@noy-db/hub 0.3.0-pre.12 → 0.3.0-pre.13

package/dist/{chunk-YCXKFB7J.js → chunk-X7QBD67R.js}

@@ -6,34 +6,36 @@ import {
   SEQUENCE_COLLECTION,
   compileSequenceFormat,
   resolveSequenceKey
-} from "./chunk-7QLY64AD.js";
+} from "./chunk-EYZ6IQ6X.js";
 import {
   loadVaultPolicy
-} from "./chunk-BLUT46UP.js";
+} from "./chunk-CRI4OUV4.js";
 import {
   LinkIntegrityError,
   isLinkCollectionName,
   linkCollectionName,
   linkRowKey
-} from "./chunk-TVS6BUUR.js";
+} from "./chunk-JZUV47FZ.js";
 import {
   hashFields,
   validateSatelliteDeclaration
-} from "./chunk-SIAIYP6G.js";
+} from "./chunk-ZAJAVEXY.js";
 import {
   loadFence
-} from "./chunk-SAL5X5OK.js";
+} from "./chunk-RYCTDFUX.js";
 import {
   InvertedIndex,
   MemoryIndexStore,
   NO_SEARCH,
   VectorSet,
-  buildPersistedIndexCallbacks
-} from "./chunk-BDPAVYGJ.js";
+  buildPersistedIndexCallbacks,
+  encodeVecId,
+  syncTierSearch
+} from "./chunk-OSDB5WW3.js";
 import {
   derivePersistedSchema,
   isZod4Schema
-} from "./chunk-P2LJI6JE.js";
+} from "./chunk-W22IKJE2.js";
 import {
   isBaseLive,
   liveBaseIdSet
@@ -42,7 +44,7 @@ import {
   CustodyApi,
   NO_CARGO,
   NO_CUSTODY
-} from "./chunk-UMC5QZTX.js";
+} from "./chunk-6T2SCQRU.js";
 import {
   ServiceBus,
   WriteHookRegistry,
@@ -50,44 +52,45 @@ import {
   assertCanImport,
   canExport,
   canImport
-} from "./chunk-K2DLLK34.js";
+} from "./chunk-6QTNZJBS.js";
 import {
   runDrainBarrier
-} from "./chunk-NAR6IDKH.js";
+} from "./chunk-3QCRBHCY.js";
 import {
   OverlayedCollection
-} from "./chunk-PN5332SU.js";
+} from "./chunk-B3HJYUOF.js";
 import {
   NO_ATTESTATION
-} from "./chunk-S2OWPVSO.js";
+} from "./chunk-5YOLBEQ6.js";
 import {
   NO_CLASSIFIED,
   guardClassifiedCompat,
   resolveClassifiedFields
-} from "./chunk-WHQHTNT7.js";
+} from "./chunk-MV43JSJF.js";
 import {
   NO_TIERS,
-  classifySealedShred
-} from "./chunk-AKEOHKMT.js";
+  classifySealedShred,
+  syncDerivedOutputs
+} from "./chunk-CDUQTA3Z.js";
 import {
   NO_PORTABILITY
-} from "./chunk-5HNX4OD4.js";
+} from "./chunk-K5IMOGHB.js";
 import {
   PERIODS_COLLECTION,
   PERIOD_ARCHIVES_COLLECTION,
   PERIOD_FREEZES_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION,
   periodExclusiveUpperBound
-} from "./chunk-Y5TWPBNW.js";
+} from "./chunk-DLG74CNB.js";
 import {
   TxContext,
   bestEffortRevert,
   revertExecuted
-} from "./chunk-AAIIDAUC.js";
+} from "./chunk-MEFJPTZ4.js";
 import {
   DEFAULT_POSTURE,
   ViaGraph
-} from "./chunk-DJ7MRXNA.js";
+} from "./chunk-HTJQYHZP.js";
 import {
   buildLookupAltIndex,
   buildLookupSnapshotRows,
@@ -110,22 +113,22 @@ import {
   runGraphDispatchWave,
   touchFor,
   updateReferencingRecords
-} from "./chunk-R3NHNVS5.js";
+} from "./chunk-4CTHCN4J.js";
 import {
   NO_AGGREGATE,
   Query,
   ScanBuilder
-} from "./chunk-SXPCZ6LL.js";
+} from "./chunk-454JXE57.js";
 import {
   EXPORT_AUDIT_COLLECTION,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-TBNF5DV5.js";
+} from "./chunk-NWSGI5C7.js";
 import {
   LazyQuery,
   decodeIdxId,
   encodeIdxId
-} from "./chunk-6S7ENMRE.js";
+} from "./chunk-M4CV6BRT.js";
 import {
   IMPLICIT_LAZY,
   Lru,
@@ -133,17 +136,17 @@ import {
 } from "./chunk-NO272T7Q.js";
 import {
   canonicalGroupKey
-} from "./chunk-EVHBK7BN.js";
+} from "./chunk-LXEXBTKL.js";
 import {
   readPath
 } from "./chunk-IGJCYUT5.js";
 import {
   resolveManagedSecret,
   saveSealedPassphrase
-} from "./chunk-FF7S3XDW.js";
+} from "./chunk-3LQ2YKO4.js";
 import {
   dictCollectionName
-} from "./chunk-F44XWXOA.js";
+} from "./chunk-NJ4EOKMB.js";
 import {
   NO_I18N,
   getAtPath,
@@ -151,12 +154,12 @@ import {
   isDictKeyDescriptor,
   isI18nTextDescriptor,
   isStaticDictDescriptor
-} from "./chunk-VCUQR6ZL.js";
+} from "./chunk-6JTIAGHD.js";
 import {
   installViaBinder,
   isViaInstalled,
   viaBinder
-} from "./chunk-GXLZXD2W.js";
+} from "./chunk-4VNQOLML.js";
 import {
   NO_TEAM,
   enrollAuthenticator,
@@ -167,7 +170,7 @@ import {
   rotatePassphrase,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-3QSOFZQB.js";
+} from "./chunk-AUSTCW2X.js";
 import {
   hasRecoveryEnrolled,
   hasStrongRecoveryEnrolled,
@@ -177,7 +180,7 @@ import {
   mintShamirRecoveryEntry,
   savePaperRecoveryEntries,
   saveShamirRecoveryEntries
-} from "./chunk-S7TAPIRS.js";
+} from "./chunk-EVVGJDRQ.js";
 import {
   INDEXED_STORE_POLICY
 } from "./chunk-VQNJ7UZL.js";
@@ -193,21 +196,26 @@ import {
   listUsers,
   loadKeyring,
   updateKeyringIdentity
-} from "./chunk-CCIR2OJH.js";
+} from "./chunk-J2ZX2XUV.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
-} from "./chunk-JGUZMC3I.js";
+} from "./chunk-4JBYV75E.js";
 import {
   NO_BROKER,
   buildCredentialBrokerHandle
-} from "./chunk-HIOLCOK3.js";
+} from "./chunk-E5ZQT5KX.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
+import {
+  assertCutoverTierSafe,
+  assertTierWritable,
+  liveRecordIsElevated
+} from "./chunk-PN2XMATY.js";
 import {
   sha256Hex
-} from "./chunk-EIZ4YOG2.js";
+} from "./chunk-Q5VNKNE5.js";
 import {
   NO_FORGET,
   addSubjectRef,
@@ -216,10 +224,10 @@ import {
   readDottedPath,
   rebuildSubjectIndex,
   removeSubjectRef
-} from "./chunk-EHW5KTTA.js";
+} from "./chunk-5O3XF4DV.js";
 import {
   NO_SEALED_RECORD
-} from "./chunk-TVOHSPVK.js";
+} from "./chunk-QLWMEXCT.js";
 import {
   RecordCodec,
   SEALED_CEK_NS,
@@ -230,20 +238,20 @@ import {
   queryByDet,
   resolveStableCek,
   validateSchemaInput
-} from "./chunk-HA6ZQWA2.js";
+} from "./chunk-XDYREZWE.js";
 import {
   buildDeleteMarker,
   buildTombstone,
   isDeleteMarker,
   isTombstone
-} from "./chunk-J3JIYFYL.js";
+} from "./chunk-7DSTRQIJ.js";
 import {
   encrypt
-} from "./chunk-37WOJQWY.js";
+} from "./chunk-CIE2BASH.js";
 import {
   NOYDB_FORMAT_VERSION,
   SealedHandle
-} from "./chunk-JC75UBMT.js";
+} from "./chunk-JNAI2HN2.js";
 import {
   AlreadyElevatedError,
   AttestationError,
@@ -266,6 +274,7 @@ import {
   NoydbError,
   NumberingUncertaintyError,
   PermissionDeniedError,
+  PersistedIndexCompensationError,
   PolicyDeniedError,
   ReadOnlyError,
   RecoveryNotEnrolledError,
@@ -280,12 +289,13 @@ import {
   USER_ENVELOPE_COLLECTION,
   UniqueConstraintError,
   UnsupportedIndexOptionError,
+  UnsupportedTierCompositionError,
   ValidationError
-} from "./chunk-FZCGIJEJ.js";
+} from "./chunk-BIOUI4HL.js";
 
 // src/port/by/default-provider.ts
 async function createDefaultCoordinationProvider(store) {
-  const { StoreCoordinationProvider } = await import("./store-coordination-provider-5KDS2RRP.js");
+  const { StoreCoordinationProvider } = await import("./store-coordination-provider-64OEZFGS.js");
   return new StoreCoordinationProvider(store);
 }
 
@@ -653,6 +663,34 @@ function exportRedact(coll, record) {
   return via2 ? via2.redactForExport(record) : record;
 }
 
+// src/kernel/lazy-count.ts
+var COUNT_PAGE_SIZE = 1e3;
+function isLive(env, storeCiphertext) {
+  return !!env && !isTombstone(env, storeCiphertext) && !isDeleteMarker(env) && (env._tier ?? 0) === 0;
+}
+async function countLiveEnvelopes(adapter, vault, name, storeCiphertext) {
+  let n = 0;
+  if (adapter.listPage) {
+    let cursor;
+    let page = await adapter.listPage(vault, name, cursor, COUNT_PAGE_SIZE);
+    while (true) {
+      for (const { envelope } of page.items) {
+        if (isLive(envelope, storeCiphertext)) n++;
+      }
+      if (page.nextCursor === null) break;
+      cursor = page.nextCursor;
+      page = await adapter.listPage(vault, name, cursor, COUNT_PAGE_SIZE);
+    }
+    return n;
+  }
+  const ids = await adapter.list(vault, name);
+  for (const id of ids) {
+    const env = await adapter.get(vault, name, id);
+    if (isLive(env, storeCiphertext)) n++;
+  }
+  return n;
+}
+
 // src/with-lookup/indexing/collection-facade.ts
 function readPersistedValue(record, field) {
   if (!field.includes(".")) return record[field];
@@ -738,6 +776,7 @@ async function rebuildIndexes(ctx) {
   for (const recordId of canonicalIds) {
     const envelope = await ctx.adapter.get(ctx.vault, ctx.name, recordId);
     if (!envelope) continue;
+    if ((envelope._tier ?? 0) > 0) continue;
     const record = await ctx.codec.decryptRecord(envelope, { skipValidation: true, id: recordId });
     if (record === null) continue;
     await maintainPersistedIndexesOnPut(ctx, recordId, record, null, envelope._v);
@@ -791,6 +830,7 @@ async function reconcileIndex(ctx, field, opts = {}) {
     if (id.startsWith("_")) continue;
     const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
     if (!env) continue;
+    if ((env._tier ?? 0) > 0) continue;
     const record = await ctx.codec.decryptRecord(env, { skipValidation: true, id });
     if (record === null) continue;
     const live = readPersistedValue(record, field);
@@ -906,6 +946,66 @@ async function purgePersistedIndexes(ctx, id) {
   }
   return { purged, residue };
 }
+async function syncTierIndexes(ctx, id, record, version, priorEnvelope) {
+  if (!ctx.indexes && !ctx.persistedIndexes) return;
+  const prior = await resolveTierSyncPrior(ctx, id, priorEnvelope);
+  if (record === null) {
+    await purgePersistedIndexes(ctx, id);
+    if (prior) ctx.indexes?.remove(id, prior);
+  } else {
+    await maintainPersistedIndexesOnPut(ctx, id, record, prior, version);
+    ctx.indexes?.upsert(id, record, prior);
+  }
+}
+async function resolveTierSyncPrior(ctx, id, priorEnvelope) {
+  const cached = ctx.cache.get(id)?.record;
+  if (cached !== void 0) return cached;
+  if (!ctx.lazy || !priorEnvelope || (priorEnvelope._tier ?? 0) > 0) return null;
+  return await ctx.codec.decryptRecord(priorEnvelope, { skipValidation: true, id });
+}
+
+// src/with-commit/history/strategy.ts
+function notEnabled(op) {
+  return new Error(
+    `${op} requires the history strategy. Import \`{ withHistory }\` from "@noy-db/hub/history" and pass it to \`createNoydb({ historyStrategy: withHistory() })\`.`
+  );
+}
+var NO_HISTORY = {
+  async saveHistory() {
+  },
+  async getHistoryEntries() {
+    throw notEnabled("collection.history()");
+  },
+  async getVersionEnvelope() {
+    throw notEnabled("collection.getVersion()");
+  },
+  async pruneHistory() {
+    return 0;
+  },
+  async clearHistory() {
+    return 0;
+  },
+  async tombstoneHistory() {
+    return 0;
+  },
+  async rewrapHistory() {
+  },
+  async envelopePayloadHash() {
+    return "";
+  },
+  computePatch() {
+    return [];
+  },
+  diff() {
+    throw notEnabled("collection.diff()");
+  },
+  buildLedger() {
+    return null;
+  },
+  buildVaultInstant() {
+    throw notEnabled("vault.at() / vault.timeMachine()");
+  }
+};
 
 // src/with-lookup/indexing/strategy.ts
 var NO_INDEXING = {
@@ -941,10 +1041,53 @@ var PersistedIndexStore = class {
   timer = null;
   lastBuild;
   debounceMs;
+  /**
+   * Bumped by every purge (removePersisted). A save() captured under a since-stale
+   * epoch undoes its own effect once it settles, however it interleaves with the
+   * purge's own delete — a delete can never be overtaken by a save that was
+   * scheduled before it (#725).
+   *
+   * Subsumes the issue's variant (b) (a stale, pre-purge in-memory index getting
+   * paired with a live, post-purge fingerprint and TRUSTED by a cold load, defeating
+   * the fingerprint backstop) for free — no separate handling needed: removePersisted()
+   * always resets `index` to undefined in the SAME synchronous step that bumps the
+   * epoch (below), and the only two paths that can repopulate `index` (ensureBuilt's
+   * cold rebuild, rebuildAndPersist's rebuild) do so strictly from `lastBuild()`, which
+   * the collection wires to read its LIVE cache at call time — not a frozen snapshot.
+   * Cache eviction (the collection dropping the purged/forgotten record) always
+   * precedes removePersisted() in both the elevate and forget call paths (#721's
+   * syncCache eviction / forget's tombstone write both land before syncSearch /
+   * _purgeSearchIndex runs). So any rebuild that executes strictly after
+   * removePersisted() — the only way `index` becomes defined again post-purge —
+   * necessarily observes the post-purge cache, and any rebuild that predates
+   * removePersisted() has its `index` wiped by it. There is no ordering in which a
+   * stale (pre-purge) index survives to be skip-rebuilt and persisted under a
+   * matching live fingerprint. Regression-pinned in
+   * `search-persisted-index-store.test.ts` ("variant (b) is subsumed...").
+   */
+  epoch = 0;
+  /**
+   * Set when a compensating/purging remove() (`compensate()` undoing a stale
+   * save, or `removePersisted()`'s own purge, #764) fails. Unlike the routine
+   * best-effort swallow on the debounced flush path (markDirty's timer
+   * .catch(), below — safe there because the fingerprint backstop forces a
+   * rebuild on the next cold load), a failed removal leaves a resurrected or
+   * un-purged blob at rest whose fingerprint can still match the live cache —
+   * a cold load would TRUST it, not rebuild past it. So this is never silently
+   * dropped: every subsequent store entrypoint (ensureBuilt, rebuildAndPersist,
+   * removePersisted) retries the remove first and refuses to proceed past it
+   * until it succeeds (#725 review), and the raw adapter error is wrapped in
+   * {@link PersistedIndexCompensationError} (#764) so a caller can catch a
+   * stuck removal deliberately instead of an indistinguishable adapter error.
+   * A crash between a landed put and its compensating remove (before this
+   * flag or a retry can run) is a residual gap — see the class doc.
+   */
+  pendingCompensation = false;
   get built() {
     return this.index !== void 0;
   }
   async ensureBuilt(build) {
+    await this.retryPendingCompensation();
     this.lastBuild = build;
     if (this.index !== void 0) return this.index;
     const loaded = await this.cb.load();
@@ -973,26 +1116,70 @@ var PersistedIndexStore = class {
     }
     await this.rebuildAndPersist();
   }
-  /** Delete the persisted blob and drop the in-memory index (forget/erasure). */
+  /** Delete the persisted blob and drop the in-memory index (forget/erasure/tier
+   *  move). A failed purge is wrapped in {@link PersistedIndexCompensationError}
+   *  (#764) and left sticky (`pendingCompensation`) so the next store entrypoint
+   *  retries it — never silently dropped, same posture #725 established for a
+   *  stale save's own compensating remove. */
   async removePersisted() {
     if (this.timer) {
       clearTimeout(this.timer);
       this.timer = null;
     }
+    await this.retryPendingCompensation();
+    this.epoch++;
     this.index = void 0;
-    await this.cb.remove();
+    try {
+      await this.cb.remove();
+      this.pendingCompensation = false;
+    } catch (e) {
+      this.pendingCompensation = true;
+      throw new PersistedIndexCompensationError(e);
+    }
   }
   /** Rebuild using the last known build thunk, then persist. */
   async rebuildAndPersist() {
+    await this.retryPendingCompensation();
     if (this.lastBuild === void 0) return;
     if (this.index === void 0) {
       this.index = InvertedIndex.build(this.lastBuild());
     }
     await this.persist();
   }
+  /** Persist the current index, then undo it if a purge (removePersisted) landed
+   *  while the save was in flight — a delete can never be overtaken by a save
+   *  that was scheduled before it (#725). A failed undo does not silently vanish:
+   *  see `pendingCompensation`. */
   async persist() {
     if (this.index === void 0) return;
-    await this.cb.save(serializeIndex(this.index), this.cb.currentFingerprint());
+    const epoch = this.epoch;
+    await this.cb.save(serializeIndex(this.index), this.cb.currentFingerprint(), () => this.epoch !== epoch);
+    if (this.epoch !== epoch) await this.compensate();
+  }
+  /** Undo a stale save. Failure is sticky, not swallowed: see `pendingCompensation`.
+   *  Wraps the raw adapter error in {@link PersistedIndexCompensationError} (#764) so
+   *  a caller (e.g. the tier ops' `syncTierSearch`) can catch a stuck compensation
+   *  deliberately instead of treating it as an indistinguishable adapter failure. */
+  async compensate() {
+    try {
+      await this.cb.remove();
+      this.pendingCompensation = false;
+    } catch (e) {
+      this.pendingCompensation = true;
+      throw new PersistedIndexCompensationError(e);
+    }
+  }
+  /** Retries a sticky compensation before any store entrypoint proceeds. Failure
+   *  re-wraps the raw adapter error the same way `compensate()` does (#764) — the
+   *  flag stays set (untouched here) so the NEXT entrypoint retries again. */
+  async retryPendingCompensation() {
+    if (!this.pendingCompensation) return;
+    try {
+      await this.cb.remove();
+      this.pendingCompensation = false;
+    } catch (e) {
+      throw new PersistedIndexCompensationError(e);
+    }
   }
 };
 
@@ -1434,6 +1621,54 @@ function buildDescription(input) {
   };
 }
 
+// src/via/blob/binding.ts
+async function eraseBlobs(ctx, cfg) {
+  if (cfg.purgeBlobsForRecord) return cfg.purgeBlobsForRecord(ctx.id);
+  return { shredded: 0, residue: [] };
+}
+function buildBlobDescribeFragment(fields) {
+  return {
+    blobFields: Object.fromEntries(
+      Object.entries(fields).map(([field, p]) => [field, {
+        ...p.retainDays !== void 0 ? { retainDays: p.retainDays } : {},
+        ...p.evictWhen !== void 0 ? { evictWhen: true } : {},
+        ...p.legalHold !== void 0 ? { legalHold: true } : {},
+        ...p.retainUntil !== void 0 ? { retainUntil: true } : {},
+        ...p.external === true ? { external: true } : {},
+        ...p.public === true ? { public: true } : {},
+        ...p.backlink !== void 0 ? { backlink: p.backlink } : {}
+      }])
+    )
+  };
+}
+function blobBinding(cfg) {
+  return {
+    brand: "blob",
+    // encryptedAtRest: 'envelope' — blob chunks are AEAD-encrypted envelopes
+    // in `_blob_chunks` (service-side), not sealed record fields; queryable:
+    // 'none' — nothing indexes blob content; exportable — vault.exportBlobs()
+    // is a first-class door; forgettable — shredAllForRecord participates in
+    // vault.forget().
+    posture: { encryptedAtRest: "envelope", queryable: "none", exportable: true, forgettable: true },
+    covers: (field) => field in cfg.fields,
+    erase: (ctx) => eraseBlobs(ctx, cfg),
+    describeFragment: () => buildBlobDescribeFragment(cfg.fields)
+  };
+}
+function linkBlobVia() {
+  installViaBinder("blob", (c) => blobBinding(c));
+}
+
+// src/port/with/blob-strategy.ts
+linkBlobVia();
+var NO_BLOBS = {
+  openSlot() {
+    throw new Error(
+      'Blob storage is not enabled on this Noydb instance. Import `{ withBlobs }` from "@noy-db/hub/blobs" and pass `withBlobs()` to `createNoydb({ blobStrategy: withBlobs() })`.'
+    );
+  }
+};
+
 // src/with-formula/derivations/stale.ts
 var _staleByRegistry = /* @__PURE__ */ new WeakMap();
 var keyFor = (source, sourceId) => `${source}/${sourceId}`;
@@ -1470,7 +1705,7 @@ async function resolveStaleOnRead(accessor, outputCollection, id) {
     }
     const sourceWithId = { ...source, id };
     if (DerivationExecutor === null) {
-      ({ DerivationExecutor } = await import("./executor-JFVAJY42.js"));
+      ({ DerivationExecutor } = await import("./executor-OVEXR6RT.js"));
     }
     const ctx = { vault: accessor.getReadOnlyFacade() };
     const result = await DerivationExecutor.run(spec, sourceWithId, 0, strategyHash, ctx);
@@ -1526,47 +1761,6 @@ var NO_CRDT = {
   }
 };
 
-// src/with-commit/history/strategy.ts
-function notEnabled(op) {
-  return new Error(
-    `${op} requires the history strategy. Import \`{ withHistory }\` from "@noy-db/hub/history" and pass it to \`createNoydb({ historyStrategy: withHistory() })\`.`
-  );
-}
-var NO_HISTORY = {
-  async saveHistory() {
-  },
-  async getHistoryEntries() {
-    throw notEnabled("collection.history()");
-  },
-  async getVersionEnvelope() {
-    throw notEnabled("collection.getVersion()");
-  },
-  async pruneHistory() {
-    return 0;
-  },
-  async clearHistory() {
-    return 0;
-  },
-  async tombstoneHistory() {
-    return 0;
-  },
-  async envelopePayloadHash() {
-    return "";
-  },
-  computePatch() {
-    return [];
-  },
-  diff() {
-    throw notEnabled("collection.diff()");
-  },
-  buildLedger() {
-    return null;
-  },
-  buildVaultInstant() {
-    throw notEnabled("vault.at() / vault.timeMachine()");
-  }
-};
-
 // src/with-party/team/sync-strategy.ts
 function notEnabled2(op) {
   return new Error(
@@ -1585,54 +1779,6 @@ var NO_SYNC = {
   }
 };
 
-// src/via/blob/binding.ts
-async function eraseBlobs(ctx, cfg) {
-  if (cfg.purgeBlobsForRecord) return cfg.purgeBlobsForRecord(ctx.id);
-  return { shredded: 0, residue: [] };
-}
-function buildBlobDescribeFragment(fields) {
-  return {
-    blobFields: Object.fromEntries(
-      Object.entries(fields).map(([field, p]) => [field, {
-        ...p.retainDays !== void 0 ? { retainDays: p.retainDays } : {},
-        ...p.evictWhen !== void 0 ? { evictWhen: true } : {},
-        ...p.legalHold !== void 0 ? { legalHold: true } : {},
-        ...p.retainUntil !== void 0 ? { retainUntil: true } : {},
-        ...p.external === true ? { external: true } : {},
-        ...p.public === true ? { public: true } : {},
-        ...p.backlink !== void 0 ? { backlink: p.backlink } : {}
-      }])
-    )
-  };
-}
-function blobBinding(cfg) {
-  return {
-    brand: "blob",
-    // encryptedAtRest: 'envelope' — blob chunks are AEAD-encrypted envelopes
-    // in `_blob_chunks` (service-side), not sealed record fields; queryable:
-    // 'none' — nothing indexes blob content; exportable — vault.exportBlobs()
-    // is a first-class door; forgettable — shredAllForRecord participates in
-    // vault.forget().
-    posture: { encryptedAtRest: "envelope", queryable: "none", exportable: true, forgettable: true },
-    covers: (field) => field in cfg.fields,
-    erase: (ctx) => eraseBlobs(ctx, cfg),
-    describeFragment: () => buildBlobDescribeFragment(cfg.fields)
-  };
-}
-function linkBlobVia() {
-  installViaBinder("blob", (c) => blobBinding(c));
-}
-
-// src/port/with/blob-strategy.ts
-linkBlobVia();
-var NO_BLOBS = {
-  openSlot() {
-    throw new Error(
-      'Blob storage is not enabled on this Noydb instance. Import `{ withBlobs }` from "@noy-db/hub/blobs" and pass `withBlobs()` to `createNoydb({ blobStrategy: withBlobs() })`.'
-    );
-  }
-};
-
 // src/kernel/via/compose.ts
 function via(...descriptors) {
   if (descriptors.length === 0) {
@@ -1910,6 +2056,34 @@ function resolveCollectionConfig(opts) {
       `Collection "${opts.name}": embeddings are not supported on CRDT collections (L2). Use a non-CRDT collection for semantic search.`
     );
   }
+  if (opts.tiers && opts.tiers.length > 0 && opts.blobFields !== void 0 && Object.keys(opts.blobFields).length > 0 && opts.perRecordKeys !== true) {
+    throw new UnsupportedTierCompositionError(
+      "blobs",
+      `Collection "${opts.name}": tiered collections that declare blobFields require \`perRecordKeys: true\` \u2014 legacy (non-perRecordKeys) blobs have no per-blob content CEK and cannot be tier-isolated on elevate/demote.`
+    );
+  }
+  if (opts.tiers && opts.tiers.length > 0 && opts.blobFields !== void 0) {
+    for (const [field, policy] of Object.entries(opts.blobFields)) {
+      if (policy?.external && policy.public === true) {
+        throw new UnsupportedTierCompositionError(
+          "blobs",
+          `Collection "${opts.name}": blob field "${field}" cannot be both \`external: true, public: true\` and declared on a tiered collection \u2014 the object key is deterministic and its bytes are world-readable by design, so tier-invisibility can never be enforced for it once elevated. Use a private/presigned external field (\`public\` omitted or \`false\`) or move this field to a non-tiered collection.`
+        );
+      }
+    }
+  }
+  if (opts.tiers && opts.tiers.length > 0 && opts.encrypted === false) {
+    throw new UnsupportedTierCompositionError(
+      "plaintext",
+      `Collection "${opts.name}": tiers are per-tier ENCRYPTION keys \u2014 a plaintext collection (\`encrypted: false\`) has nothing to re-key, so \`putAtTier\`/\`elevate\` would encrypt/decrypt incoherently. Use an encrypted collection.`
+    );
+  }
+  if (opts.tiers && opts.tiers.length > 0 && opts.crdt !== void 0 && ((opts.derivationSource?.registry().strategiesForSource(opts.name).length ?? 0) > 0 || (opts.materializedViewSource?.registry().mvsForSource(opts.name).length ?? 0) > 0)) {
+    throw new UnsupportedTierCompositionError(
+      "crdt-derivation",
+      `Collection "${opts.name}": tiers + crdt cannot be combined with this collection acting as a derivation/rollup source (#739) \u2014 the tier-aware pre-move decode \`syncDerived\` uses on elevate()/demote() does not resolve CRDT state, so a registered derivation/rollup reads raw CrdtState instead of the record and silently no-ops. Use a non-CRDT collection for a tiered derivation/rollup source, or move the derivation off this collection.`
+    );
+  }
   const effectiveViaFields = mergeViaFields(opts);
   const resolvedClassified = opts.classifiedFields !== void 0 ? resolveClassifiedFields(opts.name, opts.classifiedFields) : void 0;
   const allComputed = unifyComputedFields(opts, effectiveViaFields.computedFields);
@@ -2059,7 +2233,9 @@ function resolveCollectionConfig(opts) {
     tiersStrategy: opts.tiersStrategy ?? NO_TIERS,
     searchStrategy: opts.searchStrategy ?? NO_SEARCH,
     tierMode: opts.tierMode ?? "invisibility",
+    blobTierPolicy: opts.blobTierPolicy ?? "isolate",
     onCrossTierAccess: opts.onCrossTierAccess,
+    addSubjectRef: opts.addSubjectRef,
     deterministicFields,
     sensitiveFields,
     vdigFields,
@@ -2072,7 +2248,7 @@ function resolveCollectionConfig(opts) {
 // src/with-formula/computed/lazy.ts
 var fn = null;
 async function loadEvalComputedFields() {
-  fn ??= (await import("./computed-ORCGM5JE.js")).evalComputedFields;
+  fn ??= (await import("./computed-ZIQTYTDI.js")).evalComputedFields;
   return fn;
 }
 
@@ -2128,6 +2304,8 @@ var Collection = class {
   blobStrategy;
   objectStore;
   blobFields;
+  blobTierPolicy;
+  // #724 T2/T3
   aggregateStrategy;
   crdtStrategy;
   tiersStrategy;
@@ -2365,11 +2543,10 @@ var Collection = class {
   tiers;
   tierMode;
   onCrossTierAccess;
+  addSubjectRef;
+  // #766: putAtTier's first-write subject-index registration (wired by the Vault; undefined ⇒ no forget-subject field declared)
   /**
-   * Optional reference to the vault-level hash-chained audit
-   * log. When present, every successful `put()` and `delete()` appends
-   * an entry to the ledger AFTER the adapter write succeeds (so a
-   * failed adapter write never produces an orphan ledger entry).
+   * Optional reference to the vault-level hash-chained audit log. When present, every successful `put()` and `delete()` appends an entry to the ledger AFTER the adapter write succeeds (so a failed adapter write never produces an orphan ledger entry).
    *
    * The ledger is always a vault-wide singleton — all
    * collections in the same vault share the same LedgerStore.
@@ -2461,6 +2638,7 @@ var Collection = class {
     this.blobStrategy = cfg.blobStrategy;
     this.objectStore = cfg.objectStore;
     this.blobFields = cfg.blobFields;
+    this.blobTierPolicy = cfg.blobTierPolicy ?? "isolate";
     this.aggregateStrategy = cfg.aggregateStrategy;
     this.crdtStrategy = cfg.crdtStrategy;
     this.tiersStrategy = cfg.tiersStrategy;
@@ -2506,6 +2684,7 @@ var Collection = class {
     this.tiers = cfg.tiers;
     this.tierMode = cfg.tierMode;
     this.onCrossTierAccess = cfg.onCrossTierAccess;
+    this.addSubjectRef = cfg.addSubjectRef;
     this.deterministicFields = cfg.deterministicFields;
     this.sensitiveFields = cfg.sensitiveFields;
     this.perRecordCek = cfg.perRecordCek;
@@ -2558,9 +2737,7 @@ var Collection = class {
         const remoteJson = await this.codec.decryptJsonString(remote, id);
         if (localJson === null) return local;
         if (remoteJson === null) return remote;
-        const localState = JSON.parse(localJson);
-        const remoteState = JSON.parse(remoteJson);
-        const merged = this.crdtStrategy.mergeCrdtStates(localState, remoteState);
+        const merged = this.crdtStrategy.mergeCrdtStates(JSON.parse(localJson), JSON.parse(remoteJson));
         const mergedVersion = Math.max(local._v, remote._v) + 1;
         const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
         return this.codec.encryptJsonString(JSON.stringify(merged), mergedVersion, cek);
@@ -2875,7 +3052,7 @@ var Collection = class {
     }
     await this.onAccess?.("find", "*");
     if (hits.length === 0) return [];
-    const { verifyDigestField } = await import("./verify-QK76NJ4G.js");
+    const { verifyDigestField } = await import("./verify-ZASTRNPR.js");
     const policy = {
       normalize: spec.verifyNormalize ?? "password",
       notLastN: spec.notLastN ?? 0,
@@ -3081,7 +3258,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-TJXFQKOJ.js");
+      const { resolveStaleMVOnRead } = await import("./stale-OSQ7J3AA.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     let record;
@@ -3092,7 +3269,7 @@ var Collection = class {
       } else {
         const envelope = await this.adapter.get(this.vault, this.name, id);
         if (!envelope) return null;
-        if (isTombstone(envelope, this.storeCiphertext) || isDeleteMarker(envelope)) return null;
+        if (isTombstone(envelope, this.storeCiphertext) || isDeleteMarker(envelope) || (envelope._tier ?? 0) > 0) return null;
         record = await this.codec.decryptRecord(envelope, { id, sealedAsHandles: true });
         if (record === null) return null;
         this.lru.set(id, { record, version: envelope._v }, estimateRecordBytes(record));
@@ -3119,7 +3296,7 @@ var Collection = class {
       );
     }
     const envelope = await this.adapter.get(this.vault, this.name, id);
-    if (!envelope) return null;
+    if (!envelope || (envelope._tier ?? 0) > 0) return null;
     const json = await this.codec.decryptJsonString(envelope);
     if (json === null) return null;
     return JSON.parse(json);
@@ -3236,7 +3413,7 @@ var Collection = class {
       const cached = this.lru.get(id);
       if (cached) return cached.record;
       const env = await this.adapter.get(this.vault, this.name, id);
-      if (!env) return void 0;
+      if (!env || (env._tier ?? 0) > 0) return void 0;
       const rec = await this.codec.decryptRecord(env, { id });
       return rec === null ? void 0 : rec;
     }
@@ -3284,7 +3461,7 @@ var Collection = class {
       const cached2 = this.lru.get(id);
       if (cached2) return { record: cached2.record, version: cached2.version };
       const env = await this.adapter.get(this.vault, this.name, id);
-      if (!env) return { record: null, version: 0 };
+      if (!env || (env._tier ?? 0) > 0) return { record: null, version: 0 };
       return { record: await this.codec.decryptRecord(env, { skipValidation: true, id }) ?? null, version: env._v };
     }
     await this.ensureHydrated();
@@ -3306,7 +3483,7 @@ var Collection = class {
   async resolvePriorValues(id) {
     if (this.sensitiveFields.size > 0 || this.via?.hasAtRestHooks === true) {
       const env = await this.adapter.get(this.vault, this.name, id);
-      if (!env || isTombstone(env, this.storeCiphertext)) return void 0;
+      if (!env || isTombstone(env, this.storeCiphertext) || (env._tier ?? 0) > 0) return void 0;
       const rec = await this.codec.decryptRecord(env, { skipValidation: true, id });
       return rec === null ? void 0 : { record: rec, version: env._v };
     }
@@ -3318,11 +3495,8 @@ var Collection = class {
     if (!this.subsystemBus.gateNeedsPrior(point)) return { env: null, record: null, elided: true };
     const env = await this.adapter.get(this.vault, this.name, id);
     if (!env) return { env: null, record: null, elided: false };
-    try {
-      return { env, record: await this.codec.decryptRecord(env, { skipValidation: true, id }), elided: false };
-    } catch {
-      return { env, record: null, elided: false };
-    }
+    if ((env._tier ?? 0) > 0) return { env, record: null, elided: false };
+    return { env, record: await this.codec.decryptRecord(env, { skipValidation: true, id }), elided: false };
   }
   /**
    * Wraps {@link RecordCodec.toCacheRecord} with an additional strip for
@@ -3344,6 +3518,7 @@ var Collection = class {
     if (!hasWritePermission(this.keyring, this.name)) {
       throw new ReadOnlyError();
     }
+    await assertTierWritable(this.adapter, this.vault, this.name, id, this.tiers !== null);
     if (this.via) record = this.via.ingest(record);
     if (this.subsystemBus?.hasGateHandlers("beforePut")) {
       const { env: existingEnv, record: existingRecord } = await this.resolveGatePrior("beforePut", id);
@@ -3409,8 +3584,7 @@ var Collection = class {
             }
           }
         }
-        const arr = Array.isArray(record) ? record : [record];
-        crdtState = this.crdtStrategy.buildRgaState(arr, existingState, generateULID);
+        crdtState = this.crdtStrategy.buildRgaState(Array.isArray(record) ? record : [record], existingState, generateULID);
       } else {
         crdtState = { _crdt: "yjs", update: record };
       }
@@ -3422,9 +3596,7 @@ var Collection = class {
       const existingResolvedRecord = existingEnvelope ? await this.codec.decryptRecord(existingEnvelope, { skipValidation: true }) : null;
       const existingResolved = existingResolvedRecord !== null ? { record: existingResolvedRecord, version: existingVersion } : void 0;
       if (existingResolved && this.historyConfig.enabled !== false) {
-        const vdigCtx2 = this.vdigFields !== null ? { id, prev: existingEnvelope } : void 0;
-        const histEnvelope = await this.codec.encryptRecord(existingResolved.record, existingResolved.version, cek2, void 0, void 0, vdigCtx2, id);
-        await this.historyStrategy.saveHistory(this.adapter, this.vault, this.name, id, histEnvelope);
+        await this.historyStrategy.saveHistory(this.adapter, this.vault, this.name, id, await this.codec.encryptRecord(existingResolved.record, existingResolved.version, cek2, void 0, void 0, this.vdigFields !== null ? { id, prev: existingEnvelope } : void 0, id));
         this.emitter.emit("history:save", { vault: this.vault, collection: this.name, id, version: existingResolved.version });
         if (this.historyConfig.maxVersions) {
           await this.historyStrategy.pruneHistory(this.adapter, this.vault, this.name, id, { keepVersions: this.historyConfig.maxVersions });
@@ -3486,19 +3658,14 @@ var Collection = class {
     const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
     const vdigCtx = this.vdigFields !== null ? { id, prev: await this.adapter.get(this.vault, this.name, id) } : void 0;
     if (existing && this.historyConfig.enabled !== false) {
-      const historyEnvelope = await this.codec.encryptRecord(existing.record, existing.version, cek, void 0, void 0, vdigCtx, id);
-      await this.historyStrategy.saveHistory(this.adapter, this.vault, this.name, id, historyEnvelope);
+      await this.historyStrategy.saveHistory(this.adapter, this.vault, this.name, id, await this.codec.encryptRecord(existing.record, existing.version, cek, void 0, void 0, vdigCtx, id));
       this.emitter.emit("history:save", {
         vault: this.vault,
         collection: this.name,
         id,
         version: existing.version
       });
-      if (this.historyConfig.maxVersions) {
-        await this.historyStrategy.pruneHistory(this.adapter, this.vault, this.name, id, {
-          keepVersions: this.historyConfig.maxVersions
-        });
-      }
+      if (this.historyConfig.maxVersions) await this.historyStrategy.pruneHistory(this.adapter, this.vault, this.name, id, { keepVersions: this.historyConfig.maxVersions });
     }
     const envelope = await this.codec.encryptRecord(record, version, cek, options?.source, options?.sourceTs, vdigCtx, id);
     await this.adapter.put(this.vault, this.name, id, envelope);
@@ -3560,7 +3727,7 @@ var Collection = class {
         if (wave?.seen(`mv\0${reg.spec.name}`)) continue;
         if (executor === null) {
           ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-6OCCE5VM.js"));
+          ({ MaterializedViewExecutor: executor } = await import("./executor-UNEH5ZYH.js"));
         }
         await executor.refresh(reg, {
           getCollection: (name) => this.materializedViewSource.getCollection(name),
@@ -3570,7 +3737,7 @@ var Collection = class {
         });
       } else if (mode === "lazy") {
         if (staleHelpers === null) {
-          staleHelpers = await import("./stale-TJXFQKOJ.js");
+          staleHelpers = await import("./stale-OSQ7J3AA.js");
         }
         staleHelpers.markMVStale(registry, reg.spec.name);
       }
@@ -3774,7 +3941,7 @@ var Collection = class {
         continue;
       }
       if (DerivationExecutor === null) {
-        ({ DerivationExecutor } = await import("./executor-JFVAJY42.js"));
+        ({ DerivationExecutor } = await import("./executor-OVEXR6RT.js"));
       }
       for (const run of runs) {
         const ctx = { vault: this.derivationSource.getReadOnlyFacade() };
@@ -3794,7 +3961,7 @@ var Collection = class {
           const outputCollection = this.derivationSource.getCollection(outSpec.collection);
           const txCtx = this.derivationSource.getActiveTxContext();
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-IO2KDUWV.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-A765THMX.js");
             const prior = await loadFanoutSidecar(this.adapter, this.vault, spec.source, run.runId, key, this.getDEK, this.storeCiphertext);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -3904,13 +4071,11 @@ var Collection = class {
     }
   }
   /**
-   * @internal — bulk-rewrite every record through a cutover transform.
-   * Raw adapter path (bypasses the write gate + guards — the transform is
-   * trusted and runs only during the `migrating` phase). Bumps each
-   * record's `_v` and appends a ledger `op:'migration'` entry.
+   * @internal — bulk-rewrite every record through a cutover transform. Raw adapter path (bypasses the write gate + guards — the transform is trusted and runs only during the `migrating` phase). Bumps each record's `_v` and appends a ledger `op:'migration'` entry. #708: refuses BEFORE any rewrite if a live record is elevated (assertCutoverTierSafe) — demote it first.
    */
   async _applyCutoverTransform(transform) {
     const ids = await this.adapter.list(this.vault, this.name);
+    await assertCutoverTierSafe(this.adapter, this.vault, this.name, this.tiers !== null);
     let count = 0;
     for (const id of ids) {
       const env = await this.adapter.get(this.vault, this.name, id);
@@ -3921,8 +4086,7 @@ var Collection = class {
       const next = transform(record);
       const nextVersion = (env._v ?? 0) + 1;
       const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
-      const newEnv = await this.codec.encryptRecord(next, nextVersion, cek, void 0, void 0, this.vdigFields !== null ? { id, prev: env } : void 0, id);
-      await this.adapter.put(this.vault, this.name, id, newEnv);
+      await this.adapter.put(this.vault, this.name, id, await this.codec.encryptRecord(next, nextVersion, cek, void 0, void 0, this.vdigFields !== null ? { id, prev: env } : void 0, id));
       await this._onRecordMutated(id, "put", "cutover");
       if (this.ledger) {
         await this.ledger.append({
@@ -3994,13 +4158,14 @@ var Collection = class {
         priorEnvelope: prior
       });
     }
-    await this._doDelete(id, true);
-    return true;
+    return await this._doDelete(id, true);
   }
   async _doDelete(id, internal) {
     if (!hasWritePermission(this.keyring, this.name)) {
       throw new ReadOnlyError();
     }
+    await assertTierWritable(this.adapter, this.vault, this.name, id, !internal && this.tiers !== null);
+    if (internal && this.tiers !== null && await liveRecordIsElevated(this.adapter, this.vault, this.name, id)) return false;
     if (this.subsystemBus?.hasGateHandlers("beforeDelete")) {
       const { env: existingEnv, record: existingRecord, elided } = await this.resolveGatePrior("beforeDelete", id);
       if (existingEnv || elided) {
@@ -4038,15 +4203,14 @@ var Collection = class {
     if (existing && this.historyConfig.enabled !== false) {
       const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
       const prevForVdig = this.vdigFields !== null ? await this.adapter.get(this.vault, this.name, id) : null;
-      const historyEnvelope = await this.codec.encryptRecord(existing.record, existing.version, cek, void 0, void 0, this.vdigFields !== null ? { id, prev: prevForVdig } : void 0, id);
-      await this.historyStrategy.saveHistory(this.adapter, this.vault, this.name, id, historyEnvelope);
+      await this.historyStrategy.saveHistory(this.adapter, this.vault, this.name, id, await this.codec.encryptRecord(existing.record, existing.version, cek, void 0, void 0, this.vdigFields !== null ? { id, prev: prevForVdig } : void 0, id));
     }
     const previousEnvelope = await this.adapter.get(this.vault, this.name, id);
     const previousPayloadHash = await this.historyStrategy.envelopePayloadHash(previousEnvelope);
     let markerVersion;
     if (this.onDirty) {
       const live = previousEnvelope;
-      if (!live || isTombstone(live, this.storeCiphertext) || isDeleteMarker(live)) return;
+      if (!live || isTombstone(live, this.storeCiphertext) || isDeleteMarker(live)) return false;
       markerVersion = live._v + 1;
       await this.adapter.put(this.vault, this.name, id, buildDeleteMarker(markerVersion, this.keyring.userId));
       this.markerIds.add(id);
@@ -4081,6 +4245,7 @@ var Collection = class {
       await this.dispatchArrayDerivationsOnDelete(id);
       if (existing) await this.dispatchRollupsOnDelete(id, existing.record);
     }
+    return true;
   }
   /**
    * @internal — GDPR crypto-shred a LIVE record to a tombstone.
@@ -4154,7 +4319,7 @@ var Collection = class {
           continue;
         }
         if (helpers === null) {
-          helpers = await import("./fanout-sidecar-IO2KDUWV.js");
+          helpers = await import("./fanout-sidecar-A765THMX.js");
         }
         const sidecar = await helpers.loadFanoutSidecar(this.adapter, this.vault, spec.source, id, outputKey, this.getDEK, this.storeCiphertext);
         if (!sidecar) continue;
@@ -4170,39 +4335,49 @@ var Collection = class {
   /**
    * Mirror of {@link dispatchMaterializedViews} for the delete/forget path — no `_materializedFrom`
    * skip (record's gone); the `internal` gate at `_doDelete` is the recursion guard. Returns the
-   * row count TOMBSTONED across every eager MV sourced here (#638 T6 — `forgetDerivedFanout`'s
-   * `derivedRecordsErased`); a lazy MV only flips its stale bit (0 contribution — resolved on read).
+   * row count TOMBSTONED across EVERY MV sourced here (#638 T6 — `forgetDerivedFanout`'s
+   * `derivedRecordsErased`) — eager AND lazy/manual `invalidateMVAtRest` purges both contribute now
+   * (#761 item 1, previously eager-only); lazy persists a stale mark for cold-session recompute;
+   * manual serves empty until `refreshView()`. `residueUndecodable`/`residueDeclined` (#776/#785) carry `outputCollection:id` entries whose ownership stamp `invalidateMVAtRest` could not decode, resp. decoded+stamp-matched but declined erasure — surfaced, not erased.
    * @internal
    */
   async dispatchMaterializedViewsOnDelete(id) {
-    if (this.materializedViewSource === void 0) return 0;
+    if (this.materializedViewSource === void 0) return { deleted: 0, residueUndecodable: [], residueDeclined: [] };
     const registry = this.materializedViewSource.registry();
     const mvs = registry.mvsForSource(this.name);
-    if (mvs.length === 0) return 0;
+    if (mvs.length === 0) return { deleted: 0, residueUndecodable: [], residueDeclined: [] };
     let executor = null;
     let staleHelpers = null;
     let deleted = 0;
+    const residueUndecodable = [];
+    const residueDeclined = [];
     for (const reg of mvs) {
       const mode = reg.spec.refresh;
       if (mode === "eager") {
         if (executor === null) {
           ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-6OCCE5VM.js"));
+          ({ MaterializedViewExecutor: executor } = await import("./executor-UNEH5ZYH.js"));
         }
-        deleted += (await executor.refresh(reg, {
+        const rr = await executor.refresh(reg, {
           getCollection: (name) => this.materializedViewSource.getCollection(name),
           getActiveTxContext: () => this.materializedViewSource.getActiveTxContext(),
           getQueryContext: () => this.materializedViewSource.getQueryContext(),
           dispatchCtx: this.#dispatchCtx({ collection: this.name, id })
-        })).deleted;
-      } else if (mode === "lazy") {
+        });
+        deleted += rr.deleted;
+        residueUndecodable.push(...rr.residueUndecodable);
+        residueDeclined.push(...rr.residueDeclined);
+      } else {
         if (staleHelpers === null) {
-          staleHelpers = await import("./stale-TJXFQKOJ.js");
+          staleHelpers = await import("./stale-OSQ7J3AA.js");
         }
-        staleHelpers.markMVStale(registry, reg.spec.name);
+        const inv = await staleHelpers.invalidateMVAtRest(this.materializedViewSource, reg, mode);
+        deleted += inv.deleted;
+        residueUndecodable.push(...inv.residueUndecodable.map((rid) => `${reg.outputCollection}:${rid}`));
+        residueDeclined.push(...inv.residueDeclined.map((rid) => `${reg.outputCollection}:${rid}`));
       }
     }
-    return deleted;
+    return { deleted, residueUndecodable, residueDeclined };
   }
   /**
    * List all records in the collection.
@@ -4221,7 +4396,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-TJXFQKOJ.js");
+      const { resolveStaleMVOnRead } = await import("./stale-OSQ7J3AA.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     await this.ensureHydrated();
@@ -4260,6 +4435,11 @@ var Collection = class {
   similarTo(vector, opts = {}) {
     return this.searchStrategy.similarTo(this.searchContext(), vector, opts);
   }
+  /** Opt-in bulk `_vec` re-derive (#788) — a plain collection has nothing to rebuild; gated behind `searchStrategy: withSearch()` otherwise. */
+  rebuildEmbeddings() {
+    if (!this.embeddings) return Promise.resolve({ rebuilt: 0, skipped: 0 });
+    return this.searchStrategy.rebuildEmbeddings(this.searchContext());
+  }
   /**
    * Bind the {@link SearchContext} the search/retrieval surface needs. The
    * `cache` is the SAME `Map` reference the eager read/write path owns (passed
@@ -4379,8 +4559,7 @@ var Collection = class {
           if (op.collectionName === this.name) {
             await this._invalidateCacheEntry(op.id);
           } else if (this.derivationSource) {
-            const sibling = this.derivationSource.getCollection(op.collectionName);
-            await sibling._invalidateCacheEntry(op.id);
+            await this.derivationSource.getCollection(op.collectionName)._invalidateCacheEntry(op.id);
           }
         } catch {
         }
@@ -4590,8 +4769,10 @@ var Collection = class {
       id,
       options
     );
+    if (await liveRecordIsElevated(this.adapter, this.vault, this.name, id)) return [];
     const entries = [];
     for (const env of envelopes) {
+      if ((env._tier ?? 0) > 0) continue;
       const record = await this.codec.decryptRecord(env, { skipValidation: true, id });
       if (record === null) continue;
       entries.push({
@@ -4620,7 +4801,7 @@ var Collection = class {
       id,
       version
     );
-    if (!envelope) return null;
+    if (!envelope || (envelope._tier ?? 0) > 0 || await liveRecordIsElevated(this.adapter, this.vault, this.name, id)) return null;
     return this.codec.decryptRecord(envelope, { skipValidation: true, id });
   }
   /** Revert a record to a past version. Creates a new version with the old content. */
@@ -4638,8 +4819,7 @@ var Collection = class {
    */
   async diff(id, versionA, versionB) {
     const recordA = versionA === 0 ? null : await this.resolveVersion(id, versionA);
-    const recordB = versionB === void 0 || versionB === 0 ? versionB === 0 ? null : await this.resolveCurrentOrVersion(id) : await this.resolveVersion(id, versionB);
-    return this.historyStrategy.diff(recordA, recordB);
+    return this.historyStrategy.diff(recordA, versionB === void 0 || versionB === 0 ? versionB === 0 ? null : await this.resolveCurrentOrVersion(id) : await this.resolveVersion(id, versionB));
   }
   /** Resolve a version: try history first, then check if it's the current version. */
   async resolveVersion(id, version) {
@@ -4681,14 +4861,13 @@ var Collection = class {
   /**
    * Count records in the collection.
    *
-   * In eager mode this returns the in-memory cache size (instant). In
-   * lazy mode it asks the adapter via `list()` to enumerate ids — slower
-   * but still correct, and avoids loading any record bodies into memory.
+   * In eager mode this returns the in-memory cache size (instant). In lazy
+   * mode it counts only LIVE tier-0 envelopes via envelope inspection — no
+   * record bodies loaded — matching eager's tombstone/tier exclusion (#706).
    */
   async count() {
     if (this.lazy) {
-      const ids = await this.adapter.list(this.vault, this.name);
-      return ids.length;
+      return countLiveEnvelopes(this.adapter, this.vault, this.name, this.storeCiphertext);
     }
     await this.ensureHydrated();
     return this.cache.size;
@@ -4728,7 +4907,7 @@ var Collection = class {
     for (let i = start; i < end; i++) {
       const id = ids[i];
       const envelope = await this.adapter.get(this.vault, this.name, id);
-      if (envelope) {
+      if (envelope && (envelope._tier ?? 0) === 0) {
         const record = await this.codec.decryptRecord(envelope, { id, sealedAsHandles: true });
         if (record === null) continue;
         items.push(record);
@@ -4810,6 +4989,7 @@ var Collection = class {
   async decryptPage(items) {
     const out = [];
     for (const { id, envelope } of items) {
+      if ((envelope._tier ?? 0) > 0) continue;
       const record = await this.codec.decryptRecord(envelope, { id, sealedAsHandles: true });
       if (record === null) continue;
       out.push({ id, record, version: envelope._v });
@@ -4851,8 +5031,7 @@ var Collection = class {
   async _compensateRevertedWrite(id) {
     await this._invalidateCacheEntry(id);
     await this.onDirty?.(this.name, id, "revert", 0);
-    const restored = await this.get(id);
-    this.emitter.emit("change", { vault: this.vault, collection: this.name, id, action: restored !== null ? "put" : "delete" });
+    this.emitter.emit("change", { vault: this.vault, collection: this.name, id, action: await this.get(id) !== null ? "put" : "delete" });
   }
   async _invalidateCacheEntry(id) {
     if (this.lazy && this.lru) {
@@ -4967,7 +5146,7 @@ var Collection = class {
     const ids = await this.adapter.list(this.vault, this.name);
     for (const id of ids) {
       const envelope = await this.adapter.get(this.vault, this.name, id);
-      if (envelope && !isTombstone(envelope, this.storeCiphertext) && !isDeleteMarker(envelope)) {
+      if (envelope && !isTombstone(envelope, this.storeCiphertext) && !isDeleteMarker(envelope) && (envelope._tier ?? 0) === 0) {
         const record = await this.codec.decryptRecord(envelope, { id, sealedAsHandles: true });
         if (record === null) continue;
         this.cache.set(id, { record, version: envelope._v });
@@ -4986,7 +5165,7 @@ var Collection = class {
         this.markerIds.add(id);
         continue;
       }
-      if (isTombstone(envelope, this.storeCiphertext)) continue;
+      if (isTombstone(envelope, this.storeCiphertext) || (envelope._tier ?? 0) > 0) continue;
       const record = await this.codec.decryptRecord(envelope, { id, sealedAsHandles: true });
       if (record === null) continue;
       this.cache.set(id, { record, version: envelope._v });
@@ -5107,6 +5286,8 @@ var Collection = class {
       encrypted: this.storeCiphertext,
       userId: this.keyring.userId,
       erasableBlobs: this.perRecordCek,
+      tiersActive: this.tiers !== null,
+      keyring: this.keyring,
       debugPlaintext: this.keyring.debugPlaintext === true,
       ...this.objectStore !== void 0 ? { objectStore: this.objectStore } : {},
       ...this.blobFields !== void 0 ? { blobFields: this.blobFields } : {}
@@ -5199,7 +5380,7 @@ var Collection = class {
   /** Drop a record's encrypted _vec sidecar on erasure (a vector is text-invertible).
    *  Called by vault.ts forget() inside a resilient try/catch; residue is reported in ForgetResult. */
   async _purgeVector(id) {
-    await this.adapter.delete(this.vault, "_vec", id);
+    await this.adapter.delete(this.vault, "_vec", encodeVecId(this.name, id));
     this.vectorSet?.markDirty();
   }
   /** Drop the persisted lexical-index blob (forget/erasure): an opaque
@@ -5368,14 +5549,14 @@ var Collection = class {
   /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
   async _ensureClassifiedMarker() {
     if (this._markerPersisted || this.vdigFields === null) return;
-    const { persistClassifiedMarkerForFields } = await import("./classified-marker-M7K3OJPM.js");
+    const { persistClassifiedMarkerForFields } = await import("./classified-marker-CZKA6ITE.js");
     await persistClassifiedMarkerForFields(this.adapter, this.vault, this.name, this.vdigFields, await this.getDEK(this.name));
     this._markerPersisted = true;
   }
   /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
   async _classifiedMarkerDigestOnly() {
     if (this._markerDigestOnlyCache !== void 0) return this._markerDigestOnlyCache;
-    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-M7K3OJPM.js");
+    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-CZKA6ITE.js");
     this._markerDigestOnlyCache = await readClassifiedMarkerDigestOnly(this.adapter, this.vault, this.name, await this.getDEK(this.name));
     return this._markerDigestOnlyCache;
   }
@@ -5415,7 +5596,7 @@ var Collection = class {
     };
   }
   // ─── Hierarchical Access ──────────────────────────
-  /** tier-aware put — gated behind `tiersStrategy: withTiers()`. */
+  /** tier-aware put — gated behind `tiersStrategy: withTiers()`. `searchResidue: true` = stuck search compensation (#774, mirroring #764's elevate/demote posture); the write itself always completes. */
   putAtTier(id, record, tier, opts) {
     return this.tiersStrategy.putAtTier(this.tiersContext(), id, record, tier, opts);
   }
@@ -5427,18 +5608,16 @@ var Collection = class {
   listAtTier() {
     return this.tiersStrategy.listAtTier(this.tiersContext());
   }
-  /** elevate a record to a higher tier — gated behind `withTiers()`. */
+  /** elevate a record to a higher tier — gated behind `withTiers()`. `searchResidue: true` = stuck search compensation (#764); the move itself always completes. */
   elevate(id, toTier) {
     return this.tiersStrategy.elevate(this.tiersContext(), id, toTier);
   }
-  /** demote a record to a lower tier — gated behind `withTiers()`. */
+  /** demote a record to a lower tier — gated behind `withTiers()`. Same `searchResidue` posture as {@link elevate} (#764). */
   demote(id, toTier) {
     return this.tiersStrategy.demote(this.tiersContext(), id, toTier);
   }
   /**
-   * Emit a cross-tier access event. The subscriber sink stays collection-
-   * resident (it captures `onCrossTierAccess`); the tiers module reaches it
-   * via the {@link TiersContext.emitCrossTierEvent} callback.
+   * Emit a cross-tier access event. The subscriber sink stays collection-resident (it captures `onCrossTierAccess`); the tiers module reaches it via the {@link TiersContext.emitCrossTierEvent} callback.
    */
   emitCrossTierEvent(event) {
     try {
@@ -5479,9 +5658,7 @@ var Collection = class {
     if (patch.presentForJoin) this.presentForJoin = patch.presentForJoin;
   }
   /**
-   * Bind the {@link TiersContext} the tier ops need. The `cekCache` is passed
-   * by reference (the SAME `Lru` the kernel's read/write path owns) so an
-   * elevate/demote CEK re-wrap stays synchronous with cache eviction.
+   * Bind the {@link TiersContext} the tier ops need — `cekCache` by reference (same `Lru` the read/write path owns) for a synchronous re-wrap; `syncDerived` closes over `this` for {@link syncDerivedOutputs} (#722).
    */
   tiersContext() {
     return {
@@ -5491,19 +5668,43 @@ var Collection = class {
       keyring: this.keyring,
       codec: this.codec,
       cekCache: this.cekCache,
+      syncCache: (id, e) => {
+        if (e) this.cache.set(id, e);
+        else this.cache.delete(id);
+        this.lru?.remove(id);
+      },
+      syncIndexes: (id, rec, version, priorEnvelope) => syncTierIndexes(this.indexingContext(), id, rec, version, priorEnvelope),
+      syncSearch: (id, rec, version) => syncTierSearch(this.searchContext(), id, rec, version),
+      syncHistory: async (id, fromDek, toDek) => this.historyStrategy.rewrapHistory(this.adapter, this.vault, this.name, id, fromDek, toDek, await this.getDEK(this.name)),
+      saveHistorySnapshot: async (id, envelope) => {
+        if (this.historyConfig.enabled === false) return;
+        await this.historyStrategy.saveHistory(this.adapter, this.vault, this.name, id, envelope);
+        this.emitter.emit("history:save", { vault: this.vault, collection: this.name, id, version: envelope._v });
+        if (this.historyConfig.maxVersions) await this.historyStrategy.pruneHistory(this.adapter, this.vault, this.name, id, { keepVersions: this.historyConfig.maxVersions });
+      },
+      historyEnabled: this.historyConfig.enabled !== false && this.historyStrategy !== NO_HISTORY,
+      // #728/#737: lets putAtTier skip decrypting `existing` when no real history strategy is wired
+      syncBlobs: (id, fromTier, toTier) => this.blobStrategy !== NO_BLOBS ? this.blob(id).syncTierMove(fromTier, toTier, this.blobTierPolicy) : Promise.resolve(),
+      // #724 I1: gate on blob storage enabled (not on declared blobFields) so undeclared-field blobs still rehome; #746: syncTierMove mints/resumes the rehome journal marker; self-no-ops on an empty slot map
+      syncLedger: async (id) => {
+        await this.ledger?.purgeRecordDeltas(this.name, id);
+      },
+      syncDerived: (id, record, elevated, version) => syncDerivedOutputs(this, id, record, elevated, version),
+      hasDerivedOutputs: this.materializedViewSource !== void 0 && this.materializedViewSource.registry().mvsForSource(this.name).length > 0 || this.derivationSource !== void 0 && this.derivationSource.registry().strategiesForSource(this.name).length > 0,
+      // #737: source-grained (was vault-grained) — a derivation-free tiered collection skips the pre-move decode even when other collections in the vault have derivations
       provenance: this.provenance,
       tiers: this.tiers,
       tierMode: this.tierMode,
       getDEK: (key) => this.getDEK(key),
-      emitCrossTierEvent: (event) => this.emitCrossTierEvent(event)
+      emitCrossTierEvent: (event) => this.emitCrossTierEvent(event),
+      addSubjectRef: (id, record) => this.addSubjectRef?.(id, record) ?? Promise.resolve()
     };
   }
   /**
    * Bind the {@link IndexingContext} the index-maintenance surface needs. The
    * eager `cache` Map and the index / unique-constraint / persisted mirrors are
    * passed by reference (the SAME instances the query path reads, never
-   * copied); the `persistedIndexesLoaded` flag and `ensure*` hydration stay
-   * collection-resident, reached via callbacks.
+   * copied); the `persistedIndexesLoaded` flag and `ensure*` hydration stay collection-resident, reached via callbacks.
    */
   indexingContext() {
     return {
@@ -5554,9 +5755,12 @@ var ElevatedHandle = class {
    */
   collection(name) {
     return {
+      // #779 — surface `_elevatedPut`'s `TierMoveResult` (searchResidue) instead of
+      // discarding it, so a stuck search compensation on this convenience path is
+      // observable by the caller, mirroring `putAtTier`'s direct-call parity (#774).
       put: async (id, record) => {
         this.assertActive();
-        await this.vault._elevatedPut(name, id, record, this.tier, this.reason);
+        return await this.vault._elevatedPut(name, id, record, this.tier, this.reason);
       }
     };
   }
@@ -6773,7 +6977,7 @@ var VaultLinks = class {
 // src/with-shape/links/lazy-handle.ts
 function makeLazyLinkSetHandle(d) {
   let engine = null;
-  const load = () => engine ??= import("./link-set-DGYUOFVD.js").then(
+  const load = () => engine ??= import("./link-set-Z7Q2ASFX.js").then(
     ({ LinkSet }) => new LinkSet(d.adapter, d.vault, d.name, d.spec, d.encrypted, d.getDEK, d.actor, d.emitter, d.endpointExists)
   );
   return {
@@ -7311,7 +7515,7 @@ function declareSatellite(ctx, collectionName, options, existingRegistry) {
   ctx.forEachSyncEngine((e) => e.remirrorPairResolvers([spec.base, spec.satellite]));
   const registry = reg;
   const baseSchema = ctx.getBaseSchema(spec.base);
-  void import("./post-register-LB3P4XQU.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
+  void import("./post-register-JTH76BLY.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
   });
   return reg;
 }
@@ -8305,7 +8509,7 @@ var Vault = class {
         const strategies = options.schemaUpdate ?? [];
         const work = (async () => {
           const dek = await this.getDEK(collectionName);
-          const { persistSchemaIfNeeded } = await import("./register-ZI7YI7US.js");
+          const { persistSchemaIfNeeded } = await import("./register-VAHONCID.js");
           const result = await persistSchemaIfNeeded({
             store: this.adapter,
             vault: this.name,
@@ -8418,9 +8622,7 @@ var Vault = class {
       if (options?.sensitive !== void 0) {
         collOpts.sensitive = options.sensitive;
       }
-      if (options?.perRecordKeys !== void 0) {
-        collOpts.perRecordKeys = options.perRecordKeys;
-      }
+      if (options?.perRecordKeys !== void 0) collOpts.perRecordKeys = options.perRecordKeys;
       const subjectKey = this.forgetStrategy.subjects[collectionName];
       if (subjectKey !== void 0) {
         if (options?.perRecordKeys === false) {
@@ -8430,11 +8632,16 @@ var Vault = class {
         }
         collOpts.perRecordKeys = true;
         collOpts.subjectKeyField = subjectKey;
+        collOpts.addSubjectRef = async (id, record) => {
+          const value = readDottedPath(record, subjectKey);
+          if (value !== void 0 && value !== null) await this._addSubjectRef(coerceSubjectId(value), { collection: collectionName, id });
+        };
       }
       if (options?.provenance !== void 0) collOpts.provenance = options.provenance;
       if (options?.ramCiphertext !== void 0) collOpts.ramCiphertext = options.ramCiphertext;
       if (options?.tiers !== void 0) collOpts.tiers = options.tiers;
       if (options?.tierMode !== void 0) collOpts.tierMode = options.tierMode;
+      if (options?.blobTierPolicy !== void 0) collOpts.blobTierPolicy = options.blobTierPolicy;
       collOpts.onCrossTierAccess = (event) => this.emitCrossTier(event);
       if (this.syncAdapter !== void 0) collOpts.syncAdapter = this.syncAdapter;
       if (options?.i18nFields !== void 0) collOpts.i18nFields = options.i18nFields;
@@ -8501,7 +8708,7 @@ var Vault = class {
         const work = (async () => {
           try {
             const dek = await this.getDEK(collectionName);
-            await (await import("./register-ZI7YI7US.js")).persistSchemaIfNeeded({
+            await (await import("./register-VAHONCID.js")).persistSchemaIfNeeded({
               store: this.adapter,
               vault: this.name,
               collectionName,
@@ -9375,6 +9582,8 @@ var Vault = class {
     if (Object.keys(this.forgetStrategy.subjects).length === 0) {
       throw new ForgetStrategyNotConfiguredError();
     }
+    const ledger = this.getLedgerOrNull();
+    if (!ledger) throw new Error('vault.forget() requires the history strategy for the erasure-proof ledger entry. Pass `historyStrategy: withHistory()` from "@noy-db/hub/history" to createNoydb().');
     const refs = await lookupSubject(this.adapter, this.name, this.getDEK, this.encrypted, subjectId);
     const allRefs = expandRefsWithSatellites(refs, this.satelliteRegistry);
     let recordsShredded = 0;
@@ -9387,12 +9596,14 @@ var Vault = class {
     let indexPostingsPurged = 0;
     let sealedFieldsShredded = 0;
     let sealedCekEnvelopesPurged = 0;
+    let ledgerDeltasPurged = 0;
     const sealedCekResidue = [];
     const sealedResidue = [];
     const indexResidue = [];
+    const ledgerDeltaResidue = [];
     const blobsEnabled = this.blobStrategy !== void 0;
     const actor = this.keyring.userId;
-    const fanoutStats = { recordsErased: 0, aggregatesRecomputed: 0, residueFrozen: [], lookupReferencesCascaded: 0, lookupReferencesNullified: 0, lookupReferencesResidue: [] };
+    const fanoutStats = { recordsErased: 0, aggregatesRecomputed: 0, residueFrozen: [], lookupReferencesCascaded: 0, lookupReferencesNullified: 0, lookupReferencesResidue: [], derivedResidueUndecodable: [], derivedResidueDeclined: [] };
     const { partitionSealedCekKeys, shouldSkipBlobScan, bumpResidueCount, residueNoticesFromMap } = await import("./purge-scope-FGNNLWHD.js");
     const scopedPurge = this.forgetStrategy.scopedPurge === true;
     const sealedCekScopedSkipped = /* @__PURE__ */ new Map();
@@ -9437,6 +9648,13 @@ var Vault = class {
       } catch {
         sealedCekResidue.push(`${ref2.collection}:${ref2.id}`);
       }
+      if (blobsEnabled && !shouldSkipBlobScan(scopedPurge, this.blobFieldsRegistry.has(ref2.collection))) {
+        try {
+          await coll.blob(ref2.id).mintShredIntent(live?._tier ?? 0);
+        } catch {
+          blobResidueCollections.add(ref2.collection);
+        }
+      }
       let shred;
       try {
         shred = await coll._writeTombstone(ref2.id, actor);
@@ -9461,6 +9679,11 @@ var Vault = class {
         actor,
         this.encrypted
       );
+      try {
+        ledgerDeltasPurged += await ledger.purgeRecordDeltas(ref2.collection, ref2.id);
+      } catch {
+        ledgerDeltaResidue.push(`${ref2.collection}:${ref2.id}`);
+      }
       const idxPurge = await coll._purgePersistedIndexes(ref2.id);
       indexPostingsPurged += idxPurge.purged;
       for (const field of idxPurge.residue) indexResidue.push(`${ref2.collection}:${ref2.id}:${field}`);
@@ -9472,14 +9695,14 @@ var Vault = class {
       if (blobsEnabled && shouldSkipBlobScan(scopedPurge, this.blobFieldsRegistry.has(ref2.collection))) {
         bumpResidueCount(blobScopedSkipped, ref2.collection, 1);
       } else if (blobsEnabled) {
-        const r = await this.collection(ref2.collection).blob(ref2.id).shredAllForRecord();
+        const r = await this.collection(ref2.collection).blob(ref2.id).shredAllForRecord(live?._tier ?? 0);
         blobsShredded += r.shredded.length;
         blobsRetainedShared += r.retainedShared.length;
         if (r.residue.length > 0) blobResidueCollections.add(ref2.collection);
       } else {
         try {
-          const slotIds = await this.adapter.list(this.name, `_blob_slots_${ref2.collection}`);
-          if (slotIds.includes(ref2.id)) blobResidueCollections.add(ref2.collection);
+          const [slotIds, verKeys] = await Promise.all([this.adapter.list(this.name, `_blob_slots_${ref2.collection}`), this.adapter.list(this.name, `_blob_versions_${ref2.collection}`)]);
+          if (slotIds.includes(ref2.id) || verKeys.some((k) => k.startsWith(`${ref2.id}::`))) blobResidueCollections.add(ref2.collection);
         } catch {
         }
       }
@@ -9493,12 +9716,6 @@ var Vault = class {
       }
     }
     const subjectHash = await sha256Hex(subjectId);
-    const ledger = this.getLedgerOrNull();
-    if (!ledger) {
-      throw new Error(
-        'vault.forget() requires the history strategy for the erasure-proof ledger entry. Pass `historyStrategy: withHistory()` from "@noy-db/hub/history" to createNoydb().'
-      );
-    }
     const ledgerEntry = await ledger.append({
       op: "forget",
       collection: "",
@@ -9519,7 +9736,9 @@ var Vault = class {
         sealedFieldsShredded,
         sealedCekEnvelopesPurged,
         sealedCekResidueCount: sealedCekResidue.length,
-        sealedResidueCount: sealedResidue.length
+        sealedResidueCount: sealedResidue.length,
+        ledgerDeltasPurged,
+        ledgerDeltaResidueCount: ledgerDeltaResidue.length
       })
     });
     const scopedPurgeResidue = [...residueNoticesFromMap(sealedCekScopedSkipped, "skipped-undeclared-sealed-cek"), ...residueNoticesFromMap(blobScopedSkipped, "skipped-undeclared-blob-scan")];
@@ -9545,8 +9764,13 @@ var Vault = class {
       lookupReferencesCascaded: fanoutStats.lookupReferencesCascaded,
       lookupReferencesNullified: fanoutStats.lookupReferencesNullified,
       lookupReferencesResidue: fanoutStats.lookupReferencesResidue,
-      scopedPurgeResidue
-      // #650 Task 5 (+ review Important fix: residue) + #633
+      scopedPurgeResidue,
+      ledgerDeltasPurged,
+      ledgerDeltaResidue,
+      // #650 Task 5 (+ review Important fix: residue) + #633 + #734
+      derivedResidueUndecodable: fanoutStats.derivedResidueUndecodable,
+      derivedResidueDeclined: fanoutStats.derivedResidueDeclined
+      // #776/#785
     };
   }
   // ─── Record-scoped CEK sealing ─────────────────────────────────────
@@ -9669,7 +9893,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-NVWEQ2GU.js"),
+      import("./registry-EPKPD5SM.js"),
       import("./read-only-facade-CHCKSEPD.js")
     ]);
     const registry = new DerivationRegistry();
@@ -9701,7 +9925,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-SEKL74ET.js");
+    const { MaterializedViewRegistry } = await import("./registry-7MLVD3VO.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -9726,7 +9950,7 @@ var Vault = class {
    */
   async _initOverlayedViews(handles) {
     if (handles.length === 0) return;
-    const { OverlayedViewRegistry } = await import("./registry-DZ2T4LL7.js");
+    const { OverlayedViewRegistry } = await import("./registry-P5T7PS2U.js");
     const registry = new OverlayedViewRegistry();
     const mvRegistry = this.materializedViewRegistry;
     const overlayNames = /* @__PURE__ */ new Set();
@@ -9761,27 +9985,27 @@ var Vault = class {
   /**
    * Manual re-materialize for a single registered MV (`refresh: 'manual'` consumers,
    * stale-bit recovery on vault reopen, bulk-recompute escape hatch after a strategy
-   * change). Returns `{ written, deleted, failed }` (`deleted` always 0 without
-   * tombstoning). Throws if `name` is not a registered MV.
+   * change). Returns `{ written, deleted, failed, residueUndecodable, residueDeclined }` (`deleted`
+   * always 0 without tombstoning; #785 splits the #782 leftovers — undecodable vs #718-declined). Throws if not registered.
    */
   async refreshView(name) {
     const registry = this.materializedViewRegistry;
     if (registry === null) {
-      return { written: 0, deleted: 0, failed: 0 };
+      return { written: 0, deleted: 0, failed: 0, residueUndecodable: [], residueDeclined: [] };
     }
     const reg = registry.byName(name);
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-6OCCE5VM.js");
+    const { MaterializedViewExecutor } = await import("./executor-UNEH5ZYH.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this,
       dispatchCtx: this._dispatchCtx({ collection: name, id: "refreshView" })
     });
-    const { clearMVStale } = await import("./stale-TJXFQKOJ.js");
-    clearMVStale(registry, name);
+    const { clearMVStaleFully } = await import("./stale-OSQ7J3AA.js");
+    await clearMVStaleFully(this.adapter, this.name, registry, name);
     return result;
   }
   /**
@@ -9793,7 +10017,7 @@ var Vault = class {
     if (registry === null) return { derived: 0, failed: 0, skippedFrozen: 0 };
     const strategies = registry.strategiesForSource(sourceCollection);
     if (strategies.length === 0) return { derived: 0, failed: 0, skippedFrozen: 0 };
-    const { DerivationExecutor } = await import("./executor-JFVAJY42.js");
+    const { DerivationExecutor } = await import("./executor-OVEXR6RT.js");
     const sourceColl = this.collection(sourceCollection);
     const records = await sourceColl.list();
     const ctx = { vault: this.derivationFacade ?? new (await import("./read-only-facade-CHCKSEPD.js")).ReadOnlyVaultFacade(this, "derivation") };
@@ -9820,7 +10044,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-IO2KDUWV.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-A765THMX.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key, this.getDEK, this.encrypted);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -10047,7 +10271,7 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-YVSHMIZZ.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-W7ZV2322.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
         "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (passphrase) first."
@@ -10069,7 +10293,7 @@ var Vault = class {
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-YVSHMIZZ.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-W7ZV2322.js");
     await revokeDelegation(this.adapter, this.name, id);
     void DELEGATIONS_COLLECTION;
   }
@@ -10154,11 +10378,11 @@ var Vault = class {
    * Internal — invoked by an `ElevatedHandle.collection().put()` call.
    * Routes through the existing `Collection.putAtTier` code path with
    * the elevation context attached so the cross-tier event reflects
-   * the right authorization class.
+   * the right authorization class. Returns `putAtTier`'s `TierMoveResult` (#779).
    */
   async _elevatedPut(collectionName, id, record, tier, reason) {
     const coll = this.collection(collectionName);
-    await coll.putAtTier(id, record, tier, {
+    return coll.putAtTier(id, record, tier, {
       elevation: { reason, fromTier: 0 }
     });
   }
@@ -10317,7 +10541,7 @@ var Vault = class {
    * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
    */
   async dumpSchema(opts = {}) {
-    const { dumpVaultSchema } = await import("./walk-XQCBKSBW.js");
+    const { dumpVaultSchema } = await import("./walk-SVNDIZ62.js");
     return dumpVaultSchema(this, opts);
   }
   /**
@@ -10452,7 +10676,7 @@ var Vault = class {
    * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md
    */
   async getPublicEnvelope(opts = {}) {
-    const { readPublicEnvelope } = await import("./public-envelope-GOG4LUM7.js");
+    const { readPublicEnvelope } = await import("./public-envelope-B4KNWVUA.js");
     return readPublicEnvelope(this.adapter, this.name, opts);
   }
   /**
@@ -10467,7 +10691,7 @@ var Vault = class {
    * both modes round-trip cleanly.
    */
   async dump() {
-    const { dumpVault } = await import("./backup-2WVBIVXW.js");
+    const { dumpVault } = await import("./backup-BJ57IKAO.js");
     return dumpVault(this.backupContext());
   }
   /**
@@ -10519,7 +10743,7 @@ var Vault = class {
    * — there's no chain to verify against.
    */
   async load(backupJson) {
-    const { loadVault } = await import("./backup-2WVBIVXW.js");
+    const { loadVault } = await import("./backup-BJ57IKAO.js");
     return loadVault(this.backupContext(), backupJson);
   }
   /**
@@ -10551,7 +10775,7 @@ var Vault = class {
    * way to detect tampering of an in-place vault.
    */
   async verifyBackupIntegrity() {
-    const { verifyBackupIntegrity } = await import("./backup-2WVBIVXW.js");
+    const { verifyBackupIntegrity } = await import("./backup-BJ57IKAO.js");
     return verifyBackupIntegrity(this.backupContext());
   }
   /**
@@ -10769,7 +10993,7 @@ var Vault = class {
    * is the live validator object, not a serialization of it).
    */
   async exportJSON(opts = {}) {
-    const { exportVaultJSON } = await import("./backup-2WVBIVXW.js");
+    const { exportVaultJSON } = await import("./backup-BJ57IKAO.js");
     return exportVaultJSON(this.backupContext(), opts);
   }
 };
@@ -12640,7 +12864,7 @@ var Noydb = class {
       if (!facade) return;
       const ctx = { existing, vault: facade, userId: e.userId, role: e.role };
       await registry.runChecks(e.collection, incoming, ctx);
-      const { GuardExecutor } = await import("./executor-UPSH5O3F.js");
+      const { GuardExecutor } = await import("./executor-KGWTNEQD.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, e.docId, existing, incoming, e.computedFieldNames);
       }
@@ -13919,7 +14143,7 @@ var Noydb = class {
         "setPublicEnvelope: the public-envelope feature is not enabled. Pass `publicEnvelope: true` (or a schema object) to `createNoydb`."
       );
     }
-    const { loadPublicEnvelope, savePublicEnvelope, resolveSchema, validatePublicEnvelopeInput } = await import("./public-envelope-GOG4LUM7.js");
+    const { loadPublicEnvelope, savePublicEnvelope, resolveSchema, validatePublicEnvelopeInput } = await import("./public-envelope-B4KNWVUA.js");
     const schema = resolveSchema(this.options.publicEnvelope);
     validatePublicEnvelopeInput(input, schema);
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -13948,7 +14172,7 @@ var Noydb = class {
    * regardless).
    */
   async getPublicEnvelope(vault, opts = {}) {
-    const { readPublicEnvelope } = await import("./public-envelope-GOG4LUM7.js");
+    const { readPublicEnvelope } = await import("./public-envelope-B4KNWVUA.js");
     return readPublicEnvelope(this.options.store, vault, opts);
   }
   // ─── Auth introspection ─────────────────────────────────────────
@@ -14139,9 +14363,9 @@ async function createNoydb(options) {
     throw new ValidationError("A secret (passphrase) or getKeyring callback is required when encryption is enabled");
   }
   if (!options.coordinationStrategy) options = { ...options, coordinationStrategy: await createDefaultCoordinationProvider(options.store) };
-  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-3TH2GOFQ.js")).createUserApi };
+  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-ZGS6LCOF.js")).createUserApi };
   if (!options.policyFactory) {
-    const policyModule = await import("./policy-5POYLI26.js");
+    const policyModule = await import("./policy-Z3RUAIY2.js");
     options = { ...options, policyFactory: policyModule.createNoydbPolicy, policyCheckGateFn: policyModule.checkGate };
   }
   return new Noydb(options);
@@ -14178,4 +14402,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-YCXKFB7J.js.map
+//# sourceMappingURL=chunk-X7QBD67R.js.map