@noy-db/hub 0.3.0-pre.11 → 0.3.0-pre.13

package/dist/with-audit/tiers/index.d.ts

@@ -26,6 +26,7 @@ export { TiersNotEnabledError } from '../../kernel/errors.js';
 import { type RecordCodec, type EnclaveKey, type SealedShredSlot } from '../../kernel/enclave/index.js';
 import type { UnlockedKeyring } from '../../with-party/team/keyring.js';
 import type { Lru } from '../../kernel/cache/index.js';
+import type { BlobFieldsConfig } from '../../with-shape/blobs/blob-compaction.js';
 import { type NoydbStore, type EncryptedEnvelope, type GhostRecord, type TierMode, type CrossTierAccessEvent } from '../../kernel/types.js';
 /** Everything the moving tier methods touched on `this.*`, as a flat context. */
 export interface TiersContext<T> {
@@ -46,6 +47,168 @@ export interface TiersContext<T> {
      * owns. `null` → no caching.
      */
     readonly cekCache: Lru<string, EnclaveKey> | null;
+    /**
+     * Sync the collection's decoded-record cache after a tier move rewraps the
+     * envelope (#691). The lazy LRU is evicted on EVERY call — it is never
+     * re-seeded, since a lazy `#getRaw` miss refetches and decodes the fresh
+     * envelope via its adapter fallback (a stale LRU entry after a tier-0
+     * `putAtTier` overwrite was the #702 lazy-mode gap). `null` → also evict
+     * the eager cache entry; an `entry` → set the eager cache to the given
+     * decoded record/version (used by `demote()` landing back at tier 0 and
+     * `putAtTier`'s tier-0 write, #702 — the record is tier-0, so it must stay
+     * plain-`get()`-readable in-session).
+     */
+    syncCache(id: string, entry: {
+        record: T;
+        version: number;
+    } | null): void;
+    /**
+     * Sync the collection's indexes after a tier move rewraps the envelope
+     * (#709). Persisted `_idx/<field>/<recordId>` side-cars hold the indexed
+     * field's PLAINTEXT value and are always encrypted under the tier-0 DEK,
+     * whatever the record's own tier — the same leak class `forget()` fixed
+     * via `purgePersistedIndexes` ("forget() crypto-shreds the body but keeps
+     * the collection DEK, under which these side-cars are encrypted — so
+     * without this they leave the indexed field VALUES readable"). `null` →
+     * the record just left tier 0: purge its persisted side-cars and drop its
+     * in-memory index entries. A record → it is tier-0 again: (re)build its
+     * entries from that record. Call this BEFORE {@link syncCache} — the
+     * implementation reads the pre-write cached value as "previous" to clean
+     * up stale index buckets, so it must run while that entry is still live.
+     * `version` stamps a rebuilt side-car's own envelope version — every
+     * caller has one in scope (the envelope it just wrote), including the
+     * purge (`null`) branches, which pass it along even though it's ignored
+     * there (#720: keeps the parameter honestly required, no dead default).
+     * `priorEnvelope` (#720) — the RAW envelope read BEFORE this call's own
+     * overwrite (already in scope as `existing`/`envelope` at every record-
+     * branch call site), so a lazy same-tier value change (a `putAtTier(0)`
+     * dropping an indexed field, a `demote(0)` off an elevated record) can
+     * still be tier-gate-decoded as "previous" once the live envelope itself
+     * has already moved past it. The `null`-record branches never pass one —
+     * see the implementation's doc comment for why they don't need to.
+     */
+    syncIndexes(id: string, record: T | null, version: number, priorEnvelope?: EncryptedEnvelope): Promise<void>;
+    /** Sync the collection's SEARCH artifacts after a tier move (#721). Both the
+     *  lexical `_ftindex` blob and the `_vec/<id>` embedding are encrypted under
+     *  the tier-0 DEK and hold the record's derived plaintext (full field text /
+     *  a text-invertible vector), so leaving them means elevation never hid what
+     *  the record was searchable by — the `forget()` precedent, unapplied to
+     *  elevate. `null` → the record left tier 0: purge its `_vec`, and
+     *  invalidate the `_ftindex` blob (the cache-driven rebuild then excludes
+     *  it). A record → it is tier-0 again: re-embed it, and invalidate
+     *  `_ftindex` (rebuild includes it). No-op fast when the collection has no
+     *  search. */
+    syncSearch(id: string, record: T | null, version?: number): Promise<void>;
+    /**
+     * Sync a record's `_history` snapshots after a tier move rewraps the live
+     * envelope (#712, at-rest hardening). Each snapshot carries its own key
+     * material (a direct DEK wrap, or a per-record `_cek` itself wrapped under
+     * the tier DEK) — `elevate()`'s live-body rewrap moves only the live
+     * envelope, leaving prior versions decryptable at rest under the tier the
+     * record has moved away from (the same leak class `forget()`'s
+     * `tombstoneHistory` closed for erasure). `fromDek`/`toDek` are the SAME
+     * DEKs the caller already resolved for the live rewrap — reuse them, don't
+     * recompute. No-op when the strategy is `NO_HISTORY`.
+     */
+    syncHistory(id: string, fromDek: EnclaveKey, toDek: EnclaveKey): Promise<void>;
+    /**
+     * Save a raw pre-move envelope as a `_history` snapshot (#728). Tier moves
+     * (`putAtTier`/`elevate`/`demote`) bump `_v` and overwrite the live
+     * envelope without ever snapshotting the version that existed just before
+     * the move — so `history()` silently lost it. The caller (`tiers/index.ts`)
+     * builds `envelope` by reusing the SAME `rewrapBodyToDek(envelope, fromDek,
+     * toDek)` result it already computed for the live write, so the snapshot
+     * lands wrapped under the DESTINATION tier's DEK — never `ctx.codec.
+     * encryptRecord`, which always resolves the tier-0 DEK and would leak the
+     * pre-move body whenever `fromTier > 0`. No-op when history is disabled
+     * (folds the `historyConfig.enabled` gate so `tiers/index.ts` stays simple).
+     */
+    saveHistorySnapshot(id: string, envelope: EncryptedEnvelope): Promise<void>;
+    /**
+     * `true` iff a real history strategy is wired (not `NO_HISTORY`) AND not
+     * explicitly disabled via `historyConfig.enabled`. `putAtTier` checks this
+     * BEFORE decrypting `existing` to build a snapshot (#728, #737 regression
+     * fix) — unlike elevate/demote, which reuse a `body` rewrap their live
+     * write needs unconditionally, putAtTier's live write never decrypts the
+     * prior envelope, so building a snapshot is the ONLY reason it would
+     * touch (and potentially throw decrypting) `existing`'s ciphertext. A
+     * derivation-free, history-disabled collection must not pay that decode —
+     * or risk it, on a corrupted/inaccessible prior body — same law
+     * `hasDerivedOutputs` already enforces for the derived-outputs decode.
+     */
+    readonly historyEnabled: boolean;
+    /**
+     * Rehome a record's blob attachments after a tier move (#724 Arc 10 Task
+     * 2, at-rest hardening). A blob's home tier is its owning record's tier —
+     * the `_blob` DEK is tier-scoped (`dekKey('_blob', tier)`), so a solo-
+     * owned blob's content CEK must move with the record or it stays
+     * tier-0-unwrappable at rest even once the live body has moved (the same
+     * leak class `syncHistory` closes for `_history` snapshots). Delegates to
+     * `BlobSet.rehomeForTier`; no-op fast when the collection has no blob
+     * fields. Order-independent with the other sync hooks — touches only
+     * blob side structures, not this collection's own cache/indexes.
+     */
+    syncBlobs(id: string, fromTier: number, toTier: number): Promise<void>;
+    /**
+     * Purge a record's tier-0-era plaintext ledger deltas after a tier move
+     * lands it above tier 0 (#729). The audit ledger is a flat, vault-wide,
+     * hash-chained log — a record's reverse-JSON-Patch deltas in
+     * `_ledger_deltas` are encrypted under one collection-wide `_ledger` DEK
+     * (not the record's own tier DEK), so `elevate()`/`putAtTier()`'s live-body
+     * rewrap never moves them: they stay readable at rest to any tier-0
+     * caller, the same leak class `syncHistory` closed for `_history`
+     * snapshots. Chain-safe: `verify()` reads only `_ledger` entry fields
+     * (including `deltaHash`, which lives on the entry, not the deleted delta
+     * row), never `_ledger_deltas`, so a purge cannot break it.
+     * **Irreversible** — the deleted plaintext cannot be restored by
+     * `demote()`. **Metadata-retained** — the `_ledger` entries (that the
+     * record was mutated, at which version/timestamp/actor) are untouched;
+     * only the delta *content* is purged. No-op when the collection has no
+     * ledger (`withHistory()` not enabled).
+     */
+    syncLedger(id: string): Promise<void>;
+    /**
+     * Sync a record's derived outputs (materialized-view rows, rollup
+     * contributions, `withDerivation` outputs) after a tier move (#722).
+     * Those outputs are computed from this record and written to OTHER
+     * (output) collections via a plain `put` at tier 0 — `elevate()`'s live-
+     * body rewrap moves only the source envelope, so the output rows keep
+     * holding the source's tier-0-era plaintext, the same leak class
+     * `syncSearch`/`syncIndexes` closed for THIS collection's own artifacts.
+     * `elevated` (landing tier > 0) reuses the SAME onDelete fanout
+     * `forgetDerivedFanout` drives for `forget()` (`kernel/via/dispatch.ts`)
+     * — minus its `'ref'` cascade edge (elevate/demote never erase a
+     * *different* record) — to recompute this record's derived outputs as
+     * REMOVED. Recompute is tier-safe: the fanout's own source scan reads
+     * the elevated-excluding cache (#701/#709/#712), so it naturally omits
+     * the now-elevated record instead of re-embedding its plaintext. Landing
+     * back at tier 0 (`elevated === false`) is the reverse (Task 2, #722):
+     * `syncDerivedOutputs` instead runs the ordinary local-write add-
+     * dispatchers (`dispatchDerivations`/`dispatchMaterializedViews`, the
+     * same ones a plain `put()` fires) to restore the contribution —
+     * reversible, since the source's plaintext survives the elevate/demote
+     * rewrap round-trip. `record` is the decoded source record (PRE-move on
+     * the remove side, POST-move on the add side); only the rollup edge
+     * consumes it on remove, both add-dispatchers require it on add; `null`
+     * (tombstone/delete-marker) skips both. `version` stamps the add-
+     * dispatchers' `_derivedFrom.sourceVersion` metadata — reuses the version
+     * the tier op already has, no re-read; unused on the remove side. No-op
+     * fast when the collection has no MV/derivation source — each dispatcher
+     * below checks its own source before doing any work.
+     */
+    syncDerived(id: string, record: T | null, elevated: boolean, version?: number): Promise<void>;
+    /**
+     * `true` iff the collection has a materialized-view or derivation source
+     * attached. Gates the {@link syncDerived} pre-move decode on the remove
+     * direction (`elevate()`, `putAtTier(tier>0)`, `demote()`'s intermediate-
+     * tier branch): those sites decode the record SOLELY to feed
+     * `syncDerived(..., true)`, whose dispatchers no-op immediately when the
+     * collection has no MV/derivation source — so a no-derivation collection
+     * would otherwise pay a full record-body decrypt on every tier move for
+     * nothing (#722 perf regression). `false` short-circuits the decode to
+     * `null`, which `syncDerivedOutputs` already treats safely.
+     */
+    readonly hasDerivedOutputs: boolean;
     /** Emit `_source`/`_sourceTs` provenance fields when a source is supplied. */
     readonly provenance: boolean;
     /** Declared tiers, or null when the feature is off. */
@@ -56,9 +219,108 @@ export interface TiersContext<T> {
     getDEK(key: string): Promise<EnclaveKey>;
     /** Fire a cross-tier access event (sink stays collection-resident). */
     emitCrossTierEvent(event: CrossTierAccessEvent): void;
+    /**
+     * Register this record's ref in the encrypted `_subject_index` (#766).
+     * `putAtTier`'s raw `ctx.adapter.put` bypasses `Collection.put()`'s write-
+     * hook pipeline — the `onAfterWrite` hook that normally does this — so a
+     * record whose FIRST persistence is `putAtTier` (sensitive from birth, a
+     * documented legitimate use) would otherwise never enter the index and
+     * stay unreachable by `vault.forget()`. Idempotent (safe on every call,
+     * including a repeat write of an already-registered record) and a no-op
+     * when the collection declares no forget-subject field.
+     */
+    addSubjectRef(id: string, record: T): Promise<void>;
 }
 export declare function assertTiersEnabled<T>(ctx: TiersContext<T>): void;
 export declare function assertDeclaredTier<T>(ctx: TiersContext<T>, tier: number): void;
+/**
+ * Tier-composition guard (#724 / Arc 7 of the tier-invisibility campaign).
+ *
+ * Refuses `tiers` declared together with a derived-artifact feature whose
+ * crypto has not yet been made tier-aware — i.e. a feature `elevate()` /
+ * `demote()` does not re-key when a record moves tiers, so an elevated
+ * record's data for that feature would stay readable at tier 0.
+ *
+ * **Status:** the original call site (`Collection` constructor, beside
+ * `buildUniqueConstraintSet`) was removed by Arc 10 Task 1 (#724) — the
+ * `tiers + blobFields` refusal below was superseded by a runtime read gate
+ * on `collection.blob(id)` (`with-shape/blobs/blob-set.ts`), so this
+ * function currently has no caller. Relocated here from
+ * `with-lookup/indexing/unique-constraints.ts` (#733) so the tier-domain
+ * guard lives in the tier domain, rather than an indexing file it only
+ * borrowed for a grandfathered import specifier.
+ *
+ * ## #724 verified: `tiers + blobFields` leaks
+ *
+ * `collection.blob(id)` (`Collection.blob()`) never checks the live
+ * record's tier before returning a `BlobSet` handle, and `BlobSet`'s crypto
+ * is entirely orthogonal to the tier ladder:
+ *  - the slot map (`_blob_slots_{collection}/{id}`) is encrypted under the
+ *    collection's TIER-0 DEK (`getDEK(name)` ≡ `dekKey(name, 0)` — see
+ *    `dekKey` in `with-party/team/tiers.ts`), never a tier-N DEK;
+ *  - chunk content (`_blob_index` / `_blob_chunks`) is encrypted under the
+ *    vault-shared `_blob` DEK (`BLOB_COLLECTION`), which has no tier
+ *    dimension at all.
+ * `elevate()`/`demote()` (this file) rewrap only the live record body,
+ * `_history` snapshots (#712), and index side-cars — blob slots and chunks
+ * are untouched. A caller whose keyring never held the record's elevated
+ * tier DEK can still open `collection.blob(id).get(slot)` and read full
+ * plaintext, even though `collection.get(id)` correctly reports the same
+ * record as invisible. See `__tests__/tier-composition-guard.test.ts` for
+ * the reproduction.
+ *
+ * ## Safe today — no check needed here
+ *
+ * Field indexes, search (`textIndexes`/`embeddings`), `withHistory`
+ * (snapshot keys are rewrapped by `elevate()`/`demote()`, #712), and the
+ * decoded-record cache (evicted on tier moves) are already tier-safe. They
+ * are not enumerated below; only known-unsafe features are refused, so any
+ * combination not named here passes silently by default.
+ *
+ * ## Deliberately NOT handled here
+ *
+ * - `ledger` — `withHistory` threads a ledger writer onto every tiered
+ *   collection by default in shipped usage; refusing `tiers + ledger` would
+ *   break that default. A ledger-specific tier-rekey handler (rewrap ledger
+ *   entries, or scope ledger visibility to tier) is a separate arc.
+ * - materialized-view (MV) output — an MV's fanout spec lives on the
+ *   SOURCE collection, not on the MV collection's own config, so it is not
+ *   visible at `vault.collection()` registration time and this guard cannot
+ *   detect it structurally.
+ */
+export declare function assertTierComposition(collectionName: string, cfg: {
+    readonly tiers: boolean;
+    readonly blobFields: BlobFieldsConfig | undefined;
+}): void;
+/**
+ * Structural surface {@link syncDerivedOutputs} needs from the owning
+ * collection — the SAME onDelete dispatchers `forgetDerivedFanout` already
+ * drives (`kernel/via/dispatch.ts`), reused as-is (#722). Narrower than
+ * `Collection<T>` (avoids an import cycle: collection.ts constructs
+ * `TiersContext` FROM `this`, which already satisfies this shape
+ * structurally — no cast needed at the `tiersContext()` call site).
+ */
+export interface DerivedOutputsHost<T> {
+    dispatchMaterializedViewsOnDelete(id: string): Promise<{
+        deleted: number;
+        residueUndecodable: string[];
+        residueDeclined: string[];
+    }>;
+    dispatchArrayDerivationsOnDelete(id: string, eraseRecordShapeToo?: boolean): Promise<number>;
+    dispatchRollupsOnDelete(id: string, deleted: T): Promise<unknown>;
+    /** Task 2 (#722) add-direction: the same local-write dispatchers an ordinary `put()` fires. */
+    dispatchMaterializedViews(id: string, record: T): Promise<void>;
+    dispatchDerivations(id: string, record: T, version: number): Promise<void>;
+}
+/**
+ * The {@link TiersContext.syncDerived} implementation collection.ts's
+ * `tiersContext()` binds `this` into (#722). See that field's doc comment
+ * for the design; `host` is `this` — every dispatcher below is a public
+ * Collection method, already self-guarding (no-op) when the collection has
+ * no materialized-view/derivation source, so no separate fast-path check is
+ * needed here.
+ */
+export declare function syncDerivedOutputs<T>(host: DerivedOutputsHost<T>, id: string, record: T | null, elevated: boolean, version?: number): Promise<void>;
 /**
  * tier-aware put. Encrypts the record with the collection's tier-N DEK and
  * stamps `_tier: N` on the envelope. The caller's keyring must hold the tier-N
@@ -78,7 +340,7 @@ export declare function putAtTier<T>(ctx: TiersContext<T>, id: string, record: T
     };
     source?: string;
     sourceTs?: string;
-}): Promise<void>;
+}): Promise<TierMoveResult>;
 /**
  * tier-aware get. When the stored record is at a tier the caller cannot
  * decrypt:
@@ -100,18 +362,28 @@ export declare function listAtTier<T>(ctx: TiersContext<T>): Promise<Array<{
     tier: number;
     readable: boolean;
 }>>;
+/**
+ * Result of a completed `elevate()`/`demote()` (#764). The record move
+ * (put + indexes/cache/ledger/derived/history/blobs sync) always completes —
+ * `searchResidue: true` means only the search-index side (`_vec`/`_ftindex`)
+ * was left in a needs-retry state (a stuck `PersistedIndexCompensationError`),
+ * mirroring `forget()`'s `indexResidue` posture rather than aborting the move.
+ */
+export interface TierMoveResult {
+    readonly searchResidue: boolean;
+}
 /**
  * elevate a record to a higher tier. Re-encrypts with the target tier's DEK.
  * The caller must hold DEKs for both the current tier (to decrypt) and the
  * target tier (to re-encrypt). Stamps `_elevatedBy` with the caller id so
  * `demote()` can check the reverse operation.
  */
-export declare function elevate<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<void>;
+export declare function elevate<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<TierMoveResult>;
 /**
  * demote a record to a lower tier. Allowed only for the user who performed the
  * last elevation or an owner.
  */
-export declare function demote<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<void>;
+export declare function demote<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<TierMoveResult>;
 /**
  * Classify a live envelope's `_sealed` slots for crypto-shred completeness
  * (#M-1). Thin delegate to {@link RecordCodec.classifySealedShred}; surfaced

package/dist/with-audit/tiers/strategy.d.ts

@@ -8,7 +8,8 @@
  * @internal
  */
 import type { GhostRecord } from '../../kernel/types.js';
-import type { TiersContext } from './index.js';
+import type { TiersContext, TierMoveResult } from './index.js';
+export type { TierMoveResult };
 export interface TiersStrategy {
     putAtTier<T>(ctx: TiersContext<T>, id: string, record: T, tier: number, opts?: {
         elevation?: {
@@ -17,15 +18,15 @@ export interface TiersStrategy {
         };
         source?: string;
         sourceTs?: string;
-    }): Promise<void>;
+    }): Promise<TierMoveResult>;
     getAtTier<T>(ctx: TiersContext<T>, id: string): Promise<T | GhostRecord | null>;
     listAtTier<T>(ctx: TiersContext<T>): Promise<Array<{
         id: string;
         tier: number;
         readable: boolean;
     }>>;
-    elevate<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<void>;
-    demote<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<void>;
+    elevate<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<TierMoveResult>;
+    demote<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<TierMoveResult>;
 }
 /**
  * No-op stub — the floor default. Every capability method throws

package/dist/with-cargo/describe-extraction.d.ts

@@ -7,7 +7,7 @@
  * @module
  */
 import type { Vault } from '../kernel/vault.js';
-import { type WalkClosureOptions } from './walk-closure.js';
+import { type WalkClosureOptions, type DanglingRefNotice } from './walk-closure.js';
 export interface ExtractionPreview {
     readonly totalRecords: number;
     /** Sum of serialized encrypted-envelope sizes (bytes). */
@@ -29,5 +29,13 @@ export interface ExtractionPreview {
         readonly collection: string;
         readonly id: string;
     }>;
+    /**
+     * #772: outbound FK edges whose referenced parent was excluded from the
+     * closure (missing, or tier-elevated and therefore invisible) — mirrors
+     * `ExtractPartitionResult.danglingRefs` (#759) so a preview/extract pair
+     * gives the SAME signal. A parent excluded this way never appears in
+     * `byCollection` at all; this is the only preview-time indicator.
+     */
+    readonly danglingRefs: ReadonlyArray<DanglingRefNotice>;
 }
 export declare function describeExtraction(vault: Vault, opts: WalkClosureOptions): Promise<ExtractionPreview>;

package/dist/with-cargo/extract-partition.d.ts

@@ -9,7 +9,7 @@
 import type { Vault } from '../kernel/vault.js';
 import type { EncryptedEnvelope } from '../kernel/types.js';
 import { type EnclaveKey } from '../kernel/enclave/index.js';
-import { type WalkClosureOptions } from './walk-closure.js';
+import { type WalkClosureOptions, type DanglingRefNotice } from './walk-closure.js';
 import { type TransferSealPayload } from '../with-pod/bundle.js';
 /** Re-keyed collections snapshot + the fresh DEKs used. */
 export interface ReKeyResult {
@@ -113,6 +113,14 @@ export interface ExtractPartitionResult {
     /** Raw 32-byte transfer key — deliver out-of-band; required to adopt. */
     readonly transferKey: Uint8Array;
     readonly sealId: string;
+    /**
+     * #759: outbound FK edges whose referenced parent was excluded from the
+     * partition (missing, or tier-elevated and therefore invisible). The
+     * child record still carries its FK value; the parent did not travel —
+     * callers should surface this to the operator rather than assume
+     * referential completeness.
+     */
+    readonly danglingRefs: ReadonlyArray<DanglingRefNotice>;
 }
 /**
  * Extract a re-keyed, transfer-sealed partition. Owner-only

package/dist/with-cargo/walk-closure.d.ts

@@ -8,9 +8,10 @@
  *   1. INBOUND expansion: from selected records, pull every record
  *      that references them (children travel with parents), to a
  *      fixed point.
- *   2. OUTBOUND completion: pull every parent the selected set
- *      references (no dangling FKs), transitively, WITHOUT
- *      re-expanding inbound from those parents (bounds the closure).
+ *   2. OUTBOUND completion: pull every VISIBLE parent the selected set
+ *      references, transitively, WITHOUT re-expanding inbound from those
+ *      parents (bounds the closure). A tier-elevated (or missing) parent is
+ *      excluded rather than admitted — see `danglingRefs` on the result.
  *
  * The FK graph is auto-derived from the vault's existing RefRegistry
  * (the `ref('target')` declarations on collections) — no hand-written
@@ -25,6 +26,32 @@ export interface WalkClosureOptions {
     /** Max fixed-point iterations before throwing. Default 16. */
     readonly maxDepth?: number;
 }
+/**
+ * #759: an outbound FK edge whose referenced parent was excluded from the
+ * closure — either because it doesn't exist, or because it is tier-elevated
+ * and therefore invisible (same "elevated ≡ missing" semantics as root
+ * selection / inbound expansion). The child keeps its FK value; the parent
+ * does not travel. Callers (extract-partition) surface this as a residue
+ * notice rather than silently dropping it.
+ */
+export interface DanglingRefNotice {
+    /** Collection of the child record that holds the dangling FK. */
+    readonly collection: string;
+    /** Id of the child record. */
+    readonly id: string;
+    /** FK field on the child that references the missing/elevated parent. */
+    readonly field: string;
+    /** Target collection the FK points at. */
+    readonly target: string;
+    /** Id of the missing/elevated parent. */
+    readonly targetId: string;
+    /**
+     * #772: distinguishes an intentional tier boundary (`'elevated'` — the
+     * parent exists but is above the caller's readable tier) from a genuine
+     * data-integrity gap (`'missing'` — no envelope for `targetId` at all).
+     */
+    readonly reason: 'missing' | 'elevated';
+}
 export interface ClosureResult {
     /** collection → set of record ids that travel together. */
     readonly closure: Map<string, Set<string>>;
@@ -34,5 +61,7 @@ export interface ClosureResult {
         /** True if an edge pointed back to an already-selected node. */
         readonly cyclesDetected: boolean;
     };
+    /** #759: outbound FK edges whose parent was excluded (missing or elevated). */
+    readonly danglingRefs: ReadonlyArray<DanglingRefNotice>;
 }
 export declare function walkClosure(vault: Vault, opts: WalkClosureOptions): Promise<ClosureResult>;

package/dist/with-commit/history/history.d.ts

@@ -1,4 +1,5 @@
 import type { NoydbStore, EncryptedEnvelope, HistoryOptions, PruneOptions } from '../../kernel/types.js';
+import { type EnclaveKey } from '../../kernel/enclave/index.js';
 /** Save a history entry (a complete encrypted envelope snapshot). */
 export declare function saveHistory(adapter: NoydbStore, vault: string, collection: string, recordId: string, envelope: EncryptedEnvelope): Promise<void>;
 /** Get history entries for a record, sorted newest-first. */
@@ -25,3 +26,48 @@ export declare function clearHistory(adapter: NoydbStore, vault: string, collect
  * Returns the number of history versions newly tombstoned.
  */
 export declare function tombstoneHistory(adapter: NoydbStore, vault: string, collection: string, recordId: string, actor: string, encrypted: boolean): Promise<number>;
+/**
+ * Re-key every `_history` snapshot of a record from `fromDek` to `toDek`.
+ * Mirrors what `rewrapBodyToDek` already does for a record's LIVE body on a
+ * tier move (elevate/demote/putAtTier) — each `_history` envelope also
+ * carries its own `_cek`, wrapped under the collection's tier-0 DEK at write
+ * time (`record-codec.ts`), so a tier move that rewraps only the live
+ * envelope leaves prior versions decryptable at rest under the tier the
+ * record left. This is defense-in-depth *beneath* the read-gate
+ * (`history()`/`getVersion()` already return empty for an elevated record;
+ * this protects the ciphertext even if that gate is bypassed).
+ *
+ * Rewraps content in place — unlike `tombstoneHistory`, it does NOT blank
+ * `_iv`/`_data`/`_cek` — so a subsequent `demote()` restores tier-0
+ * readability. Tombstone-shaped entries (a forgotten/shredded version —
+ * blanked `_data`, no `_cek`) are skipped: there is no key material left to
+ * rewrap.
+ *
+ * **Legacy fallback.** A snapshot written before this fix stays wrapped
+ * under the tier-0 DEK even after its live record has since moved tiers, so
+ * a rewrap attempted with a tier-N `fromDek` fails to unwrap/decrypt. When
+ * the caller supplies `tier0Dek`, a failed rewrap is retried once with
+ * `tier0Dek` as `fromDek` (the only other key a pre-fix snapshot can be
+ * wrapped under — history is written only by tier-0 `put()`). The output is
+ * always wrapped under `toDek` regardless of which `fromDek` succeeded. A
+ * rewrap that fails under BOTH keys re-throws — that is real corruption, not
+ * a tier mismatch, and must not be swallowed.
+ *
+ * **Crash-atomicity / idempotency (#712 whole-branch-fix-3).** This loop has
+ * no transaction around it: a crash after some entries have been rewritten
+ * under `toDek` but before the loop finishes leaves the record's history
+ * split across two keys. A retry of the SAME call must not re-fail on the
+ * entries that already made it — so each entry is probed with
+ * `isRewrappedUnder(env, toDek)` FIRST; a match means it's already at the
+ * target key and is skipped (put nothing). This makes same-target retries
+ * and demote-after-crash fully self-healing. It does NOT close every crash
+ * window: a crash that lands SOME entries under `toDek` while the record's
+ * NEXT move target differs from this call's `toDek` (an intermediate-tier
+ * crash — e.g. elevate 0→1 crashes mid-loop, then the record is moved 1→2)
+ * still finds those entries unreadable under either `fromDek` or the
+ * tier-0 fallback, since `toDek` is a third key the next call never probes
+ * for. That residual window is an accepted, fail-closed limitation (see
+ * `.changeset/history-at-rest.md` and the design doc) — availability is
+ * lost, never confidentiality.
+ */
+export declare function rewrapHistory(adapter: NoydbStore, vault: string, collection: string, recordId: string, fromDek: EnclaveKey, toDek: EnclaveKey, tier0Dek?: EnclaveKey): Promise<void>;

package/dist/with-commit/history/ledger/store.d.ts

@@ -216,6 +216,27 @@ export declare class LedgerStore {
      * backward" signal and falls back to the on-disk current value.
      */
     loadDelta(index: number): Promise<JsonPatch | null>;
+    /**
+     * Purge a record's tier-0-era plaintext deltas (#729). Deletes each
+     * `_ledger_deltas/<paddedIndex>` row whose entry matches
+     * `(collection, id)` and carries a delta, then returns the count
+     * deleted.
+     *
+     * Chain-safe by construction: `verify()` recomputes the tamper-chain
+     * from each `_ledger` entry's own canonical fields — including the
+     * stored `deltaHash` field, which lives on the entry, not on the
+     * `_ledger_deltas` row — and never re-reads `_ledger_deltas`.
+     * Deleting a delta row therefore cannot break `verify()`.
+     * `reconstruct()` already treats a missing delta (`loadDelta` →
+     * `null`) as a pruned stop, so a purge just makes the pre-purge
+     * plaintext unreachable rather than corrupting anything.
+     *
+     * No `_ledger` entry is touched and nothing is re-encrypted — this
+     * is irreversible (the deleted plaintext cannot be recovered) but
+     * leaves the entry metadata (that the record was mutated, at which
+     * version/timestamp/actor) fully intact for audit purposes.
+     */
+    purgeRecordDeltas(collection: string, id: string): Promise<number>;
     /** Encrypt a JSON Patch into an envelope for storage. Mirrors encryptEntry. */
     private encryptDelta;
     /**

package/dist/with-commit/history/strategy.d.ts

@@ -85,6 +85,16 @@ export interface HistoryStrategy {
      * tombstoned, or `0` under `NO_HISTORY` (no history = nothing to shred).
      */
     tombstoneHistory(adapter: NoydbStore, vault: string, collection: string, recordId: string, actor: string, encrypted: boolean): Promise<number>;
+    /**
+     * Re-key every `_history` snapshot of a record from `fromDek` to `toDek`
+     * on a tier move (elevate/demote/putAtTier), mirroring the live-body
+     * rewrap so prior versions are not left decryptable at rest under a tier
+     * the record has moved away from. Optional `tier0Dek` enables the legacy
+     * fallback for snapshots written before this rewrap existed (see
+     * `history.ts` for the full contract). No-op under `NO_HISTORY` (no
+     * history = nothing to rewrap).
+     */
+    rewrapHistory(adapter: NoydbStore, vault: string, collection: string, recordId: string, fromDek: EnclaveKey, toDek: EnclaveKey, tier0Dek?: EnclaveKey): Promise<void>;
     /**
      * Compute the SHA-256 hash of an envelope's encrypted payload, used
      * by `LedgerStore.append` to track tamper-evidence. Returns the

package/dist/with-commit/history/time-machine.d.ts

@@ -119,6 +119,16 @@ export declare class CollectionInstant<T = unknown> {
      * Return the record as it existed at the target timestamp, or
      * `null` if the record had not been created yet or had already been
      * deleted by then.
+     *
+     * Gated on the LIVE record's current tier — #730, mirroring the #712
+     * read-gate `history()`/`getVersion()` already apply: an elevated record
+     * is invisible through the whole time-machine surface, not just a
+     * decrypt failure. See {@link resolveVisibleEnvelope}.
+     *
+     * Decrypts through {@link openEnvelopeJson}, the `_cek`-aware envelope
+     * body opener — a snapshot from a `perRecordKeys` collection is encrypted
+     * under its own per-record CEK (wrapped in `_cek`), not the collection
+     * DEK directly.
      */
     get(id: string): Promise<T | null>;
     /**
@@ -134,6 +144,19 @@ export declare class CollectionInstant<T = unknown> {
     put(_id: string, _record: T): Promise<never>;
     delete(_id: string): Promise<never>;
     update(_id: string, _patch: Partial<T>): Promise<never>;
+    /**
+     * {@link resolveEnvelope}, additionally gated on the record's LIVE
+     * (current, not historical) tier — #730. Mirrors the #712 read-gate
+     * `history()`/`getVersion()` apply: history snapshots keep their
+     * tier-0-wrapped CEKs and carry no `_tier` of their own, so an elevated
+     * record's prior versions would otherwise stay tier-0-decryptable here.
+     * `null` for a resolved envelope carrying its own `_tier > 0` (a
+     * tier-aware snapshot reached some other way) or whose LIVE record is
+     * currently elevated — both `get()` and `list()` route through this so
+     * the invisibility law holds on the whole time-machine read surface, not
+     * just a decrypt failure.
+     */
+    private resolveVisibleEnvelope;
     /**
      * Return the envelope that represents the record's state at
      * `targetTs`, accounting for deletes. `null` if the record didn't

package/dist/with-commit/tx/elevated-handle.d.ts

@@ -1,4 +1,5 @@
 import type { Vault } from '../../kernel/vault.js';
+import type { TierMoveResult } from '../../with-audit/tiers/index.js';
 /**
  * Reserved collection that holds the audit ledger of elevation
  * sessions. One envelope per `vault.elevate(...)` call.
@@ -44,7 +45,7 @@ export declare class ElevatedHandle {
      * unprivileged" trivially true.
      */
     collection<T>(name: string): {
-        put(id: string, record: T): Promise<void>;
+        put(id: string, record: T): Promise<TierMoveResult>;
     };
     /**
      * Manually revert the elevation. Idempotent — calling twice (or

package/dist/with-commit/tx/transaction.d.ts

@@ -199,6 +199,11 @@ export declare function runTransaction<T>(db: Noydb, fn: (tx: TxContext) => Prom
  * state can still reconstruct it by walking the ledger through the
  * failed-tx timestamp.
  *
+ * Delegates the reverse/best-effort/raw-revert shape to the shared
+ * `bestEffortRevert` helper (`kernel/best-effort-revert.ts`); the cache
+ * invalidation below rides along as that helper's per-leg `compensate`
+ * callback, gated on `db` exactly as before.
+ *
  * @internal — shared between `runTransaction` and
  * `Collection.putManyAtomic`. Both register source ops + nested
  * derivation side-effect ops onto `_executed`; this helper unwinds the

package/dist/with-formula/materialized-views/executor.d.ts

@@ -36,6 +36,15 @@ export interface RefreshResult {
     deleted: number;
     /** Failed row writes (non-strict mode). */
     failed: number;
+    /** #782/#785 — `outputCollection:id` entries from the tombstone pass whose ownership stamp
+     *  couldn't be decoded under the collection's default DEK (undecodable, mirroring
+     *  `invalidateMVAtRest`'s #776 posture) — ownership UNCONFIRMED. Only populated when
+     *  `onEmpty: 'delete'`. */
+    residueUndecodable: string[];
+    /** #782/#785 — `outputCollection:id` entries that decoded, stamp-matched this MV, but
+     *  `_internalDelete` declined (the #718 tier-elevation gate) — ownership CONFIRMED, a real
+     *  silent survival, surfaced rather than dropped. Only populated when `onEmpty: 'delete'`. */
+    residueDeclined: string[];
 }
 /**
  * Run an MV's `query()` and write the result rows to the output