@noy-db/hub 0.3.0-pre.5 → 0.3.0-pre.7

package/dist/{chunk-IEUIUSBO.js → chunk-5K7KZMXG.js}

@@ -1,3 +1,6 @@
+import {
+  loadVaultPolicy
+} from "./chunk-NO53W6O5.js";
 import {
   jsonSchemaToFields
 } from "./chunk-TQ3REHVF.js";
@@ -6,30 +9,40 @@ import {
   SEQUENCE_COLLECTION,
   compileSequenceFormat,
   resolveSequenceKey
-} from "./chunk-P27Z66EB.js";
-import {
-  loadVaultPolicy
-} from "./chunk-T45LAT2Y.js";
+} from "./chunk-IEKK2XI4.js";
 import {
   LinkIntegrityError,
   isLinkCollectionName,
   linkCollectionName,
   linkRowKey
-} from "./chunk-P3NGV5RV.js";
+} from "./chunk-V76PHWLE.js";
 import {
-  derivePersistedSchema,
-  isZod4Schema
-} from "./chunk-ULIHDPKL.js";
+  hashFields,
+  validateSatelliteDeclaration
+} from "./chunk-5JQMX2EH.js";
 import {
   loadFence
-} from "./chunk-YFF2RP3X.js";
+} from "./chunk-WRLPV6SI.js";
 import {
   InvertedIndex,
   MemoryIndexStore,
   NO_SEARCH,
   VectorSet,
   buildPersistedIndexCallbacks
-} from "./chunk-A4DWPOP3.js";
+} from "./chunk-CP3GUIAN.js";
+import {
+  derivePersistedSchema,
+  isZod4Schema
+} from "./chunk-55LSDABW.js";
+import {
+  isBaseLive,
+  liveBaseIdSet
+} from "./chunk-GYGLAVCX.js";
+import {
+  CustodyApi,
+  NO_CARGO,
+  NO_CUSTODY
+} from "./chunk-RUWEHFRB.js";
 import {
   ServiceBus,
   WriteHookRegistry,
@@ -37,50 +50,45 @@ import {
   assertCanImport,
   canExport,
   canImport
-} from "./chunk-7SY3PTED.js";
+} from "./chunk-HBVEGUON.js";
 import {
   NO_ATTESTATION
-} from "./chunk-Z7KI4WHR.js";
+} from "./chunk-LFGJG4XZ.js";
 import {
   NO_CLASSIFIED,
   enforceClassifiedWrite,
   resolveClassifiedFields
-} from "./chunk-AF5ZRTZ4.js";
+} from "./chunk-47C4CI7R.js";
 import {
   NO_TIERS,
   classifySealedShred
-} from "./chunk-VMJ5URU7.js";
+} from "./chunk-E3LURVGQ.js";
 import {
   NO_PORTABILITY
-} from "./chunk-N5YVZHCB.js";
-import {
-  CustodyApi,
-  NO_CARGO,
-  NO_CUSTODY
-} from "./chunk-PI5CG2OV.js";
+} from "./chunk-II6DLDZM.js";
 import {
   runDrainBarrier
-} from "./chunk-3Y4QLJ6K.js";
+} from "./chunk-EU7HDMT3.js";
 import {
   PERIODS_COLLECTION
-} from "./chunk-GZZL5R73.js";
+} from "./chunk-YSU2E4GZ.js";
 import {
   TxContext,
   revertExecuted
-} from "./chunk-T65UZXR6.js";
+} from "./chunk-FCOZ7DEC.js";
 import {
   OverlayedCollection
-} from "./chunk-ZROMNP7Q.js";
+} from "./chunk-MOQ5M46U.js";
 import {
   EXPORT_AUDIT_COLLECTION,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-5MRE3C4Q.js";
+} from "./chunk-I6Q7YECW.js";
 import {
   LazyQuery,
   decodeIdxId,
   encodeIdxId
-} from "./chunk-QNTEDPWP.js";
+} from "./chunk-6PALJTC2.js";
 import {
   IMPLICIT_LAZY,
   Lru,
@@ -89,11 +97,11 @@ import {
 import {
   resolveManagedSecret,
   saveSealedPassphrase
-} from "./chunk-VWGCJUTV.js";
+} from "./chunk-H7WQMGXH.js";
 import {
   isDictCollectionName,
   isStaticDictDescriptor
-} from "./chunk-44UTIDE2.js";
+} from "./chunk-WFBZRXS5.js";
 import {
   NO_TEAM,
   enrollAuthenticator,
@@ -104,7 +112,7 @@ import {
   rotatePassphrase,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-LEA7WJEZ.js";
+} from "./chunk-WGH3YV6Y.js";
 import {
   hasRecoveryEnrolled,
   hasStrongRecoveryEnrolled,
@@ -114,7 +122,7 @@ import {
   mintShamirRecoveryEntry,
   savePaperRecoveryEntries,
   saveShamirRecoveryEntries
-} from "./chunk-LPRPVCNY.js";
+} from "./chunk-VUHXLL32.js";
 import {
   INDEXED_STORE_POLICY
 } from "./chunk-VQNJ7UZL.js";
@@ -130,17 +138,17 @@ import {
   listUsers,
   loadKeyring,
   updateKeyringIdentity
-} from "./chunk-ZT4GWVTX.js";
+} from "./chunk-GMZFHDSG.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
-} from "./chunk-TB5RNNJ4.js";
+} from "./chunk-3CHNKEFI.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
 import {
   sha256Hex
-} from "./chunk-M66NAZA4.js";
+} from "./chunk-G5CFMITA.js";
 import {
   NO_FORGET,
   addSubjectRef,
@@ -149,10 +157,10 @@ import {
   readDottedPath,
   rebuildSubjectIndex,
   removeSubjectRef
-} from "./chunk-O2DB4C3M.js";
+} from "./chunk-VMRXI3IF.js";
 import {
   NO_SEALED_RECORD
-} from "./chunk-G7RDYYTE.js";
+} from "./chunk-XW5LZYV4.js";
 import {
   RecordCodec,
   SEALED_CEK_NS,
@@ -162,35 +170,37 @@ import {
   queryByDet,
   resolveStableCek,
   validateSchemaInput
-} from "./chunk-OVO2RZAE.js";
+} from "./chunk-JIW3Q5JN.js";
 import {
+  buildDeleteMarker,
   buildTombstone,
+  isDeleteMarker,
   isTombstone
-} from "./chunk-QKVILR7N.js";
+} from "./chunk-HGQ6UNHE.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-LN22XH4B.js";
+} from "./chunk-HCK2DFEK.js";
 import {
   encrypt
-} from "./chunk-TLJOJBZD.js";
+} from "./chunk-5HZULLHE.js";
 import {
   NO_AGGREGATE,
   Query,
   ScanBuilder
-} from "./chunk-GBTUANXF.js";
+} from "./chunk-6Z435B6N.js";
 import {
   canonicalGroupKey
-} from "./chunk-P5WXDYMD.js";
+} from "./chunk-5GQE5IDB.js";
 import {
   moneyRuntime,
   readPath
-} from "./chunk-ZKF6HH7V.js";
+} from "./chunk-6P5AJ2ZS.js";
 import {
   getAtPath,
   resolvePolicy,
   setAtPathInPlace,
   stripI18nFilled
-} from "./chunk-4K3MQ5S3.js";
+} from "./chunk-BASCPHNM.js";
 import {
   AlreadyElevatedError,
   AttestationError,
@@ -217,6 +227,7 @@ import {
   RecoveryNotEnrolledError,
   RecoveryProfileNotImplementedError,
   ReservedCollectionNameError,
+  SatelliteConfigError,
   SchemaFenceError,
   StaticDictReadonlyError,
   StoreCapabilityError,
@@ -227,11 +238,11 @@ import {
   UnknownDictCodeError,
   UnsupportedIndexOptionError,
   ValidationError
-} from "./chunk-U23JUUPX.js";
+} from "./chunk-OJ64XMPJ.js";
 
 // src/port/by/default-provider.ts
 async function createDefaultCoordinationProvider(store) {
-  const { StoreCoordinationProvider } = await import("./store-coordination-provider-JJCEMTAE.js");
+  const { StoreCoordinationProvider } = await import("./store-coordination-provider-F5N5ASDF.js");
   return new StoreCoordinationProvider(store);
 }
 
@@ -1060,7 +1071,7 @@ async function resolveStaleOnRead(accessor, outputCollection, id) {
     }
     const sourceWithId = { ...source, id };
     if (DerivationExecutor === null) {
-      ({ DerivationExecutor } = await import("./executor-CBTNU5VZ.js"));
+      ({ DerivationExecutor } = await import("./executor-EUPYHCLU.js"));
     }
     const ctx = { vault: accessor.getReadOnlyFacade() };
     const result = await DerivationExecutor.run(spec, sourceWithId, 0, strategyHash, ctx);
@@ -1350,7 +1361,7 @@ function resolveCollectionConfig(opts) {
 // src/with-formula/computed/lazy.ts
 var fn = null;
 async function loadEvalComputedFields() {
-  fn ??= (await import("./computed-BMMEFRFJ.js")).evalComputedFields;
+  fn ??= (await import("./computed-6FOFXQPE.js")).evalComputedFields;
   return fn;
 }
 
@@ -2188,7 +2199,7 @@ var Collection = class {
     }
     await this.onAccess?.("find", "*");
     if (hits.length === 0) return [];
-    const { verifyDigestField } = await import("./verify-YB5LQHNA.js");
+    const { verifyDigestField } = await import("./verify-CAYGXYNO.js");
     const policy = {
       normalize: spec.verifyNormalize ?? "password",
       notLastN: spec.notLastN ?? 0,
@@ -2364,7 +2375,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-7Q62KVI3.js");
+      const { resolveStaleMVOnRead } = await import("./stale-DP66HFT3.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name);
     }
     let record;
@@ -2375,7 +2386,7 @@ var Collection = class {
       } else {
         const envelope = await this.adapter.get(this.vault, this.name, id);
         if (!envelope) return null;
-        if (isTombstone(envelope, this.storeCiphertext)) return null;
+        if (isTombstone(envelope, this.storeCiphertext) || isDeleteMarker(envelope)) return null;
         record = await this.codec.decryptRecord(envelope, { id, sealedAsHandles: true });
         if (record === null) return null;
         this.lru.set(id, { record, version: envelope._v }, estimateRecordBytes(record));
@@ -2825,14 +2836,15 @@ var Collection = class {
       return;
     }
     let existing;
+    let priorRaw = null;
     if (this.lazy && this.lru) {
       existing = this.lru.get(id);
       if (!existing) {
-        const previousEnvelope = await this.adapter.get(this.vault, this.name, id);
-        if (previousEnvelope) {
-          const previousRecord = await this.codec.decryptRecord(previousEnvelope);
+        priorRaw = await this.adapter.get(this.vault, this.name, id);
+        if (priorRaw) {
+          const previousRecord = await this.codec.decryptRecord(priorRaw);
           if (previousRecord !== null) {
-            existing = { record: previousRecord, version: previousEnvelope._v };
+            existing = { record: previousRecord, version: priorRaw._v };
           }
         }
       }
@@ -2840,7 +2852,11 @@ var Collection = class {
       await this.ensureHydrated();
       existing = await this.resolvePriorValues(id);
     }
-    const version = existing ? existing.version + 1 : 1;
+    let version = existing ? existing.version + 1 : 1;
+    if (!existing && this.onDirty) {
+      if (priorRaw === null) priorRaw = await this.adapter.get(this.vault, this.name, id);
+      if (priorRaw && isDeleteMarker(priorRaw)) version = priorRaw._v + 1;
+    }
     this.uniqueConstraints?.check(id, record);
     const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
     const vdigCtx = this.vdigFields !== null ? { id, prev: await this.adapter.get(this.vault, this.name, id) } : void 0;
@@ -2927,7 +2943,7 @@ var Collection = class {
       if (mode === "eager") {
         if (executor === null) {
           ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-FGISLQIN.js"));
+          ({ MaterializedViewExecutor: executor } = await import("./executor-6LHOV7MN.js"));
         }
         await executor.refresh(reg, {
           getCollection: (name) => this.materializedViewSource.getCollection(name),
@@ -2936,7 +2952,7 @@ var Collection = class {
         });
       } else if (mode === "lazy") {
         if (staleHelpers === null) {
-          staleHelpers = await import("./stale-7Q62KVI3.js");
+          staleHelpers = await import("./stale-DP66HFT3.js");
         }
         staleHelpers.markMVStale(registry, reg.spec.name);
       }
@@ -2966,7 +2982,7 @@ var Collection = class {
       if (this.sensitiveFields.size > 0) {
         const cached = this.lru.get(id);
         const env = await this.adapter.get(this.vault, this.name, id);
-        if (!env || isTombstone(env, this.storeCiphertext)) return null;
+        if (!env || isTombstone(env, this.storeCiphertext) || isDeleteMarker(env)) return null;
         raw = await this.codec.decryptRecord(env, { id });
         if (raw === null) return null;
         if (!cached) {
@@ -2977,7 +2993,7 @@ var Collection = class {
         if (cached) raw = cached.record;
         else {
           const env = await this.adapter.get(this.vault, this.name, id);
-          if (!env || isTombstone(env, this.storeCiphertext)) return null;
+          if (!env || isTombstone(env, this.storeCiphertext) || isDeleteMarker(env)) return null;
           raw = await this.codec.decryptRecord(env, { id });
           if (raw === null) return null;
           this.lru.set(id, { record: raw, version: env._v }, estimateRecordBytes(raw));
@@ -3121,7 +3137,7 @@ var Collection = class {
         continue;
       }
       if (DerivationExecutor === null) {
-        ({ DerivationExecutor } = await import("./executor-CBTNU5VZ.js"));
+        ({ DerivationExecutor } = await import("./executor-EUPYHCLU.js"));
       }
       for (const run of runs) {
         const ctx = { vault: this.derivationSource.getReadOnlyFacade() };
@@ -3140,7 +3156,7 @@ var Collection = class {
           const outputCollection = this.derivationSource.getCollection(outSpec.collection);
           const txCtx = this.derivationSource.getActiveTxContext();
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-WS22Q5WH.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-BDKLP5GG.js");
             const prior = await loadFanoutSidecar(this.adapter, this.vault, spec.source, run.runId, key, this.getDEK, this.storeCiphertext);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -3260,7 +3276,7 @@ var Collection = class {
     let count = 0;
     for (const id of ids) {
       const env = await this.adapter.get(this.vault, this.name, id);
-      if (!env || isTombstone(env, this.storeCiphertext)) continue;
+      if (!env || isTombstone(env, this.storeCiphertext) || isDeleteMarker(env)) continue;
       const decoded = await this.codec.decryptRecord(env, { skipValidation: true, id });
       if (decoded === null) continue;
       const record = decoded;
@@ -3389,7 +3405,15 @@ var Collection = class {
     }
     const previousEnvelope = await this.adapter.get(this.vault, this.name, id);
     const previousPayloadHash = await this.historyStrategy.envelopePayloadHash(previousEnvelope);
-    await this.adapter.delete(this.vault, this.name, id);
+    let markerVersion;
+    if (this.onDirty) {
+      const live = previousEnvelope;
+      if (!live || isTombstone(live, this.storeCiphertext) || isDeleteMarker(live)) return;
+      markerVersion = live._v + 1;
+      await this.adapter.put(this.vault, this.name, id, buildDeleteMarker(markerVersion, this.keyring.userId));
+    } else {
+      await this.adapter.delete(this.vault, this.name, id);
+    }
     if (this.ledger) {
       await this.ledger.append({
         op: "delete",
@@ -3412,7 +3436,7 @@ var Collection = class {
         this.uniqueConstraints?.remove(id, existing.record);
       }
     }
-    await this.onDirty?.(this.name, id, "delete", existing?.version ?? 0);
+    await this.onDirty?.(this.name, id, "put", markerVersion ?? (existing?.version ?? 0) + 1);
     this.emitter.emit("change", {
       vault: this.vault,
       collection: this.name,
@@ -3464,11 +3488,12 @@ var Collection = class {
   }
   async _writeTombstone(id, actor) {
     const live = await this.adapter.get(this.vault, this.name, id);
-    if (!live || isTombstone(live, this.storeCiphertext)) return null;
+    if (!live || isTombstone(live, this.storeCiphertext) || isDeleteMarker(live)) return null;
     await this.adapter.put(this.vault, this.name, id, buildTombstone(live._v, actor));
     this.cache.delete(id);
     this.lru?.remove(id);
     this.cekCache?.remove(id);
+    await this.onDirty?.(this.name, id, "put", live._v);
     return { previousVersion: live._v };
   }
   /**
@@ -3493,7 +3518,7 @@ var Collection = class {
       for (const [outputKey, outSpec] of Object.entries(spec.outputs)) {
         if (outSpec.shape !== "array") continue;
         if (helpers === null) {
-          helpers = await import("./fanout-sidecar-WS22Q5WH.js");
+          helpers = await import("./fanout-sidecar-BDKLP5GG.js");
         }
         const sidecar = await helpers.loadFanoutSidecar(this.adapter, this.vault, spec.source, id, outputKey, this.getDEK, this.storeCiphertext);
         if (!sidecar) continue;
@@ -3527,7 +3552,7 @@ var Collection = class {
       if (mode === "eager") {
         if (executor === null) {
           ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-FGISLQIN.js"));
+          ({ MaterializedViewExecutor: executor } = await import("./executor-6LHOV7MN.js"));
         }
         await executor.refresh(reg, {
           getCollection: (name) => this.materializedViewSource.getCollection(name),
@@ -3536,7 +3561,7 @@ var Collection = class {
         });
       } else if (mode === "lazy") {
         if (staleHelpers === null) {
-          staleHelpers = await import("./stale-7Q62KVI3.js");
+          staleHelpers = await import("./stale-DP66HFT3.js");
         }
         staleHelpers.markMVStale(registry, reg.spec.name);
       }
@@ -3559,7 +3584,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-7Q62KVI3.js");
+      const { resolveStaleMVOnRead } = await import("./stale-DP66HFT3.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name);
     }
     await this.ensureHydrated();
@@ -4193,6 +4218,15 @@ var Collection = class {
   _invalidateCekCacheEntry(id) {
     this.cekCache?.remove(id);
   }
+  /** @internal Satellite fan-out revert cleanup (spec #591): drop the sync dirty entry ('revert' is
+   *  onDirty-channel-only) and re-announce the RESTORED state as a plain put/delete — `subscribe()`
+   *  only understands those two actions, and the restored record may exist again. */
+  async _compensateRevertedWrite(id) {
+    await this._invalidateCacheEntry(id);
+    await this.onDirty?.(this.name, id, "revert", 0);
+    const restored = await this.get(id);
+    this.emitter.emit("change", { vault: this.vault, collection: this.name, id, action: restored !== null ? "put" : "delete" });
+  }
   async _invalidateCacheEntry(id) {
     if (this.lazy && this.lru) {
       this.lru.remove(id);
@@ -4243,7 +4277,7 @@ var Collection = class {
     const ids = await this.adapter.list(this.vault, this.name);
     for (const id of ids) {
       const envelope = await this.adapter.get(this.vault, this.name, id);
-      if (envelope && !isTombstone(envelope, this.storeCiphertext)) {
+      if (envelope && !isTombstone(envelope, this.storeCiphertext) && !isDeleteMarker(envelope)) {
         const record = await this.codec.decryptRecord(envelope, { id, sealedAsHandles: true });
         if (record === null) continue;
         this.cache.set(id, { record, version: envelope._v });
@@ -4256,7 +4290,7 @@ var Collection = class {
   /** Hydrate from a pre-loaded snapshot (used by Vault). */
   async hydrateFromSnapshot(records) {
     for (const [id, envelope] of Object.entries(records)) {
-      if (isTombstone(envelope, this.storeCiphertext)) continue;
+      if (isTombstone(envelope, this.storeCiphertext) || isDeleteMarker(envelope)) continue;
       const record = await this.codec.decryptRecord(envelope, { id, sealedAsHandles: true });
       if (record === null) continue;
       this.cache.set(id, { record, version: envelope._v });
@@ -4704,14 +4738,14 @@ var Collection = class {
   /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
   async _ensureClassifiedMarker() {
     if (this._markerPersisted || this.vdigFields === null) return;
-    const { persistClassifiedMarkerForFields } = await import("./config-drift-3UIJVI5G.js");
+    const { persistClassifiedMarkerForFields } = await import("./config-drift-LRKCC3VZ.js");
     await persistClassifiedMarkerForFields(this.adapter, this.vault, this.name, this.vdigFields, await this.getDEK(this.name));
     this._markerPersisted = true;
   }
   /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
   async _classifiedMarkerDigestOnly() {
     if (this._markerDigestOnlyCache !== void 0) return this._markerDigestOnlyCache;
-    const { readClassifiedMarkerDigestOnly } = await import("./config-drift-3UIJVI5G.js");
+    const { readClassifiedMarkerDigestOnly } = await import("./config-drift-LRKCC3VZ.js");
     this._markerDigestOnlyCache = await readClassifiedMarkerDigestOnly(this.adapter, this.vault, this.name, await this.getDEK(this.name));
     return this._markerDigestOnlyCache;
   }
@@ -5758,7 +5792,7 @@ var VaultLinks = class {
 // src/with-shape/links/lazy-handle.ts
 function makeLazyLinkSetHandle(d) {
   let engine = null;
-  const load = () => engine ??= import("./link-set-UQEIYQAM.js").then(
+  const load = () => engine ??= import("./link-set-62Y36TOG.js").then(
     ({ LinkSet }) => new LinkSet(d.adapter, d.vault, d.name, d.spec, d.encrypted, d.getDEK, d.actor, d.emitter, d.endpointExists)
   );
   return {
@@ -5772,6 +5806,423 @@ function makeLazyLinkSetHandle(d) {
   };
 }
 
+// src/with-shape/satellites/registry.ts
+var SatelliteRegistry = class {
+  byBase = /* @__PURE__ */ new Map();
+  bySat = /* @__PURE__ */ new Map();
+  byJoin = /* @__PURE__ */ new Map();
+  poisoned = /* @__PURE__ */ new Map();
+  locks = /* @__PURE__ */ new Map();
+  register(spec) {
+    if (this.byBase.has(spec.base)) {
+      throw new SatelliteConfigError(`R-S1: base "${spec.base}" already has satellite "${this.byBase.get(spec.base).satellite}" \u2014 v1 allows exactly one satellite per base.`);
+    }
+    if (this.byBase.has(spec.satellite)) {
+      throw new SatelliteConfigError(`R-S3: "${spec.satellite}" is itself registered as a base (of "${this.byBase.get(spec.satellite).satellite}") \u2014 no satellite-of-satellite chains.`);
+    }
+    const taken = (n) => this.byBase.has(n) || this.bySat.has(n) || this.byJoin.has(n);
+    if (spec.joined !== void 0 && taken(spec.joined)) {
+      throw new SatelliteConfigError(`R-S5: joined name "${spec.joined}" collides with an existing pair member or joined name.`);
+    }
+    this.byBase.set(spec.base, spec);
+    this.bySat.set(spec.satellite, spec);
+    if (spec.joined !== void 0) this.byJoin.set(spec.joined, spec);
+  }
+  satelliteOf(base) {
+    return this.byBase.get(base) ?? null;
+  }
+  bySatellite(name) {
+    return this.bySat.get(name) ?? null;
+  }
+  byJoined(name) {
+    return this.byJoin.get(name) ?? null;
+  }
+  isPairMember(name) {
+    return this.byBase.has(name) || this.bySat.has(name);
+  }
+  allSpecs() {
+    return [...this.byBase.values()];
+  }
+  expandNames(names) {
+    const out = new Set(names);
+    for (const n of names) {
+      const asBase = this.byBase.get(n);
+      if (asBase) out.add(asBase.satellite);
+      const asSat = this.bySat.get(n);
+      if (asSat) out.add(asSat.base);
+    }
+    return [...out];
+  }
+  poison(satellite, reason) {
+    this.poisoned.set(satellite, reason);
+  }
+  assertNotPoisoned(satellite) {
+    const reason = this.poisoned.get(satellite);
+    if (reason !== void 0) throw new SatelliteConfigError(reason);
+  }
+  /** Per-base async mutex: chains sections on a stored promise tail. */
+  async withPairLock(base, fn2) {
+    const tail = this.locks.get(base) ?? Promise.resolve();
+    let release;
+    const gate = new Promise((res) => {
+      release = res;
+    });
+    this.locks.set(base, tail.then(() => gate));
+    await tail;
+    try {
+      return await fn2();
+    } finally {
+      release();
+    }
+  }
+};
+
+// src/with-shape/satellites/declare.ts
+function declareSatellite(ctx, collectionName, options, existingRegistry) {
+  if (existingRegistry !== null) {
+    const existing = existingRegistry.bySatellite(collectionName);
+    if (existing) {
+      const same = existing.base === options.satelliteOf && hashFields(existing.fields) === hashFields(options.fields ?? []) && (existing.joined ?? null) === (options.joined ?? null);
+      if (!same) {
+        throw new SatelliteConfigError(`R-S9: "${collectionName}" re-declared divergently within this session (base/fields/joined mismatch).`);
+      }
+      return existingRegistry;
+    }
+  }
+  const spec = validateSatelliteDeclaration({
+    satellite: collectionName,
+    satelliteOf: options.satelliteOf,
+    fields: options.fields,
+    joined: options.joined,
+    baseIsSatellite: (existingRegistry?.bySatellite(options.satelliteOf) ?? null) !== null,
+    // R-S8 direction (i): refuse if EITHER this declaration sets crdt, OR the
+    // base was already constructed with crdt mode before this pairing.
+    crdtMode: options.crdt !== void 0 || ctx.getBaseCrdt(options.satelliteOf) !== void 0,
+    joinedCollidesWithCollection: options.joined !== void 0 && ctx.collectionExists(options.joined)
+  });
+  if (ctx.forgetSubjects[spec.base] !== void 0 && options.perRecordKeys !== true) {
+    throw new SatelliteConfigError(`R-S7: satellite "${collectionName}" of forget-covered base "${spec.base}" must declare perRecordKeys.`);
+  }
+  let reg = existingRegistry;
+  if (reg === null) {
+    const created = new SatelliteRegistry();
+    ctx.registerPoisonHook((e) => {
+      if (e.vault === ctx.vaultName) created.assertNotPoisoned(e.collection);
+    });
+    ctx.forEachSyncEngine((e) => e.setPairExpander((names) => created.expandNames(names)));
+    reg = created;
+  }
+  reg.register(spec);
+  ctx.forEachSyncEngine((e) => e.remirrorPairResolvers([spec.base, spec.satellite]));
+  const registry = reg;
+  const baseSchema = ctx.getBaseSchema(spec.base);
+  void import("./post-register-DCJ2SRVG.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
+  });
+  return reg;
+}
+
+// src/with-shape/satellites/raw-target.ts
+var RAW_TARGET = /* @__PURE__ */ Symbol("noydb.satellite.rawTarget");
+
+// src/with-shape/satellites/fanout.ts
+function unwrap(handle) {
+  return handle[RAW_TARGET] ?? handle;
+}
+async function revertAndCompensate(deps, executed) {
+  for (const leg of [...executed].reverse()) {
+    try {
+      if (leg.prior !== null) await deps.adapter.put(deps.vaultName, leg.coll, leg.id, leg.prior);
+      else await deps.adapter.delete(deps.vaultName, leg.coll, leg.id);
+      await leg.handle._compensateRevertedWrite(leg.id);
+    } catch {
+    }
+  }
+}
+async function joinedPut(deps, id, record) {
+  deps.registry.assertNotPoisoned(deps.spec.satellite);
+  const base = unwrap(deps.base());
+  const satellite = unwrap(deps.satellite());
+  const satFields = new Set(deps.spec.fields);
+  const baseRec = {};
+  const satRec = {};
+  for (const [k, v] of Object.entries(record)) (satFields.has(k) ? satRec : baseRec)[k] = v;
+  await base.validateInput(baseRec);
+  await satellite.validateInput(satRec);
+  return deps.registry.withPairLock(deps.spec.base, async () => {
+    const executed = [];
+    const run = async (handle, coll, rec) => {
+      executed.push({ coll, id, prior: await deps.adapter.get(deps.vaultName, coll, id), handle });
+      await handle.put(id, rec);
+    };
+    try {
+      await run(base, deps.spec.base, baseRec);
+      await run(satellite, deps.spec.satellite, satRec);
+    } catch (err) {
+      await revertAndCompensate(deps, executed);
+      throw err;
+    }
+  });
+}
+async function pairDelete(deps, id) {
+  const base = unwrap(deps.base());
+  const satellite = unwrap(deps.satellite());
+  return deps.registry.withPairLock(deps.spec.base, async () => {
+    const executed = [];
+    const run = async (handle, coll) => {
+      executed.push({ coll, id, prior: await deps.adapter.get(deps.vaultName, coll, id), handle });
+      await handle.delete(id);
+    };
+    try {
+      await run(satellite, deps.spec.satellite);
+      await run(base, deps.spec.base);
+    } catch (err) {
+      await revertAndCompensate(deps, executed);
+      throw err;
+    }
+  });
+}
+
+// src/with-shape/satellites/proxy.ts
+async function listWithIds(target) {
+  const records = await target.list();
+  const ids = [...target.cache.keys()];
+  const out = [];
+  for (let i = 0; i < records.length; i++) {
+    const id = ids[i];
+    if (id !== void 0) out.push([id, records[i]]);
+  }
+  return out;
+}
+async function filterLiveHits(hits, adapter, vaultName, base) {
+  const live = await Promise.all(hits.map((h) => isBaseLive(adapter, vaultName, base, h.id)));
+  return hits.filter((_, i) => live[i]);
+}
+function makeSatelliteProxy(target, spec, registry) {
+  const adapter = target.adapter;
+  const vaultName = target.vault;
+  const queryNotExistenceFiltered = () => {
+    throw new SatelliteConfigError(
+      `satellite "${spec.satellite}": query() is not existence-filtered. Query's terminal methods (toArray/first/count) read the in-memory cache synchronously, while existence authority (\xA7 Convergence & existence authority, rule 1) requires an async, undecrypted check against live base state \u2014 the two shapes don't compose without either breaking query()'s synchronous contract or accepting a check that misses out-of-band base mutations. Use list() (or get()) for existence-safe reads on satellite collections.`
+    );
+  };
+  const getOne = async (id) => {
+    if (!await isBaseLive(adapter, vaultName, spec.base, id)) return null;
+    return target.get(id);
+  };
+  const putOne = async (id, record) => {
+    return registry.withPairLock(spec.base, async () => {
+      registry.assertNotPoisoned(spec.satellite);
+      if (!await isBaseLive(adapter, vaultName, spec.base, id)) {
+        throw new SatelliteConfigError(
+          `R-S6: satellite "${spec.satellite}" put for "${id}" with no live base record in "${spec.base}" \u2014 create the base first (or write through the joined handle).`
+        );
+      }
+      return target.put(id, record);
+    });
+  };
+  const overrides = {
+    get: getOne,
+    async list() {
+      const live = await liveBaseIdSet(adapter, vaultName, spec.base);
+      const pairs = await listWithIds(target);
+      return pairs.filter(([id]) => live.has(id)).map(([, record]) => record);
+    },
+    query: queryNotExistenceFiltered,
+    put: putOne,
+    // #591 review I1: the real `getMany` loops `this.get(id)` bound to the raw
+    // target, never this proxy's existence-filtered `get` — same Map<id, T|null>
+    // shape, built from the overridden single-get instead.
+    async getMany(ids) {
+      const result = /* @__PURE__ */ new Map();
+      for (const id of ids) result.set(id, await getOne(id));
+      return result;
+    },
+    // #591 review I1: the real `putMany` (non-atomic) loops `this.put(id, record)`
+    // bound to the raw target, bypassing R-S6/pair-lock/poison per item; looping
+    // through the overridden single-put here restores that per-item enforcement
+    // while preserving the real putMany's { ok, success, failures } shape — a
+    // refused item becomes a failure entry, not a thrown error. Atomic mode is a
+    // single transaction by design (looping per-item `put` would break its
+    // all-or-nothing revert guarantee), so instead the WHOLE call is refused
+    // with R-S6 up front, under the pair lock + poison check, if any id lacks a
+    // live base — only then does it delegate to the real atomic executor.
+    async putMany(entries, options) {
+      if (options?.atomic) {
+        return registry.withPairLock(spec.base, async () => {
+          registry.assertNotPoisoned(spec.satellite);
+          for (const [id] of entries) {
+            if (!await isBaseLive(adapter, vaultName, spec.base, id)) {
+              throw new SatelliteConfigError(
+                `R-S6: satellite "${spec.satellite}" putMany(atomic) refused \u2014 "${id}" has no live base record in "${spec.base}".`
+              );
+            }
+          }
+          return target.putMany(entries, options);
+        });
+      }
+      const success = [];
+      const failures = [];
+      for (const [id, record] of entries) {
+        try {
+          await putOne(id, record);
+          success.push(id);
+        } catch (error) {
+          failures.push({ id, error });
+        }
+      }
+      return { ok: failures.length === 0, success, failures };
+    },
+    // No `deleteMany` override: the real `deleteMany` loops the raw
+    // `this.delete(id)` too, but this proxy never overrides single `delete`
+    // (satellite delete is legal, unguarded — see makeBaseProxy for the leg
+    // that DOES need fan-out) — there is nothing for a bulk delete to bypass.
+    // #591 Task 9: search/retrieve/similarTo answer from the search facade's
+    // own cache/index (never the get/list overrides above), so they need
+    // their own existence post-filter — every retrieval surface the facade
+    // exposes is covered here.
+    async search(field, query, opts) {
+      const hits = await target.search(field, query, opts);
+      return filterLiveHits(hits, adapter, vaultName, spec.base);
+    },
+    async retrieve(query, opts) {
+      const hits = await target.retrieve(query, opts);
+      return filterLiveHits(hits, adapter, vaultName, spec.base);
+    },
+    async similarTo(vector, opts) {
+      const hits = await target.similarTo(vector, opts);
+      return filterLiveHits(hits, adapter, vaultName, spec.base);
+    },
+    // #591 Task 9 review fix: findByDet/queryByDet scan envelopes straight
+    // off the adapter (kernel/enclave/record-keys/deterministic.ts) and
+    // return BARE records (no id), so a post-filter can't correlate a match
+    // back to its base row. Instead the scan itself is scoped: re-run the
+    // same det functions over the collection's own DeterministicContext
+    // (`detContext()` is private like `adapter`/`cache` above) with its
+    // `adapter.list` narrowed to live-base ids — a dead-base match is then
+    // never visited, so findByDet correctly continues to a later live match
+    // rather than short-circuiting on a ghost.
+    async findByDet(field, value) {
+      return findByDet(liveScopedDetContext(), field, value);
+    },
+    async queryByDet(field, value) {
+      return queryByDet(liveScopedDetContext(), field, value);
+    }
+  };
+  const liveScopedDetContext = () => {
+    const ctx = target.detContext();
+    const raw = ctx.adapter;
+    return {
+      ...ctx,
+      adapter: {
+        ...raw,
+        get: raw.get.bind(raw),
+        async list(v, c) {
+          const ids = await raw.list(v, c);
+          const live = await Promise.all(ids.map((id) => isBaseLive(adapter, vaultName, spec.base, id)));
+          return ids.filter((_, i) => live[i]);
+        }
+      }
+    };
+  };
+  return new Proxy(target, {
+    get(t, prop, _recv) {
+      if (prop === RAW_TARGET) return t;
+      if (typeof prop === "string" && prop in overrides) return overrides[prop];
+      const v = Reflect.get(t, prop, t);
+      return typeof v === "function" ? v.bind(t) : v;
+    }
+  });
+}
+function makeBaseProxy(target, spec, registry, satellite) {
+  const adapter = target.adapter;
+  const vaultName = target.vault;
+  const deleteOne = async (id) => {
+    return pairDelete({ spec, base: () => target, satellite, adapter, vaultName, registry }, id);
+  };
+  const overrides = {
+    delete: deleteOne,
+    async deleteMany(ids) {
+      const success = [];
+      const failures = [];
+      for (const id of ids) {
+        try {
+          await deleteOne(id);
+          success.push(id);
+        } catch (error) {
+          failures.push({ id, error });
+        }
+      }
+      return { ok: failures.length === 0, success, failures };
+    }
+  };
+  return new Proxy(target, {
+    get(t, prop, _recv) {
+      if (prop === RAW_TARGET) return t;
+      if (typeof prop === "string" && prop in overrides) return overrides[prop];
+      const v = Reflect.get(t, prop, t);
+      return typeof v === "function" ? v.bind(t) : v;
+    }
+  });
+}
+
+// src/with-shape/satellites/joined.ts
+function makeJoinedHandle(spec, deps) {
+  const base = () => deps.base();
+  const satellite = () => deps.satellite();
+  const adapter = deps.adapter;
+  const nullSat = () => Object.fromEntries(spec.fields.map((f) => [f, null]));
+  const merge = (b, s) => ({ ...nullSat(), ...s ?? {}, ...b });
+  return {
+    async get(id) {
+      if (!await isBaseLive(adapter, deps.vaultName, spec.base, id)) return null;
+      const b = await base().get(id);
+      if (b === null) return null;
+      const s = await satellite().get(id);
+      return merge(b, s);
+    },
+    async put(id, record) {
+      await joinedPut(deps, id, record);
+    },
+    async delete(id) {
+      await pairDelete(deps, id);
+    },
+    async list() {
+      const live = await liveBaseIdSet(adapter, deps.vaultName, spec.base);
+      const pairs = await listWithIds(base());
+      const out = [];
+      for (const [id, b] of pairs) {
+        if (!live.has(id)) continue;
+        out.push(merge(b, await satellite().get(id)));
+      }
+      return out;
+    },
+    async describe() {
+      const [b, s] = await Promise.all([base().describe({}), satellite().describe({})]);
+      return {
+        collection: spec.joined ?? `${spec.base}+${spec.satellite}`,
+        fields: [...b.fields, ...s.fields],
+        meta: { label: spec.joined ?? spec.base }
+      };
+    }
+  };
+}
+
+// src/with-shape/satellites/forget.ts
+function expandRefsWithSatellites(refs, registry) {
+  if (registry === null) return refs;
+  const out = [];
+  let anySat = false;
+  for (const ref2 of refs) {
+    const spec = registry.satelliteOf(ref2.collection);
+    if (spec) {
+      anySat = true;
+      out.push({ collection: spec.satellite, id: ref2.id, satelliteOf: ref2.collection });
+    }
+    out.push(ref2);
+  }
+  return anySat ? out : refs;
+}
+
 // src/with-shape/schema-update/gate.ts
 var SchemaUpdateGate = class {
   #decision;
@@ -6110,6 +6561,8 @@ var Vault = class {
    */
   reloadKeyring;
   collectionCache = /* @__PURE__ */ new Map();
+  satelliteRegistry = null;
+  // spec #591, archetype-③
   /** Vault-level schema cutover fence/controller. */
   schemaFence;
   /** Per-client heartbeat/watcher; started lazily on cutover registration. */
@@ -6401,6 +6854,29 @@ var Vault = class {
     if (isSecretBearingReservedCollection(collectionName)) {
       throw new ReservedCollectionNameError(collectionName);
     }
+    if (this.satelliteRegistry?.byJoined(collectionName)) {
+      throw new SatelliteConfigError(`"${collectionName}" is a joined handle \u2014 use vault.joined('${collectionName}'), not vault.collection().`);
+    }
+    if (options?.crdt !== void 0 && this.satelliteRegistry?.isPairMember(collectionName)) {
+      throw new SatelliteConfigError("R-S8: crdtMode is refused on either member of a satellite pair in v1 (revert cannot compensate a merge).");
+    }
+    if (options?.satelliteOf !== void 0) {
+      this.satelliteRegistry = declareSatellite({
+        adapter: this.adapter,
+        vaultName: this.name,
+        forgetSubjects: this.forgetStrategy.subjects,
+        getDEK: this.getDEK,
+        getBaseSchema: (base) => this.collectionCache.get(base)?.getSchema(),
+        getBaseCrdt: (base) => this.collectionCache.get(base)?.getConfig()?.crdt,
+        collectionExists: (name) => this.collectionCache.has(name),
+        registerPoisonHook: (hook) => {
+          this.noydb._writeHooks.onBeforeWrite(hook);
+        },
+        forEachSyncEngine: (fn2) => {
+          this.noydb._forEachSyncEngine(this.name, fn2);
+        }
+      }, collectionName, { ...options, satelliteOf: options.satelliteOf }, this.satelliteRegistry);
+    }
     let coll = this.collectionCache.get(collectionName);
     if (coll && options?.moneyFields) {
       coll._applyMoneyFields(options.moneyFields);
@@ -6461,7 +6937,7 @@ var Vault = class {
         const strategies = options.schemaUpdate ?? [];
         const work = (async () => {
           const dek = await this.getDEK(collectionName);
-          const { persistSchemaIfNeeded } = await import("./register-V5AQTXNI.js");
+          const { persistSchemaIfNeeded } = await import("./register-5NRE7HBZ.js");
           const result = await persistSchemaIfNeeded({
             store: this.adapter,
             vault: this.name,
@@ -6640,7 +7116,7 @@ var Vault = class {
         const work = (async () => {
           try {
             const dek = await this.getDEK(collectionName);
-            await (await import("./register-V5AQTXNI.js")).persistSchemaIfNeeded({
+            await (await import("./register-5NRE7HBZ.js")).persistSchemaIfNeeded({
               store: this.adapter,
               vault: this.name,
               collectionName,
@@ -6656,8 +7132,27 @@ var Vault = class {
         this._pendingSchemaWrites.push(work);
       }
     }
+    if (this.satelliteRegistry) {
+      const spec = this.satelliteRegistry.bySatellite(collectionName);
+      if (spec) return makeSatelliteProxy(coll, spec, this.satelliteRegistry);
+      const baseSpec = this.satelliteRegistry.satelliteOf(collectionName);
+      if (baseSpec) return makeBaseProxy(coll, baseSpec, this.satelliteRegistry, () => this.collection(baseSpec.satellite));
+    }
     return coll;
   }
+  /** Full-record handle for a satellite pair registered with `joined:` (spec #591). Narrow type — not a Collection. */
+  joined(name) {
+    const spec = this.satelliteRegistry?.byJoined(name);
+    if (!spec) throw new SatelliteConfigError(`No joined handle "${name}" is registered \u2014 declare it via collection(satellite, { joined: '${name}' }).`);
+    return makeJoinedHandle(spec, {
+      spec,
+      base: () => this.collection(spec.base),
+      satellite: () => this.collection(spec.satellite),
+      adapter: this.adapter,
+      vaultName: this.name,
+      registry: this.satelliteRegistry
+    });
+  }
   /**
    * Await all background persisted-schema writes triggered by
    * `collection({ persistJsonSchema: true })` calls on this vault.
@@ -6696,6 +7191,45 @@ var Vault = class {
     if (!coll) return;
     await coll._applyRemoteChange(docId, action);
   }
+  /** @internal #598: refresh cache entries a sync-applied write rewrote underneath us. No-op if not loaded this session. */
+  async _invalidateSyncApplied(collection, id) {
+    const coll = this.collectionCache.get(collection);
+    if (!coll) return;
+    coll._invalidateCekCacheEntry(id);
+    await coll._invalidateCacheEntry(id);
+  }
+  /**
+   * @internal #589 → #604. Physically remove delete markers with `_ts` strictly
+   * older than `before` (ISO timestamp), across `collections` (or all data
+   * collections). Returns the count removed.
+   *
+   * SAFETY: purging a marker RE-OPENS the #589 resurrection window for any peer
+   * offline since before the cutoff — never-GC is safe precisely because the marker
+   * is always present to win convergence. This is an operator-asserted safe-point
+   * ONLY; #604's period-close lifecycle is what earns that assertion. Do not call
+   * it on live/unsettled data.
+   *
+   * Emits no ledger/event yet — #604's period-close, the only intended caller, owns
+   * the audit record.
+   *
+   * Purges the local adapter only; the operator must purge every sync target too, or
+   * the next pull re-imports the markers (benign — they still read deleted — but no
+   * space is reclaimed). #604 owns cross-target purge.
+   */
+  async _purgeDeleteMarkers(before, collections) {
+    const snapshot = await this.adapter.loadAll(this.name);
+    let removed = 0;
+    for (const [coll, records] of Object.entries(snapshot)) {
+      if (collections && !collections.includes(coll)) continue;
+      for (const [id, env] of Object.entries(records)) {
+        if (isDeleteMarker(env) && env._ts < before) {
+          await this.adapter.delete(this.name, coll, id);
+          removed++;
+        }
+      }
+    }
+    return removed;
+  }
   /**
    * For a detected conflict: capture this tab's clobbered record,
    * read the common ancestor from history, converge the cache to the store's
@@ -7464,6 +7998,7 @@ var Vault = class {
       throw new ForgetStrategyNotConfiguredError();
     }
     const refs = await lookupSubject(this.adapter, this.name, this.getDEK, this.encrypted, subjectId);
+    const allRefs = expandRefsWithSatellites(refs, this.satelliteRegistry);
     let recordsShredded = 0;
     let historyVersionsShredded = 0;
     const collections = /* @__PURE__ */ new Set();
@@ -7479,9 +8014,10 @@ var Vault = class {
     const indexResidue = [];
     const blobsEnabled = this.blobStrategy !== void 0;
     const actor = this.keyring.userId;
-    for (const ref2 of refs) {
+    for (const ref2 of allRefs) {
       const coll = this.collection(ref2.collection);
-      const perRecordKeys = this.forgetStrategy.subjects[ref2.collection] !== void 0;
+      const satelliteOf = ref2.satelliteOf;
+      const perRecordKeys = this.forgetStrategy.subjects[satelliteOf ?? ref2.collection] !== void 0;
       const live = await this.adapter.get(this.name, ref2.collection, ref2.id);
       if (perRecordKeys && live && live._data && !hasPerRecordKey(live)) {
         unmigratedRecords.push(`${ref2.collection}:${ref2.id}`);
@@ -7513,7 +8049,17 @@ var Vault = class {
       } catch {
         sealedCekResidue.push(`${ref2.collection}:${ref2.id}`);
       }
-      const shred = await coll._writeTombstone(ref2.id, actor);
+      let shred;
+      try {
+        shred = await coll._writeTombstone(ref2.id, actor);
+      } catch (cause) {
+        if (satelliteOf === void 0) throw cause;
+        throw new SatelliteConfigError(
+          // R-S4: abort the whole forget rather than leave the heavy side un-erased
+          `R-S4: forget could not fan out to satellite "${ref2.collection}" \u2014 aborting rather than leaving the heavy side`,
+          { cause }
+        );
+      }
       if (shred !== null) {
         recordsShredded++;
         collections.add(ref2.collection);
@@ -7723,7 +8269,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-IMNMHWTM.js"),
+      import("./registry-5QLETK3Q.js"),
       import("./read-only-facade-5ADRJVTM.js")
     ]);
     const registry = new DerivationRegistry();
@@ -7754,7 +8300,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-K6VUQXKV.js");
+    const { MaterializedViewRegistry } = await import("./registry-DYTNLOJC.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -7778,7 +8324,7 @@ var Vault = class {
    */
   async _initOverlayedViews(handles) {
     if (handles.length === 0) return;
-    const { OverlayedViewRegistry } = await import("./registry-ZVO3T4M5.js");
+    const { OverlayedViewRegistry } = await import("./registry-HSNQ4NBP.js");
     const registry = new OverlayedViewRegistry();
     const mvRegistry = this.materializedViewRegistry;
     const overlayNames = /* @__PURE__ */ new Set();
@@ -7825,13 +8371,13 @@ var Vault = class {
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-FGISLQIN.js");
+    const { MaterializedViewExecutor } = await import("./executor-6LHOV7MN.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this
     });
-    const { clearMVStale } = await import("./stale-7Q62KVI3.js");
+    const { clearMVStale } = await import("./stale-DP66HFT3.js");
     clearMVStale(registry, name);
     return result;
   }
@@ -7847,7 +8393,7 @@ var Vault = class {
     if (registry === null) return { derived: 0, failed: 0 };
     const strategies = registry.strategiesForSource(sourceCollection);
     if (strategies.length === 0) return { derived: 0, failed: 0 };
-    const { DerivationExecutor } = await import("./executor-CBTNU5VZ.js");
+    const { DerivationExecutor } = await import("./executor-EUPYHCLU.js");
     const sourceColl = this.collection(sourceCollection);
     const records = await sourceColl.list();
     const ctx = { vault: this.derivationFacade ?? new (await import("./read-only-facade-5ADRJVTM.js")).ReadOnlyVaultFacade(this, "derivation") };
@@ -7872,7 +8418,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-WS22Q5WH.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-BDKLP5GG.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key, this.getDEK, this.encrypted);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -8094,7 +8640,7 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-BQNIEHZE.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-FDOXXHNG.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
         "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (passphrase) first."
@@ -8116,7 +8662,7 @@ var Vault = class {
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-BQNIEHZE.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-FDOXXHNG.js");
     await revokeDelegation(this.adapter, this.name, id);
     void DELEGATIONS_COLLECTION;
   }
@@ -8332,7 +8878,7 @@ var Vault = class {
    * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
    */
   async dumpSchema(opts = {}) {
-    const { dumpVaultSchema } = await import("./walk-T65TZDN2.js");
+    const { dumpVaultSchema } = await import("./walk-3SB25HF2.js");
     return dumpVaultSchema(this, opts);
   }
   /**
@@ -8467,7 +9013,7 @@ var Vault = class {
    * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md
    */
   async getPublicEnvelope(opts = {}) {
-    const { readPublicEnvelope } = await import("./public-envelope-MRN5YYZZ.js");
+    const { readPublicEnvelope } = await import("./public-envelope-CBRIJORQ.js");
     return readPublicEnvelope(this.adapter, this.name, opts);
   }
   /**
@@ -8482,7 +9028,7 @@ var Vault = class {
    * both modes round-trip cleanly.
    */
   async dump() {
-    const { dumpVault } = await import("./backup-OPONO6Q5.js");
+    const { dumpVault } = await import("./backup-7PX6NDKT.js");
     return dumpVault(this.backupContext());
   }
   /**
@@ -8534,7 +9080,7 @@ var Vault = class {
    * — there's no chain to verify against.
    */
   async load(backupJson) {
-    const { loadVault } = await import("./backup-OPONO6Q5.js");
+    const { loadVault } = await import("./backup-7PX6NDKT.js");
     return loadVault(this.backupContext(), backupJson);
   }
   /**
@@ -8566,7 +9112,7 @@ var Vault = class {
    * way to detect tampering of an in-place vault.
    */
   async verifyBackupIntegrity() {
-    const { verifyBackupIntegrity } = await import("./backup-OPONO6Q5.js");
+    const { verifyBackupIntegrity } = await import("./backup-7PX6NDKT.js");
     return verifyBackupIntegrity(this.backupContext());
   }
   /**
@@ -8784,7 +9330,7 @@ var Vault = class {
    * is the live validator object, not a serialization of it).
    */
   async exportJSON(opts = {}) {
-    const { exportVaultJSON } = await import("./backup-OPONO6Q5.js");
+    const { exportVaultJSON } = await import("./backup-7PX6NDKT.js");
     return exportVaultJSON(this.backupContext(), opts);
   }
 };
@@ -10656,7 +11202,7 @@ var Noydb = class {
       if (!facade) return;
       const ctx = { existing, vault: facade, userId: e.userId, role: e.role };
       await registry.runChecks(e.collection, incoming, ctx);
-      const { GuardExecutor } = await import("./executor-DJHNSTIR.js");
+      const { GuardExecutor } = await import("./executor-KZ4B3PRT.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, e.docId, existing, incoming, e.computedFieldNames);
       }
@@ -10821,7 +11367,8 @@ var Noydb = class {
       onDirty: targets.length > 0 ? async (coll, id, action, version) => {
         for (const [key, engine] of this.syncEngines) {
           if (key === name || key.startsWith(`${name}::`)) {
-            void engine.trackChange(coll, id, action, version);
+            if (action === "revert") void engine.removeDirty(coll, id);
+            else void engine.trackChange(coll, id, action, version);
           }
         }
       } : void 0,
@@ -10873,6 +11420,9 @@ var Noydb = class {
         return refreshed;
       } : void 0
     });
+    this._forEachSyncEngine(name, (engine) => {
+      engine.setCacheInvalidator((collection, id) => comp._invalidateSyncApplied(collection, id));
+    });
     await comp._initGuards(this.options.guardStrategies ?? []);
     await comp._initDerivations(this.options.derivationStrategies ?? []);
     await comp._initMaterializedViews(this.options.materializedViewStrategies ?? []);
@@ -11487,6 +12037,9 @@ var Noydb = class {
     }
     return engine;
   }
+  _forEachSyncEngine(vault, fn2) {
+    for (const [key, engine] of this.syncEngines) if (key === vault || key.startsWith(`${vault}::`)) fn2(engine);
+  }
   // ─── Events ────────────────────────────────────────────────────
   on(event, handler) {
     this.emitter.on(event, handler);
@@ -11909,7 +12462,7 @@ var Noydb = class {
         "setPublicEnvelope: the public-envelope feature is not enabled. Pass `publicEnvelope: true` (or a schema object) to `createNoydb`."
       );
     }
-    const { loadPublicEnvelope, savePublicEnvelope, resolveSchema, validatePublicEnvelopeInput } = await import("./public-envelope-MRN5YYZZ.js");
+    const { loadPublicEnvelope, savePublicEnvelope, resolveSchema, validatePublicEnvelopeInput } = await import("./public-envelope-CBRIJORQ.js");
     const schema = resolveSchema(this.options.publicEnvelope);
     validatePublicEnvelopeInput(input, schema);
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -11938,7 +12491,7 @@ var Noydb = class {
    * regardless).
    */
   async getPublicEnvelope(vault, opts = {}) {
-    const { readPublicEnvelope } = await import("./public-envelope-MRN5YYZZ.js");
+    const { readPublicEnvelope } = await import("./public-envelope-CBRIJORQ.js");
     return readPublicEnvelope(this.options.store, vault, opts);
   }
   // ─── Auth introspection ─────────────────────────────────────────
@@ -12129,9 +12682,9 @@ async function createNoydb(options) {
     throw new ValidationError("A secret (passphrase) or getKeyring callback is required when encryption is enabled");
   }
   if (!options.coordinationStrategy) options = { ...options, coordinationStrategy: await createDefaultCoordinationProvider(options.store) };
-  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-JOXUNSKP.js")).createUserApi };
+  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-Z66JMGOU.js")).createUserApi };
   if (!options.policyFactory) {
-    const policyModule = await import("./policy-YIKUH4AD.js");
+    const policyModule = await import("./policy-SXPLTQS4.js");
     options = { ...options, policyFactory: policyModule.createNoydbPolicy, policyCheckGateFn: policyModule.checkGate };
   }
   return new Noydb(options);
@@ -12166,4 +12719,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-IEUIUSBO.js.map
+//# sourceMappingURL=chunk-5K7KZMXG.js.map