@noy-db/hub 0.3.0-pre.12 → 0.3.0-pre.13

package/dist/with-commit/history/ledger/store.d.ts

@@ -216,6 +216,27 @@ export declare class LedgerStore {
      * backward" signal and falls back to the on-disk current value.
      */
     loadDelta(index: number): Promise<JsonPatch | null>;
+    /**
+     * Purge a record's tier-0-era plaintext deltas (#729). Deletes each
+     * `_ledger_deltas/<paddedIndex>` row whose entry matches
+     * `(collection, id)` and carries a delta, then returns the count
+     * deleted.
+     *
+     * Chain-safe by construction: `verify()` recomputes the tamper-chain
+     * from each `_ledger` entry's own canonical fields — including the
+     * stored `deltaHash` field, which lives on the entry, not on the
+     * `_ledger_deltas` row — and never re-reads `_ledger_deltas`.
+     * Deleting a delta row therefore cannot break `verify()`.
+     * `reconstruct()` already treats a missing delta (`loadDelta` →
+     * `null`) as a pruned stop, so a purge just makes the pre-purge
+     * plaintext unreachable rather than corrupting anything.
+     *
+     * No `_ledger` entry is touched and nothing is re-encrypted — this
+     * is irreversible (the deleted plaintext cannot be recovered) but
+     * leaves the entry metadata (that the record was mutated, at which
+     * version/timestamp/actor) fully intact for audit purposes.
+     */
+    purgeRecordDeltas(collection: string, id: string): Promise<number>;
     /** Encrypt a JSON Patch into an envelope for storage. Mirrors encryptEntry. */
     private encryptDelta;
     /**

package/dist/with-commit/history/strategy.d.ts

@@ -85,6 +85,16 @@ export interface HistoryStrategy {
      * tombstoned, or `0` under `NO_HISTORY` (no history = nothing to shred).
      */
     tombstoneHistory(adapter: NoydbStore, vault: string, collection: string, recordId: string, actor: string, encrypted: boolean): Promise<number>;
+    /**
+     * Re-key every `_history` snapshot of a record from `fromDek` to `toDek`
+     * on a tier move (elevate/demote/putAtTier), mirroring the live-body
+     * rewrap so prior versions are not left decryptable at rest under a tier
+     * the record has moved away from. Optional `tier0Dek` enables the legacy
+     * fallback for snapshots written before this rewrap existed (see
+     * `history.ts` for the full contract). No-op under `NO_HISTORY` (no
+     * history = nothing to rewrap).
+     */
+    rewrapHistory(adapter: NoydbStore, vault: string, collection: string, recordId: string, fromDek: EnclaveKey, toDek: EnclaveKey, tier0Dek?: EnclaveKey): Promise<void>;
     /**
      * Compute the SHA-256 hash of an envelope's encrypted payload, used
      * by `LedgerStore.append` to track tamper-evidence. Returns the

package/dist/with-commit/history/time-machine.d.ts

@@ -119,6 +119,16 @@ export declare class CollectionInstant<T = unknown> {
      * Return the record as it existed at the target timestamp, or
      * `null` if the record had not been created yet or had already been
      * deleted by then.
+     *
+     * Gated on the LIVE record's current tier — #730, mirroring the #712
+     * read-gate `history()`/`getVersion()` already apply: an elevated record
+     * is invisible through the whole time-machine surface, not just a
+     * decrypt failure. See {@link resolveVisibleEnvelope}.
+     *
+     * Decrypts through {@link openEnvelopeJson}, the `_cek`-aware envelope
+     * body opener — a snapshot from a `perRecordKeys` collection is encrypted
+     * under its own per-record CEK (wrapped in `_cek`), not the collection
+     * DEK directly.
      */
     get(id: string): Promise<T | null>;
     /**
@@ -134,6 +144,19 @@ export declare class CollectionInstant<T = unknown> {
     put(_id: string, _record: T): Promise<never>;
     delete(_id: string): Promise<never>;
     update(_id: string, _patch: Partial<T>): Promise<never>;
+    /**
+     * {@link resolveEnvelope}, additionally gated on the record's LIVE
+     * (current, not historical) tier — #730. Mirrors the #712 read-gate
+     * `history()`/`getVersion()` apply: history snapshots keep their
+     * tier-0-wrapped CEKs and carry no `_tier` of their own, so an elevated
+     * record's prior versions would otherwise stay tier-0-decryptable here.
+     * `null` for a resolved envelope carrying its own `_tier > 0` (a
+     * tier-aware snapshot reached some other way) or whose LIVE record is
+     * currently elevated — both `get()` and `list()` route through this so
+     * the invisibility law holds on the whole time-machine read surface, not
+     * just a decrypt failure.
+     */
+    private resolveVisibleEnvelope;
     /**
      * Return the envelope that represents the record's state at
      * `targetTs`, accounting for deletes. `null` if the record didn't

package/dist/with-commit/tx/elevated-handle.d.ts

@@ -1,4 +1,5 @@
 import type { Vault } from '../../kernel/vault.js';
+import type { TierMoveResult } from '../../with-audit/tiers/index.js';
 /**
  * Reserved collection that holds the audit ledger of elevation
  * sessions. One envelope per `vault.elevate(...)` call.
@@ -44,7 +45,7 @@ export declare class ElevatedHandle {
      * unprivileged" trivially true.
      */
     collection<T>(name: string): {
-        put(id: string, record: T): Promise<void>;
+        put(id: string, record: T): Promise<TierMoveResult>;
     };
     /**
      * Manually revert the elevation. Idempotent — calling twice (or

package/dist/with-formula/materialized-views/executor.d.ts

@@ -36,6 +36,15 @@ export interface RefreshResult {
     deleted: number;
     /** Failed row writes (non-strict mode). */
     failed: number;
+    /** #782/#785 — `outputCollection:id` entries from the tombstone pass whose ownership stamp
+     *  couldn't be decoded under the collection's default DEK (undecodable, mirroring
+     *  `invalidateMVAtRest`'s #776 posture) — ownership UNCONFIRMED. Only populated when
+     *  `onEmpty: 'delete'`. */
+    residueUndecodable: string[];
+    /** #782/#785 — `outputCollection:id` entries that decoded, stamp-matched this MV, but
+     *  `_internalDelete` declined (the #718 tier-elevation gate) — ownership CONFIRMED, a real
+     *  silent survival, surfaced rather than dropped. Only populated when `onEmpty: 'delete'`. */
+    residueDeclined: string[];
 }
 /**
  * Run an MV's `query()` and write the result rows to the output

package/dist/with-formula/materialized-views/stale.d.ts

@@ -1,8 +1,9 @@
 import type { Collection } from '../../kernel/collection.js';
 import type { TxContext } from '../../with-commit/tx/transaction.js';
 import type { PutDerivedOutputCtx } from '../../kernel/via/dispatch.js';
-import type { MaterializedViewRegistry } from './registry.js';
+import type { MaterializedViewRegistry, RegisteredMV } from './registry.js';
 import type { MVQueryContext } from './types.js';
+import type { NoydbStore } from '../../kernel/types.js';
 /**
  * Accessor shape passed in from the owning Vault. Provides the
  * registry (used as a stable WeakMap key + to look up MVs by output
@@ -30,6 +31,48 @@ export declare function markMVStale(registry: MaterializedViewRegistry, mvName:
  * @internal
  */
 export declare function isMVStale(registry: MaterializedViewRegistry, mvName: string): boolean;
+/**
+ * Reserved collection holding CONTENT-FREE lazy-stale markers (record id =
+ * MV name, plaintext `_iv: ''` envelope, no payload) — mirrors the
+ * `_meta`/schema-fence marker envelope shape. Written only from the
+ * delete/forget/elevate dispatcher (#736); ordinary source writes stay
+ * in-memory-only (the cheap path). Read via the adapter directly, never
+ * through `vault.collection()` — same reserved-collection convention as
+ * `_subject_index`/`_meta`.
+ */
+export declare const MV_STALE_COLLECTION = "_mv_stale";
+/**
+ * Invalidate an MV from the delete/forget/elevate dispatcher (#736) — the ordinary
+ * source-write path (`dispatchMaterializedViews`) never calls this. Deletes EVERY
+ * persisted row in `reg.outputCollection` via `_internalDelete` (the at-rest law: a
+ * stale mark alone leaves the elevated/forgotten source's plaintext sitting in the
+ * output row) using the adapter directly so the read-path's `resolveStaleMVOnRead`
+ * isn't triggered mid-invalidation. `mode: 'lazy'` also persists the stale mark so a
+ * cold session recomputes on next read; `'manual'` gets the purge only — the MV
+ * serves empty until an explicit `vault.refreshView()` (erasure wins). Deletion is
+ * stamp-scoped (`_materializedFrom.mvName === reg.spec.name` — see the loop below),
+ * so another registered MV sharing this output collection keeps its own rows intact:
+ * no cross-MV re-marking is needed here, only `reg` itself is marked stale.
+ *
+ * Returns the count of rows actually `_internalDelete`d (#761 item 1) — folded by the
+ * caller into `dispatchMaterializedViewsOnDelete`'s `deleted` so `ForgetResult.derivedRecordsErased`
+ * counts lazy/manual purges too, not just the eager executor's tombstone leg — plus
+ * `residueUndecodable`, the bare ids whose ownership stamp could NOT be decoded (#776): a
+ * candidate row that fails to decode under the collection's default DEK (e.g. elevated above
+ * tier 0 on a tiered output collection) has UNKNOWN ownership — it might be this MV's own
+ * output, or (same-collection shape) a plain user record — so it is never erased, but it must
+ * be SURFACED rather than silently skipped (the #724 posture), since it may still hold the
+ * forgotten/pre-elevation contribution, decryptable by tier-holders — and `residueDeclined`
+ * (#785), the bare ids that DID decode and stamp-match but whose `_internalDelete` declined
+ * (ownership CONFIRMED, erasure declined).
+ *
+ * @internal
+ */
+export declare function invalidateMVAtRest(accessor: MVStaleAccessor, reg: RegisteredMV, mode: 'lazy' | 'manual'): Promise<{
+    deleted: number;
+    residueUndecodable: string[];
+    residueDeclined: string[];
+}>;
 /**
  * Called from `Collection.get` (and any reader that materializes the
  * MV's output collection). If any MV producing `outputCollection` is
@@ -60,3 +103,11 @@ export declare function resolveStaleMVOnRead(accessor: MVStaleAccessor, outputCo
  * @internal
  */
 export declare function clearMVStale(registry: MaterializedViewRegistry, mvName: string): void;
+/**
+ * `clearMVStale` plus the persisted marker (#736) — `Vault.refreshView()`'s
+ * completion path. A lingering persisted marker after a manual refresh would
+ * make the NEXT cold session recompute redundantly.
+ *
+ * @internal
+ */
+export declare function clearMVStaleFully(adapter: NoydbStore, vault: string, registry: MaterializedViewRegistry, mvName: string): Promise<void>;

package/dist/with-lookup/embeddings/index.d.ts

@@ -1,3 +1,4 @@
 export { cosine } from './cosine.js';
 export { embeddingSourceText, type EmbeddingDescriptor } from './descriptor.js';
 export { VectorSet, type StoredVector, type VectorHit } from './vector-set.js';
+export { encodeVecId } from './vec-id.js';

package/dist/with-lookup/embeddings/vec-id.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Collection-namespaced `_vec` side-car ids (#726).
+ *
+ * `_vec` embedding side-cars used to be keyed by the bare record id,
+ * vault-wide — two collections sharing a record id shared one `_vec` row.
+ * This was verified to be a clobber/crash bug, NOT a confidentiality leak:
+ * every collection has its own DEK, and AES-GCM auth-tag verification means
+ * decrypting a foreign collection's `_vec` row under the wrong DEK throws
+ * `TamperedError` rather than returning wrong plaintext — no disclosure
+ * mechanism exists. The real bug was id collision: a same-id write/forget in
+ * one collection could clobber or delete the other collection's row, and a
+ * collection whose `similarTo()` / cold semantic `retrieve()` encountered a
+ * foreign same-id row crashed with an uncaught `TamperedError` (a DoS). The
+ * store-collection bucket stays the literal `'_vec'`; the id becomes
+ * composite: `${collection}/${recordId}`. Mirrors `encodeIdxId`
+ * (`../indexing/persisted-indexes.js`).
+ *
+ * Decode is deliberately NOT split-on-`/`: the collection is always known
+ * at the decode site (`ctx.name`), so `decodeVecId` strips that known
+ * prefix — correct even when `recordId` itself contains `/`.
+ *
+ * Precondition: `collection` itself must not contain `/` — otherwise
+ * `${collection}/${recordId}` is ambiguous (e.g. collection `'a'` would
+ * misattribute collection `'a/b'`'s rows via prefix match in `isVecIdFor`).
+ * Collection names are NOT currently restricted to a `/`-free charset by
+ * `vault.collection()`, so `encodeVecId` enforces the precondition itself,
+ * failing loud at the write boundary rather than silently misencoding.
+ */
+/**
+ * Encode the `_vec` side-car id for a (collection, recordId) pair.
+ * Format: `<collection>/<recordId>` — no escaping; `recordId` may contain `/`.
+ *
+ * Throws if `collection` contains `/`: that would make the composite id
+ * ambiguous against `isVecIdFor`'s prefix match (collection `'a'` would
+ * appear to own collection `'a/b'`'s rows), reintroducing the clobber/crash
+ * risk the namespacing fix exists to close.
+ */
+export declare function encodeVecId(collection: string, recordId: string): string;
+/**
+ * Decode a `_vec` id back to the bare record id, given the KNOWN owning
+ * collection — strips the `<collection>/` prefix rather than splitting on
+ * `/`, so a `recordId` containing `/` round-trips correctly. Returns `null`
+ * if `vecId` does not belong to `collection`.
+ */
+export declare function decodeVecId(collection: string, vecId: string): string | null;
+/** Predicate form of {@link decodeVecId} — used to filter `list()` results. */
+export declare function isVecIdFor(collection: string, vecId: string): boolean;

package/dist/with-lookup/indexing/collection-facade.d.ts

@@ -20,7 +20,7 @@
  *
  * Internal service — not exported as a `@noy-db/hub/*` subpath.
  */
-import type { NoydbStore } from '../../kernel/types.js';
+import type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js';
 import type { RecordCodec } from '../../kernel/enclave/index.js';
 import type { NoydbEventEmitter } from '../../kernel/events.js';
 import type { CollectionIndexes } from './eager-indexes.js';
@@ -118,3 +118,40 @@ export declare function purgePersistedIndexes<T>(ctx: IndexingContext<T>, id: st
     purged: number;
     residue: string[];
 }>;
+/**
+ * Sync this collection's indexes after a tier move (#709). Persisted
+ * `_idx/<field>/<recordId>` side-cars are always encrypted under the
+ * tier-0 DEK regardless of the record's own tier, and the eager in-memory
+ * `CollectionIndexes` mirror holds plaintext bucket values too — so both
+ * leak an elevated record's indexed field values unless swept the same way
+ * `purgePersistedIndexes` already sweeps them for `forget()` ("forget()
+ * crypto-shreds the body but keeps the collection DEK, under which these
+ * side-cars are encrypted — so without this they leave the indexed field
+ * VALUES readable", `purgePersistedIndexes` above).
+ *
+ * `record === null` — the record just left tier 0: purge its persisted
+ * side-cars (content-free, no decrypt needed) and drop its eager-mirror
+ * entry, read from `ctx.cache` (the caller's pre-write value — the caller
+ * MUST invoke this before evicting/overwriting that cache entry, so it
+ * still reflects the value being replaced).
+ *
+ * `record` given — the record is tier-0 again: (re)build its entries from
+ * that record, using the SAME pre-write `ctx.cache` read as the previous
+ * value so a stale bucket (e.g. a same-tier `putAtTier` value change) is
+ * cleaned up rather than left as a false-positive hit. `version` stamps
+ * the rebuilt side-car's own envelope version.
+ *
+ * `priorEnvelope` (#720) — the RAW envelope the caller read BEFORE its own
+ * overwrite landed (`putAtTier`'s `existing` / `demote`'s pre-move
+ * `envelope`), for the `ctx.cache`-miss lazy case: by this call's time the
+ * adapter already holds the NEW envelope, so a `ctx.adapter.get()` here
+ * would only ever re-observe the write just made — useless for recovering
+ * what a same-tier `putAtTier` may have dropped. Optional: the null-record
+ * branches (elevate / demote-to-intermediate / putAtTier(tier>0)) never
+ * need it — their only prior-dependent step, the eager `indexes.remove`
+ * below, already has what it needs from `ctx.cache` (eager mode is
+ * unaffected by the raw-envelope overwrite; lazy mode has no eager mirror).
+ *
+ * No-ops fast when the collection has neither index kind declared.
+ */
+export declare function syncTierIndexes<T>(ctx: IndexingContext<T>, id: string, record: T | null, version: number, priorEnvelope?: EncryptedEnvelope): Promise<void>;

package/dist/with-lookup/search/collection-facade.d.ts

@@ -121,3 +121,43 @@ export declare function similarTo<T>(ctx: SearchContext<T>, vector: Float32Array
  * (`Collection.put`) only invokes this when `embeddings` is declared.
  */
 export declare function embedOnWrite<T>(ctx: SearchContext<T>, id: string, record: T, version: number): Promise<void>;
+/**
+ * Force-re-derive every eligible tier-0 record's `_vec` sidecar once (#788).
+ * Opt-in bulk repair for the #726 re-namespace: legacy bare-id rows are
+ * unreachable to `buildVectorLoad` (it only recognises `<collection>/<id>`
+ * keys) and otherwise self-heal only when a record is next `put()` — this
+ * lets an adopter recover recall immediately instead of waiting on writes.
+ *
+ * **Skips elevated records** (`liveRecordIsElevated`) rather than refusing
+ * the whole walk — the OPPOSITE of `_applyCutoverTransform`'s
+ * `assertCutoverTierSafe` refuse-whole-batch precedent. An elevated record is
+ * SUPPOSED to have no `_vec` (`syncTierSearch` purges it on elevate);
+ * re-embedding one here would write searchable plaintext-derived data above
+ * tier 0. Load-bearing: never write a `_vec` row for an elevated record.
+ *
+ * Tombstones, delete markers, and a raw `get` racing a delete between `list`
+ * and `get` all decrypt to `null` (`decryptRecord` already folds
+ * tombstone/delete-marker into that null) and are skipped the same way.
+ * Unconditional re-derive, no already-migrated check — safe to re-run after
+ * a partial failure (each id is independently idempotent).
+ */
+export declare function rebuildEmbeddings<T>(ctx: SearchContext<T>): Promise<{
+    rebuilt: number;
+    skipped: number;
+}>;
+/**
+ * Sync the collection's SEARCH artifacts after a tier move (#721). Both the
+ * lexical `_ftindex` blob and the `_vec/<id>` embedding are encrypted under
+ * the tier-0 DEK and hold the record's derived plaintext (full field text /
+ * a text-invertible vector), so leaving them means elevation never hid what
+ * the record was searchable by — the `forget()` precedent, unapplied to
+ * elevate. `null` → the record left tier 0: purge its `_vec` sidecar (mirrors
+ * `Collection._purgeVector`), and invalidate the `_ftindex` blob (mirrors
+ * `Collection._purgeSearchIndex`: deletes the persisted blob when persisted,
+ * else drops the in-memory index) so the next `retrieve()` rebuilds from the
+ * elevated-free `ctx.cache`. A record → it is tier-0 again: re-embed it via
+ * {@link embedOnWrite}, then invalidate `_ftindex` so the rebuild includes it
+ * again. No-op fast when the collection has neither a lexical index nor a
+ * vector set.
+ */
+export declare function syncTierSearch<T>(ctx: SearchContext<T>, id: string, record: T | null, version?: number): Promise<void>;

package/dist/with-lookup/search/persisted-index-store.d.ts

@@ -4,6 +4,20 @@
  * live (L1 behavior); persists an opaque snapshot via a debounced flush, and
  * validates a loaded blob against a {count,maxVersion} fingerprint so a stale
  * blob is never used — only rebuilt.
+ *
+ * #725: a debounced save (encrypt + adapter.put) racing a purge (removePersisted,
+ * called by elevate's tier purge and forget's erasure) is guarded by an epoch counter
+ * — see the `epoch` field doc for the mechanism and why it also closes the issue's
+ * variant (b) for free. Residual gap, structurally unavoidable without a durable
+ * write-ahead log: a process CRASH strictly between a stale save's `adapter.put`
+ * landing and its compensating `remove()` running (or between the compensating
+ * remove landing and `pendingCompensation` being persisted somewhere durable — it is
+ * in-memory only) leaves the resurrected blob at rest until the next natural
+ * rebuild-persist. This is on par with the gate-before-put optimization's own crash
+ * residual (a crash between `isStale()` returning false and the put landing) — both
+ * are eliminated only by making the purge and the save's commit point transactional
+ * with the store, which is out of scope for an in-memory debounce layer over an
+ * arbitrary opaque-blob backend.
  */
 import { InvertedIndex, type IndexDoc } from './inverted-index.js';
 import type { IndexStore } from './index-store.js';
@@ -16,7 +30,14 @@ export interface PersistedIndexCallbacks {
         json: string;
         fingerprint: Fingerprint;
     } | null>;
-    save(json: string, fp: Fingerprint): Promise<void>;
+    /** `isStale()` reflects whether a purge (removePersisted) has landed since this
+     *  save's epoch was captured — check it AFTER any async encrypt step and BEFORE
+     *  the actual adapter.put, skipping the write when true (#725 review: shrinks the
+     *  at-rest window for purge-beats-encrypt orderings to zero). Belt-and-suspenders:
+     *  PersistedIndexStore's own post-save epoch check (persist(), below) is the
+     *  backstop that catches every other ordering, including a purge landing during
+     *  the put itself. */
+    save(json: string, fp: Fingerprint, isStale: () => boolean): Promise<void>;
     remove(): Promise<void>;
     currentFingerprint(): Fingerprint;
     debounceMs?: number;
@@ -27,15 +48,74 @@ export declare class PersistedIndexStore implements IndexStore {
     private timer;
     private lastBuild;
     private readonly debounceMs;
+    /**
+     * Bumped by every purge (removePersisted). A save() captured under a since-stale
+     * epoch undoes its own effect once it settles, however it interleaves with the
+     * purge's own delete — a delete can never be overtaken by a save that was
+     * scheduled before it (#725).
+     *
+     * Subsumes the issue's variant (b) (a stale, pre-purge in-memory index getting
+     * paired with a live, post-purge fingerprint and TRUSTED by a cold load, defeating
+     * the fingerprint backstop) for free — no separate handling needed: removePersisted()
+     * always resets `index` to undefined in the SAME synchronous step that bumps the
+     * epoch (below), and the only two paths that can repopulate `index` (ensureBuilt's
+     * cold rebuild, rebuildAndPersist's rebuild) do so strictly from `lastBuild()`, which
+     * the collection wires to read its LIVE cache at call time — not a frozen snapshot.
+     * Cache eviction (the collection dropping the purged/forgotten record) always
+     * precedes removePersisted() in both the elevate and forget call paths (#721's
+     * syncCache eviction / forget's tombstone write both land before syncSearch /
+     * _purgeSearchIndex runs). So any rebuild that executes strictly after
+     * removePersisted() — the only way `index` becomes defined again post-purge —
+     * necessarily observes the post-purge cache, and any rebuild that predates
+     * removePersisted() has its `index` wiped by it. There is no ordering in which a
+     * stale (pre-purge) index survives to be skip-rebuilt and persisted under a
+     * matching live fingerprint. Regression-pinned in
+     * `search-persisted-index-store.test.ts` ("variant (b) is subsumed...").
+     */
+    private epoch;
+    /**
+     * Set when a compensating/purging remove() (`compensate()` undoing a stale
+     * save, or `removePersisted()`'s own purge, #764) fails. Unlike the routine
+     * best-effort swallow on the debounced flush path (markDirty's timer
+     * .catch(), below — safe there because the fingerprint backstop forces a
+     * rebuild on the next cold load), a failed removal leaves a resurrected or
+     * un-purged blob at rest whose fingerprint can still match the live cache —
+     * a cold load would TRUST it, not rebuild past it. So this is never silently
+     * dropped: every subsequent store entrypoint (ensureBuilt, rebuildAndPersist,
+     * removePersisted) retries the remove first and refuses to proceed past it
+     * until it succeeds (#725 review), and the raw adapter error is wrapped in
+     * {@link PersistedIndexCompensationError} (#764) so a caller can catch a
+     * stuck removal deliberately instead of an indistinguishable adapter error.
+     * A crash between a landed put and its compensating remove (before this
+     * flag or a retry can run) is a residual gap — see the class doc.
+     */
+    private pendingCompensation;
     constructor(cb: PersistedIndexCallbacks);
     get built(): boolean;
     ensureBuilt(build: () => ReadonlyArray<IndexDoc>): Promise<InvertedIndex>;
     markDirty(): void;
     /** Force an immediate persist (cancels any pending debounce). */
     flush(): Promise<void>;
-    /** Delete the persisted blob and drop the in-memory index (forget/erasure). */
+    /** Delete the persisted blob and drop the in-memory index (forget/erasure/tier
+     *  move). A failed purge is wrapped in {@link PersistedIndexCompensationError}
+     *  (#764) and left sticky (`pendingCompensation`) so the next store entrypoint
+     *  retries it — never silently dropped, same posture #725 established for a
+     *  stale save's own compensating remove. */
     removePersisted(): Promise<void>;
     /** Rebuild using the last known build thunk, then persist. */
     private rebuildAndPersist;
+    /** Persist the current index, then undo it if a purge (removePersisted) landed
+     *  while the save was in flight — a delete can never be overtaken by a save
+     *  that was scheduled before it (#725). A failed undo does not silently vanish:
+     *  see `pendingCompensation`. */
     private persist;
+    /** Undo a stale save. Failure is sticky, not swallowed: see `pendingCompensation`.
+     *  Wraps the raw adapter error in {@link PersistedIndexCompensationError} (#764) so
+     *  a caller (e.g. the tier ops' `syncTierSearch`) can catch a stuck compensation
+     *  deliberately instead of treating it as an indistinguishable adapter failure. */
+    private compensate;
+    /** Retries a sticky compensation before any store entrypoint proceeds. Failure
+     *  re-wraps the raw adapter error the same way `compensate()` does (#764) — the
+     *  flag stays set (untouched here) so the NEXT entrypoint retries again. */
+    private retryPendingCompensation;
 }

package/dist/with-lookup/search/strategy.d.ts

@@ -28,6 +28,10 @@ export interface SearchStrategy {
     warmIndex<T>(ctx: SearchContext<T>): Promise<void>;
     flushIndex<T>(ctx: SearchContext<T>): Promise<void>;
     embedOnWrite<T>(ctx: SearchContext<T>, id: string, record: T, version: number): Promise<void>;
+    rebuildEmbeddings<T>(ctx: SearchContext<T>): Promise<{
+        rebuilt: number;
+        skipped: number;
+    }>;
 }
 /**
  * No-op stub — the floor default. Every capability method (and the embedding

package/dist/with-shape/blobs/blob-intent.d.ts

@@ -0,0 +1,153 @@
+/**
+ * `_blob_intent` — the blob durability journal marker (#753, spec §7).
+ *
+ * One row per in-flight multi-step blob operation (`shred` | `rehome`),
+ * written BEFORE the first destructive/movement step and deleted as the
+ * operation's LAST step. An absent marker means "no operation in flight"
+ * (the normal state, zero cost on every path that doesn't crash); a present
+ * marker means the operation MUST be resumed before any other blob work on
+ * that record proceeds.
+ *
+ * **Pattern honesty (C9):** this is the family's FIRST content-bearing
+ * ENCRYPTED reserved marker. The prior reserved-collection precedent,
+ * `_mv_stale` (`with-formula/materialized-views/stale.ts`), is
+ * content-free plaintext (`{ _iv: '', _data: '{}' }` — the row's only
+ * payload is its key). `_blob_intent` carries real operational metadata
+ * (op, tiers, eTags + counts) and is encrypted, so its codec/CAS/backup/
+ * sweep conventions below are new to the codebase, not a copy of an
+ * existing pattern.
+ *
+ * **Key management (spec §4):** encrypted under the record's OWNING
+ * collection's tier-0 DEK — `getDEK(collection)`, which resolves to
+ * `dekKey(collection, 0) === collection` (see `with-party/team/tiers.ts`).
+ * Every legitimate resumer (forget()-retry, blob write entry points,
+ * tier ops) already holds this DEK; minting an elevated DEK for the
+ * marker itself would make resume impossible for a tier-0-only resumer.
+ * Documented residue: a tier-0 DEK holder can learn that an elevated
+ * record's shred/rehome was in flight and which eTags it touched —
+ * existence-adjacent, consistent with the already-documented
+ * dedup-policy residue (#741).
+ *
+ * **Key grammar (C11):** `{collection}::{recordId}`. Blob-bearing record
+ * ids already refuse `::` at the write surface (`blob-set.ts`'s
+ * `assertKeyPartSafe`, #752) — re-validated here defensively so the
+ * sweep's prefix-free key list stays unambiguous regardless of caller.
+ *
+ * Wired by `shredAllForRecord`/`forget()` (PR-1 Task 3, shred) and by
+ * `BlobSet.syncTierMove`/`rehomeForTier`/`resolvePendingIntent` (PR-2 Task
+ * 2, rehome — mint/resume/consume for `op:'rehome'` markers).
+ */
+import type { NoydbStore } from '../../kernel/types.js';
+import { type EnclaveKey } from '../../kernel/enclave/index.js';
+/** Reserved collection holding `_blob_intent` marker rows. */
+export declare const BLOB_INTENT_COLLECTION = "_blob_intent";
+/**
+ * One captured refCount hold on an eTag, authoritative on resume (spec §2a,
+ * amended by C5). `chunkCount` lets a resumed release complete chunk
+ * cleanup even if the `_blob_index` row itself is already gone (mirrors
+ * `releaseRef`'s `chunkCountHint` parameter, Task 1).
+ */
+export interface BlobIntentHold {
+    readonly eTag: string;
+    readonly n: number;
+    readonly chunkCount: number;
+}
+/**
+ * The intent marker's decrypted payload (spec §2a, amended by C5: `holds`
+ * entries carry `{ eTag, n, chunkCount }` rather than the original bare
+ * `{ eTag, n }`).
+ */
+export interface BlobIntent {
+    readonly op: 'shred' | 'rehome';
+    /** Random nonce minted at marker creation (`crypto.getRandomValues`) — the op-stamp identity. */
+    readonly opId: string;
+    /** Captured ONCE at marker creation; authoritative on every resume. */
+    readonly holds?: readonly BlobIntentHold[];
+    readonly ownerTier?: number;
+    readonly fromTier?: number;
+    readonly toTier?: number;
+    readonly policy?: 'isolate' | 'dedup';
+    /**
+     * Rehome destination `+1` row-stamps (`${opId}:${slotName}` /
+     * `${opId}:${versionKey}`) CONFIRMED applied — #746 whole-branch review
+     * (K=8 stamp-ring blocker). `BlobObject.lastOps` is a BOUNDED ring (K=8,
+     * spec C2) — correct as the sole idempotency source for SHRED (one
+     * decrement per eTag, count captured in `holds`) but not for REHOME,
+     * whose row-scoped increments can exceed K on a single destination via
+     * either ≥9 rows of identical content on ONE record, or ≥8 CONCURRENT
+     * rehomes converging on one shared destination between a crashed op's
+     * stamp-write and its resume — either way, an evicted-but-unapplied-
+     * looking stamp gets re-applied, over-counting the destination's
+     * refCount and permanently stranding it above 0. This field is THIS
+     * op's own UNBOUNDED, per-record backstop: appended (via
+     * {@link recordAppliedStamp}) immediately after a stamped `+1` lands
+     * (whether freshly applied or found already in the ring), consulted
+     * BEFORE attempting the CAS so a resume that finds its own row-stamp
+     * here skips the increment entirely — independent of the shared
+     * destination object's bounded ring and of how many OTHER ops have
+     * touched it since. Absent/empty is the normal case (no rehome — or no
+     * increments yet — in flight).
+     */
+    readonly appliedStamps?: readonly string[];
+}
+/** Resume callback signature for {@link sweepBlobIntents} — supplied by the caller (Task 3 / PR-2). */
+export type BlobIntentResume = (collection: string, recordId: string, intent: BlobIntent) => Promise<void>;
+/**
+ * Read the `_blob_intent` marker for `{collection}::{recordId}`, or `null`
+ * if none is pending. The resume-gate check every future blob mutator
+ * (Task 3 / PR-2) runs before proceeding.
+ */
+export declare function getIntent(adapter: NoydbStore, vault: string, collection: string, recordId: string, getDEK: (collection: string) => Promise<EnclaveKey>): Promise<BlobIntent | null>;
+/**
+ * Create a `_blob_intent` marker for `{collection}::{recordId}` — CAS
+ * create-if-absent (C8). `store.put(..., expectedVersion: 0)` succeeds only
+ * when no row is present (every real adapter treats a missing record +
+ * `expectedVersion: 0` as a no-conflict write — the same convention
+ * `loadOrCreateSigner` uses in `with-audit/attestation/signer.ts`); a
+ * present row always carries `_v >= 1`, so the CAS throws `ConflictError`
+ * and is converted here into {@link BlobIntentPendingError} — the signal
+ * a caller catches to resume the PENDING operation before starting a new
+ * one, rather than silently clobbering it (which would orphan the prior
+ * op's op-stamps).
+ */
+export declare function createIntent(adapter: NoydbStore, vault: string, collection: string, recordId: string, getDEK: (collection: string) => Promise<EnclaveKey>, intent: BlobIntent): Promise<void>;
+/** Delete the `_blob_intent` marker for `{collection}::{recordId}` — the operation's LAST step. */
+export declare function deleteIntent(adapter: NoydbStore, vault: string, collection: string, recordId: string): Promise<void>;
+/**
+ * Durably record that a rehome destination row-stamp has been CONFIRMED
+ * applied — #746 whole-branch review (K=8 stamp-ring blocker). Appends
+ * `stamp` to the marker's `appliedStamps` (idempotent no-op if already
+ * present), CAS-retried against concurrent resumers touching the SAME
+ * marker (mirrors `BlobSet.casUpdateSlots`'s retry shape).
+ *
+ * A no-op — never throws — when the marker is already gone: that only
+ * happens if the whole op already completed and deleted it (this call is
+ * racing its own operation's tail) or a sibling resumer already finished
+ * it; either way there is nothing left to record against. A marker whose
+ * `op` is NOT `'rehome'` (should be structurally impossible — only
+ * `BlobSet`'s own rehome machinery calls this, against its own marker) is
+ * treated the same way: nothing to record.
+ */
+export declare function recordAppliedStamp(adapter: NoydbStore, vault: string, collection: string, recordId: string, getDEK: (collection: string) => Promise<EnclaveKey>, stamp: string): Promise<void>;
+/**
+ * List every persisted `_blob_intent` marker and resume each via the
+ * caller-supplied `resume` callback (the forget-entry / vault-open sweep,
+ * mirroring `_mv_stale`'s `hydratePersistedStaleMarkers`/orphan-sweep
+ * pattern).
+ *
+ * **Per-marker isolation (#753 Task 3, carried finding from the Task 2
+ * review):** each marker's decode + `resume` runs in its own try/catch — a
+ * corrupt/DEK-mismatched marker, or a marker whose resume genuinely fails
+ * (e.g. a store error mid-release), is reported via `onResumeError` and
+ * skipped, never aborting the loop and never silently swallowed. Earlier
+ * (Task 2) this loop had no try/catch at all; that was safe only because
+ * nothing called `resume` with real logic yet — `BlobSet.mintShredIntent`'s
+ * collection-scoped sweep (this function's first real caller, Task 3) can
+ * hit a genuinely corrupt sibling marker and must not let it block a
+ * healthy one (mirrors `stale.ts`'s orphan-sweep defensive posture, #736).
+ *
+ * `resume` is the per-marker resume action (Task 3: `BlobSet`'s
+ * `resolvePendingIntent`-equivalent for a shred marker; a rehome marker is
+ * PR-2 scope and should be skipped by the callback, not thrown into here).
+ */
+export declare function sweepBlobIntents(adapter: NoydbStore, vault: string, getDEK: (collection: string) => Promise<EnclaveKey>, resume: BlobIntentResume, onResumeError?: (collection: string, recordId: string, err: unknown) => void): Promise<void>;