@noy-db/hub 0.3.0-pre.12 → 0.3.0-pre.13

package/dist/indexing/index.js

@@ -7,12 +7,12 @@ import {
   decodeIdxId,
   encodeIdxId,
   isIdxId
-} from "../chunk-6S7ENMRE.js";
+} from "../chunk-M4CV6BRT.js";
 import {
   CollectionIndexes
 } from "../chunk-KPZS5QAQ.js";
 import "../chunk-IGJCYUT5.js";
-import "../chunk-FZCGIJEJ.js";
+import "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-lookup/indexing/active.ts

package/dist/issue-5OKB6I2R.js

@@ -0,0 +1,19 @@
+import {
+  issueAttestationCore
+} from "./chunk-GTGPO5KW.js";
+import "./chunk-EXK7QRWF.js";
+import "./chunk-ZJADGNYF.js";
+import "./chunk-XDYREZWE.js";
+import "./chunk-7DSTRQIJ.js";
+import "./chunk-HB3RFQSC.js";
+import "./chunk-JKJOGPZN.js";
+import "./chunk-5M5DVGV7.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-CIE2BASH.js";
+import "./chunk-JNAI2HN2.js";
+import "./chunk-BIOUI4HL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  issueAttestationCore
+};
+//# sourceMappingURL=issue-5OKB6I2R.js.map

package/dist/kernel/collection-config.d.ts

@@ -122,6 +122,16 @@ export interface CollectionOpts<T> {
     blobStrategy?: BlobStrategy | undefined;
     objectStore?: ObjectProjection | undefined;
     blobFields?: BlobFieldsConfig | undefined;
+    /**
+     * #724 Arc 10 Task 3: how `elevate()`/`demote()`/`putAtTier()` rehome a
+     * SHARED blob (`refCount > 1`) it can't rewrap in place. `'isolate'`
+     * (default) forks a private tier-scoped copy for the moving record and
+     * releases its hold on the shared object — co-owners stay byte-for-byte
+     * untouched. `'dedup'` (#741, opt-in) leaves the shared object in place;
+     * the Task-1 runtime read gate still hides it, but the chunks stay
+     * decryptable at rest under the flat `_blob` DEK (documented residue).
+     */
+    blobTierPolicy?: 'isolate' | 'dedup' | undefined;
     aggregateStrategy?: AggregateStrategy | undefined;
     crdtStrategy?: CrdtStrategy | undefined;
     /**
@@ -256,6 +266,14 @@ export interface CollectionOpts<T> {
      * classified refusal matrix (R4: a digest-only field cannot be the subject key).
      */
     subjectKeyField?: string | undefined;
+    /**
+     * Register a record's forget-subject ref directly (bypassing the write-hook
+     * pipeline), wired by the Vault when this collection declares a forget-
+     * subject field. Consumed by `putAtTier` (#766, via `TiersContext.addSubjectRef`)
+     * so a record whose first write is a tier write still enters `_subject_index`.
+     * `undefined` when no forget strategy declares this collection (no-op).
+     */
+    addSubjectRef?: ((id: string, record: unknown) => Promise<void>) | undefined;
     /** — tree-shake seam for `collection.reveal()`. Defaults to `NO_CLASSIFIED`. */
     classifiedStrategy?: ClassifiedStrategy | undefined;
     /**
@@ -779,7 +797,9 @@ export declare function resolveCollectionConfig<T>(opts: CollectionOpts<T>): {
     tiersStrategy: TiersStrategy;
     searchStrategy: SearchStrategy;
     tierMode: TierMode;
+    blobTierPolicy: "isolate" | "dedup";
     onCrossTierAccess: ((event: CrossTierAccessEvent) => void) | undefined;
+    addSubjectRef: ((id: string, record: unknown) => Promise<void>) | undefined;
     deterministicFields: ReadonlySet<string> | null;
     sensitiveFields: ReadonlySet<string>;
     vdigFields: ReadonlyMap<string, VdigFieldPolicy> | null;

package/dist/kernel/collection.d.ts

@@ -11,6 +11,7 @@ import type { MutationOrigin } from './mutation.js';
 import { type WaveContext, type RollupOutcome, type RollupDeleteIntent } from './via/dispatch.js';
 import type { ComputedFields } from '../with-formula/computed/index.js';
 import { type SealedShredSlot } from './enclave/index.js';
+import { type TierMoveResult } from '../with-audit/tiers/index.js';
 import type { GhostRecord } from './types.js';
 import type { StandardSchemaV1 } from './schema.js';
 import type { DiffEntry } from '../with-commit/history/diff.js';
@@ -106,6 +107,7 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
     private readonly blobStrategy;
     private readonly objectStore;
     private readonly blobFields;
+    private readonly blobTierPolicy;
     private readonly aggregateStrategy;
     private readonly crdtStrategy;
     private readonly tiersStrategy;
@@ -335,11 +337,9 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
     private readonly tiers;
     private readonly tierMode;
     private readonly onCrossTierAccess;
+    private readonly addSubjectRef;
     /**
-     * Optional reference to the vault-level hash-chained audit
-     * log. When present, every successful `put()` and `delete()` appends
-     * an entry to the ledger AFTER the adapter write succeeds (so a
-     * failed adapter write never produces an orphan ledger entry).
+     * Optional reference to the vault-level hash-chained audit log. When present, every successful `put()` and `delete()` appends an entry to the ledger AFTER the adapter write succeeds (so a failed adapter write never produces an orphan ledger entry).
      *
      * The ledger is always a vault-wide singleton — all
      * collections in the same vault share the same LedgerStore.
@@ -750,10 +750,7 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
      */
     delete(id: string): Promise<void>;
     /**
-     * @internal — bulk-rewrite every record through a cutover transform.
-     * Raw adapter path (bypasses the write gate + guards — the transform is
-     * trusted and runs only during the `migrating` phase). Bumps each
-     * record's `_v` and appends a ledger `op:'migration'` entry.
+     * @internal — bulk-rewrite every record through a cutover transform. Raw adapter path (bypasses the write gate + guards — the transform is trusted and runs only during the `migrating` phase). Bumps each record's `_v` and appends a ledger `op:'migration'` entry. #708: refuses BEFORE any rewrite if a live record is elevated (assertCutoverTierSafe) — demote it first.
      */
     _applyCutoverTransform(transform: (doc: Record<string, unknown>) => Record<string, unknown>): Promise<number>;
     /** @internal Untracked delete body — call {@link delete}, not this. */
@@ -841,11 +838,17 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
     /**
      * Mirror of {@link dispatchMaterializedViews} for the delete/forget path — no `_materializedFrom`
      * skip (record's gone); the `internal` gate at `_doDelete` is the recursion guard. Returns the
-     * row count TOMBSTONED across every eager MV sourced here (#638 T6 — `forgetDerivedFanout`'s
-     * `derivedRecordsErased`); a lazy MV only flips its stale bit (0 contribution — resolved on read).
+     * row count TOMBSTONED across EVERY MV sourced here (#638 T6 — `forgetDerivedFanout`'s
+     * `derivedRecordsErased`) — eager AND lazy/manual `invalidateMVAtRest` purges both contribute now
+     * (#761 item 1, previously eager-only); lazy persists a stale mark for cold-session recompute;
+     * manual serves empty until `refreshView()`. `residueUndecodable`/`residueDeclined` (#776/#785) carry `outputCollection:id` entries whose ownership stamp `invalidateMVAtRest` could not decode, resp. decoded+stamp-matched but declined erasure — surfaced, not erased.
      * @internal
      */
-    dispatchMaterializedViewsOnDelete(id: string): Promise<number>;
+    dispatchMaterializedViewsOnDelete(id: string): Promise<{
+        deleted: number;
+        residueUndecodable: string[];
+        residueDeclined: string[];
+    }>;
     /**
      * List all records in the collection.
      *
@@ -882,6 +885,11 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
         minScore?: number;
         includeRecord?: boolean;
     }): Promise<RetrieveHit<T>[]>;
+    /** Opt-in bulk `_vec` re-derive (#788) — a plain collection has nothing to rebuild; gated behind `searchStrategy: withSearch()` otherwise. */
+    rebuildEmbeddings(): Promise<{
+        rebuilt: number;
+        skipped: number;
+    }>;
     /**
      * Bind the {@link SearchContext} the search/retrieval surface needs. The
      * `cache` is the SAME `Map` reference the eager read/write path owns (passed
@@ -1064,9 +1072,9 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
     /**
      * Count records in the collection.
      *
-     * In eager mode this returns the in-memory cache size (instant). In
-     * lazy mode it asks the adapter via `list()` to enumerate ids — slower
-     * but still correct, and avoids loading any record bodies into memory.
+     * In eager mode this returns the in-memory cache size (instant). In lazy
+     * mode it counts only LIVE tier-0 envelopes via envelope inspection — no
+     * record bodies loaded — matching eager's tombstone/tier exclusion (#706).
      */
     count(): Promise<number>;
     /**
@@ -1453,7 +1461,7 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
     queryByDet(field: string, value: unknown): Promise<T[]>;
     /** Bind the {@link DeterministicContext} this collection's det lookups need. */
     private detContext;
-    /** tier-aware put — gated behind `tiersStrategy: withTiers()`. */
+    /** tier-aware put — gated behind `tiersStrategy: withTiers()`. `searchResidue: true` = stuck search compensation (#774, mirroring #764's elevate/demote posture); the write itself always completes. */
     putAtTier(id: string, record: T, tier: number, opts?: {
         elevation?: {
             reason: string;
@@ -1461,7 +1469,7 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
         };
         source?: string;
         sourceTs?: string;
-    }): Promise<void>;
+    }): Promise<TierMoveResult>;
     /** tier-aware get — gated behind `tiersStrategy: withTiers()`. */
     getAtTier(id: string): Promise<T | GhostRecord | null>;
     /** list ids grouped by the caller's readability — gated behind `withTiers()`. */
@@ -1470,14 +1478,12 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
         tier: number;
         readable: boolean;
     }>>;
-    /** elevate a record to a higher tier — gated behind `withTiers()`. */
-    elevate(id: string, toTier: number): Promise<void>;
-    /** demote a record to a lower tier — gated behind `withTiers()`. */
-    demote(id: string, toTier: number): Promise<void>;
+    /** elevate a record to a higher tier — gated behind `withTiers()`. `searchResidue: true` = stuck search compensation (#764); the move itself always completes. */
+    elevate(id: string, toTier: number): Promise<TierMoveResult>;
+    /** demote a record to a lower tier — gated behind `withTiers()`. Same `searchResidue` posture as {@link elevate} (#764). */
+    demote(id: string, toTier: number): Promise<TierMoveResult>;
     /**
-     * Emit a cross-tier access event. The subscriber sink stays collection-
-     * resident (it captures `onCrossTierAccess`); the tiers module reaches it
-     * via the {@link TiersContext.emitCrossTierEvent} callback.
+     * Emit a cross-tier access event. The subscriber sink stays collection-resident (it captures `onCrossTierAccess`); the tiers module reaches it via the {@link TiersContext.emitCrossTierEvent} callback.
      */
     private emitCrossTierEvent;
     /**
@@ -1503,17 +1509,14 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
         presentForJoin?: (record: unknown, locale: string) => unknown;
     }): void;
     /**
-     * Bind the {@link TiersContext} the tier ops need. The `cekCache` is passed
-     * by reference (the SAME `Lru` the kernel's read/write path owns) so an
-     * elevate/demote CEK re-wrap stays synchronous with cache eviction.
+     * Bind the {@link TiersContext} the tier ops need — `cekCache` by reference (same `Lru` the read/write path owns) for a synchronous re-wrap; `syncDerived` closes over `this` for {@link syncDerivedOutputs} (#722).
      */
     private tiersContext;
     /**
      * Bind the {@link IndexingContext} the index-maintenance surface needs. The
      * eager `cache` Map and the index / unique-constraint / persisted mirrors are
      * passed by reference (the SAME instances the query path reads, never
-     * copied); the `persistedIndexesLoaded` flag and `ensure*` hydration stay
-     * collection-resident, reached via callbacks.
+     * copied); the `persistedIndexesLoaded` flag and `ensure*` hydration stay collection-resident, reached via callbacks.
      */
     private indexingContext;
 }

package/dist/kernel/enclave/classify/verify.d.ts

@@ -7,6 +7,9 @@
  * text door (verifyTextField) has no real PBKDF2 of its own, so it pays the
  * pad UNCONDITIONALLY — every outcome, including a real compare, costs the
  * same one PBKDF2 unit (no inverted exists-vs-absent oracle).
+ * Elevated records (_tier > 0, with-audit tier moves) are non-comparable
+ * through every door and pad-false exactly like missing records (#691) —
+ * the tier-aware read surface is getAtTier, never verify.
  * Throws are reserved for caller/config bugs (ClassifiedVerifyError /
  * ClassifiedConfigError) and are exempt from the pad by design (R6 note).
  * @module

package/dist/kernel/enclave/index.d.ts

@@ -58,7 +58,8 @@ export type { EnclaveKey } from './crypto.js';
 export { encrypt, decrypt, encryptBytes, decryptBytes, encryptBytesWithAAD, decryptBytesWithAAD, encryptDeterministic, decryptDeterministic, sha256Hex, hmacSha256Hex, } from './crypto.js';
 export { deriveKey, derivePassphraseKey, generateDEK, generateSalt, generateIV, wrapKey, unwrapKey, bufferToBase64, base64ToBuffer, derivePresenceKey, deriveDeterministicKey, deriveSealedFieldKey, deriveSealedFieldKeyFromCek, wrapCek, unwrapCek, importCek, } from './crypto.js';
 export type { PassphraseKeyUsage } from './crypto.js';
-export { resolveStableCek, rewrapBodyToDek } from './record-keys/lifecycle.js';
+export { resolveStableCek, rewrapBodyToDek, rewrapEnvelope, applyRewrappedBody, isRewrappedUnder } from './record-keys/lifecycle.js';
+export type { RewrappedBody } from './record-keys/lifecycle.js';
 export { RecordCodec } from './record-keys/record-codec.js';
 export type { SealedShredSlot } from './record-keys/record-codec.js';
 export { SEALED_CEK_NS, sealRecordToHost, revokeSealedRecord, rotateRecordCek } from './record-keys/sealing.js';

package/dist/kernel/enclave/record-keys/deterministic.d.ts

@@ -12,6 +12,7 @@
  * Both functions take a small {@link DeterministicContext} (the exact `this.*`
  * the moving methods touched) instead of `this`, mirroring the `record-keys/`
  * siblings. Behaviour is byte-identical to the inline code they replaced.
+ * Elevated records (_tier > 0) are skipped: invisible to tier-0 scans (#691).
  *
  * Internal service — not exported as a `@noy-db/hub/*` subpath.
  */

package/dist/kernel/enclave/record-keys/lifecycle.d.ts

@@ -55,3 +55,53 @@ export interface RewrappedBody {
  *   directly — byte-for-byte the pre-CEK behaviour.
  */
 export declare function rewrapBodyToDek(envelope: Pick<EncryptedEnvelope, '_iv' | '_data' | '_cek'>, fromDek: EnclaveKey, toDek: EnclaveKey): Promise<RewrappedBody>;
+/**
+ * Merge an ALREADY-rewrapped {@link RewrappedBody} into `envelope`, keeping
+ * every field but the re-keyed body (`_iv`/`_data`/`_cek`) unchanged.
+ *
+ * Body-field access (`_iv`/`_data`/`_cek`) is sanctioned inside the enclave;
+ * this lets callers outside it get back a ready-to-store envelope without
+ * reading those fields themselves. Takes a body the caller has ALREADY
+ * computed (vs. {@link rewrapEnvelope}, which also runs `rewrapBodyToDek`)
+ * so a caller building a SECOND envelope from the same rewrap — a tier
+ * move's live write AND its pre-move `_history` snapshot, #728 — pays the
+ * unwrap/decrypt/encrypt/wrap crypto once, not twice.
+ */
+export declare function applyRewrappedBody(envelope: EncryptedEnvelope, body: RewrappedBody): EncryptedEnvelope;
+/**
+ * Move a FULL stored envelope from `fromDek` to `toDek`, preserving every
+ * field other than the re-keyed body (`_iv`/`_data`/`_cek`) unchanged.
+ * Mirrors the spread-merge idiom `with-audit/tiers/index.ts`'s
+ * `elevate()`/`demote()` use to apply `rewrapBodyToDek`'s result to the live
+ * envelope, generalized to any envelope shape (history callers don't bump
+ * `_v`/`_ts`/`_tier` the way a tier move does).
+ */
+export declare function rewrapEnvelope(envelope: EncryptedEnvelope, fromDek: EnclaveKey, toDek: EnclaveKey): Promise<EncryptedEnvelope>;
+/**
+ * Is `envelope` ALREADY wrapped under `dek` (a per-record CEK wrapped under
+ * `dek`, or — legacy, no `_cek` — the body itself decryptable under `dek`)?
+ *
+ * A toDek-first idempotency check for retry-safe rewrap loops (#712 crash
+ * atomicity, `with-commit/history/history.ts`'s `rewrapHistory`): a crash
+ * mid-rewrap can strand some entries already moved to `toDek` while others
+ * remain under `fromDek`. Calling this with `toDek` before attempting the
+ * `fromDek` rewrap lets the caller skip an already-migrated entry instead of
+ * re-wrapping it (a re-wrap would be a correctness no-op but doubles as an
+ * unnecessary write) — and, more importantly, tells a retry loop that this
+ * entry needs no `fromDek` unwrap attempt at all, so a crash that landed some
+ * entries under `toDek` doesn't wedge on those already-moved entries.
+ *
+ * AES-KW (CEK unwrap) and AES-GCM (direct decrypt) are both authenticated —
+ * unwrap/decrypt under the wrong key throws, never silently returns garbage
+ * — so a caught error here reliably means "not wrapped under `dek`", not a
+ * corrupt envelope (a genuinely corrupt envelope also throws under the
+ * correct key, but callers that reach this helper only do so as a
+ * best-effort probe before their own decisive fromDek attempt, which still
+ * surfaces real corruption).
+ *
+ * Body-field access (`_iv`/`_data`/`_cek`) is sanctioned inside the enclave —
+ * this is the sanctioned door so callers outside it (history.ts) never read
+ * those fields themselves, preserving the check-architecture body-access
+ * ratchet.
+ */
+export declare function isRewrappedUnder(envelope: Pick<EncryptedEnvelope, '_iv' | '_data' | '_cek'>, dek: EnclaveKey): Promise<boolean>;

package/dist/kernel/enclave/record-keys/record-codec.d.ts

@@ -278,6 +278,33 @@ export declare class RecordCodec<T> {
         id?: string;
         sealedAsHandles?: boolean;
     }): Promise<T>;
+    /**
+     * Decrypt an envelope under an EXPLICIT `dek` instead of this codec's own
+     * `ctx.getDEK()` / cekCache resolution — for a from-tier>0 pre-move decode
+     * (`with-audit/tiers/index.ts`'s `putAtTier`/`elevate`/`demote` sites,
+     * #722 whole-branch review). Mirrors the manual unwrap-then-decrypt
+     * `getAtTier`'s own tier>0 leg performs there (same primitives, same
+     * `applySealedSlots` extraction point #635 built for exactly this caller).
+     *
+     * `decryptRecord` is tier-UNAWARE: `resolveEnvelopeCek` reads the cekCache
+     * or falls back to `ctx.getDEK()` — this codec's DEFAULT (tier-0/
+     * collection) DEK — never the envelope's OWN tier. That only happens to
+     * decrypt a from-tier>0 envelope correctly when some other call in the
+     * SAME op already primed the cekCache with this record's CEK (true for an
+     * ordinary put()-then-elevate(0→1); NOT true for a `putAtTier`-origin
+     * envelope, whose body is encrypted directly under its tier DEK with no
+     * `_cek` ever minted, or a non-`perRecordKeys` collection, which has no
+     * `_cek` at all) — those throw `TamperedError`. Decrypting under the
+     * caller-resolved `dek` is correct regardless of cache state or
+     * `perRecordKeys`.
+     *
+     * No CRDT resolution, no schema validation — same scope as `getAtTier`'s
+     * tier>0 branch (the established precedent for a tier-aware read), which
+     * skips both for the same reason: a tier>0 read is an internal/derived-
+     * output-recompute path, not the public per-record read surface schema
+     * validation guards.
+     */
+    decryptRecordAtDek(envelope: EncryptedEnvelope, dek: EnclaveKey, id?: string): Promise<T | null>;
     /**
      * Decrypt an envelope into a record of type `T`.
      *

package/dist/kernel/errors.d.ts

@@ -490,6 +490,62 @@ export declare class TierNotGrantedError extends NoydbError {
     readonly collection: string;
     constructor(collection: string, tier: number);
 }
+/**
+ * Thrown when a tier-0 `put()` or `delete()` targets a record whose LIVE
+ * envelope is elevated (`_tier > 0`) — regardless of whether the caller
+ * holds the tier's DEK. `put()`/`delete()` are the tier-0 write APIs;
+ * the sanctioned way to write an elevated record is `putAtTier()`,
+ * `elevate()`, or `demote()`.
+ *
+ * Distinct from `TierNotGrantedError`, which means "no DEK for tier N"
+ * and refuses only non-holders. This error refuses HOLDERS too — the
+ * problem isn't clearance, it's that `put()`/`delete()` are the wrong
+ * API for an already-elevated record (a tier-0 `put()` over one would
+ * otherwise silently demote it; a tier-0 `delete()` would write a
+ * marker with no `_tier`, erasing the elevation signal). It is also
+ * distinct from the read-path invisibility gate (`liveRecordIsElevated`
+ * in `tier-visibility.ts`), which throws nothing — elevated records
+ * simply read as absent there. This is a write-path refusal, not a
+ * read-path ghost.
+ *
+ * #708: also raised by the coordinated-cutover pre-check
+ * (`assertCutoverTierSafe`) — a bulk-rewrite is a third tier-0 write path,
+ * so it gets the same refusal with a `detail` override naming the record.
+ */
+export declare class TierWriteRefusedError extends NoydbError {
+    readonly tier: number;
+    readonly collection: string;
+    constructor(collection: string, tier: number, detail?: string);
+}
+/**
+ * Thrown at `vault.collection()` registration when `tiers` is declared
+ * together with a derived-artifact feature whose crypto has not yet been
+ * made tier-aware (elevate()/demote() do not re-key it), so an elevated
+ * record's data would stay readable at tier 0. Mirrors
+ * `UnsupportedIndexOptionError` — the refusal happens loudly at
+ * registration instead of leaking silently at rest.
+ *
+ * `feature` names the incompatible feature (e.g. `'blobs'`) so catch
+ * blocks can pattern-match without inspecting the error message.
+ */
+export declare class UnsupportedTierCompositionError extends NoydbError {
+    readonly feature: string;
+    constructor(feature: string, message: string);
+}
+/**
+ * Thrown by `createIntent` (blob durability journal, #753 spec §7 C8) when a
+ * `_blob_intent` marker already exists for `{collection}::{recordId}` — the
+ * CAS create-if-absent (`expectedVersion: 0`) lost to a present row. A
+ * present marker means a shred or rehome is already in flight for this
+ * record and MUST be resumed before any new intent is minted (overwriting it
+ * would orphan the prior op's op-stamps — spec C8). Callers catch this and
+ * resume the pending marker first, then retry.
+ */
+export declare class BlobIntentPendingError extends NoydbError {
+    readonly collection: string;
+    readonly recordId: string;
+    constructor(collection: string, recordId: string);
+}
 /**
  * Thrown when an elevated-handle operation runs after the elevation's
  * TTL expired. Reads continue at the original tier; only writes
@@ -816,6 +872,24 @@ export declare class IndexWriteFailureError extends NoydbError {
         cause: unknown;
     });
 }
+/**
+ * Thrown when `PersistedIndexStore`'s compensating `remove()` — the undo of a
+ * stale debounced `_ftindex` save that raced a purge (#725) — itself fails.
+ * That failure is sticky (`pendingCompensation`) and retried-first by every
+ * subsequent store entrypoint (`ensureBuilt`/`rebuildAndPersist`/
+ * `removePersisted`) rather than silently dropped, but was previously
+ * rethrown as the RAW adapter error indefinitely — indistinguishable from
+ * any other adapter failure, so a caller could not catch it deliberately the
+ * way `forget()` catches `_purgeSearchIndex` into `indexResidue` (#764).
+ *
+ * `cause` is the underlying adapter error. Callers that want stuck-
+ * compensation resilience instead of an abort (e.g. `elevate()`/`demote()`,
+ * #764) catch this type specifically and surface it as residue.
+ */
+export declare class PersistedIndexCompensationError extends NoydbError {
+    readonly cause: unknown;
+    constructor(cause: unknown);
+}
 /**
  * Thrown by `.where()` / `.orderBy()` / `.aggregate()` (via the Via
  * pipeline's `postureFor`/`wrapReducers`) when the field is covered by a Via

package/dist/kernel/lazy-count.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Lazy-mode `count()` support (#706): count ids whose envelope is LIVE at
+ * tier 0 — parity with eager count (the hydrated cache excludes tombstones,
+ * delete markers, and elevated records, #701). Envelope inspection only —
+ * no record body is ever decrypted here.
+ *
+ * #713: when the adapter implements the optional `listPage`, page through
+ * it and apply the same predicate to each page's envelopes — one
+ * round-trip per page instead of one `list()` + one `get()` per id. Stores
+ * without `listPage` keep the original N+1 loop.
+ */
+import type { NoydbStore } from './types.js';
+export declare function countLiveEnvelopes(adapter: NoydbStore, vault: string, name: string, storeCiphertext: boolean): Promise<number>;

package/dist/kernel/tier-visibility.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Tier visibility helper (#712/#707): a tier-0 code path treats an elevated
+ * (_tier > 0) record as invisible. History reads gate on the LIVE record's
+ * tier — history snapshots keep their tier-0-wrapped CEKs and carry no _tier
+ * of their own, so an elevated record's prior versions would otherwise stay
+ * tier-0-decryptable (the read-gate closes the API surface; #712's at-rest
+ * arc rewraps the snapshot keys). Envelope inspection only — no decryption.
+ *
+ * #715/#716: the write ring. Invisibility on the read side is exactly what
+ * makes a tier-0 write path treat an elevated record as absent — a put()
+ * believes it's a create (demotion) and a delete() writes a marker with no
+ * _tier (erasing the elevation signal). `assertTierWritable` closes that by
+ * refusing the write outright. Both helpers share a single envelope peek
+ * (`peekLiveTier`) — no duplicated `adapter.get` per write.
+ */
+import type { NoydbStore } from './types.js';
+export declare function liveRecordIsElevated(adapter: NoydbStore, vault: string, name: string, id: string): Promise<boolean>;
+/**
+ * The tier a record's LIVE envelope currently carries (0 if untiered or
+ * never moved). #724 Task 4: `BlobSet.loadSlots`/`saveSlots` use this to
+ * resolve the per-record slot map's collection DEK at the record's current
+ * tier by default, so the slot map's physical location follows the record
+ * after `rehomeForTier` re-keys it.
+ */
+export declare function liveRecordTier(adapter: NoydbStore, vault: string, name: string, id: string): Promise<number>;
+/**
+ * Refuses a tier-0 `put()`/`delete()` targeting an elevated record.
+ * No-op when `tiersEnabled` is false (the cost gate — collections that
+ * never declare tiers pay nothing). Throws `TierWriteRefusedError` with
+ * the record's ACTUAL live tier when elevated — holders included, since
+ * `put()`/`delete()` are the tier-0 APIs and `putAtTier`/`elevate`/`demote`
+ * are the sanctioned tier-aware paths.
+ */
+export declare function assertTierWritable(adapter: NoydbStore, vault: string, name: string, id: string, tiersEnabled: boolean): Promise<void>;
+/**
+ * #708: ALL-OR-NOTHING pre-check for a coordinated-cutover bulk-rewrite —
+ * scans every id's live tier BEFORE any record is transformed and refuses
+ * on the first elevated one found. `_applyCutoverTransform` re-encrypts at
+ * tier 0 with no gate of its own; without this, it would silently demote
+ * an elevated record. Same cost gate as `assertTierWritable` (no-op, no
+ * adapter call, when `tiersEnabled` is false).
+ *
+ * This pre-check guards against an ordinary `put()`/`delete()` racing the
+ * cutover, because those go through the schema fence (`SchemaFenceController`
+ * blocks concurrent writes during a coordinated cutover). It does NOT guard
+ * against `elevate()`/`demote()`/`putAtTier()` — those tier-move paths bypass
+ * the fence, so a tier move landing between this scan and the rewrite it
+ * gates is not excluded. Cutover callers are expected to hold the vault
+ * quiescent for tier moves on this collection for the duration of the call,
+ * the same tier-quiescence assumption the documented CAS-less caller
+ * (`with-shape/satellites/migrate-cek.ts`'s "No-quiesce precondition") makes
+ * explicit for concurrent writes generally.
+ */
+export declare function assertCutoverTierSafe(adapter: NoydbStore, vault: string, name: string, tiersEnabled: boolean): Promise<void>;

package/dist/kernel/types.d.ts

@@ -1854,6 +1854,65 @@ export interface BlobObject {
      * store (e.g. S3). Absent when no routing is configured.
      */
     readonly storeHint?: 'default' | 'blobs';
+    /**
+     * Bounded ring (K=8 — an AUDIT-VISIBLE concurrency bound, not an
+     * implementation detail) of the most recent op-stamp identities applied to
+     * this object's `refCount`. Appended in the SAME CAS write as the
+     * `refCount` change it stamps (`BlobSet`'s `casUpdateRefCountStamped`),
+     * never a separate write — no crash window between the two. Oldest entry
+     * is evicted once the ring exceeds K entries.
+     *
+     * The blob durability journal (#753, spec §7 C2/C4) uses membership here
+     * as its test-and-set: a stamped mutator re-reads this ring on every CAS
+     * attempt (including retries) BEFORE computing its delta — stamp already
+     * present → that mutation already landed → skip re-applying it. This is
+     * what makes a crash-resumed refCount decrement/increment exactly-once
+     * rather than at-least-once.
+     *
+     * Two acceptances, by design — SHRED only (see the #746 whole-branch
+     * review correction below for rehome):
+     *  - **Eviction beyond K, for SHRED.** More than 8 distinct in-flight
+     *    stamped operations racing the SAME object between reads is far
+     *    outside any expected co-ownership fan-out; a 9th racer whose stamp
+     *    gets evicted before it re-reads can only double-apply an idempotent
+     *    CAS delta — never silently lose one (the DECREMENT delta is bounded
+     *    by the marker's authoritative captured `hold.n`, applied as ONE CAS
+     *    per eTag — never per-row — so eviction has nothing row-scoped to
+     *    re-apply against). Not a data-loss risk for shred, just a documented
+     *    concurrency bound.
+     *  - **Stale stamps on a retained object.** A `retainedShared` object (one
+     *    reference released, others still live) keeps whatever stamp its last
+     *    CAS write appended even after that operation's marker is gone —
+     *    harmless bookkeeping, not crypto material (unlike `_cek`), that sits
+     *    inert until the object's next CAS write evicts or overwrites it.
+     *
+     * **#746 whole-branch review correction — this ring is NOT the sole
+     * idempotency source for REHOME.** Rehome's destination `+1`s are
+     * ROW-SCOPED (`${opId}:${slotName}` / `${opId}:${versionKey}`, one stamp
+     * PER CONTRIBUTING ROW, not one per eTag). Within a SINGLE op this ring is
+     * sufficient — rows are processed sequentially and each row's referencing
+     * update lands before the next row's `+1`, so a row whose stamp is later
+     * evicted is already seen as "moved" (skipped) on resume, never
+     * re-incremented. The genuine over-count is **concurrent independent ops**
+     * (distinct `opId`s) converging on one shared destination: ≥8 of them can
+     * evict a crashed op's row-stamp before it resumes, and a naive ring-only
+     * resume would then double-apply that row's `+1` — a real, silent,
+     * permanent-leak over-count, not merely eviction-tolerant like shred's.
+     * `BlobIntent.appliedStamps` (`blob-intent.ts`) is rehome's ring-INDEPENDENT
+     * backstop: an unbounded, per-op, per-record log of confirmed row-stamps,
+     * consulted BEFORE this ring on every resume (see
+     * `BlobSet.applyStampedIncrement`). This ring stays the fast first-line
+     * check; `appliedStamps` makes correctness independent of ring eviction
+     * **except** in one intrinsic non-atomic window: the destination `+1`/ring
+     * write (A) and the `appliedStamps` append (B) are separate object writes,
+     * A before B (deliberately — B-first could under-count and crypto-shred a
+     * still-referenced object, i.e. data loss, strictly worse than a
+     * retained-too-long leak). A crash BETWEEN A and B followed by ≥8 concurrent
+     * evictions before resume can still over-count. This window is intrinsic
+     * (rehome, unlike shred, cannot pre-capture destinations at mint time) and
+     * fail-safe-directed; it is a documented residual (see the arc changeset).
+     */
+    readonly lastOps?: readonly string[];
 }
 /**
  * Slot record — mutable metadata linking a named slot on a record
@@ -1899,6 +1958,20 @@ export interface SlotRecord {
     readonly uploadedAt: string;
     /** User ID of the uploader, if available. */
     readonly uploadedBy?: string;
+    /**
+     * Internal rehome-journal bookkeeping (#746 spec §7 review, carried
+     * finding (b)) — NEVER part of the public `list()`/`SlotInfo` contract
+     * (`BlobSet.list()` filters it out explicitly). Set, in the SAME CAS
+     * write that points this slot at its new (rehomed) eTag, to the OLD eTag
+     * still awaiting its refCount release: `putUnderDEK`'s slot-CAS and its
+     * old-eTag release are two separate writes, and a crash between them
+     * would otherwise lose the only record of which object still needs
+     * releasing (the slot map itself has already moved past it) — a
+     * permanent stranded-refcount leak. Cleared once the release lands.
+     * Only ever set under a marker-governed (stamped) rehome; absent on
+     * every ordinary `put()`.
+     */
+    readonly pendingRelease?: string;
 }
 /** Result of `BlobSet.list()` — slot record plus its named slot key. */
 export interface SlotInfo extends SlotRecord {

package/dist/kernel/vault.d.ts

@@ -28,7 +28,7 @@ import type { IndexStrategy } from '../with-lookup/indexing/strategy.js';
 import type { LazyStrategy } from '../port/with/lazy-strategy.js';
 import type { AggregateStrategy } from '../with-lookup/aggregate/strategy.js';
 import type { CrdtStrategy } from './types.js';
-import type { TiersStrategy } from '../with-audit/tiers/strategy.js';
+import type { TiersStrategy, TierMoveResult } from '../with-audit/tiers/strategy.js';
 import type { SearchStrategy } from '../with-lookup/search/strategy.js';
 import { type CargoStrategy } from '../with-cargo/strategy.js';
 import { type BrokerStrategy, type CredentialBrokerHandle } from '../port/with/broker-strategy.js';
@@ -465,6 +465,7 @@ export declare class Vault {
          * when `vault.compact()` runs.
          */
         blobFields?: BlobFieldsConfig<T>;
+        blobTierPolicy?: 'isolate' | 'dedup';
         /** — declarative record archival policy: `{ archiveWhen, legalHold? }`. Evaluated when `vault.archive()` runs. */
         archive?: ArchivePolicy<T>;
         /** — declared tiers for this collection. */
@@ -1155,13 +1156,15 @@ export declare class Vault {
     /**
      * Manual re-materialize for a single registered MV (`refresh: 'manual'` consumers,
      * stale-bit recovery on vault reopen, bulk-recompute escape hatch after a strategy
-     * change). Returns `{ written, deleted, failed }` (`deleted` always 0 without
-     * tombstoning). Throws if `name` is not a registered MV.
+     * change). Returns `{ written, deleted, failed, residueUndecodable, residueDeclined }` (`deleted`
+     * always 0 without tombstoning; #785 splits the #782 leftovers — undecodable vs #718-declined). Throws if not registered.
      */
     refreshView(name: string): Promise<{
         written: number;
         deleted: number;
         failed: number;
+        residueUndecodable: string[];
+        residueDeclined: string[];
     }>;
     /**
      * Re-derive every record in the named source collection (useful after a strategy
@@ -1340,9 +1343,9 @@ export declare class Vault {
      * Internal — invoked by an `ElevatedHandle.collection().put()` call.
      * Routes through the existing `Collection.putAtTier` code path with
      * the elevation context attached so the cross-tier event reflects
-     * the right authorization class.
+     * the right authorization class. Returns `putAtTier`'s `TierMoveResult` (#779).
      */
-    _elevatedPut<T>(collectionName: string, id: string, record: T, tier: number, reason: string): Promise<void>;
+    _elevatedPut<T>(collectionName: string, id: string, record: T, tier: number, reason: string): Promise<TierMoveResult>;
     private writeElevationAudit;
     /**
      * low-level escape hatch used by `@noy-db/on-magic-link`