[goetchstone]

Slice 7's core (planned 2026-10-24), after watching the operator's 30-day pull: every account's Gmail, a day at a time, 1,000 events a GAM call, is hours on a large tenant ("with a larger tenant it would take days").

• Still to do → Pull Every Account From : an item for each address the reader found suspect (never one set aside as shared), reading the recommended logs for every account from it over the window shown. Google filters on the address before it reads, so it stays small at any size. Done once a saved read of the incident read every account from it (its about.txt, by the existing About parser), so never swept twice.
• How far a wide read gets: from a log's first full read, its events an hour and that read's time give how much of the window the bounds read whole, oldest first, in how many reads and minutes; said in the log's progress line. The operator's 30-day Gmail (about 900 an hour) stopped after about 9 days; that's now said up front.
• Not built from the plan: waiting with Read the Oldest N Hours / Narrow Instead, and the wide read's own speed-ups (several days at once, more per GAM call).
• Tests: NarrowFirstTests, IncidentEvidenceTests.whichAddressAReadOfEveryAccountWasFrom, .howFarAWideReadWillGet. Suite green locally (909), app builds. Live check L1n written down.
• Screenshots of Still to do follow from this PR's green CI run.

🤖 Generated with Claude Code