Add a crash-safe rebuildable disk-backed index for expected constant-time current revocation lookup and bounded-memory suffix replay. Keep the global transition log as the sole authority and validate every derived lookup against its authoritative transition frame.