@noy-db/hub 0.3.0-pre.11 → 0.3.0-pre.13

package/dist/indexing/index.js

@@ -7,12 +7,12 @@ import {
   decodeIdxId,
   encodeIdxId,
   isIdxId
-} from "../chunk-3CNQ7FQ3.js";
+} from "../chunk-M4CV6BRT.js";
 import {
   CollectionIndexes
 } from "../chunk-KPZS5QAQ.js";
 import "../chunk-IGJCYUT5.js";
-import "../chunk-FH542DDY.js";
+import "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-lookup/indexing/active.ts
@@ -42,10 +42,10 @@ function declareAll(persisted, defs) {
   for (const def of defs) {
     if (typeof def === "string") {
       persisted.declare(def);
-    } else if (Array.isArray(def)) {
-      persisted.declareComposite(def);
     } else {
-      persisted.declareComposite(def.fields);
+      const fields = Array.isArray(def) ? def : def.fields;
+      for (const f of fields) persisted.declare(f);
+      persisted.declareComposite(fields);
     }
   }
 }

package/dist/indexing/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-lookup/indexing/active.ts"],"sourcesContent":["/**\n * Active indexing strategy factory. Calling `withIndexing()` returns\n * an `IndexStrategy` whose `createState` constructs a real\n * `CollectionIndexes` (eager) or `PersistedCollectionIndex` (lazy)\n * per Collection, depending on the collection's `prefetch` mode and\n * its declared `IndexDef[]`.\n *\n * This module is only reachable through the `@noy-db/hub/indexing`\n * subpath — a consumer that never imports the subpath ships none of\n * this (ESM tree-shaking + hub's `\"sideEffects\": false`).\n */\n\nimport { CollectionIndexes } from './eager-indexes.js'\nimport type { IndexDef } from './eager-indexes.js'\nimport { PersistedCollectionIndex } from './persisted-indexes.js'\nimport type { IndexStrategy, IndexState } from './strategy.js'\n\n/**\n * Build the default indexing strategy. Pass into\n * `createNoydb({ indexStrategy: withIndexing() })` to light up the\n * eager-mode `==/in` fast-path on `.query()` and the full lazy-mode\n * `.lazyQuery()` + rebuild / reconcile / auto-reconcile surface.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withIndexing } from '@noy-db/hub/indexing'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   indexStrategy: withIndexing(),\n * })\n * ```\n */\nexport function withIndexing(): IndexStrategy {\n  return {\n    createState({ defs, lazy }) {\n      if (lazy) {\n        const persisted = new PersistedCollectionIndex()\n        declareAll(persisted, defs)\n        return makeLazyState(persisted)\n      }\n      const eager = new CollectionIndexes()\n      for (const def of defs) {\n        if (typeof def === 'string') {\n          eager.declare(def)\n        } else if (Array.isArray(def)) {\n          for (const f of def as readonly string[]) eager.declare(f)\n        } else {\n          for (const f of (def as { fields: readonly string[] }).fields) eager.declare(f)\n        }\n      }\n      return makeEagerState(eager)\n    },\n  }\n}\n\nfunction declareAll(persisted: PersistedCollectionIndex, defs: readonly IndexDef[]): void {\n  for (const def of defs) {\n    if (typeof def === 'string') {\n      persisted.declare(def)\n    } else if (Array.isArray(def)) {\n      persisted.declareComposite(def as readonly string[])\n    } else {\n      persisted.declareComposite((def as { fields: readonly string[] }).fields)\n    }\n  }\n}\n\nfunction makeEagerState(eager: CollectionIndexes): IndexState {\n  return {\n    isEnabled: true,\n    getEagerIndexes: () => eager,\n    getPersistedIndexes: () => null,\n  }\n}\n\nfunction makeLazyState(persisted: PersistedCollectionIndex): IndexState {\n  return {\n    isEnabled: true,\n    getEagerIndexes: () => null,\n    getPersistedIndexes: () => persisted,\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAkCO,SAAS,eAA8B;AAC5C,SAAO;AAAA,IACL,YAAY,EAAE,MAAM,KAAK,GAAG;AAC1B,UAAI,MAAM;AACR,cAAM,YAAY,IAAI,yBAAyB;AAC/C,mBAAW,WAAW,IAAI;AAC1B,eAAO,cAAc,SAAS;AAAA,MAChC;AACA,YAAM,QAAQ,IAAI,kBAAkB;AACpC,iBAAW,OAAO,MAAM;AACtB,YAAI,OAAO,QAAQ,UAAU;AAC3B,gBAAM,QAAQ,GAAG;AAAA,QACnB,WAAW,MAAM,QAAQ,GAAG,GAAG;AAC7B,qBAAW,KAAK,IAA0B,OAAM,QAAQ,CAAC;AAAA,QAC3D,OAAO;AACL,qBAAW,KAAM,IAAsC,OAAQ,OAAM,QAAQ,CAAC;AAAA,QAChF;AAAA,MACF;AACA,aAAO,eAAe,KAAK;AAAA,IAC7B;AAAA,EACF;AACF;AAEA,SAAS,WAAW,WAAqC,MAAiC;AACxF,aAAW,OAAO,MAAM;AACtB,QAAI,OAAO,QAAQ,UAAU;AAC3B,gBAAU,QAAQ,GAAG;AAAA,IACvB,WAAW,MAAM,QAAQ,GAAG,GAAG;AAC7B,gBAAU,iBAAiB,GAAwB;AAAA,IACrD,OAAO;AACL,gBAAU,iBAAkB,IAAsC,MAAM;AAAA,IAC1E;AAAA,EACF;AACF;AAEA,SAAS,eAAe,OAAsC;AAC5D,SAAO;AAAA,IACL,WAAW;AAAA,IACX,iBAAiB,MAAM;AAAA,IACvB,qBAAqB,MAAM;AAAA,EAC7B;AACF;AAEA,SAAS,cAAc,WAAiD;AACtE,SAAO;AAAA,IACL,WAAW;AAAA,IACX,iBAAiB,MAAM;AAAA,IACvB,qBAAqB,MAAM;AAAA,EAC7B;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-lookup/indexing/active.ts"],"sourcesContent":["/**\n * Active indexing strategy factory. Calling `withIndexing()` returns\n * an `IndexStrategy` whose `createState` constructs a real\n * `CollectionIndexes` (eager) or `PersistedCollectionIndex` (lazy)\n * per Collection, depending on the collection's `prefetch` mode and\n * its declared `IndexDef[]`.\n *\n * This module is only reachable through the `@noy-db/hub/indexing`\n * subpath — a consumer that never imports the subpath ships none of\n * this (ESM tree-shaking + hub's `\"sideEffects\": false`).\n */\n\nimport { CollectionIndexes } from './eager-indexes.js'\nimport type { IndexDef } from './eager-indexes.js'\nimport { PersistedCollectionIndex } from './persisted-indexes.js'\nimport type { IndexStrategy, IndexState } from './strategy.js'\n\n/**\n * Build the default indexing strategy. Pass into\n * `createNoydb({ indexStrategy: withIndexing() })` to light up the\n * eager-mode `==/in` fast-path on `.query()` and the full lazy-mode\n * `.lazyQuery()` + rebuild / reconcile / auto-reconcile surface.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withIndexing } from '@noy-db/hub/indexing'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   indexStrategy: withIndexing(),\n * })\n * ```\n */\nexport function withIndexing(): IndexStrategy {\n  return {\n    createState({ defs, lazy }) {\n      if (lazy) {\n        const persisted = new PersistedCollectionIndex()\n        declareAll(persisted, defs)\n        return makeLazyState(persisted)\n      }\n      const eager = new CollectionIndexes()\n      for (const def of defs) {\n        if (typeof def === 'string') {\n          eager.declare(def)\n        } else if (Array.isArray(def)) {\n          for (const f of def as readonly string[]) eager.declare(f)\n        } else {\n          for (const f of (def as { fields: readonly string[] }).fields) eager.declare(f)\n        }\n      }\n      return makeEagerState(eager)\n    },\n  }\n}\n\nfunction declareAll(persisted: PersistedCollectionIndex, defs: readonly IndexDef[]): void {\n  for (const def of defs) {\n    if (typeof def === 'string') {\n      persisted.declare(def)\n    } else {\n      const fields = Array.isArray(def) ? (def as readonly string[]) : (def as { fields: readonly string[] }).fields\n      // #698: decompose a composite into its component single-field indexes\n      // (like the eager branch above), so a composite-only declaration still\n      // provides the single-field driver the #696 Via-covered fall-through\n      // and single-field queries need. The composite mirror is kept for the\n      // multi-field fast path.\n      for (const f of fields) persisted.declare(f)\n      persisted.declareComposite(fields)\n    }\n  }\n}\n\nfunction makeEagerState(eager: CollectionIndexes): IndexState {\n  return {\n    isEnabled: true,\n    getEagerIndexes: () => eager,\n    getPersistedIndexes: () => null,\n  }\n}\n\nfunction makeLazyState(persisted: PersistedCollectionIndex): IndexState {\n  return {\n    isEnabled: true,\n    getEagerIndexes: () => null,\n    getPersistedIndexes: () => persisted,\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAkCO,SAAS,eAA8B;AAC5C,SAAO;AAAA,IACL,YAAY,EAAE,MAAM,KAAK,GAAG;AAC1B,UAAI,MAAM;AACR,cAAM,YAAY,IAAI,yBAAyB;AAC/C,mBAAW,WAAW,IAAI;AAC1B,eAAO,cAAc,SAAS;AAAA,MAChC;AACA,YAAM,QAAQ,IAAI,kBAAkB;AACpC,iBAAW,OAAO,MAAM;AACtB,YAAI,OAAO,QAAQ,UAAU;AAC3B,gBAAM,QAAQ,GAAG;AAAA,QACnB,WAAW,MAAM,QAAQ,GAAG,GAAG;AAC7B,qBAAW,KAAK,IAA0B,OAAM,QAAQ,CAAC;AAAA,QAC3D,OAAO;AACL,qBAAW,KAAM,IAAsC,OAAQ,OAAM,QAAQ,CAAC;AAAA,QAChF;AAAA,MACF;AACA,aAAO,eAAe,KAAK;AAAA,IAC7B;AAAA,EACF;AACF;AAEA,SAAS,WAAW,WAAqC,MAAiC;AACxF,aAAW,OAAO,MAAM;AACtB,QAAI,OAAO,QAAQ,UAAU;AAC3B,gBAAU,QAAQ,GAAG;AAAA,IACvB,OAAO;AACL,YAAM,SAAS,MAAM,QAAQ,GAAG,IAAK,MAA6B,IAAsC;AAMxG,iBAAW,KAAK,OAAQ,WAAU,QAAQ,CAAC;AAC3C,gBAAU,iBAAiB,MAAM;AAAA,IACnC;AAAA,EACF;AACF;AAEA,SAAS,eAAe,OAAsC;AAC5D,SAAO;AAAA,IACL,WAAW;AAAA,IACX,iBAAiB,MAAM;AAAA,IACvB,qBAAqB,MAAM;AAAA,EAC7B;AACF;AAEA,SAAS,cAAc,WAAiD;AACtE,SAAO;AAAA,IACL,WAAW;AAAA,IACX,iBAAiB,MAAM;AAAA,IACvB,qBAAqB,MAAM;AAAA,EAC7B;AACF;","names":[]}

package/dist/issue-5OKB6I2R.js

@@ -0,0 +1,19 @@
+import {
+  issueAttestationCore
+} from "./chunk-GTGPO5KW.js";
+import "./chunk-EXK7QRWF.js";
+import "./chunk-ZJADGNYF.js";
+import "./chunk-XDYREZWE.js";
+import "./chunk-7DSTRQIJ.js";
+import "./chunk-HB3RFQSC.js";
+import "./chunk-JKJOGPZN.js";
+import "./chunk-5M5DVGV7.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-CIE2BASH.js";
+import "./chunk-JNAI2HN2.js";
+import "./chunk-BIOUI4HL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  issueAttestationCore
+};
+//# sourceMappingURL=issue-5OKB6I2R.js.map

package/dist/kernel/best-effort-revert.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Best-effort reverse-revert — the shape shared by two independent rollback
+ * paths that used to duplicate it: satellite fan-out
+ * (`with-shape/satellites/fanout.ts`'s `revertAndCompensate`) and
+ * multi-record transactions (`with-commit/tx/transaction.ts`'s
+ * `revertExecuted`). Both revert a list of already-executed writes on
+ * failure by walking them in REVERSE order and, per leg, restoring the
+ * captured prior envelope straight through the raw adapter — `put(prior)`
+ * when one existed, `delete` when the leg was a fresh insert — bypassing
+ * the Collection layer so the revert itself doesn't re-fire
+ * encryption/ledger/change-event machinery. Each leg's raw-adapter revert
+ * is best-effort: a throw is swallowed so a revert-path failure never masks
+ * the original error that triggered the rollback, and the loop moves on to
+ * the next leg.
+ *
+ * An optional per-leg `compensate` callback runs immediately after a
+ * successful raw-adapter revert (still inside the same try, so a throwing
+ * callback is swallowed the same way as a throwing raw revert). What the
+ * callback does is entirely caller-defined — satellites' fan-out fires
+ * `_compensateRevertedWrite` only for legs whose write actually landed
+ * (#596); with-commit's transaction executor invalidates the Collection
+ * cache. Neither concern belongs here: this helper only knows the generic
+ * reverse/best-effort/raw-revert shape.
+ *
+ * Lives in `kernel/` — not a `with-*` service — so both consumers (one a
+ * gated service, `with-commit`; one an always-on schema feature,
+ * `with-shape/satellites`) can import it without creating a
+ * `with-* → with-*` edge, which would force either family to always bundle
+ * the other and defeat the opt-in tree-shaking both are built around.
+ *
+ * @internal — implementation-sharing only, not part of the public surface.
+ */
+import type { EncryptedEnvelope } from './types.js';
+/** One already-executed write a revert pass needs to unwind. */
+export interface BestEffortRevertLeg {
+    readonly vaultName: string;
+    readonly collectionName: string;
+    readonly id: string;
+    /** Envelope captured before the write, or `null` if the id didn't exist yet. */
+    readonly prior: EncryptedEnvelope | null;
+}
+/** The subset of `NoydbStore` a raw-adapter revert needs. */
+export interface BestEffortRevertAdapter {
+    put(vaultName: string, collectionName: string, id: string, envelope: EncryptedEnvelope): Promise<void>;
+    delete(vaultName: string, collectionName: string, id: string): Promise<void>;
+}
+/**
+ * Revert `executed` in reverse order via the raw adapter, best-effort.
+ * `compensate`, when supplied, runs once per leg immediately after that
+ * leg's own raw revert succeeds.
+ */
+export declare function bestEffortRevert<T extends BestEffortRevertLeg>(executed: readonly T[], adapter: BestEffortRevertAdapter, compensate?: (leg: T) => Promise<void> | void): Promise<void>;

package/dist/kernel/collection-config.d.ts

@@ -106,6 +106,13 @@ export interface CollectionOpts<T> {
      */
     historyConfigExplicit?: boolean | undefined;
     onDirty?: OnDirtyCallback | undefined;
+    /**
+     * #693: live check for whether multi-tab coordination is active at all
+     * (`Noydb._tabCoordinationActive`). When true, the shared local store may be
+     * written out-of-band by another tab, so the #606 marker-id-set gate falls
+     * back to an unconditional store read on re-create.
+     */
+    tabCoordinated?: (() => boolean) | undefined;
     /**
      * tree-shake seam. When omitted, `collection.blob(id)` throws
      * with a pointer at the `@noy-db/hub/blobs` subpath. When set (via
@@ -115,6 +122,16 @@ export interface CollectionOpts<T> {
     blobStrategy?: BlobStrategy | undefined;
     objectStore?: ObjectProjection | undefined;
     blobFields?: BlobFieldsConfig | undefined;
+    /**
+     * #724 Arc 10 Task 3: how `elevate()`/`demote()`/`putAtTier()` rehome a
+     * SHARED blob (`refCount > 1`) it can't rewrap in place. `'isolate'`
+     * (default) forks a private tier-scoped copy for the moving record and
+     * releases its hold on the shared object — co-owners stay byte-for-byte
+     * untouched. `'dedup'` (#741, opt-in) leaves the shared object in place;
+     * the Task-1 runtime read gate still hides it, but the chunks stay
+     * decryptable at rest under the flat `_blob` DEK (documented residue).
+     */
+    blobTierPolicy?: 'isolate' | 'dedup' | undefined;
     aggregateStrategy?: AggregateStrategy | undefined;
     crdtStrategy?: CrdtStrategy | undefined;
     /**
@@ -249,6 +266,14 @@ export interface CollectionOpts<T> {
      * classified refusal matrix (R4: a digest-only field cannot be the subject key).
      */
     subjectKeyField?: string | undefined;
+    /**
+     * Register a record's forget-subject ref directly (bypassing the write-hook
+     * pipeline), wired by the Vault when this collection declares a forget-
+     * subject field. Consumed by `putAtTier` (#766, via `TiersContext.addSubjectRef`)
+     * so a record whose first write is a tier write still enters `_subject_index`.
+     * `undefined` when no forget strategy declares this collection (no-op).
+     */
+    addSubjectRef?: ((id: string, record: unknown) => Promise<void>) | undefined;
     /** — tree-shake seam for `collection.reveal()`. Defaults to `NO_CLASSIFIED`. */
     classifiedStrategy?: ClassifiedStrategy | undefined;
     /**
@@ -688,6 +713,7 @@ export declare function resolveCollectionConfig<T>(opts: CollectionOpts<T>): {
     reconcileOnOpen: "auto" | "off" | "dry-run";
     getDEK: (collectionName: string) => Promise<EnclaveKey>;
     onDirty: OnDirtyCallback | undefined;
+    tabCoordinated: (() => boolean) | undefined;
     historyConfig: HistoryConfig;
     historyConfigExplicit: boolean;
     schema: StandardSchemaV1<unknown, T> | undefined;
@@ -771,7 +797,9 @@ export declare function resolveCollectionConfig<T>(opts: CollectionOpts<T>): {
     tiersStrategy: TiersStrategy;
     searchStrategy: SearchStrategy;
     tierMode: TierMode;
+    blobTierPolicy: "isolate" | "dedup";
     onCrossTierAccess: ((event: CrossTierAccessEvent) => void) | undefined;
+    addSubjectRef: ((id: string, record: unknown) => Promise<void>) | undefined;
     deterministicFields: ReadonlySet<string> | null;
     sensitiveFields: ReadonlySet<string>;
     vdigFields: ReadonlyMap<string, VdigFieldPolicy> | null;

package/dist/kernel/collection.d.ts

@@ -11,6 +11,7 @@ import type { MutationOrigin } from './mutation.js';
 import { type WaveContext, type RollupOutcome, type RollupDeleteIntent } from './via/dispatch.js';
 import type { ComputedFields } from '../with-formula/computed/index.js';
 import { type SealedShredSlot } from './enclave/index.js';
+import { type TierMoveResult } from '../with-audit/tiers/index.js';
 import type { GhostRecord } from './types.js';
 import type { StandardSchemaV1 } from './schema.js';
 import type { DiffEntry } from '../with-commit/history/diff.js';
@@ -89,6 +90,8 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
     private readonly activeTxId;
     private readonly getDEK;
     private readonly onDirty;
+    /** #693: live check — true when multi-tab write-propagation is active; gates the #606 marker-id-set fallback read. */
+    private readonly tabCoordinated;
     private readonly historyConfig;
     /** True when the caller explicitly provided a `historyConfig` option (vs. inheriting the vault default). */
     private readonly historyConfigExplicit;
@@ -104,6 +107,7 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
     private readonly blobStrategy;
     private readonly objectStore;
     private readonly blobFields;
+    private readonly blobTierPolicy;
     private readonly aggregateStrategy;
     private readonly crdtStrategy;
     private readonly tiersStrategy;
@@ -112,6 +116,20 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
     private readonly syncStrategy;
     private readonly cache;
     private hydrated;
+    /**
+     * #606: ids known to carry a delete marker in the store — lets the #589
+     * re-create version-continuity gate in `_putInternal` read the store ONLY
+     * for a known marker prior, instead of unconditionally on every insert.
+     * Populated on hydration (`ensureHydrated`/`hydrateFromSnapshot`), local
+     * delete (`_doDelete`), and the sync/tab/cutover choke point
+     * (`_invalidateCacheEntry`). Accepted drift: `vault._purgeDeleteMarkers`/
+     * `_purgeMarkersOn` remove markers directly on the raw store, bypassing
+     * Collection, so this set can hold stale ids after a purge on an
+     * already-loaded collection — perf-only and self-healing (a stale id just
+     * costs one `adapter.get` that returns non-marker/null, and version
+     * resolution falls back to 1 correctly). Do not try to wire purge into it.
+     */
+    private readonly markerIds;
     /**
      * Lazy mode flag. `true` when constructed with `prefetch: false`.
      * In lazy mode the cache is bounded by an LRU and `list()`/`query()`
@@ -140,8 +158,7 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
     private readonly indexState;
     /**
      * In-memory unique-constraint enforcement for eager mode.
-     * `null` when no `unique:true` indexes are declared on this collection,
-     * or when the collection is in lazy mode (which throws at registration).
+     * `null` when no `unique:true` indexes are declared on this collection, or when the collection is in lazy mode (which throws at registration).
      */
     private readonly uniqueConstraints;
     /**
@@ -160,8 +177,7 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
      */
     private get indexes();
     /**
-     * Accessor for the persisted-mirror (lazy-mode) index. Returns `null`
-     * when indexing is disabled or the collection is in eager mode.
+     * Accessor for the persisted-mirror (lazy-mode) index. Returns `null` when indexing is disabled or the collection is in eager mode.
      */
     private get persistedIndexes();
     /**
@@ -321,11 +337,9 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
     private readonly tiers;
     private readonly tierMode;
     private readonly onCrossTierAccess;
+    private readonly addSubjectRef;
     /**
-     * Optional reference to the vault-level hash-chained audit
-     * log. When present, every successful `put()` and `delete()` appends
-     * an entry to the ledger AFTER the adapter write succeeds (so a
-     * failed adapter write never produces an orphan ledger entry).
+     * Optional reference to the vault-level hash-chained audit log. When present, every successful `put()` and `delete()` appends an entry to the ledger AFTER the adapter write succeeds (so a failed adapter write never produces an orphan ledger entry).
      *
      * The ledger is always a vault-wide singleton — all
      * collections in the same vault share the same LedgerStore.
@@ -736,10 +750,7 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
      */
     delete(id: string): Promise<void>;
     /**
-     * @internal — bulk-rewrite every record through a cutover transform.
-     * Raw adapter path (bypasses the write gate + guards — the transform is
-     * trusted and runs only during the `migrating` phase). Bumps each
-     * record's `_v` and appends a ledger `op:'migration'` entry.
+     * @internal — bulk-rewrite every record through a cutover transform. Raw adapter path (bypasses the write gate + guards — the transform is trusted and runs only during the `migrating` phase). Bumps each record's `_v` and appends a ledger `op:'migration'` entry. #708: refuses BEFORE any rewrite if a live record is elevated (assertCutoverTierSafe) — demote it first.
      */
     _applyCutoverTransform(transform: (doc: Record<string, unknown>) => Record<string, unknown>): Promise<number>;
     /** @internal Untracked delete body — call {@link delete}, not this. */
@@ -827,11 +838,17 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
     /**
      * Mirror of {@link dispatchMaterializedViews} for the delete/forget path — no `_materializedFrom`
      * skip (record's gone); the `internal` gate at `_doDelete` is the recursion guard. Returns the
-     * row count TOMBSTONED across every eager MV sourced here (#638 T6 — `forgetDerivedFanout`'s
-     * `derivedRecordsErased`); a lazy MV only flips its stale bit (0 contribution — resolved on read).
+     * row count TOMBSTONED across EVERY MV sourced here (#638 T6 — `forgetDerivedFanout`'s
+     * `derivedRecordsErased`) — eager AND lazy/manual `invalidateMVAtRest` purges both contribute now
+     * (#761 item 1, previously eager-only); lazy persists a stale mark for cold-session recompute;
+     * manual serves empty until `refreshView()`. `residueUndecodable`/`residueDeclined` (#776/#785) carry `outputCollection:id` entries whose ownership stamp `invalidateMVAtRest` could not decode, resp. decoded+stamp-matched but declined erasure — surfaced, not erased.
      * @internal
      */
-    dispatchMaterializedViewsOnDelete(id: string): Promise<number>;
+    dispatchMaterializedViewsOnDelete(id: string): Promise<{
+        deleted: number;
+        residueUndecodable: string[];
+        residueDeclined: string[];
+    }>;
     /**
      * List all records in the collection.
      *
@@ -868,6 +885,11 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
         minScore?: number;
         includeRecord?: boolean;
     }): Promise<RetrieveHit<T>[]>;
+    /** Opt-in bulk `_vec` re-derive (#788) — a plain collection has nothing to rebuild; gated behind `searchStrategy: withSearch()` otherwise. */
+    rebuildEmbeddings(): Promise<{
+        rebuilt: number;
+        skipped: number;
+    }>;
     /**
      * Bind the {@link SearchContext} the search/retrieval surface needs. The
      * `cache` is the SAME `Map` reference the eager read/write path owns (passed
@@ -1050,9 +1072,9 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
     /**
      * Count records in the collection.
      *
-     * In eager mode this returns the in-memory cache size (instant). In
-     * lazy mode it asks the adapter via `list()` to enumerate ids — slower
-     * but still correct, and avoids loading any record bodies into memory.
+     * In eager mode this returns the in-memory cache size (instant). In lazy
+     * mode it counts only LIVE tier-0 envelopes via envelope inspection — no
+     * record bodies loaded — matching eager's tombstone/tier exclusion (#706).
      */
     count(): Promise<number>;
     /**
@@ -1439,7 +1461,7 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
     queryByDet(field: string, value: unknown): Promise<T[]>;
     /** Bind the {@link DeterministicContext} this collection's det lookups need. */
     private detContext;
-    /** tier-aware put — gated behind `tiersStrategy: withTiers()`. */
+    /** tier-aware put — gated behind `tiersStrategy: withTiers()`. `searchResidue: true` = stuck search compensation (#774, mirroring #764's elevate/demote posture); the write itself always completes. */
     putAtTier(id: string, record: T, tier: number, opts?: {
         elevation?: {
             reason: string;
@@ -1447,7 +1469,7 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
         };
         source?: string;
         sourceTs?: string;
-    }): Promise<void>;
+    }): Promise<TierMoveResult>;
     /** tier-aware get — gated behind `tiersStrategy: withTiers()`. */
     getAtTier(id: string): Promise<T | GhostRecord | null>;
     /** list ids grouped by the caller's readability — gated behind `withTiers()`. */
@@ -1456,14 +1478,12 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
         tier: number;
         readable: boolean;
     }>>;
-    /** elevate a record to a higher tier — gated behind `withTiers()`. */
-    elevate(id: string, toTier: number): Promise<void>;
-    /** demote a record to a lower tier — gated behind `withTiers()`. */
-    demote(id: string, toTier: number): Promise<void>;
+    /** elevate a record to a higher tier — gated behind `withTiers()`. `searchResidue: true` = stuck search compensation (#764); the move itself always completes. */
+    elevate(id: string, toTier: number): Promise<TierMoveResult>;
+    /** demote a record to a lower tier — gated behind `withTiers()`. Same `searchResidue` posture as {@link elevate} (#764). */
+    demote(id: string, toTier: number): Promise<TierMoveResult>;
     /**
-     * Emit a cross-tier access event. The subscriber sink stays collection-
-     * resident (it captures `onCrossTierAccess`); the tiers module reaches it
-     * via the {@link TiersContext.emitCrossTierEvent} callback.
+     * Emit a cross-tier access event. The subscriber sink stays collection-resident (it captures `onCrossTierAccess`); the tiers module reaches it via the {@link TiersContext.emitCrossTierEvent} callback.
      */
     private emitCrossTierEvent;
     /**
@@ -1489,17 +1509,14 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
         presentForJoin?: (record: unknown, locale: string) => unknown;
     }): void;
     /**
-     * Bind the {@link TiersContext} the tier ops need. The `cekCache` is passed
-     * by reference (the SAME `Lru` the kernel's read/write path owns) so an
-     * elevate/demote CEK re-wrap stays synchronous with cache eviction.
+     * Bind the {@link TiersContext} the tier ops need — `cekCache` by reference (same `Lru` the read/write path owns) for a synchronous re-wrap; `syncDerived` closes over `this` for {@link syncDerivedOutputs} (#722).
      */
     private tiersContext;
     /**
      * Bind the {@link IndexingContext} the index-maintenance surface needs. The
      * eager `cache` Map and the index / unique-constraint / persisted mirrors are
      * passed by reference (the SAME instances the query path reads, never
-     * copied); the `persistedIndexesLoaded` flag and `ensure*` hydration stay
-     * collection-resident, reached via callbacks.
+     * copied); the `persistedIndexesLoaded` flag and `ensure*` hydration stay collection-resident, reached via callbacks.
      */
     private indexingContext;
 }

package/dist/kernel/enclave/classify/verify.d.ts

@@ -7,6 +7,9 @@
  * text door (verifyTextField) has no real PBKDF2 of its own, so it pays the
  * pad UNCONDITIONALLY — every outcome, including a real compare, costs the
  * same one PBKDF2 unit (no inverted exists-vs-absent oracle).
+ * Elevated records (_tier > 0, with-audit tier moves) are non-comparable
+ * through every door and pad-false exactly like missing records (#691) —
+ * the tier-aware read surface is getAtTier, never verify.
  * Throws are reserved for caller/config bugs (ClassifiedVerifyError /
  * ClassifiedConfigError) and are exempt from the pad by design (R6 note).
  * @module

package/dist/kernel/enclave/index.d.ts

@@ -58,7 +58,8 @@ export type { EnclaveKey } from './crypto.js';
 export { encrypt, decrypt, encryptBytes, decryptBytes, encryptBytesWithAAD, decryptBytesWithAAD, encryptDeterministic, decryptDeterministic, sha256Hex, hmacSha256Hex, } from './crypto.js';
 export { deriveKey, derivePassphraseKey, generateDEK, generateSalt, generateIV, wrapKey, unwrapKey, bufferToBase64, base64ToBuffer, derivePresenceKey, deriveDeterministicKey, deriveSealedFieldKey, deriveSealedFieldKeyFromCek, wrapCek, unwrapCek, importCek, } from './crypto.js';
 export type { PassphraseKeyUsage } from './crypto.js';
-export { resolveStableCek, rewrapBodyToDek } from './record-keys/lifecycle.js';
+export { resolveStableCek, rewrapBodyToDek, rewrapEnvelope, applyRewrappedBody, isRewrappedUnder } from './record-keys/lifecycle.js';
+export type { RewrappedBody } from './record-keys/lifecycle.js';
 export { RecordCodec } from './record-keys/record-codec.js';
 export type { SealedShredSlot } from './record-keys/record-codec.js';
 export { SEALED_CEK_NS, sealRecordToHost, revokeSealedRecord, rotateRecordCek } from './record-keys/sealing.js';

package/dist/kernel/enclave/record-keys/deterministic.d.ts

@@ -12,6 +12,7 @@
  * Both functions take a small {@link DeterministicContext} (the exact `this.*`
  * the moving methods touched) instead of `this`, mirroring the `record-keys/`
  * siblings. Behaviour is byte-identical to the inline code they replaced.
+ * Elevated records (_tier > 0) are skipped: invisible to tier-0 scans (#691).
  *
  * Internal service — not exported as a `@noy-db/hub/*` subpath.
  */

package/dist/kernel/enclave/record-keys/lifecycle.d.ts

@@ -55,3 +55,53 @@ export interface RewrappedBody {
  *   directly — byte-for-byte the pre-CEK behaviour.
  */
 export declare function rewrapBodyToDek(envelope: Pick<EncryptedEnvelope, '_iv' | '_data' | '_cek'>, fromDek: EnclaveKey, toDek: EnclaveKey): Promise<RewrappedBody>;
+/**
+ * Merge an ALREADY-rewrapped {@link RewrappedBody} into `envelope`, keeping
+ * every field but the re-keyed body (`_iv`/`_data`/`_cek`) unchanged.
+ *
+ * Body-field access (`_iv`/`_data`/`_cek`) is sanctioned inside the enclave;
+ * this lets callers outside it get back a ready-to-store envelope without
+ * reading those fields themselves. Takes a body the caller has ALREADY
+ * computed (vs. {@link rewrapEnvelope}, which also runs `rewrapBodyToDek`)
+ * so a caller building a SECOND envelope from the same rewrap — a tier
+ * move's live write AND its pre-move `_history` snapshot, #728 — pays the
+ * unwrap/decrypt/encrypt/wrap crypto once, not twice.
+ */
+export declare function applyRewrappedBody(envelope: EncryptedEnvelope, body: RewrappedBody): EncryptedEnvelope;
+/**
+ * Move a FULL stored envelope from `fromDek` to `toDek`, preserving every
+ * field other than the re-keyed body (`_iv`/`_data`/`_cek`) unchanged.
+ * Mirrors the spread-merge idiom `with-audit/tiers/index.ts`'s
+ * `elevate()`/`demote()` use to apply `rewrapBodyToDek`'s result to the live
+ * envelope, generalized to any envelope shape (history callers don't bump
+ * `_v`/`_ts`/`_tier` the way a tier move does).
+ */
+export declare function rewrapEnvelope(envelope: EncryptedEnvelope, fromDek: EnclaveKey, toDek: EnclaveKey): Promise<EncryptedEnvelope>;
+/**
+ * Is `envelope` ALREADY wrapped under `dek` (a per-record CEK wrapped under
+ * `dek`, or — legacy, no `_cek` — the body itself decryptable under `dek`)?
+ *
+ * A toDek-first idempotency check for retry-safe rewrap loops (#712 crash
+ * atomicity, `with-commit/history/history.ts`'s `rewrapHistory`): a crash
+ * mid-rewrap can strand some entries already moved to `toDek` while others
+ * remain under `fromDek`. Calling this with `toDek` before attempting the
+ * `fromDek` rewrap lets the caller skip an already-migrated entry instead of
+ * re-wrapping it (a re-wrap would be a correctness no-op but doubles as an
+ * unnecessary write) — and, more importantly, tells a retry loop that this
+ * entry needs no `fromDek` unwrap attempt at all, so a crash that landed some
+ * entries under `toDek` doesn't wedge on those already-moved entries.
+ *
+ * AES-KW (CEK unwrap) and AES-GCM (direct decrypt) are both authenticated —
+ * unwrap/decrypt under the wrong key throws, never silently returns garbage
+ * — so a caught error here reliably means "not wrapped under `dek`", not a
+ * corrupt envelope (a genuinely corrupt envelope also throws under the
+ * correct key, but callers that reach this helper only do so as a
+ * best-effort probe before their own decisive fromDek attempt, which still
+ * surfaces real corruption).
+ *
+ * Body-field access (`_iv`/`_data`/`_cek`) is sanctioned inside the enclave —
+ * this is the sanctioned door so callers outside it (history.ts) never read
+ * those fields themselves, preserving the check-architecture body-access
+ * ratchet.
+ */
+export declare function isRewrappedUnder(envelope: Pick<EncryptedEnvelope, '_iv' | '_data' | '_cek'>, dek: EnclaveKey): Promise<boolean>;

package/dist/kernel/enclave/record-keys/record-codec.d.ts

@@ -278,6 +278,33 @@ export declare class RecordCodec<T> {
         id?: string;
         sealedAsHandles?: boolean;
     }): Promise<T>;
+    /**
+     * Decrypt an envelope under an EXPLICIT `dek` instead of this codec's own
+     * `ctx.getDEK()` / cekCache resolution — for a from-tier>0 pre-move decode
+     * (`with-audit/tiers/index.ts`'s `putAtTier`/`elevate`/`demote` sites,
+     * #722 whole-branch review). Mirrors the manual unwrap-then-decrypt
+     * `getAtTier`'s own tier>0 leg performs there (same primitives, same
+     * `applySealedSlots` extraction point #635 built for exactly this caller).
+     *
+     * `decryptRecord` is tier-UNAWARE: `resolveEnvelopeCek` reads the cekCache
+     * or falls back to `ctx.getDEK()` — this codec's DEFAULT (tier-0/
+     * collection) DEK — never the envelope's OWN tier. That only happens to
+     * decrypt a from-tier>0 envelope correctly when some other call in the
+     * SAME op already primed the cekCache with this record's CEK (true for an
+     * ordinary put()-then-elevate(0→1); NOT true for a `putAtTier`-origin
+     * envelope, whose body is encrypted directly under its tier DEK with no
+     * `_cek` ever minted, or a non-`perRecordKeys` collection, which has no
+     * `_cek` at all) — those throw `TamperedError`. Decrypting under the
+     * caller-resolved `dek` is correct regardless of cache state or
+     * `perRecordKeys`.
+     *
+     * No CRDT resolution, no schema validation — same scope as `getAtTier`'s
+     * tier>0 branch (the established precedent for a tier-aware read), which
+     * skips both for the same reason: a tier>0 read is an internal/derived-
+     * output-recompute path, not the public per-record read surface schema
+     * validation guards.
+     */
+    decryptRecordAtDek(envelope: EncryptedEnvelope, dek: EnclaveKey, id?: string): Promise<T | null>;
     /**
      * Decrypt an envelope into a record of type `T`.
      *

package/dist/kernel/errors.d.ts

@@ -490,6 +490,62 @@ export declare class TierNotGrantedError extends NoydbError {
     readonly collection: string;
     constructor(collection: string, tier: number);
 }
+/**
+ * Thrown when a tier-0 `put()` or `delete()` targets a record whose LIVE
+ * envelope is elevated (`_tier > 0`) — regardless of whether the caller
+ * holds the tier's DEK. `put()`/`delete()` are the tier-0 write APIs;
+ * the sanctioned way to write an elevated record is `putAtTier()`,
+ * `elevate()`, or `demote()`.
+ *
+ * Distinct from `TierNotGrantedError`, which means "no DEK for tier N"
+ * and refuses only non-holders. This error refuses HOLDERS too — the
+ * problem isn't clearance, it's that `put()`/`delete()` are the wrong
+ * API for an already-elevated record (a tier-0 `put()` over one would
+ * otherwise silently demote it; a tier-0 `delete()` would write a
+ * marker with no `_tier`, erasing the elevation signal). It is also
+ * distinct from the read-path invisibility gate (`liveRecordIsElevated`
+ * in `tier-visibility.ts`), which throws nothing — elevated records
+ * simply read as absent there. This is a write-path refusal, not a
+ * read-path ghost.
+ *
+ * #708: also raised by the coordinated-cutover pre-check
+ * (`assertCutoverTierSafe`) — a bulk-rewrite is a third tier-0 write path,
+ * so it gets the same refusal with a `detail` override naming the record.
+ */
+export declare class TierWriteRefusedError extends NoydbError {
+    readonly tier: number;
+    readonly collection: string;
+    constructor(collection: string, tier: number, detail?: string);
+}
+/**
+ * Thrown at `vault.collection()` registration when `tiers` is declared
+ * together with a derived-artifact feature whose crypto has not yet been
+ * made tier-aware (elevate()/demote() do not re-key it), so an elevated
+ * record's data would stay readable at tier 0. Mirrors
+ * `UnsupportedIndexOptionError` — the refusal happens loudly at
+ * registration instead of leaking silently at rest.
+ *
+ * `feature` names the incompatible feature (e.g. `'blobs'`) so catch
+ * blocks can pattern-match without inspecting the error message.
+ */
+export declare class UnsupportedTierCompositionError extends NoydbError {
+    readonly feature: string;
+    constructor(feature: string, message: string);
+}
+/**
+ * Thrown by `createIntent` (blob durability journal, #753 spec §7 C8) when a
+ * `_blob_intent` marker already exists for `{collection}::{recordId}` — the
+ * CAS create-if-absent (`expectedVersion: 0`) lost to a present row. A
+ * present marker means a shred or rehome is already in flight for this
+ * record and MUST be resumed before any new intent is minted (overwriting it
+ * would orphan the prior op's op-stamps — spec C8). Callers catch this and
+ * resume the pending marker first, then retry.
+ */
+export declare class BlobIntentPendingError extends NoydbError {
+    readonly collection: string;
+    readonly recordId: string;
+    constructor(collection: string, recordId: string);
+}
 /**
  * Thrown when an elevated-handle operation runs after the elevation's
  * TTL expired. Reads continue at the original tier; only writes
@@ -816,6 +872,24 @@ export declare class IndexWriteFailureError extends NoydbError {
         cause: unknown;
     });
 }
+/**
+ * Thrown when `PersistedIndexStore`'s compensating `remove()` — the undo of a
+ * stale debounced `_ftindex` save that raced a purge (#725) — itself fails.
+ * That failure is sticky (`pendingCompensation`) and retried-first by every
+ * subsequent store entrypoint (`ensureBuilt`/`rebuildAndPersist`/
+ * `removePersisted`) rather than silently dropped, but was previously
+ * rethrown as the RAW adapter error indefinitely — indistinguishable from
+ * any other adapter failure, so a caller could not catch it deliberately the
+ * way `forget()` catches `_purgeSearchIndex` into `indexResidue` (#764).
+ *
+ * `cause` is the underlying adapter error. Callers that want stuck-
+ * compensation resilience instead of an abort (e.g. `elevate()`/`demote()`,
+ * #764) catch this type specifically and surface it as residue.
+ */
+export declare class PersistedIndexCompensationError extends NoydbError {
+    readonly cause: unknown;
+    constructor(cause: unknown);
+}
 /**
  * Thrown by `.where()` / `.orderBy()` / `.aggregate()` (via the Via
  * pipeline's `postureFor`/`wrapReducers`) when the field is covered by a Via
@@ -1838,7 +1912,7 @@ export declare class ClassifiedRotationError extends Error {
 }
 /**
  * A satellite-collection declaration or operation violated the refusal
- * matrix (R-S1…R-S9) of the satellite-collections design. The message
+ * matrix (R-S1…R-S10) of the satellite-collections design. The message
  * always names the R-S id.
  */
 export declare class SatelliteConfigError extends NoydbError {

package/dist/kernel/lazy-count.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Lazy-mode `count()` support (#706): count ids whose envelope is LIVE at
+ * tier 0 — parity with eager count (the hydrated cache excludes tombstones,
+ * delete markers, and elevated records, #701). Envelope inspection only —
+ * no record body is ever decrypted here.
+ *
+ * #713: when the adapter implements the optional `listPage`, page through
+ * it and apply the same predicate to each page's envelopes — one
+ * round-trip per page instead of one `list()` + one `get()` per id. Stores
+ * without `listPage` keep the original N+1 loop.
+ */
+import type { NoydbStore } from './types.js';
+export declare function countLiveEnvelopes(adapter: NoydbStore, vault: string, name: string, storeCiphertext: boolean): Promise<number>;

package/dist/kernel/noydb.d.ts

@@ -577,6 +577,14 @@ export declare class Noydb {
      * `by-*` real-time transport is injected via `coordinationStrategy`.
      */
     get coordination(): CoordinationProvider;
+    /**
+     * #693: true when multi-tab coordination is active at all — presence/election
+     * alone (`propagateWrites: false`) or full write-propagation — a peer tab can
+     * write this instance's shared store out-of-band either way, so per-collection
+     * marker-id sets are not authoritative and the re-create gate must fall back to
+     * a store read. Live (tab coordination is enable/disable-able at runtime).
+     */
+    get _tabCoordinationActive(): boolean;
     /**
      * Soft-lock a single vault: clear its in-memory keyring, DEKs, vault
      * instance, sync engine, policy enforcer, and active-tier entry —