diff --git a/.github/workflows/azure-objects.yml b/.github/workflows/azure-objects.yml
index afc895a6..e781b47e 100644
--- a/.github/workflows/azure-objects.yml
+++ b/.github/workflows/azure-objects.yml
@@ -62,6 +62,9 @@ jobs:
           echo "AZURE_FEDERATED_TOKEN_FILE=$RUNNER_TEMP/assertion" >> "$GITHUB_ENV"
 
       - name: Test against the storage account
+        # #126: two contract classes against a real account; the services
+        # leg's limit and hang dump, which run the same classes on emulators.
+        timeout-minutes: 10
         run: >
           dotnet test
           --project tests/Varve.Store.Tests/Varve.Store.Tests.csproj
@@ -69,6 +72,10 @@ jobs:
           --no-build
           --filter-class Varve.Store.Tests.Objects.AzureAccountObjectStoreContractTests
           --filter-class Varve.Store.Tests.Objects.AzureAccountStorageContractTests
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Store.Tests
+          --hangdump
+          --hangdump-timeout 5m
 
       - name: What-if for the Container Apps template
         env:
@@ -101,3 +108,13 @@ jobs:
       - name: Remove the token
         if: always()
         run: rm -f "$RUNNER_TEMP/assertion"
+
+      - name: Upload the test results
+        # #126: every run keeps its TRX, pass or fail, so a slow or red run
+        # can be explained test by test from its own artifacts.
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: test-results-azure-objects
+          path: ${{ github.workspace }}/artifacts/test-results
+          if-no-files-found: warn
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 01863eeb..4c2c393f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -249,6 +249,18 @@ jobs:
         # dotNetRDF is a benchmark-only reference.
         run: dotnet build tests/Varve.Benchmarks/Varve.Benchmarks.csproj --configuration Release
 
+      - name: Temporary folder on the runner's temporary drive
+        # #126: every test dataset, and the object store's cache directories,
+        # are made under the temporary folder. On windows-latest that is the
+        # profile's, on C:, the system drive; the runner's own temporary folder
+        # is on D:, as the workspace is. From here on, the tests' is too.
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          "The temporary folder was $([System.IO.Path]::GetTempPath()); it is now $env:RUNNER_TEMP."
+          "TEMP=$env:RUNNER_TEMP" >> $env:GITHUB_ENV
+          "TMP=$env:RUNNER_TEMP" >> $env:GITHUB_ENV
+
       # Every test project except the conformance one, which has a job of its
       # own because it is gated by the ratchet rather than by its own result.
       # One step each rather than one step over the solution: `dotnet test`
@@ -259,114 +271,168 @@ jobs:
           dotnet test
           --project tests/Varve.Analyzers.Tests/Varve.Analyzers.Tests.csproj
           --configuration Release
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Analyzers.Tests
 
       - name: Test Varve.Iri
         run: >
           dotnet test
           --project tests/Varve.Iri.Tests/Varve.Iri.Tests.csproj
           --configuration Release
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Iri.Tests
 
       - name: Test Varve.Rdf
         run: >
           dotnet test
           --project tests/Varve.Rdf.Tests/Varve.Rdf.Tests.csproj
           --configuration Release
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Rdf.Tests
 
       - name: Test Varve.Turtle
         run: >
           dotnet test
           --project tests/Varve.Turtle.Tests/Varve.Turtle.Tests.csproj
           --configuration Release
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Turtle.Tests
 
       - name: Test Varve.RdfXml
         run: >
           dotnet test
           --project tests/Varve.RdfXml.Tests/Varve.RdfXml.Tests.csproj
           --configuration Release
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.RdfXml.Tests
 
       - name: Test Varve.JsonLd
         run: >
           dotnet test
           --project tests/Varve.JsonLd.Tests/Varve.JsonLd.Tests.csproj
           --configuration Release
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.JsonLd.Tests
 
       - name: Test Varve.Delta
         run: >
           dotnet test
           --project tests/Varve.Delta.Tests/Varve.Delta.Tests.csproj
           --configuration Release
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Delta.Tests
 
       - name: Test Varve.Json.Canonical
         run: >
           dotnet test
           --project tests/Varve.Json.Canonical.Tests/Varve.Json.Canonical.Tests.csproj
           --configuration Release
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Json.Canonical.Tests
 
       - name: Test Varve.Events
         run: >
           dotnet test
           --project tests/Varve.Events.Tests/Varve.Events.Tests.csproj
           --configuration Release
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Events.Tests
 
       - name: Test Varve.Management
         run: >
           dotnet test
           --project tests/Varve.Management.Tests/Varve.Management.Tests.csproj
           --configuration Release
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Management.Tests
 
       - name: Test Varve.Store
+        # #126: about twice the slowest green run, so a hang fails in an hour
+        # rather than at the six-hour job limit; the hang dump fires first,
+        # when no test has ended for 15 minutes, and names the tests in flight.
+        # The longest gap between two tests ending was 9.0 minutes on Windows.
+        timeout-minutes: ${{ matrix.os == 'windows-latest' && 65 || 35 }}
         run: >
           dotnet test
           --project tests/Varve.Store.Tests/Varve.Store.Tests.csproj
           --configuration Release
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Store.Tests
+          --hangdump
+          --hangdump-timeout 15m
+
+      - name: Store test durations
+        # #126: the slowest tests and the classes that held the parallel slots,
+        # in the job summary, from the step's own TRX.
+        if: always()
+        run: >
+          dotnet run eng/test-durations.cs --
+          ${{ github.workspace }}/artifacts/test-results/Varve.Store.Tests
+          --label "Varve.Store.Tests on ${{ matrix.os }}"
 
       - name: Test Varve.Xsd
         run: >
           dotnet test
           --project tests/Varve.Xsd.Tests/Varve.Xsd.Tests.csproj
           --configuration Release
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Xsd.Tests
 
       - name: Test Varve.Sparql
         run: >
           dotnet test
           --project tests/Varve.Sparql.Tests/Varve.Sparql.Tests.csproj
           --configuration Release
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Sparql.Tests
 
       - name: Test Varve.Sparql.Results
         run: >
           dotnet test
           --project tests/Varve.Sparql.Results.Tests/Varve.Sparql.Results.Tests.csproj
           --configuration Release
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Sparql.Results.Tests
 
       - name: Test Varve.Sparql.Evaluation
         run: >
           dotnet test
           --project tests/Varve.Sparql.Evaluation.Tests/Varve.Sparql.Evaluation.Tests.csproj
           --configuration Release
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Sparql.Evaluation.Tests
 
       - name: Test Varve.Sparql.Store
         run: >
           dotnet test
           --project tests/Varve.Sparql.Store.Tests/Varve.Sparql.Store.Tests.csproj
           --configuration Release
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Sparql.Store.Tests
 
       - name: Test Varve.Shacl
         run: >
           dotnet test
           --project tests/Varve.Shacl.Tests/Varve.Shacl.Tests.csproj
           --configuration Release
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Shacl.Tests
 
       - name: Test Varve.Shacl.Sparql
         run: >
           dotnet test
           --project tests/Varve.Shacl.Sparql.Tests/Varve.Shacl.Sparql.Tests.csproj
           --configuration Release
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Shacl.Sparql.Tests
 
       - name: Test Varve.Protocol
         run: >
           dotnet test
           --project tests/Varve.Protocol.Tests/Varve.Protocol.Tests.csproj
           --configuration Release
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Protocol.Tests
 
       # Built with the solution since 7b and never run by CI until the
       # Client and integration milestone's second part found the gap.
@@ -375,6 +441,8 @@ jobs:
           dotnet test
           --project tests/Varve.Protocol.Client.Tests/Varve.Protocol.Client.Tests.csproj
           --configuration Release
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Protocol.Client.Tests
 
       # Layer (a) of ADR 0100: the permission matrix and every way a token can
       # be wrong, against an issuer in the test, on every platform.
@@ -383,6 +451,8 @@ jobs:
           dotnet test
           --project tests/Varve.Server.Tests/Varve.Server.Tests.csproj
           --configuration Release
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Server.Tests
 
       # tools/repo-standard: its own solution, built and tested on both
       # platforms (ADR 0039). Not packed: it is not published from here.
@@ -394,6 +464,8 @@ jobs:
           dotnet test
           --project tools/repo-standard/tests/RepoStandard.Tests/RepoStandard.Tests.csproj
           --configuration Release
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/RepoStandard.Tests
 
       # The publish dry run. A version pushed to nuget.org cannot be edited,
       # replaced or deleted, so the pack step and its output are exercised on
@@ -410,6 +482,16 @@ jobs:
       - name: Check the package metadata
         run: dotnet run eng/package-metadata.cs -- ${{ github.workspace }}/artifacts/packages
 
+      - name: Upload the test results
+        # #126: every run keeps its TRX, pass or fail, so a slow or red run
+        # can be explained test by test from its own artifacts.
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: test-results-build-${{ matrix.os }}
+          path: ${{ github.workspace }}/artifacts/test-results
+          if-no-files-found: warn
+
   # Constraint 2, proven rather than configured. An analyzer only sees what it
   # can see statically; only an ILC run shows the packages publish, and only
   # running the binary shows the interesting AOT failures — a trimmed type, a
@@ -538,6 +620,18 @@ jobs:
           --project tests/Varve.Server.Tests/Varve.Server.Tests.csproj
           --configuration Release
           --filter-class Varve.Server.Tests.ProviderTests
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Server.Tests
+
+      - name: Upload the test results
+        # #126: every run keeps its TRX, pass or fail, so a slow or red run
+        # can be explained test by test from its own artifacts.
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: test-results-auth-mock-oauth2
+          path: ${{ github.workspace }}/artifacts/test-results
+          if-no-files-found: warn
 
   # The object-storage legs (ADR 0134): the storage contract suite and the
   # object-store contract, race properties included, against Azurite and the
@@ -584,6 +678,8 @@ jobs:
           exit 1
 
       - name: Test against them
+        # #126: about twice its slowest green run, with the hang dump below it.
+        timeout-minutes: 10
         env:
           VARVE_AZURITE: http://127.0.0.1:10000/devstoreaccount1
           VARVE_RUSTFS: http://127.0.0.1:9000,varvetest,varvetestsecret
@@ -593,6 +689,17 @@ jobs:
           --project tests/Varve.Store.Tests/Varve.Store.Tests.csproj
           --configuration Release
           --filter-namespace Varve.Store.Tests.Objects
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Store.Tests
+          --hangdump
+          --hangdump-timeout 5m
+
+      - name: Store test durations
+        if: always()
+        run: >
+          dotnet run eng/test-durations.cs --
+          ${{ github.workspace }}/artifacts/test-results/Varve.Store.Tests
+          --label "Varve.Store.Tests.Objects against the services"
 
       # A server's datasets in the container: a second server takes one over,
       # the first answers writes with writer-superseded, and varve lease
@@ -606,6 +713,18 @@ jobs:
           --project tests/Varve.Server.Tests/Varve.Server.Tests.csproj
           --configuration Release
           --filter-class Varve.Server.Tests.ObjectStorageServerTests
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Server.Tests
+
+      - name: Upload the test results
+        # #126: every run keeps its TRX, pass or fail, so a slow or red run
+        # can be explained test by test from its own artifacts.
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: test-results-storage-services
+          path: ${{ github.workspace }}/artifacts/test-results
+          if-no-files-found: warn
 
   # The fleet (ADRs 0163, 0164, 0168): two server processes on one Azurite
   # container, the system writer and a follower that forwards. Its own job,
@@ -657,6 +776,18 @@ jobs:
           --project tests/Varve.Server.Tests/Varve.Server.Tests.csproj
           --configuration Release
           --filter-class Varve.Server.Tests.FleetTests
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Server.Tests
+
+      - name: Upload the test results
+        # #126: every run keeps its TRX, pass or fail, so a slow or red run
+        # can be explained test by test from its own artifacts.
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: test-results-fleet-services
+          path: ${{ github.workspace }}/artifacts/test-results
+          if-no-files-found: warn
 
   # The REC generator's bytes on both architectures (ADR 0141): its tests pin
   # each size's SHA-256, so a pass on each runner is the same bytes on both.
@@ -685,7 +816,17 @@ jobs:
           global-json-file: global.json
 
       - name: Generate S, M and L and compare
-        run: dotnet test --project tests/Varve.Rec.Tests/Varve.Rec.Tests.csproj --configuration Release
+        run: dotnet test --project tests/Varve.Rec.Tests/Varve.Rec.Tests.csproj --configuration Release --report-trx --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Rec.Tests
+
+      - name: Upload the test results
+        # #126: every run keeps its TRX, pass or fail, so a slow or red run
+        # can be explained test by test from its own artifacts.
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: test-results-rec-generator-${{ matrix.rid }}
+          path: ${{ github.workspace }}/artifacts/test-results
+          if-no-files-found: warn
 
   # Auth test layer (c) (ADR 0100): Zitadel and PostgreSQL, a real provider,
   # started by compose and seeded through its API by eng/zitadel-seed.cs. One
@@ -733,11 +874,23 @@ jobs:
           --project tests/Varve.Server.Tests/Varve.Server.Tests.csproj
           --configuration Release
           --filter-class Varve.Server.Tests.ProviderTests
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Server.Tests
 
       - name: Zitadel's log
         if: failure()
         run: docker compose --file .github/zitadel/compose.yaml logs zitadel
 
+      - name: Upload the test results
+        # #126: every run keeps its TRX, pass or fail, so a slow or red run
+        # can be explained test by test from its own artifacts.
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: test-results-auth-zitadel
+          path: ${{ github.workspace }}/artifacts/test-results
+          if-no-files-found: warn
+
   # The real-provider legs (ADR 0100): one test each for Entra ID and Google,
   # with secrets from the auth-providers environment, which only main can
   # deploy to — so no pull request, and no fork, ever sees them. Not a required
@@ -772,6 +925,18 @@ jobs:
           --project tests/Varve.Server.Tests/Varve.Server.Tests.csproj
           --configuration Release
           --filter-class Varve.Server.Tests.ProviderTests
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Server.Tests
+
+      - name: Upload the test results
+        # #126: every run keeps its TRX, pass or fail, so a slow or red run
+        # can be explained test by test from its own artifacts.
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: test-results-auth-providers
+          path: ${{ github.workspace }}/artifacts/test-results
+          if-no-files-found: warn
 
   # The container image (ADR 0111): the Native AOT binary published on a
   # native runner for its architecture, built into the chiseled image, pushed
@@ -985,6 +1150,8 @@ jobs:
           --project tests/Varve.Server.Tests/Varve.Server.Tests.csproj
           --configuration Release
           --filter-class Varve.Server.Tests.ProviderTests
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Server.Tests
 
       - name: Stop the mock and its container
         if: always() && matrix.rid == 'linux-x64'
@@ -1063,6 +1230,8 @@ jobs:
           --project tests/Varve.Server.Tests/Varve.Server.Tests.csproj
           --configuration Release
           --filter-class Varve.Server.Tests.ProviderTests
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Server.Tests
 
       - name: Stop Zitadel and its container
         if: always() && matrix.rid == 'linux-x64'
@@ -1079,6 +1248,16 @@ jobs:
           path: ${{ github.workspace }}/artifacts/container-protocol
           if-no-files-found: warn
 
+      - name: Upload the test results
+        # #126: every run keeps its TRX, pass or fail, so a slow or red run
+        # can be explained test by test from its own artifacts.
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: test-results-container-${{ matrix.rid }}
+          path: ${{ github.workspace }}/artifacts/test-results
+          if-no-files-found: warn
+
   # The Aspire sample (ADR 0117): the AppHost starts the server's container
   # beside the test issuer and its test passes a token, an update and a
   # query. The image is the one the container job just pushed for this
@@ -1128,6 +1307,18 @@ jobs:
           dotnet test
           --project samples/Varve.Aspire.Sample.Tests/Varve.Aspire.Sample.Tests.csproj
           --configuration Release
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Aspire.Sample.Tests
+
+      - name: Upload the test results
+        # #126: every run keeps its TRX, pass or fail, so a slow or red run
+        # can be explained test by test from its own artifacts.
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: test-results-aspire
+          path: ${{ github.workspace }}/artifacts/test-results
+          if-no-files-found: warn
 
   # Durability, measured per platform (ADR 0073): what an append and a flush
   # to the device cost on each runner, with the calls the file backend makes.
@@ -1183,6 +1374,18 @@ jobs:
           dotnet test
           --project samples/Varve.OnBehalfOf.Sample.Tests/Varve.OnBehalfOf.Sample.Tests.csproj
           --configuration Release
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.OnBehalfOf.Sample.Tests
+
+      - name: Upload the test results
+        # #126: every run keeps its TRX, pass or fail, so a slow or red run
+        # can be explained test by test from its own artifacts.
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: test-results-samples
+          path: ${{ github.workspace }}/artifacts/test-results
+          if-no-files-found: warn
 
   # The Event Hubs bridge sample (ADRs 0143, 0146): the emulator and Azurite
   # started by compose, and the sample's test, which runs Varve as a process,
@@ -1228,6 +1431,8 @@ jobs:
           dotnet test
           --project samples/Varve.EventHubs.Sample.Tests/Varve.EventHubs.Sample.Tests.csproj
           --configuration Release
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.EventHubs.Sample.Tests
 
       - name: The emulator's log
         if: failure()
@@ -1237,6 +1442,16 @@ jobs:
         if: always()
         run: docker compose --file .github/eventhubs/compose.yaml down || true
 
+      - name: Upload the test results
+        # #126: every run keeps its TRX, pass or fail, so a slow or red run
+        # can be explained test by test from its own artifacts.
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: test-results-samples-eventhubs
+          path: ${{ github.workspace }}/artifacts/test-results
+          if-no-files-found: warn
+
   # The Entra registrations of the on-behalf-of chain build (ADR 0127): the
   # Bicep CLI the runner's Azure CLI carries, and the Microsoft Graph
   # extension from mcr.microsoft.com. Nothing is deployed.
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
new file mode 100644
index 00000000..4ba440ae
--- /dev/null
+++ b/.github/workflows/nightly.yml
@@ -0,0 +1,106 @@
+# The store's searches at their full depth, every night on main (#126).
+#
+# Some of the store's tests search a space wider than a pull request can wait
+# for. On a pull request each explores a share of it; here, every variable in
+# docs/testing.md section 8 is set, and each explores the whole: as much as
+# the gate explored before #126, or more. The property each test proves is the
+# same at either depth.
+#
+# Not a required check: it runs after the commits it tests have landed. A red
+# night is a defect on main, found the next morning instead of never. #129 may
+# make this run a release's gate.
+#
+# No container: the suites here run in process. The services legs keep their
+# own job in ci.yml and its images in .github/ci-images.yaml.
+name: Nightly
+
+on:
+  schedule:
+    # 02:41 UTC every day: off the hour, as GitHub asks of scheduled workflows.
+    - cron: "41 2 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  DOTNET_NOLOGO: "true"
+  DOTNET_CLI_TELEMETRY_OPTOUT: "true"
+  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: "true"
+  NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages
+
+jobs:
+  store:
+    name: store, full depth (${{ matrix.os }})
+    if: github.ref == 'refs/heads/main'
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+
+    steps:
+      - name: Line endings
+        # As the build job: the bytes tested are the bytes committed (ADR 0036).
+        shell: bash
+        run: git config --global core.autocrlf false
+
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Set up .NET
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
+        with:
+          global-json-file: global.json
+
+      - name: Cache NuGet packages
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+        with:
+          path: ${{ env.NUGET_PACKAGES }}
+          key: nuget-${{ runner.os }}-${{ hashFiles('Directory.Packages.props') }}
+          restore-keys: nuget-${{ runner.os }}-
+
+      - name: Build
+        run: dotnet build tests/Varve.Store.Tests/Varve.Store.Tests.csproj --configuration Release
+
+      - name: Temporary folder on the runner's temporary drive
+        # As the build job (#126): the tests' temporary folder on D:, not C:.
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          "TEMP=$env:RUNNER_TEMP" >> $env:GITHUB_ENV
+          "TMP=$env:RUNNER_TEMP" >> $env:GITHUB_ENV
+
+      - name: Test Varve.Store at full depth
+        # The pull request's depth runs in the build job; this is the rest.
+        # Each value covers the whole of its search (docs/testing.md §8). The
+        # crash during recovery at stride 1 runs alone for most of an hour on
+        # Windows with no other test ending, so the hang dump waits longer.
+        timeout-minutes: 150
+        env:
+          VARVE_FAULT_RECOVERY_STRIDE: "1"
+          VARVE_CACHE_DAMAGE_STRIDE: "1"
+        run: >
+          dotnet test
+          --project tests/Varve.Store.Tests/Varve.Store.Tests.csproj
+          --configuration Release
+          --no-build
+          --report-trx
+          --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Store.Tests
+          --hangdump
+          --hangdump-timeout 100m
+
+      - name: Store test durations
+        if: always()
+        run: >
+          dotnet run eng/test-durations.cs --
+          ${{ github.workspace }}/artifacts/test-results/Varve.Store.Tests
+          --label "Varve.Store.Tests at full depth on ${{ matrix.os }}"
+
+      - name: Upload the test results
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: test-results-nightly-${{ matrix.os }}
+          path: ${{ github.workspace }}/artifacts/test-results
+          if-no-files-found: warn
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index a50d39ea..a6fc043d 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -101,49 +101,51 @@ jobs:
         run: dotnet build Varve.slnx --configuration Release --no-restore
 
       - name: Test the analyzers
-        run: dotnet test --project tests/Varve.Analyzers.Tests/Varve.Analyzers.Tests.csproj --configuration Release
+        run: dotnet test --project tests/Varve.Analyzers.Tests/Varve.Analyzers.Tests.csproj --configuration Release --report-trx --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Analyzers.Tests
 
       - name: Test Varve.Iri
-        run: dotnet test --project tests/Varve.Iri.Tests/Varve.Iri.Tests.csproj --configuration Release
+        run: dotnet test --project tests/Varve.Iri.Tests/Varve.Iri.Tests.csproj --configuration Release --report-trx --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Iri.Tests
 
       - name: Test Varve.Rdf
-        run: dotnet test --project tests/Varve.Rdf.Tests/Varve.Rdf.Tests.csproj --configuration Release
+        run: dotnet test --project tests/Varve.Rdf.Tests/Varve.Rdf.Tests.csproj --configuration Release --report-trx --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Rdf.Tests
 
       - name: Test Varve.Turtle
-        run: dotnet test --project tests/Varve.Turtle.Tests/Varve.Turtle.Tests.csproj --configuration Release
+        run: dotnet test --project tests/Varve.Turtle.Tests/Varve.Turtle.Tests.csproj --configuration Release --report-trx --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Turtle.Tests
 
       - name: Test Varve.RdfXml
-        run: dotnet test --project tests/Varve.RdfXml.Tests/Varve.RdfXml.Tests.csproj --configuration Release
+        run: dotnet test --project tests/Varve.RdfXml.Tests/Varve.RdfXml.Tests.csproj --configuration Release --report-trx --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.RdfXml.Tests
 
       - name: Test Varve.JsonLd
-        run: dotnet test --project tests/Varve.JsonLd.Tests/Varve.JsonLd.Tests.csproj --configuration Release
+        run: dotnet test --project tests/Varve.JsonLd.Tests/Varve.JsonLd.Tests.csproj --configuration Release --report-trx --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.JsonLd.Tests
 
       - name: Test Varve.Delta
-        run: dotnet test --project tests/Varve.Delta.Tests/Varve.Delta.Tests.csproj --configuration Release
+        run: dotnet test --project tests/Varve.Delta.Tests/Varve.Delta.Tests.csproj --configuration Release --report-trx --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Delta.Tests
 
       - name: Test Varve.Store
-        run: dotnet test --project tests/Varve.Store.Tests/Varve.Store.Tests.csproj --configuration Release
+        # #126: the build job's Ubuntu limit and hang dump, for the same suite.
+        timeout-minutes: 35
+        run: dotnet test --project tests/Varve.Store.Tests/Varve.Store.Tests.csproj --configuration Release --report-trx --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Store.Tests --hangdump --hangdump-timeout 15m
 
       - name: Test Varve.Xsd
-        run: dotnet test --project tests/Varve.Xsd.Tests/Varve.Xsd.Tests.csproj --configuration Release
+        run: dotnet test --project tests/Varve.Xsd.Tests/Varve.Xsd.Tests.csproj --configuration Release --report-trx --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Xsd.Tests
 
       - name: Test Varve.Sparql
-        run: dotnet test --project tests/Varve.Sparql.Tests/Varve.Sparql.Tests.csproj --configuration Release
+        run: dotnet test --project tests/Varve.Sparql.Tests/Varve.Sparql.Tests.csproj --configuration Release --report-trx --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Sparql.Tests
 
       - name: Test Varve.Sparql.Results
-        run: dotnet test --project tests/Varve.Sparql.Results.Tests/Varve.Sparql.Results.Tests.csproj --configuration Release
+        run: dotnet test --project tests/Varve.Sparql.Results.Tests/Varve.Sparql.Results.Tests.csproj --configuration Release --report-trx --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Sparql.Results.Tests
 
       - name: Test Varve.Sparql.Evaluation
-        run: dotnet test --project tests/Varve.Sparql.Evaluation.Tests/Varve.Sparql.Evaluation.Tests.csproj --configuration Release
+        run: dotnet test --project tests/Varve.Sparql.Evaluation.Tests/Varve.Sparql.Evaluation.Tests.csproj --configuration Release --report-trx --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Sparql.Evaluation.Tests
 
       - name: Test Varve.Sparql.Store
-        run: dotnet test --project tests/Varve.Sparql.Store.Tests/Varve.Sparql.Store.Tests.csproj --configuration Release
+        run: dotnet test --project tests/Varve.Sparql.Store.Tests/Varve.Sparql.Store.Tests.csproj --configuration Release --report-trx --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Sparql.Store.Tests
 
       - name: Test Varve.Shacl
-        run: dotnet test --project tests/Varve.Shacl.Tests/Varve.Shacl.Tests.csproj --configuration Release
+        run: dotnet test --project tests/Varve.Shacl.Tests/Varve.Shacl.Tests.csproj --configuration Release --report-trx --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Shacl.Tests
 
       - name: Test Varve.Shacl.Sparql
-        run: dotnet test --project tests/Varve.Shacl.Sparql.Tests/Varve.Shacl.Sparql.Tests.csproj --configuration Release
+        run: dotnet test --project tests/Varve.Shacl.Sparql.Tests/Varve.Shacl.Sparql.Tests.csproj --configuration Release --report-trx --results-directory ${{ github.workspace }}/artifacts/test-results/Varve.Shacl.Sparql.Tests
 
       - name: Run the W3C suites
         continue-on-error: true
@@ -244,6 +246,16 @@ jobs:
           --source https://api.nuget.org/v3/index.json
           --skip-duplicate
 
+      - name: Upload the test results
+        # #126: every run keeps its TRX, pass or fail, so a slow or red run
+        # can be explained test by test from its own artifacts.
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: test-results-publish
+          path: ${{ github.workspace }}/artifacts/test-results
+          if-no-files-found: warn
+
   # The container image (ADR 0111), after the gates: the Native AOT binary
   # published on a native runner per architecture, built into the chiseled
   # image and pushed by digest; the manifest job joins the two, tags the
diff --git a/Directory.Packages.props b/Directory.Packages.props
index 50244a65..fd61865e 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -188,6 +188,7 @@
   <ItemGroup Label="Test-time">
     <PackageVersion Include="xunit.v3" Version="4.0.1" Adr="0009" />
     <PackageVersion Include="Microsoft.Testing.Extensions.TrxReport" Version="2.4.1" Adr="0007" />
+    <PackageVersion Include="Microsoft.Testing.Extensions.HangDump" Version="2.4.1" Adr="0007" />
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Analyzer.Testing" Version="1.1.4" Adr="0004" />
     <!-- A transitive dependency of the analyzer harness, pinned rather than
          inherited: Microsoft.CodeAnalysis.Analyzer.Testing asks for
diff --git a/docs/adr/0007-w3c-conformance-harness.md b/docs/adr/0007-w3c-conformance-harness.md
index d80bbca3..6bbdcae6 100644
--- a/docs/adr/0007-w3c-conformance-harness.md
+++ b/docs/adr/0007-w3c-conformance-harness.md
@@ -183,3 +183,28 @@ maintainer accepts it (ADR 0066).
 
 **The ledger.** No ruling changes; `W3cSuitesPinnedSubmodule` and
 `ConformanceRatchet` cover the new suites as written.
+
+## Amendment, 2026-10-19 — `Microsoft.Testing.Extensions.HangDump`
+
+Filed by #126, unaccepted until the maintainer accepts it (ADR 0066).
+
+- **The need.** No step that runs `Varve.Store.Tests` had a time limit or a
+  dump: a hang held a runner to GitHub's six-hour job limit and named no
+  test. Each such step now has `timeout-minutes`, and below it
+  `--hangdump --hangdump-timeout <t>`, which writes a dump of the test host
+  when no test has reported for `<t>` and names the tests in flight. VSTest's
+  `--blame-hang-timeout` is not available: this repository runs on
+  Microsoft.Testing.Platform (ADR 0006).
+- **The entry.** `Microsoft.Testing.Extensions.HangDump` 2.4.1, the same
+  platform line as `Microsoft.Testing.Extensions.TrxReport` 2.4.1, which this
+  ADR already admits for the same reason: an extension the platform does not
+  build in. Test-time only, referenced by `Varve.Store.Tests` alone, never by
+  anything packable. MIT and managed; it brings
+  `Microsoft.Diagnostics.NETCore.Client` 0.2.607501 (MIT, managed, the
+  runtime's diagnostics client) and `Microsoft.Extensions.Logging.Abstractions`
+  transitively, neither with a native asset.
+- **When it leaves.** When the platform builds hang dumps in, or the store
+  tests stop being the long step a hang would hide in.
+
+**The ledger.** The ruling of this block is `HangDumpForTheStoreTests`,
+unaccepted until the maintainer accepts it.
diff --git a/docs/decisions/w3c-conformance-harness.md b/docs/decisions/w3c-conformance-harness.md
index 110ebfc7..b16192bc 100644
--- a/docs/decisions/w3c-conformance-harness.md
+++ b/docs/decisions/w3c-conformance-harness.md
@@ -39,6 +39,8 @@ decisions:
     statement: "eng/ scripts are C# file-based apps run with dotnet run, one implementation for every operating system"
     accepted-by: mailto:emil@okkels-klein.dk
     accepted-at: 2026-09-20T00:00:00Z
+  - key: HangDumpForTheStoreTests
+    statement: "Microsoft.Testing.Extensions.HangDump is a test-time register entry under this ADR, referenced by Varve.Store.Tests alone, so a hang in a store-test step writes a dump naming its tests before the step's time limit; amended 2026-10-19"
 ---
 
 The rulings of [ADR 0007](../adr/0007-w3c-conformance-harness.md) still in force, one line each. The ADR is the
@@ -47,3 +49,5 @@ narrative; this is what code cites. Acceptance is transcribed from the ADR's Sta
 `ManifestsReadByVarveTurtle` is the exit criterion's outcome, recorded by the undated
 "Met at milestone 3b" note inside the ADR; it carries 2026-09-22, the date of the milestone
 3b record, and replaces the temporary dotNetRdf.Core reader the ADR first decided.
+
+`HangDumpForTheStoreTests` is the amendment of 2026-10-19 (#126), filed unaccepted (ADR 0066).
diff --git a/docs/spec/storage-format.md b/docs/spec/storage-format.md
index 9446f1d3..e929ee82 100644
--- a/docs/spec/storage-format.md
+++ b/docs/spec/storage-format.md
@@ -49,9 +49,10 @@ storage contract that writes them is ADRs 0018, 0040 and 0071.
     00000001.seg
     …
   derived/
-    .gitignore          "*", written at creation
+    .gitignore          "*", written at open when it is not; not flushed
     LOCK                the lease (ADR 0075), held open; not a blob
-    LOCK.owner          who holds it, for the refusal's message; not a blob
+    LOCK.owner          who holds it, for the refusal's message; not a blob,
+                        not flushed
     checkpoints/<P>
     checkpoints/<P>.graphs   the graph-version index at P (ADR 0125)
     index/state
diff --git a/docs/testing.md b/docs/testing.md
index 490da336..81ff65bd 100644
--- a/docs/testing.md
+++ b/docs/testing.md
@@ -230,3 +230,34 @@ merges and deletions runs against Azurite and RustFS as well, in the
 are run with merges off (`T.Options()`); the merge suites turn them on and
 drive maintenance by hand, because a second dataset opened over one memory
 storage, which only one process may write, would race a background merge.
+
+## 8. How long the tests take
+
+Every `dotnet test` step in CI writes a TRX and uploads it, pass or fail,
+and the store's steps write their slowest tests, and the classes that held
+the parallel slots, to the job summary (`eng/test-durations.cs`, #126). A
+slow run is explained from its own artifacts; two runs compare test by test.
+Each store step has a time limit at about twice its slowest green run, and a
+hang dump below it that names the tests in flight.
+
+Some searches are wider than a pull request can wait for. Each such test
+explores a pull request's share of its space by default, and the whole of
+it when its variable is set. **The property is the same at either depth**;
+only how much of the space is searched changes, and the pull request's share
+is a subset of the nightly's. Where a share is chosen by a seed, each run
+draws a new one, so that pull requests between them search the whole space;
+the seed starts the test's output and any failure's message, and its
+variable replays the run. The nightly run (`.github/workflows/nightly.yml`,
+on `main`) sets every depth below.
+
+| Variable | Test | Pull request | Nightly |
+|---|---|---:|---:|
+| `VARVE_FAULT_RECOVERY_STRIDE` | `FaultInjectionTests.CrashDuringRecovery.a_crash_during_recovery_recovers`: crashes the workload at every *n*th of its 1,428 operations, then its recovery at every operation | 25, from operation 1 + seed mod 25 (about 11,500 points) | 1 (about 288,000 points; the gate's was 5, 57,679) |
+| `VARVE_FAULT_RECOVERY_SEED` | the same: the seed that chooses where a pull request's share starts | a new one each run | n/a at stride 1 |
+| `VARVE_CACHE_DAMAGE_STRIDE` | `Objects.ObjectCacheTests.a_commit_index_blob_cut_short_or_with_its_verified_bytes_zeroed_is_a_miss`: reopens a cache whose commit index blob is cut or has a verified byte zeroed, one case in *n* | 8, from case seed mod 8 (69 of 552 cases) | 1 (all 552) |
+| `VARVE_CACHE_DAMAGE_SEED` | the same: the seed that chooses which eighth | a new one each run | n/a at stride 1 |
+
+The variables of §6 that hunt rather than gate (`VARVE_FAULT_SEEDS`,
+`VARVE_OBJECT_FAULT_SEEDS`, `VARVE_OBJECT_FAULT_STEPS`,
+`VARVE_HTTP_FAULT_STEPS`) stay what they were: neither a pull request nor the
+nightly run sets them.
diff --git a/eng/test-durations.cs b/eng/test-durations.cs
new file mode 100644
index 00000000..baf08962
--- /dev/null
+++ b/eng/test-durations.cs
@@ -0,0 +1,217 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+// Test durations from a run's TRX.
+//
+//   dotnet run eng/test-durations.cs -- <trx-file-or-directory> [--top <n>] [--label <text>]
+//
+// Writes the slowest tests of a run, and the classes that held the run's
+// parallel slots, to standard output and to the job summary. #126: the store
+// suite's step went from 8 to 27–54 minutes on Windows, and nothing in the log
+// said where the time went, because Microsoft.Testing.Platform prints only
+// failed and skipped tests.
+//
+// Two tables:
+//   - the <n> slowest tests (default 20), by their own duration;
+//   - the slowest classes by their busy time (the sum of their tests'
+//     durations), with the minutes into the run at which each class's first
+//     test started and its last test ended. A class whose last test ends long
+//     after every other class's is the tail the step waits for.
+//
+// It reads every *.trx under a directory, so a step that writes several (a
+// re-run, a filter run twice) is read as one run.
+//
+// Exit codes: 0 written, 2 could not run. No TRX at all is reported and exits
+// 0: the step that should have written it has already failed, and a second red
+// step would say nothing new.
+//
+// See docs/testing.md, "How long the tests take".
+
+using System.Globalization;
+using System.Text;
+using System.Xml.Linq;
+
+XNamespace trxNs = "http://microsoft.com/schemas/VisualStudio/TeamTest/2010";
+
+if (args.Length == 0)
+{
+    Console.Error.WriteLine("usage: dotnet run eng/test-durations.cs -- <trx-file-or-directory> [--top <n>] [--label <text>]");
+    return 2;
+}
+
+string input = args[0];
+int top = 20;
+string? label = null;
+for (int i = 1; i < args.Length - 1; i++)
+{
+    switch (args[i])
+    {
+        case "--top" when int.TryParse(args[i + 1], NumberStyles.None, CultureInfo.InvariantCulture, out int n) && n > 0:
+            top = n;
+            break;
+        case "--label":
+            label = args[i + 1];
+            break;
+        default:
+            break;
+    }
+}
+
+string[] files = File.Exists(input)
+    ? [input]
+    : Directory.Exists(input)
+        ? Directory.GetFiles(input, "*.trx", SearchOption.AllDirectories)
+        : [];
+
+var output = new StringBuilder();
+output.AppendLine(CultureInfo.InvariantCulture, $"### Test durations{(label is null ? "" : $" — {label}")}");
+output.AppendLine();
+
+if (files.Length == 0)
+{
+    output.AppendLine(CultureInfo.InvariantCulture, $"No TRX under `{input}`: the test step did not write one.");
+    Emit(output.ToString());
+    return 0;
+}
+
+var results = new List<Result>();
+foreach (string file in files)
+{
+    XDocument document;
+    try
+    {
+        document = XDocument.Load(file);
+    }
+    catch (System.Xml.XmlException e)
+    {
+        Console.Error.WriteLine($"{file}: not a TRX ({e.Message})");
+        return 2;
+    }
+
+    // The class is on the definition, the duration on the result; testId joins them.
+    var classes = new Dictionary<string, string>(StringComparer.Ordinal);
+    foreach (XElement test in document.Descendants(trxNs + "UnitTest"))
+    {
+        string? id = (string?)test.Attribute("id");
+        string? className = (string?)test.Element(trxNs + "TestMethod")?.Attribute("className");
+        if (id is not null && className is not null)
+        {
+            classes[id] = className;
+        }
+    }
+
+    foreach (XElement result in document.Descendants(trxNs + "UnitTestResult"))
+    {
+        string name = (string?)result.Attribute("testName") ?? "?";
+        string id = (string?)result.Attribute("testId") ?? "";
+        string outcome = (string?)result.Attribute("outcome") ?? "?";
+        TimeSpan duration = TimeSpan.TryParse((string?)result.Attribute("duration"), CultureInfo.InvariantCulture, out TimeSpan d) ? d : TimeSpan.Zero;
+        DateTimeOffset? start = DateTimeOffset.TryParse((string?)result.Attribute("startTime"), CultureInfo.InvariantCulture, DateTimeStyles.None, out DateTimeOffset s) ? s : null;
+        DateTimeOffset? end = DateTimeOffset.TryParse((string?)result.Attribute("endTime"), CultureInfo.InvariantCulture, DateTimeStyles.None, out DateTimeOffset e) ? e : null;
+        string className = classes.TryGetValue(id, out string? c) ? c : "?";
+        results.Add(new Result(className, name, outcome, duration, start, end));
+    }
+}
+
+// The namespace every class shares is dropped from the tables, so a suite's
+// classes read as SmokeTests and Faults.FaultInjectionTests.
+string sharedNamespace = SharedNamespace(results.Select(r => r.Class).Where(c => c != "?").Distinct(StringComparer.Ordinal).ToList());
+
+DateTimeOffset? runStart = results.Where(r => r.Start is not null).Select(r => r.Start).Min();
+DateTimeOffset? runEnd = results.Where(r => r.End is not null).Select(r => r.End).Max();
+TimeSpan busy = results.Aggregate(TimeSpan.Zero, (sum, r) => sum + r.Duration);
+
+output.AppendLine(CultureInfo.InvariantCulture,
+    $"{results.Count} results from {files.Length} TRX; first start to last end {Minutes(runEnd - runStart)}; busy time (sum of durations) {Minutes(busy)}.");
+output.AppendLine();
+output.AppendLine("| # | Duration | Outcome | Class | Test |");
+output.AppendLine("|---:|---:|---|---|---|");
+int rank = 0;
+foreach (Result r in results.OrderByDescending(r => r.Duration).Take(top))
+{
+    output.AppendLine(CultureInfo.InvariantCulture,
+        $"| {++rank} | {Minutes(r.Duration)} | {r.Outcome} | {Cell(Short(r.Class))} | {Cell(Method(r))} |");
+}
+
+output.AppendLine();
+output.AppendLine("Classes by busy time; *from* and *to* are minutes into the run of the class's first start and last end.");
+output.AppendLine();
+output.AppendLine("| Class | Tests | Busy | From | To |");
+output.AppendLine("|---|---:|---:|---:|---:|");
+foreach (IGrouping<string, Result> group in results
+    .GroupBy(r => r.Class, StringComparer.Ordinal)
+    .OrderByDescending(g => g.Sum(r => r.Duration.Ticks))
+    .Take(top))
+{
+    TimeSpan classBusy = TimeSpan.FromTicks(group.Sum(r => r.Duration.Ticks));
+    DateTimeOffset? from = group.Where(r => r.Start is not null).Select(r => r.Start).Min();
+    DateTimeOffset? to = group.Where(r => r.End is not null).Select(r => r.End).Max();
+    output.AppendLine(CultureInfo.InvariantCulture,
+        $"| {Cell(Short(group.Key))} | {group.Count()} | {Minutes(classBusy)} | {Offset(from)} | {Offset(to)} |");
+}
+
+Emit(output.ToString());
+return 0;
+
+string Offset(DateTimeOffset? at) =>
+    at is { } value && runStart is { } origin
+        ? (value - origin).TotalMinutes.ToString("0.0", CultureInfo.InvariantCulture)
+        : "?";
+
+static string Minutes(TimeSpan? span) =>
+    span is not { } value ? "?"
+    : value.TotalMinutes >= 1
+        ? string.Create(CultureInfo.InvariantCulture, $"{(int)value.TotalMinutes}m {value.Seconds:00}s")
+        : string.Create(CultureInfo.InvariantCulture, $"{value.TotalSeconds:0.0}s");
+
+string Short(string className) =>
+    sharedNamespace.Length > 0 && className.StartsWith(sharedNamespace, StringComparison.Ordinal)
+        ? className[sharedNamespace.Length..]
+        : className;
+
+// The longest run of whole namespace segments, with its trailing dot, that
+// every class's namespace starts with.
+// The platform names a test by its class and method; the class has a column.
+static string Method(Result r) =>
+    r.Name.StartsWith(r.Class + ".", StringComparison.Ordinal) ? r.Name[(r.Class.Length + 1)..] : r.Name;
+
+static string SharedNamespace(List<string> classes)
+{
+    if (classes.Count == 0)
+    {
+        return "";
+    }
+
+    string[] shared = classes[0].Split('.')[..^1];
+    foreach (string className in classes.Skip(1))
+    {
+        string[] parts = className.Split('.')[..^1];
+        int same = 0;
+        while (same < shared.Length && same < parts.Length && shared[same] == parts[same])
+        {
+            same++;
+        }
+
+        shared = shared[..same];
+    }
+
+    return shared.Length == 0 ? "" : string.Join('.', shared) + ".";
+}
+
+static string Cell(string text)
+{
+    string escaped = text.Replace("|", "\\|", StringComparison.Ordinal).Replace("\n", " ", StringComparison.Ordinal);
+    return escaped.Length <= 160 ? escaped : string.Concat(escaped.AsSpan(0, 157), "...");
+}
+
+static void Emit(string text)
+{
+    Console.Write(text);
+    if (Environment.GetEnvironmentVariable("GITHUB_STEP_SUMMARY") is { Length: > 0 } summary)
+    {
+        File.AppendAllText(summary, text + Environment.NewLine);
+    }
+}
+
+sealed record Result(string Class, string Name, string Outcome, TimeSpan Duration, DateTimeOffset? Start, DateTimeOffset? End);
diff --git a/src/Varve.Store/FileStorage.cs b/src/Varve.Store/FileStorage.cs
index 9c35bcb5..e777b9ea 100644
--- a/src/Varve.Store/FileStorage.cs
+++ b/src/Varve.Store/FileStorage.cs
@@ -65,6 +65,7 @@ public sealed class FileStorage : IStorage, IAsyncDisposable
     private const string LockName = "LOCK";
     private const string OwnerName = "LOCK.owner";
     private const string IgnoreName = ".gitignore";
+    private const string Ignore = "*\n";
 
     private readonly IFileSystem _files;
     private readonly IDisposable _lease;
@@ -120,16 +121,18 @@ internal static FileStorage Open(IFileSystem files, DatasetDirectory directory,
         files.CreateDirectory(derived);
 
         IDisposable lease = files.TryLock(Path.Combine(derived, LockName))
-            ?? throw new DatasetLeasedException(directory, ReadOwner(files, Path.Combine(derived, OwnerName)));
+            ?? throw new DatasetLeasedException(directory, ReadSmallFile(files, Path.Combine(derived, OwnerName)));
 
         try
         {
             WriteSmallFile(files, Path.Combine(derived, OwnerName), Owner(options.Clock));
             string ignore = Path.Combine(derived, IgnoreName);
 
-            if (!files.FileExists(ignore))
+            // Rewritten whenever it is not what it should be, since it is not
+            // flushed: one a power loss tore is whole again at the next open.
+            if (ReadSmallFile(files, ignore) != Ignore)
             {
-                WriteSmallFile(files, ignore, "*\n");
+                WriteSmallFile(files, ignore, Ignore);
             }
 
             FileStorage storage = new(files, directory, lease);
@@ -157,7 +160,7 @@ private static string Owner(TimeProvider clock) =>
         + " on " + Environment.MachineName
         + ", since " + clock.GetUtcNow().ToString("O", CultureInfo.InvariantCulture);
 
-    private static string? ReadOwner(IFileSystem files, string path)
+    private static string? ReadSmallFile(IFileSystem files, string path)
     {
         try
         {
@@ -176,7 +179,13 @@ private static string Owner(TimeProvider clock) =>
         }
     }
 
-    // A small file replaced whole: written beside, flushed, renamed (ADR 0073).
+    // A small file replaced whole: written beside and renamed, so no reader
+    // sees it half written. Not flushed: neither small file is state. The
+    // owner is read only for a refusal's message (ADR 0075), and the ignore
+    // file is rewritten at open when it is not whole, so a power loss that
+    // tears either changes no answer. Flushing them cost two device flushes
+    // an open, which the object-storage backend pays at every open of its
+    // local cache (#126).
     private static void WriteSmallFile(IFileSystem files, string path, string text)
     {
         string temporary = path + TemporarySuffix;
@@ -189,7 +198,6 @@ private static void WriteSmallFile(IFileSystem files, string path, string text)
         using (IFileHandle handle = files.Open(temporary, FileOpen.CreateNew))
         {
             handle.WriteAsync(0, Encoding.UTF8.GetBytes(text), CancellationToken.None).AsTask().GetAwaiter().GetResult();
-            handle.Flush();
         }
 
         files.Move(temporary, path);
diff --git a/tests/Varve.Store.Tests/Faults/FaultInjectionTests.cs b/tests/Varve.Store.Tests/Faults/FaultInjectionTests.cs
index 3841f355..4ef15948 100644
--- a/tests/Varve.Store.Tests/Faults/FaultInjectionTests.cs
+++ b/tests/Varve.Store.Tests/Faults/FaultInjectionTests.cs
@@ -24,7 +24,12 @@ namespace Varve.Store.Tests.Faults;
 /// read equals the history of a run that never crashed, the derived state is
 /// rebuilt, and the log can be continued and reopened.
 /// </summary>
-public sealed class FaultInjectionTests
+/// <remarks>
+/// One class of tests per kind of fault, nested here beside the workload
+/// they share: xunit runs a class's tests one after another, and as one
+/// class the suite ran its 13 in series for the whole of the step (#126).
+/// </remarks>
+public static class FaultInjectionTests
 {
     private static readonly string Root = Path.GetFullPath(Path.Combine(Path.GetTempPath(), "varve-simulated", "dataset"));
 
@@ -305,525 +310,612 @@ private static void Check(bool condition, string message)
     private static void Report(string line) => TestContext.Current.TestOutputHelper?.WriteLine(line);
 
     /// <summary>
-    /// A process crash at every operation of the workload, and inside every
-    /// write at every byte offset of the log's records and segment headers and
-    /// trailers, and at the start, middle and end of every write to derived/.
-    /// What a crash keeps is everything written before it: every acknowledged
-    /// commit survives.
+    /// Where a process crash cuts a write: at every byte of a write to the log,
+    /// and at the start, middle and end of any other.
     /// </summary>
-    [Theory]
-    [InlineData(6101, 24)]
-    [InlineData(6102, 24)]
-    public async Task a_process_crash_anywhere_recovers_to_the_last_closed_commit(int seed, int steps)
-    {
-        Reference reference = await ReferenceAsync(seed, steps);
-        Dictionary<int, (int Length, string Path)> writes = reference.Writes.ToDictionary(w => w.Operation, w => (w.Length, w.Path));
-        int points = 0;
+    private static List<int> Cuts(int length, string path) =>
+        path.Contains(Path.DirectorySeparatorChar + "log" + Path.DirectorySeparatorChar, StringComparison.Ordinal)
+            ? [.. Enumerable.Range(0, length)]
+            : [.. new[] { 0, length / 2, Math.Max(0, length - 1) }.Distinct()];
 
-        for (int operation = 1; operation <= reference.Operations; operation++)
+    /// <summary>A process crash at every operation and every cut of its write, and the images those cuts are built from.</summary>
+    public sealed class ProcessCrash
+    {
+        /// <summary>
+        /// The process-crash suites build every cut of a write from one run
+        /// crashed at the write's start (#126). That image is the image a run
+        /// crashed at the cut leaves, with the same acknowledged position, file
+        /// for file and byte for byte, at every cut of every tenth write, batched
+        /// and not.
+        /// </summary>
+        [Theory]
+        [InlineData(6101, 24, 1)]
+        [InlineData(6151, 32, 4)]
+        public async Task an_image_cut_from_one_crash_is_the_image_of_a_crash_at_that_cut(int seed, int steps, int batch)
         {
-            List<int> keeps = [];
+            Reference reference = await ReferenceAsync(seed, steps, batch);
+            int compared = 0;
 
-            if (writes.TryGetValue(operation, out (int Length, string Path) write))
+            foreach ((int operation, int length, string path) in reference.Writes.Where((_, index) => index % 10 == 0))
             {
-                if (write.Path.Contains(Path.DirectorySeparatorChar + "log" + Path.DirectorySeparatorChar, StringComparison.Ordinal))
-                {
-                    keeps.AddRange(Enumerable.Range(0, write.Length));
-                }
-                else
+                int at = operation;
+                (SimulatedFileSystem once, long acknowledged) = await CrashAsync(seed, steps, op => op.Number == at ? 0 : null, batch);
+
+                foreach (int keep in Cuts(length, path))
                 {
-                    keeps.AddRange(new[] { 0, write.Length / 2, Math.Max(0, write.Length - 1) }.Distinct());
+                    int cut = keep;
+                    (SimulatedFileSystem replayed, long replayedAcknowledged) = await CrashAsync(seed, steps, op => op.Number == at ? cut : null, batch);
+                    string where = "operation " + at + ", byte " + cut + " of " + length + " to " + path;
+                    Assert.True(replayedAcknowledged == acknowledged, where + ": acknowledged " + replayedAcknowledged + " against " + acknowledged);
+                    SameFiles(replayed.Image(CrashKind.Process, new Random(at)), once.Image(CrashKind.Process, new Random(at), cut), where);
+                    compared++;
                 }
             }
-            else
+
+            Assert.True(compared > 100, "only " + compared + " cuts compared");
+            Report("cut images, seed " + seed + ": " + compared + " cuts compared");
+        }
+
+        private static void SameFiles(SimulatedFileSystem expected, SimulatedFileSystem actual, string where)
+        {
+            IReadOnlyList<string> names = expected.Files(Root);
+            Assert.True(names.SequenceEqual(actual.Files(Root)), where + ": the images hold different files");
+
+            foreach (string name in names)
             {
-                keeps.Add(0);
+                Assert.True(expected.Read(name).AsSpan().SequenceEqual(actual.Read(name)), where + ": " + name + " differs");
+                Assert.True(expected.IsReadOnly(name) == actual.IsReadOnly(name), where + ": " + name + " is sealed in one image only");
             }
+        }
+
+        /// <summary>
+        /// A process crash at every operation of the workload, and inside every
+        /// write at every byte offset of the log's records and segment headers and
+        /// trailers, and at the start, middle and end of every write to derived/.
+        /// What a crash keeps is everything written before it: every acknowledged
+        /// commit survives.
+        /// </summary>
+        [Theory]
+        [InlineData(6101, 24)]
+        [InlineData(6102, 24)]
+        public async Task a_process_crash_anywhere_recovers_to_the_last_closed_commit(int seed, int steps)
+        {
+            Reference reference = await ReferenceAsync(seed, steps);
+            Dictionary<int, (int Length, string Path)> writes = reference.Writes.ToDictionary(w => w.Operation, w => (w.Length, w.Path));
+            int points = 0;
 
-            foreach (int keep in keeps)
+            for (int operation = 1; operation <= reference.Operations; operation++)
             {
+                List<int> keeps = writes.TryGetValue(operation, out (int Length, string Path) write) ? Cuts(write.Length, write.Path) : [0];
+
+                // One run crashed at the operation's start; every cut of its write
+                // is built from it, as a run crashed at that cut would leave it.
                 int at = operation;
-                (SimulatedFileSystem crashed, long acknowledged) = await CrashAsync(seed, steps, op => op.Number == at ? keep : null);
-                await VerifyAsync(crashed.Image(CrashKind.Process, new Random(at)), reference, acknowledged, "process crash at operation " + at + ", byte " + keep);
-                points++;
+                (SimulatedFileSystem crashed, long acknowledged) = await CrashAsync(seed, steps, op => op.Number == at ? 0 : null);
+
+                foreach (int keep in keeps)
+                {
+                    await VerifyAsync(crashed.Image(CrashKind.Process, new Random(at), keep), reference, acknowledged, "process crash at operation " + at + ", byte " + keep);
+                    points++;
+                }
             }
-        }
 
-        Report("process crash, seed " + seed + ": " + reference.Operations + " operations, " + points + " injection points, head " + (reference.History.Count - 1));
+            Report("process crash, seed " + seed + ": " + reference.Operations + " operations, " + points + " injection points, head " + (reference.History.Count - 1));
+        }
     }
 
-    /// <summary>
-    /// Group commit (ADR 0124): the same workload with the requests queued four
-    /// at a time and written as one batch with one flush. A process crash at
-    /// every operation and inside every write at every byte offset of the
-    /// log's records — so inside every batch, between and within its commits —
-    /// and a power loss with writes reordered up to the flush barrier, each
-    /// recover to a closed commit no earlier than the last one acknowledged:
-    /// no request is acknowledged before its batch is durable.
-    /// </summary>
-    [Theory]
-    [InlineData(6151, 32)]
-    [InlineData(6152, 32)]
-    public async Task a_crash_inside_a_batch_recovers_to_the_last_closed_commit(int seed, int steps)
+    /// <summary>The same, inside a batch of commits written with one flush.</summary>
+    public sealed class BatchedCrash
     {
-        const int batch = 4;
-        Reference reference = await ReferenceAsync(seed, steps, batch);
-        Dictionary<int, (int Length, string Path)> writes = reference.Writes.ToDictionary(w => w.Operation, w => (w.Length, w.Path));
-        int points = 0;
-
-        for (int operation = 1; operation <= reference.Operations; operation++)
+        /// <summary>
+        /// Group commit (ADR 0124): the same workload with the requests queued four
+        /// at a time and written as one batch with one flush. A process crash at
+        /// every operation and inside every write at every byte offset of the
+        /// log's records — so inside every batch, between and within its commits —
+        /// and a power loss with writes reordered up to the flush barrier, each
+        /// recover to a closed commit no earlier than the last one acknowledged:
+        /// no request is acknowledged before its batch is durable.
+        /// </summary>
+        [Theory]
+        [InlineData(6151, 32)]
+        [InlineData(6152, 32)]
+        public async Task a_crash_inside_a_batch_recovers_to_the_last_closed_commit(int seed, int steps)
         {
-            List<int> keeps = [];
+            const int batch = 4;
+            Reference reference = await ReferenceAsync(seed, steps, batch);
+            Dictionary<int, (int Length, string Path)> writes = reference.Writes.ToDictionary(w => w.Operation, w => (w.Length, w.Path));
+            int points = 0;
 
-            if (writes.TryGetValue(operation, out (int Length, string Path) write))
+            for (int operation = 1; operation <= reference.Operations; operation++)
             {
-                if (write.Path.Contains(Path.DirectorySeparatorChar + "log" + Path.DirectorySeparatorChar, StringComparison.Ordinal))
+                List<int> keeps = writes.TryGetValue(operation, out (int Length, string Path) write) ? Cuts(write.Length, write.Path) : [0];
+
+                // One run crashed at the operation's start serves every cut of its
+                // write and every power-loss image, as in the unbatched suites.
+                int at = operation;
+                (SimulatedFileSystem crashed, long acknowledged) = await CrashAsync(seed, steps, op => op.Number == at ? 0 : null, batch);
+
+                foreach (int keep in keeps)
                 {
-                    keeps.AddRange(Enumerable.Range(0, write.Length));
+                    await VerifyAsync(crashed.Image(CrashKind.Process, new Random(at), keep), reference, acknowledged, "batched, process crash at operation " + at + ", byte " + keep, batch: batch);
+                    points++;
                 }
-                else
+
+                for (int image = 0; image < 3; image++)
                 {
-                    keeps.AddRange(new[] { 0, write.Length / 2, Math.Max(0, write.Length - 1) }.Distinct());
+                    await VerifyAsync(crashed.Image(CrashKind.PowerLoss, new Random((at * 31) + image)), reference, acknowledged, "batched, power loss at operation " + at + ", image " + image, batch: batch);
+                    points++;
                 }
             }
-            else
-            {
-                keeps.Add(0);
-            }
-
-            foreach (int keep in keeps)
-            {
-                int at = operation;
-                (SimulatedFileSystem crashed, long acknowledged) = await CrashAsync(seed, steps, op => op.Number == at ? keep : null, batch);
-                await VerifyAsync(crashed.Image(CrashKind.Process, new Random(at)), reference, acknowledged, "batched, process crash at operation " + at + ", byte " + keep, batch: batch);
-                points++;
-            }
 
-            for (int image = 0; image < 3; image++)
-            {
-                int at = operation;
-                (SimulatedFileSystem crashed, long acknowledged) = await CrashAsync(seed, steps, op => op.Number == at ? 0 : null, batch);
-                await VerifyAsync(crashed.Image(CrashKind.PowerLoss, new Random((at * 31) + image)), reference, acknowledged, "batched, power loss at operation " + at + ", image " + image, batch: batch);
-                points++;
-            }
+            Report("batched crash, seed " + seed + ": " + reference.Operations + " operations, " + points + " injection points, head " + (reference.History.Count - 1));
         }
-
-        Report("batched crash, seed " + seed + ": " + reference.Operations + " operations, " + points + " injection points, head " + (reference.History.Count - 1));
     }
 
-    /// <summary>
-    /// Power lost at every operation: each write since its file's last flush
-    /// kept, dropped or torn at a sector, in every combination the seed draws,
-    /// and metadata cut anywhere after the last flush. Every acknowledged
-    /// commit survives, because a commit is acknowledged only after its flush
-    /// (ADR 0013, ADR 0073).
-    /// </summary>
-    [Theory]
-    [InlineData(6201, 24, 6)]
-    [InlineData(6202, 24, 6)]
-    public async Task a_power_loss_with_writes_reordered_up_to_the_flush_recovers(int seed, int steps, int imagesPerPoint)
+    /// <summary>Power lost at every operation, with writes reordered up to the flush, and directory entries lost.</summary>
+    public sealed class PowerLoss
     {
-        Reference reference = await ReferenceAsync(seed, steps);
-        int points = 0;
-
-        for (int operation = 1; operation <= reference.Operations; operation++)
+        /// <summary>
+        /// Power lost at every operation: each write since its file's last flush
+        /// kept, dropped or torn at a sector, in every combination the seed draws,
+        /// and metadata cut anywhere after the last flush. Every acknowledged
+        /// commit survives, because a commit is acknowledged only after its flush
+        /// (ADR 0013, ADR 0073).
+        /// </summary>
+        [Theory]
+        [InlineData(6201, 24, 6)]
+        [InlineData(6202, 24, 6)]
+        public async Task a_power_loss_with_writes_reordered_up_to_the_flush_recovers(int seed, int steps, int imagesPerPoint)
         {
-            int at = operation;
-            (SimulatedFileSystem crashed, long acknowledged) = await CrashAsync(seed, steps, op => op.Number == at ? 0 : null);
+            Reference reference = await ReferenceAsync(seed, steps);
+            int points = 0;
 
-            for (int image = 0; image < imagesPerPoint; image++)
+            for (int operation = 1; operation <= reference.Operations; operation++)
             {
-                await VerifyAsync(crashed.Image(CrashKind.PowerLoss, new Random((at * 31) + image)), reference, acknowledged, "power loss at operation " + at + ", image " + image);
-                points++;
-            }
-        }
+                int at = operation;
+                (SimulatedFileSystem crashed, long acknowledged) = await CrashAsync(seed, steps, op => op.Number == at ? 0 : null);
 
-        Report("power loss, seed " + seed + ": " + reference.Operations + " operations, " + points + " injection points");
-    }
+                for (int image = 0; image < imagesPerPoint; image++)
+                {
+                    await VerifyAsync(crashed.Image(CrashKind.PowerLoss, new Random((at * 31) + image)), reference, acknowledged, "power loss at operation " + at + ", image " + image);
+                    points++;
+                }
+            }
 
-    /// <summary>
-    /// Power lost on a file system that may drop a new file's directory entry
-    /// even after the file was flushed (ADR 0073's undocumented rows):
-    /// acknowledged commits in a lost segment are lost, which ADR 0073 states,
-    /// but the dataset always opens at a closed commit, consistently.
-    /// </summary>
-    [Fact]
-    public async Task a_lost_directory_entry_is_a_segment_never_created()
-    {
-        const int seed = 6301, steps = 24;
-        Reference reference = await ReferenceAsync(seed, steps);
-        int points = 0;
+            Report("power loss, seed " + seed + ": " + reference.Operations + " operations, " + points + " injection points");
+        }
 
-        for (int operation = 1; operation <= reference.Operations; operation += 2)
+        /// <summary>
+        /// Power lost on a file system that may drop a new file's directory entry
+        /// even after the file was flushed (ADR 0073's undocumented rows):
+        /// acknowledged commits in a lost segment are lost, which ADR 0073 states,
+        /// but the dataset always opens at a closed commit, consistently.
+        /// </summary>
+        [Fact]
+        public async Task a_lost_directory_entry_is_a_segment_never_created()
         {
-            int at = operation;
-            (SimulatedFileSystem crashed, _) = await CrashAsync(seed, steps, op => op.Number == at ? 0 : null);
+            const int seed = 6301, steps = 24;
+            Reference reference = await ReferenceAsync(seed, steps);
+            int points = 0;
 
-            for (int image = 0; image < 4; image++)
+            for (int operation = 1; operation <= reference.Operations; operation += 2)
             {
-                await VerifyAsync(crashed.Image(CrashKind.LostDirectoryEntries, new Random((at * 17) + image)), reference, 0, "lost entries at operation " + at + ", image " + image);
-                points++;
+                int at = operation;
+                (SimulatedFileSystem crashed, _) = await CrashAsync(seed, steps, op => op.Number == at ? 0 : null);
+
+                for (int image = 0; image < 4; image++)
+                {
+                    await VerifyAsync(crashed.Image(CrashKind.LostDirectoryEntries, new Random((at * 17) + image)), reference, 0, "lost entries at operation " + at + ", image " + image);
+                    points++;
+                }
             }
-        }
 
-        Report("lost directory entries: " + points + " injection points");
+            Report("lost directory entries: " + points + " injection points");
+        }
     }
 
-    /// <summary>
-    /// After a crash, derived/ deleted, or replaced by the derived/ of the run
-    /// that did not crash — a longer log's, so its state and checkpoints name
-    /// positions this log does not have. Both open, rebuild, and read right.
-    /// </summary>
-    [Fact]
-    public async Task derived_data_deleted_or_stale_after_a_crash_is_rebuilt()
+    /// <summary>derived/ deleted or stale after a crash, and checkpoints crashed while written or dropped.</summary>
+    public sealed class DerivedAndCheckpoints
     {
-        const int seed = 6401, steps = 24;
-        Reference reference = await ReferenceAsync(seed, steps);
-        string derived = Path.Combine(Root, "derived");
-        int points = 0;
-
-        for (int operation = 1; operation <= reference.Operations; operation += 3)
+        /// <summary>
+        /// After a crash, derived/ deleted, or replaced by the derived/ of the run
+        /// that did not crash — a longer log's, so its state and checkpoints name
+        /// positions this log does not have. Both open, rebuild, and read right.
+        /// </summary>
+        [Fact]
+        public async Task derived_data_deleted_or_stale_after_a_crash_is_rebuilt()
         {
-            int at = operation;
-            (SimulatedFileSystem crashed, long acknowledged) = await CrashAsync(seed, steps, op => op.Number == at ? 0 : null);
+            const int seed = 6401, steps = 24;
+            Reference reference = await ReferenceAsync(seed, steps);
+            string derived = Path.Combine(Root, "derived");
+            int points = 0;
 
-            SimulatedFileSystem deleted = crashed.Image(CrashKind.Process, new Random(at));
-            deleted.RemoveTree(derived);
-            await VerifyAsync(deleted, reference, acknowledged, "derived/ deleted after operation " + at);
+            for (int operation = 1; operation <= reference.Operations; operation += 3)
+            {
+                int at = operation;
+                (SimulatedFileSystem crashed, long acknowledged) = await CrashAsync(seed, steps, op => op.Number == at ? 0 : null);
 
-            SimulatedFileSystem stale = crashed.Image(CrashKind.Process, new Random(at));
-            stale.RemoveTree(derived);
+                SimulatedFileSystem deleted = crashed.Image(CrashKind.Process, new Random(at));
+                deleted.RemoveTree(derived);
+                await VerifyAsync(deleted, reference, acknowledged, "derived/ deleted after operation " + at);
 
-            foreach (string file in reference.Final.Files(derived))
-            {
-                stale.Place(file, reference.Final.Read(file), readOnly: false);
-            }
+                SimulatedFileSystem stale = crashed.Image(CrashKind.Process, new Random(at));
+                stale.RemoveTree(derived);
 
-            await VerifyAsync(stale, reference, acknowledged, "derived/ of a longer log after operation " + at);
-            points += 2;
-        }
+                foreach (string file in reference.Final.Files(derived))
+                {
+                    stale.Place(file, reference.Final.Read(file), readOnly: false);
+                }
 
-        Report("derived/ deleted or stale: " + points + " injection points");
-    }
+                await VerifyAsync(stale, reference, acknowledged, "derived/ of a longer log after operation " + at);
+                points += 2;
+            }
 
-    /// <summary>
-    /// A checkpoint is an extent set with its graph-version index beside it
-    /// (ADR 0125, ADR 0139), named by the catalog only once written whole. A
-    /// process crash at every operation of a workload that writes checkpoints
-    /// and drops each one's predecessor — so inside every extent write, index
-    /// write, catalog swap and merge — opens with every extent belonging to a
-    /// set the catalog names, every named set whole, and every graph's version
-    /// at every position what the commits say.
-    /// </summary>
-    [Fact]
-    public async Task a_crash_while_checkpoints_and_their_graph_indexes_are_written_or_dropped_leaves_no_orphan()
-    {
-        SimulatedFileSystem reference = new();
-        long[][] versions = await CheckpointWorkloadAsync(reference);
-        string extents = Path.Combine(Root, "derived", "extents");
-        Check(reference.Files(extents).Any(f => f.EndsWith("graphs", StringComparison.Ordinal)), "the workload wrote no graph-version index");
-        int points = 0;
+            Report("derived/ deleted or stale: " + points + " injection points");
+        }
 
-        for (int operation = 1; operation <= reference.Operations; operation++)
+        /// <summary>
+        /// A checkpoint is an extent set with its graph-version index beside it
+        /// (ADR 0125, ADR 0139), named by the catalog only once written whole. A
+        /// process crash at every operation of a workload that writes checkpoints
+        /// and drops each one's predecessor — so inside every extent write, index
+        /// write, catalog swap and merge — opens with every extent belonging to a
+        /// set the catalog names, every named set whole, and every graph's version
+        /// at every position what the commits say.
+        /// </summary>
+        [Fact]
+        public async Task a_crash_while_checkpoints_and_their_graph_indexes_are_written_or_dropped_leaves_no_orphan()
         {
-            int at = operation;
-            SimulatedFileSystem files = new() { Injector = op => op.Number == at ? 0 : null };
+            SimulatedFileSystem reference = new();
+            long[][] versions = await CheckpointWorkloadAsync(reference);
+            string extents = Path.Combine(Root, "derived", "extents");
+            Check(reference.Files(extents).Any(f => f.EndsWith("graphs", StringComparison.Ordinal)), "the workload wrote no graph-version index");
+            int points = 0;
 
-            try
-            {
-                await CheckpointWorkloadAsync(files);
-            }
-            catch (SimulatedCrash)
+            for (int operation = 1; operation <= reference.Operations; operation++)
             {
-            }
-
-            SimulatedFileSystem image = files.Image(CrashKind.Process, new Random(at));
-            string where = "crash at operation " + at;
-            FileStorage storage = FileStorage.Open(image, new DatasetDirectory(Root), StorageOptions);
+                int at = operation;
+                SimulatedFileSystem files = new() { Injector = op => op.Number == at ? 0 : null };
 
-            await using (storage)
-            {
-                if ((await storage.Log.ReadManifestAsync(T.Ct)).IsEmpty)
+                try
                 {
-                    continue;
+                    await CheckpointWorkloadAsync(files);
                 }
-
-                await using Dataset dataset = await Dataset.OpenAsync(storage, Unbatched, T.Ct);
-
-                IReadOnlyList<BlobName> names = await storage.Derived.ListAsync(T.Ct);
-                var catalog = await ExtentCatalog.TryReadAsync(storage.Derived, dataset.Id, T.Ct);
-                HashSet<string> named = [.. (catalog?.Sets ?? []).Select(s => s.Name)];
-
-                foreach (BlobName name in names.Where(n => n.Value.StartsWith(ExtentSet.Prefix, StringComparison.Ordinal)))
+                catch (SimulatedCrash)
                 {
-                    string set = name.Value[..(name.Value.LastIndexOf('/') + 1)];
-                    Check(named.Contains(set), where + ": " + name.Value + " belongs to no set the catalog names");
                 }
 
-                foreach (string set in named)
+                SimulatedFileSystem image = files.Image(CrashKind.Process, new Random(at));
+                string where = "crash at operation " + at;
+                FileStorage storage = FileStorage.Open(image, new DatasetDirectory(Root), StorageOptions);
+
+                await using (storage)
                 {
-                    foreach (BlobName part in ExtentSet.BlobsOf(set))
+                    if ((await storage.Log.ReadManifestAsync(T.Ct)).IsEmpty)
                     {
-                        Check(names.Contains(part), where + ": the catalog names " + set + " but " + part.Value + " is missing");
+                        continue;
                     }
-                }
 
-                for (long p = 0; p <= dataset.Head.Value; p++)
-                {
-                    for (int g = 0; g < CheckpointGraphs; g++)
+                    await using Dataset dataset = await Dataset.OpenAsync(storage, Unbatched, T.Ct);
+
+                    IReadOnlyList<BlobName> names = await storage.Derived.ListAsync(T.Ct);
+                    var catalog = await ExtentCatalog.TryReadAsync(storage.Derived, dataset.Id, T.Ct);
+                    HashSet<string> named = [.. (catalog?.Sets ?? []).Select(s => s.Name)];
+
+                    foreach (BlobName name in names.Where(n => n.Value.StartsWith(ExtentSet.Prefix, StringComparison.Ordinal)))
                     {
-                        long version = (await dataset.GraphVersionAsync(T.Iri("g" + g), new Position(p), T.Ct)).Value;
-                        Check(version == versions[p][g], where + ": graph " + g + " at " + p + " is version " + version + ", not " + versions[p][g]);
+                        string set = name.Value[..(name.Value.LastIndexOf('/') + 1)];
+                        Check(named.Contains(set), where + ": " + name.Value + " belongs to no set the catalog names");
+                    }
+
+                    foreach (string set in named)
+                    {
+                        foreach (BlobName part in ExtentSet.BlobsOf(set))
+                        {
+                            Check(names.Contains(part), where + ": the catalog names " + set + " but " + part.Value + " is missing");
+                        }
+                    }
+
+                    for (long p = 0; p <= dataset.Head.Value; p++)
+                    {
+                        for (int g = 0; g < CheckpointGraphs; g++)
+                        {
+                            long version = (await dataset.GraphVersionAsync(T.Iri("g" + g), new Position(p), T.Ct)).Value;
+                            Check(version == versions[p][g], where + ": graph " + g + " at " + p + " is version " + version + ", not " + versions[p][g]);
+                        }
                     }
                 }
+
+                points++;
             }
 
-            points++;
+            Report("checkpoint and graph index crash: " + reference.Operations + " operations, " + points + " recovered images");
         }
 
-        Report("checkpoint and graph index crash: " + reference.Operations + " operations, " + points + " recovered images");
-    }
-
-    private const int CheckpointGraphs = 3;
+        private const int CheckpointGraphs = 3;
 
-    // Twelve commits, each into one of three graphs; a checkpoint after every
-    // third, and the one before it dropped. Returns each graph's version at
-    // each position.
-    private static async Task<long[][]> CheckpointWorkloadAsync(SimulatedFileSystem files)
-    {
-        List<long[]> versions = [new long[CheckpointGraphs]];
-        await using FileStorage storage = FileStorage.Open(files, new DatasetDirectory(Root), StorageOptions);
-        await using Dataset dataset = await Dataset.CreateAsync(storage, T.Id, Unbatched, T.Ct);
-        long previous = 0;
-
-        for (int i = 0; i < 12; i++)
+        // Twelve commits, each into one of three graphs; a checkpoint after every
+        // third, and the one before it dropped. Returns each graph's version at
+        // each position.
+        private static async Task<long[][]> CheckpointWorkloadAsync(SimulatedFileSystem files)
         {
-            int g = i % CheckpointGraphs;
-            CommitResult result = await dataset.CommitAsync(new CommitRequest().Assert(T.Iri("s" + i), T.Iri("p"), T.Integer(i.ToString(CultureInfo.InvariantCulture)), T.Iri("g" + g)), T.Ct);
-            long[] next = [.. versions[^1]];
-            next[g] = result.Position.Value;
-            versions.Add(next);
+            List<long[]> versions = [new long[CheckpointGraphs]];
+            await using FileStorage storage = FileStorage.Open(files, new DatasetDirectory(Root), StorageOptions);
+            await using Dataset dataset = await Dataset.CreateAsync(storage, T.Id, Unbatched, T.Ct);
+            long previous = 0;
 
-            if (i % 3 == 2)
+            for (int i = 0; i < 12; i++)
             {
-                await dataset.CheckpointAsync(dataset.Head, T.Ct);
+                int g = i % CheckpointGraphs;
+                CommitResult result = await dataset.CommitAsync(new CommitRequest().Assert(T.Iri("s" + i), T.Iri("p"), T.Integer(i.ToString(CultureInfo.InvariantCulture)), T.Iri("g" + g)), T.Ct);
+                long[] next = [.. versions[^1]];
+                next[g] = result.Position.Value;
+                versions.Add(next);
 
-                if (previous > 0)
+                if (i % 3 == 2)
                 {
-                    await dataset.DropCheckpointAsync(new Position(previous), T.Ct);
-                }
+                    await dataset.CheckpointAsync(dataset.Head, T.Ct);
+
+                    if (previous > 0)
+                    {
+                        await dataset.DropCheckpointAsync(new Position(previous), T.Ct);
+                    }
 
-                previous = dataset.Head.Value;
+                    previous = dataset.Head.Value;
+                }
             }
-        }
 
-        return [.. versions];
+            return [.. versions];
+        }
     }
 
-    /// <summary>
-    /// The dataset directory copied while it is being written, as `git add` or
-    /// a backup would: the copier lists the directory once, then copies one
-    /// file at a time, each as it reads at that moment. The copy opens at a
-    /// closed commit with no corruption; the copy without derived/ too.
-    /// </summary>
-    [Fact]
-    public async Task a_directory_copied_mid_write_opens_on_the_copy()
+    /// <summary>A directory copied file by file while it is written.</summary>
+    public sealed class CopiedMidWrite
     {
-        const int seed = 6501, steps = 30;
-        Reference reference = await ReferenceAsync(seed, steps);
-        int points = 0;
-
-        for (int trial = 0; trial < 300; trial++)
+        /// <summary>
+        /// The dataset directory copied while it is being written, as `git add` or
+        /// a backup would: the copier lists the directory once, then copies one
+        /// file at a time, each as it reads at that moment. The copy opens at a
+        /// closed commit with no corruption; the copy without derived/ too.
+        /// </summary>
+        [Fact]
+        public async Task a_directory_copied_mid_write_opens_on_the_copy()
         {
-            Random random = new(trial);
-            int listAt = random.Next(1, reference.Operations);
-            List<int> copyAt = [];
-            List<string>? listed = null;
-            Dictionary<string, byte[]> copied = new(StringComparer.Ordinal);
-            // The copier lists at one operation and copies file i at a later
-            // one, in listing order, while the writer carries on.
-            int copied_ = 0;
-
-            (SimulatedFileSystem live, _) = await CrashAsync(seed, steps, files => op =>
+            const int seed = 6501, steps = 30;
+            Reference reference = await ReferenceAsync(seed, steps);
+            int points = 0;
+
+            for (int trial = 0; trial < 300; trial++)
             {
-                if (op.Number == listAt)
+                Random random = new(trial);
+                int listAt = random.Next(1, reference.Operations);
+                List<int> copyAt = [];
+                List<string>? listed = null;
+                Dictionary<string, byte[]> copied = new(StringComparer.Ordinal);
+                // The copier lists at one operation and copies file i at a later
+                // one, in listing order, while the writer carries on.
+                int copied_ = 0;
+
+                (SimulatedFileSystem live, _) = await CrashAsync(seed, steps, files => op =>
                 {
-                    listed = [.. files.Files(Root).Where(f => !f.EndsWith(".tmp", StringComparison.Ordinal))];
-                    int next = listAt;
+                    if (op.Number == listAt)
+                    {
+                        listed = [.. files.Files(Root).Where(f => !f.EndsWith(".tmp", StringComparison.Ordinal))];
+                        int next = listAt;
+
+                        foreach (string _ in listed)
+                        {
+                            next += random.Next(0, 8);
+                            copyAt.Add(next);
+                        }
+                    }
 
-                    foreach (string _ in listed)
+                    while (listed is not null && copied_ < listed.Count && copyAt[copied_] <= op.Number)
                     {
-                        next += random.Next(0, 8);
-                        copyAt.Add(next);
+                        if (files.FileExists(listed[copied_]))
+                        {
+                            copied[listed[copied_]] = files.Read(listed[copied_]);
+                        }
+
+                        copied_++;
                     }
-                }
 
-                while (listed is not null && copied_ < listed.Count && copyAt[copied_] <= op.Number)
+                    return null;
+                });
+
+                // Files the writer had finished with before the copier reached them.
+                while (listed is not null && copied_ < listed.Count)
                 {
-                    if (files.FileExists(listed[copied_]))
+                    if (live.FileExists(listed[copied_]))
                     {
-                        copied[listed[copied_]] = files.Read(listed[copied_]);
+                        copied[listed[copied_]] = live.Read(listed[copied_]);
                     }
 
                     copied_++;
                 }
 
-                return null;
-            });
-
-            // Files the writer had finished with before the copier reached them.
-            while (listed is not null && copied_ < listed.Count)
-            {
-                if (live.FileExists(listed[copied_]))
+                foreach (bool withDerived in new[] { true, false })
                 {
-                    copied[listed[copied_]] = live.Read(listed[copied_]);
-                }
+                    SimulatedFileSystem copy = new();
 
-                copied_++;
-            }
-
-            foreach (bool withDerived in new[] { true, false })
-            {
-                SimulatedFileSystem copy = new();
+                    foreach ((string path, byte[] bytes) in copied)
+                    {
+                        bool isDerived = path.Contains(Path.DirectorySeparatorChar + "derived" + Path.DirectorySeparatorChar, StringComparison.Ordinal);
 
-                foreach ((string path, byte[] bytes) in copied)
-                {
-                    bool isDerived = path.Contains(Path.DirectorySeparatorChar + "derived" + Path.DirectorySeparatorChar, StringComparison.Ordinal);
+                        if (!withDerived && isDerived)
+                        {
+                            continue;
+                        }
 
-                    if (!withDerived && isDerived)
-                    {
-                        continue;
+                        if (!path.EndsWith("LOCK", StringComparison.Ordinal))
+                        {
+                            copy.Place(path, bytes, readOnly: false);
+                        }
                     }
 
-                    if (!path.EndsWith("LOCK", StringComparison.Ordinal))
-                    {
-                        copy.Place(path, bytes, readOnly: false);
-                    }
+                    await VerifyAsync(copy, reference, 0, "copy listed at operation " + listAt + (withDerived ? string.Empty : " without derived/"));
+                    points++;
                 }
-
-                await VerifyAsync(copy, reference, 0, "copy listed at operation " + listAt + (withDerived ? string.Empty : " without derived/"));
-                points++;
             }
-        }
 
-        Report("copies mid-write: " + points + " copies opened");
+            Report("copies mid-write: " + points + " copies opened");
+        }
     }
 
-    /// <summary>
-    /// Defect 1 of milestone 6a, kept as a named case: power lost at operation
-    /// 21 of seed 6201, the first seal, where the closed trailer reached the
-    /// disk and a record of the commit in flight before it did not. The next
-    /// open refused the log as damaged. The writer now flushes the segment
-    /// before the trailer that vouches for it.
-    /// </summary>
-    [Fact]
-    public async Task regression_a_closed_trailer_never_outlives_the_records_before_it()
+    /// <summary>Defects the suite found, kept by name.</summary>
+    public sealed class Regressions
     {
-        Reference reference = await ReferenceAsync(6201, 24);
-        (SimulatedFileSystem crashed, long acknowledged) = await CrashAsync(6201, 24, op => op.Number == 21 ? 0 : null);
-
-        for (int image = 0; image < 64; image++)
+        /// <summary>
+        /// Defect 1 of milestone 6a, kept as a named case: power lost at operation
+        /// 21 of seed 6201, the first seal, where the closed trailer reached the
+        /// disk and a record of the commit in flight before it did not. The next
+        /// open refused the log as damaged. The writer now flushes the segment
+        /// before the trailer that vouches for it.
+        /// </summary>
+        [Fact]
+        public async Task regression_a_closed_trailer_never_outlives_the_records_before_it()
         {
-            await VerifyAsync(crashed.Image(CrashKind.PowerLoss, new Random((21 * 31) + image)), reference, acknowledged, "power loss at operation 21, image " + image);
+            Reference reference = await ReferenceAsync(6201, 24);
+            (SimulatedFileSystem crashed, long acknowledged) = await CrashAsync(6201, 24, op => op.Number == 21 ? 0 : null);
+
+            for (int image = 0; image < 64; image++)
+            {
+                await VerifyAsync(crashed.Image(CrashKind.PowerLoss, new Random((21 * 31) + image)), reference, acknowledged, "power loss at operation 21, image " + image);
+            }
         }
     }
 
-    /// <summary>
-    /// A crash during recovery itself — while it seals an abandoned tail,
-    /// deletes stale derived files, or continues the log — at every operation
-    /// recovery performs, after a process crash at every fifth operation of
-    /// the workload. The second restart recovers as the first would have.
-    /// </summary>
-    [Fact]
-    public async Task a_crash_during_recovery_recovers()
+    /// <summary>A crash inside recovery itself.</summary>
+    public sealed class CrashDuringRecovery
     {
-        const int seed = 6601, steps = 24;
-        Reference reference = await ReferenceAsync(seed, steps);
-        int points = 0;
-
-        for (int operation = 1; operation <= reference.Operations; operation += 5)
+        /// <summary>
+        /// A crash during recovery itself — while it seals an abandoned tail,
+        /// deletes stale derived files, or continues the log — at every operation
+        /// recovery performs, after a process crash at every 25th operation of the
+        /// workload, from one chosen by a seed, or every
+        /// <c>VARVE_FAULT_RECOVERY_STRIDE</c>th. A pull request's run covers a
+        /// 25th of the 1,428 operations, and runs between them cover all of them;
+        /// the nightly run's stride of 1 covers every one, about 288,000 points.
+        /// <c>VARVE_FAULT_RECOVERY_SEED</c> replays a run: the test's output, and
+        /// the message of any failure, start with it. The second restart
+        /// recovers as the first would have.
+        /// </summary>
+        [Fact]
+        public async Task a_crash_during_recovery_recovers()
         {
-            int at = operation;
-            (SimulatedFileSystem crashed, long acknowledged) = await CrashAsync(seed, steps, op => op.Number == at ? 0 : null);
+            int stride = Depth.Of("VARVE_FAULT_RECOVERY_STRIDE", 25);
+            int sweep = Depth.Seed("VARVE_FAULT_RECOVERY_SEED");
+            int from = 1 + (sweep % stride);
+            string replay = "VARVE_FAULT_RECOVERY_SEED=" + sweep + " VARVE_FAULT_RECOVERY_STRIDE=" + stride;
+            Report(replay + ": a crash at operation " + from + " of the workload and every " + stride + "th after it");
+            int points;
 
-            // How many operations a whole recovery takes from this image, and
-            // where it continues the log.
-            SimulatedFileSystem counting = crashed.Image(CrashKind.Process, new Random(at));
-            long first = await VerifyCoreAsync(counting, reference, acknowledged, "recovery after operation " + at, null, "after");
-            int recoveryOperations = counting.Operations;
-            Continuation continued = new(first, "after");
+            try
+            {
+                points = await CrashEveryRecoveryAsync(from, stride);
+            }
+            catch (Exception error)
+            {
+                throw new InvalidOperationException(replay + " replays this. " + error.Message, error);
+            }
+
+            Report(replay + ": " + points + " injection points");
+        }
+
+        private static async Task<int> CrashEveryRecoveryAsync(int from, int stride)
+        {
+            const int seed = 6601, steps = 24;
+            Reference reference = await ReferenceAsync(seed, steps);
+            int points = 0;
 
-            for (int second = 1; second <= recoveryOperations; second++)
+            for (int operation = from; operation <= reference.Operations; operation += stride)
             {
-                int during = second;
-                SimulatedFileSystem image = crashed.Image(CrashKind.Process, new Random(at));
-                image.Injector = op => op.Number == during ? 0 : null;
+                int at = operation;
+                (SimulatedFileSystem crashed, long acknowledged) = await CrashAsync(seed, steps, op => op.Number == at ? 0 : null);
 
-                try
-                {
-                    await VerifyCoreAsync(image, reference, acknowledged, "recovery after operation " + at, null, "after");
-                }
-                catch (SimulatedCrash)
-                {
-                }
-                catch (InvalidOperationException error) when (error.InnerException is SimulatedCrash || error.Message.Contains("Simulated", StringComparison.Ordinal))
+                // How many operations a whole recovery takes from this image, and
+                // where it continues the log.
+                SimulatedFileSystem counting = crashed.Image(CrashKind.Process, new Random(at));
+                long first = await VerifyCoreAsync(counting, reference, acknowledged, "recovery after operation " + at, null, "after");
+                int recoveryOperations = counting.Operations;
+                Continuation continued = new(first, "after");
+
+                for (int second = 1; second <= recoveryOperations; second++)
                 {
-                }
+                    int during = second;
+                    SimulatedFileSystem image = crashed.Image(CrashKind.Process, new Random(at));
+                    image.Injector = op => op.Number == during ? 0 : null;
 
-                SimulatedFileSystem restarted = image.Image(CrashKind.Process, new Random(during));
+                    try
+                    {
+                        await VerifyCoreAsync(image, reference, acknowledged, "recovery after operation " + at, null, "after");
+                    }
+                    catch (SimulatedCrash)
+                    {
+                    }
+                    catch (InvalidOperationException error) when (error.InnerException is SimulatedCrash || error.Message.Contains("Simulated", StringComparison.Ordinal))
+                    {
+                    }
 
-                try
-                {
-                    await VerifyCoreAsync(restarted, reference, acknowledged, "a crash at operation " + during + " of the recovery after operation " + at, continued, "again");
-                }
-                catch (Exception error) when (error is not InvalidOperationException)
-                {
-                    throw new InvalidOperationException("a crash at operation " + during + " of the recovery after operation " + at + ": " + error.GetType().Name + ": " + error.Message, error);
+                    SimulatedFileSystem restarted = image.Image(CrashKind.Process, new Random(during));
+
+                    try
+                    {
+                        await VerifyCoreAsync(restarted, reference, acknowledged, "a crash at operation " + during + " of the recovery after operation " + at, continued, "again");
+                    }
+                    catch (Exception error) when (error is not InvalidOperationException)
+                    {
+                        throw new InvalidOperationException("a crash at operation " + during + " of the recovery after operation " + at + ": " + error.GetType().Name + ": " + error.Message, error);
+                    }
+                    points++;
                 }
-                points++;
             }
-        }
 
-        Report("crash during recovery: " + points + " injection points");
+            return points;
+        }
     }
 
-    /// <summary>
-    /// The same suites over many seeds and longer workloads, for hunting
-    /// defects rather than for the gate: set VARVE_FAULT_SEEDS to a count to
-    /// run it. Not in CI.
-    /// </summary>
-    [Fact]
-    public async Task deep_exploration_over_many_seeds()
+    /// <summary>The deep exploration, for hunting rather than for the gate.</summary>
+    public sealed class DeepExploration
     {
-        if (!int.TryParse(Environment.GetEnvironmentVariable("VARVE_FAULT_SEEDS"), CultureInfo.InvariantCulture, out int seeds))
+        /// <summary>
+        /// The same suites over many seeds and longer workloads, for hunting
+        /// defects rather than for the gate: set VARVE_FAULT_SEEDS to a count to
+        /// run it. Not in CI.
+        /// </summary>
+        [Fact]
+        public async Task deep_exploration_over_many_seeds()
         {
-            Assert.Skip("Set VARVE_FAULT_SEEDS to run the deep exploration.");
-        }
-
-        long points = 0;
+            if (!int.TryParse(Environment.GetEnvironmentVariable("VARVE_FAULT_SEEDS"), CultureInfo.InvariantCulture, out int seeds))
+            {
+                Assert.Skip("Set VARVE_FAULT_SEEDS to run the deep exploration.");
+            }
 
-        for (int seed = 7000; seed < 7000 + seeds; seed++)
-        {
-            int steps = 20 + (seed % 25);
-            Reference reference = await ReferenceAsync(seed, steps);
-            Random choose = new(seed);
+            long points = 0;
 
-            for (int operation = 1; operation <= reference.Operations; operation++)
+            for (int seed = 7000; seed < 7000 + seeds; seed++)
             {
-                int at = operation;
-                (SimulatedFileSystem crashed, long acknowledged) = await CrashAsync(seed, steps, op => op.Number == at ? choose.Next(0, Math.Max(1, op.Length)) : null);
-                await VerifyAsync(crashed.Image(CrashKind.Process, new Random(at)), reference, acknowledged, "seed " + seed + ", process crash at operation " + at);
+                int steps = 20 + (seed % 25);
+                Reference reference = await ReferenceAsync(seed, steps);
+                Random choose = new(seed);
 
-                for (int image = 0; image < 3; image++)
+                for (int operation = 1; operation <= reference.Operations; operation++)
                 {
-                    await VerifyAsync(crashed.Image(CrashKind.PowerLoss, new Random((at * 31) + image)), reference, acknowledged, "seed " + seed + ", power loss at operation " + at + ", image " + image);
-                }
+                    int at = operation;
+                    (SimulatedFileSystem crashed, long acknowledged) = await CrashAsync(seed, steps, op => op.Number == at ? choose.Next(0, Math.Max(1, op.Length)) : null);
+                    await VerifyAsync(crashed.Image(CrashKind.Process, new Random(at)), reference, acknowledged, "seed " + seed + ", process crash at operation " + at);
 
-                await VerifyAsync(crashed.Image(CrashKind.LostDirectoryEntries, new Random(at)), reference, 0, "seed " + seed + ", lost entries at operation " + at);
-                points += 5;
+                    for (int image = 0; image < 3; image++)
+                    {
+                        await VerifyAsync(crashed.Image(CrashKind.PowerLoss, new Random((at * 31) + image)), reference, acknowledged, "seed " + seed + ", power loss at operation " + at + ", image " + image);
+                    }
+
+                    await VerifyAsync(crashed.Image(CrashKind.LostDirectoryEntries, new Random(at)), reference, 0, "seed " + seed + ", lost entries at operation " + at);
+                    points += 5;
+                }
             }
-        }
 
-        Report("deep exploration: " + seeds + " seeds, " + points + " injection points");
+            Report("deep exploration: " + seeds + " seeds, " + points + " injection points");
+        }
     }
 }
diff --git a/tests/Varve.Store.Tests/Faults/SimulatedFileSystem.cs b/tests/Varve.Store.Tests/Faults/SimulatedFileSystem.cs
index 4594599b..fa0a0573 100644
--- a/tests/Varve.Store.Tests/Faults/SimulatedFileSystem.cs
+++ b/tests/Varve.Store.Tests/Faults/SimulatedFileSystem.cs
@@ -79,6 +79,10 @@ internal sealed class SimulatedFileSystem : IFileSystem
     private readonly Lock _gate = new();
     private int _durableJournal;
 
+    // The write a crash stopped: its file, where it began and all it would
+    // have written, so that one crash builds the image of every cut of it.
+    private (Inode Inode, long Offset, byte[] Bytes)? _inFlight;
+
     /// <summary>Called before each mutating operation with its number; returns the bytes of a write to keep when it crashes there, or null to go on.</summary>
     public Func<Operation, int?>? Injector { get; set; }
 
@@ -265,10 +269,25 @@ public void MakeReadOnly(string path)
     /// chooses, for a power loss, which unflushed writes survive and where
     /// metadata is cut.
     /// </summary>
-    public SimulatedFileSystem Image(CrashKind kind, Random random)
+    public SimulatedFileSystem Image(CrashKind kind, Random random) => Image(kind, random, inFlightBytes: 0);
+
+    /// <summary>
+    /// What a restart finds after a process crash inside the write the crash
+    /// stopped, had that write kept its first <paramref name="inFlightBytes"/>
+    /// bytes. A run crashed at a write's start keeps none of it; this is the
+    /// image a run crashed there keeping <paramref name="inFlightBytes"/> would
+    /// leave, byte for byte, without replaying the run to the same operation
+    /// once per cut (#126).
+    /// </summary>
+    public SimulatedFileSystem Image(CrashKind kind, Random random, int inFlightBytes)
     {
         lock (_gate)
         {
+            if (inFlightBytes != 0 && (kind != CrashKind.Process || _inFlight is null))
+            {
+                throw new InvalidOperationException("Only a process crash inside a write keeps part of the write in flight.");
+            }
+
             SimulatedFileSystem image = new();
 
             foreach (string directory in _directories)
@@ -313,6 +332,13 @@ public SimulatedFileSystem Image(CrashKind kind, Random random)
                 {
                     copy = new Inode { ReadOnly = sealedAt.ContainsKey(inode) };
                     copy.Bytes.AddRange(kind == CrashKind.Process ? inode.Bytes : inode.Survivors(random));
+
+                    if (inFlightBytes != 0 && _inFlight is { } inFlight && ReferenceEquals(inode, inFlight.Inode))
+                    {
+                        copy.Write(inFlight.Offset, inFlight.Bytes.AsSpan(0, Math.Min(inFlightBytes, inFlight.Bytes.Length)));
+                        copy.Pending.Clear();
+                    }
+
                     copy.Durable = [.. copy.Bytes];
                     copies[inode] = copy;
                 }
@@ -409,6 +435,7 @@ private void Write(Inode inode, long offset, ReadOnlySpan<byte> bytes, string pa
 
             if (keep is not null)
             {
+                _inFlight = (inode, offset, bytes.ToArray());
                 Crashed = true;
                 throw new SimulatedCrash("Crashed after " + written.Length + " of " + bytes.Length + " bytes to " + path + ".");
             }
diff --git a/tests/Varve.Store.Tests/FileStorageTests.cs b/tests/Varve.Store.Tests/FileStorageTests.cs
index 0900f713..03bd70b0 100644
--- a/tests/Varve.Store.Tests/FileStorageTests.cs
+++ b/tests/Varve.Store.Tests/FileStorageTests.cs
@@ -110,6 +110,34 @@ public sealed class FileStorageTests
 {
     private static readonly string[] SetParts = ["order0", "order1", "order2", "order3", "order4", "order5", "terms", "graphs"];
 
+    /// <summary>
+    /// The ignore file and the lease's owner are written without a flush
+    /// (#126): neither is state. An ignore file a power loss left empty, cut
+    /// short or zeroed is whole again after the next open, so derived/ stays
+    /// out of version control (ADR 0075).
+    /// </summary>
+    [Theory]
+    [InlineData("")]
+    [InlineData("*")]
+    [InlineData("\0\0")]
+    public async Task a_torn_ignore_file_is_whole_again_after_an_open(string torn)
+    {
+        await using TemporaryDirectory directory = new();
+        string ignore = Path.Combine(directory.Path, "derived", ".gitignore");
+
+        await using (FileStorage storage = await FileStorage.OpenAsync(directory.Directory, TemporaryDirectory.Options, T.Ct))
+        {
+        }
+
+        await File.WriteAllTextAsync(ignore, torn, T.Ct);
+
+        await using (FileStorage storage = await FileStorage.OpenAsync(directory.Directory, TemporaryDirectory.Options, T.Ct))
+        {
+        }
+
+        Assert.Equal("*\n", await File.ReadAllTextAsync(ignore, T.Ct));
+    }
+
     [Fact]
     public async Task a_dataset_on_disk_has_the_layout_of_the_storage_format()
     {
diff --git a/tests/Varve.Store.Tests/ObjectStorage/ObjectCacheTests.cs b/tests/Varve.Store.Tests/ObjectStorage/ObjectCacheTests.cs
new file mode 100644
index 00000000..f4ce1eb4
--- /dev/null
+++ b/tests/Varve.Store.Tests/ObjectStorage/ObjectCacheTests.cs
@@ -0,0 +1,200 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Threading.Tasks;
+using Varve.Store.Log;
+using Varve.Store.ObjectStorage.Model;
+using Xunit;
+using Backend = Varve.Store.ObjectStorage.ObjectStorage;
+
+namespace Varve.Store.Tests.Objects;
+
+/// <summary>
+/// The object-storage backend's local cache, damaged (#126): the commit index
+/// below the catalog, kept as a blob in the cache by an earlier instance, cut
+/// short or with a byte of what is verified zeroed. Opened again on that
+/// cache, the dataset serves what it served before, as a cache miss would:
+/// never an error, never a different answer.
+/// </summary>
+/// <remarks>
+/// The entries before the last are not verified when the blob is read below
+/// the catalog: only the last is compared with the catalog's (ADR 0139), and
+/// a zeroed byte in one of the others is read as an error or as a different
+/// history. What keeps such a blob from existing is its publication, a
+/// temporary file flushed before its rename (ADR 0073), so a crash leaves a
+/// blob whole or absent; that flush stays for this reason (#126).
+/// </remarks>
+public sealed class ObjectCacheTests
+{
+    private const int Commits = 24;
+
+    [Fact]
+    public async Task a_commit_index_blob_cut_short_or_with_its_verified_bytes_zeroed_is_a_miss()
+    {
+        await using ObjectHarness objects = new();
+        string cache = Directory.CreateTempSubdirectory("varve-cache-").FullName;
+
+        try
+        {
+            // A history, and a catalog at its head: the commit index below it
+            // is what a later instance reads from the log on first use.
+            await using (Backend writer = await objects.OpenAsync(instance: "writer"))
+            await using (Dataset dataset = await Dataset.CreateAsync(writer, T.Id, Options(objects), T.Ct))
+            {
+                for (int i = 1; i <= Commits; i++)
+                {
+                    objects.Clock.Now = objects.Clock.Now.AddSeconds(1);
+                    await dataset.CommitAsync(new CommitRequest().Assert(T.Iri("s" + i), T.Iri("p"), T.Integer(i.ToString(CultureInfo.InvariantCulture))), T.Ct);
+                }
+
+                await dataset.CheckpointAsync(dataset.Head, T.Ct);
+            }
+
+            // An instance on the cache reads below the catalog, which keeps
+            // the commit index there as a blob in the cache.
+            string expected = await ServeAsync(objects, cache);
+            string blob = Assert.Single(Directory.GetFiles(Path.Combine(cache, "local", "derived", "index", "commits")));
+            byte[] whole = await File.ReadAllBytesAsync(blob, T.Ct);
+            List<string> wrong = [];
+
+            // The last entry, the directory after it and the derived header
+            // are what a read verifies (storage format, sections 7.1 and 7.4).
+            const int EntryBytes = 80;
+            int verified = whole.Length - 160 - (12 + (8 * ((Commits + 127) / 128))) - EntryBytes;
+            List<(byte[] Damaged, string How)> cases = [];
+
+            for (int at = 0; at < whole.Length; at++)
+            {
+                // A cut anywhere before the last entry loses the header as a
+                // cut inside it does; every sixteenth byte stands for them.
+                if (at >= verified || at % 16 == 0)
+                {
+                    cases.Add((whole[..at], "cut at byte " + at));
+                }
+
+                if (at >= verified && whole[at] != 0)
+                {
+                    byte[] zeroed = [.. whole];
+                    zeroed[at] = 0;
+                    cases.Add((zeroed, "byte " + at + " zeroed"));
+                }
+            }
+
+            // A pull request checks every eighth case, from where a seed says,
+            // so that pull requests between them check all of them; the
+            // nightly run checks every one (docs/testing.md section 8).
+            int stride = Depth.Of("VARVE_CACHE_DAMAGE_STRIDE", 8);
+            int sweep = Depth.Seed("VARVE_CACHE_DAMAGE_SEED");
+            string replay = "VARVE_CACHE_DAMAGE_SEED=" + sweep + " VARVE_CACHE_DAMAGE_STRIDE=" + stride;
+            int checkedCases = 0;
+
+            for (int i = sweep % stride; i < cases.Count; i += stride)
+            {
+                await CheckAsync(cases[i].Damaged, cases[i].How);
+                checkedCases++;
+            }
+
+            TestContext.Current.TestOutputHelper?.WriteLine(replay + ": " + checkedCases + " of " + cases.Count + " damaged blobs");
+            Assert.True(wrong.Count == 0, replay + " replays this. " + wrong.Count + " damaged blobs were not a miss, of " + whole.Length + " bytes:\n  " + string.Join("\n  ", wrong));
+
+            async Task CheckAsync(byte[] damaged, string how)
+            {
+                string copy = Directory.CreateTempSubdirectory("varve-cache-").FullName;
+
+                try
+                {
+                    Copy(cache, copy);
+                    await File.WriteAllBytesAsync(Path.Combine(copy, Path.GetRelativePath(cache, blob)), damaged, T.Ct);
+                    string served;
+
+                    try
+                    {
+                        served = await ServeAsync(objects, copy);
+                    }
+                    catch (Exception error) when (error is not Xunit.Sdk.XunitException)
+                    {
+                        wrong.Add(how + ": " + error.GetType().Name + ": " + error.Message);
+                        return;
+                    }
+
+                    if (served != expected)
+                    {
+                        wrong.Add(how + ": served a different history");
+                    }
+                }
+                finally
+                {
+                    Directory.Delete(copy, recursive: true);
+                }
+            }
+        }
+        finally
+        {
+            Directory.Delete(cache, recursive: true);
+        }
+    }
+
+    private static DatasetOptions Options(ObjectHarness objects) => T.Options(objects.Clock, segmentBytes: 2048);
+
+    // What a follower on the cache serves below the catalog: every position
+    // as of, by time, and from the feed.
+    private static async Task<string> ServeAsync(ObjectHarness objects, string cache)
+    {
+        ObjectStorageOptions options = objects.Options(ObjectStorageAccess.ReadOnly);
+        await using Backend storage = await Backend.OpenAsync(new ObjectStorageOptions
+        {
+            Store = options.Store,
+            Prefix = options.Prefix,
+            Cache = new CacheDirectory(cache),
+            Access = options.Access,
+            Instance = options.Instance,
+            Clock = options.Clock,
+            ProbeRandomness = options.ProbeRandomness,
+            CacheBytes = options.CacheBytes,
+        }, T.Ct);
+        await using Dataset dataset = await Dataset.OpenAsync(storage, Options(objects), T.Ct);
+        List<string> served = [];
+
+        for (long q = 0; q <= dataset.Head.Value; q++)
+        {
+            using DatasetView view = await dataset.AsOfAsync(new Position(q), T.Ct);
+            served.Add(q + ": " + string.Join(" ", T.Terms(view)));
+
+            if (q > 0)
+            {
+                CommitTimestamp at = dataset.TimestampAt(new Position(q));
+                served.Add(q + " @" + at.Value.UtcTicks + " -> " + dataset.PositionAt(at).Value);
+            }
+        }
+
+        await using IAsyncEnumerator<Commit> commits = dataset.Subscribe(new Position(0), SubscriptionFilter.All, T.Ct).GetAsyncEnumerator(T.Ct);
+
+        for (long q = 1; q <= dataset.Head.Value && await commits.MoveNextAsync(); q++)
+        {
+            served.Add("feed " + commits.Current.Position.Value + " @" + commits.Current.Timestamp.Value.UtcTicks + " +" + commits.Current.Delta.Asserted.Length);
+        }
+
+        return string.Join("\n", served);
+    }
+
+    private static void Copy(string from, string to)
+    {
+        foreach (string directory in Directory.GetDirectories(from, "*", SearchOption.AllDirectories))
+        {
+            Directory.CreateDirectory(Path.Combine(to, Path.GetRelativePath(from, directory)));
+        }
+
+        foreach (string file in Directory.GetFiles(from, "*", SearchOption.AllDirectories))
+        {
+            if (Path.GetFileName(file) != "LOCK")
+            {
+                File.Copy(file, Path.Combine(to, Path.GetRelativePath(from, file)));
+            }
+        }
+    }
+}
diff --git a/tests/Varve.Store.Tests/Support.cs b/tests/Varve.Store.Tests/Support.cs
index 909e905d..9bd8386b 100644
--- a/tests/Varve.Store.Tests/Support.cs
+++ b/tests/Varve.Store.Tests/Support.cs
@@ -4,6 +4,7 @@
 
 using System;
 using System.Collections.Generic;
+using System.Globalization;
 using System.Linq;
 using System.Text;
 using System.Threading;
@@ -26,6 +27,29 @@ internal sealed class ManualClock : TimeProvider
     public static ManualClock Epoch() => new(new DateTimeOffset(2026, 9, 23, 12, 0, 0, TimeSpan.Zero));
 }
 
+/// <summary>
+/// How much of a long search a run makes: the pull request's amount, or the
+/// one its variable names, which the nightly run sets (#126; docs/testing.md,
+/// "How long the tests take"). The property searched is the same at either.
+/// </summary>
+internal static class Depth
+{
+    public static int Of(string variable, int pullRequest) =>
+        int.TryParse(Environment.GetEnvironmentVariable(variable), NumberStyles.None, CultureInfo.InvariantCulture, out int value) && value > 0
+            ? value
+            : pullRequest;
+
+    /// <summary>
+    /// Where a search that a pull request runs a share of starts in its space:
+    /// the variable's seed, which replays a run, or a new one each run, so that
+    /// pull requests cover the whole space between them.
+    /// </summary>
+    public static int Seed(string variable) =>
+        int.TryParse(Environment.GetEnvironmentVariable(variable), NumberStyles.None, CultureInfo.InvariantCulture, out int value)
+            ? value
+            : Random.Shared.Next();
+}
+
 internal static class T
 {
     /// <summary>The test's cancellation token, which every store call takes.</summary>
diff --git a/tests/Varve.Store.Tests/Varve.Store.Tests.csproj b/tests/Varve.Store.Tests/Varve.Store.Tests.csproj
index c57650b2..ea4b7e7c 100644
--- a/tests/Varve.Store.Tests/Varve.Store.Tests.csproj
+++ b/tests/Varve.Store.Tests/Varve.Store.Tests.csproj
@@ -15,6 +15,7 @@
   <ItemGroup>
     <PackageReference Include="xunit.v3" />
     <PackageReference Include="Microsoft.Testing.Extensions.TrxReport" />
+    <PackageReference Include="Microsoft.Testing.Extensions.HangDump" />
     <PackageReference Include="CsCheck" />
   </ItemGroup>