@noy-db/hub 0.3.0-pre.11 → 0.3.0-pre.13

package/dist/with-formula/materialized-views/stale.d.ts

@@ -1,8 +1,9 @@
 import type { Collection } from '../../kernel/collection.js';
 import type { TxContext } from '../../with-commit/tx/transaction.js';
 import type { PutDerivedOutputCtx } from '../../kernel/via/dispatch.js';
-import type { MaterializedViewRegistry } from './registry.js';
+import type { MaterializedViewRegistry, RegisteredMV } from './registry.js';
 import type { MVQueryContext } from './types.js';
+import type { NoydbStore } from '../../kernel/types.js';
 /**
  * Accessor shape passed in from the owning Vault. Provides the
  * registry (used as a stable WeakMap key + to look up MVs by output
@@ -30,6 +31,48 @@ export declare function markMVStale(registry: MaterializedViewRegistry, mvName:
  * @internal
  */
 export declare function isMVStale(registry: MaterializedViewRegistry, mvName: string): boolean;
+/**
+ * Reserved collection holding CONTENT-FREE lazy-stale markers (record id =
+ * MV name, plaintext `_iv: ''` envelope, no payload) — mirrors the
+ * `_meta`/schema-fence marker envelope shape. Written only from the
+ * delete/forget/elevate dispatcher (#736); ordinary source writes stay
+ * in-memory-only (the cheap path). Read via the adapter directly, never
+ * through `vault.collection()` — same reserved-collection convention as
+ * `_subject_index`/`_meta`.
+ */
+export declare const MV_STALE_COLLECTION = "_mv_stale";
+/**
+ * Invalidate an MV from the delete/forget/elevate dispatcher (#736) — the ordinary
+ * source-write path (`dispatchMaterializedViews`) never calls this. Deletes EVERY
+ * persisted row in `reg.outputCollection` via `_internalDelete` (the at-rest law: a
+ * stale mark alone leaves the elevated/forgotten source's plaintext sitting in the
+ * output row) using the adapter directly so the read-path's `resolveStaleMVOnRead`
+ * isn't triggered mid-invalidation. `mode: 'lazy'` also persists the stale mark so a
+ * cold session recomputes on next read; `'manual'` gets the purge only — the MV
+ * serves empty until an explicit `vault.refreshView()` (erasure wins). Deletion is
+ * stamp-scoped (`_materializedFrom.mvName === reg.spec.name` — see the loop below),
+ * so another registered MV sharing this output collection keeps its own rows intact:
+ * no cross-MV re-marking is needed here, only `reg` itself is marked stale.
+ *
+ * Returns the count of rows actually `_internalDelete`d (#761 item 1) — folded by the
+ * caller into `dispatchMaterializedViewsOnDelete`'s `deleted` so `ForgetResult.derivedRecordsErased`
+ * counts lazy/manual purges too, not just the eager executor's tombstone leg — plus
+ * `residueUndecodable`, the bare ids whose ownership stamp could NOT be decoded (#776): a
+ * candidate row that fails to decode under the collection's default DEK (e.g. elevated above
+ * tier 0 on a tiered output collection) has UNKNOWN ownership — it might be this MV's own
+ * output, or (same-collection shape) a plain user record — so it is never erased, but it must
+ * be SURFACED rather than silently skipped (the #724 posture), since it may still hold the
+ * forgotten/pre-elevation contribution, decryptable by tier-holders — and `residueDeclined`
+ * (#785), the bare ids that DID decode and stamp-match but whose `_internalDelete` declined
+ * (ownership CONFIRMED, erasure declined).
+ *
+ * @internal
+ */
+export declare function invalidateMVAtRest(accessor: MVStaleAccessor, reg: RegisteredMV, mode: 'lazy' | 'manual'): Promise<{
+    deleted: number;
+    residueUndecodable: string[];
+    residueDeclined: string[];
+}>;
 /**
  * Called from `Collection.get` (and any reader that materializes the
  * MV's output collection). If any MV producing `outputCollection` is
@@ -60,3 +103,11 @@ export declare function resolveStaleMVOnRead(accessor: MVStaleAccessor, outputCo
  * @internal
  */
 export declare function clearMVStale(registry: MaterializedViewRegistry, mvName: string): void;
+/**
+ * `clearMVStale` plus the persisted marker (#736) — `Vault.refreshView()`'s
+ * completion path. A lingering persisted marker after a manual refresh would
+ * make the NEXT cold session recompute redundantly.
+ *
+ * @internal
+ */
+export declare function clearMVStaleFully(adapter: NoydbStore, vault: string, registry: MaterializedViewRegistry, mvName: string): Promise<void>;

package/dist/with-lookup/embeddings/index.d.ts

@@ -1,3 +1,4 @@
 export { cosine } from './cosine.js';
 export { embeddingSourceText, type EmbeddingDescriptor } from './descriptor.js';
 export { VectorSet, type StoredVector, type VectorHit } from './vector-set.js';
+export { encodeVecId } from './vec-id.js';

package/dist/with-lookup/embeddings/vec-id.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Collection-namespaced `_vec` side-car ids (#726).
+ *
+ * `_vec` embedding side-cars used to be keyed by the bare record id,
+ * vault-wide — two collections sharing a record id shared one `_vec` row.
+ * This was verified to be a clobber/crash bug, NOT a confidentiality leak:
+ * every collection has its own DEK, and AES-GCM auth-tag verification means
+ * decrypting a foreign collection's `_vec` row under the wrong DEK throws
+ * `TamperedError` rather than returning wrong plaintext — no disclosure
+ * mechanism exists. The real bug was id collision: a same-id write/forget in
+ * one collection could clobber or delete the other collection's row, and a
+ * collection whose `similarTo()` / cold semantic `retrieve()` encountered a
+ * foreign same-id row crashed with an uncaught `TamperedError` (a DoS). The
+ * store-collection bucket stays the literal `'_vec'`; the id becomes
+ * composite: `${collection}/${recordId}`. Mirrors `encodeIdxId`
+ * (`../indexing/persisted-indexes.js`).
+ *
+ * Decode is deliberately NOT split-on-`/`: the collection is always known
+ * at the decode site (`ctx.name`), so `decodeVecId` strips that known
+ * prefix — correct even when `recordId` itself contains `/`.
+ *
+ * Precondition: `collection` itself must not contain `/` — otherwise
+ * `${collection}/${recordId}` is ambiguous (e.g. collection `'a'` would
+ * misattribute collection `'a/b'`'s rows via prefix match in `isVecIdFor`).
+ * Collection names are NOT currently restricted to a `/`-free charset by
+ * `vault.collection()`, so `encodeVecId` enforces the precondition itself,
+ * failing loud at the write boundary rather than silently misencoding.
+ */
+/**
+ * Encode the `_vec` side-car id for a (collection, recordId) pair.
+ * Format: `<collection>/<recordId>` — no escaping; `recordId` may contain `/`.
+ *
+ * Throws if `collection` contains `/`: that would make the composite id
+ * ambiguous against `isVecIdFor`'s prefix match (collection `'a'` would
+ * appear to own collection `'a/b'`'s rows), reintroducing the clobber/crash
+ * risk the namespacing fix exists to close.
+ */
+export declare function encodeVecId(collection: string, recordId: string): string;
+/**
+ * Decode a `_vec` id back to the bare record id, given the KNOWN owning
+ * collection — strips the `<collection>/` prefix rather than splitting on
+ * `/`, so a `recordId` containing `/` round-trips correctly. Returns `null`
+ * if `vecId` does not belong to `collection`.
+ */
+export declare function decodeVecId(collection: string, vecId: string): string | null;
+/** Predicate form of {@link decodeVecId} — used to filter `list()` results. */
+export declare function isVecIdFor(collection: string, vecId: string): boolean;

package/dist/with-lookup/indexing/collection-facade.d.ts

@@ -20,7 +20,7 @@
  *
  * Internal service — not exported as a `@noy-db/hub/*` subpath.
  */
-import type { NoydbStore } from '../../kernel/types.js';
+import type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js';
 import type { RecordCodec } from '../../kernel/enclave/index.js';
 import type { NoydbEventEmitter } from '../../kernel/events.js';
 import type { CollectionIndexes } from './eager-indexes.js';
@@ -118,3 +118,40 @@ export declare function purgePersistedIndexes<T>(ctx: IndexingContext<T>, id: st
     purged: number;
     residue: string[];
 }>;
+/**
+ * Sync this collection's indexes after a tier move (#709). Persisted
+ * `_idx/<field>/<recordId>` side-cars are always encrypted under the
+ * tier-0 DEK regardless of the record's own tier, and the eager in-memory
+ * `CollectionIndexes` mirror holds plaintext bucket values too — so both
+ * leak an elevated record's indexed field values unless swept the same way
+ * `purgePersistedIndexes` already sweeps them for `forget()` ("forget()
+ * crypto-shreds the body but keeps the collection DEK, under which these
+ * side-cars are encrypted — so without this they leave the indexed field
+ * VALUES readable", `purgePersistedIndexes` above).
+ *
+ * `record === null` — the record just left tier 0: purge its persisted
+ * side-cars (content-free, no decrypt needed) and drop its eager-mirror
+ * entry, read from `ctx.cache` (the caller's pre-write value — the caller
+ * MUST invoke this before evicting/overwriting that cache entry, so it
+ * still reflects the value being replaced).
+ *
+ * `record` given — the record is tier-0 again: (re)build its entries from
+ * that record, using the SAME pre-write `ctx.cache` read as the previous
+ * value so a stale bucket (e.g. a same-tier `putAtTier` value change) is
+ * cleaned up rather than left as a false-positive hit. `version` stamps
+ * the rebuilt side-car's own envelope version.
+ *
+ * `priorEnvelope` (#720) — the RAW envelope the caller read BEFORE its own
+ * overwrite landed (`putAtTier`'s `existing` / `demote`'s pre-move
+ * `envelope`), for the `ctx.cache`-miss lazy case: by this call's time the
+ * adapter already holds the NEW envelope, so a `ctx.adapter.get()` here
+ * would only ever re-observe the write just made — useless for recovering
+ * what a same-tier `putAtTier` may have dropped. Optional: the null-record
+ * branches (elevate / demote-to-intermediate / putAtTier(tier>0)) never
+ * need it — their only prior-dependent step, the eager `indexes.remove`
+ * below, already has what it needs from `ctx.cache` (eager mode is
+ * unaffected by the raw-envelope overwrite; lazy mode has no eager mirror).
+ *
+ * No-ops fast when the collection has neither index kind declared.
+ */
+export declare function syncTierIndexes<T>(ctx: IndexingContext<T>, id: string, record: T | null, version: number, priorEnvelope?: EncryptedEnvelope): Promise<void>;

package/dist/with-lookup/indexing/lazy-builder.d.ts

@@ -25,6 +25,7 @@
 import type { FieldClause, Operator } from '../../kernel/query/predicate.js';
 import type { PersistedCollectionIndex } from './persisted-indexes.js';
 import type { QueryField } from '../../kernel/types.js';
+import type { ViaPipeline } from '../../kernel/via/pipeline.js';
 export interface LazyOrderBy {
     readonly field: string;
     readonly direction: 'asc' | 'desc';
@@ -36,10 +37,42 @@ export interface LazyOrderBy {
 export interface LazyQuerySource<T> {
     readonly collectionName: string;
     readonly persistedIndexes: PersistedCollectionIndex;
+    /**
+     * Per-field bucket-key canonicalizer (#677 — lazy twin of the eager
+     * `candidateRecords()` probe-resolution in `kernel/query/builder.ts`).
+     * Consulted in `resolveCandidateIds()` for `==`/`in` clause values
+     * BEFORE calling `lookupEqual`/`lookupIn`, so a mixed-era stored value
+     * (money) probes the SAME canonical bucket the write path now
+     * populates. A narrow closure — not the whole `ViaPipeline` — keeps
+     * the with-lookup/kernel seam thin. `undefined` (no via, or no binding
+     * covers the field) is the common case: falls back to the raw value,
+     * unchanged from today.
+     */
+    canonicalizeIndexKey?(field: string, value: unknown): string | undefined;
     /** Ensure `_idx/<field>/*` side-cars have been bulk-loaded into the mirror. */
     ensurePersistedIndexesLoaded(): Promise<void>;
-    /** Decrypt one record by id, or return null if it's gone. */
-    getRecord(id: string): Promise<T | null>;
+    /**
+     * Decrypt one record by id in RAW (pre-`present()`, stored-form) shape,
+     * or return null if it's gone (#684 — the raw-fetch seam). Used by the
+     * post-filter (`toArray()`) so a `clause.via.evaluate` (e.g. money) sees
+     * the same operand/actual-value space as eager's `filterRecords` — the
+     * DECODED form (e.g. money's canonical decimal) is only materialized
+     * for survivors, via {@link decodeRecord}.
+     */
+    getRawRecord(id: string): Promise<unknown>;
+    /**
+     * Apply this collection's locale/virtual-field decode (`present()`) to a
+     * RAW record already known to match — the output-side twin of
+     * {@link getRawRecord}. Mirrors eager's `Query.decodeVia`.
+     */
+    decodeRecord(record: unknown): Promise<T>;
+    /**
+     * This collection's compiled Via pipeline (money, i18n, …), read lazily
+     * (a method, not a captured value) so a late `_setVia` (#666) is honored
+     * — same closure discipline as {@link canonicalizeIndexKey}. `undefined`
+     * when the collection has no Via-covered fields.
+     */
+    via(): ViaPipeline | undefined;
 }
 interface LazyPlan {
     readonly clauses: readonly FieldClause[];

package/dist/with-lookup/indexing/persisted-indexes.d.ts

@@ -97,6 +97,23 @@ export declare function compositeKey(fields: readonly string[]): string;
 export declare class PersistedCollectionIndex {
     private readonly indexes;
     private readonly defs;
+    /**
+     * Per-field bucket-key canonicalizer (#677 — lazy twin of #672's
+     * `CollectionIndexes.setCanonicalizer`), registered ONCE via
+     * {@link setCanonicalizer} when the collection wires indexing up
+     * (money-aware via `ViaPipeline.canonicalizeIndexKey`). Consulted by
+     * EVERY bucket-mutation site — `ingest`/`upsert`/`remove` — so bucket
+     * membership is symmetric: a legacy non-canonical stored value (e.g.
+     * `'0100'`) and a canonical one (`'100'`) land in the SAME bucket,
+     * mirroring `eager-indexes.ts`'s `addToIndex`/`removeFromIndex`.
+     */
+    private canonicalize?;
+    /**
+     * Register the bucket-key canonicalizer. Called once, where the
+     * collection constructs its indexing state — safe to call again (the
+     * closure is simply replaced) but there is normally only one caller.
+     */
+    setCanonicalizer(fn: (field: string, value: unknown) => string | undefined): void;
     /**
      * Declare a single-field index. Subsequent `upsert` / `ingest` calls
      * populate the in-memory mirror; calls before `declare` are no-ops
@@ -156,12 +173,21 @@ export declare class PersistedCollectionIndex {
      * back to scan or throws `IndexRequiredError`). Returns a shared empty
      * set if the field is declared but no record matches — that set MUST
      * NOT be mutated by the caller.
+     *
+     * `value` is bucketed via the plain {@link stringifyKey} — it is NOT
+     * canonicalized here. Callers on a Via-covered field (money) canonicalize
+     * `value` themselves BEFORE calling (see `lazy-builder.ts`'s
+     * `resolveCandidateIds()`, #677) — the SAME caller-canonicalizes split
+     * `eager-indexes.ts`'s `lookupEqual`/`lookupIn` use (see `kernel/query/
+     * builder.ts`'s `candidateRecords()`), so probing here twice never
+     * double-canonicalizes.
      */
     lookupEqual(field: string, value: unknown): ReadonlySet<string> | null;
     /**
      * Set lookup — return the union of record ids whose `field` matches any
      * of `values`. Returns `null` if the field is not declared. Returns a
-     * fresh (non-shared) Set — safe for the caller to mutate.
+     * fresh (non-shared) Set — safe for the caller to mutate. Same
+     * caller-canonicalizes contract as {@link lookupEqual} (#677).
      */
     lookupIn(field: string, values: readonly unknown[]): ReadonlySet<string> | null;
     /**
@@ -174,6 +200,23 @@ export declare class PersistedCollectionIndex {
      * Supported ops: `'<'`, `'<='`, `'>'`, `'>='`, `'between'`. For
      * `'between'`, `value` is `[lo, hi]` and both bounds are inclusive
      * (matches the eager-mode operator contract in `predicate.ts`).
+     *
+     * NOT canonicalized (#677): this method compares `value` against the
+     * ORIGINAL TYPED `state.values`, not a stringified bucket key, so a
+     * `canonicalizeIndexKey`-shaped (`string | undefined`) result would not
+     * even type-check as a bound here. This does NOT mirror eager mode the
+     * way `lookupEqual`/`lookupIn` do: `moneyIndexProbe` (`via/money/
+     * where.ts`) never emits a range probe, so EAGER mode's `candidateRecords`
+     * never calls an index for a range clause and always scans.
+     *
+     * LAZY mode's `resolveCandidateIds()` (`lazy-builder.ts`) no longer
+     * dispatches a Via-covered (e.g. money) range clause through THIS method
+     * at all (#684) — it enumerates the field's indexed ids via `orderedBy()`
+     * instead and leaves the raw/typed comparison here for the (now
+     * Via-aware) post-filter to redo correctly in scaled-int space. A
+     * NON-via range clause still dispatches through this method exactly as
+     * before — the raw/typed comparison here is correct and sufficient for
+     * fields with no decode-transforming Via binding.
      */
     lookupRange(field: string, op: '<' | '<=' | '>' | '>=' | 'between', value: unknown): ReadonlySet<string> | null;
     /**

package/dist/with-lookup/search/collection-facade.d.ts

@@ -121,3 +121,43 @@ export declare function similarTo<T>(ctx: SearchContext<T>, vector: Float32Array
  * (`Collection.put`) only invokes this when `embeddings` is declared.
  */
 export declare function embedOnWrite<T>(ctx: SearchContext<T>, id: string, record: T, version: number): Promise<void>;
+/**
+ * Force-re-derive every eligible tier-0 record's `_vec` sidecar once (#788).
+ * Opt-in bulk repair for the #726 re-namespace: legacy bare-id rows are
+ * unreachable to `buildVectorLoad` (it only recognises `<collection>/<id>`
+ * keys) and otherwise self-heal only when a record is next `put()` — this
+ * lets an adopter recover recall immediately instead of waiting on writes.
+ *
+ * **Skips elevated records** (`liveRecordIsElevated`) rather than refusing
+ * the whole walk — the OPPOSITE of `_applyCutoverTransform`'s
+ * `assertCutoverTierSafe` refuse-whole-batch precedent. An elevated record is
+ * SUPPOSED to have no `_vec` (`syncTierSearch` purges it on elevate);
+ * re-embedding one here would write searchable plaintext-derived data above
+ * tier 0. Load-bearing: never write a `_vec` row for an elevated record.
+ *
+ * Tombstones, delete markers, and a raw `get` racing a delete between `list`
+ * and `get` all decrypt to `null` (`decryptRecord` already folds
+ * tombstone/delete-marker into that null) and are skipped the same way.
+ * Unconditional re-derive, no already-migrated check — safe to re-run after
+ * a partial failure (each id is independently idempotent).
+ */
+export declare function rebuildEmbeddings<T>(ctx: SearchContext<T>): Promise<{
+    rebuilt: number;
+    skipped: number;
+}>;
+/**
+ * Sync the collection's SEARCH artifacts after a tier move (#721). Both the
+ * lexical `_ftindex` blob and the `_vec/<id>` embedding are encrypted under
+ * the tier-0 DEK and hold the record's derived plaintext (full field text /
+ * a text-invertible vector), so leaving them means elevation never hid what
+ * the record was searchable by — the `forget()` precedent, unapplied to
+ * elevate. `null` → the record left tier 0: purge its `_vec` sidecar (mirrors
+ * `Collection._purgeVector`), and invalidate the `_ftindex` blob (mirrors
+ * `Collection._purgeSearchIndex`: deletes the persisted blob when persisted,
+ * else drops the in-memory index) so the next `retrieve()` rebuilds from the
+ * elevated-free `ctx.cache`. A record → it is tier-0 again: re-embed it via
+ * {@link embedOnWrite}, then invalidate `_ftindex` so the rebuild includes it
+ * again. No-op fast when the collection has neither a lexical index nor a
+ * vector set.
+ */
+export declare function syncTierSearch<T>(ctx: SearchContext<T>, id: string, record: T | null, version?: number): Promise<void>;

package/dist/with-lookup/search/persisted-index-store.d.ts

@@ -4,6 +4,20 @@
  * live (L1 behavior); persists an opaque snapshot via a debounced flush, and
  * validates a loaded blob against a {count,maxVersion} fingerprint so a stale
  * blob is never used — only rebuilt.
+ *
+ * #725: a debounced save (encrypt + adapter.put) racing a purge (removePersisted,
+ * called by elevate's tier purge and forget's erasure) is guarded by an epoch counter
+ * — see the `epoch` field doc for the mechanism and why it also closes the issue's
+ * variant (b) for free. Residual gap, structurally unavoidable without a durable
+ * write-ahead log: a process CRASH strictly between a stale save's `adapter.put`
+ * landing and its compensating `remove()` running (or between the compensating
+ * remove landing and `pendingCompensation` being persisted somewhere durable — it is
+ * in-memory only) leaves the resurrected blob at rest until the next natural
+ * rebuild-persist. This is on par with the gate-before-put optimization's own crash
+ * residual (a crash between `isStale()` returning false and the put landing) — both
+ * are eliminated only by making the purge and the save's commit point transactional
+ * with the store, which is out of scope for an in-memory debounce layer over an
+ * arbitrary opaque-blob backend.
  */
 import { InvertedIndex, type IndexDoc } from './inverted-index.js';
 import type { IndexStore } from './index-store.js';
@@ -16,7 +30,14 @@ export interface PersistedIndexCallbacks {
         json: string;
         fingerprint: Fingerprint;
     } | null>;
-    save(json: string, fp: Fingerprint): Promise<void>;
+    /** `isStale()` reflects whether a purge (removePersisted) has landed since this
+     *  save's epoch was captured — check it AFTER any async encrypt step and BEFORE
+     *  the actual adapter.put, skipping the write when true (#725 review: shrinks the
+     *  at-rest window for purge-beats-encrypt orderings to zero). Belt-and-suspenders:
+     *  PersistedIndexStore's own post-save epoch check (persist(), below) is the
+     *  backstop that catches every other ordering, including a purge landing during
+     *  the put itself. */
+    save(json: string, fp: Fingerprint, isStale: () => boolean): Promise<void>;
     remove(): Promise<void>;
     currentFingerprint(): Fingerprint;
     debounceMs?: number;
@@ -27,15 +48,74 @@ export declare class PersistedIndexStore implements IndexStore {
     private timer;
     private lastBuild;
     private readonly debounceMs;
+    /**
+     * Bumped by every purge (removePersisted). A save() captured under a since-stale
+     * epoch undoes its own effect once it settles, however it interleaves with the
+     * purge's own delete — a delete can never be overtaken by a save that was
+     * scheduled before it (#725).
+     *
+     * Subsumes the issue's variant (b) (a stale, pre-purge in-memory index getting
+     * paired with a live, post-purge fingerprint and TRUSTED by a cold load, defeating
+     * the fingerprint backstop) for free — no separate handling needed: removePersisted()
+     * always resets `index` to undefined in the SAME synchronous step that bumps the
+     * epoch (below), and the only two paths that can repopulate `index` (ensureBuilt's
+     * cold rebuild, rebuildAndPersist's rebuild) do so strictly from `lastBuild()`, which
+     * the collection wires to read its LIVE cache at call time — not a frozen snapshot.
+     * Cache eviction (the collection dropping the purged/forgotten record) always
+     * precedes removePersisted() in both the elevate and forget call paths (#721's
+     * syncCache eviction / forget's tombstone write both land before syncSearch /
+     * _purgeSearchIndex runs). So any rebuild that executes strictly after
+     * removePersisted() — the only way `index` becomes defined again post-purge —
+     * necessarily observes the post-purge cache, and any rebuild that predates
+     * removePersisted() has its `index` wiped by it. There is no ordering in which a
+     * stale (pre-purge) index survives to be skip-rebuilt and persisted under a
+     * matching live fingerprint. Regression-pinned in
+     * `search-persisted-index-store.test.ts` ("variant (b) is subsumed...").
+     */
+    private epoch;
+    /**
+     * Set when a compensating/purging remove() (`compensate()` undoing a stale
+     * save, or `removePersisted()`'s own purge, #764) fails. Unlike the routine
+     * best-effort swallow on the debounced flush path (markDirty's timer
+     * .catch(), below — safe there because the fingerprint backstop forces a
+     * rebuild on the next cold load), a failed removal leaves a resurrected or
+     * un-purged blob at rest whose fingerprint can still match the live cache —
+     * a cold load would TRUST it, not rebuild past it. So this is never silently
+     * dropped: every subsequent store entrypoint (ensureBuilt, rebuildAndPersist,
+     * removePersisted) retries the remove first and refuses to proceed past it
+     * until it succeeds (#725 review), and the raw adapter error is wrapped in
+     * {@link PersistedIndexCompensationError} (#764) so a caller can catch a
+     * stuck removal deliberately instead of an indistinguishable adapter error.
+     * A crash between a landed put and its compensating remove (before this
+     * flag or a retry can run) is a residual gap — see the class doc.
+     */
+    private pendingCompensation;
     constructor(cb: PersistedIndexCallbacks);
     get built(): boolean;
     ensureBuilt(build: () => ReadonlyArray<IndexDoc>): Promise<InvertedIndex>;
     markDirty(): void;
     /** Force an immediate persist (cancels any pending debounce). */
     flush(): Promise<void>;
-    /** Delete the persisted blob and drop the in-memory index (forget/erasure). */
+    /** Delete the persisted blob and drop the in-memory index (forget/erasure/tier
+     *  move). A failed purge is wrapped in {@link PersistedIndexCompensationError}
+     *  (#764) and left sticky (`pendingCompensation`) so the next store entrypoint
+     *  retries it — never silently dropped, same posture #725 established for a
+     *  stale save's own compensating remove. */
     removePersisted(): Promise<void>;
     /** Rebuild using the last known build thunk, then persist. */
     private rebuildAndPersist;
+    /** Persist the current index, then undo it if a purge (removePersisted) landed
+     *  while the save was in flight — a delete can never be overtaken by a save
+     *  that was scheduled before it (#725). A failed undo does not silently vanish:
+     *  see `pendingCompensation`. */
     private persist;
+    /** Undo a stale save. Failure is sticky, not swallowed: see `pendingCompensation`.
+     *  Wraps the raw adapter error in {@link PersistedIndexCompensationError} (#764) so
+     *  a caller (e.g. the tier ops' `syncTierSearch`) can catch a stuck compensation
+     *  deliberately instead of treating it as an indistinguishable adapter failure. */
+    private compensate;
+    /** Retries a sticky compensation before any store entrypoint proceeds. Failure
+     *  re-wraps the raw adapter error the same way `compensate()` does (#764) — the
+     *  flag stays set (untouched here) so the NEXT entrypoint retries again. */
+    private retryPendingCompensation;
 }

package/dist/with-lookup/search/strategy.d.ts

@@ -28,6 +28,10 @@ export interface SearchStrategy {
     warmIndex<T>(ctx: SearchContext<T>): Promise<void>;
     flushIndex<T>(ctx: SearchContext<T>): Promise<void>;
     embedOnWrite<T>(ctx: SearchContext<T>, id: string, record: T, version: number): Promise<void>;
+    rebuildEmbeddings<T>(ctx: SearchContext<T>): Promise<{
+        rebuilt: number;
+        skipped: number;
+    }>;
 }
 /**
  * No-op stub — the floor default. Every capability method (and the embedding

package/dist/with-party/team/sync.d.ts

@@ -57,6 +57,15 @@ export declare class SyncEngine {
     private reservedLookup?;
     /** Wire the reserved-lookup source (#650 Task 4). */
     setReservedLookupSource(source: ReservedLookupSource): void;
+    /** #653: expands a (pair-expanded) collection-name filter to include the reserved `_dict_*`
+     *  collections those names depend on via their lookup fields — mirrors `pairExpander` so a
+     *  partial `push`/`pull({collections:[...]})` never drops the dictionary a named collection's
+     *  labels/membership rely on. Wired unconditionally from the vault's `dictKeyFieldRegistry` via
+     *  `setReservedDictExpander` (returns `[]` when the vault has no dict-backed collections); only
+     *  `undefined` on a standalone engine that was never vault-attached. */
+    private reservedDictExpander?;
+    /** Wire the reserved-dict expansion function (#653). Same injection pattern as `setPairExpander`. */
+    setReservedDictExpander(expander: (names: readonly string[]) => readonly string[]): void;
     constructor(opts: {
         local: NoydbStore;
         remote: NoydbStore;

package/dist/with-shape/blobs/blob-intent.d.ts

@@ -0,0 +1,153 @@
+/**
+ * `_blob_intent` — the blob durability journal marker (#753, spec §7).
+ *
+ * One row per in-flight multi-step blob operation (`shred` | `rehome`),
+ * written BEFORE the first destructive/movement step and deleted as the
+ * operation's LAST step. An absent marker means "no operation in flight"
+ * (the normal state, zero cost on every path that doesn't crash); a present
+ * marker means the operation MUST be resumed before any other blob work on
+ * that record proceeds.
+ *
+ * **Pattern honesty (C9):** this is the family's FIRST content-bearing
+ * ENCRYPTED reserved marker. The prior reserved-collection precedent,
+ * `_mv_stale` (`with-formula/materialized-views/stale.ts`), is
+ * content-free plaintext (`{ _iv: '', _data: '{}' }` — the row's only
+ * payload is its key). `_blob_intent` carries real operational metadata
+ * (op, tiers, eTags + counts) and is encrypted, so its codec/CAS/backup/
+ * sweep conventions below are new to the codebase, not a copy of an
+ * existing pattern.
+ *
+ * **Key management (spec §4):** encrypted under the record's OWNING
+ * collection's tier-0 DEK — `getDEK(collection)`, which resolves to
+ * `dekKey(collection, 0) === collection` (see `with-party/team/tiers.ts`).
+ * Every legitimate resumer (forget()-retry, blob write entry points,
+ * tier ops) already holds this DEK; minting an elevated DEK for the
+ * marker itself would make resume impossible for a tier-0-only resumer.
+ * Documented residue: a tier-0 DEK holder can learn that an elevated
+ * record's shred/rehome was in flight and which eTags it touched —
+ * existence-adjacent, consistent with the already-documented
+ * dedup-policy residue (#741).
+ *
+ * **Key grammar (C11):** `{collection}::{recordId}`. Blob-bearing record
+ * ids already refuse `::` at the write surface (`blob-set.ts`'s
+ * `assertKeyPartSafe`, #752) — re-validated here defensively so the
+ * sweep's prefix-free key list stays unambiguous regardless of caller.
+ *
+ * Wired by `shredAllForRecord`/`forget()` (PR-1 Task 3, shred) and by
+ * `BlobSet.syncTierMove`/`rehomeForTier`/`resolvePendingIntent` (PR-2 Task
+ * 2, rehome — mint/resume/consume for `op:'rehome'` markers).
+ */
+import type { NoydbStore } from '../../kernel/types.js';
+import { type EnclaveKey } from '../../kernel/enclave/index.js';
+/** Reserved collection holding `_blob_intent` marker rows. */
+export declare const BLOB_INTENT_COLLECTION = "_blob_intent";
+/**
+ * One captured refCount hold on an eTag, authoritative on resume (spec §2a,
+ * amended by C5). `chunkCount` lets a resumed release complete chunk
+ * cleanup even if the `_blob_index` row itself is already gone (mirrors
+ * `releaseRef`'s `chunkCountHint` parameter, Task 1).
+ */
+export interface BlobIntentHold {
+    readonly eTag: string;
+    readonly n: number;
+    readonly chunkCount: number;
+}
+/**
+ * The intent marker's decrypted payload (spec §2a, amended by C5: `holds`
+ * entries carry `{ eTag, n, chunkCount }` rather than the original bare
+ * `{ eTag, n }`).
+ */
+export interface BlobIntent {
+    readonly op: 'shred' | 'rehome';
+    /** Random nonce minted at marker creation (`crypto.getRandomValues`) — the op-stamp identity. */
+    readonly opId: string;
+    /** Captured ONCE at marker creation; authoritative on every resume. */
+    readonly holds?: readonly BlobIntentHold[];
+    readonly ownerTier?: number;
+    readonly fromTier?: number;
+    readonly toTier?: number;
+    readonly policy?: 'isolate' | 'dedup';
+    /**
+     * Rehome destination `+1` row-stamps (`${opId}:${slotName}` /
+     * `${opId}:${versionKey}`) CONFIRMED applied — #746 whole-branch review
+     * (K=8 stamp-ring blocker). `BlobObject.lastOps` is a BOUNDED ring (K=8,
+     * spec C2) — correct as the sole idempotency source for SHRED (one
+     * decrement per eTag, count captured in `holds`) but not for REHOME,
+     * whose row-scoped increments can exceed K on a single destination via
+     * either ≥9 rows of identical content on ONE record, or ≥8 CONCURRENT
+     * rehomes converging on one shared destination between a crashed op's
+     * stamp-write and its resume — either way, an evicted-but-unapplied-
+     * looking stamp gets re-applied, over-counting the destination's
+     * refCount and permanently stranding it above 0. This field is THIS
+     * op's own UNBOUNDED, per-record backstop: appended (via
+     * {@link recordAppliedStamp}) immediately after a stamped `+1` lands
+     * (whether freshly applied or found already in the ring), consulted
+     * BEFORE attempting the CAS so a resume that finds its own row-stamp
+     * here skips the increment entirely — independent of the shared
+     * destination object's bounded ring and of how many OTHER ops have
+     * touched it since. Absent/empty is the normal case (no rehome — or no
+     * increments yet — in flight).
+     */
+    readonly appliedStamps?: readonly string[];
+}
+/** Resume callback signature for {@link sweepBlobIntents} — supplied by the caller (Task 3 / PR-2). */
+export type BlobIntentResume = (collection: string, recordId: string, intent: BlobIntent) => Promise<void>;
+/**
+ * Read the `_blob_intent` marker for `{collection}::{recordId}`, or `null`
+ * if none is pending. The resume-gate check every future blob mutator
+ * (Task 3 / PR-2) runs before proceeding.
+ */
+export declare function getIntent(adapter: NoydbStore, vault: string, collection: string, recordId: string, getDEK: (collection: string) => Promise<EnclaveKey>): Promise<BlobIntent | null>;
+/**
+ * Create a `_blob_intent` marker for `{collection}::{recordId}` — CAS
+ * create-if-absent (C8). `store.put(..., expectedVersion: 0)` succeeds only
+ * when no row is present (every real adapter treats a missing record +
+ * `expectedVersion: 0` as a no-conflict write — the same convention
+ * `loadOrCreateSigner` uses in `with-audit/attestation/signer.ts`); a
+ * present row always carries `_v >= 1`, so the CAS throws `ConflictError`
+ * and is converted here into {@link BlobIntentPendingError} — the signal
+ * a caller catches to resume the PENDING operation before starting a new
+ * one, rather than silently clobbering it (which would orphan the prior
+ * op's op-stamps).
+ */
+export declare function createIntent(adapter: NoydbStore, vault: string, collection: string, recordId: string, getDEK: (collection: string) => Promise<EnclaveKey>, intent: BlobIntent): Promise<void>;
+/** Delete the `_blob_intent` marker for `{collection}::{recordId}` — the operation's LAST step. */
+export declare function deleteIntent(adapter: NoydbStore, vault: string, collection: string, recordId: string): Promise<void>;
+/**
+ * Durably record that a rehome destination row-stamp has been CONFIRMED
+ * applied — #746 whole-branch review (K=8 stamp-ring blocker). Appends
+ * `stamp` to the marker's `appliedStamps` (idempotent no-op if already
+ * present), CAS-retried against concurrent resumers touching the SAME
+ * marker (mirrors `BlobSet.casUpdateSlots`'s retry shape).
+ *
+ * A no-op — never throws — when the marker is already gone: that only
+ * happens if the whole op already completed and deleted it (this call is
+ * racing its own operation's tail) or a sibling resumer already finished
+ * it; either way there is nothing left to record against. A marker whose
+ * `op` is NOT `'rehome'` (should be structurally impossible — only
+ * `BlobSet`'s own rehome machinery calls this, against its own marker) is
+ * treated the same way: nothing to record.
+ */
+export declare function recordAppliedStamp(adapter: NoydbStore, vault: string, collection: string, recordId: string, getDEK: (collection: string) => Promise<EnclaveKey>, stamp: string): Promise<void>;
+/**
+ * List every persisted `_blob_intent` marker and resume each via the
+ * caller-supplied `resume` callback (the forget-entry / vault-open sweep,
+ * mirroring `_mv_stale`'s `hydratePersistedStaleMarkers`/orphan-sweep
+ * pattern).
+ *
+ * **Per-marker isolation (#753 Task 3, carried finding from the Task 2
+ * review):** each marker's decode + `resume` runs in its own try/catch — a
+ * corrupt/DEK-mismatched marker, or a marker whose resume genuinely fails
+ * (e.g. a store error mid-release), is reported via `onResumeError` and
+ * skipped, never aborting the loop and never silently swallowed. Earlier
+ * (Task 2) this loop had no try/catch at all; that was safe only because
+ * nothing called `resume` with real logic yet — `BlobSet.mintShredIntent`'s
+ * collection-scoped sweep (this function's first real caller, Task 3) can
+ * hit a genuinely corrupt sibling marker and must not let it block a
+ * healthy one (mirrors `stale.ts`'s orphan-sweep defensive posture, #736).
+ *
+ * `resume` is the per-marker resume action (Task 3: `BlobSet`'s
+ * `resolvePendingIntent`-equivalent for a shred marker; a rehome marker is
+ * PR-2 scope and should be skipped by the callback, not thrown into here).
+ */
+export declare function sweepBlobIntents(adapter: NoydbStore, vault: string, getDEK: (collection: string) => Promise<EnclaveKey>, resume: BlobIntentResume, onResumeError?: (collection: string, recordId: string, err: unknown) => void): Promise<void>;