besides `permission`, where it
+       * is, read in the decision and again under the head; none for null.
+       */
+      needs?: (db: Queryable) => Promise<(readonly Permission[] | null)[]>;
       remote: boolean;
       entry: (secret: SecretRef, decision: 'allow' | 'deny', code: string | null) => NewEntry;
-      input: Correlation & Through & { purpose?: string };
+      input: Correlation & Through & { purpose?: string; keepsSensitive?: boolean };
     },
     /**
      * One per secret; null for a bad claim, an error for an outage or an
@@ -1048,17 +1140,35 @@ class VaultService implements Vault {
       const gone = (place: SecretPlace) => environments.get(place.environmentId)?.deleted ?? false;
       owners.clear();
       for (const [id, environment] of environments) if (environment.owner !== null) owners.set(id, ownerKey(environment.owner));
+      const needs = call.needs === undefined ? [] : await call.needs(d.tx);
       const codes: (RefusalCode | null)[] = secrets.map((secret, i) => {
         const personal = personalRefusal(reader, principal, call.permission, secret, at[i]!, environments);
         if (personal !== undefined) return personal;
+        const also = needs[i];
+        if (also != null) {
+          const place = placeIn(at[i]!, environments);
+          const refused = also.map((permission) => refuses(reader, permission, place, gone(secret) || gone(at[i]!)));
+          if (refused.every((code) => code !== null)) return refused[0]!;
+        }
+        // Through a reference, the holder's grants decide, its source's never: a reference takes its value and nature
+        // (a sensitive one stays use-only) from its source, and its permissions from where it lives. Its maker held what
+        // the source's nature asks when it was made (`reference`).
         return refuses(reader, call.permission, placeIn(at[i]!, environments), gone(secret) || gone(at[i]!));
       });
       if (call.vet !== undefined && !codes.some((code) => code !== null)) {
         (await call.vet(d.tx)).forEach((code, i) => (codes[i] = code));
       }
+      // A sensitive value is only ever used for a person, never handed back, by whatever credential of theirs asks. And
+      // a fork copies one, for anyone, a service account too, only where its app says it keeps it sensitive: an app of
+      // 0.9, mid-deploy, would write the copy as a secret its people read.
+      const copying = action === 'secret.read' && call.input.purpose === 'copy';
+      const handedBack = action === 'secret.read' && principal.startsWith('user:') && handsBack({ purpose: call.input.purpose ?? '', keepsSensitive: call.input.keepsSensitive === true });
+      if (handedBack || (copying && call.input.keepsSensitive !== true)) {
+        secrets.forEach((secret, i) => {
+          if (codes[i] === null && secret.sensitive === true) codes[i] = 'sensitive';
+        });
+      }
       let first = codes.find((code) => code !== null) ?? null;
-      // A person's values are only ever used for them, where people get stand-ins: by whatever credential of theirs asks.
-      if (first === null && action === 'secret.read' && this.#config.people === 'stand-ins' && principal.startsWith('user:') && HANDED_BACK.includes(call.input.purpose as Purpose)) first = 'stand_ins';
       if (first === null && action === 'secret.read' && (await this.#overBulkLimit(d, principal, secrets.length))) first = 'bulk_limit';
       if (first !== null) {
         throw new Refused(
@@ -1087,7 +1197,6 @@ class VaultService implements Vault {
     if (call.remote) {
       const intent = await this.#decide([principal], async (d) => {
         await check(d);
-        await lockLogHead(d.tx);
         const at = await this.#now(d.tx);
         const appended = await this.#append(d.tx, [{
           actor: principal,
@@ -1111,7 +1220,12 @@ class VaultService implements Vault {
       intentSeq = intent.seq;
     }
 
-    return this.#decide([principal], async (d) => {
+    // Under the reader's row: the check, the key operations, and their outcome. With a key in memory, under the
+    // log's head too, from the start (`#decideOnce`): what the check read stands until the commit, as every change it
+    // reads appends under the head, and the head waits on nothing slow. With a key service, which nothing may wait on
+    // holding the head, the head is taken once the keys are open, and what the check read is read again under it.
+    const late = call.remote;
+    const decided = async (d: Decision) => {
       try {
         await check(d);
       } catch (error) {
@@ -1121,9 +1235,12 @@ class VaultService implements Vault {
         }
         throw error;
       }
+    };
+    return this.#decide([principal], async (d) => {
+      await decided(d);
       // A reference ended while this decided refuses it, rather than a read logged after its end.
       const { vet } = call;
-      if (vet !== undefined) {
+      if (late && vet !== undefined) {
         d.underLock.push(async (locked) => {
           const codes = await vet(locked);
           const first = codes.find((code) => code !== null);
@@ -1150,15 +1267,20 @@ class VaultService implements Vault {
         if (done.length < outcomes.length) {
           throw new Refused(refusal('bad_claim', MESSAGES.bad_claim), entries());
         }
-        // Again under the log's head, the append's, taken a statement early: a
-        // deletion renames its place under it, so one that committed since the
-        // check above is seen here, and nothing is released after it.
-        // A read through a reference: its holder's place too, which a deletion may have taken.
-        await lockLogHead(d.tx);
-        const places = secrets.flatMap((secret, i) => [secret, call.places?.[i] ?? secret]);
-        const now = await store.environmentsById(d.tx, places.map((place) => place.environmentId));
-        if (places.some((place) => now.get(place.environmentId)?.deleted ?? false)) {
-          throw new Refused(refusal('deleted', MESSAGES.deleted), secrets.map((secret, i) => outcomeEntry(secret, i, 'deny', 'deleted')));
+        if (late) {
+          // Again under the log's head, the append's, taken a statement early: a
+          // deletion renames its place under it, so one that committed since the
+          // check above is seen here, and nothing is released after it.
+          // A read through a reference: its holder's place too, which a deletion may have taken.
+          await lockLogHead(d.tx);
+          // And as the policy is now, under the head every change to it takes: an environment protected, or a role narrowed,
+          // since the check above is seen here, and nothing it refuses now is released.
+          await decided(d);
+          const places = secrets.flatMap((secret, i) => [secret, call.places?.[i] ?? secret]);
+          const now = await store.environmentsById(d.tx, places.map((place) => place.environmentId));
+          if (places.some((place) => now.get(place.environmentId)?.deleted ?? false)) {
+            throw new Refused(refusal('deleted', MESSAGES.deleted), secrets.map((secret, i) => outcomeEntry(secret, i, 'deny', 'deleted')));
+          }
         }
         const released = secrets.map((secret, i) => outcomeEntry(secret, i, 'allow', null));
         d.log.push(...released);
@@ -1169,7 +1291,7 @@ class VaultService implements Vault {
       } finally {
         for (const value of done) value.wipe();
       }
-    });
+    }, late);
   }
 
   /** Whether `n` more keys would take `principal` past the bulk limit; counted under their row's lock, so exactly. */
@@ -1225,7 +1347,11 @@ class VaultService implements Vault {
       };
     };
     return this.#decide([principal], async (d) => {
+      // Under the log's head, which a deletion and every change to the policy take: neither side deleted, nor protected,
+      // nor a role narrowed, before this commits.
       const reader = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports), input);
+      // Each source's nature, its current version's, under the head: what its maker must hold there.
+      const natures = await store.natures(d.tx, [...sources.values()].map((source) => source.secretId));
       // Both sides as the store has them: a grant on a slug matches there, and neither side may be deleted.
       const environments = await store.environmentsById(d.tx, items.flatMap((item) => {
         const source = sources.get(item.source.secretId);
@@ -1238,17 +1364,15 @@ class VaultService implements Vault {
         if (source.secretId === item.holder.secretId) return 'invalid';
         // A personal config's values are bound to its owner: no reference holds one, nor reads one.
         if (environments.get(item.holder.environmentId)?.owner != null || environments.get(source.environmentId)?.owner != null) return 'personal';
+        // Making one hands its source's value to whoever reads the holder, whatever its nature becomes: its maker reads
+        // it at the source, as any direct access there, and, for a sensitive one, which nobody reads, uses it there too.
+        const at = placeIn(source, environments);
         return refuses(reader, 'secret.write', placeIn(item.holder, environments), gone(item.holder))
-          ?? refuses(reader, 'secret.read', placeIn(source, environments), gone(source));
+          ?? refuses(reader, 'secret.read', at, gone(source))
+          ?? (natures.get(source.secretId) === 'sensitive' ? refuses(reader, 'secret.use', at, gone(source)) : null);
       });
       const first = codes.find((code) => code !== null) ?? null;
       if (first !== null) throw new Refused(refusal(first, MESSAGES[first]), items.map((item, i) => entry(item, 'deny', codes[i] ?? first)));
-      // Again under the log's head, as a read is: neither side was deleted since the check above.
-      d.underLock.push(async (locked) => {
-        const now = await store.environmentsById(locked, [...environments.keys()]);
-        if (![...now.values()].some((environment) => environment.deleted)) return;
-        throw new Refused(refusal('deleted', MESSAGES.deleted), items.map((item) => entry(item, 'deny', 'deleted')));
-      });
       const entries = items.map((item) => entry(item, 'allow', null));
       d.log.push(...entries);
       const answer = { seqs: [] as number[] };
@@ -1311,6 +1435,7 @@ class VaultService implements Vault {
       return seals.map((seal) => (done.has(seal.seq) ? ('ended' as const) : null));
     };
     return this.#decide([principal], async (d) => {
+      // Under the log's head: two ends of one reference at once, the second finds the first; and the actor's standing stands.
       const actor = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports), input);
       // Ending is allowed in a deleted place: deleting one ends the references into and out of it.
       const environments = await store.environmentsById(d.tx, seals.map((seal) => seal.holder.environmentId));
@@ -1326,11 +1451,6 @@ class VaultService implements Vault {
       if (!codes.some((code) => code !== null)) (await ended(d.tx)).forEach((code, i) => (codes[i] = code));
       const first = codes.find((code) => code !== null) ?? null;
       if (first !== null) throw new Refused(refusal(first, MESSAGES[first]), vias.map((via, i) => entry(via, seals[i]!, 'deny', codes[i] ?? first)));
-      // Two ends of one reference at once: the second finds the first under the head's lock.
-      d.underLock.push(async (locked) => {
-        if ((await ended(locked)).every((code) => code === null)) return;
-        throw new Refused(refusal('ended', MESSAGES.ended), vias.map((via, i) => entry(via, seals[i]!, 'deny', 'ended')));
-      });
       const entries = vias.map((via, i) => entry(via, seals[i]!, 'allow', null));
       d.log.push(...entries);
       const answer = { seqs: [] as number[] };
@@ -1412,11 +1532,11 @@ class VaultService implements Vault {
   /**
    * Refuse a change that would leave `principal`, an Owner of the whole
    * instance, no longer one, unless another is. Counted under the log's
-   * head: two changes at once, each demoting or removing a different
-   * Owner, lock different rows, and only the head puts one after the other.
+   * head, which every decision holds: two changes at once, each demoting or
+   * removing a different Owner, lock different rows, and only the head puts
+   * one after the other.
    */
   async #keepAnOwner(d: Decision, actor: string, principal: string, refused: (code: RefusalCode, message?: string) => Refused): Promise<void> {
-    await lockLogHead(d.tx);
     if ((await this.#anOwner(d.tx, d.reports, principal)) !== null) return;
     throw refused('last_owner', actor === principal
       ? "you're the last Owner of the whole instance: make someone else an Owner first"
@@ -1473,17 +1593,20 @@ class VaultService implements Vault {
     if (row?.status !== 'active') return { principal, status: row?.status ?? 'unknown', live: none, all: none, fault, stored: grants };
     const held = grants.map((grant) => ({ ...grant, role: grant.role as Role }));
     const { role, scope } = roleOf(principal, row);
+    // Every decision about them reads the policy: their roles as an Owner edited them, and which environments are protected.
+    const { policy } = await this.#policyAt(db, reports, at);
+    const service = !principal.startsWith('user:');
     return {
       principal,
       status: 'active',
-      live: { role, scope, grants: held.filter((grant) => live(grant, at)) },
-      all: { role, scope, grants: held },
+      live: { role, scope, grants: held.filter((grant) => live(grant, at)), policy, service },
+      all: { role, scope, grants: held, policy, service },
       fault,
       stored: grants,
     };
   }
 
-  #access(principal: string, row: Member | undefined, held: readonly GrantRow[], at: number, tampered: boolean): Access {
+  #access(principal: string, row: Member | undefined, held: readonly GrantRow[], at: number, tampered: boolean, policy: Policy): Access {
     const active = PRINCIPAL.test(principal) && !tampered && row?.status === 'active';
     return {
       principal,
@@ -1493,6 +1616,7 @@ class VaultService implements Vault {
       grants: active ? held.filter((grant) => live(grant, at) && grantKind(grant) !== null).map(view) : [],
       since: row ? iso(row.statusChangedAt) : null,
       by: row?.statusChangedBy ?? null,
+      policy,
     };
   }
 
@@ -1520,7 +1644,8 @@ class VaultService implements Vault {
     const read = async (db: Queryable, reports: NewEntry[]) => {
       const [row, held, at] = await Promise.all([store.member(db, principal), store.grants(db, principal), this.#now(db)]);
       const fault = await this.#integrity(db, principal, row, held, reports);
-      return this.#access(principal, row, held, at, fault !== null);
+      const { policy } = await this.#policyAt(db, reports, at);
+      return this.#access(principal, row, held, at, fault !== null, policy);
     };
     const found: NewEntry[] = [];
     const quick = await read(this.#db, found).catch((error: unknown) => {
@@ -1588,10 +1713,7 @@ class VaultService implements Vault {
         const key = placeKey(change);
         if (places.has(key)) throw refused('invalid', 'each place may be changed once per call');
         places.add(key);
-        if (change.role !== null && !isRole(change.role)) throw refused('invalid', `no such role: ${change.role}`);
-        if (change.role !== null && change.environmentId !== null && !assignableToEnvironment(change.role)) {
-          throw refused('invalid', `${change.role} can only be granted on a project`);
-        }
+        if (change.role !== null && typeof change.role !== 'string') throw refused('invalid', `no such role: ${String(change.role)}`);
         const expiresAt = change.expiresAt === null ? null : Date.parse(change.expiresAt);
         if (Number.isNaN(expiresAt) || (expiresAt !== null && expiresAt <= d.at)) {
           throw refused('invalid', 'an end date must be in the future');
@@ -1600,7 +1722,15 @@ class VaultService implements Vault {
       // A project or an environment must be there, and to be granted, not
       // deleted. Read under the log's head, which a deletion holds while it
       // renames the place, so the place is as it commits.
-      await lockLogHead(d.tx);
+      // The roles as the policy defines them now, under the head every change to it takes: a role an Owner made is
+      // granted as one that ships, and one deleted meanwhile is granted by nobody.
+      const { policy } = await this.#policyAt(d.tx, d.reports, d.at);
+      for (const change of changes) {
+        if (change.role !== null && !isRole(change.role, policy)) throw refused('invalid', `no such role: ${change.role}`);
+        if (change.role !== null && change.environmentId !== null && !assignableToEnvironment(change.role, policy)) {
+          throw refused('invalid', `${change.role} can only be granted on a project`);
+        }
+      }
       const known = await store.places(
         d.tx,
         changes.map((change) => change.projectId!),
@@ -1922,7 +2052,7 @@ class VaultService implements Vault {
    */
   async #settingsAt(db: Queryable, reports: NewEntry[]): Promise<Settings> {
     const entry = await newestAuthentic(
-      (before) => store.newestVaultEntries(db, SETTINGS, LOOK_BACK.page, before),
+      (limit, before) => store.newestVaultEntries(db, SETTINGS, limit, before),
       this.#check(reports, null),
     );
     if (entry === 'none') return DEFAULT_SETTINGS;
@@ -1931,6 +2061,143 @@ class VaultService implements Vault {
     return isScope(serviceAccounts) ? { serviceAccounts } : CLOSED_SETTINGS;
   }
 
+  // --- the instance's access policy -------------------------------------------
+
+  async policy(): Promise<Policy> {
+    await this.#settled();
+    const reports: NewEntry[] = [];
+    const { policy } = await this.#policyAt(this.#db, reports, await this.#now(this.#db));
+    await this.#record(reports);
+    return policy;
+  }
+
+  /**
+   * The policy the vault's newest `policy.change` says, by its MAC, and its
+   * edits, as of `at`: one in its name it did not write is passed over, and
+   * reported. With such entries and none of its own within reach, the
+   * policy is unreadable, and closed: every environment is protected, and
+   * no role holds anything but Owner, otherwise whoever can insert rows
+   * could unprotect them. Its edits are then unknown, not none.
+   */
+  async #policyAt(db: Queryable, reports: NewEntry[], at: number): Promise<{ policy: Policy; edits: PolicyEdits; readable: boolean }> {
+    const entry = await newestAuthentic(
+      (limit, before) => store.newestVaultEntries(db, POLICY, limit, before),
+      this.#check(reports, null),
+    );
+    if (entry === 'none') return { policy: DEFAULT_POLICY, edits: NO_EDITS, readable: true };
+    const edits = typeof entry === 'string' ? null : readEdits(JSON.parse(entry.metadata) as { policy?: unknown });
+    return edits === null ? { policy: CLOSED_POLICY, edits: NO_EDITS, readable: false } : { policy: await livePolicy(db, edits, at), edits, readable: true };
+  }
+
+  changePolicy(input: ChangePolicyInput): Promise<Outcome<{ policy: Policy; seq: number | null }>> {
+    const { actor, change, revision } = input;
+    if (revision !== undefined && (typeof revision !== 'string' || !POLICY_REVISION.test(revision))) throw new Error('revision names a policy as policyRevision writes it');
+    // Where a protection is, once its rows are found: its project, and its one environment if that has a row yet. A fork's,
+    // protected before its row is written, is named by the change alone, as the log's columns name only rows.
+    const at: { projectId?: string; environmentId?: string } = {};
+    const entry = (decision: 'allow' | 'deny', detail: Record<string, unknown>, code: RefusalCode | null = null): NewEntry => ({
+      actor,
+      action: POLICY,
+      decision,
+      code,
+      operationId: input.operationId ?? null,
+      requestId: input.requestId ?? null,
+      ...at,
+      metadata: JSON.stringify({ ...detail, ...traced(input) }),
+    });
+    const refused = (code: RefusalCode, message = MESSAGES[code]) =>
+      new Refused(refusal(code, message), [entry('deny', { change: describeChange(change) }, code)]);
+    return this.#decide([actor], async (d) => {
+      validateCorrelation(input);
+      const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports), input);
+      if (acting.status === 'tampered') throw refused('tampered');
+      if (acting.status !== 'active') throw refused(acting.status === 'removed' ? 'removed' : 'not_a_member');
+      // Under the log's head, as the actor's standing above: two changes at once each start from the one before. One the
+      // caller weighed from a revision of the policy, its newest change and its protected environments' rows, starts
+      // from that one, or is refused, to be asked again: a protected prod renamed since is a policy changed too.
+      const newest = await newestVaultSeq(d.tx, POLICY);
+      const { policy: before, edits, readable } = await this.#policyAt(d.tx, d.reports, d.at);
+      if (revision !== undefined && policyRevision(newest, before) !== revision) throw refused('policy_changed');
+      const owner = acting.live.credentialScope == null && ownsInstance(acting.live);
+      // Unreadable, its edits are unknown: a change made from none would erase every protection and role edit the forged
+      // rows hide. An Owner of the whole instance alone writes it again, from the roles as they ship and nothing protected.
+      if (!readable && !owner) throw refused('not_allowed', "the vault cannot read its own policy: only an Owner of the whole instance writes it again, from the roles as they ship");
+      // Those the policy no longer holds stay out: a deleted environment's id, and an unwritten fork's past its window,
+      // neither of which comes back, the window being one a fork writes its row well within.
+      const next: PolicyEdits = {
+        roles: { ...edits.roles },
+        instanceRoles: { ...edits.instanceRoles },
+        protected: edits.protected.filter((place) => before.protected.includes(place.environmentId)).map((place) => ({ ...place })),
+      };
+      if (change?.kind === 'role' || change?.kind === 'instance-role') {
+        // Roles are the whole instance's: an Owner of all of it alone changes them (R1, R15), never through a scoped credential.
+        if (!owner) throw refused('not_allowed', 'only an Owner of the whole instance edits roles');
+        const instance = change.kind === 'instance-role';
+        const fixed = instance ? FIXED_ROLES.instanceRoles.includes(change.role as InstanceRole) : FIXED_ROLES.roles.includes(change.role);
+        if (typeof change.role !== 'string' || fixed) throw refused('invalid', `${change.role} is not edited: it holds ${change.role === 'member' ? 'nothing' : 'everything'}, always`);
+        if (instance && !isInstanceRole(change.role)) throw refused('invalid', `no instance role ${change.role}: an Owner makes project roles`);
+        if (!instance && !isBuiltinRole(change.role) && !ROLE_ID.test(change.role)) throw refused('invalid', 'a role is named by lowercase letters, digits and dashes, 2 to 32, starting with a letter');
+        const table = instance ? next.instanceRoles as Record<string, RoleDefinition> : next.roles;
+        if (change.definition === null) {
+          // Put back as it ships, or, one an Owner made, gone: while no grant names it.
+          if (!instance && !isBuiltinRole(change.role)) {
+            if (table[change.role] === undefined) throw refused('invalid', `no role ${change.role}`);
+            const held = await store.grantsNaming(d.tx, change.role);
+            if (held > 0) throw refused('invalid', `${held === 1 ? '1 grant names' : `${held} grants name`} ${change.role}: revoke ${held === 1 ? 'it' : 'them'} first`);
+          }
+          // What it ships as is held to the same rule as any edit: a project-wide permission back on a role granted on environments.
+          const shipped = instance ? undefined : isBuiltinRole(change.role) ? ROLES[change.role] : undefined;
+          if (shipped !== undefined && shipped.permissions.some((permission) => PROJECT_ONLY_PERMISSIONS.includes(permission)) && (await store.grantsNaming(d.tx, change.role, { onEnvironments: true })) > 0) {
+            throw refused('invalid', `${change.role} is granted on environments: as it ships, it holds a project-wide permission, which would make those grants incoherent`);
+          }
+          delete table[change.role];
+        } else {
+          const problem = definitionProblem(change.definition);
+          if (problem !== null) throw refused('invalid', problem);
+          const definition = normalDefinition(change.definition);
+          // A project role granted on an environment keeps no project-wide permission while any grant there names it.
+          if (!instance && definition.permissions.some((permission) => PROJECT_ONLY_PERMISSIONS.includes(permission)) && (await store.grantsNaming(d.tx, change.role, { onEnvironments: true })) > 0) {
+            throw refused('invalid', `${change.role} is granted on environments: a project-wide permission would make those grants incoherent`);
+          }
+          const shipped = instance ? INSTANCE_ROLES[change.role as InstanceRole] : isBuiltinRole(change.role) ? ROLES[change.role] : undefined;
+          if (shipped !== undefined && JSON.stringify(normalDefinition(shipped)) === JSON.stringify(definition)) delete table[change.role];
+          else table[change.role] = definition;
+        }
+      } else if (change?.kind === 'protect') {
+        if (typeof change.projectId !== 'string' || !UUID.test(change.projectId) || !Array.isArray(change.environmentIds) || change.environmentIds.length === 0
+          || change.environmentIds.some((id) => typeof id !== 'string' || !UUID.test(id)) || typeof change.protected !== 'boolean') {
+          throw refused('invalid', 'protection names a project and some of its environments, by id, and whether they are protected');
+        }
+        if (!(await store.projectLive(d.tx, change.projectId))) throw refused('invalid', 'no such project');
+        at.projectId = change.projectId;
+        // Each a live environment of the project, or none yet: a fork's id, protected before its row is written.
+        const found = await store.environmentsById(d.tx, change.environmentIds);
+        if ([...found.values()].some((environment) => environment.projectId !== change.projectId)) throw refused('invalid', 'each environment is one of the project\'s');
+        if (change.environmentIds.length === 1 && found.has(change.environmentIds[0]!)) at.environmentId = change.environmentIds[0];
+        if (change.protected) {
+          if (!allows(acting.live, 'environment.manage', { projectId: change.projectId })) throw refused('not_allowed', 'protecting an environment takes managing its project\'s environments');
+          const known = new Set(next.protected.map((place) => place.environmentId));
+          next.protected = [...next.protected, ...change.environmentIds.filter((id) => !known.has(id)).map((environmentId) => ({ projectId: change.projectId, environmentId, at: d.at }))]
+            .sort((a, b) => (a.environmentId < b.environmentId ? -1 : 1));
+        } else {
+          // Unprotecting widens what people hold there: an Owner of the whole instance's to do (R15).
+          if (!owner) throw refused('not_allowed', 'only an Owner of the whole instance unprotects an environment');
+          next.protected = next.protected.filter((place) => !change.environmentIds.includes(place.environmentId));
+        }
+      } else {
+        throw refused('invalid', 'a change is to a role, an instance role, or protection');
+      }
+      // The policy now, and the newest change, which it is as of: this one's, when it changed anything.
+      const answer = { policy: await livePolicy(d.tx, next, d.at), seq: newest === null ? null : Number(newest) };
+      if (!readable || JSON.stringify(next) !== JSON.stringify(edits)) {
+        const made = entry('allow', { policy: next, change: describeChange(change), before: describeBefore(change, before) });
+        d.log.push(made);
+        d.after.push((seqOf) => (answer.seq = seqOf(made)));
+      }
+      return answer;
+    });
+  }
+
   setSettings(input: SetSettingsInput): Promise<Outcome<{ settings: Settings }>> {
     const { actor } = input;
     const entry = (decision: 'allow' | 'deny', detail: Record<string, unknown>, code: RefusalCode | null = null): NewEntry => ({
@@ -1951,7 +2218,6 @@ class VaultService implements Vault {
       if (!runsInstance(acting.live)) throw refused('not_allowed', "only admins and owners of the whole instance change its settings");
       if (!isScope(input.settings?.serviceAccounts)) throw refused('invalid', 'who sets up service accounts is a scope: { projects, environments }, each all, only or except');
       // Under the log's head, so two changes at once each name the one before.
-      await lockLogHead(d.tx);
       const previous = await this.#settingsAt(d.tx, d.reports);
       const settings: Settings = { serviceAccounts: normalScope(input.settings.serviceAccounts) };
       if (JSON.stringify(settings) !== JSON.stringify(previous)) d.log.push(entry('allow', { ...settings, previous }));
@@ -2097,73 +2363,137 @@ class VaultService implements Vault {
 
   // --- checkpoints and the log --------------------------------------------------
 
-  /** The last checkpoint the vault signed, and the entry that holds it: its newest allowed `audit.checkpoint`. */
-  async #latest(db: Queryable): Promise<{ checkpoint: Checkpoint; seq: bigint; keyId: string } | null> {
-    const row = await store.latestVaultEntry(db, [CHECKPOINT]);
-    return row === undefined ? null : { checkpoint: JSON.parse(row.metadata) as Checkpoint, seq: row.seq, keyId: row.keyId };
+  /**
+   * Where a walk of the log resumes: the first entry (`start`), a
+   * checkpoint's entry that keeps a tally, or the newest such entry, the
+   * first entry while there is none. The entry must be the vault's, by its
+   * MAC, and its tally whole: the members and grants it keeps, or the
+   * earlier checkpoint it names keeps, match the digest it carries.
+   *
+   * Its signature is left to the walk: the entry comes after the prefix it
+   * signs, so a walk from there reads it, as it reads every other.
+   */
+  async #resume(db: Queryable, from: 'start' | 'newest' | bigint): Promise<Resumed | Broken> {
+    if (from === 'start') return FIRST_ENTRY;
+    const entry = from === 'newest' ? await store.latestTallied(db) : (await store.entriesAt(db, [from])).get(from);
+    if (entry === undefined) return from === 'newest' ? FIRST_ENTRY : { ok: false, failedAtSeq: Number(from), reason: 'no checkpoint at this entry' };
+    return (await this.#resumeEach(db, [entry]))[0]!;
+  }
+
+  /** `#resume` for each of these checkpoint entries, the entries their members and grants are kept in read at once. */
+  async #resumeEach(db: Queryable, entries: readonly StoredEntry[]): Promise<(Resumed | Broken)[]> {
+    const reads = entries.map((entry) => this.#tallied(entry));
+    const named = reads.flatMap((read) => (typeof read !== 'string' && 'at' in read.tally.access ? [BigInt(read.tally.access.at)] : []));
+    const carriers = new Map([...(await store.entriesAt(db, named))].map(([seq, held]) => [seq, this.#tallied(held)]));
+    return entries.map((entry, i): Resumed | Broken => {
+      const broken = (reason: string): Broken => ({ ok: false, failedAtSeq: Number(entry.seq), reason });
+      const read = reads[i]!;
+      if (typeof read === 'string') return broken(read);
+      let carrier = entry.seq;
+      let { access } = read.tally;
+      if ('at' in access) {
+        carrier = BigInt(access.at);
+        const holder = carrier < entry.seq ? carriers.get(carrier) : undefined;
+        if (holder === undefined || typeof holder === 'string' || 'at' in holder.tally.access) {
+          return broken(`its tally keeps its members and grants in entry ${carrier}, which holds none`);
+        }
+        access = holder.tally.access;
+      }
+      const kept = { members: access.members, grants: access.grants, newest: access.newest };
+      if (keptDigest(access) !== read.tally.access.digest) return broken("its tally's members and grants do not match their digest");
+      return {
+        ok: true,
+        entry: entry.seq,
+        at: { seq: BigInt(read.seq), hash: Buffer.from(read.hash, 'hex') },
+        tally: { ...read.tally, access: kept },
+        digest: read.tally.access.digest,
+        carrier,
+        scrub: read.scrub === null ? null : { at: positionOf(read.scrub.at), end: positionOf(read.scrub.end) },
+      };
+    });
+  }
+
+  /** A checkpoint's entry that keeps a tally, as it says, or why it is not one the vault wrote. */
+  #tallied(entry: StoredEntry): TalliedCheckpoint | string {
+    const not = "not a checkpoint of the vault's that keeps a tally";
+    if (entry.author !== 'vault' || entry.action !== CHECKPOINT || entry.decision !== 'allow' || entry.relatedSeq === null) return not;
+    const authentic = verifyEntries([entry], { startSeq: entry.seq, startPrevHash: entry.prevHash, keys: this.#keysFor(entry) });
+    if (!authentic.ok) return withCause(authentic.reason);
+    const read = metadataOf(entry) as Partial<TalliedCheckpoint> | null;
+    if (read?.tally?.v !== TALLY_VERSION || read.scrub === undefined || typeof read.seq !== 'number' || BigInt(read.seq) !== entry.relatedSeq) return not;
+    return read as TalliedCheckpoint;
+  }
+
+  /** Which of `heads` the log still holds where they were, in one read. */
+  async #holding(db: Queryable, heads: readonly LogHead[]): Promise<(head: LogHead) => boolean> {
+    const hashes = await store.hashesAt(db, [...new Set(heads.filter((head) => head.seq >= 0).map((head) => BigInt(head.seq)))]);
+    return (head) => head.hash === GENESIS_HASH.toString('hex') || hashes.get(BigInt(head.seq))?.toString('hex') === head.hash;
   }
 
   /**
-   * The chain recomputed to its last entry, for a checkpoint to sign: from
-   * its first entry at the first checkpoint of each hour, and otherwise from
-   * the prefix the last checkpoint signed, if that one was signed this hour.
-   *
-   * Resuming never signs what the vault did not recompute. The vault
-   * recomputed the last checkpoint's prefix itself, from entry 0 at the
-   * hour's first checkpoint and onward at each one since, and the entry
-   * that holds it is the first one checked again, by its MAC. The next
-   * signature extends that same chain.
+   * Sign the log up to its last entry, from the newest checkpoint's tally.
    *
-   * What resuming does not do is recompute the rows of that prefix again.
-   * They can change while the hash stored at its end stays, so it first
-   * checks the two things that are cheap: that hash is still there, which a
-   * prefix rewritten and chained again changes, and every entry of the
-   * prefix is, which a cut changes. Either failing, it recomputes from entry
-   * 0, which names what broke. An entry edited in place, its hash left as
-   * it was, is the one change left to the next full pass, within the hour.
+   * In one snapshot, and without the log's lock, so that no append waits on
+   * it: every member's row checked, since rows changed around the vault
+   * write nothing to the log; the prefix the newest checkpoint signed still
+   * there, its hash where it was, which a rewrite chained again changes, and
+   * every entry of it, which a cut changes; the chain recomputed from there,
+   * every hash from content and every vault entry by its MAC, no further
+   * than one walk (`walks.checkpoint`); and a stretch of the prefixes signed
+   * before rehashed (`#scrub`). Then, under the lock, the entries appended
+   * since the snapshot, so that it signs the head.
    *
-   * It resumes only from a checkpoint under the key the vault writes with
-   * now: once the log reaches that key, no other writes again (`forward`).
-   * After a rotation, the next pass is full.
+   * A walk cut short signs where it got to, behind the head: the log after
+   * an upgrade from 0.10.0, whose checkpoints kept no tally, is signed again
+   * from the first entry, one walk a call, and `/readyz` stays red until the
+   * checkpoints reach the newest heartbeat.
    */
-  async #recompute(tx: Queryable): Promise<{ verification: LogVerification; anchor: Anchor }> {
-    const { logKeys } = this.#prepared;
-    const latest = await this.#latest(tx);
-    const hour = (ms: number) => Math.floor(ms / FULL_RECOMPUTE_MS);
-    const resumable =
-      latest !== null &&
-      latest.keyId === logKeys[0].keyId &&
-      latest.seq === BigInt(latest.checkpoint.seq) + 1n &&
-      hour(Date.parse(latest.checkpoint.signedAt)) === hour(await this.#now(tx)) &&
-      (await carries(tx, latest.checkpoint)) &&
-      (await store.complete(tx, BigInt(latest.checkpoint.seq)));
-    if (!resumable) return verifyChain(tx, logKeys, [], UNVERIFIED);
-    const { seq, hash } = latest.checkpoint;
-    const signed: Anchor = { nextSeq: BigInt(seq) + 1n, hash: Buffer.from(hash, 'hex'), vaultEntries: 0, vaultKeys: [logKeys[0].keyId] };
-    return verifyChain(tx, logKeys, [], signed);
-  }
-
-  async checkpoint(): Promise<Outcome<{ checkpoint: Checkpoint }>> {
+  async checkpoint(): Promise<Outcome<{ checkpoint: Checkpoint; warning?: string }>> {
     await this.#settled();
     // A KEK found wrong turns readiness red: the checkpoint is refused. It does no key work of its
     // own, so it writes nothing more and never waits on a key service; a check under way, or none yet, is no verdict.
-    const { wrongKek } = this.#prepared;
-    // Then, in one snapshot and without the log's lock, so that no append
-    // waits on it: every member's row checked, since rows changed around the
-    // vault write nothing to the log; and the chain recomputed, every hash
-    // from content and every vault entry by its MAC, from the first entry
-    // once an hour, since an entry cut from the middle leaves the hashes
-    // around a later checkpoint as they were (`#recompute`).
+    const { wrongKek, logKeys } = this.#prepared;
+    const { walks } = this.#prepared.options;
     const found: NewEntry[] = [];
-    const whole = await this.#db.transaction(async (tx) => {
+    // The newest checkpoint entry, signed or refused, as this call's snapshot found it.
+    let seen: bigint | null = null;
+    const walked = await this.#db.transaction(async (tx) => {
+      seen = (await store.newestCheckpointEntry(tx))?.seq ?? null;
       await this.#sweep(tx, found);
-      return this.#recompute(tx);
+      const from = await this.#resume(tx, 'newest');
+      if (!from.ok) return from;
+      const signed = headOf(from.at);
+      if (!(await this.#holding(tx, [signed]))(signed)) {
+        return { ok: false as const, failedAtSeq: null, reason: `the log up to entry ${signed.seq} is not the prefix the last checkpoint signed` };
+      }
+      const gap = await missingEntry(tx, from.at.seq);
+      if (gap !== null) return { ok: false as const, failedAtSeq: Number(gap.found), reason: `sequence gap: expected seq ${gap.expected}, found ${gap.found}` };
+      const walk = new Walk(from.tally, from.digest);
+      const chain = await rehash(tx, logKeys, from.at, walk, { limit: walks.checkpoint });
+      if (!chain.ok) return chain;
+      const unsigned = await this.#checkpointFault(tx, walk.checkpoints);
+      if (unsigned !== null) return unsigned;
+      return { ok: true as const, from, tally: walk.tally(), digest: walk.digest(), at: chain.at, done: chain.done };
     }, SNAPSHOT);
+    // The past rehashed, in a snapshot of its own. The database failing it leaves the stretch for the
+    // next call, where it was, and the checkpoint is signed all the same, saying why (`warning`); a bug
+    // throws, as anywhere else.
+    let scrub: Scrubbed = { ok: true, next: walked.ok ? walked.from.scrub : null };
+    let stalled: string | null = null;
+    if (walked.ok) {
+      try {
+        scrub = await this.#db.transaction((tx) => this.#scrub(tx, walked.from), SNAPSHOT);
+      } catch (error) {
+        // Only the database not answering, or a statement it gave up on: anything else is coffre's to fix.
+        if (!isUnreachable(error) && !timedOut(error)) throw error;
+        stalled = `the rehash of the past did not run, and goes on where it was next time: ${(error as Error).message}`;
+      }
+    }
     return this.#decide([], async (d) => {
       for (const entry of found) if (!d.reports.includes(entry)) d.reports.push(entry);
       // Checkpoints one at a time, each against the one before.
       const head = await lockLogHead(d.tx);
-      const latest = await this.#latest(d.tx);
+      const latest = await store.latestVaultEntry(d.tx, [CHECKPOINT]);
       const refused = (code: RefusalCode, detail: Record<string, unknown>, message = MESSAGES[code]) =>
         new Refused(refusal(code, message), [
           { actor: SCHEDULER, action: CHECKPOINT, decision: 'deny', code, metadata: JSON.stringify(detail) },
@@ -2171,33 +2501,104 @@ class VaultService implements Vault {
       // Logging the refusal would give the next call something to sign.
       if (head.nextSeq === 0n) throw new Refused(refusal('invalid', 'the log is empty'), []);
       if (wrongKek !== null) throw refused('wrong_kek', { reason: wrongKek }, wrongKek);
-      if (!whole.verification.ok) {
-        throw refused('log_broken', { failedAtSeq: whole.verification.failedAtSeq, reason: whole.verification.reason });
+      if (!walked.ok) throw refused('log_broken', { failedAtSeq: walked.failedAtSeq, reason: walked.reason });
+      if (!scrub.ok) throw refused('log_broken', { failedAtSeq: scrub.failedAtSeq, reason: scrub.reason });
+      const newest = latest === undefined ? null : (JSON.parse(latest.metadata) as Checkpoint);
+      // Another call checkpointed, or refused to, since this one's snapshot, or this one's rehash of the past
+      // could not run: what it would sign over is not what it checked. A refusal for a broken log stands,
+      // and a checkpoint signed meanwhile is the newest prefix; the next call starts from them.
+      if (stalled !== null || ((await store.newestCheckpointEntry(d.tx))?.seq ?? null) !== seen) {
+        const standing = await this.#standingRefusal(d.tx);
+        if (standing !== null) throw refused('log_broken', standing);
+        if (stalled === null && newest !== null) return { checkpoint: signedPart(newest) };
       }
-      // Nothing since the last one: it is still the newest prefix.
-      if (latest !== null && latest.seq === head.nextSeq - 1n) return { checkpoint: latest.checkpoint };
+      // Nothing since the last one, which signed every entry before its own: it is still the newest prefix.
+      if (newest !== null && latest!.seq === head.nextSeq - 1n && latest!.relatedSeq === latest!.seq - 1n) return { checkpoint: signedPart(newest) };
       // Under the lock, the rest: the prefix signed last still where it was,
-      // and every entry since the snapshot. A rewrite is never signed over.
-      if (latest !== null && !(await carries(d.tx, latest.checkpoint))) {
-        throw refused('log_broken', { reason: `the log up to entry ${latest.checkpoint.seq} is not the prefix the last checkpoint signed` });
+      // and every entry since the snapshot, unless the walk is catching up,
+      // when what it walked must still be there. A rewrite is never signed over.
+      if (newest !== null && !(await carries(d.tx, newest))) {
+        throw refused('log_broken', { reason: `the log up to entry ${newest.seq} is not the prefix the last checkpoint signed` });
       }
-      const { verification: held, anchor: verified } = await verifyChain(d.tx, this.#prepared.logKeys, [], whole.anchor);
-      if (!held.ok) throw refused('log_broken', { failedAtSeq: held.failedAtSeq, reason: held.reason });
-      // It signs the entry it verified to, which the head, locked, must name.
-      if (verified.nextSeq !== head.nextSeq || !verified.hash.equals(head.headHash)) {
-        throw refused('log_broken', { reason: 'the chain head does not name the last entry' });
+      const walk = new Walk(walked.tally, walked.digest);
+      let { at } = walked;
+      if (walked.done) {
+        // Where the snapshot's walk ended still has the hash it found there: what follows links to it.
+        if (!(await carries(d.tx, headOf(at)))) {
+          throw refused('log_broken', { failedAtSeq: Number(at.seq), reason: `the log up to entry ${at.seq} changed while the vault walked it` });
+        }
+        const rest = await rehash(d.tx, logKeys, at, walk, {});
+        if (!rest.ok) throw refused('log_broken', { failedAtSeq: rest.failedAtSeq, reason: rest.reason });
+        const unsigned = await this.#checkpointFault(d.tx, walk.checkpoints);
+        if (unsigned !== null) throw refused('log_broken', { failedAtSeq: unsigned.failedAtSeq, reason: unsigned.reason });
+        at = rest.at;
+        // It signs the entry it verified to, which the head, locked, must name.
+        if (at.seq !== head.nextSeq - 1n || !at.hash.equals(head.headHash)) {
+          throw refused('log_broken', { reason: 'the chain head does not name the last entry' });
+        }
+      } else if (!(await carries(d.tx, headOf(at)))) {
+        throw refused('log_broken', { reason: `the log up to entry ${at.seq} changed while the vault walked it` });
       }
-      const signed = { seq: Number(verified.nextSeq - 1n), hash: verified.hash.toString('hex'), signedAt: iso(d.at) };
+      // Another call signed as far, or further, while this one walked behind the head: that is the newest prefix, never one shorter.
+      if (newest !== null && latest!.relatedSeq !== null && latest!.relatedSeq >= at.seq) return { checkpoint: signedPart(newest) };
+      this.#prepared.verified = further(this.#prepared.verified, at);
+      const tally = walk.tally();
+      // Its members and grants once, in the first checkpoint after they change; the others name that one.
+      const digest = walk.digest();
+      const { from } = walked;
+      const access = digest === from.digest && from.carrier !== null ? { digest, at: Number(from.carrier) } : { digest, ...tally.access };
+      const signed = { seq: Number(at.seq), hash: at.hash.toString('hex'), signedAt: iso(d.at) };
       const checkpoint = {
         ...signed,
         keyId: this.#prepared.signer.keyId,
         signature: await this.#prepared.signer.sign(checkpointMessage(signed)),
       };
-      d.log.push({ actor: SCHEDULER, action: CHECKPOINT, decision: 'allow', metadata: JSON.stringify(checkpoint) });
-      return { checkpoint };
+      const lap = scrub.next === null ? null : { at: headOf(scrub.next.at), end: headOf(scrub.next.end) };
+      const kept: TalliedCheckpoint = { ...checkpoint, tally: { v: TALLY_VERSION, ...tally, access }, scrub: lap };
+      d.log.push({ actor: SCHEDULER, action: CHECKPOINT, decision: 'allow', relatedSeq: at.seq, metadata: JSON.stringify(kept) });
+      return stalled === null ? { checkpoint } : { checkpoint, warning: stalled };
     });
   }
 
+  /**
+   * The prefixes signed before, rehashed a stretch at a time, in laps: a lap
+   * runs from the first entry to the prefix the newest checkpoint signed
+   * when it began, which it keeps (`end`), `walks.scrub` entries a call, each
+   * hash recomputed from its entry and each link checked (`relink`); the
+   * next lap runs to the prefix signed then. A checkpoint resumes from the
+   * newest one's tally and never reads what it signed again, and an entry
+   * before it edited in place, its stored hash left as it was, keeps the
+   * chain: this is what finds it, within two laps at most, each the length
+   * of the log when it began over `walks.scrub` beats, however fast the log
+   * grows meanwhile. The lap as it goes on, null between laps.
+   */
+  async #scrub(db: Queryable, newest: Resumed): Promise<Scrubbed> {
+    const lap = newest.scrub ?? { at: START, end: newest.at };
+    if (lap.end.seq < 0n) return { ok: true, next: null };
+    const relinked = await relink(db, lap.at, lap.end.seq, this.#prepared.options.walks.scrub);
+    if (!relinked.ok) return relinked;
+    if (relinked.at.seq < lap.end.seq) return { ok: true, next: { at: relinked.at, end: lap.end } };
+    // A lap ends at the prefix a checkpoint signed, or it was not the chain the checkpoints signed.
+    if (!relinked.at.hash.equals(lap.end.hash)) {
+      return { ok: false, failedAtSeq: Number(lap.end.seq), reason: `the log up to entry ${lap.end.seq} is not the prefix a checkpoint signed` };
+    }
+    return { ok: true, next: null };
+  }
+
+  /**
+   * The newest refusal for a broken log since the newest checkpoint was
+   * signed, by the vault's MAC, as it said: it stands, for every
+   * verification and checkpoint, until a checkpoint is signed, which takes
+   * the check that found it running again and passing. A refusal of
+   * another kind since, a wrong KEK, hides none.
+   */
+  async #standingRefusal(db: Queryable): Promise<{ failedAtSeq?: number | null; reason?: string } | null> {
+    const signed = await store.latestVaultEntry(db, [CHECKPOINT]);
+    const refused = await store.newestRefusal(db, CHECKPOINT, 'log_broken', signed?.seq ?? -1n);
+    if (refused === undefined || !this.#authentic(refused)) return null;
+    return JSON.parse(refused.metadata) as { failedAtSeq?: number | null; reason?: string };
+  }
+
   async about(): Promise<{ checkpointKeys: Record<string, CheckpointKey>; owners: string[]; rootAdmins: [] }> {
     await this.#settled();
     const { signers, since } = this.#prepared;
@@ -2221,41 +2622,123 @@ class VaultService implements Vault {
     return { current: { kekProvider: provider, kekId: keyId }, checks };
   }
 
-  verifyLog(input: VerifyLogInput): Promise<LogVerification> {
-    return this.#verifyAll(input.upTo ?? null);
-  }
-
   /**
-   * The whole log, in one snapshot and one pass over the vault's entries:
-   * each by its MAC, the keys it moved through, and what the other checks
-   * need of it, gathered as it goes (`Findings`); then every checkpoint, the
-   * heads that must still be there, the key batches accounted for, and the
-   * members and grants replayed.
+   * The log from a checkpoint's tally, in one snapshot: the vault's
+   * entries since, each by its MAC, the keys it moved through, and what the
+   * other checks need of it (`Walk`); then every checkpoint walked, the
+   * heads that must still be there, and, for a walk that ends at the
+   * present, the key batches accounted for and the members and grants
+   * replayed against their rows.
    *
    * With `upTo`, the head the app verified to, the links and hashes of the
-   * chain are the app's to recompute, as it just has, over its own snapshot,
-   * through that head; `carries(upTo)` ties this snapshot to that one. So
-   * the vault reads only its own entries, each checked against its own hash
-   * and MAC over the link it names. Without `upTo`, nobody else recomputed
-   * the chain: the vault reads it all, and rehashes every link.
+   * chain are the app's to recompute, as it just has, over its own
+   * snapshot, through that head; holding `upTo` ties this snapshot to that
+   * one. So the vault reads only its own entries, each checked against its
+   * own hash and MAC over the link it names. Without `upTo`, nobody else
+   * recomputed the chain: the vault reads it all, and rehashes every link,
+   * no further than one walk (`walks.verify`).
    */
-  async #verifyAll(upTo: LogHead | null): Promise<LogVerification> {
+  async verifyLog(input: VerifyLogInput): Promise<LogVerification> {
     await this.#settled();
-    return this.#db.transaction(async (tx) => {
+    const upTo = input.upTo ?? null;
+    const { logKeys } = this.#prepared;
+    const { walks } = this.#prepared.options;
+    return this.#db.transaction(async (tx): Promise<LogVerification> => {
       const remembered = this.#prepared.verified;
-      const findings = new Findings();
-      const read = upTo === null ? await this.#rehashed(tx, findings) : await this.#ownEntries(tx, findings);
-      if (!read.ok) return read;
-      // Each head the log must still hold, in one read: the app's, every checkpoint's, and the last this vault rehashed.
-      const heads: LogHead[] = [...(upTo === null ? [] : [upTo]), ...findings.checkpoints.map(({ checkpoint }) => checkpoint)];
-      const rememberedHead = remembered.nextSeq > 0n ? { seq: Number(remembered.nextSeq - 1n), hash: remembered.hash.toString('hex') } : null;
-      if (rememberedHead !== null) heads.push(rememberedHead);
-      const hashes = await store.hashesAt(tx, [...new Set(heads.map((head) => BigInt(head.seq)))]);
-      const holds = (head: LogHead) => head.hash === GENESIS_HASH.toString('hex') || hashes.get(BigInt(head.seq))?.toString('hex') === head.hash;
+      const from = await this.#resume(tx, input.from === undefined ? 'newest' : input.from === 'start' ? 'start' : BigInt(input.from));
+      if (!from.ok) return from;
+      // Where a stretch ends, the last entry its checkpoint names: that checkpoint, and each it passes on the
+      // way, are held to the walk as it gets there, so a fault on the way is named where it is.
+      const to = input.to === undefined ? null : BigInt(input.to);
+      const ends = to === null ? null : (await store.entriesAt(tx, [to])).get(to)?.relatedSeq ?? -1n;
+      if (ends !== null && (ends <= from.at.seq || (upTo !== null && BigInt(upTo.seq) !== ends))) {
+        return { ok: false, failedAtSeq: Number(to), reason: 'not a checkpoint after the one the walk starts from, whose prefix ends where the app verified to' };
+      }
+      // The prefix the walk starts from still there, as it was signed, and whole: a rewrite chained again
+      // changes its hash, and a cut its count.
+      if (!(await this.#holding(tx, [headOf(from.at)]))(headOf(from.at))) {
+        return { ok: false, failedAtSeq: Number(from.entry), reason: `the log up to entry ${from.at.seq} is not the prefix this checkpoint signed: it was rewritten` };
+      }
+      const gap = await missingEntry(tx, from.at.seq);
+      if (gap !== null) return { ok: false, failedAtSeq: Number(gap.found), reason: `sequence gap: expected seq ${gap.expected}, found ${gap.found}` };
+      // Every checkpoint after it whose prefix the walk may pass, a stretch's end among them, signed while
+      // the app walked or not: each tally is held to the walk where it gets there (`Walk.expect`).
+      const walk = new Walk(from.tally, from.digest);
+      const later = await store.talliedAfter(tx, from.entry ?? -1n, walks.verify);
+      const passed = later.filter(({ seq }) => to === null || seq <= to);
+      if (to !== null && passed.at(-1)?.seq !== to) {
+        return { ok: false, failedAtSeq: Number(to), reason: `a stretch passes no more than ${walks.verify} checkpoints: end one sooner` };
+      }
+      // Each one's tally as what the walk must come to, a few at a time, so that members and grants kept whole
+      // in many of them are never all in memory: the digest it keeps of them stands for them.
+      // Each one's members and grants are as its digest says, kept whole in it or in the earlier checkpoint it
+      // names, each such checkpoint read once: what a walk resuming from it would find.
+      const holding = new Map<bigint, string | null>();
+      const carried = async (carrier: bigint): Promise<string | null> => {
+        if (!holding.has(carrier)) {
+          const entry = (await store.entriesAt(tx, [carrier])).get(carrier);
+          const read = entry === undefined ? 'missing' : this.#tallied(entry);
+          holding.set(carrier, typeof read === 'string' || 'at' in read.tally.access ? null : keptDigest(read.tally.access));
+        }
+        return holding.get(carrier)!;
+      };
+      const expected: Expected[] = [];
+      // The hash the stretch's own checkpoint signed, as it is read among the others.
+      let endSigned: string | null = null;
+      for (let after = from.entry ?? -1n, last = passed.at(-1)?.seq; last !== undefined && after < last; ) {
+        const batch = await store.talliedWithin(tx, after, last, walks.verify + 1);
+        if (batch.length === 0) break;
+        for (const entry of batch) {
+          const read = this.#tallied(entry);
+          const point = { entry: entry.seq, through: entry.relatedSeq! };
+          if (typeof read === 'string') {
+            expected.push({ ...point, unreadable: read });
+            continue;
+          }
+          if (entry.seq === to) endSigned = read.hash;
+          const { access } = read.tally;
+          if (!('at' in access)) holding.set(entry.seq, keptDigest(access));
+          const kept = 'at' in access ? (BigInt(access.at) < entry.seq ? await carried(BigInt(access.at)) : null) : holding.get(entry.seq)!;
+          expected.push(kept === access.digest
+            ? { ...point, key: expectedKey(read.tally) }
+            : { ...point, unreadable: kept === null ? `its tally keeps its members and grants in entry ${'at' in access ? access.at : entry.seq}, which holds none` : "its tally's members and grants do not match their digest" });
+        }
+        after = batch.at(-1)!.seq;
+      }
+      walk.expect(expected);
+      // How far the walk got, the hash there, and whether that is the present: the rows and the key batches
+      // are held to the log only when the walk read every entry of the vault's there is.
+      let through = from.at.seq;
+      let reached = headOf(from.at).hash;
+      let present = false;
+      if (upTo === null) {
+        const chain = await rehash(tx, logKeys, from.at, walk, ends === null ? { limit: walks.verify } : { to: ends });
+        if (!chain.ok) return chain;
+        [through, reached, present] = [chain.at.seq, headOf(chain.at).hash, chain.done && ends === null];
+        this.#prepared.verified = further(this.#prepared.verified, chain.at);
+      } else {
+        // On past the app's head, to the vault's last entry in this snapshot: the rows are as they are at
+        // this one's. The app's head bounds what is verified; the vault's own walk, what the rows meet.
+        const own = await ownEntries(tx, logKeys, from.at.seq, walk, ends === null ? { limit: walks.verify } : { to: ends });
+        if (!own.ok) return own;
+        // An app older than 0.10.1 names no `from`, and takes an ok for the whole of `upTo`: it gets one only for that.
+        if (!own.done && input.from === undefined) {
+          return { ok: false, failedAtSeq: null, reason: `the vault verifies no more than ${walks.verify} of its entries a call, and its checkpoints are catching up: update the app` };
+        }
+        // Short of its own last entry, it has not held the rows to the log: never say it verified all the app did.
+        const short = own.at < BigInt(upTo.seq) ? own.at : BigInt(upTo.seq) - 1n;
+        [through, reached, present] = [own.done ? BigInt(upTo.seq) : short, upTo.hash, own.done && ends === null];
+      }
+      walk.finish(ends ?? through);
+      // Each head the log must still hold, in one read: the app's, every
+      // checkpoint's walked, and the last this vault rehashed.
+      const rememberedHead = remembered.seq >= 0n ? headOf(remembered) : null;
+      const heads = [...(upTo === null ? [] : [upTo]), ...(rememberedHead === null ? [] : [rememberedHead])];
+      const holds = await this.#holding(tx, [...heads, ...walk.checkpoints.map(({ checkpoint }) => checkpoint)]);
       if (upTo !== null && !holds(upTo)) {
         return { ok: false, failedAtSeq: upTo.seq, reason: 'not the entry the app verified up to: the log changed between the two checks' };
       }
-      const unsigned = await this.#checkpointFault(findings, holds);
+      const unsigned = await this.#checkpointFault(tx, walk.checkpoints, holds);
       if (unsigned !== null) return unsigned;
       // What this vault last verified must still be there: whoever holds
       // its key can seal a rewrite, but cannot put back the head it saw. A
@@ -2263,57 +2746,46 @@ class VaultService implements Vault {
       if (rememberedHead !== null && !holds(rememberedHead)) {
         return { ok: false, failedAtSeq: rememberedHead.seq, reason: 'changed since the vault last verified it' };
       }
+      if (walk.mismatch !== null) return { ok: false, failedAtSeq: Number(walk.mismatch.entry), reason: walk.mismatch.reason };
+      if (ends !== null) {
+        // The walk ends at the prefix the stretch's checkpoint signed, by its hash too: a chain made again from before it is not.
+        if ((upTo === null && through !== ends) || endSigned !== reached) {
+          return { ok: false, failedAtSeq: Number(to), reason: `the log up to entry ${ends} is not the prefix this checkpoint signed: it was rewritten` };
+        }
+        return { ok: true, entries: walk.entries, through: Number(ends) };
+      }
+      // A checkpoint refused since the newest was signed, for a broken log: what it found, the stretch of the
+      // past it rehashed among it, which no walk from a tally reads again.
+      const standing = await this.#standingRefusal(tx);
+      if (standing !== null) {
+        return { ok: false, failedAtSeq: standing.failedAtSeq ?? null, reason: `the last checkpoint was refused: ${standing.reason ?? 'the log is broken'}` };
+      }
+      const verified = { ok: true as const, entries: walk.entries, through: Number(through) };
+      if (!present) return verified;
       const at = await this.#now(tx);
-      const accounting = findings.accounting.result(at);
+      const accounting = walk.accounting.result(at);
       if (!accounting.ok) return accounting;
       const [rows, held] = await Promise.all([store.allMembers(tx), store.grants(tx)]);
-      const fault = this.#unsealed(rows, held, findings.newestAccess) ?? findings.replayFault ?? replayFault(findings.replayed, rows, held, at);
+      const fault = this.#unsealed(rows, held, walk.newestAccess) ?? walk.replayFault ?? replayFault(walk.replayed, rows, held, at);
       if (fault !== null) return { ok: false, failedAtSeq: null, reason: describeAccessFault(fault), fault };
-      const verified = { ok: true as const, entries: findings.entries };
       return accounting.pending === 0 ? verified : { ...verified, pending: accounting.pending };
     }, SNAPSHOT);
   }
 
   /**
-   * The vault's own entries, oldest first: each against its own hash, and by
-   * its MAC, over the link it names, which the app checked; and the vault's
-   * keys moving only forward through them.
-   */
-  async #ownEntries(tx: Queryable, findings: Findings): Promise<{ ok: true } | Extract<LogVerification, { ok: false }>> {
-    const { logKeys } = this.#prepared;
-    let keys: readonly string[] = [];
-    for (let after = -1n; ; ) {
-      const batch = await store.vaultEntriesAfter(tx, after, VERIFY_BATCH);
-      if (batch.length === 0) return { ok: true };
-      for (const entry of batch) {
-        const result = verifyEntries([entry], { startSeq: entry.seq, startPrevHash: entry.prevHash, keys: logKeys });
-        if (!result.ok) return { ok: false, failedAtSeq: Number(result.failedAtSeq), reason: withCause(result.reason) };
-      }
-      const moved = forward(batch, keys, logKeys[0]!.keyId);
-      if ('failedAtSeq' in moved) return { ok: false, failedAtSeq: Number(moved.failedAtSeq), reason: moved.reason };
-      keys = moved.keys;
-      for (const entry of batch) findings.add(entry);
-      after = batch[batch.length - 1]!.seq;
-    }
-  }
-
-  /** The whole chain from its first entry: every link and hash, the vault's MACs; the furthest verified is kept for checkpoints. */
-  async #rehashed(tx: Queryable, findings: Findings): Promise<{ ok: true } | Extract<LogVerification, { ok: false }>> {
-    const { verification, anchor } = await verifyChain(tx, this.#prepared.logKeys, [], UNVERIFIED, (batch) => {
-      for (const entry of batch) if (entry.author === 'vault') findings.add(entry);
-    });
-    if (!verification.ok) return verification;
-    this.#prepared.verified = further(this.#prepared.verified, anchor);
-    return { ok: true };
-  }
-
-  /**
-   * Every checkpoint, not only the newest: each signed by the key whose log
-   * key wrote its entry, over a prefix the log still holds (`holds`), entry
-   * for entry. Its entry's MAC is checked by now, and one under a key the
-   * vault replaced comes before the rotation.
+   * Every checkpoint walked, not only the newest: each signed by the key
+   * whose log key wrote its entry, over a prefix the log still holds,
+   * entry for entry, which one that keeps a tally names as related. Its
+   * entry's MAC is checked by now, and one under a key the vault replaced
+   * comes before the rotation.
    */
-  async #checkpointFault(findings: Findings, holds: (head: LogHead) => boolean): Promise<Extract<LogVerification, { ok: false }> | null> {
+  async #checkpointFault(
+    db: Queryable,
+    checkpoints: Walk['checkpoints'],
+    known?: (head: LogHead) => boolean,
+  ): Promise<Broken | null> {
+    if (checkpoints.length === 0) return null;
+    const holds = known ?? (await this.#holding(db, checkpoints.map(({ checkpoint }) => checkpoint)));
     const { logKeys, signers } = this.#prepared;
     // Each signer's key imported once, for this check only.
     const verifiers = new Map<string, Promise<(checkpoint: Checkpoint) => Promise<boolean>>>();
@@ -2322,7 +2794,6 @@ class VaultService implements Vault {
       if (verifier === undefined) verifiers.set(by.keyId, (verifier = checkpointVerifier(by.publicKey)));
       return verifier.then((verify) => verify(checkpoint));
     };
-    const { checkpoints } = findings;
     for (let from = 0; from < checkpoints.length; from += SIGNATURES_AT_ONCE) {
       const chunk = checkpoints.slice(from, from + SIGNATURES_AT_ONCE);
       // The signatures of a chunk at once, where crypto runs beside the code; the first fault, in the log's order.
@@ -2330,7 +2801,7 @@ class VaultService implements Vault {
         const by = signers[logKeys.findIndex((key) => key.keyId === entry.keyId)];
         if (by?.keyId !== checkpoint.keyId) return `a checkpoint signed under ${checkpoint.keyId}, in an entry written under ${entry.keyId}: each key signs only its own`;
         if (!(await signed(checkpoint, by))) return 'a checkpoint the vault did not sign';
-        if (BigInt(checkpoint.seq) >= entry.seq || !holds(checkpoint)) {
+        if (BigInt(checkpoint.seq) >= entry.seq || !holds(checkpoint) || (entry.relatedSeq !== null && entry.relatedSeq !== BigInt(checkpoint.seq))) {
           return `the log up to entry ${checkpoint.seq} is not the prefix this checkpoint signed: it was rewritten`;
         }
         return null;
@@ -2343,8 +2814,8 @@ class VaultService implements Vault {
 
   /**
    * The first member whose row fails its MAC, or names an older access
-   * entry than the log's newest about them (`newest`, from the full check's
-   * pass, where each entry's MAC was checked).
+   * entry than the log's newest about them (`newest`, from the walk, where
+   * each entry's MAC was checked, on from the tally).
    */
   #unsealed(rows: readonly Member[], held: readonly GrantRow[], newest: ReadonlyMap<string, bigint>): AccessFault | null {
     for (const row of rows) {
@@ -2356,40 +2827,80 @@ class VaultService implements Vault {
   }
 }
 
+type Broken = Extract<LogVerification, { ok: false }>;
+
 /**
- * What one pass over the vault's entries gathers for the other checks of a
- * full verification, so that the log is read once: the key batches, the
- * access entries replayed, each member's newest, and the checkpoints. Each
- * entry comes after its MAC was checked.
+ * Where a walk of the log resumes: the checkpoint's entry (null for the
+ * first entry), the end of the prefix it signed, the tally through there,
+ * its members and grants' digest and the entry that keeps them, and where
+ * the background rehash goes on from (`#scrub`).
  */
-class Findings {
-  readonly accounting = new KeyAccounting();
-  readonly replayed: Replayed = { members: new Map(), held: new Map() };
-  /** The first access entry the replay could not apply. */
-  replayFault: AccessFault | null = null;
-  /** Each member's newest allowed access entry, by seq. */
-  readonly newestAccess = new Map<string, bigint>();
-  /** Every allowed checkpoint, with its entry's seq and key: tens of thousands a year, so nothing more of it. */
-  readonly checkpoints: { entry: { seq: bigint; keyId: string }; checkpoint: Checkpoint }[] = [];
-  /** The vault's entries read. */
-  entries = 0;
-
-  add(entry: StoredEntry): void {
-    this.entries += 1;
-    this.accounting.add(entry);
-    if (entry.decision !== 'allow') return;
-    if (ACCESS.has(entry.action)) {
-      this.replayFault ??= apply(this.replayed, entry);
-      if (entry.subjectPrincipal !== null) this.newestAccess.set(entry.subjectPrincipal, entry.seq);
-    } else if (entry.action === CHECKPOINT) {
-      this.checkpoints.push({ entry: { seq: entry.seq, keyId: entry.keyId }, checkpoint: JSON.parse(entry.metadata) as Checkpoint });
-    }
+type Resumed = {
+  ok: true;
+  entry: bigint | null;
+  at: Position;
+  tally: Tally;
+  digest: string;
+  carrier: bigint | null;
+  scrub: Lap | null;
+};
+
+/** A lap of the rehash of the past: the last entry rehashed, and the prefix it rehashes to, signed when it began. */
+type Lap = { at: Position; end: Position };
+
+/** Whether a statement was cancelled for taking too long: Postgres's `query_canceled`, a statement timeout among them. */
+function timedOut(error: unknown): boolean {
+  for (let cause = error; typeof cause === 'object' && cause !== null; cause = (cause as { cause?: unknown }).cause) {
+    if ((cause as { code?: unknown }).code === '57014') return true;
   }
+  return false;
 }
 
-const ACCESS = new Set<string>(ACCESS_ACTIONS);
+/** Where the next rehash of the past goes on from, null for the first entry; or what it found. */
+type Scrubbed = { ok: true; next: Lap | null } | Broken;
+
+const FIRST_ENTRY: Resumed = { ok: true, entry: null, at: START, tally: EMPTY_TALLY, digest: accessDigest(EMPTY_TALLY.access), carrier: null, scrub: null };
+
+/** How far one call walks the log, in entries: a checkpoint's walk from the last, its rehash of the past, and a verification's own walk. */
+export type Walks = { checkpoint: number; scrub: number; verify: number };
+
+/**
+ * A walk rehashes, MACs and replays some 40 µs of CPU an entry, and 95
+ * with V8's optimizer off, as on a cold isolate: 10,000 entries is a beat
+ * of catching up, about a second, and a team's instance writes fewer than
+ * a thousand a day. The rehash of the past is a hash an entry, 14 µs warm
+ * and 55 cold, beside two reads: 100 entries keep it near 6 ms a beat.
+ */
+const WALKS: Walks = { checkpoint: 10_000, scrub: 100, verify: 10_000 };
 
-/** Checkpoint signatures checked at once, in a full verification. */
+/** The digest of the members and grants a checkpoint keeps whole, beside the digest it says they have. */
+function keptDigest({ members, grants, newest }: AccessTally): string {
+  return accessDigest({ members, grants, newest });
+}
+
+/** Each checkpoint entry's metadata, parsed once however many times it is asked about: one may hold every member and grant. */
+const parsed = new WeakMap<StoredEntry, unknown>();
+function metadataOf(entry: StoredEntry): unknown {
+  if (!parsed.has(entry)) parsed.set(entry, JSON.parse(entry.metadata));
+  return parsed.get(entry);
+}
+
+/** A head, as an entry keeps it, as a walk goes on from it. */
+function positionOf(head: LogHead): Position {
+  return { seq: BigInt(head.seq), hash: Buffer.from(head.hash, 'hex') };
+}
+
+/** A position as the log's heads are named, in hex. */
+function headOf(position: Position): LogHead {
+  return { seq: Number(position.seq), hash: position.hash.toString('hex') };
+}
+
+/** What a checkpoint's signature covers, and nothing it keeps beside it. */
+function signedPart({ seq, hash, signedAt, keyId, signature }: Checkpoint): Checkpoint {
+  return { seq, hash, signedAt, keyId, signature };
+}
+
+/** Checkpoint signatures checked at once. */
 const SIGNATURES_AT_ONCE = 256;
 
 /** Settle every operation before releasing the member lock, including cancelled requests. */
@@ -2442,6 +2953,7 @@ function validateItems(items: readonly { secret: SecretRef; key?: string; wrappe
     if (field === 'key' && typeof key !== 'string') throw new Error('DEK must be base64');
     if (field === 'wrapped' && (wrapped === undefined || wrapped === null)) throw new Error('wrapped key is required');
     checkContext(context(secret));
+    if (secret.sensitive !== undefined && typeof secret.sensitive !== 'boolean') throw new Error('a secret is sensitive or not: true, false or absent');
     if (!Number.isSafeInteger(secret.version) || secret.version < 1) throw new Error('secret version must be a positive integer');
     if (typeof secret.path !== 'string' || /[\uD800-\uDFFF]/u.test(secret.path)) throw new Error('secret path must be a well-formed string');
     if (key !== undefined) {
@@ -2578,10 +3090,13 @@ function personalRefusal(
   if (own?.owner == null && held?.owner == null) return undefined;
   if (own !== held || principal !== own?.owner || own.parentId === null) return 'personal';
   const parent = placeIn({ projectId: secret.projectId, environmentId: own.parentId }, environments);
-  const refused = refuses(reader, 'secret.read', parent, own.deleted || (environments.get(own.parentId)?.deleted ?? true));
+  // Its owner reads what they wrote while they read or use the environment it configures (R8).
+  const gone = own.deleted || (environments.get(own.parentId)?.deleted ?? true);
+  const refused = refuses(reader, 'secret.use', parent, gone) === null ? null : refuses(reader, 'secret.read', parent, gone);
   if (refused !== null) return refused;
-  // The credential's scope caps the owner still: their viewer token on the parent reads, and wraps no key.
-  return withinCredential(reader.live, permission, parent) ? null : 'no_grant';
+  // The credential's scope caps the owner still: their viewer token on the parent reads, and wraps no key. Reading their
+  // own values takes use there: a Contributor's handle reads what its owner wrote, and nothing of the parent's.
+  return withinCredential(reader.live, permission === 'secret.read' ? 'secret.use' : permission, parent) ? null : 'no_grant';
 }
 
 function refuses(reader: Standing, permission: Permission, where: Place, deleted: boolean): RefusalCode | null {
@@ -2781,9 +3296,71 @@ function iso(ms: number): string {
   return new Date(ms).toISOString();
 }
 
-/** A secret's binding context: its ids, and a personal config's owner, hashed, as the decision read it. */
+/** A policy entry's edits, checked as the vault wrote them, or null for any that does not hold. */
+function readEdits(stored: { policy?: unknown }): PolicyEdits | null {
+  const edits = stored.policy as Partial<PolicyEdits> | undefined;
+  if (typeof edits !== 'object' || edits === null) return null;
+  const { roles, instanceRoles, protected: protectedIds } = edits;
+  if (typeof roles !== 'object' || roles === null || typeof instanceRoles !== 'object' || instanceRoles === null || !Array.isArray(protectedIds)) return null;
+  const defined = (table: object) => Object.values(table).every((definition) => definitionProblem(definition as RoleDefinition) === null);
+  if (!defined(roles) || !defined(instanceRoles) || Object.keys(instanceRoles).some((role) => !isInstanceRole(role))) return null;
+  if (protectedIds.some((place) => typeof place !== 'object' || place === null || !UUID.test((place as ProtectedPlace).projectId) || !UUID.test((place as ProtectedPlace).environmentId)
+    || !Number.isSafeInteger((place as ProtectedPlace).at))) return null;
+  return { roles: roles as Record<string, RoleDefinition>, instanceRoles: instanceRoles as PolicyEdits['instanceRoles'], protected: protectedIds as ProtectedPlace[] };
+}
+
+/**
+ * The policy `edits` say as of `at`: the roles as they ship, each edited
+ * one replaced and each made one added; and the protected environments, but
+ * for those deleted since, the project around one's included: a deleted
+ * prod protects nothing, and holds nobody back from giving a service
+ * account a role on all of its project (`givesService`). A fork's id with
+ * no row yet stays, protected before it is written, ten minutes: one with
+ * none after that is a fork refused or abandoned, never written. Each
+ * keeps its slug, which a scoped instance role's filters read. The edits
+ * keep them all: no write is needed.
+ */
+async function livePolicy(db: Queryable, edits: PolicyEdits, at: number): Promise<Policy> {
+  const rows = await store.environmentsById(db, edits.protected.map((place) => place.environmentId));
+  const live = edits.protected.filter((place) => {
+    const row = rows.get(place.environmentId);
+    return row === undefined ? at - place.at < UNWRITTEN_FORK_MS : !row.deleted;
+  });
+  const slugOf = (place: ProtectedPlace) => rows.get(place.environmentId)?.slug ?? null;
+  return {
+    roles: { ...ROLES, ...edits.roles },
+    instanceRoles: { ...INSTANCE_ROLES, ...edits.instanceRoles },
+    protected: live.map((place) => place.environmentId),
+    protectedIn: live.reduce<Record<string, { environmentId: string; slug: string | null }[]>>(
+      (byProject, place) => ({ ...byProject, [place.projectId]: [...(byProject[place.projectId] ?? []), { environmentId: place.environmentId, slug: slugOf(place) }] }),
+      {},
+    ),
+  };
+}
+
+/** A change, as its entry names it. */
+function describeChange(change: PolicyChange | undefined): Record<string, unknown> | null {
+  if (change === undefined || change === null || typeof change !== 'object') return null;
+  if (change.kind === 'protect') return { kind: 'protect', projectId: change.projectId, environmentIds: change.environmentIds, protected: change.protected };
+  return { kind: change.kind, role: change.role, definition: change.definition };
+}
+
+/** What a change changed, as it was: the role's definition, or which environments were protected. */
+function describeBefore(change: PolicyChange, before: Policy): Record<string, unknown> {
+  if (change.kind === 'protect') return { protected: change.environmentIds.filter((id) => before.protected.includes(id)) };
+  const table = change.kind === 'instance-role' ? before.instanceRoles as Record<string, RoleDefinition> : before.roles;
+  return { definition: Object.hasOwn(table, change.role) ? table[change.role] : null };
+}
+
+/** A secret's binding context: its ids, a personal config's owner, hashed, as the decision read it, and whether it is sensitive. */
 function context(secret: SecretRef, owner?: string): SecretContext {
-  return { projectId: secret.projectId, environmentId: secret.environmentId, secretId: secret.secretId, ...(owner === undefined ? {} : { owner }) };
+  return {
+    projectId: secret.projectId,
+    environmentId: secret.environmentId,
+    secretId: secret.secretId,
+    ...(owner === undefined ? {} : { owner }),
+    ...(secret.sensitive === true ? { sensitive: true as const } : {}),
+  };
 }
 
 function unwrappable(wrapped: WrappedKey) {