@@ -855,6 +855,42 @@ func (c *Cache[U]) coldest() (int64, bool) {
 	return best, found
 }
 
+// evictOlderThan hollows every evictable run older than cutoff in ONE pass
+// over the index, publishing each node's successor once. The hooks fire
+// outside the lock, as evictColdest's does.
+func (c *Cache[U]) evictOlderThan(cutoff int64) (dropped int, freed int64) {
+	var hooks []Coord
+	c.mu.Lock()
+	for _, n := range *c.nodes.Load() {
+		runs := n.load()
+		var next []*run[U]
+		for i, r := range runs {
+			if !r.resident || r.pinned || c.effEpoch(r) >= cutoff {
+				continue
+			}
+			if next == nil {
+				next = append([]*run[U](nil), runs...)
+			}
+			next[i] = hollow(r)
+			freed += r.bytes
+			dropped++
+			hooks = append(hooks, r.coord)
+		}
+		if next != nil {
+			n.publish(next)
+		}
+	}
+	hook := c.Evicted
+	c.mu.Unlock()
+
+	if hook != nil {
+		for _, co := range hooks {
+			hook(co)
+		}
+	}
+	return dropped, freed
+}
+
 func (c *Cache[U]) evictColdest() int64 {
 	c.mu.Lock()
 	var victim *run[U]
 
@@ -0,0 +1,169 @@
+package tree
+
+import (
+	"container/list"
+	"sync"
+	"testing"
+)
+
+// Q2, MEASURED BEFORE IT IS BUILT. Gluck endorsed epoch buckets over a heap
+// for the eviction scan, with the instruction to measure bucket MAINTENANCE
+// against the scan it replaces first.
+//
+// The two costs sit on DIFFERENT PATHS and that is the whole finding:
+//
+//	THE SCAN     is on the daemon's standing sweep. A read never evicts
+//	             (charge raises pressure; Sweep lowers it), so its cost is
+//	             paid once per beat by one goroutine.
+//	THE INDEX    would be maintained on TOUCH, which is on the READ PATH,
+//	             where every reader is concurrent and nothing shared is
+//	             written today.
+//
+// So the comparison is not "R^2 versus log R". It is "one background walk per
+// beat versus a shared write per read", and this file measures both.
+
+func buildCache(tb testing.TB, b *Budget, runs int) *Cache[fatUnit] {
+	c := New[fatUnit](
+		func(co Coord) ([]fatUnit, error) {
+			out := make([]fatUnit, 0, co.To-co.From)
+			for k := co.From + 1; k <= co.To; k++ {
+				out = append(out, fatUnit{key: k, payload: make([]byte, 1024)})
+			}
+			return out, nil
+		},
+		b,
+		func(u fatUnit) int { return len(u.payload) },
+		func(u fatUnit) uint64 { return u.key },
+	)
+	tb.Cleanup(c.Close)
+	lineage := []Ref{{Node: "p"}}
+	for i := 0; len(c.runs("p")) < runs; i++ {
+		lo := uint64(i * runChunk)
+		if _, err := c.Range(lineage, lo, lo+runChunk); err != nil {
+			tb.Fatal(err)
+		}
+		if i > runs*4 {
+			tb.Fatalf("fixture: %d runs after %d ranges", len(c.runs("p")), i)
+		}
+	}
+	return c
+}
+
+// fatUnit is a 1 KiB unit: the fixture measures RUN COUNT, and a run is cut
+// by bytes, so the unit size is what decides how many runs a range builds.
+type fatUnit struct {
+	key     uint64
+	payload []byte
+}
+
+// THE SCAN, AT PRODUCTION SIZE. The segment cache holds 32 MiB in runs cut at
+// 32 KiB, so R is in the high hundreds to low thousands; the decoded and
+// composed tenants add their own. This times a FULL SWEEP -- the compounding
+// case, one rescan per dropped run.
+func BenchmarkSweepFull(b *testing.B) {
+	for _, runs := range []int{256, 1024, 4096} {
+		b.Run(sizeName(runs), func(b *testing.B) {
+			for i := 0; i < b.N; i++ {
+				b.StopTimer()
+				bud := NewBudget(0)
+				c := buildCache(b, bud, runs)
+				resident := len(c.runs("p"))
+				b.StartTimer()
+				dropped, _ := bud.TrimIdle(0)
+				b.StopTimer()
+				if dropped != resident-1 {
+					b.Fatalf("dropped %d of %d", dropped, resident)
+				}
+				c.Close()
+				b.StartTimer()
+			}
+		})
+	}
+}
+
+// ONE EVICTION under pressure, which is what the standing sweep actually does
+// per beat when a tenant has just charged past its limit.
+func BenchmarkSweepOneEviction(b *testing.B) {
+	for _, runs := range []int{256, 1024, 4096} {
+		b.Run(sizeName(runs), func(b *testing.B) {
+			bud := NewBudget(0)
+			c := buildCache(b, bud, runs)
+			resident, _, _ := bud.Stats()
+			b.ResetTimer()
+			for i := 0; i < b.N; i++ {
+				bud.SetLimit(resident - int64(i+1)*1024)
+				bud.pressure.Store(true)
+				bud.Sweep()
+			}
+			b.StopTimer()
+			c.Close()
+		})
+	}
+}
+
+// THE MAINTENANCE, ON THE PATH IT WOULD LIVE ON. An epoch bucket index must be
+// updated when a run is TOUCHED, and a touch happens on every warm read. Today
+// that is one atomic store, and only when the epoch is stale.
+//
+// The in-run control is the read itself: both arms do the same Range over the
+// same warm cache in the same binary, and the only difference is what the
+// touch does.
+func BenchmarkTouchShape(b *testing.B) {
+	bud := NewBudget(0)
+	c := buildCache(b, bud, 256)
+	lineage := []Ref{{Node: "p"}}
+
+	// ONE UNIT PER READ. A 64-unit Range copies 64 KiB and a mutex
+	// acquisition disappears inside it -- the mistake that produced a
+	// retracted -43.8% on this very package (plans/tree-shaped-log.md).
+	b.Run("today_atomic_epoch", func(b *testing.B) {
+		b.RunParallel(func(pb *testing.PB) {
+			var i uint64
+			for pb.Next() {
+				k := i % 2000
+				i++
+				if _, err := c.Range(lineage, k, k+1); err != nil {
+					b.Fatal(err)
+				}
+			}
+		})
+	})
+
+	// The bucket arm: the same read, plus the shared write an index needs.
+	// A container/list under one mutex is the cheapest honest stand-in --
+	// UIBudget's deleted LRU was exactly this shape, and so is any bucket
+	// map that must move a run between two buckets atomically.
+	var mu sync.Mutex
+	l := list.New()
+	elems := make([]*list.Element, 256)
+	for i := range elems {
+		elems[i] = l.PushFront(i)
+	}
+	b.Run("with_bucket_move", func(b *testing.B) {
+		b.RunParallel(func(pb *testing.PB) {
+			var i uint64
+			for pb.Next() {
+				k := i % 2000
+				if _, err := c.Range(lineage, k, k+1); err != nil {
+					b.Fatal(err)
+				}
+				mu.Lock()
+				l.MoveToFront(elems[i%256])
+				mu.Unlock()
+				i++
+			}
+		})
+	})
+}
+
+func sizeName(n int) string {
+	switch n {
+	case 256:
+		return "R256"
+	case 1024:
+		return "R1024"
+	case 4096:
+		return "R4096"
+	}
+	return "R?"
+}
@@ -66,9 +66,12 @@ func TestEvictionVisitsEveryResidentRun(t *testing.T) {
 	}
 }
 
-// The sweep is the compounding case: TrimIdle re-scans from the top for EVERY
-// run it drops. Recorded as a number rather than an assertion about the cure.
-func TestSweepRescansPerDroppedRun(t *testing.T) {
+// THE SWEEP VISITS EACH RUN ONCE. It used to re-scan from the top for every
+// run it dropped -- O(R^2), 180 ms at R=4096 -- because it asked "who is
+// coldest" once per victim when the cutoff was already fixed. One pass per
+// owner is the whole cure; no index, no data structure, nothing on the read
+// path. evict_cost_bench_test.go carries the wall-clock pair.
+func TestAFullSweepVisitsEachRunOnce(t *testing.T) {
 	const runs = 64
 	var calls int
 	var mu sync.Mutex
@@ -94,6 +97,10 @@ func TestSweepRescansPerDroppedRun(t *testing.T) {
 	if dropped != before-1 {
 		t.Fatalf("swept %d runs, want %d", dropped, before-1)
 	}
-	t.Logf("R=%d: a full sweep dropped %d runs in %d run visits (~R^2/2 = %d)",
+	t.Logf("R=%d: a full sweep dropped %d runs in %d run visits (the old scan: ~R^2/2 = %d)",
 		before, dropped, visits.Load(), before*before/2)
+	if visits.Load() > int64(before) {
+		t.Fatalf("R=%d: %d run visits for one sweep; the pass is scanning more than once per run",
+			before, visits.Load())
+	}
 }
@@ -65,6 +65,10 @@ type owner interface {
 	coldest() (int64, bool)
 	// evictColdest hollows that run and returns the bytes freed.
 	evictColdest() int64
+	// evictOlderThan hollows EVERY evictable run older than cutoff, in one
+	// pass. The idle sweep knows its predicate before it starts, so it does
+	// not have to ask "who is coldest" once per victim.
+	evictOlderThan(cutoff int64) (dropped int, freed int64)
 }
 
 // NewBudget bounds its caches to limit bytes; 0 is unbounded.
@@ -179,26 +183,26 @@ func (b *Budget) EpochNow() int64 {
 // TrimIdle evicts every unpinned run whose epoch is older than the
 // current epoch minus keep, then advances the epoch: the idle sweep,
 // generalized. Returns runs dropped and bytes freed.
+//
+// ONE PASS PER OWNER. The cutoff is fixed before the sweep starts, so
+// "who is coldest" is not a question this loop has to ask -- it used to
+// ask it once per victim and rescan every run to answer, which made a
+// full sweep O(R^2): 180 ms at R=4096, measured, against 1 ms for the
+// same work in one pass. See evict_cost_bench_test.go.
 func (b *Budget) TrimIdle(keep int64) (dropped int, freed int64) {
 	if b == nil {
 		return 0, 0
 	}
 	cutoff := b.epoch.Add(1) - 1 - keep
 	for _, o := range *b.owners.Load() {
-		for {
-			e, ok := o.coldest()
-			if !ok || e >= cutoff {
-				break
-			}
-			f := o.evictColdest()
-			if f <= 0 {
-				break
-			}
-			b.bytes.Add(-f)
-			b.evictions.Add(1)
-			dropped++
-			freed += f
+		d, f := o.evictOlderThan(cutoff)
+		if d == 0 {
+			continue
 		}
+		b.bytes.Add(-f)
+		b.evictions.Add(int64(d))
+		dropped += d
+		freed += f
 	}
 	return dropped, freed
 }
 
@@ -1678,4 +1678,76 @@ figure moved 1.18x -> 1.07x when it went.
 It survived: x1.13 across three runs, with cf3fc17d stable to a hundred bytes.
 But it survived by luck rather than by method, and the method is now: heap
 deltas are run three times and the spread is reported, exactly as timings are.
-reports the deterministic quantity (allocations, counts) ahead of the timing.
+reports the deterministic quantity (allocations, counts) ahead of the timing.
+# Q2 ANSWERED WITHOUT THE STRUCTURE: THE SWEEP WAS QUADRATIC BY QUESTION, NOT
+# BY SHAPE (dfdfae6a, 2026-08-19)
+
+Gluck endorsed epoch buckets over a heap for the eviction scan, with the
+standing instruction to MEASURE BUCKET MAINTENANCE AGAINST THE SCAN IT
+REPLACES BEFORE BUILDING. Measured. The structure is not needed, and the
+measurement says why.
+
+## THE TWO COSTS SIT ON DIFFERENT PATHS, WHICH IS THE WHOLE FINDING
+
+    THE SCAN     is on the daemon's standing sweep. A read never evicts, so
+                 the scan is paid by ONE goroutine, once per beat.
+    THE INDEX    would be maintained on TOUCH, and a touch is on the READ
+                 PATH, where every reader is concurrent and nothing shared is
+                 written today.
+
+So the trade was never "R^2 versus log R". It was ONE BACKGROUND WALK PER BEAT
+AGAINST A SHARED WRITE PER READ.
+
+## WHAT EACH COSTS, MEASURED (evict_cost_bench_test.go, 5800X, bench lock held)
+
+    ONE EVICTION under pressure -- what a beat actually does:
+        R=256    147 ns        R=1024   534 ns        R=4096   1.77 us
+
+    THE FULL IDLE SWEEP, before:
+        R=256    967 us        R=1024   10.65 ms      R=4096   180 ms
+
+    THE MAINTENANCE, on a ONE-UNIT read at 16 readers (a 64-unit Range copies
+    64 KiB and a mutex disappears inside it -- the fixture error that produced
+    this file's retracted -43.8%):
+        today, lock-free            7.1 - 33.5 ns/op
+        with one bucket move        105 - 119 ns/op
+
+    THE INDEX WOULD MAKE A WARM READ 4-15x MORE EXPENSIVE AND SERIALIZE EVERY
+    READER, to save a walk that costs microseconds per beat.
+
+The bucket arm is also TIGHTER than the lock-free one, which is the giveaway
+rather than a virtue: everything queues behind the same mutex, so the variance
+that comes from real parallelism disappears with the parallelism.
+
+## AND THE QUADRATIC DIED WITHOUT ANY OF IT
+
+`TrimIdle` asked "who is COLDEST?" once per victim -- a full rescan of every
+run to answer -- when the cutoff was FIXED BEFORE THE SWEEP STARTED. The
+predicate was known and the loop kept re-deriving it.
+
+`evictOlderThan(cutoff)` is one pass per owner, publishing each node's
+successor once:
+
+    FULL SWEEP      before      after      speedup
+        R=256       967 us      21.8 us      44x
+        R=1024      10.65 ms    77.1 us     138x
+        R=4096      180 ms      294 us      612x
+
+and the counting instrument agrees with the clock: a sweep at R=128 now drops
+127 runs in 128 RUN VISITS, against ~R^2/2 = 8192 before. Scaling 256 -> 4096
+(16x R) costs 13.5x, which is linear.
+
+    NO DATA STRUCTURE WAS ADDED. Nothing was written on the read path. The
+    fix is the DELETION of a question the loop did not have to ask.
+
+## THE BENCHMARK CAUGHT MY OWN QUADRATIC FIRST
+
+The first `evictOlderThan` searched the successor slice for each victim's
+index -- O(R^2) inside the very pass that was replacing an O(R^2) loop. The
+wall clock said R=4096 cost 109x what R=256 did where linear predicts 16x, and
+that ratio is the only reason it was found: the counting instrument was
+satisfied, the suite was green, and the sweep was still 31x faster than
+before, which is exactly the size of improvement that stops an investigation.
+
+    A SPEEDUP IS NOT A PROOF OF THE SHAPE YOU INTENDED. Check the exponent,
+    not the ratio.