@noy-db/hub 0.3.0-pre.7 → 0.3.0-pre.9

package/dist/{chunk-5K7KZMXG.js → chunk-4C4WBS4V.js}

@@ -1,6 +1,6 @@
 import {
   loadVaultPolicy
-} from "./chunk-NO53W6O5.js";
+} from "./chunk-X66MXMR5.js";
 import {
   jsonSchemaToFields
 } from "./chunk-TQ3REHVF.js";
@@ -9,31 +9,31 @@ import {
   SEQUENCE_COLLECTION,
   compileSequenceFormat,
   resolveSequenceKey
-} from "./chunk-IEKK2XI4.js";
+} from "./chunk-5SAZMBW7.js";
 import {
   LinkIntegrityError,
   isLinkCollectionName,
   linkCollectionName,
   linkRowKey
-} from "./chunk-V76PHWLE.js";
+} from "./chunk-PEDZFFKW.js";
 import {
   hashFields,
   validateSatelliteDeclaration
-} from "./chunk-5JQMX2EH.js";
+} from "./chunk-ICV32FPK.js";
 import {
   loadFence
-} from "./chunk-WRLPV6SI.js";
+} from "./chunk-CTSFKDGA.js";
 import {
   InvertedIndex,
   MemoryIndexStore,
   NO_SEARCH,
   VectorSet,
   buildPersistedIndexCallbacks
-} from "./chunk-CP3GUIAN.js";
+} from "./chunk-FGOGS7CE.js";
 import {
   derivePersistedSchema,
   isZod4Schema
-} from "./chunk-55LSDABW.js";
+} from "./chunk-HBTT7YQX.js";
 import {
   isBaseLive,
   liveBaseIdSet
@@ -42,7 +42,7 @@ import {
   CustodyApi,
   NO_CARGO,
   NO_CUSTODY
-} from "./chunk-RUWEHFRB.js";
+} from "./chunk-42KVY3OC.js";
 import {
   ServiceBus,
   WriteHookRegistry,
@@ -50,45 +50,59 @@ import {
   assertCanImport,
   canExport,
   canImport
-} from "./chunk-HBVEGUON.js";
+} from "./chunk-QTXQ6RNZ.js";
 import {
   NO_ATTESTATION
-} from "./chunk-LFGJG4XZ.js";
+} from "./chunk-3I4KYWNP.js";
 import {
   NO_CLASSIFIED,
-  enforceClassifiedWrite,
+  guardClassifiedCompat,
   resolveClassifiedFields
-} from "./chunk-47C4CI7R.js";
+} from "./chunk-V7RNIND6.js";
 import {
   NO_TIERS,
   classifySealedShred
-} from "./chunk-E3LURVGQ.js";
+} from "./chunk-SSFC3IYA.js";
 import {
   NO_PORTABILITY
-} from "./chunk-II6DLDZM.js";
+} from "./chunk-5TZZUL5X.js";
 import {
   runDrainBarrier
-} from "./chunk-EU7HDMT3.js";
+} from "./chunk-ZWQFOXBR.js";
 import {
-  PERIODS_COLLECTION
-} from "./chunk-YSU2E4GZ.js";
+  PERIODS_COLLECTION,
+  PERIOD_ARCHIVES_COLLECTION,
+  PERIOD_FREEZES_COLLECTION,
+  PERIOD_TARGET_PURGES_COLLECTION,
+  periodExclusiveUpperBound
+} from "./chunk-IUKGIB2Q.js";
 import {
   TxContext,
   revertExecuted
-} from "./chunk-FCOZ7DEC.js";
+} from "./chunk-JC5R7P44.js";
+import {
+  DEFAULT_POSTURE,
+  ViaGraph
+} from "./chunk-7ZANJ6JZ.js";
+import {
+  forgetDerivedFanout,
+  ledgerAuditHook,
+  putDerivedOutput,
+  runGraphDispatchWave
+} from "./chunk-H57P2SJB.js";
 import {
   OverlayedCollection
-} from "./chunk-MOQ5M46U.js";
+} from "./chunk-SZCHEDML.js";
 import {
   EXPORT_AUDIT_COLLECTION,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-I6Q7YECW.js";
+} from "./chunk-NYVQCZ54.js";
 import {
   LazyQuery,
   decodeIdxId,
   encodeIdxId
-} from "./chunk-6PALJTC2.js";
+} from "./chunk-XJK2WIYN.js";
 import {
   IMPLICIT_LAZY,
   Lru,
@@ -97,11 +111,10 @@ import {
 import {
   resolveManagedSecret,
   saveSealedPassphrase
-} from "./chunk-H7WQMGXH.js";
+} from "./chunk-CJEMA2Z6.js";
 import {
-  isDictCollectionName,
-  isStaticDictDescriptor
-} from "./chunk-WFBZRXS5.js";
+  dictCollectionName
+} from "./chunk-IIP5WFVT.js";
 import {
   NO_TEAM,
   enrollAuthenticator,
@@ -112,7 +125,7 @@ import {
   rotatePassphrase,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-WGH3YV6Y.js";
+} from "./chunk-DEYAO3N6.js";
 import {
   hasRecoveryEnrolled,
   hasStrongRecoveryEnrolled,
@@ -122,7 +135,7 @@ import {
   mintShamirRecoveryEntry,
   savePaperRecoveryEntries,
   saveShamirRecoveryEntries
-} from "./chunk-VUHXLL32.js";
+} from "./chunk-VJ3NQK4K.js";
 import {
   INDEXED_STORE_POLICY
 } from "./chunk-VQNJ7UZL.js";
@@ -138,17 +151,17 @@ import {
   listUsers,
   loadKeyring,
   updateKeyringIdentity
-} from "./chunk-GMZFHDSG.js";
+} from "./chunk-6CU3FN74.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
-} from "./chunk-3CHNKEFI.js";
+} from "./chunk-E5AHO65E.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
 import {
   sha256Hex
-} from "./chunk-G5CFMITA.js";
+} from "./chunk-MSVY7ULZ.js";
 import {
   NO_FORGET,
   addSubjectRef,
@@ -157,50 +170,59 @@ import {
   readDottedPath,
   rebuildSubjectIndex,
   removeSubjectRef
-} from "./chunk-VMRXI3IF.js";
+} from "./chunk-A2APWS32.js";
 import {
   NO_SEALED_RECORD
-} from "./chunk-XW5LZYV4.js";
+} from "./chunk-2HVUKRNE.js";
 import {
   RecordCodec,
   SEALED_CEK_NS,
   findByDet,
   hasPerRecordKey,
+  makeReservedEnvelopes,
   openEnvelopeJson,
   queryByDet,
   resolveStableCek,
   validateSchemaInput
-} from "./chunk-JIW3Q5JN.js";
+} from "./chunk-XHD3L3JO.js";
 import {
   buildDeleteMarker,
   buildTombstone,
   isDeleteMarker,
   isTombstone
-} from "./chunk-HGQ6UNHE.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-HCK2DFEK.js";
+} from "./chunk-Z5YFRMG5.js";
 import {
   encrypt
-} from "./chunk-5HZULLHE.js";
+} from "./chunk-AUR7MRHA.js";
+import {
+  NOYDB_FORMAT_VERSION,
+  SealedHandle
+} from "./chunk-UNJU345Q.js";
 import {
   NO_AGGREGATE,
   Query,
   ScanBuilder
-} from "./chunk-6Z435B6N.js";
+} from "./chunk-7HAPHVRJ.js";
 import {
   canonicalGroupKey
-} from "./chunk-5GQE5IDB.js";
+} from "./chunk-2XE6LIXT.js";
 import {
-  moneyRuntime,
   readPath
-} from "./chunk-6P5AJ2ZS.js";
+} from "./chunk-KCG3BHFG.js";
 import {
+  NO_I18N,
   getAtPath,
-  resolvePolicy,
-  setAtPathInPlace,
-  stripI18nFilled
-} from "./chunk-BASCPHNM.js";
+  isDictCollectionName,
+  isDictKeyDescriptor,
+  isI18nTextDescriptor,
+  isStaticDictDescriptor,
+  presentI18nForJoin
+} from "./chunk-3C5CKXFI.js";
+import {
+  installViaBinder,
+  isViaInstalled,
+  viaBinder
+} from "./chunk-6G2SCQYS.js";
 import {
   AlreadyElevatedError,
   AttestationError,
@@ -210,12 +232,13 @@ import {
   ConflictError,
   DebugPlaintextError,
   DerivationCapExceededError,
+  DictKeyInUseError,
   ElevationExpiredError,
+  FieldNotQueryableError,
   ForgetStrategyNotConfiguredError,
   IndexWriteFailureError,
   InvalidKeyError,
   KeyringCorruptError,
-  LocaleNotSpecifiedError,
   ManagedRecoveryNotEnrolledError,
   MigrationRequiredError,
   NoAccessError,
@@ -232,85 +255,281 @@ import {
   StaticDictReadonlyError,
   StoreCapabilityError,
   TierNotGrantedError,
-  TranslatorNotConfiguredError,
   USER_ENVELOPE_COLLECTION,
   UniqueConstraintError,
   UnknownDictCodeError,
   UnsupportedIndexOptionError,
   ValidationError
-} from "./chunk-OJ64XMPJ.js";
+} from "./chunk-CU62BBRB.js";
 
 // src/port/by/default-provider.ts
 async function createDefaultCoordinationProvider(store) {
-  const { StoreCoordinationProvider } = await import("./store-coordination-provider-F5N5ASDF.js");
+  const { StoreCoordinationProvider } = await import("./store-coordination-provider-WKGAE2WI.js");
   return new StoreCoordinationProvider(store);
 }
 
-// src/with-shape/classified/guards.ts
-function guardClassifiedCompat(collection, byField, ctx) {
-  const digestOnly = Object.entries(byField).filter(([, s]) => s.storage === "digest-only");
-  const protectedForms = Object.values(byField).filter((s) => s.storage === "digest-only" || s.storage === "recoverable");
-  if (protectedForms.length > 0 && (ctx.crdt || ctx.hasConflictPolicy)) {
-    throw new ClassifiedConfigError(
-      collection,
-      "digest-only/recoverable classified fields cannot combine with a crdt mode or a conflictPolicy resolver \u2014 merge paths bypass write enforcement (R2)"
-    );
-  }
-  for (const [f, spec] of Object.entries(byField)) {
-    if (spec.equatable === true && spec.storage !== "digest-only") {
-      throw new ClassifiedConfigError(
-        collection,
-        `field "${f}" declares equatable but storage is '${spec.storage}' \u2014 equatable is a digest-only knob; recoverable equality is _det's job (R7)`
-      );
+// src/kernel/via-pipeline.ts
+var ViaPipeline = class _ViaPipeline {
+  constructor(bindings, taint) {
+    this.bindings = bindings;
+    this.taint = taint;
+  }
+  bindings;
+  taint;
+  /** undefined when there is nothing to enforce — the zero-via fast path is
+   *  `this.via === undefined` (#553: keeps an all-plain collection sync). */
+  static build(bindings, taint) {
+    if (bindings.length === 0 && (!taint || taint.postures.size === 0)) return void 0;
+    return new _ViaPipeline(bindings, taint);
+  }
+  /** Refuse a write before crypto runs: awaits each binding's `enforceWrite` in order — first throw wins. */
+  async enforceWrite(record, ctx) {
+    for (const b of this.bindings) if (b.enforceWrite) await b.enforceWrite(record, ctx);
+  }
+  ingest(record) {
+    let r = record;
+    for (const b of this.bindings) if (b.ingest) r = b.ingest(r);
+    return r;
+  }
+  canonicalizeStored(record) {
+    let r = record;
+    for (const b of this.bindings) if (b.canonicalizeStored) r = b.canonicalizeStored(r);
+    return r;
+  }
+  async encodeWrite(record, ctx) {
+    let r = record;
+    for (const b of this.bindings) if (b.encodeWrite) r = await b.encodeWrite(r, ctx);
+    return r;
+  }
+  /**
+   * Final write-pipeline stage: folds each binding's `encodeAtRest` in
+   * order, threading the record and accumulating the sealed-slot map. A
+   * field belongs to exactly one via feature — two bindings sealing the
+   * same field is a brand-keyed collision and throws.
+   */
+  async encodeAtRest(record, crypto) {
+    let r = record;
+    let sealed;
+    const sealedBy = /* @__PURE__ */ new Map();
+    for (const b of this.bindings) {
+      if (!b.encodeAtRest) continue;
+      const result = await b.encodeAtRest(r, crypto);
+      r = result.record;
+      if (!result.sealed) continue;
+      for (const [field, ref2] of Object.entries(result.sealed)) {
+        const priorBrand = sealedBy.get(field);
+        if (priorBrand !== void 0) {
+          throw new ValidationError(
+            `via encodeAtRest: field "${field}" sealed by binding "${priorBrand}" is also sealed by binding "${b.brand}"`
+          );
+        }
+        sealedBy.set(field, b.brand);
+        sealed ??= {};
+        sealed[field] = ref2;
+      }
     }
+    return sealed ? { record: r, sealed } : { record: r };
   }
-  const hasEquatable = Object.values(byField).some((s) => s.equatable === true);
-  if (hasEquatable && ctx.acknowledgeEquatableRisk !== true) {
-    throw new ClassifiedConfigError(
-      collection,
-      `classified equatable fields require \`acknowledgeEquatableRisk: true\` \u2014 equal values produce equal store-visible index tags (a partition leak a DEK holder can offline-dictionary at the PBKDF2 floor); the door is the real control for low-entropy fields (R8)`
-    );
+  /** First read-pipeline stage: folds each binding's `decodeAtRest` in order. */
+  async decodeAtRest(record, sealed, crypto, opts) {
+    let r = record;
+    for (const b of this.bindings) if (b.decodeAtRest) r = await b.decodeAtRest(r, sealed, crypto, opts);
+    return r;
   }
-  if (digestOnly.length === 0) return;
-  if (!ctx.storeCiphertext) {
-    throw new ClassifiedConfigError(
-      collection,
-      `storage:'digest-only' requires an encrypted collection \u2014 with encrypt: false the write path skips the digest slot entirely and the secret would persist as raw plaintext`
-    );
+  async present(record, ctx) {
+    let r = record;
+    for (const b of this.bindings) if (b.present) r = await b.present(r, ctx);
+    return r;
+  }
+  buildClause(field, op, value) {
+    for (const b of this.bindings) {
+      const payload = b.buildClause?.(field, op, value);
+      if (payload !== void 0) return { brand: b.brand, payload };
+    }
+    return void 0;
+  }
+  evaluateClause(clause, actual, op) {
+    const b = this.bindings.find((x) => x.brand === clause.brand);
+    return b?.evaluateClause ? b.evaluateClause(actual, op, clause.payload) : false;
+  }
+  decodeResults(record) {
+    let r = record;
+    for (const b of this.bindings) if (b.decodeResults) r = b.decodeResults(r);
+    return r;
   }
-  if (!ctx.perRecordKeys) {
-    throw new ClassifiedConfigError(
-      collection,
-      `storage:'digest-only' requires perRecordKeys: true \u2014 vdig keys derive from the per-record CEK so forget() shreds them (R1)`
-    );
+  /** undefined = no binding covers the field → caller falls back to generic compare. */
+  compareForOrder(field, a, b) {
+    for (const bind of this.bindings) {
+      const c = bind.compareForOrder?.(field, a, b);
+      if (c !== void 0) return c;
+    }
+    return void 0;
+  }
+  /** undefined = no binding resolves an order-sort label for `key` at `field`/`locale` (#650 Task 7 —
+   *  the `orderBy(..., {by:'label'})` per-call-locale channel `compareForOrder` above can't serve). */
+  resolveOrderLabel(field, key, locale) {
+    for (const bind of this.bindings) {
+      const label = bind.resolveOrderLabel?.(field, key, locale);
+      if (label !== void 0) return label;
+    }
+    return void 0;
+  }
+  /**
+   * Which posture governs `field`, if any binding covers it — `undefined`
+   * means no binding declares `field` (the generic, non-via query path
+   * applies). #629 Task 8's posture consumer: `.where()`/`.orderBy()`
+   * consult this before building/evaluating a clause, refusing fields whose
+   * posture is `queryable: 'none'` (e.g. blob); every other posture
+   * ('det-exact'/'ordered'/'full') is left to the existing per-binding
+   * buildClause/evaluateClause/compareForOrder machinery, unchanged.
+   *
+   * #638 Task 3: the graph-computed taint overlay is consulted FIRST — a
+   * derived field's assigned (most-restrictive-of-sources) posture wins over
+   * whatever a binding would otherwise report for that field name (no
+   * binding covers a computed/derived field today, so this never actually
+   * shadows one — see `via-taint-binding.ts`'s `taintBinding.covers`, which
+   * only claims the sealed subset for `encodeAtRest`/`decodeAtRest`, not for
+   * this lookup).
+   */
+  postureFor(field) {
+    const t = this.taint?.postures.get(field);
+    if (t) return t;
+    for (const b of this.bindings) {
+      if (b.covers?.(field)) return b.posture;
+    }
+    return void 0;
+  }
+  /**
+   * Refuse any field-based reducer over a `queryable: 'none'` field (blob) —
+   * metadata-only: walks each reducer's `.field` and checks posture, no
+   * rewriting. Reducers with no `.field` (e.g. `count()`) are skipped.
+   *
+   * Shared by `wrapReducers` below (which ALSO applies each binding's
+   * rewrite, e.g. money's exact-BigInt reducer swap) and by
+   * `ScanBuilder.aggregate()` (#629 Task 8 review fix wave 1), which must
+   * call THIS, not `wrapReducers` — wiring full `wrapReducers` into
+   * `ScanBuilder.aggregate()` would newly activate money/i18n reducer
+   * wrapping on a path that has never run it, a parity-breaking behavior
+   * change for existing brands.
+   */
+  refuseUnqueryableReducers(spec) {
+    for (const reducer of Object.values(spec)) {
+      const field = reducer?.field;
+      if (field !== void 0 && this.postureFor(field)?.queryable === "none") {
+        throw new FieldNotQueryableError(field);
+      }
+    }
+  }
+  /**
+   * Rewrite an aggregate spec (money exact reducers), then refuse any
+   * field-based reducer over a `queryable: 'none'` field (blob) — the same
+   * posture gate `.where()`/`.orderBy()` apply, extended to `.aggregate()`
+   * (both the bare-spec and builder forms funnel through here).
+   */
+  wrapReducers(spec) {
+    this.refuseUnqueryableReducers(spec);
+    let s = spec;
+    for (const b of this.bindings) if (b.wrapReducers) s = b.wrapReducers(s);
+    return s;
+  }
+  /**
+   * Deliberate export-layer redaction (#629 Task 9's posture consumer):
+   * for every OWN field the decoded record carries, if the covering
+   * binding's posture declares `exportable: false` (classified today;
+   * money/i18n/blob are all `true`), replace the value with
+   * {@link EXPORT_REDACTION_MARKER} — the same `'[sealed]'` string
+   * `SealedHandle.toJSON()` (`kernel/types.ts`) already emits, so this is
+   * byte-parity with today's accidental redaction, now independent of the
+   * field's runtime shape. `SealedHandle.toJSON()` stays untouched as
+   * defense-in-depth: a record read via `collection.get()` and
+   * JSON.stringify'd outside `exportStream()` still gets the accident's
+   * redaction on its own. Never mutates the input; returns a new object
+   * only when a field was actually redacted.
+   */
+  redactForExport(record) {
+    let out;
+    for (const field of Object.keys(record)) {
+      if (this.postureFor(field)?.exportable === false) {
+        out ??= { ...record };
+        out[field] = EXPORT_REDACTION_MARKER;
+      }
+    }
+    return out ?? record;
+  }
+  /**
+   * Shared fold over a subset of `this.bindings`: runs each binding's
+   * `erase`, concatenating shredded/retainedShared counts and residue.
+   * Consults `posture.forgettable` (#629 Task 10) — a binding declaring
+   * `forgettable: false` is skipped even if it defines `erase` (none does
+   * today; a future non-forgettable binding is supported without a brand check).
+   */
+  async foldErase(ctx, bindings) {
+    let shredded = 0;
+    let retainedShared = 0;
+    const residue = [];
+    for (const b of bindings) {
+      if (!b.erase || b.posture.forgettable === false) continue;
+      const report = await b.erase(ctx);
+      shredded += report.shredded;
+      retainedShared += report.retainedShared ?? 0;
+      residue.push(...report.residue);
+    }
+    return retainedShared > 0 ? { shredded, residue, retainedShared } : { shredded, residue };
+  }
+  /** `forget()`'s per-ref erasure door: folds every binding's `erase`. */
+  async erase(ctx) {
+    return this.foldErase(ctx, this.bindings);
+  }
+  /**
+   * `forget()`'s SEALED-posture-only erase fold (#629 Task 10, `Collection._onViaErase`'s
+   * one caller) — classified today; metadata-filtered on
+   * `posture.encryptedAtRest`, not brand-checked. `undefined` when no
+   * sealed-posture binding is compiled in — `vault.ts` then falls back to
+   * its own bare-`sensitive` classification, which no via binding covers.
+   */
+  async eraseSealed(ctx) {
+    const sealed = this.bindings.filter((b) => b.posture.encryptedAtRest === "sealed");
+    return sealed.length === 0 ? void 0 : this.foldErase(ctx, sealed);
   }
-  for (const [f, spec] of digestOnly) {
-    const n = spec.notLastN ?? 0;
-    if (!Number.isInteger(n) || n < 0 || n > 8) {
-      throw new ClassifiedConfigError(
-        collection,
-        `digest-only field "${f}" declares notLastN ${n} \u2014 must be an integer 0..8 (write cost is n \xD7 600K PBKDF2; ring blast radius is documented)`
-      );
-    }
-    if (ctx.bareSensitiveFields.has(f)) {
-      throw new ClassifiedConfigError(
-        collection,
-        `field "${f}" is digest-only AND listed in sensitive[] \u2014 storage forms are mutually exclusive per field (R5)`
-      );
-    }
-    if (ctx.deterministicFields?.has(f)) {
-      throw new ClassifiedConfigError(
-        collection,
-        `digest-only field "${f}" cannot be deterministic \u2014 equality-correlatable ciphertext defeats per-write salts (R3)`
-      );
-    }
-    if (ctx.indexedFields.has(f) || ctx.textIndexFields.has(f) || ctx.vectorSourceFields.has(f) || ctx.subjectKeyField === f) {
-      throw new ClassifiedConfigError(
-        collection,
-        `digest-only field "${f}" cannot be indexed, text-indexed, embedded, or a forget-subject key (R4)`
-      );
+  /** True iff any binding implements decodeResults (query fast-path gating). */
+  get hasResultDecode() {
+    return this.bindings.some((b) => b.decodeResults !== void 0);
+  }
+  /**
+   * True iff any binding declares an at-rest hook (`encodeAtRest`/
+   * `decodeAtRest`) — the codec boundary's async-stack gate (#629 Task 3
+   * consults this to choose between the hook path and today's inline
+   * sealed-slot path; a stack with only sync hooks, e.g. money-only, stays
+   * `false`).
+   */
+  get hasAtRestHooks() {
+    return this.bindings.some((b) => b.encodeAtRest !== void 0 || b.decodeAtRest !== void 0);
+  }
+  /**
+   * Fold every binding's `describeFragment()` into one `brand -> fragment`
+   * map (#650 Task 7 — the first-ever consumer; `describeFragment` was
+   * declared at `via.ts:136` since #623 with zero callers until this task).
+   * `undefined` when no compiled binding implements it. Consumed by
+   * `Collection.describe()`/`describeAsync()`, threaded to `buildDescription`
+   * as `BuildDescriptionInput.viaFragments`.
+   */
+  describeFragments() {
+    let out;
+    for (const b of this.bindings) {
+      const f = b.describeFragment?.();
+      if (f !== void 0) {
+        out ??= {};
+        out[b.brand] = f;
+      }
     }
+    return out;
   }
+};
+var EXPORT_REDACTION_MARKER = "[sealed]";
+function exportRedact(coll, record) {
+  if (record === null || typeof record !== "object") return record;
+  const via2 = coll.via;
+  return via2 ? via2.redactForExport(record) : record;
 }
 
 // src/with-lookup/indexing/collection-facade.ts
@@ -398,7 +617,7 @@ async function rebuildIndexes(ctx) {
   for (const recordId of canonicalIds) {
     const envelope = await ctx.adapter.get(ctx.vault, ctx.name, recordId);
     if (!envelope) continue;
-    const record = await ctx.codec.decryptRecord(envelope, { skipValidation: true });
+    const record = await ctx.codec.decryptRecord(envelope, { skipValidation: true, id: recordId });
     if (record === null) continue;
     await maintainPersistedIndexesOnPut(ctx, recordId, record, null, envelope._v);
   }
@@ -451,7 +670,7 @@ async function reconcileIndex(ctx, field, opts = {}) {
     if (id.startsWith("_")) continue;
     const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
     if (!env) continue;
-    const record = await ctx.codec.decryptRecord(env, { skipValidation: true });
+    const record = await ctx.codec.decryptRecord(env, { skipValidation: true, id });
     if (record === null) continue;
     const live = readPersistedValue(record, field);
     const stored = sidecar.get(id);
@@ -875,13 +1094,14 @@ function deriveWidget(opts) {
     case "percent":
       return "number";
   }
-  if (opts.dict !== void 0) return "select";
+  if (opts.dict !== void 0 || opts.lookup !== void 0) return "select";
   if (opts.type === "boolean") return "checkbox";
   if (opts.type === "number") return "number";
   return "text";
 }
 function buildDescription(input) {
-  const { collection, fieldMeta, moneyFields, dictKeyFields, computed, refs, zodFields, dictLabels, meta, i18nFields, classified } = input;
+  const { collection, fieldMeta, moneyFields, dictKeyFields, lookupFields, computed, refs, zodFields, dictLabels, meta, i18nFields, classified, taint } = input;
+  const lookupFragments = input.viaFragments?.["lookup"]?.lookupFields;
   if (zodFields !== void 0 && Object.keys(zodFields).length > 0 && fieldMeta !== void 0) {
     const knownFields = /* @__PURE__ */ new Set([
       ...Object.keys(moneyFields ?? {}),
@@ -889,13 +1109,15 @@ function buildDescription(input) {
       ...Object.keys(refs),
       ...Object.keys(computed ?? {}),
       ...Object.keys(zodFields),
-      ...Object.keys(i18nFields ?? {})
+      ...Object.keys(i18nFields ?? {}),
+      ...Object.keys(lookupFields ?? {})
     ]);
     validateFieldMetaKeys(collection, fieldMeta, knownFields);
   }
   const allKeys = /* @__PURE__ */ new Set([
     ...Object.keys(moneyFields ?? {}),
     ...Object.keys(dictKeyFields ?? {}),
+    ...Object.keys(lookupFields ?? {}),
     ...Object.keys(refs),
     ...Object.keys(computed ?? {}),
     ...Object.keys(fieldMeta ?? {}),
@@ -908,15 +1130,18 @@ function buildDescription(input) {
     const zod = zodFields?.[key];
     const money = moneyFields?.[key];
     const dict = dictKeyFields?.[key];
+    const lookupDesc = lookupFields?.[key];
     const refDesc = refs[key];
     const isComputed = computed !== void 0 && key in computed;
     const i18nDesc = i18nFields?.[key];
     const cls = classified?.[key];
+    const taintPosture = taint?.postures.get(key);
     let type = zod?.type ?? "unknown";
     const inferred = {};
     let moneyBlock;
     let dictBlock;
     let refBlock;
+    let lookupBlock;
     if (money) {
       type = "number";
       inferred.semanticType = "currency";
@@ -963,10 +1188,49 @@ function buildDescription(input) {
           dictBlock = { name: dict.name, static: false };
         }
       }
+    } else if (lookupDesc) {
+      type = "enum";
+      const lookupLabelMap = dictLabels?.[lookupDesc.dimension];
+      const lookupLabelMapHasEntries = lookupLabelMap !== void 0 && Object.keys(lookupLabelMap).length > 0;
+      if (lookupDesc.table !== void 0) {
+        const displayLocale = lookupDesc.displayLocale;
+        const table = lookupDesc.table;
+        const values = (lookupDesc.keys ?? Object.keys(table)).map((k) => {
+          const localeMap = table[k];
+          const label = displayLocale !== void 0 ? localeMap?.[displayLocale] ?? void 0 : void 0;
+          return label !== void 0 ? { value: k, label } : { value: k };
+        });
+        dictBlock = { name: lookupDesc.dimension, static: true, values };
+      } else if (lookupLabelMapHasEntries) {
+        const values = Object.entries(lookupLabelMap).map(([value, label]) => ({ value, label }));
+        dictBlock = { name: lookupDesc.dimension, static: false, values };
+      } else if (lookupDesc.keys !== void 0) {
+        const values = lookupDesc.keys.map((k) => {
+          const label = lookupDesc.labels?.[k];
+          return label !== void 0 ? { value: k, label } : { value: k };
+        });
+        dictBlock = { name: lookupDesc.dimension, static: false, values };
+      } else {
+        dictBlock = { name: lookupDesc.dimension, static: false };
+      }
     } else if (i18nDesc) {
       type = "string";
     } else if (isComputed) {
     }
+    const lookupFragmentEntry = lookupFragments?.[key];
+    if (lookupFragmentEntry !== void 0) {
+      lookupBlock = {
+        ...lookupFragmentEntry.dimension !== void 0 ? { dimension: lookupFragmentEntry.dimension } : {},
+        backing: lookupFragmentEntry.backing,
+        vocabulary: lookupFragmentEntry.vocabulary,
+        key: lookupFragmentEntry.key,
+        onDelete: lookupFragmentEntry.onDelete,
+        ...lookupFragmentEntry.altKeys !== void 0 ? { altKeys: lookupFragmentEntry.altKeys } : {},
+        ...lookupFragmentEntry.present !== void 0 ? { present: lookupFragmentEntry.present } : {},
+        ...lookupFragmentEntry.sortBy !== void 0 ? { sortBy: lookupFragmentEntry.sortBy } : {},
+        ...lookupFragmentEntry.keys !== void 0 ? { keys: lookupFragmentEntry.keys } : {}
+      };
+    }
     if (cls !== void 0) inferred.sensitivity = cls.sensitivity;
     const channelEntry = fieldMeta?.[key];
     const zodMeta = zod?.meta;
@@ -988,6 +1252,7 @@ function buildDescription(input) {
       type,
       ...resolved.semanticType !== void 0 ? { semanticType: resolved.semanticType } : {},
       ...dictBlock !== void 0 ? { dict: dictBlock } : {},
+      ...lookupBlock !== void 0 ? { lookup: lookupBlock } : {},
       ...resolved.widget !== void 0 ? { resolvedWidget: resolved.widget } : {}
     });
     const editable = !isComputed && key !== "id";
@@ -1009,6 +1274,7 @@ function buildDescription(input) {
       ...refBlock !== void 0 ? { ref: refBlock } : {},
       ...moneyBlock !== void 0 ? { money: moneyBlock } : {},
       ...dictBlock !== void 0 ? { dict: dictBlock } : {},
+      ...lookupBlock !== void 0 ? { lookup: lookupBlock } : {},
       ...isComputed ? { computed: true } : {},
       ...i18nBlock !== void 0 ? { i18n: i18nBlock } : {},
       widget,
@@ -1020,7 +1286,8 @@ function buildDescription(input) {
           list: cls.list.kind === "omit" ? "omit" : cls.list.kind === "mask" ? { mask: cls.list.pattern } : { rider: cls.list.rider },
           ...cls.equatable === true ? { equatable: true } : {}
         }
-      } : {}
+      } : {},
+      ...taintPosture !== void 0 ? { taint: { posture: taintPosture, forcedBy: taint?.provenance?.get(key) ?? [] } } : {}
     };
     fields.push(field);
   }
@@ -1071,7 +1338,7 @@ async function resolveStaleOnRead(accessor, outputCollection, id) {
     }
     const sourceWithId = { ...source, id };
     if (DerivationExecutor === null) {
-      ({ DerivationExecutor } = await import("./executor-EUPYHCLU.js"));
+      ({ DerivationExecutor } = await import("./executor-WAEI6PDV.js"));
     }
     const ctx = { vault: accessor.getReadOnlyFacade() };
     const result = await DerivationExecutor.run(spec, sourceWithId, 0, strategyHash, ctx);
@@ -1168,51 +1435,64 @@ var NO_HISTORY = {
   }
 };
 
-// src/with-shape/i18n/strategy.ts
-function notEnabled2(op) {
-  return new Error(
-    `${op} requires the i18n strategy. Import \`{ withI18n }\` from "@noy-db/hub/i18n" and pass it to \`createNoydb({ i18nStrategy: withI18n() })\`.`
-  );
-}
-var NO_I18N = {
-  applyI18nLocale(record) {
-    return record;
-  },
-  validateI18nTextValue() {
-    throw notEnabled2("i18nText field validation");
-  },
-  enforceScript(value) {
-    return { value, warnings: [] };
-  },
-  computeExemptFills() {
-    return /* @__PURE__ */ new Map();
-  },
-  densify() {
-  },
-  buildDictionaryHandle() {
-    throw notEnabled2("vault.dictionary()");
-  }
-};
-
 // src/with-party/team/sync-strategy.ts
-function notEnabled3(op) {
+function notEnabled2(op) {
   return new Error(
     `${op} requires the sync strategy. Import \`{ withSync }\` from "@noy-db/hub/sync" and pass it to \`createNoydb({ syncStrategy: withSync() })\`.`
   );
 }
 var NO_SYNC = {
   buildSyncEngine() {
-    throw notEnabled3("SyncEngine");
+    throw notEnabled2("SyncEngine");
   },
   buildSyncTransaction() {
-    throw notEnabled3("SyncTransaction");
+    throw notEnabled2("SyncTransaction");
   },
   buildPresence() {
-    throw notEnabled3("collection.presence()");
+    throw notEnabled2("collection.presence()");
   }
 };
 
-// src/with-shape/blobs/strategy.ts
+// src/shape/via-blob/binding.ts
+async function eraseBlobs(ctx, cfg) {
+  if (cfg.purgeBlobsForRecord) return cfg.purgeBlobsForRecord(ctx.id);
+  return { shredded: 0, residue: [] };
+}
+function buildBlobDescribeFragment(fields) {
+  return {
+    blobFields: Object.fromEntries(
+      Object.entries(fields).map(([field, p]) => [field, {
+        ...p.retainDays !== void 0 ? { retainDays: p.retainDays } : {},
+        ...p.evictWhen !== void 0 ? { evictWhen: true } : {},
+        ...p.legalHold !== void 0 ? { legalHold: true } : {},
+        ...p.retainUntil !== void 0 ? { retainUntil: true } : {},
+        ...p.external === true ? { external: true } : {},
+        ...p.public === true ? { public: true } : {},
+        ...p.backlink !== void 0 ? { backlink: p.backlink } : {}
+      }])
+    )
+  };
+}
+function blobBinding(cfg) {
+  return {
+    brand: "blob",
+    // encryptedAtRest: 'envelope' — blob chunks are AEAD-encrypted envelopes
+    // in `_blob_chunks` (service-side), not sealed record fields; queryable:
+    // 'none' — nothing indexes blob content; exportable — vault.exportBlobs()
+    // is a first-class door; forgettable — shredAllForRecord participates in
+    // vault.forget().
+    posture: { encryptedAtRest: "envelope", queryable: "none", exportable: true, forgettable: true },
+    covers: (field) => field in cfg.fields,
+    erase: (ctx) => eraseBlobs(ctx, cfg),
+    describeFragment: () => buildBlobDescribeFragment(cfg.fields)
+  };
+}
+function linkBlobVia() {
+  installViaBinder("blob", (c) => blobBinding(c));
+}
+
+// src/port/with/blob-strategy.ts
+linkBlobVia();
 var NO_BLOBS = {
   openSlot() {
     throw new Error(
@@ -1221,23 +1501,502 @@ var NO_BLOBS = {
   }
 };
 
+// src/shape/via-lookup/registry.ts
+function enforceStaticDictOnPut(staticFields, record) {
+  if (!staticFields || Object.keys(staticFields).length === 0) return;
+  if (!record || typeof record !== "object") return;
+  const obj = record;
+  for (const [field, desc] of Object.entries(staticFields)) {
+    if (desc.validateCodes === false) continue;
+    const known = new Set(desc.keys);
+    const values = getAtPath(obj, field);
+    for (const value of values) {
+      if (value === void 0 || value === null) continue;
+      const codes = Array.isArray(value) ? value : [value];
+      for (const code of codes) {
+        if (typeof code !== "string") continue;
+        if (!known.has(code)) {
+          throw new UnknownDictCodeError(desc.name, field, code);
+        }
+      }
+    }
+  }
+}
+function resolveDictSource(leftCollection, field, staticDescriptorByField, dictKeyFieldRegistry, getDictionaryHandle) {
+  const staticFields = staticDescriptorByField.get(leftCollection);
+  if (staticFields && field in staticFields) {
+    const desc = staticFields[field];
+    const rows = Object.entries(desc.table).map(
+      ([key, labels]) => ({ key, labels, ...labels })
+    );
+    const source = {
+      snapshot() {
+        return rows;
+      },
+      lookupById(id) {
+        return rows.find((e) => e["key"] === id);
+      }
+    };
+    if (desc.displayLocale !== void 0) {
+      ;
+      source.displayLocale = desc.displayLocale;
+    }
+    return source;
+  }
+  const dictFields = dictKeyFieldRegistry.get(leftCollection);
+  if (!dictFields || !(field in dictFields)) return null;
+  const dictName = dictFields[field];
+  if (!dictName) return null;
+  const handle = getDictionaryHandle(dictName);
+  return {
+    snapshot() {
+      return handle.snapshotEntries();
+    },
+    lookupById(id) {
+      const entries = handle.snapshotEntries();
+      return entries.find((e) => e["key"] === id);
+    }
+  };
+}
+async function updateReferencingRecords(registry, getCollection, name, oldKey, newKey) {
+  for (const [collectionName, dictFields] of registry) {
+    const fields = Object.entries(dictFields).filter(([, dn]) => dn === name).map(([field]) => field);
+    if (fields.length === 0) continue;
+    const coll = getCollection(collectionName);
+    const records = await coll.list();
+    for (const record of records) {
+      let changed = false;
+      const updated = { ...record };
+      for (const field of fields) {
+        if (updated[field] === oldKey) {
+          updated[field] = newKey;
+          changed = true;
+        }
+      }
+      if (changed) {
+        const id = record["id"];
+        if (id !== void 0) {
+          await coll.put(id, updated);
+        }
+      }
+    }
+  }
+}
+function resolveLabelFromMap(labels, locale, fallback) {
+  if (labels[locale] !== void 0) return labels[locale];
+  const chain = Array.isArray(fallback) ? fallback : fallback ? [fallback] : [];
+  for (const fb of chain) {
+    if (fb === "any") {
+      const any = Object.values(labels)[0];
+      if (any !== void 0) return any;
+    } else if (labels[fb] !== void 0) {
+      return labels[fb];
+    }
+  }
+  return void 0;
+}
+function lookupToStaticDictCompat(desc) {
+  if (desc.backing !== "static" || desc.table === void 0) return void 0;
+  return {
+    _noydbStaticDict: true,
+    _viaBrand: "i18n",
+    name: desc.dimension,
+    table: desc.table,
+    keys: desc.keys ?? Object.keys(desc.table),
+    ...desc.displayLocale !== void 0 ? { displayLocale: desc.displayLocale } : {},
+    ...desc.onMissing !== void 0 ? { onMissing: desc.onMissing } : {},
+    ...desc.substitute !== void 0 ? { substitute: desc.substitute } : {},
+    validateCodes: desc.vocabulary === "closed"
+  };
+}
+function collectLookupDictCompat(lookupFields) {
+  const dictFieldMap = {};
+  const staticEntries = [];
+  for (const [field, desc] of Object.entries(lookupFields ?? {})) {
+    if (desc.backing === "reserved") {
+      dictFieldMap[field] = desc.dimension;
+    } else {
+      const compat = lookupToStaticDictCompat(desc);
+      if (compat) staticEntries.push([field, compat]);
+    }
+  }
+  return { dictFieldMap, staticEntries };
+}
+function materializeBackingTable(descriptor, rows) {
+  const keys = new Set(rows.keys());
+  const owner = /* @__PURE__ */ new Map();
+  for (const key of keys) owner.set(key, key);
+  const altIndex = /* @__PURE__ */ new Map();
+  const altFields = descriptor.altKeys ?? [];
+  for (const [canonicalKey, row] of rows) {
+    for (const altField of altFields) {
+      const value = row[altField];
+      if (typeof value !== "string" || value === "") continue;
+      const existingOwner = owner.get(value);
+      if (existingOwner !== void 0 && existingOwner !== canonicalKey) {
+        throw new ValidationError(
+          `lookup "${descriptor.dimension}": altKey field "${altField}" value "${value}" is claimed by both "${existingOwner}" and "${canonicalKey}" \u2014 key/altKey values must be unique across the dimension.`
+        );
+      }
+      owner.set(value, canonicalKey);
+      altIndex.set(value, canonicalKey);
+    }
+  }
+  return { keys, altIndex };
+}
+function checkLookupMembership(descriptor, key, getDictionary, getCollection) {
+  if (descriptor.backing === "static") {
+    const known = descriptor.keys ?? (descriptor.table ? Object.keys(descriptor.table) : []);
+    return known.includes(key);
+  }
+  if (descriptor.backing === "reserved") {
+    if ((descriptor.keys ?? []).includes(key)) return true;
+    return getDictionary(descriptor.dimension).snapshotEntries().some((e) => e["key"] === key);
+  }
+  return buildLookupAltIndex(descriptor, getDictionary, getCollection).keys.has(key);
+}
+function buildLookupAltIndex(descriptor, getDictionary, getCollection) {
+  if (descriptor.backing === "static") {
+    return materializeBackingTable(descriptor, new Map(Object.entries(descriptor.table ?? {})));
+  }
+  if (descriptor.backing === "reserved") {
+    const entries = getDictionary(descriptor.dimension).snapshotEntries();
+    return materializeBackingTable(descriptor, new Map(entries.map((e) => [String(e["key"]), e])));
+  }
+  const rows = getCollection(descriptor.dimension).querySourceForJoin().snapshot();
+  return materializeBackingTable(
+    descriptor,
+    new Map(
+      rows.map((r) => {
+        const row = r;
+        return [String(row[descriptor.key]), row];
+      })
+    )
+  );
+}
+function collectLookupRefEdges(collectionName, lookupFields) {
+  const edges = [];
+  for (const [field, desc] of Object.entries(lookupFields ?? {})) {
+    if (desc.backing === "static") continue;
+    const backing = desc.backing === "reserved" ? dictCollectionName(desc.dimension) : desc.dimension;
+    edges.push({
+      referencing: { collection: collectionName, field },
+      sources: [
+        { collection: backing, field: "*" },
+        ...desc.present?.label !== void 0 ? [{ collection: backing, field: desc.present.label }] : []
+      ],
+      onDelete: desc.onDelete,
+      keyField: desc.key
+    });
+  }
+  return edges;
+}
+function registerLookupRefEdges(graph, collectionName, lookupFields) {
+  for (const e of collectLookupRefEdges(collectionName, lookupFields)) {
+    graph.registerDerived(e.referencing, e.sources, "ref", "record", e.onDelete, e.keyField);
+  }
+}
+function buildLookupSnapshotRows(descriptor, isReservedDimension, getDictionary, getCollection) {
+  const dimension = descriptor.dimension;
+  if (isReservedDimension(dimension)) {
+    const rows = /* @__PURE__ */ new Map();
+    for (const entry of getDictionary(dimension).snapshotEntries()) {
+      const key = entry["key"];
+      if (typeof key === "string") rows.set(key, entry);
+    }
+    return rows;
+  }
+  if (descriptor.backing === "collection") {
+    const rawRows = getCollection(dimension).querySourceForJoin().snapshot();
+    const rows = /* @__PURE__ */ new Map();
+    for (const r of rawRows) {
+      const row = r;
+      rows.set(String(row[descriptor.key]), row);
+    }
+    return rows;
+  }
+  return void 0;
+}
+
+// src/shape/via-lookup/snapshot.ts
+function readRowField(row, field, by, locale, fallback) {
+  if (!row || field === void 0) return void 0;
+  const raw = row[field];
+  if (by === void 0) return typeof raw === "string" ? raw : void 0;
+  if (!raw || typeof raw !== "object") return void 0;
+  const map = raw;
+  const val = map[locale];
+  if (typeof val === "string") return val;
+  if (typeof fallback === "string" && typeof map[fallback] === "string") return map[fallback];
+  return void 0;
+}
+function buildLookupSnapshot(dimension, rows, descriptor) {
+  void dimension;
+  return {
+    row: (key) => rows.get(key),
+    label: (key, locale, fallback) => readRowField(rows.get(key), descriptor.present?.label, descriptor.present?.by, locale, fallback),
+    compareKeys: (a, b, locale) => {
+      const sortField = descriptor.sortBy ?? descriptor.present?.label;
+      const av = readRowField(rows.get(a), sortField, descriptor.present?.by, locale) ?? a;
+      const bv = readRowField(rows.get(b), sortField, descriptor.present?.by, locale) ?? b;
+      return av < bv ? -1 : av > bv ? 1 : 0;
+    }
+  };
+}
+function presentLookupForJoin(record, locale, lookupFields, getSnapshotRows) {
+  let result = record;
+  for (const [field, desc] of Object.entries(lookupFields)) {
+    if (desc.present === void 0) continue;
+    const raw = record[field];
+    if (typeof raw !== "string") continue;
+    const rows = desc.backing === "static" ? desc.table ? new Map(Object.entries(desc.table)) : void 0 : getSnapshotRows(desc);
+    if (!rows) continue;
+    const label = buildLookupSnapshot(desc.dimension, rows, desc).label(raw, locale);
+    if (label === void 0) continue;
+    if (result === record) result = { ...record };
+    result[`${field}Label`] = label;
+  }
+  return result;
+}
+function buildPresentForJoin(i18nFields, lookupFields, getSnapshotRows) {
+  const hasI18n = i18nFields !== void 0 && Object.keys(i18nFields).length > 0;
+  const hasLookup = lookupFields !== void 0 && Object.keys(lookupFields).length > 0;
+  if (!hasI18n && !hasLookup) return void 0;
+  const resolveRows = getSnapshotRows ?? (() => void 0);
+  return (record, locale) => {
+    if (record === null || typeof record !== "object") return record;
+    let result = record;
+    if (hasI18n) result = presentI18nForJoin(result, i18nFields, locale);
+    if (hasLookup) result = presentLookupForJoin(result, locale, lookupFields, resolveRows);
+    return result;
+  };
+}
+
+// src/port/with/lookup-strategy.ts
+function isLookupDescriptor(x) {
+  return typeof x === "object" && x !== null && x._viaBrand === "lookup";
+}
+
+// src/kernel/via-compose.ts
+function via(...descriptors) {
+  if (descriptors.length === 0) {
+    throw new ValidationError("via(): at least one descriptor is required, e.g. via(money({ currency: 'EUR' }))");
+  }
+  return { _noydbVia: true, descriptors };
+}
+function isViaFieldSpec(x) {
+  return typeof x === "object" && x !== null && x._noydbVia === true;
+}
+function mergeViaFields(sources) {
+  for (const field of Object.keys(sources.dictKeyFields ?? {})) {
+    if (sources.lookupFields && field in sources.lookupFields) {
+      throw new ValidationError(
+        `mergeViaFields(): field "${field}" is declared in both \`dictKeyFields\` and \`lookupFields\` \u2014 declare it in one place only.`
+      );
+    }
+  }
+  if (!sources.viaFields || Object.keys(sources.viaFields).length === 0) {
+    return {
+      moneyFields: sources.moneyFields,
+      i18nFields: sources.i18nFields,
+      dictKeyFields: sources.dictKeyFields,
+      computedFields: void 0,
+      lookupFields: sources.lookupFields
+    };
+  }
+  const sugarFieldNames = /* @__PURE__ */ new Set([
+    ...Object.keys(sources.moneyFields ?? {}),
+    ...Object.keys(sources.i18nFields ?? {}),
+    ...Object.keys(sources.dictKeyFields ?? {}),
+    ...Object.keys(sources.lookupFields ?? {})
+  ]);
+  const viaMoney = {};
+  const viaI18nText = {};
+  const viaDictKey = {};
+  const viaComputed = {};
+  const viaLookup = {};
+  for (const [field, spec] of Object.entries(sources.viaFields)) {
+    if (sugarFieldNames.has(field)) {
+      throw new ValidationError(
+        `via(): field "${field}" is declared via both a sugar key and \`viaFields\` \u2014 declare it in one place only.`
+      );
+    }
+    for (const descriptor of spec.descriptors) {
+      if (descriptor._viaBrand === "money") {
+        viaMoney[field] = descriptor;
+      } else if (descriptor._viaBrand === "i18n") {
+        if (isI18nTextDescriptor(descriptor)) viaI18nText[field] = descriptor;
+        else if (isDictKeyDescriptor(descriptor) || isStaticDictDescriptor(descriptor)) viaDictKey[field] = descriptor;
+      } else if (descriptor._viaBrand === "computed") {
+        viaComputed[field] = descriptor;
+      } else if (descriptor._viaBrand === "lookup" && isLookupDescriptor(descriptor)) {
+        viaLookup[field] = descriptor;
+      } else {
+        throw new ValidationError(`via(): field "${field}" has a descriptor with unrecognized _viaBrand "${descriptor._viaBrand}" \u2014 via() only supports money/i18n/computed/lookup descriptors today.`);
+      }
+    }
+  }
+  return {
+    moneyFields: Object.keys(viaMoney).length > 0 ? { ...sources.moneyFields ?? {}, ...viaMoney } : sources.moneyFields,
+    i18nFields: Object.keys(viaI18nText).length > 0 ? { ...sources.i18nFields ?? {}, ...viaI18nText } : sources.i18nFields,
+    dictKeyFields: Object.keys(viaDictKey).length > 0 ? { ...sources.dictKeyFields ?? {}, ...viaDictKey } : sources.dictKeyFields,
+    computedFields: Object.keys(viaComputed).length > 0 ? viaComputed : void 0,
+    lookupFields: Object.keys(viaLookup).length > 0 ? { ...sources.lookupFields ?? {}, ...viaLookup } : sources.lookupFields
+  };
+}
+
 // src/kernel/collection-config.ts
+function computedEntryParts(entry) {
+  if (typeof entry === "function") return { fn: entry, mode: "materialized" };
+  return { fn: entry.fn, ...entry.deps !== void 0 ? { deps: entry.deps } : {}, mode: entry.mode ?? "materialized" };
+}
+function unifyComputedFields(opts, viaComputedFields) {
+  return { ...opts.computed ?? {}, ...viaComputedFields ?? {} };
+}
+function compileViaBindings(opts, classifiedGuardCtx, eraseCfgOut) {
+  const { moneyFields, i18nFields, dictKeyFields, computedFields, lookupFields } = mergeViaFields(opts);
+  const bindings = [];
+  if (moneyFields) bindings.push(viaBinder("money")(moneyFields));
+  if (i18nFields || dictKeyFields) {
+    const densify = i18nFields ? Object.fromEntries(
+      Object.entries(i18nFields).filter(([, d]) => d.options.densifyOnWrite === true)
+    ) : {};
+    const i18nDensifyFields = Object.keys(densify).length > 0 ? densify : void 0;
+    bindings.push(viaBinder("i18n")({
+      ...i18nFields !== void 0 ? { i18nFields } : {},
+      ...dictKeyFields !== void 0 ? { dictKeyFields } : {},
+      ...i18nDensifyFields !== void 0 ? { i18nDensifyFields } : {},
+      strategy: opts.i18nStrategy ?? NO_I18N,
+      ...opts.defaultLocale !== void 0 ? { defaultLocale: opts.defaultLocale } : {},
+      ...opts.autoTranslateHook !== void 0 ? { autoTranslateHook: opts.autoTranslateHook } : {},
+      ...opts.dictLabelResolver !== void 0 ? { dictLabelResolver: opts.dictLabelResolver } : {},
+      ...opts.i18nPutValidator !== void 0 ? { i18nPutValidator: opts.i18nPutValidator } : {},
+      collectionName: opts.name
+    }));
+  }
+  if (lookupFields !== void 0) {
+    bindings.push(viaBinder("lookup")({
+      lookupFields,
+      ...opts.lookupLabelResolver !== void 0 ? { lookupLabelResolver: opts.lookupLabelResolver } : {},
+      ...opts.getLookupBacking !== void 0 ? { getLookupBacking: opts.getLookupBacking } : {},
+      ...opts.membership !== void 0 ? { membership: opts.membership } : {},
+      ...opts.getAltIndex !== void 0 ? { getAltIndex: opts.getAltIndex } : {},
+      ...opts.snapshotFor !== void 0 ? { snapshotFor: opts.snapshotFor } : {},
+      collectionName: opts.name
+    }));
+  }
+  if (opts.classifiedFields !== void 0) {
+    const classifiedCfg = {
+      entries: opts.classifiedFields,
+      collectionName: opts.name,
+      guardCtx: classifiedGuardCtx
+    };
+    if (eraseCfgOut) eraseCfgOut.classified = classifiedCfg;
+    bindings.push(viaBinder("classified")(classifiedCfg));
+  }
+  if (opts.blobFields !== void 0) {
+    bindings.push(viaBinder("blob")({
+      fields: opts.blobFields,
+      collectionName: opts.name
+    }));
+  }
+  const virtualFields = /* @__PURE__ */ new Map();
+  for (const [field, entry] of Object.entries(unifyComputedFields(opts, computedFields))) {
+    const parts = computedEntryParts(entry);
+    if (parts.mode === "virtual") {
+      virtualFields.set(field, { _viaBrand: "computed", fn: parts.fn, mode: "virtual", ...parts.deps !== void 0 ? { deps: parts.deps } : {} });
+    }
+  }
+  if (virtualFields.size > 0) {
+    bindings.push(viaBinder("computed")({ virtualFields }));
+  }
+  return bindings;
+}
+function collectKnownFieldNames(parts) {
+  return /* @__PURE__ */ new Set([
+    ...Object.keys(parts.moneyFields ?? {}),
+    ...Object.keys(parts.i18nFields ?? {}),
+    ...Object.keys(parts.dictKeyFields ?? {}),
+    ...Object.keys(parts.classifiedFields ?? {}),
+    ...Object.keys(parts.computed ?? {}),
+    ...Object.keys(parts.lookupFields ?? {})
+  ]);
+}
+var EMPTY_KNOWN_FIELDS = /* @__PURE__ */ new Set();
+function resolveComputedEdges(collectionName, computed, hasClassifiedFields, knownFields = EMPTY_KNOWN_FIELDS) {
+  if (!computed) return [];
+  const edges = [];
+  for (const [field, entry] of Object.entries(computed)) {
+    const parts = computedEntryParts(entry);
+    const deps = parts.deps;
+    if (deps === void 0) {
+      if (hasClassifiedFields) {
+        throw new ValidationError(
+          `Collection "${collectionName}": computed field "${field}" has no declared \`deps\` and the collection declares classified fields \u2014 an opaque computed function could silently copy a classified field's plaintext into an ordinary, unredacted field. Declare \`deps\` naming the source fields it reads, e.g. computed: { ${field}: { fn, deps: [...] } } or via(computed(fn, { deps: [...] })).`
+        );
+      }
+      continue;
+    }
+    if (deps.length === 0) {
+      throw new ValidationError(`Collection "${collectionName}": computed field "${field}"'s \`deps\` must be non-empty.`);
+    }
+    for (const dep of deps) {
+      if (typeof dep !== "string" || dep.length === 0) {
+        throw new ValidationError(`Collection "${collectionName}": computed field "${field}"'s \`deps\` entries must be non-empty strings.`);
+      }
+      if (hasClassifiedFields && !knownFields.has(dep)) {
+        throw new ValidationError(
+          `Collection "${collectionName}": computed field "${field}"'s \`deps\` entry "${dep}" does not name a declared field, and the collection declares classified fields \u2014 an opaque computed function could silently copy a classified field's plaintext into an ordinary, unredacted field via a mistyped/unknown dep name. Declare \`deps\` naming only known fields (money/i18n/dictKey/classified/computed) \u2014 check "${dep}" for a typo.`
+        );
+      }
+    }
+    edges.push({
+      target: { collection: collectionName, field },
+      sources: deps.map((d) => ({ collection: collectionName, field: d })),
+      grain: parts.mode === "virtual" ? "virtual" : "record"
+    });
+  }
+  return edges;
+}
+function resolveViaBindingDepsEdges(collectionName, bindings, knownFields) {
+  const edges = [];
+  for (const binding of bindings) {
+    if (!binding.deps || binding.deps.length === 0) continue;
+    for (const dep of binding.deps) {
+      if (!knownFields.has(dep)) {
+        throw new ValidationError(
+          `Collection "${collectionName}": via binding "${binding.brand}" deps references undeclared field "${dep}".`
+        );
+      }
+    }
+    const sources = binding.deps.map((d) => ({ collection: collectionName, field: d }));
+    for (const field of knownFields) {
+      if (binding.covers?.(field)) edges.push({ target: { collection: collectionName, field }, sources });
+    }
+  }
+  return edges;
+}
 function resolveCollectionConfig(opts) {
   if (opts.embeddings && opts.crdt) {
     throw new Error(
       `Collection "${opts.name}": embeddings are not supported on CRDT collections (L2). Use a non-CRDT collection for semantic search.`
     );
   }
-  if (opts.moneyFields) moneyRuntime().validateMoneyFieldPaths(opts.moneyFields);
+  const effectiveViaFields = mergeViaFields(opts);
   const resolvedClassified = opts.classifiedFields !== void 0 ? resolveClassifiedFields(opts.name, opts.classifiedFields) : void 0;
-  let mergedComputed = opts.computed;
+  const allComputed = unifyComputedFields(opts, effectiveViaFields.computedFields);
+  const materializedComputed = {};
+  for (const [field, entry] of Object.entries(allComputed)) {
+    if (computedEntryParts(entry).mode !== "virtual") materializedComputed[field] = entry;
+  }
+  let mergedComputed = Object.keys(materializedComputed).length > 0 ? materializedComputed : void 0;
   if (resolvedClassified !== void 0) {
-    for (const key of Object.keys(opts.computed ?? {})) {
+    for (const key of Object.keys(allComputed)) {
       if (resolvedClassified.riderComputed[key] !== void 0) {
         throw new ClassifiedConfigError(opts.name, `computed field "${key}" collides with a rider companion`);
       }
     }
-    mergedComputed = { ...resolvedClassified.riderComputed, ...opts.computed ?? {} };
+    mergedComputed = { ...resolvedClassified.riderComputed, ...materializedComputed };
   }
   let deterministicFields;
   if (opts.deterministicFields && opts.deterministicFields.length > 0) {
@@ -1250,10 +2009,6 @@ function resolveCollectionConfig(opts) {
   } else {
     deterministicFields = null;
   }
-  const densifyFields = opts.i18nFields ? Object.fromEntries(
-    Object.entries(opts.i18nFields).filter(([, d]) => d.options.densifyOnWrite === true)
-  ) : {};
-  const i18nDensifyFields = Object.keys(densifyFields).length > 0 ? densifyFields : void 0;
   const guardIndexedFields = /* @__PURE__ */ new Set();
   for (const ix of opts.indexes ?? []) {
     if (typeof ix === "string") guardIndexedFields.add(ix);
@@ -1289,6 +2044,18 @@ function resolveCollectionConfig(opts) {
   const vdigFields = vdigEntries.length > 0 ? new Map(vdigEntries) : null;
   const perRecordCek = opts.perRecordKeys === true;
   const cekCache = perRecordCek ? new Lru({ maxRecords: 4096 }) : null;
+  const viaEraseCfgOut = {};
+  const via2 = ViaPipeline.build(compileViaBindings(opts, classifiedGuardCtx, viaEraseCfgOut));
+  const knownFields = collectKnownFieldNames({
+    moneyFields: effectiveViaFields.moneyFields,
+    i18nFields: effectiveViaFields.i18nFields,
+    dictKeyFields: effectiveViaFields.dictKeyFields,
+    classifiedFields: resolvedClassified?.byField,
+    computed: allComputed,
+    lookupFields: effectiveViaFields.lookupFields
+  });
+  const computedEdges = resolveComputedEdges(opts.name, allComputed, resolvedClassified !== void 0, knownFields);
+  const viaDepsEdges = resolveViaBindingDepsEdges(opts.name, via2?.bindings ?? [], knownFields);
   return {
     adapter: opts.adapter,
     vault: opts.vault,
@@ -1320,20 +2087,34 @@ function resolveCollectionConfig(opts) {
     ledger: opts.ledger,
     refEnforcer: opts.refEnforcer,
     joinResolver: opts.joinResolver,
-    i18nFields: opts.i18nFields,
+    i18nFields: effectiveViaFields.i18nFields,
     textIndexes: opts.textIndexes,
-    i18nDensifyFields,
     embeddings: opts.embeddings,
     vectorSet: opts.embeddings ? new VectorSet() : void 0,
-    dictKeyFields: opts.dictKeyFields,
+    dictKeyFields: effectiveViaFields.dictKeyFields,
+    lookupFields: effectiveViaFields.lookupFields,
+    // #650 Task 6 — the sync join-dressing hook (#626 retirement, spec §5);
+    // `undefined` when this collection declares neither i18nText nor lookup
+    // fields, matching today's `i18nFields`-absent JoinableSource shape.
+    presentForJoin: buildPresentForJoin(effectiveViaFields.i18nFields, effectiveViaFields.lookupFields, opts.snapshotFor),
     fieldMeta: opts.fieldMeta,
     meta: opts.meta,
     _refs: opts.declaredRefs ?? {},
-    moneyFields: opts.moneyFields,
+    via: via2,
+    classifiedEraseCfg: viaEraseCfgOut.classified,
+    moneyFields: effectiveViaFields.moneyFields,
     classified: resolvedClassified,
     classifiedGuardCtx,
     classifiedStrategy: opts.classifiedStrategy ?? NO_CLASSIFIED,
     computed: mergedComputed,
+    computedEdges,
+    viaDepsEdges,
+    // #638 Task 7 — every declared computed field name (both modes, both surfaces); the
+    // reconcile path's cross-call depsless-computed leak-guard memory
+    // (`via-graph-wiring.ts#registerCollectionGraphSources`) reads this instead of
+    // `Object.keys(opts.computed ?? {})` alone, so a via(computed(...))-declared field
+    // participates in that guard identically to a sugar-declared one.
+    computedFieldNames: Object.keys(allComputed),
     dictLabelResolver: opts.dictLabelResolver,
     getDictionary: opts.getDictionary,
     i18nPutValidator: opts.i18nPutValidator,
@@ -1344,6 +2125,7 @@ function resolveCollectionConfig(opts) {
     onAccess: opts.onAccess,
     derivationSource: opts.derivationSource,
     materializedViewSource: opts.materializedViewSource,
+    graphDispatch: opts.graphDispatch,
     tiers: opts.tiers && opts.tiers.length > 0 ? new Set(opts.tiers) : null,
     tiersStrategy: opts.tiersStrategy ?? NO_TIERS,
     searchStrategy: opts.searchStrategy ?? NO_SEARCH,
@@ -1361,7 +2143,7 @@ function resolveCollectionConfig(opts) {
 // src/with-formula/computed/lazy.ts
 var fn = null;
 async function loadEvalComputedFields() {
-  fn ??= (await import("./computed-6FOFXQPE.js")).evalComputedFields;
+  fn ??= (await import("./computed-R62HGCO4.js")).evalComputedFields;
   return fn;
 }
 
@@ -1420,7 +2202,6 @@ var Collection = class {
   tiersStrategy;
   searchStrategy;
   historyStrategy;
-  i18nStrategy;
   syncStrategy;
   // In-memory cache of decrypted records (eager mode only). Lazy mode
   // uses `lru` instead. Both fields exist so a single Collection instance
@@ -1522,70 +2303,38 @@ var Collection = class {
    * throw `LocaleNotSpecifiedError` unless a per-call locale is passed.
    */
   defaultLocale;
-  /**
-   * Map of field name → `I18nTextDescriptor` for fields declared with
-   * `i18nText()`. Used by:
-   *   - `put()` via `i18nPutValidator` to enforce required translations
-   *   - `get()`/`list()` to apply locale resolution after decryption
-   *
-   * Declared via the `i18nFields` collection option.
-   */
+  /** Field name → `I18nTextDescriptor` for `i18nText()` fields (`i18nFields` option); write/read
+   *  runs through the compiled `via` i18n binding — this remains for `describe()`
+   *  and the search-index build path. */
   i18nFields;
-  /**
-   * The configured string fields exposed to `retrieve()`. `undefined`
-   * for ordinary collections, so the search path costs nothing when unused.
-   */
+  /** The configured string fields exposed to `retrieve()`; `undefined` for ordinary collections (zero-cost). */
   textIndexes;
-  /**
-   * The session-scoped lexical index store. `undefined` (so the dirty
-   * poke + retrieve are zero-cost) unless `textIndexes` is non-empty.
-   */
+  /** Session-scoped lexical index store; `undefined` (zero-cost) unless `textIndexes` is non-empty. */
   searchIndexStore;
-  /**
-   * The densify-enabled subset of {@link i18nFields} (fields whose
-   * descriptor opts in via `densifyOnWrite: true`). `undefined` when none opt
-   * in, so the write path skips all densify work for ordinary collections.
-   */
-  i18nDensifyFields;
-  /**
-   * Embedding config for write-time vector derivation. `undefined`
-   * for ordinary collections (zero cost). When set, `put()` encodes the
-   * source field(s) and stores an encrypted `_vec` sidecar.
-   */
+  /** Embedding config for write-time vector derivation; `undefined` (zero-cost) for ordinary
+   *  collections. When set, `put()` encodes the source field(s) and stores an encrypted `_vec` sidecar. */
   embeddings;
-  /**
-   * In-memory vector set, populated lazily from `_vec` sidecars.
-   * `undefined` when no embedding config is declared.
-   */
+  /** In-memory vector set, populated lazily from `_vec` sidecars; `undefined` when no embedding config is declared. */
   vectorSet;
-  /**
-   * Map of field name → `DictKeyDescriptor` for fields declared with
-   * `dictKey()`. Used by `get()`/`list()` to add `<field>Label` virtual
-   * fields when a locale is requested.
-   */
+  /** Field name → `DictKeyDescriptor` for `dictKey()` fields; used by `get()`/`list()` to add
+   *  `<field>Label` virtual fields when a locale is requested. */
   dictKeyFields;
-  /**
-   * Consumer-neutral per-field descriptors declared via the `fieldMeta`
-   * collection option. Read by `getFieldMeta()`; merged by `collection.describe()`.
-   */
+  /** Field name → `LookupDescriptor` for native `lookup()`/`enumOf()`/`dict()` fields (#650 Task 2) — describe()-only in this task. */
+  lookupFields;
+  /** Sync join-dressing hook (#650 Task 6, #626 retirement) — `querySourceForJoin()`'s `presentForJoin`. */
+  presentForJoin;
+  /** Consumer-neutral per-field descriptors declared via `fieldMeta`; read by `getFieldMeta()`, merged by `describe()`. */
   fieldMeta;
-  /**
-   * Collection-level descriptive metadata declared via the `meta` collection
-   * option. Read by `getMeta()`; surfaced in `collection.describe()`.
-   */
+  /** Collection-level descriptive metadata declared via `meta`; read by `getMeta()`, surfaced in `describe()`. */
   meta;
-  /**
-   * Outbound ref declarations for this collection (snapshot from vault
-   * refRegistry at construction time). Used by `describe()` (sync, config-only).
-   */
+  /** Outbound ref declarations (snapshot from vault refRegistry at construction time); used by `describe()`. */
   _refs;
-  /**
-   * Money field descriptors keyed by field path. Declared via the
-   * `moneyFields` collection option: `put()` quantizes to a scaled-int
-   * string, `get()`/`list()` decode back. Mutable so {@link _applyMoneyFields}
-   * can attach descriptors to a collection MV-analysis pre-created.
-   */
+  /** Money field descriptors keyed by field path, typed as the opaque {@link ViaDescriptor} marker
+   *  (the kernel never inspects the concrete shape); `put()` quantizes to a scaled-int string,
+   *  `get()`/`list()` decode back. Mutable so {@link _applyMoneyFields} can attach. */
   moneyFields;
+  via;
+  // compiled Via pipeline (money, i18n); rebuilt by {@link _applyMoneyFields}
   /**
    * Computed scalar fields, evaluated first on every `put()`. Mutable for
    * the same MV-pre-creation reconcile as {@link moneyFields}.
@@ -1620,27 +2369,12 @@ var Collection = class {
    * `createNoydb()` option (opt in with `withClassified()`).
    */
   classifiedStrategy;
-  /**
-   * Async callback provided by the Vault that resolves a dict key
-   * to its label for a given locale. Used by the locale-read path for
-   * dictKey fields.
-   *
-   * Signature: `(dictName, key, locale, fallback?) => Promise<string | undefined>`
-   */
-  dictLabelResolver;
   /**
    * Async callback provided by the Vault to open a dynamic
    * dictionary handle (for label-map pre-computation in the search index).
    * Only used in `resolveDictLabelMaps()`; static dicts bypass this entirely.
    */
   getDictionary;
-  /**
-   * Synchronous callback provided by the Vault that validates
-   * i18nText fields on `put()`. Throws `MissingTranslationError` when
-   * a required translation is absent. Called after schema validation,
-   * before encryption.
-   */
-  i18nPutValidator;
   /**
    * declared deterministic fields. `null` when the feature
    * is inactive for this collection; a frozen `Set` otherwise.
@@ -1695,14 +2429,6 @@ var Collection = class {
   tiers;
   tierMode;
   onCrossTierAccess;
-  /**
-   * Async translator callback provided by Noydb via Vault for
-   * `i18nText` fields with `autoTranslate: true`. Called
-   * before i18n validation so translated values are present when the
-   * validator runs. `undefined` when no `plaintextTranslator` was
-   * configured on `createNoydb()`.
-   */
-  autoTranslateHook;
   /**
    * Optional reference to the vault-level hash-chained audit
    * log. When present, every successful `put()` and `delete()` appends
@@ -1740,6 +2466,8 @@ var Collection = class {
    * commits + after `dispatchDerivations` has run.
    */
   materializedViewSource;
+  /** #638 Task 4 — `Vault._collectGraphTouch`; a no-op absent an open sync/cutover/restore batch. */
+  graphDispatch;
   /**
    * Optional back-reference to the owning compartment's ref
    * enforcer. When present, `Collection.put` calls
@@ -1802,7 +2530,6 @@ var Collection = class {
     this.tiersStrategy = cfg.tiersStrategy;
     this.searchStrategy = cfg.searchStrategy;
     this.historyStrategy = cfg.historyStrategy;
-    this.i18nStrategy = cfg.i18nStrategy;
     this.syncStrategy = cfg.syncStrategy;
     this.reconcileOnOpen = cfg.reconcileOnOpen;
     this.getDEK = cfg.getDEK;
@@ -1816,29 +2543,29 @@ var Collection = class {
     this.i18nFields = cfg.i18nFields;
     this.textIndexes = cfg.textIndexes;
     this.searchIndexStore = opts.textIndexes && opts.textIndexes.length > 0 ? opts.textIndexPersist ? new PersistedIndexStore(buildPersistedIndexCallbacks(() => this.searchContext())) : new MemoryIndexStore() : void 0;
-    this.i18nDensifyFields = cfg.i18nDensifyFields;
     this.embeddings = cfg.embeddings;
     this.vectorSet = cfg.vectorSet;
     this.dictKeyFields = cfg.dictKeyFields;
+    this.lookupFields = cfg.lookupFields;
+    this.presentForJoin = cfg.presentForJoin;
     this.fieldMeta = cfg.fieldMeta;
     this.meta = cfg.meta;
     this._refs = cfg._refs;
     this.moneyFields = cfg.moneyFields;
+    this.via = cfg.via;
     this.classified = cfg.classified;
     this.classifiedGuardCtx = cfg.classifiedGuardCtx;
     this.vdigFields = cfg.vdigFields;
     this.classifiedStrategy = cfg.classifiedStrategy;
     this.computed = cfg.computed;
-    this.dictLabelResolver = cfg.dictLabelResolver;
     this.getDictionary = cfg.getDictionary;
-    this.i18nPutValidator = cfg.i18nPutValidator;
-    this.autoTranslateHook = cfg.autoTranslateHook;
     this.defaultLocale = cfg.defaultLocale;
     this.crdtMode = cfg.crdtMode;
     this.syncAdapter = cfg.syncAdapter;
     this.onAccess = cfg.onAccess;
     this.derivationSource = cfg.derivationSource;
     this.materializedViewSource = cfg.materializedViewSource;
+    this.graphDispatch = cfg.graphDispatch;
     this.tiers = cfg.tiers;
     this.tierMode = cfg.tierMode;
     this.onCrossTierAccess = cfg.onCrossTierAccess;
@@ -1878,10 +2605,12 @@ var Collection = class {
       crdtMode: this.crdtMode,
       crdtStrategy: this.crdtStrategy,
       schema: this.schema,
-      getDEK: () => this.getDEK(this.name),
+      getDEK: (collection) => this.getDEK(collection ?? this.name),
       cekCache: this.cekCache,
-      classifiedMarkerDigestOnly: () => this._classifiedMarkerDigestOnly()
+      classifiedMarkerDigestOnly: () => this._classifiedMarkerDigestOnly(),
+      via: this.via
     });
+    if (cfg.classifiedEraseCfg) cfg.classifiedEraseCfg.classifySealedShred = (live) => this.codec.classifySealedShred(live);
     if (opts.crdt && opts.onRegisterConflictResolver) {
       const crdtMode = opts.crdt;
       const crdtResolver = async (id, local, remote) => {
@@ -1945,7 +2674,7 @@ var Collection = class {
           const merged = mergeFn(localRecord, remoteRecord);
           const mergedVersion = Math.max(local._v, remote._v) + 1;
           const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
-          return this.codec.encryptRecord(merged, mergedVersion, cek);
+          return this.codec.encryptRecord(merged, mergedVersion, cek, void 0, void 0, void 0, id);
         };
       }
       opts.onRegisterConflictResolver(collectionName, resolver);
@@ -2035,35 +2764,41 @@ var Collection = class {
       fieldMeta: this.fieldMeta,
       moneyFields: this.moneyFields,
       dictKeyFields: this.dictKeyFields,
+      ...this.lookupFields !== void 0 ? { lookupFields: this.lookupFields } : {},
       computed: this.computed,
       refs: this._refs,
       zodFields: void 0,
       ...this.meta !== void 0 ? { meta: this.meta } : {},
       ...this.i18nFields !== void 0 ? { i18nFields: this.i18nFields } : {},
-      ...this.classified !== void 0 ? { classified: this.classified.byField } : {}
+      ...this.classified !== void 0 ? { classified: this.classified.byField } : {},
+      ...this.via?.taint !== void 0 ? { taint: this.via.taint } : {},
+      ...this.via ? { viaFragments: this.via.describeFragments() } : {}
+      // #650 Task 7
     });
   }
   /**
-   * Async describe implementation.
-   * Derives validator-exact types via deriveZodFields (lazy, no static zod import),
-   * optionally resolves dynamic-dict labels from vault.dictionary(name).list(),
-   * then delegates to buildDescription which also runs fieldMeta key-validation.
+   * Async describe implementation. Derives validator-exact types via deriveZodFields
+   * (lazy, no static zod import), optionally resolves dynamic-dict labels from vault.dictionary(name).list(),
+   * then delegates to buildDescription (which also runs fieldMeta key-validation).
    */
   async describeAsync(opts) {
     const zodFields = this.schema !== void 0 ? await deriveZodFields(this.schema) : void 0;
     let dictLabels;
-    if (opts.resolveDictLabels === true && this.dictKeyFields !== void 0) {
-      dictLabels = {};
-      for (const [, desc] of Object.entries(this.dictKeyFields)) {
-        if (!isStaticDictDescriptor(desc) && this.getDictionary !== void 0) {
-          const handle = await this.getDictionary(desc.name);
+    if (opts.resolveDictLabels === true && this.getDictionary !== void 0) {
+      const names = /* @__PURE__ */ new Set();
+      for (const desc of Object.values(this.dictKeyFields ?? {})) if (!isStaticDictDescriptor(desc)) names.add(desc.name);
+      for (const desc of Object.values(this.lookupFields ?? {})) if (desc.backing === "reserved") names.add(desc.dimension);
+      if (names.size > 0) {
+        dictLabels = {};
+        for (const name of names) {
+          const handle = await this.getDictionary(name);
           const entries = await handle.list();
           const valueToLabel = {};
           for (const entry of entries) {
             const label = Object.values(entry.labels)[0];
             if (label !== void 0) valueToLabel[entry.key] = label;
           }
-          dictLabels[desc.name] = valueToLabel;
+          dictLabels[name] = valueToLabel;
         }
       }
     }
@@ -2072,13 +2807,17 @@ var Collection = class {
       fieldMeta: this.fieldMeta,
       moneyFields: this.moneyFields,
       dictKeyFields: this.dictKeyFields,
+      ...this.lookupFields !== void 0 ? { lookupFields: this.lookupFields } : {},
       computed: this.computed,
       refs: this._refs,
       zodFields,
       ...dictLabels !== void 0 ? { dictLabels } : {},
       ...this.meta !== void 0 ? { meta: this.meta } : {},
       ...this.i18nFields !== void 0 ? { i18nFields: this.i18nFields } : {},
-      ...this.classified !== void 0 ? { classified: this.classified.byField } : {}
+      ...this.classified !== void 0 ? { classified: this.classified.byField } : {},
+      ...this.via?.taint !== void 0 ? { taint: this.via.taint } : {},
+      ...this.via ? { viaFragments: this.via.describeFragments() } : {}
+      // #650 Task 7
     });
   }
   /** JSON Schema for this collection with describe() metadata as x- extensions. */
@@ -2199,7 +2938,7 @@ var Collection = class {
     }
     await this.onAccess?.("find", "*");
     if (hits.length === 0) return [];
-    const { verifyDigestField } = await import("./verify-CAYGXYNO.js");
+    const { verifyDigestField } = await import("./verify-GH6CWVSW.js");
     const policy = {
       normalize: spec.verifyNormalize ?? "password",
       notLastN: spec.notLastN ?? 0,
@@ -2286,10 +3025,17 @@ var Collection = class {
    * analysis auto-creates a source collection (without options) during
    * `openVault`, before the user's `collection(name, { moneyFields })`
    * declaration; this reconciles that ordering. First-wins. Not public.
+   *
+   * PREPENDS money rather than appending: {@link compileViaBindings} always
+   * compiles money before i18n (money-first pipeline order — see its
+   * docstring), and by the time this reconcile runs an i18n binding may
+   * already be sitting in `this.via.bindings` (declared at construction).
+   * Appending here would yield `[i18n, money]` on this path vs `[money,
+   * i18n]` from compile — prepending keeps both paths money-first.
    */
   _applyMoneyFields(moneyFields) {
     if (this.moneyFields !== void 0) return;
-    moneyRuntime().validateMoneyFieldPaths(moneyFields);
+    this.via = ViaPipeline.build([viaBinder("money")(moneyFields), ...this.via?.bindings ?? []]);
     this.moneyFields = moneyFields;
   }
   /** @internal — attach computed fields post-construction. See {@link _applyMoneyFields}. */
@@ -2349,6 +3095,13 @@ var Collection = class {
     }
     this.classified = resolved;
     this.computed = { ...resolved.riderComputed, ...this.computed ?? {} };
+    this.via = ViaPipeline.build([...this.via?.bindings ?? [], viaBinder("classified")({
+      entries: classifiedFields,
+      collectionName: this.name,
+      guardCtx: this.classifiedGuardCtx,
+      classifySealedShred: (live) => this.codec.classifySealedShred(live)
+      // #629 T10
+    })]);
   }
   /** @internal — used only in tests; do not read in production code. */
   get _ramCiphertext() {
@@ -2375,7 +3128,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-DP66HFT3.js");
+      const { resolveStaleMVOnRead } = await import("./stale-IYYXEH3U.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name);
     }
     let record;
@@ -2531,7 +3284,7 @@ var Collection = class {
       if (cached) return cached.record;
       const env = await this.adapter.get(this.vault, this.name, id);
       if (!env) return void 0;
-      const rec = await this.codec.decryptRecord(env);
+      const rec = await this.codec.decryptRecord(env, { id });
       return rec === null ? void 0 : rec;
     }
     await this.ensureHydrated();
@@ -2579,7 +3332,7 @@ var Collection = class {
       if (cached2) return { record: cached2.record, version: cached2.version };
       const env = await this.adapter.get(this.vault, this.name, id);
       if (!env) return { record: null, version: 0 };
-      return { record: await this.codec.decryptRecord(env, { skipValidation: true }) ?? null, version: env._v };
+      return { record: await this.codec.decryptRecord(env, { skipValidation: true, id }) ?? null, version: env._v };
     }
     await this.ensureHydrated();
     const cached = this.cache.get(id);
@@ -2613,7 +3366,7 @@ var Collection = class {
     const env = await this.adapter.get(this.vault, this.name, id);
     if (!env) return { env: null, record: null, elided: false };
     try {
-      return { env, record: await this.codec.decryptRecord(env, { skipValidation: true }), elided: false };
+      return { env, record: await this.codec.decryptRecord(env, { skipValidation: true, id }), elided: false };
     } catch {
       return { env, record: null, elided: false };
     }
@@ -2638,7 +3391,7 @@ var Collection = class {
     if (!hasWritePermission(this.keyring, this.name)) {
       throw new ReadOnlyError();
     }
-    if (this.moneyFields) record = moneyRuntime().canonicalizeIncomingMoney(record, this.moneyFields);
+    if (this.via) record = this.via.ingest(record);
     if (this.subsystemBus?.hasGateHandlers("beforePut")) {
       const { env: existingEnv, record: existingRecord } = await this.resolveGatePrior("beforePut", id);
       const gateEvent = {
@@ -2647,7 +3400,7 @@ var Collection = class {
         collection: this.name,
         docId: id,
         incoming: record,
-        existing: this.moneyFields ? moneyRuntime().canonicalizeStoredMoney(existingRecord, this.moneyFields) : existingRecord,
+        existing: this.via ? this.via.canonicalizeStored(existingRecord) : existingRecord,
         existingVersion: existingEnv?._v ?? 0,
         existingTs: existingEnv?._ts,
         userId: this.keyring.userId,
@@ -2656,99 +3409,21 @@ var Collection = class {
       };
       await this.subsystemBus.dispatchGate("beforePut", gateEvent);
     }
-    if (this.classified !== void 0) {
-      enforceClassifiedWrite(record, this.classified.byField, this.name);
-    }
+    const viaWriteCtx = {
+      id,
+      vault: this.vault,
+      prior: async () => await this.resolveDensifyPrior(id) ?? null,
+      emit: (e, p) => this.emitter.emit(e, p)
+    };
+    if (this.via) await this.via.enforceWrite(record, viaWriteCtx);
     if (this.computed !== void 0) {
       record = (await loadEvalComputedFields())(record, this.computed, id);
     }
     if (this.schema !== void 0) {
       record = await validateSchemaInput(this.schema, record, `put(${id})`);
     }
-    if (this.moneyFields) {
-      record = moneyRuntime().quantizeMoneyFields(record, this.moneyFields);
-    }
-    if (this.i18nFields) {
-      const obj = record;
-      for (const [field, descriptor] of Object.entries(this.i18nFields)) {
-        if (!descriptor.options.autoTranslate) continue;
-        const leafValues = getAtPath(obj, field);
-        if (leafValues.length !== 1) continue;
-        const value = leafValues[0];
-        if (!value || typeof value !== "object" || Array.isArray(value)) continue;
-        const map = value;
-        const { languages, required } = descriptor.options;
-        const missing = languages.filter(
-          (lang) => !(lang in map) || map[lang] === ""
-        );
-        if (missing.length === 0) continue;
-        const sourceLocale = languages.find((l) => l in map && map[l] !== "");
-        if (!sourceLocale) continue;
-        if (!this.autoTranslateHook) {
-          throw new TranslatorNotConfiguredError(field, this.name);
-        }
-        const toTranslate = required === "any" ? [] : required === "all" ? missing : missing.filter((l) => required.includes(l));
-        const translated = { ...map };
-        for (const targetLocale of toTranslate) {
-          translated[targetLocale] = await this.autoTranslateHook(
-            map[sourceLocale],
-            sourceLocale,
-            targetLocale,
-            field,
-            this.name
-          );
-        }
-        setAtPathInPlace(obj, field, translated);
-      }
-    }
-    let densifyPrior;
-    let exemptFills;
-    if (this.i18nDensifyFields) {
-      densifyPrior = await this.resolveDensifyPrior(id);
-      exemptFills = this.i18nStrategy.computeExemptFills(
-        densifyPrior,
-        record,
-        this.i18nDensifyFields
-      );
-    }
-    if (this.i18nFields) {
-      const obj = record;
-      for (const [field, descriptor] of Object.entries(this.i18nFields)) {
-        if (!descriptor.options.script) continue;
-        for (const leaf of getAtPath(obj, field)) {
-          if (!leaf || typeof leaf !== "object" || Array.isArray(leaf)) continue;
-          const leafMap = leaf;
-          const { value: cleaned, warnings } = this.i18nStrategy.enforceScript(
-            leafMap,
-            field,
-            descriptor,
-            exemptFills?.get(field)
-          );
-          if (cleaned !== leafMap) Object.assign(leafMap, cleaned);
-          const mode = descriptor.options.onScriptViolation;
-          if (mode === "warn" || mode === "filter") {
-            for (const w of warnings) {
-              this.emitter.emit("i18n:script-violation", {
-                vault: this.vault,
-                collection: this.name,
-                id,
-                mode,
-                warning: w
-              });
-            }
-          }
-        }
-      }
-    }
-    if (this.i18nPutValidator !== void 0) {
-      this.i18nPutValidator(record);
-    }
-    if (this.i18nDensifyFields) {
-      this.i18nStrategy.densify(
-        record,
-        densifyPrior,
-        this.i18nDensifyFields
-      );
+    if (this.via) {
+      record = await this.via.encodeWrite(record, viaWriteCtx);
     }
     if (this.refEnforcer !== void 0) {
       await this.refEnforcer.enforceRefsOnPut(this.name, record);
@@ -2795,7 +3470,7 @@ var Collection = class {
       const existingResolved = existingResolvedRecord !== null ? { record: existingResolvedRecord, version: existingVersion } : void 0;
       if (existingResolved && this.historyConfig.enabled !== false) {
         const vdigCtx2 = this.vdigFields !== null ? { id, prev: existingEnvelope } : void 0;
-        const histEnvelope = await this.codec.encryptRecord(existingResolved.record, existingResolved.version, cek2, void 0, void 0, vdigCtx2);
+        const histEnvelope = await this.codec.encryptRecord(existingResolved.record, existingResolved.version, cek2, void 0, void 0, vdigCtx2, id);
         await this.historyStrategy.saveHistory(this.adapter, this.vault, this.name, id, histEnvelope);
         this.emitter.emit("history:save", { vault: this.vault, collection: this.name, id, version: existingResolved.version });
         if (this.historyConfig.maxVersions) {
@@ -2827,12 +3502,7 @@ var Collection = class {
         this.cache.set(id, { record: resolvedRecord, version: version2 });
         this.indexes?.upsert(id, resolvedRecord, existingResolved ? existingResolved.record : null);
       }
-      await this.onDirty?.(this.name, id, "put", version2);
-      this.emitter.emit("change", { vault: this.vault, collection: this.name, id, action: "put" });
-      this.searchIndexStore?.markDirty();
-      await this.onAccess?.("put", id);
-      await this.dispatchDerivations(id, record, version2);
-      await this.dispatchMaterializedViews(id, record);
+      await this._onRecordMutated(id, "put", "local-write", { record, version: version2 });
       return;
     }
     let existing;
@@ -2842,7 +3512,7 @@ var Collection = class {
       if (!existing) {
         priorRaw = await this.adapter.get(this.vault, this.name, id);
         if (priorRaw) {
-          const previousRecord = await this.codec.decryptRecord(priorRaw);
+          const previousRecord = await this.codec.decryptRecord(priorRaw, { id });
           if (previousRecord !== null) {
             existing = { record: previousRecord, version: priorRaw._v };
           }
@@ -2861,7 +3531,7 @@ var Collection = class {
     const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
     const vdigCtx = this.vdigFields !== null ? { id, prev: await this.adapter.get(this.vault, this.name, id) } : void 0;
     if (existing && this.historyConfig.enabled !== false) {
-      const historyEnvelope = await this.codec.encryptRecord(existing.record, existing.version, cek, void 0, void 0, vdigCtx);
+      const historyEnvelope = await this.codec.encryptRecord(existing.record, existing.version, cek, void 0, void 0, vdigCtx, id);
       await this.historyStrategy.saveHistory(this.adapter, this.vault, this.name, id, historyEnvelope);
       this.emitter.emit("history:save", {
         vault: this.vault,
@@ -2875,7 +3545,7 @@ var Collection = class {
         });
       }
     }
-    const envelope = await this.codec.encryptRecord(record, version, cek, options?.source, options?.sourceTs, vdigCtx);
+    const envelope = await this.codec.encryptRecord(record, version, cek, options?.source, options?.sourceTs, vdigCtx, id);
     await this.adapter.put(this.vault, this.name, id, envelope);
     await this._ensureClassifiedMarker();
     if (this.embeddings) {
@@ -2904,17 +3574,7 @@ var Collection = class {
       this.indexes?.upsert(id, record, existing ? existing.record : null);
       this.uniqueConstraints?.upsert(id, record, existing?.record);
     }
-    await this.onDirty?.(this.name, id, "put", version);
-    this.emitter.emit("change", {
-      vault: this.vault,
-      collection: this.name,
-      id,
-      action: "put"
-    });
-    this.searchIndexStore?.markDirty();
-    await this.onAccess?.("put", id);
-    await this.dispatchDerivations(id, record, version);
-    await this.dispatchMaterializedViews(id, record);
+    await this._onRecordMutated(id, "put", "local-write", { record, version });
   }
   /**
    * Fire registered MV strategies whose dependency set includes this
@@ -2926,10 +3586,10 @@ var Collection = class {
    * MV-emitted row (carries `_materializedFrom`) — defensive guard
    * against missed cycle detection.
    *
-   * @internal
+   * @internal `wave` (#638 Task 4): when present (the sync/cutover/restore dispatch wave),
+   * an eager MV already refreshed this wave is skipped (per-target dedup, keyed on spec name).
    */
-  async dispatchMaterializedViews(id, record) {
-    void id;
+  async dispatchMaterializedViews(id, record, wave) {
     if (this.materializedViewSource === void 0) return;
     const incoming = record;
     if (incoming && typeof incoming === "object" && "_materializedFrom" in incoming) return;
@@ -2941,18 +3601,20 @@ var Collection = class {
     for (const reg of mvs) {
       const mode = reg.spec.refresh;
       if (mode === "eager") {
+        if (wave?.seen(`mv\0${reg.spec.name}`)) continue;
         if (executor === null) {
           ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-6LHOV7MN.js"));
+          ({ MaterializedViewExecutor: executor } = await import("./executor-IL7SRNUZ.js"));
         }
         await executor.refresh(reg, {
           getCollection: (name) => this.materializedViewSource.getCollection(name),
           getActiveTxContext: () => this.materializedViewSource.getActiveTxContext(),
-          getQueryContext: () => this.materializedViewSource.getQueryContext()
+          getQueryContext: () => this.materializedViewSource.getQueryContext(),
+          dispatchCtx: this.#dispatchCtx({ collection: this.name, id })
         });
       } else if (mode === "lazy") {
         if (staleHelpers === null) {
-          staleHelpers = await import("./stale-DP66HFT3.js");
+          staleHelpers = await import("./stale-IYYXEH3U.js");
         }
         staleHelpers.markMVStale(registry, reg.spec.name);
       }
@@ -3004,7 +3666,15 @@ var Collection = class {
       raw = (await this.resolvePriorValues(id))?.record ?? null;
     }
     if (raw === null) return null;
-    return this.moneyFields ? moneyRuntime().canonicalizeStoredMoney(raw, this.moneyFields) : raw;
+    return this.via ? this.via.canonicalizeStored(raw) : raw;
+  }
+  /** @internal #638 Task 4 — decrypted STORED-form record + envelope version for the sync/cutover/
+   *  restore dispatch wave (id threaded into decrypt, matching `_invalidateCacheEntry`'s contract). */
+  async _getStoredRecordForDispatch(id) {
+    const env = await this.adapter.get(this.vault, this.name, id);
+    if (!env || isTombstone(env, this.storeCiphertext) || isDeleteMarker(env)) return null;
+    const record = await this.codec.decryptRecord(env, { id });
+    return record === null ? null : { record, version: env._v };
   }
   /**
    * @internal Ids of records whose top-level `field` equals `value`.
@@ -3035,19 +3705,22 @@ var Collection = class {
     }
     return out;
   }
-  /**
-   * @internal Recompute a rollup aggregate onto the parent.
-   * Gathers every child of `parentId`, runs `compute`, and patches only the
-   * rollup `field` onto the parent's raw stored record (value-equality
-   * guarded). No-op when the parent record does not exist.
-   */
-  async recomputeRollup(spec, parentId) {
-    if (this.derivationSource === void 0 || spec.rollup === void 0) return;
+  /** @internal Recompute a rollup aggregate onto the parent from `parentId`'s current children
+   *  (value-equality guarded; no-op absent parent). `wave` (#638 T4): per-target dedup. Returns
+   *  the `putDerivedOutput` outcome, or `'noop'` when nothing needed recomputing (#638 T6 —
+   *  `dispatchRollupsOnDelete`'s forget-fanout caller needs this to fill the forget report). */
+  /** @internal — ctx for `putDerivedOutput`'s frozen-period skip+audit (#638 Task 5). */
+  #dispatchCtx(source) {
+    return { emit: (e, p) => this.emitter.emit(e, p), source, audit: ledgerAuditHook(this.ledger, this.keyring.userId) };
+  }
+  async recomputeRollup(spec, parentId, source, wave) {
+    if (this.derivationSource === void 0 || spec.rollup === void 0) return "noop";
     const { from, key, field, compute } = spec.rollup;
     const into = spec.source;
+    if (wave?.seen(`rollup\0${into}\0${parentId}\0${field}`)) return "noop";
     const intoColl = this.derivationSource.getCollection(into);
     const base = await intoColl._getStoredRecord(parentId);
-    if (base === null) return;
+    if (base === null) return "noop";
     const fromColl = this.derivationSource.getCollection(from);
     const childIds = await fromColl._findMatchingIds(key, parentId);
     const children = [];
@@ -3056,7 +3729,7 @@ var Collection = class {
       if (c !== null && c !== void 0) children.push(c);
     }
     const newValue = compute(children);
-    if (selfWriteFieldEqual(base[field], newValue)) return;
+    if (selfWriteFieldEqual(base[field], newValue)) return "noop";
     const patched = { ...base, [field]: newValue };
     const txCtx = this.derivationSource.getActiveTxContext();
     if (txCtx !== null) {
@@ -3066,28 +3739,32 @@ var Collection = class {
         priorEnvelope: prior
       });
     }
-    await intoColl.put(parentId, patched);
+    return putDerivedOutput(intoColl, parentId, patched, this.#dispatchCtx(source));
   }
   /**
-   * @internal Fire any rollups for which THIS collection is the
-   * child `from`, recomputing the affected parent after a child delete. Called
-   * from the delete path with the just-removed record's key value. Other
-   * derivation kinds do not react to deletes (unchanged).
+   * @internal Fire any rollups for which THIS collection is the child `from`, recomputing the
+   * affected parent after a child delete/forget. Called from the delete path (return discarded)
+   * and from `forgetDerivedFanout` (#638 Task 6), which needs the per-target outcome to fill
+   * `ForgetResult.derivedAggregatesRecomputed`/`derivedResidueFrozen`.
    */
-  async dispatchRollupsOnDelete(deleted) {
-    if (this.derivationSource === void 0) return;
+  async dispatchRollupsOnDelete(id, deleted) {
+    if (this.derivationSource === void 0) return [];
     const registry = this.derivationSource.registry();
     const rec = deleted;
+    const results = [];
     for (const { spec } of registry.strategiesForSource(this.name)) {
       if (!spec.rollup || spec.rollup.from !== this.name) continue;
       const kv = rec[spec.rollup.key];
       if (typeof kv !== "string" && typeof kv !== "number") continue;
-      await this.recomputeRollup(spec, String(kv));
+      results.push({ into: spec.source, parentId: String(kv), outcome: await this.recomputeRollup(spec, String(kv), { collection: this.name, id }) });
     }
+    return results;
   }
-  async dispatchDerivations(id, record, version) {
+  /** @internal `wave` (#638 Task 4) — threaded to `recomputeRollup` for the sync/cutover/restore
+   *  dispatch wave's per-target dedup; `undefined` on the local-write path (byte-identical). */
+  async dispatchDerivations(id, record, version, wave) {
     if (this.derivationSource === void 0) return;
-    const incoming = this.moneyFields ? moneyRuntime().canonicalizeStoredMoney(record, this.moneyFields) : record;
+    const incoming = this.via ? this.via.canonicalizeStored(record) : record;
     if (incoming && typeof incoming === "object" && "_derivedFrom" in incoming) return;
     const registry = this.derivationSource.registry();
     const strategies = registry.strategiesForSource(this.name);
@@ -3104,7 +3781,7 @@ var Collection = class {
         } else {
           parentId = id;
         }
-        if (parentId !== null) await this.recomputeRollup(spec, parentId);
+        if (parentId !== null) await this.recomputeRollup(spec, parentId, { collection: this.name, id }, wave);
         continue;
       }
       const isSource = spec.source === this.name;
@@ -3137,10 +3814,11 @@ var Collection = class {
         continue;
       }
       if (DerivationExecutor === null) {
-        ({ DerivationExecutor } = await import("./executor-EUPYHCLU.js"));
+        ({ DerivationExecutor } = await import("./executor-WAEI6PDV.js"));
       }
       for (const run of runs) {
         const ctx = { vault: this.derivationSource.getReadOnlyFacade() };
+        const outCtx = this.#dispatchCtx({ collection: spec.source, id: run.runId });
         const result = await DerivationExecutor.run(spec, run.input, run.version, strategyHash, ctx);
         for (const key of Object.keys(spec.outputs)) {
           const out = result.outputs[key];
@@ -3156,7 +3834,7 @@ var Collection = class {
           const outputCollection = this.derivationSource.getCollection(outSpec.collection);
           const txCtx = this.derivationSource.getActiveTxContext();
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-BDKLP5GG.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-CI5BCMQM.js");
             const prior = await loadFanoutSidecar(this.adapter, this.vault, spec.source, run.runId, key, this.getDEK, this.storeCiphertext);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -3178,7 +3856,7 @@ var Collection = class {
                   priorEnvelope
                 });
               }
-              await outputCollection.put(entry.key, entry.value, { source: "derived" });
+              await putDerivedOutput(outputCollection, entry.key, entry.value, outCtx, { source: "derived" });
             }
             await saveFanoutSidecar(this.adapter, this.vault, {
               source: spec.source,
@@ -3211,7 +3889,7 @@ var Collection = class {
                 priorEnvelope: prior
               });
             }
-            await outputCollection.put(run.runId, patched, { source: "derived" });
+            await putDerivedOutput(outputCollection, run.runId, patched, outCtx, { source: "derived" });
             continue;
           }
           if (txCtx !== null) {
@@ -3226,7 +3904,7 @@ var Collection = class {
               priorEnvelope: prior
             });
           }
-          await outputCollection.put(run.runId, out.value, { source: "derived" });
+          await putDerivedOutput(outputCollection, run.runId, out.value, outCtx, { source: "derived" });
         }
       }
     }
@@ -3283,9 +3961,9 @@ var Collection = class {
       const next = transform(record);
       const nextVersion = (env._v ?? 0) + 1;
       const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
-      const newEnv = await this.codec.encryptRecord(next, nextVersion, cek, void 0, void 0, this.vdigFields !== null ? { id, prev: env } : void 0);
+      const newEnv = await this.codec.encryptRecord(next, nextVersion, cek, void 0, void 0, this.vdigFields !== null ? { id, prev: env } : void 0, id);
       await this.adapter.put(this.vault, this.name, id, newEnv);
-      await this._invalidateCacheEntry(id);
+      await this._onRecordMutated(id, "put", "cutover");
       if (this.ledger) {
         await this.ledger.append({
           op: "migration",
@@ -3314,9 +3992,8 @@ var Collection = class {
    * history snapshot still fire so backup integrity and time-travel
    * reconstruction stay consistent.
    *
-   * Returns silently for delete-of-absent (idempotent contract — both
-   * paths honour this: the `txCtx === null` path also reads the prior
-   * envelope and short-circuits before the ledger/event side-effects).
+   * Returns `true` when it erased a live record, `false` for delete-of-absent (idempotent
+   * contract — both txCtx-aware and txCtx===null callers honour this, short-circuiting before any side-effect).
    *
    * When a `txCtx` is supplied, the prior envelope is captured and
    * pushed onto `txCtx._executed` BEFORE the delete fires — mirrors
@@ -3345,7 +4022,7 @@ var Collection = class {
    */
   async _internalDelete(id, txCtx = null) {
     const prior = await this.adapter.get(this.vault, this.name, id);
-    if (prior === null) return;
+    if (prior === null) return false;
     if (txCtx !== null) {
       txCtx._executed.push({
         op: {
@@ -3358,6 +4035,7 @@ var Collection = class {
       });
     }
     await this._doDelete(id, true);
+    return true;
   }
   async _doDelete(id, internal) {
     if (!hasWritePermission(this.keyring, this.name)) {
@@ -3370,7 +4048,7 @@ var Collection = class {
           vault: this.vault,
           collection: this.name,
           docId: id,
-          existing: this.moneyFields ? moneyRuntime().canonicalizeStoredMoney(existingRecord, this.moneyFields) : existingRecord,
+          existing: this.via ? this.via.canonicalizeStored(existingRecord) : existingRecord,
           existingVersion: existingEnv?._v ?? 0,
           existingTs: existingEnv?._ts,
           internal,
@@ -3388,7 +4066,7 @@ var Collection = class {
       if (!existing && this.historyConfig.enabled !== false) {
         const previousEnvelope2 = await this.adapter.get(this.vault, this.name, id);
         if (previousEnvelope2) {
-          const previousRecord = await this.codec.decryptRecord(previousEnvelope2);
+          const previousRecord = await this.codec.decryptRecord(previousEnvelope2, { id });
           if (previousRecord !== null) {
             existing = { record: previousRecord, version: previousEnvelope2._v };
           }
@@ -3400,7 +4078,7 @@ var Collection = class {
     if (existing && this.historyConfig.enabled !== false) {
       const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
       const prevForVdig = this.vdigFields !== null ? await this.adapter.get(this.vault, this.name, id) : null;
-      const historyEnvelope = await this.codec.encryptRecord(existing.record, existing.version, cek, void 0, void 0, this.vdigFields !== null ? { id, prev: prevForVdig } : void 0);
+      const historyEnvelope = await this.codec.encryptRecord(existing.record, existing.version, cek, void 0, void 0, this.vdigFields !== null ? { id, prev: prevForVdig } : void 0, id);
       await this.historyStrategy.saveHistory(this.adapter, this.vault, this.name, id, historyEnvelope);
     }
     const previousEnvelope = await this.adapter.get(this.vault, this.name, id);
@@ -3436,19 +4114,11 @@ var Collection = class {
         this.uniqueConstraints?.remove(id, existing.record);
       }
     }
-    await this.onDirty?.(this.name, id, "put", markerVersion ?? (existing?.version ?? 0) + 1);
-    this.emitter.emit("change", {
-      vault: this.vault,
-      collection: this.name,
-      id,
-      action: "delete"
-    });
-    this.searchIndexStore?.markDirty();
-    await this.onAccess?.("delete", id);
+    await this._onRecordMutated(id, "delete", "local-delete", { version: markerVersion ?? (existing?.version ?? 0) + 1 });
     if (!internal) {
       await this.dispatchMaterializedViewsOnDelete(id);
       await this.dispatchArrayDerivationsOnDelete(id);
-      if (existing) await this.dispatchRollupsOnDelete(existing.record);
+      if (existing) await this.dispatchRollupsOnDelete(id, existing.record);
     }
   }
   /**
@@ -3497,75 +4167,81 @@ var Collection = class {
     return { previousVersion: live._v };
   }
   /**
-   * Cascade deletes of array-shape derived rows when a source row is
-   * deleted. Reads each registered strategy's fanout sidecar
-   * for this source id, deletes every listed derived row, then
-   * deletes the sidecar itself.
-   *
-   * Record-shape derivations are skipped — see _doDelete's comment
-   * for why the asymmetry is correct.
+   * Cascade deletes of array-shape derived rows when a source row is deleted. Reads each
+   * registered strategy's fanout sidecar for this source id, deletes every listed derived
+   * row, then deletes the sidecar itself. Returns the REAL erased count (#622 review Finding 1).
    *
+   * Record-shape derivations are skipped on the ordinary delete path (see _doDelete's comment).
+   * `eraseRecordShapeToo` (#638 T6, default `false`) opts a same-id record-shape copy into
+   * erasure too — forget()'s fanout, GDPR residue. A delete-of-absent contributes 0 either way.
    * @internal
    */
-  async dispatchArrayDerivationsOnDelete(id) {
-    if (this.derivationSource === void 0) return;
+  async dispatchArrayDerivationsOnDelete(id, eraseRecordShapeToo = false) {
+    if (this.derivationSource === void 0) return 0;
     const registry = this.derivationSource.registry();
     const strategies = registry.strategiesForSource(this.name);
-    if (strategies.length === 0) return;
+    if (strategies.length === 0) return 0;
     let helpers = null;
     const txCtx = this.derivationSource.getActiveTxContext();
+    let erased = 0;
     for (const { spec } of strategies) {
       for (const [outputKey, outSpec] of Object.entries(spec.outputs)) {
-        if (outSpec.shape !== "array") continue;
+        if (outSpec.shape === "record") {
+          if (eraseRecordShapeToo && spec.source === this.name && outSpec.collection !== this.name) {
+            if (await this.derivationSource.getCollection(outSpec.collection)._internalDelete(id, txCtx)) erased += 1;
+          }
+          continue;
+        }
         if (helpers === null) {
-          helpers = await import("./fanout-sidecar-BDKLP5GG.js");
+          helpers = await import("./fanout-sidecar-CI5BCMQM.js");
         }
         const sidecar = await helpers.loadFanoutSidecar(this.adapter, this.vault, spec.source, id, outputKey, this.getDEK, this.storeCiphertext);
         if (!sidecar) continue;
         const outputCollection = this.derivationSource.getCollection(outSpec.collection);
         for (const derivedId of sidecar.keys) {
-          await outputCollection._internalDelete(derivedId, txCtx);
+          if (await outputCollection._internalDelete(derivedId, txCtx)) erased += 1;
         }
         await helpers.deleteFanoutSidecar(this.adapter, this.vault, spec.source, id, outputKey);
       }
     }
+    return erased;
   }
   /**
-   * Mirror of {@link dispatchMaterializedViews} for the delete path.
-   * No record content is available (it's gone), so the
-   * `_materializedFrom` skip used by the put-side dispatch doesn't
-   * apply here — instead, the recursion guard is the `internal` gate
-   * at the `_doDelete` call site above.
-   *
+   * Mirror of {@link dispatchMaterializedViews} for the delete/forget path — no `_materializedFrom`
+   * skip (record's gone); the `internal` gate at `_doDelete` is the recursion guard. Returns the
+   * row count TOMBSTONED across every eager MV sourced here (#638 T6 — `forgetDerivedFanout`'s
+   * `derivedRecordsErased`); a lazy MV only flips its stale bit (0 contribution — resolved on read).
    * @internal
    */
   async dispatchMaterializedViewsOnDelete(id) {
-    void id;
-    if (this.materializedViewSource === void 0) return;
+    if (this.materializedViewSource === void 0) return 0;
     const registry = this.materializedViewSource.registry();
     const mvs = registry.mvsForSource(this.name);
-    if (mvs.length === 0) return;
+    if (mvs.length === 0) return 0;
     let executor = null;
     let staleHelpers = null;
+    let deleted = 0;
     for (const reg of mvs) {
       const mode = reg.spec.refresh;
       if (mode === "eager") {
         if (executor === null) {
           ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-6LHOV7MN.js"));
+          ({ MaterializedViewExecutor: executor } = await import("./executor-IL7SRNUZ.js"));
         }
-        await executor.refresh(reg, {
+        deleted += (await executor.refresh(reg, {
           getCollection: (name) => this.materializedViewSource.getCollection(name),
           getActiveTxContext: () => this.materializedViewSource.getActiveTxContext(),
-          getQueryContext: () => this.materializedViewSource.getQueryContext()
-        });
+          getQueryContext: () => this.materializedViewSource.getQueryContext(),
+          dispatchCtx: this.#dispatchCtx({ collection: this.name, id })
+        })).deleted;
       } else if (mode === "lazy") {
         if (staleHelpers === null) {
-          staleHelpers = await import("./stale-DP66HFT3.js");
+          staleHelpers = await import("./stale-IYYXEH3U.js");
         }
         staleHelpers.markMVStale(registry, reg.spec.name);
       }
     }
+    return deleted;
   }
   /**
    * List all records in the collection.
@@ -3584,22 +4260,14 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-DP66HFT3.js");
+      const { resolveStaleMVOnRead } = await import("./stale-IYYXEH3U.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name);
     }
     await this.ensureHydrated();
     const records = [...this.cache.values()].map((e) => e.record);
-    if (!this.hasReadTransforms()) return records;
+    if (!this.via) return records;
     return Promise.all(records.map((r) => this.applyLocaleToRecord(r, locale)));
   }
-  /**
-   * @internal — whether any read-side record transform is registered
-   * (money decode, i18nText resolution, dictKey labels). Gates the
-   * no-transform fast path in {@link list}.
-   */
-  hasReadTransforms() {
-    return this.moneyFields !== void 0 && Object.keys(this.moneyFields).length > 0 || this.i18nFields !== void 0 && Object.keys(this.i18nFields).length > 0 || this.dictKeyFields !== void 0 && Object.keys(this.dictKeyFields).length > 0;
-  }
   /**
    * Scan-mode full-text search over a plain-text `field`. Decrypts the
    * collection in memory and ranks records by BM25 against the tokenized query.
@@ -3826,7 +4494,7 @@ var Collection = class {
       getIndexes: () => this.getIndexes(),
       lookupById: (id) => this.cache.get(id)?.record,
       snapshotEntries: () => [...this.cache.entries()].map(([id, e]) => ({ id, record: e.record })),
-      ...this.moneyFields ? { moneyFields: this.moneyFields } : {}
+      ...this.via ? { via: this.via } : {}
     };
     const resolver = this.joinResolver;
     const leftCollection = this.name;
@@ -3906,8 +4574,7 @@ var Collection = class {
    * silently miss records — consistent with the `query()` /
    * `list()` lazy-mode policy. If this becomes a blocker for a
    * real consumer, the fix is to add an async `scan()`-backed
-   * variant of this method, which is exactly what  streaming
-   * joins will need anyway.
+   * variant of this method, which is exactly what streaming joins will need anyway.
    */
   querySourceForJoin() {
     if (this.lazy) {
@@ -3927,9 +4594,8 @@ var Collection = class {
         this.emitter.on("change", handler);
         return () => this.emitter.off("change", handler);
       },
-      // Expose this (right-side) collection's i18nText descriptors so
-      // the join executor can resolve joined i18n fields at the `join` layer.
-      ...this.i18nFields !== void 0 ? { i18nFields: this.i18nFields } : {}
+      // Sync join dressing (#650 Task 6, #626 retirement) — i18n-text + lookup-label, from this collection's own bindings.
+      ...this.presentForJoin !== void 0 ? { presentForJoin: this.presentForJoin } : {}
     };
   }
   /**
@@ -3965,7 +4631,7 @@ var Collection = class {
     );
     const entries = [];
     for (const env of envelopes) {
-      const record = await this.codec.decryptRecord(env, { skipValidation: true });
+      const record = await this.codec.decryptRecord(env, { skipValidation: true, id });
       if (record === null) continue;
       entries.push({
         version: env._v,
@@ -3994,7 +4660,7 @@ var Collection = class {
       version
     );
     if (!envelope) return null;
-    return this.codec.decryptRecord(envelope, { skipValidation: true });
+    return this.codec.decryptRecord(envelope, { skipValidation: true, id });
   }
   /** Revert a record to a past version. Creates a new version with the old content. */
   async revert(id, version) {
@@ -4102,7 +4768,7 @@ var Collection = class {
       const id = ids[i];
       const envelope = await this.adapter.get(this.vault, this.name, id);
       if (envelope) {
-        const record = await this.codec.decryptRecord(envelope, { sealedAsHandles: true });
+        const record = await this.codec.decryptRecord(envelope, { id, sealedAsHandles: true });
         if (record === null) continue;
         items.push(record);
         if (!this.lazy && !this.cache.has(id)) {
@@ -4176,14 +4842,14 @@ var Collection = class {
       [],
       [],
       joinContext,
-      this.moneyFields
+      this.via
     );
   }
   /** Decrypt a page of envelopes returned by `adapter.listPage`. */
   async decryptPage(items) {
     const out = [];
     for (const { id, envelope } of items) {
-      const record = await this.codec.decryptRecord(envelope, { sealedAsHandles: true });
+      const record = await this.codec.decryptRecord(envelope, { id, sealedAsHandles: true });
       if (record === null) continue;
       out.push({ id, record, version: envelope._v });
     }
@@ -4243,7 +4909,7 @@ var Collection = class {
       }
       return;
     }
-    const record = await this.codec.decryptRecord(envelope, { sealedAsHandles: true });
+    const record = await this.codec.decryptRecord(envelope, { id, sealedAsHandles: true });
     if (record === null) {
       this.cache.delete(id);
       if (previous) {
@@ -4263,9 +4929,63 @@ var Collection = class {
    * Never writes to the store and never fires write hooks, so it cannot loop.
    */
   async _applyRemoteChange(id, action) {
-    await this._invalidateCacheEntry(id);
-    this.emitter.emit("change", { vault: this.vault, collection: this.name, id, action });
-    this.searchIndexStore?.markDirty();
+    await this._onRecordMutated(id, action, "tab-mirror");
+  }
+  /**
+   * Origin-tagged mutation choke point (#623 task 10) — the single dispatch
+   * point every put/delete path funnels through, AFTER its own store write,
+   * to fire the side-effects that path performs today. Each case below
+   * performs EXACTLY the side-effect set the seam-map Part-3 table
+   * (`.superpowers/sdd/seam-map-i18n-pipeline.md`) records for `origin` —
+   * this is a pure parity extraction of existing tails, not a behavior
+   * change. Phase C (#621, #622) plugs the dependency-graph dispatch into
+   * this socket, keyed off `origin`, without every call site having to
+   * learn the graph.
+   *
+   * `restore` is never reached: `Vault.load` / `backup.ts#loadVault` drops
+   * the whole `collectionCache` instead of dispatching per record — the
+   * origin is reserved for phase C.
+   *
+   * @internal
+   */
+  async _onRecordMutated(id, action, origin, ctx) {
+    switch (origin) {
+      case "local-write": {
+        const record = ctx.record;
+        const version = ctx.version;
+        await this.onDirty?.(this.name, id, "put", version);
+        this.emitter.emit("change", { vault: this.vault, collection: this.name, id, action: "put" });
+        this.searchIndexStore?.markDirty();
+        await this.onAccess?.("put", id);
+        await this.dispatchDerivations(id, record, version);
+        await this.dispatchMaterializedViews(id, record);
+        return;
+      }
+      case "local-delete": {
+        await this.onDirty?.(this.name, id, "put", ctx.version);
+        this.emitter.emit("change", { vault: this.vault, collection: this.name, id, action: "delete" });
+        this.searchIndexStore?.markDirty();
+        await this.onAccess?.("delete", id);
+        return;
+      }
+      case "tab-mirror":
+        await this._invalidateCacheEntry(id);
+        this.emitter.emit("change", { vault: this.vault, collection: this.name, id, action });
+        this.searchIndexStore?.markDirty();
+        return;
+      case "sync-apply":
+        this._invalidateCekCacheEntry(id);
+        await this._invalidateCacheEntry(id);
+        this.graphDispatch?.collect(this.name, id);
+        return;
+      case "cutover":
+        await this._invalidateCacheEntry(id);
+        this.graphDispatch?.collect(this.name, id);
+        return;
+      case "restore":
+        this.graphDispatch?.collect(this.name, id);
+        return;
+    }
   }
   /** @internal — the current in-memory record without a store read (for conflict capture). */
   _peekCached(id) {
@@ -4423,7 +5143,7 @@ var Collection = class {
     for (const [id, entry] of this.cache) {
       const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
       const prevForVdig = this.vdigFields !== null ? await this.adapter.get(this.vault, this.name, id) : null;
-      result[id] = await this.codec.encryptRecord(entry.record, entry.version, cek, void 0, void 0, this.vdigFields !== null ? { id, prev: prevForVdig } : void 0);
+      result[id] = await this.codec.encryptRecord(entry.record, entry.version, cek, void 0, void 0, this.vdigFields !== null ? { id, prev: prevForVdig } : void 0, id);
     }
     return result;
   }
@@ -4435,93 +5155,22 @@ var Collection = class {
    * `this.defaultLocale`.
    *
    * - i18nText fields: replaced with the resolved string (or the full
-   *   map when `locale === 'raw'`).
-   * - dictKey fields: `<field>Label` virtual fields added.
-   *
-   * Returns the record unchanged when no locale is active and no i18n/dict
-   * fields are registered.
-   */
-  async applyLocaleToRecord(record, localeOpts) {
-    const hasI18n = this.i18nFields && Object.keys(this.i18nFields).length > 0;
-    const hasDict = this.dictKeyFields && Object.keys(this.dictKeyFields).length > 0;
-    const hasMoney = this.moneyFields && Object.keys(this.moneyFields).length > 0;
-    if (!hasI18n && !hasDict && !hasMoney) return record;
-    const locale = localeOpts?.locale ?? this.defaultLocale;
-    let result = record;
-    if (hasMoney && this.moneyFields) {
-      result = moneyRuntime().decodeMoneyFields(result, this.moneyFields, typeof locale === "string" ? locale : void 0);
-    }
-    const hasStaticDisplay = hasDict && this.dictKeyFields !== void 0 && Object.values(this.dictKeyFields).some(
-      (d) => isStaticDictDescriptor(d) && d.displayLocale !== void 0
-    );
-    if (!locale && !hasStaticDisplay) return stripI18nFilled(result);
-    const layer = localeOpts?._layer ?? "read";
-    if (locale && hasI18n && this.i18nFields) {
-      result = this.i18nStrategy.applyI18nLocale(result, this.i18nFields, locale, localeOpts?.fallback, layer);
-    }
-    if (hasDict && this.dictKeyFields && this.dictLabelResolver && locale !== "raw") {
-      const withLabels = { ...result };
-      const resolver = this.dictLabelResolver;
-      for (const [field, desc] of Object.entries(this.dictKeyFields)) {
-        const policy = desc.onMissing ? resolvePolicy(desc.onMissing, layer) : "null";
-        const fallback = policy === "substitute" ? localeOpts?.fallback ?? desc.substitute : localeOpts?.fallback;
-        const effLocale = locale ?? (isStaticDictDescriptor(desc) ? desc.displayLocale : void 0);
-        const resolveKey = async (key) => {
-          if (!effLocale) {
-            if (policy === "throw") {
-              throw new LocaleNotSpecifiedError(
-                field,
-                `dictKey "${field}": no locale active to resolve key "${key}".`
-              );
-            }
-            return null;
-          }
-          const label = await resolver(desc.name, key, effLocale, fallback);
-          if (label === void 0) {
-            if (policy === "throw") {
-              throw new LocaleNotSpecifiedError(
-                field,
-                `dictKey "${field}": no label for key "${key}" in locale "${effLocale}".`
-              );
-            }
-            return null;
-          }
-          return label;
-        };
-        if (field.includes("[].")) {
-          const parts = field.split("[].");
-          const arrayKey = parts[0];
-          const leaf = parts[1];
-          if (!leaf || leaf.includes(".")) continue;
-          const arr = withLabels[arrayKey];
-          if (!Array.isArray(arr)) continue;
-          const labelKey = `${leaf}Label`;
-          withLabels[arrayKey] = await Promise.all(
-            arr.map(async (el) => {
-              if (!el || typeof el !== "object" || Array.isArray(el)) return el;
-              const k = el[leaf];
-              if (typeof k !== "string") return el;
-              return { ...el, [labelKey]: await resolveKey(k) };
-            })
-          );
-          continue;
-        }
-        const val = result[field];
-        if (Array.isArray(val)) {
-          withLabels[`${field}Label`] = await Promise.all(
-            val.map(async (k) => ({
-              key: k,
-              label: typeof k === "string" ? await resolveKey(k) : null
-            }))
-          );
-        } else if (typeof val === "string") {
-          const label = await resolveKey(val);
-          if (label !== null) withLabels[`${field}Label`] = label;
-        }
-      }
-      result = withLabels;
-    }
-    return stripI18nFilled(result);
+   *   map when `locale === 'raw'`).
+   * - dictKey fields: `<field>Label` virtual fields added.
+   *
+   * Returns the record unchanged when no Via pipeline is compiled (#638 Task 7:
+   * was money/i18n/dictKey-flag-gated — missed any OTHER binding's `present`
+   * hook, e.g. the `computed` via-binding's virtual-mode read-time compute;
+   * `this.via` truthiness is the general condition every binding's presence
+   * already implies).
+   */
+  async applyLocaleToRecord(record, localeOpts) {
+    if (!this.via) return record;
+    const locale = localeOpts?.locale ?? this.defaultLocale;
+    const layer = localeOpts?._layer ?? "read";
+    let result = record;
+    result = await this.via.present(result, { locale, ...localeOpts?.fallback !== void 0 ? { fallback: localeOpts.fallback } : {}, layer });
+    return result;
   }
   /**
    * Low-level: encrypt a pre-serialised JSON string into an EncryptedEnvelope.
@@ -4738,14 +5387,14 @@ var Collection = class {
   /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
   async _ensureClassifiedMarker() {
     if (this._markerPersisted || this.vdigFields === null) return;
-    const { persistClassifiedMarkerForFields } = await import("./config-drift-LRKCC3VZ.js");
+    const { persistClassifiedMarkerForFields } = await import("./classified-marker-IO5EBW7Q.js");
     await persistClassifiedMarkerForFields(this.adapter, this.vault, this.name, this.vdigFields, await this.getDEK(this.name));
     this._markerPersisted = true;
   }
   /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
   async _classifiedMarkerDigestOnly() {
     if (this._markerDigestOnlyCache !== void 0) return this._markerDigestOnlyCache;
-    const { readClassifiedMarkerDigestOnly } = await import("./config-drift-LRKCC3VZ.js");
+    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-IO5EBW7Q.js");
     this._markerDigestOnlyCache = await readClassifiedMarkerDigestOnly(this.adapter, this.vault, this.name, await this.getDEK(this.name));
     return this._markerDigestOnlyCache;
   }
@@ -4824,6 +5473,10 @@ var Collection = class {
   _classifySealedShred(live) {
     return classifySealedShred(this.tiersContext(), live);
   }
+  async _onViaErase(id, live) {
+    return this.via ? this.via.eraseSealed({ id, vault: this.vault, live, crypto: await this.codec.eraseCryptoCtx(id, live) }) : void 0;
+  }
+  // @internal forget()'s per-ref via-erase fold (#629 T10)
   /**
    * Bind the {@link TiersContext} the tier ops need. The `cekCache` is passed
    * by reference (the SAME `Lru` the kernel's read/write path owns) so an
@@ -5224,7 +5877,7 @@ var VaultPeriods = class {
       ...anchor.priorPeriodName !== void 0 && { priorPeriodName: anchor.priorPeriodName },
       ...options.dateField !== void 0 && { dateField: options.dateField }
     };
-    const envelope = await this.writePeriodRecord(record);
+    const envelope = await this.writeReserved(PERIODS_COLLECTION, record.name, record);
     await this.deps.strategy.appendPeriodLedgerEntry(this.deps.getLedgerOrNull(), this.deps.userId(), envelope, record.name);
     existing.push(record);
     this.periodCache = existing;
@@ -5279,20 +5932,208 @@ var VaultPeriods = class {
       priorPeriodName: anchor.priorPeriodName ?? prior.name,
       ...openingCollections.length > 0 && { openingCollections }
     };
-    const envelope = await this.writePeriodRecord(record);
+    const envelope = await this.writeReserved(PERIODS_COLLECTION, record.name, record);
     await this.deps.strategy.appendPeriodLedgerEntry(this.deps.getLedgerOrNull(), this.deps.userId(), envelope, record.name);
     existing.push(record);
     this.periodCache = existing;
     return record;
   }
-  /** Return every closed / opened period in `closedAt` order. */
+  /**
+   * Freeze a closed period: physically purges delete markers whose `_ts`
+   * falls inside the period's window (#604) and records the fact in a
+   * companion `_period_freezes/<name>` record. NEVER mutates the
+   * hash-chained `_periods/<name>` record's stored bytes — `frozenAt` /
+   * `frozenBy` / `purgedMarkerCount` are merged into `PeriodRecord`s on
+   * read only. Idempotent: a second call is a no-op that returns the
+   * same merged record without re-purging or re-appending a ledger entry.
+   */
+  async freezePeriod(name) {
+    const existing = await this.loadPeriodsCache();
+    const period = existing.find((p) => p.name === name);
+    if (!period) throw new ValidationError(`freezePeriod: no period named "${name}".`);
+    if (period.kind !== "closed") {
+      throw new ValidationError(
+        `freezePeriod: period "${name}" is "${period.kind}"; only a closed period can be frozen.`
+      );
+    }
+    const before = periodExclusiveUpperBound(period.endDate);
+    if (Date.parse(before) > Date.now()) {
+      throw new ValidationError(
+        `freezePeriod: period "${name}" purge window ends at ${before}, in the future; only a period whose window is fully in the past can be frozen (recent delete markers may not have converged).`
+      );
+    }
+    const prior = await this.readReserved(PERIOD_FREEZES_COLLECTION, name);
+    if (prior) return this.mergeFreeze(period, prior);
+    const purgedMarkerCount = await this.deps.purgeDeleteMarkers(before);
+    const freeze = {
+      period: name,
+      frozenAt: (/* @__PURE__ */ new Date()).toISOString(),
+      frozenBy: this.deps.userId(),
+      purgedMarkerCount
+    };
+    const envelope = await this.writeReserved(PERIOD_FREEZES_COLLECTION, name, freeze);
+    await this.deps.strategy.appendPeriodLedgerEntry(
+      this.deps.getLedgerOrNull(),
+      this.deps.userId(),
+      envelope,
+      name,
+      PERIOD_FREEZES_COLLECTION
+    );
+    return this.mergeFreeze(period, freeze);
+  }
+  /**
+   * Archive a closed period (#613): physically relocates its in-window
+   * records (those with `_ts < periodExclusiveUpperBound(endDate)`) from the
+   * hot store to the configured cold tier via `archiveRecords`, and records
+   * the fact in a companion `_period_archives/<name>` record. NEVER mutates
+   * the hash-chained `_periods/<name>` record. Non-destructive (reads fall
+   * through to cold) and idempotent: a second call is a no-op returning the
+   * same merged record.
+   */
+  async archivePeriod(name) {
+    const existing = await this.loadPeriodsCache();
+    const period = existing.find((p) => p.name === name);
+    if (!period) throw new ValidationError(`archivePeriod: no period named "${name}".`);
+    if (period.kind !== "closed") {
+      throw new ValidationError(
+        `archivePeriod: period "${name}" is "${period.kind}"; only a closed period can be archived.`
+      );
+    }
+    const prior = await this.readReserved(PERIOD_ARCHIVES_COLLECTION, name);
+    if (prior) return this.mergeArchive(period, prior);
+    const before = periodExclusiveUpperBound(period.endDate);
+    const archivedRecordCount = await this.deps.archiveRecords(before);
+    const archive = {
+      period: name,
+      archivedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      archivedBy: this.deps.userId(),
+      archivedRecordCount
+    };
+    const envelope = await this.writeReserved(PERIOD_ARCHIVES_COLLECTION, name, archive);
+    await this.deps.strategy.appendPeriodLedgerEntry(
+      this.deps.getLedgerOrNull(),
+      this.deps.userId(),
+      envelope,
+      name,
+      PERIOD_ARCHIVES_COLLECTION
+    );
+    return this.mergeArchive(period, archive);
+  }
+  /**
+   * Target-purge a closed period (#615): sweeps delete markers off the vault's
+   * PUSH-ONLY sync targets (`backup`/`archive`) via `purgeTargets`, recording a
+   * companion `_period_target_purges/<name>` record. `sync-peer` targets are
+   * skipped (resurrection risk). NEVER mutates the chained `_periods/<name>`
+   * record. Requires the period be frozen first (closed → frozen → target-purged).
+   * Idempotent once run; with no push-only targets it writes no companion and
+   * is re-runnable.
+   */
+  async purgePeriodTargets(name) {
+    const existing = await this.loadPeriodsCache();
+    const period = existing.find((p) => p.name === name);
+    if (!period) throw new ValidationError(`purgePeriodTargets: no period named "${name}".`);
+    if (period.kind !== "closed") {
+      throw new ValidationError(
+        `purgePeriodTargets: period "${name}" is "${period.kind}"; only a closed period can be target-purged.`
+      );
+    }
+    const frozen = await this.readReserved(PERIOD_FREEZES_COLLECTION, name);
+    if (!frozen) {
+      throw new ValidationError(
+        `purgePeriodTargets: period "${name}" must be frozen first (closed \u2192 frozen \u2192 target-purged).`
+      );
+    }
+    const prior = await this.readReserved(PERIOD_TARGET_PURGES_COLLECTION, name);
+    if (prior) return this.mergeTargetPurge(period, prior);
+    const before = periodExclusiveUpperBound(period.endDate);
+    const targets = await this.deps.purgeTargets(before);
+    if (targets.length === 0) return period;
+    const record = {
+      period: name,
+      purgedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      purgedBy: this.deps.userId(),
+      targets
+    };
+    const envelope = await this.writeReserved(PERIOD_TARGET_PURGES_COLLECTION, name, record);
+    await this.deps.strategy.appendPeriodLedgerEntry(
+      this.deps.getLedgerOrNull(),
+      this.deps.userId(),
+      envelope,
+      name,
+      PERIOD_TARGET_PURGES_COLLECTION
+    );
+    return this.mergeTargetPurge(period, record);
+  }
+  /** Merge target-purge companion fields into a fresh `PeriodRecord` copy — never mutates `periodCache`. */
+  mergeTargetPurge(period, record) {
+    return {
+      ...period,
+      targetsPurgedAt: record.purgedAt,
+      targetsPurgedBy: record.purgedBy,
+      targetsPurged: record.targets
+    };
+  }
+  /** Merge archive companion fields into a fresh `PeriodRecord` copy — never mutates `periodCache`. */
+  mergeArchive(period, archive) {
+    return {
+      ...period,
+      archivedAt: archive.archivedAt,
+      archivedBy: archive.archivedBy,
+      archivedRecordCount: archive.archivedRecordCount
+    };
+  }
+  /** Merge freeze companion fields into a fresh `PeriodRecord` copy — never mutates `periodCache`. */
+  mergeFreeze(period, freeze) {
+    return {
+      ...period,
+      frozenAt: freeze.frozenAt,
+      frozenBy: freeze.frozenBy,
+      purgedMarkerCount: freeze.purgedMarkerCount
+    };
+  }
+  /** Return every closed / opened period in `closedAt` order, merged with any freeze + archive companions. */
   async listPeriods() {
-    return [...await this.loadPeriodsCache()];
+    const all = await this.loadPeriodsCache();
+    const freezeIds = await this.deps.adapter.list(this.deps.vault, PERIOD_FREEZES_COLLECTION);
+    const freezes = /* @__PURE__ */ new Map();
+    for (const id of freezeIds) {
+      const f = await this.readReserved(PERIOD_FREEZES_COLLECTION, id);
+      if (f) freezes.set(f.period, f);
+    }
+    const archiveIds = await this.deps.adapter.list(this.deps.vault, PERIOD_ARCHIVES_COLLECTION);
+    const archives = /* @__PURE__ */ new Map();
+    for (const id of archiveIds) {
+      const a = await this.readReserved(PERIOD_ARCHIVES_COLLECTION, id);
+      if (a) archives.set(a.period, a);
+    }
+    const targetPurgeIds = await this.deps.adapter.list(this.deps.vault, PERIOD_TARGET_PURGES_COLLECTION);
+    const targetPurges = /* @__PURE__ */ new Map();
+    for (const id of targetPurgeIds) {
+      const tp = await this.readReserved(PERIOD_TARGET_PURGES_COLLECTION, id);
+      if (tp) targetPurges.set(tp.period, tp);
+    }
+    return all.map((p) => {
+      const f = freezes.get(p.name);
+      let merged = f ? this.mergeFreeze(p, f) : p;
+      const a = archives.get(p.name);
+      if (a) merged = this.mergeArchive(merged, a);
+      const tp = targetPurges.get(p.name);
+      if (tp) merged = this.mergeTargetPurge(merged, tp);
+      return merged;
+    });
   }
-  /** Look up a single period by name. Returns `null` if not found. */
+  /** Look up a single period by name, merged with its freeze + archive + target-purge companions if any. Returns `null` if not found. */
   async getPeriod(name) {
     const all = await this.loadPeriodsCache();
-    return all.find((p) => p.name === name) ?? null;
+    const period = all.find((p) => p.name === name);
+    if (!period) return null;
+    const freeze = await this.readReserved(PERIOD_FREEZES_COLLECTION, name);
+    const archive = await this.readReserved(PERIOD_ARCHIVES_COLLECTION, name);
+    let merged = freeze ? this.mergeFreeze(period, freeze) : period;
+    if (archive) merged = this.mergeArchive(merged, archive);
+    const targetPurge = await this.readReserved(PERIOD_TARGET_PURGES_COLLECTION, name);
+    if (targetPurge) merged = this.mergeTargetPurge(merged, targetPurge);
+    return merged;
   }
   /** Called by the gate bus before put/delete. */
   async assertTsWritable(existing, incoming) {
@@ -5317,11 +6158,12 @@ var VaultPeriods = class {
     this.periodCache = loaded;
     return loaded;
   }
-  async writePeriodRecord(record) {
-    const json = JSON.stringify(record);
+  /** Generic reserved-collection writer — serves `_periods` and `_period_freezes` alike. */
+  async writeReserved(collection, key, value) {
+    const json = JSON.stringify(value);
     let envelope;
     if (this.deps.encrypted) {
-      const dek = await this.deps.getDEK(PERIODS_COLLECTION);
+      const dek = await this.deps.getDEK(collection);
       const { iv, data } = await encrypt(json, dek);
       envelope = {
         _noydb: NOYDB_FORMAT_VERSION,
@@ -5341,9 +6183,16 @@ var VaultPeriods = class {
         _by: this.deps.userId()
       };
     }
-    await this.deps.adapter.put(this.deps.vault, PERIODS_COLLECTION, record.name, envelope);
+    await this.deps.adapter.put(this.deps.vault, collection, key, envelope);
     return envelope;
   }
+  /** Generic reserved-collection reader — serves `_period_freezes` companion reads. */
+  async readReserved(collection, key) {
+    const env = await this.deps.adapter.get(this.deps.vault, collection, key);
+    if (!env) return null;
+    const json = this.deps.encrypted ? await openEnvelopeJson(env, await this.deps.getDEK(collection)) : env._data;
+    return JSON.parse(json);
+  }
   async decryptPeriodRecord(envelope) {
     let json;
     if (this.deps.encrypted) {
@@ -5577,11 +6426,12 @@ var VaultLinks = class {
    * for the same (collection, id) returns immediately so two
    * mutually-cascading collections don't recurse forever.
    */
-  async enforceRefsOnDelete(collectionName, id) {
+  async enforceRefsOnDelete(graph, collectionName, id) {
     const key = `${collectionName}/${id}`;
     if (this.cascadeInProgress.has(key)) return;
     this.cascadeInProgress.add(key);
     try {
+      await this.enforceLookupRefsOnDelete(graph, collectionName, collectionName, id);
       const inbound = this.deps.refRegistry.getInbound(collectionName);
       for (const rule of inbound) {
         const fromCollection = this.deps.collection(rule.collection);
@@ -5636,6 +6486,109 @@ var VaultLinks = class {
       this.cascadeInProgress.delete(key);
     }
   }
+  /**
+   * Find the records in `collection` whose `field` currently equals `key` — the SAME
+   * list()+filter machinery `enforceRefsOnDelete`'s classic ref-restrict/cascade loop above
+   * already uses (bounded by the referencing collection's size, never by the whole vault or by
+   * "which collections reference this" — that part is the graph's O(1) `_out` reverse index).
+   */
+  async findLookupReferencingRecords(collection, field, key) {
+    const all = await collection.list();
+    return all.filter((rec) => String(rec[field]) === key);
+  }
+  /**
+   * Resolve the VALUE a referencing field actually stores for the row being deleted (`rawKey`,
+   * the backing row's PUT-id) under a given edge's `keyField` — a referencing field always stores
+   * `row[keyField]`, never the PUT-id when the two differ (matrix tier's `lookup(dim, {key})`;
+   * mirrors Task 3's `checkLookupMembership` review fix, Important 1). `keyField === 'id'`
+   * (reserved/static tiers, and the matrix default) needs no row read: `rawKey` IS the value.
+   * Reads the backing row AT MOST ONCE per distinct non-`'id'` `keyField`, even across multiple
+   * edges — `backingCollection` is only `.get()`-able for the matrix tier, which is exactly the
+   * only tier that can ever have `keyField !== 'id'`.
+   */
+  async resolveLookupCompareKey(backingCollection, rawKey, keyField, cache) {
+    if (keyField === "id") return rawKey;
+    if (cache.has(keyField)) return cache.get(keyField);
+    const row = await this.deps.collection(backingCollection).get(rawKey);
+    const raw = row?.[keyField];
+    const resolved = typeof raw === "string" || typeof raw === "number" ? String(raw) : void 0;
+    cache.set(keyField, resolved);
+    return resolved;
+  }
+  /**
+   * Phase 1 (#650 Task 5, #648) — restrict check, never mutates. Throws
+   * `DictKeyInUseError(dimension, key, usedBy, count)` naming the FIRST referencing collection
+   * still holding a matching record, for every `onDelete:'restrict'` edge the graph's O(1)
+   * `referencingEdgesOf(backingCollection)` reverse lookup finds pointing at this dimension. A
+   * dimension with no declared lookup-referencing edges is a no-op — undeclared refs keep
+   * dangling (today's behavior, unaffected). Called by `Vault.forget()` BEFORE any shred (the
+   * spec §4 "restrict refuses before any shred" design decision) — cascade/nullify propagation
+   * for the SAME edges happens separately, after the shred, via `forgetDerivedFanout`.
+   *
+   * Also resolves (and RETURNS) the live compare-key for EVERY referencing edge, restrict AND
+   * cascade/nullify alike (#650 Task 5 review, Important fix): `forgetDerivedFanout`'s cascade/
+   * nullify propagation runs AFTER `_writeTombstone`, when a non-`'id'` `keyField`'s value can no
+   * longer be read off the (now-shredded) row — resolving it HERE, at the one point every
+   * referencing edge's backing row is still guaranteed live, eliminates that post-shred
+   * dependency. A `keyField` this can't resolve (row unreadable) maps to `undefined` in the
+   * returned map so the caller can report it as residue instead of silently skipping the edge.
+   */
+  async checkLookupRefsRestrict(graph, dimension, backingCollection, key) {
+    const keyCache = /* @__PURE__ */ new Map();
+    for (const { referencing, onDelete, keyField } of graph.referencingEdgesOf(backingCollection)) {
+      const compareKey = await this.resolveLookupCompareKey(backingCollection, key, keyField, keyCache);
+      if (onDelete !== "restrict" || compareKey === void 0) continue;
+      const coll = this.deps.collection(referencing.collection);
+      const matches = await this.findLookupReferencingRecords(coll, referencing.field, compareKey);
+      if (matches.length > 0) {
+        throw new DictKeyInUseError(dimension, key, referencing.collection, matches.length);
+      }
+    }
+    return keyCache;
+  }
+  /**
+   * Phase 2 (#650 Task 5, #648) — apply `cascade`/`nullify` propagation for this dimension's
+   * non-restrict referencing edges (restrict edges are skipped — phase 1 above already refused
+   * or the caller already checked). `cascade` deletes each matching record through its ordinary
+   * `collection.delete()` (an origin-tagged, fanout-visible delete — participates in sync/history/
+   * the graph dispatch wave exactly like any other delete); `nullify` clears the referencing field
+   * via an ordinary `collection.put()`. Returns the counts so callers (forget's `ForgetFanoutStats`)
+   * can report the propagation additively.
+   */
+  async applyLookupRefsPropagation(graph, backingCollection, key) {
+    let cascaded = 0;
+    let nullified = 0;
+    const keyCache = /* @__PURE__ */ new Map();
+    for (const { referencing, onDelete, keyField } of graph.referencingEdgesOf(backingCollection)) {
+      if (onDelete === "restrict") continue;
+      const compareKey = await this.resolveLookupCompareKey(backingCollection, key, keyField, keyCache);
+      if (compareKey === void 0) continue;
+      const coll = this.deps.collection(referencing.collection);
+      const matches = await this.findLookupReferencingRecords(coll, referencing.field, compareKey);
+      for (const rec of matches) {
+        const id = rec["id"];
+        if (id === void 0) continue;
+        if (onDelete === "cascade") {
+          await coll.delete(id);
+          cascaded++;
+        } else if (onDelete === "nullify") {
+          await coll.put(id, { ...rec, [referencing.field]: null });
+          nullified++;
+        }
+      }
+    }
+    return { cascaded, nullified };
+  }
+  /**
+   * Convenience: the full restrict-then-propagate sequence for an ORDINARY (non-forget) delete of
+   * a lookup-referenced row — `checkLookupRefsRestrict` then `applyLookupRefsPropagation`. Used by
+   * `enforceRefsOnDelete` above (matrix-tier: the backing row IS an ordinary `Collection` record)
+   * and by `LookupHandle.delete()`'s injected `checkReferencesOnDelete` callback (reserved tier).
+   */
+  async enforceLookupRefsOnDelete(graph, dimension, backingCollection, key) {
+    await this.checkLookupRefsRestrict(graph, dimension, backingCollection, key);
+    return this.applyLookupRefsPropagation(graph, backingCollection, key);
+  }
   /**
    * @internal — apply link `onDelete` policy when an endpoint record is
    * deleted. `'strict'` throws (blocks the delete), `'cascade'`
@@ -5792,7 +6745,7 @@ var VaultLinks = class {
 // src/with-shape/links/lazy-handle.ts
 function makeLazyLinkSetHandle(d) {
   let engine = null;
-  const load = () => engine ??= import("./link-set-62Y36TOG.js").then(
+  const load = () => engine ??= import("./link-set-YBAC2DQT.js").then(
     ({ LinkSet }) => new LinkSet(d.adapter, d.vault, d.name, d.spec, d.encrypted, d.getDEK, d.actor, d.emitter, d.endpointExists)
   );
   return {
@@ -5806,6 +6759,166 @@ function makeLazyLinkSetHandle(d) {
   };
 }
 
+// src/kernel/via-taint-binding.ts
+var EMPTY_STRING_SET = /* @__PURE__ */ new Set();
+function isDefaultPosture(p) {
+  return p.encryptedAtRest === DEFAULT_POSTURE.encryptedAtRest && p.queryable === DEFAULT_POSTURE.queryable && p.exportable === DEFAULT_POSTURE.exportable && p.forgettable === DEFAULT_POSTURE.forgettable;
+}
+function buildTaintOverlay(rawPostures, sealFields) {
+  let out;
+  for (const [field, posture] of rawPostures) {
+    if (isDefaultPosture(posture)) continue;
+    out ??= /* @__PURE__ */ new Map();
+    out.set(field, sealFields.has(field) ? { ...posture, queryable: "none" } : posture);
+  }
+  return out;
+}
+async function encodeTaintAtRest(record, crypto, fields) {
+  let open = record;
+  let sealed;
+  for (const field of fields) {
+    if (!(field in record)) continue;
+    const value = record[field];
+    if (value === void 0) continue;
+    const ref2 = await crypto.sealedSlots.seal(field, value);
+    if (open === record) open = { ...record };
+    delete open[field];
+    sealed ??= {};
+    sealed[field] = ref2;
+  }
+  return sealed ? { record: open, sealed } : { record };
+}
+async function decodeTaintAtRest(record, sealed, crypto, opts, fields) {
+  let out = record;
+  for (const field of fields) {
+    const ref2 = sealed[field];
+    if (ref2 === void 0) continue;
+    if (out === record) out = { ...record };
+    out[field] = opts.asHandles ? new SealedHandle(() => crypto.sealedSlots.unseal(field, ref2)) : await crypto.sealedSlots.unseal(field, ref2);
+  }
+  return out;
+}
+function taintBinding(sealFields, presentRedactFields = EMPTY_STRING_SET) {
+  const fields = [...sealFields];
+  const redactFields = [...presentRedactFields];
+  return {
+    brand: "taint",
+    posture: { encryptedAtRest: "sealed", queryable: "none", exportable: false, forgettable: true },
+    covers: (field) => sealFields.has(field) || presentRedactFields.has(field),
+    ...fields.length > 0 ? {
+      encodeAtRest: (record, crypto) => encodeTaintAtRest(record, crypto, fields),
+      decodeAtRest: (record, sealed, crypto, opts) => decodeTaintAtRest(record, sealed, crypto, opts, fields)
+    } : {},
+    ...redactFields.length > 0 ? {
+      present: (record) => {
+        let out = record;
+        for (const field of redactFields) {
+          if (field in out) {
+            if (out === record) out = { ...record };
+            out[field] = EXPORT_REDACTION_MARKER;
+          }
+        }
+        return out;
+      }
+    } : {}
+  };
+}
+
+// src/kernel/via-graph-wiring.ts
+var CLASSIFIED_POSTURE = { encryptedAtRest: "sealed", queryable: "det-exact", exportable: false, forgettable: true };
+function registerCollectionGraphSources(graph, name, opts) {
+  const cfg = resolveCollectionConfig(opts);
+  const bindings = cfg.via?.bindings ?? [];
+  const knownFields = /* @__PURE__ */ new Set([
+    ...Object.keys(cfg.moneyFields ?? {}),
+    ...Object.keys(cfg.i18nFields ?? {}),
+    ...Object.keys(cfg.dictKeyFields ?? {}),
+    // #650 Task 2 — native lookup()/enumOf()/dict() fields register their
+    // posture (`lookupBinding().posture`) the same generic way every other
+    // binding does; no `'ref'` EdgeKind / graph edge yet (Task 5).
+    ...Object.keys(cfg.lookupFields ?? {}),
+    ...cfg.classified !== void 0 ? Object.keys(cfg.classified.byField) : []
+  ]);
+  for (const field of knownFields) {
+    for (const binding of bindings) {
+      if (binding.covers?.(field)) {
+        graph.registerField(name, field, binding.posture);
+        break;
+      }
+    }
+  }
+  for (const edge of cfg.computedEdges) graph.registerDerived(edge.target, edge.sources, "computed", edge.grain ?? "record");
+  for (const edge of cfg.viaDepsEdges) graph.registerDerived(edge.target, edge.sources, "computed", edge.grain ?? "record");
+  if (cfg.classified !== void 0) graph.markClassified(name);
+  const depFields = new Set(cfg.computedEdges.map((edge) => edge.target.field));
+  for (const field of cfg.computedFieldNames) {
+    if (!depFields.has(field)) graph.markDepslessComputed(name, field);
+  }
+}
+function validateReconcileGraphEdges(graph, name, options) {
+  const resolvedClassified = options.classifiedFields !== void 0 ? resolveClassifiedFields(name, options.classifiedFields) : void 0;
+  if (resolvedClassified !== void 0 && Object.values(resolvedClassified.byField).some((spec) => spec.storage !== "never")) {
+    const riderNames = new Set(Object.keys(resolvedClassified.riderComputed));
+    const leaking = [...graph.depslessComputedFields(name)].filter((field) => !riderNames.has(field));
+    if (leaking.length > 0) {
+      const field = leaking[0];
+      throw new ValidationError(
+        `Collection "${name}": computed field "${field}" has no declared \`deps\` and the collection declares classified fields \u2014 an opaque computed function could silently copy a classified field's plaintext into an ordinary, unredacted field. Declare \`deps\` naming the source fields it reads, e.g. computed: { ${field}: { fn, deps: [...] } }.`
+      );
+    }
+  }
+  const combinedHasClassified = graph.isClassified(name) || resolvedClassified !== void 0;
+  let edges = [];
+  let depslessComputedFields = [];
+  if (options.computed !== void 0) {
+    for (const [field, entry] of Object.entries(options.computed)) {
+      if (computedEntryParts(entry).mode === "virtual") {
+        throw new ValidationError(
+          `Collection "${name}": computed field "${field}" declares mode: 'virtual' on a reconcile call \u2014 virtual computed fields are construction-only (no late-attach reconcile door); declare them in the collection's first vault.collection("${name}", { ... }) call.`
+        );
+      }
+    }
+    const knownFields = collectKnownFieldNames({
+      moneyFields: options.moneyFields,
+      classifiedFields: resolvedClassified?.byField,
+      computed: options.computed
+    });
+    edges = resolveComputedEdges(name, options.computed, combinedHasClassified, knownFields);
+    const depFields = new Set(edges.map((edge) => edge.target.field));
+    depslessComputedFields = Object.keys(options.computed).filter((field) => !depFields.has(field));
+  }
+  return {
+    edges,
+    depslessComputedFields,
+    classifiedFieldNames: resolvedClassified !== void 0 ? Object.keys(resolvedClassified.byField) : []
+  };
+}
+function commitReconcileGraphEdges(graph, name, plan) {
+  for (const edge of plan.edges) {
+    if (!graph.hasDerived(edge.target)) graph.registerDerived(edge.target, edge.sources, "computed", edge.grain ?? "record");
+  }
+  for (const field of plan.depslessComputedFields) graph.markDepslessComputed(name, field);
+  for (const field of plan.classifiedFieldNames) graph.registerField(name, field, CLASSIFIED_POSTURE);
+  if (plan.classifiedFieldNames.length > 0) graph.markClassified(name);
+}
+function applyTaintOverlay(coll, graph, name) {
+  const postures = buildTaintOverlay(graph.taintedPostures(name), graph.taintSealedFields(name));
+  if (!postures) return;
+  const sealFields = graph.taintSealedFields(name);
+  const provenance = graph.taintProvenance(name);
+  const virtualFields = graph.virtualFields(name);
+  const virtualExportRedact = /* @__PURE__ */ new Set();
+  for (const [field, posture] of postures) {
+    if (posture.exportable === false && virtualFields.has(field)) virtualExportRedact.add(field);
+  }
+  const c = coll;
+  const needsTaintBinding = sealFields.size > 0 || virtualExportRedact.size > 0;
+  const bindings = needsTaintBinding ? [...c.via?.bindings ?? [], taintBinding(sealFields, virtualExportRedact)] : c.via?.bindings ?? [];
+  const taint = { postures, sealFields, provenance };
+  c.via = ViaPipeline.build(bindings, taint);
+  c.codec.setVia(c.via);
+}
+
 // src/with-shape/satellites/registry.ts
 var SatelliteRegistry = class {
   byBase = /* @__PURE__ */ new Map();
@@ -5916,7 +7029,7 @@ function declareSatellite(ctx, collectionName, options, existingRegistry) {
   ctx.forEachSyncEngine((e) => e.remirrorPairResolvers([spec.base, spec.satellite]));
   const registry = reg;
   const baseSchema = ctx.getBaseSchema(spec.base);
-  void import("./post-register-DCJ2SRVG.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
+  void import("./post-register-MROIUA5O.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
   });
   return reg;
 }
@@ -6409,50 +7522,25 @@ var VaultAttestation = class {
 };
 
 // src/kernel/vault.ts
-function resolveLabelFromMap(labels, locale, fallback) {
-  if (labels[locale] !== void 0) return labels[locale];
-  const chain = Array.isArray(fallback) ? fallback : fallback ? [fallback] : [];
-  for (const fb of chain) {
-    if (fb === "any") {
-      const any = Object.values(labels)[0];
-      if (any !== void 0) return any;
-    } else if (labels[fb] !== void 0) {
-      return labels[fb];
-    }
-  }
-  return void 0;
-}
 var Vault = class {
   adapter;
   /** The vault's name as passed to `openVault()`. Stable for the instance lifetime. */
   name;
-  /**
-   * Backreference to the parent `Noydb`. Lets vault-scoped services
-   * (e.g. `as-*` reader `apply()` paths gating on `withTransactions()`)
-   * reach the strategy seam without threading `db` through every API.
-   *
-   * Type-only Noydb import keeps the module graph acyclic at runtime.
-   */
+  /** Backreference to the parent `Noydb` — lets vault-scoped services reach the strategy seam
+   *  without threading `db` through every API (type-only import keeps the module graph acyclic). */
   noydb;
-  /**
-   * The active in-memory keyring. NOT readonly because `load()`
-   * needs to refresh it after restoring a different keyring file —
-   * otherwise the in-memory DEKs (from the pre-load session) and
-   * the on-disk wrapped DEKs (from the loaded backup) drift apart
-   * and every subsequent decrypt fails with TamperedError.
-   */
+  /** The active in-memory keyring. NOT readonly — `load()` refreshes it after restoring a
+   *  different keyring file, or in-memory/on-disk DEKs drift apart and decrypt fails with TamperedError. */
   keyring;
   encrypted;
   emitter;
   onDirty;
   onRegisterConflictResolver;
   syncAdapter;
+  getPurgeableTargets;
   historyConfig;
-  /**
-   * tree-shake seam for the optional blob service. Undefined
-   * means "blobs are off for this vault"; every `collection.blob(id)`
-   * call throws with a pointer at `@noy-db/hub/blobs`.
-   */
+  /** tree-shake seam for the optional blob service; `undefined` means "blobs are off for this
+   *  vault" — every `collection.blob(id)` call throws with a pointer at `@noy-db/hub/blobs`. */
   blobStrategy;
   objectStore;
   /** Cold-storage archival strategy (the archive target store). */
@@ -6465,11 +7553,8 @@ var Vault = class {
   crdtStrategy;
   tiersStrategy;
   searchStrategy;
-  /**
-   * Cargo (partition extraction) strategy — `NO_CARGO` (throwing) unless
-   * `withCargo()` was passed. Public so the `extractPartition` free function
-   * (which takes a `Vault`) routes through it.
-   */
+  /** Cargo (partition extraction) strategy — `NO_CARGO` (throwing) unless `withCargo()` was passed.
+   *  Public so the `extractPartition` free function (which takes a `Vault`) routes through it. */
   cargoStrategy;
   sealedRecordStrategy;
   portabilityStrategy;
@@ -6483,42 +7568,26 @@ var Vault = class {
   i18nStrategy;
   syncStrategy;
   classifiedStrategy;
-  /**
-   * Per-vault guard registry. `null` until `_initGuards()` runs; stays
-   * `null` for vaults that never register any guard strategy. The
-   * runtime class is dynamic-imported on demand so consumers that
-   * never use guards don't pull `GuardRegistry`/`GuardExecutor` into
-   * their bundle.
-   */
+  /** Per-vault guard registry; `null` until `_initGuards()` runs (or for vaults that never register
+   *  one) — the runtime class is dynamic-imported on demand to keep it out of the floor bundle. */
   guardRegistry = null;
-  /**
-   * Per-vault derivation registry. Same lazy-load contract as
-   * `guardRegistry` — `null` until `_initDerivations()` runs with at
-   * least one strategy handle.
-   */
+  /** Per-vault derivation/MV/overlay registries — same lazy-load contract as
+   *  `guardRegistry`: each stays `null` until its `_init*()` runs with at
+   *  least one strategy/MV/overlay handle. */
   derivationRegistry = null;
-  /**
-   * Per-vault materialized-view registry. Same lazy-load
-   * contract as `derivationRegistry` — `null` until
-   * `_initMaterializedViews()` runs with at least one MV handle.
-   */
   materializedViewRegistry = null;
-  /**
-   * Per-vault overlay registry. Same lazy-load contract as
-   * `materializedViewRegistry` — `null` until `_initOverlayedViews()`
-   * runs with at least one handle.
-   */
   overlayedViewRegistry = null;
-  /**
-   * Cached read-only facades handed to guard callbacks via `ctx.vault`
-   * and to derivation callbacks via `derive(source, ctx)`. Split by
-   * resolution layer: the guard facade reads at `layer:'guard'`,
-   * the derivation facade at `layer:'derivation'`, so i18nText / dictKey
-   * fields resolve under that layer's `onMissing` policy. Allocated
-   * eagerly inside `_initGuards()` / `_initDerivations()` so read
-   * accessors stay synchronous (callers in `tx/transaction.ts` rely on
-   * that). Each stays `null` for vaults without that service.
-   */
+  /** Per-vault dependency graph (#638) — field postures + derivation/MV/overlay/
+   *  computed/via-deps edges. Metadata-only (field names, postures, grains —
+   *  never values or key material); always present, unlike the registries above. */
+  graph;
+  /** #638 Task 4 — open sync/cutover/restore touch collector, or `undefined` between batches. */
+  _graphBatch;
+  /** Cached read-only facades for guard/derivation callbacks — split by
+   *  resolution layer (`layer:'guard'` vs `'derivation'`, each field's
+   *  `onMissing` policy differs). Allocated eagerly inside `_initGuards()`/
+   *  `_initDerivations()` so read accessors stay synchronous; `null` for
+   *  vaults without that service. */
   guardFacade = null;
   derivationFacade = null;
   getDEK;
@@ -6547,18 +7616,9 @@ var Vault = class {
    * @see docs/superpowers/specs/2026-06-17-fr6-deed-custodian-liberate-design.md
    */
   custody;
-  /**
-   * Optional callback that re-derives an UnlockedKeyring from the
-   * adapter using the active user's passphrase. Called by `load()`
-   * after the on-disk keyring file has been replaced — refreshes
-   * `this.keyring` so the next DEK access uses the loaded wrapped
-   * DEKs instead of the stale pre-load ones.
-   *
-   * Provided by Noydb at openVault() time. Tests that
-   * construct Vault directly can pass `undefined`; load()
-   * skips the refresh in that case (which is fine for plaintext
-   * compartments — there's nothing to re-unwrap).
-   */
+  /** Re-derives an UnlockedKeyring from the adapter using the active user's passphrase; called by
+   *  `load()` after the on-disk keyring file has been replaced. Provided by Noydb at openVault()
+   *  time; `undefined` in tests that construct Vault directly (load() then skips the refresh). */
   reloadKeyring;
   collectionCache = /* @__PURE__ */ new Map();
   satelliteRegistry = null;
@@ -6640,46 +7700,22 @@ var Vault = class {
    * should use separate Vault instances.
    */
   consentContext = null;
-  /**
-   * Registry of dictKey fields declared across all collections in this
-   * vault. Keyed by collection name → field name → dictionary name.
-   * Used by `DictionaryHandle.rename()` to find and update all records
-   * referencing a renamed key.
-   *
-   * Populated by `collection()` when the `dictKeyFields` option is passed.
-   */
+  /** dictKeyField registry: collection name → field name → dictionary name — `DictionaryHandle.rename()`'s reference-update source; populated by `collection()` from `dictKeyFields`. */
   dictKeyFieldRegistry = /* @__PURE__ */ new Map();
-  /**
-   * Names of dictionaries backed by a `staticDict()` descriptor.
-   * A static dict skips the `dictKeyFieldRegistry` rename machinery, but the
-   * vault must still *know* a name is static so `vault.dictionary(name)` can
-   * refuse mutation (`StaticDictReadonlyError`). Populated at `collection()`
-   * config time whenever a `StaticDictDescriptor` is seen.
-   */
+  /** Names of `staticDict()`-backed dictionaries (skip rename tracking; `vault.dictionary(name)` refuses mutation on these via `StaticDictReadonlyError`). Populated at `collection()` config time. */
   staticDictNames = /* @__PURE__ */ new Set();
-  /**
-   * Static-dict descriptors keyed by dictionary name. Backs the
-   * read-path label resolver (resolve from the in-memory table) and the
-   * query-seam `resolveDictSource` snapshot. Last writer wins when the same
-   * name is registered by multiple collections (identical-across-vaults by
-   * construction, so the tables match).
-   */
+  /** Static-dict descriptors by dictionary name — backs the read-path label resolver and the `resolveDictSource` snapshot. Last writer wins across collections (tables match by construction). */
   staticByName = /* @__PURE__ */ new Map();
-  /**
-   * Per-collection map of field name → StaticDictDescriptor. Used by
-   * `enforceStaticDictOnPut` to validate stored codes against `desc.keys`.
-   */
+  /** Per-collection field name → StaticDictDescriptor, validated by `enforceStaticDictOnPut`. */
   staticDescriptorByField = /* @__PURE__ */ new Map();
-  /**
-   * Registry of i18nText fields declared across all collections. Keyed
-   * by collection name → field name → I18nTextDescriptor. Used by
-   * `applyI18nLocale` on reads and by `validateI18nTextValue` on puts.
-   *
-   * Populated by `collection()` when the `i18nFields` option is passed.
-   */
+  /** i18nText fields: collection name → field name → descriptor. Used by `applyI18nLocale`/`validateI18nTextValue`; populated by `collection()` from `i18nFields`. */
   i18nFieldRegistry = /* @__PURE__ */ new Map();
   /** Cache of DictionaryHandle instances, one per dictionary name. */
   dictionaryCache = /* @__PURE__ */ new Map();
+  /** #650 Task 4 (#647) — declared reserved-lookup collection name → dimension name, for dimensions
+   *  with `backing:'reserved'` (dict()/dictKey()). The explicit sync-pull registry: NOT a blanket
+   *  underscore-glob — populated at `collection()`-declare time and at `dictionary()`-call time. */
+  reservedLookupCollections = /* @__PURE__ */ new Map();
   /** Registered link specs, keyed by link name; set by `vault.link()`. */
   linkRegistry = /* @__PURE__ */ new Map();
   /** Cache of link-set handles, one per link name (lazy -- see links()). */
@@ -6712,6 +7748,7 @@ var Vault = class {
     this.onDirty = opts.onDirty;
     this.onRegisterConflictResolver = opts.onRegisterConflictResolver;
     this.syncAdapter = opts.syncAdapter;
+    this.getPurgeableTargets = opts.getPurgeableTargets ?? (() => []);
     this.blobStrategy = opts.blobStrategy;
     this.objectStore = opts.objectStore;
     this.archiveStrategy = opts.archiveStrategy;
@@ -6734,7 +7771,10 @@ var Vault = class {
       userId: () => this.keyring.userId,
       getDEK: (collection) => this.getDEK(collection),
       getLedgerOrNull: () => this.getLedgerOrNull(),
-      collection: (name) => this.collection(name)
+      collection: (name) => this.collection(name),
+      purgeDeleteMarkers: (before) => this._purgeDeleteMarkers(before),
+      archiveRecords: (before) => this._archiveClosedPeriod(before),
+      purgeTargets: (before) => this._purgePeriodTargets(before)
     });
     this.linksEnforcer = new VaultLinks({
       refRegistry: this.refRegistry,
@@ -6752,6 +7792,7 @@ var Vault = class {
     this.i18nStrategy = opts.i18nStrategy ?? NO_I18N;
     this.syncStrategy = opts.syncStrategy ?? NO_SYNC;
     this.classifiedStrategy = opts.classifiedStrategy ?? NO_CLASSIFIED;
+    this.graph = new ViaGraph();
     void opts.guardStrategies;
     this.historyConfig = opts.historyConfig ?? { enabled: true };
     this.reloadKeyring = opts.reloadKeyring;
@@ -6878,6 +7919,7 @@ var Vault = class {
       }, collectionName, { ...options, satelliteOf: options.satelliteOf }, this.satelliteRegistry);
     }
     let coll = this.collectionCache.get(collectionName);
+    const reconcilePlan = coll && (options?.computed || options?.classifiedFields) ? validateReconcileGraphEdges(this.graph, collectionName, options) : void 0;
     if (coll && options?.moneyFields) {
       coll._applyMoneyFields(options.moneyFields);
     }
@@ -6893,12 +7935,17 @@ var Vault = class {
     if (coll && options?.classifiedFields) {
       coll._applyClassifiedFields(options.classifiedFields);
     }
+    if (reconcilePlan) {
+      commitReconcileGraphEdges(this.graph, collectionName, reconcilePlan);
+      applyTaintOverlay(coll, this.graph, collectionName);
+    }
     if (!coll) {
+      const effectiveViaFields = mergeViaFields({ moneyFields: options?.moneyFields, i18nFields: options?.i18nFields, dictKeyFields: options?.dictKeyFields, lookupFields: options?.lookupFields, viaFields: options?.viaFields });
       if (options?.refs) {
         this.refRegistry.register(collectionName, options.refs);
       }
-      if (options?.i18nFields) {
-        this.i18nFieldRegistry.set(collectionName, options.i18nFields);
+      if (effectiveViaFields.i18nFields) {
+        this.i18nFieldRegistry.set(collectionName, effectiveViaFields.i18nFields);
       }
       if (options?.blobFields) {
         this.blobFieldsRegistry.set(collectionName, options.blobFields);
@@ -6909,10 +7956,10 @@ var Vault = class {
       if (options?.attestation !== void 0) {
         this.attestation.register(collectionName, options.attestation);
       }
-      if (options?.dictKeyFields) {
+      if (effectiveViaFields.dictKeyFields || effectiveViaFields.lookupFields) {
         const dictFieldMap = {};
         const staticFieldMap = {};
-        for (const [field, desc] of Object.entries(options.dictKeyFields)) {
+        for (const [field, desc] of Object.entries(effectiveViaFields.dictKeyFields ?? {})) {
           if (isStaticDictDescriptor(desc)) {
             staticFieldMap[field] = desc;
             this.staticDictNames.add(desc.name);
@@ -6921,8 +7968,18 @@ var Vault = class {
             dictFieldMap[field] = desc.name;
           }
         }
+        const lookupCompat = collectLookupDictCompat(effectiveViaFields.lookupFields);
+        Object.assign(dictFieldMap, lookupCompat.dictFieldMap);
+        for (const [field, desc] of lookupCompat.staticEntries) {
+          staticFieldMap[field] = desc;
+          this.staticDictNames.add(desc.name);
+          this.staticByName.set(desc.name, desc);
+        }
         if (Object.keys(dictFieldMap).length > 0) {
           this.dictKeyFieldRegistry.set(collectionName, dictFieldMap);
+          for (const dictName of new Set(Object.values(dictFieldMap))) {
+            this.reservedLookupCollections.set(dictCollectionName(dictName), dictName);
+          }
         }
         if (Object.keys(staticFieldMap).length > 0) {
           this.staticDescriptorByField.set(collectionName, staticFieldMap);
@@ -6937,7 +7994,7 @@ var Vault = class {
         const strategies = options.schemaUpdate ?? [];
         const work = (async () => {
           const dek = await this.getDEK(collectionName);
-          const { persistSchemaIfNeeded } = await import("./register-5NRE7HBZ.js");
+          const { persistSchemaIfNeeded } = await import("./register-OVJKW7BS.js");
           const result = await persistSchemaIfNeeded({
             store: this.adapter,
             vault: this.name,
@@ -7002,6 +8059,7 @@ var Vault = class {
         defaultLocale: this.locale,
         onRegisterConflictResolver: this.onRegisterConflictResolver,
         onAccess: (op, id) => this._logConsent(op, collectionName, id),
+        graphDispatch: { collect: (collection, id) => this._collectGraphTouch(collection, id) },
         // Derivation source is only wired when the corresponding registry
         // has been initialised. Guard source was removed in Track A slice 3b
         // — guards now run via the gate bus in Noydb.#registerGuardGate.
@@ -7072,9 +8130,10 @@ var Vault = class {
       if (options?.warmIndexOnOpen !== void 0) collOpts.warmIndexOnOpen = options.warmIndexOnOpen;
       if (options?.textIndexPersist !== void 0) collOpts.textIndexPersist = options.textIndexPersist;
       if (options?.moneyFields !== void 0) collOpts.moneyFields = options.moneyFields;
+      if (options?.viaFields !== void 0) collOpts.viaFields = options.viaFields;
       if (options?.computed !== void 0) collOpts.computed = options.computed;
       if (options?.classifiedFields !== void 0) collOpts.classifiedFields = options.classifiedFields;
-      if (options?.dictKeyFields !== void 0) {
+      if (effectiveViaFields.dictKeyFields !== void 0 || effectiveViaFields.lookupFields !== void 0) {
         collOpts.dictLabelResolver = async (dictName, key, locale, fallback) => {
           const stat = this.staticByName.get(dictName);
           if (stat) {
@@ -7085,15 +8144,23 @@ var Vault = class {
           return handle.resolveLabel(key, locale, fallback);
         };
         collOpts.getDictionary = async (name) => this.dictionary(name);
-        collOpts.dictKeyFields = options.dictKeyFields;
+        collOpts.dictKeyFields = options?.dictKeyFields;
+      }
+      if (effectiveViaFields.lookupFields !== void 0) {
+        collOpts.lookupLabelResolver = collOpts.dictLabelResolver;
+        collOpts.getLookupBacking = (dimension) => async (key) => await this.collection(dimension).get(key) ?? void 0;
+        collOpts.lookupFields = options?.lookupFields;
+        collOpts.membership = (field, key) => checkLookupMembership(effectiveViaFields.lookupFields[field], key, (n) => this.dictionary(n), (n) => this.collection(n));
+        collOpts.getAltIndex = (d) => buildLookupAltIndex(d, (n) => this.dictionary(n), (n) => this.collection(n));
+        collOpts.snapshotFor = (d) => buildLookupSnapshotRows(d, (n) => this.reservedLookupCollections.has(dictCollectionName(n)), (n) => this.dictionary(n), (n) => this.collection(n));
       }
-      if (options?.i18nFields !== void 0 || options?.dictKeyFields !== void 0) {
+      if (effectiveViaFields.i18nFields !== void 0 || effectiveViaFields.dictKeyFields !== void 0) {
         collOpts.i18nPutValidator = (record) => {
           this.enforceI18nOnPut(collectionName, record);
           this.enforceStaticDictOnPut(collectionName, record);
         };
       }
-      if (options?.i18nFields !== void 0 && this.translateText) {
+      if (effectiveViaFields.i18nFields !== void 0 && this.translateText) {
         collOpts.autoTranslateHook = this.translateText;
       }
       if (options?.fieldMeta !== void 0) {
@@ -7107,6 +8174,9 @@ var Vault = class {
       }
       coll = new Collection(collOpts);
       this.collectionCache.set(collectionName, coll);
+      registerCollectionGraphSources(this.graph, collectionName, collOpts);
+      registerLookupRefEdges(this.graph, collectionName, effectiveViaFields.lookupFields);
+      applyTaintOverlay(coll, this.graph, collectionName);
       if (options?.warmIndexOnOpen === true && options.prefetch !== false) {
         void coll.warmIndex().catch(() => {
         });
@@ -7116,7 +8186,7 @@ var Vault = class {
         const work = (async () => {
           try {
             const dek = await this.getDEK(collectionName);
-            await (await import("./register-5NRE7HBZ.js")).persistSchemaIfNeeded({
+            await (await import("./register-OVJKW7BS.js")).persistSchemaIfNeeded({
               store: this.adapter,
               vault: this.name,
               collectionName,
@@ -7179,7 +8249,9 @@ var Vault = class {
   async #runCutoverTransform(collectionName, transform) {
     const coll = this.collectionCache.get(collectionName);
     if (!coll) return;
+    this._beginGraphBatch();
     await coll._applyCutoverTransform(transform);
+    await this._flushGraphBatch();
   }
   /**
    * Refresh a loaded collection's view of one document from a peer
@@ -7191,12 +8263,45 @@ var Vault = class {
     if (!coll) return;
     await coll._applyRemoteChange(docId, action);
   }
-  /** @internal #598: refresh cache entries a sync-applied write rewrote underneath us. No-op if not loaded this session. */
+  /** @internal #598: refresh cache entries a sync-applied write rewrote underneath us. No-op if not loaded this session.
+   *  #650 Task 4 (#647): a reserved-lookup collection has no `Collection` instance — instead, refresh
+   *  its already-warmed `LookupHandle._syncCache` (membership/altIndex/snapshot reads never see a
+   *  stale verdict for a pulled vocabulary edit) and collect the touch into any open graph batch
+   *  (the sync-apply wave-reachability seam Task 5's ref edges will use). No-op if never warmed. */
   async _invalidateSyncApplied(collection, id) {
     const coll = this.collectionCache.get(collection);
-    if (!coll) return;
-    coll._invalidateCekCacheEntry(id);
-    await coll._invalidateCacheEntry(id);
+    if (coll) {
+      await coll._onRecordMutated(id, "put", "sync-apply");
+      return;
+    }
+    const dimName = this.reservedLookupCollections.get(collection);
+    if (dimName === void 0) return;
+    await this.dictionaryCache.get(dimName)?._refreshSyncCache(id);
+    this._collectGraphTouch(collection, id);
+  }
+  /** @internal #650 Task 4 (#647) — declared reserved-lookup collection names, for `SyncEngine.pull()`'s explicit prefix registry. */
+  _reservedLookupCollectionNames() {
+    return [...this.reservedLookupCollections.keys()];
+  }
+  /** @internal #638 Task 4 — open a graph-dispatch touch batch (sync pull()/push()/cutover). */
+  _beginGraphBatch() {
+    this._graphBatch = /* @__PURE__ */ new Map();
+  }
+  /** @internal #638 Task 4 — `Collection._onRecordMutated`'s sync-apply/cutover/restore hook; a
+   *  no-op when no batch is open (`_beginGraphBatch()` was never called for this call chain). */
+  _collectGraphTouch(collection, id) {
+    if (!this._graphBatch) return;
+    this._graphBatch.set(collection, (this._graphBatch.get(collection) ?? /* @__PURE__ */ new Set()).add(id));
+  }
+  /** @internal #638 Task 4 — close the open batch and run ONE dispatch wave over it. */
+  async _flushGraphBatch() {
+    const batch = this._graphBatch;
+    this._graphBatch = void 0;
+    if (batch && batch.size > 0) await runGraphDispatchWave(this, batch);
+  }
+  /** @internal #638 Task 4 — cached-collection lookup for `runGraphDispatchWave` (`VaultLike`); never constructs. */
+  _getCollection(name) {
+    return this.collectionCache.get(name);
   }
   /**
    * @internal #589 → #604. Physically remove delete markers with `_ts` strictly
@@ -7209,27 +8314,65 @@ var Vault = class {
    * ONLY; #604's period-close lifecycle is what earns that assertion. Do not call
    * it on live/unsettled data.
    *
-   * Emits no ledger/event yet — #604's period-close, the only intended caller, owns
-   * the audit record.
+   * Emits no ledger/event itself — its callers (#604's `freezePeriod`, #615's
+   * `purgePeriodTargets`) own the audit record. The sweep body is shared via
+   * {@link _purgeMarkersOn}, which #615 also aims at push-only sync targets.
    *
-   * Purges the local adapter only; the operator must purge every sync target too, or
-   * the next pull re-imports the markers (benign — they still read deleted — but no
-   * space is reclaimed). #604 owns cross-target purge.
+   * Purges the local adapter only. Markers already pushed to the vault's
+   * push-only (`backup`/`archive`) sync targets are reclaimed by #615's
+   * `vault.purgePeriodTargets`; `sync-peer` targets are left untouched (purging
+   * them would re-open the resurrection window — the deferred half of #611).
    */
   async _purgeDeleteMarkers(before, collections) {
-    const snapshot = await this.adapter.loadAll(this.name);
+    return this._purgeMarkersOn(this.adapter, before, collections);
+  }
+  /**
+   * @internal #615. Sweep delete markers with `_ts < before` off ANY store
+   * (local adapter or a push-only sync target). Returns the count removed.
+   */
+  async _purgeMarkersOn(store, before, collections) {
+    const snapshot = await store.loadAll(this.name);
     let removed = 0;
     for (const [coll, records] of Object.entries(snapshot)) {
       if (collections && !collections.includes(coll)) continue;
       for (const [id, env] of Object.entries(records)) {
         if (isDeleteMarker(env) && env._ts < before) {
-          await this.adapter.delete(this.name, coll, id);
+          await store.delete(this.name, coll, id);
           removed++;
         }
       }
     }
     return removed;
   }
+  /**
+   * @internal #613. Relocate this closed period's in-window records (those
+   * with `_ts < before`) from the hot store to the configured cold tier,
+   * via the routeStore's `compact({ before })`. Returns the count moved.
+   * Requires a `routeStore` with a cold route (the `coldArchival`
+   * capability); throws a clear error otherwise. Non-destructive — reads
+   * fall through to cold, so this does NOT re-open the #589 window.
+   */
+  async _archiveClosedPeriod(before) {
+    const store = this.adapter;
+    if (store.capabilities?.coldArchival !== true || typeof store.compact !== "function") {
+      throw new ValidationError("archivePeriod: cold archival requires a routeStore with a cold route.");
+    }
+    return store.compact(this.name, { before });
+  }
+  /**
+   * @internal #615. Sweep delete markers with `_ts < before` off each of the
+   * vault's push-only sync targets, returning a per-target count. Skips
+   * `sync-peer` targets by construction (getPurgeableTargets yields only
+   * backup/archive). Never touches the local adapter.
+   */
+  async _purgePeriodTargets(before) {
+    const out = [];
+    for (const t of this.getPurgeableTargets()) {
+      const purgedCount = await this._purgeMarkersOn(t.store, before);
+      out.push({ ...t.label !== void 0 ? { label: t.label } : {}, role: t.role, purgedCount });
+    }
+    return out;
+  }
   /**
    * For a detected conflict: capture this tab's clobbered record,
    * read the common ancestor from history, converge the cache to the store's
@@ -7300,8 +8443,12 @@ var Vault = class {
    * Validate i18nText fields on a `put()`. Called by Collection just
    * before the adapter write, after schema validation. Throws
    * `MissingTranslationError` when a required translation is absent.
+   *
+   * Delegates through the Via registry (#623) — a no-op only when i18n was
+   * never declared (mirrors the registry check below).
    */
   enforceI18nOnPut(collectionName, record) {
+    if (!isViaInstalled("i18n")) return;
     const i18nFields = this.i18nFieldRegistry.get(collectionName);
     if (!i18nFields || Object.keys(i18nFields).length === 0) return;
     if (!record || typeof record !== "object") return;
@@ -7318,79 +8465,15 @@ var Vault = class {
    * Validate staticDict codes on a `put()`. For each `staticDict()`
    * field, every stored code must be a declared key of the descriptor's
    * table, else `UnknownDictCodeError`. Opt out per descriptor with
-   * `{ validateCodes: false }`. Supports scalar, dotted, and `[].`-wildcard
-   * field paths via `getAtPath` (same path support as i18n validation).
-   */
-  enforceStaticDictOnPut(collectionName, record) {
-    const staticFields = this.staticDescriptorByField.get(collectionName);
-    if (!staticFields || Object.keys(staticFields).length === 0) return;
-    if (!record || typeof record !== "object") return;
-    const obj = record;
-    for (const [field, desc] of Object.entries(staticFields)) {
-      if (desc.validateCodes === false) continue;
-      const known = new Set(desc.keys);
-      const values = getAtPath(obj, field);
-      for (const value of values) {
-        if (value === void 0 || value === null) continue;
-        const codes = Array.isArray(value) ? value : [value];
-        for (const code of codes) {
-          if (typeof code !== "string") continue;
-          if (!known.has(code)) {
-            throw new UnknownDictCodeError(desc.name, field, code);
-          }
-        }
-      }
-    }
-  }
-  /**
-   * Apply locale resolution to a record for the given collection.
+   * `{ validateCodes: false }`.
    *
-   * Called by Collection after decryption when locale options are present.
-   * Returns a new object (never mutates the cached record).
+   * Delegates through the Via registry — see {@link enforceI18nOnPut}. The
+   * per-field validation itself lives in `shape/via-lookup/registry.ts`
+   * (#650 Task 1 extraction), reached via `port/with/lookup-strategy.ts`.
    */
-  async applyLocale(collectionName, record, localeOpts) {
-    const locale = localeOpts.locale ?? this.locale;
-    const staticFields = this.staticDescriptorByField.get(collectionName);
-    const hasStaticDisplay = staticFields !== void 0 && Object.values(staticFields).some((d) => d.displayLocale !== void 0);
-    if (!locale && !hasStaticDisplay) return record;
-    let result = record;
-    if (locale) {
-      const i18nFields = this.i18nFieldRegistry.get(collectionName);
-      if (i18nFields && Object.keys(i18nFields).length > 0) {
-        result = this.i18nStrategy.applyI18nLocale(result, i18nFields, locale, localeOpts.fallback);
-      }
-    }
-    const dictFields = this.dictKeyFieldRegistry.get(collectionName);
-    if (locale && dictFields && Object.keys(dictFields).length > 0 && locale !== "raw") {
-      const withLabels = { ...result };
-      for (const [field, dictName] of Object.entries(dictFields)) {
-        const key = result[field];
-        if (typeof key !== "string") continue;
-        const handle = this.dictionary(dictName);
-        const label = await handle.resolveLabel(key, locale, localeOpts.fallback);
-        if (label !== void 0) {
-          withLabels[`${field}Label`] = label;
-        }
-      }
-      result = withLabels;
-    }
-    if (staticFields && Object.keys(staticFields).length > 0 && locale !== "raw") {
-      const withLabels = { ...result };
-      for (const [field, desc] of Object.entries(staticFields)) {
-        const effLocale = locale ?? desc.displayLocale;
-        if (!effLocale) continue;
-        const key = result[field];
-        if (typeof key !== "string") continue;
-        const labels = desc.table[key];
-        if (!labels) continue;
-        const label = resolveLabelFromMap(labels, effLocale, localeOpts.fallback ?? desc.substitute);
-        if (label !== void 0) {
-          withLabels[`${field}Label`] = label;
-        }
-      }
-      result = withLabels;
-    }
-    return result;
+  enforceStaticDictOnPut(collectionName, record) {
+    if (!isViaInstalled("i18n")) return;
+    enforceStaticDictOnPut(this.staticDescriptorByField.get(collectionName), record);
   }
   /**
    * Open a dictionary by name. Returns a `DictionaryHandle` for CRUD
@@ -7414,6 +8497,7 @@ var Vault = class {
     if (this.staticDictNames.has(name)) {
       throw new StaticDictReadonlyError(name);
     }
+    this.reservedLookupCollections.set(dictCollectionName(name), name);
     let handle = this.dictionaryCache.get(name);
     if (!handle) {
       handle = this.i18nStrategy.buildDictionaryHandle({
@@ -7421,37 +8505,36 @@ var Vault = class {
         compartmentName: this.name,
         dictionaryName: name,
         keyring: this.keyring,
-        getDEK: this.getDEK,
+        reservedEnvelopes: makeReservedEnvelopes((collection) => this.getDEK(collection), ["_dict_"])("_dict_"),
         encrypted: this.encrypted,
         ledger: this.getLedgerOrNull() ?? void 0,
         options,
         // findAndUpdateReferences: rewrite dictKey fields in all
-        // registered collections when rename() is called
+        // registered collections when rename() is called. Body extracted to
+        // shape/via-lookup/registry.ts (#650 Task 1) — reached via the
+        // port/with/lookup-strategy.ts seam.
         findAndUpdateReferences: async (dictionaryName, oldKey, newKey) => {
-          for (const [collectionName, dictFields] of this.dictKeyFieldRegistry) {
-            const fields = Object.entries(dictFields).filter(([, dn]) => dn === dictionaryName).map(([field]) => field);
-            if (fields.length === 0) continue;
-            const coll = this.collection(collectionName);
-            const records = await coll.list();
-            for (const record of records) {
-              let changed = false;
-              const updated = { ...record };
-              for (const field of fields) {
-                if (updated[field] === oldKey) {
-                  updated[field] = newKey;
-                  changed = true;
-                }
-              }
-              if (changed) {
-                const id = record["id"];
-                if (id !== void 0) {
-                  await coll.put(id, updated);
-                }
-              }
-            }
-          }
+          await updateReferencingRecords(
+            this.dictKeyFieldRegistry,
+            (collectionName) => this.collection(collectionName),
+            dictionaryName,
+            oldKey,
+            newKey
+          );
+        },
+        emitter: this.emitter,
+        buildDeleteMarker,
+        // #647 fix wave 1 — real kernel/enclave builder; LookupHandle can't import it directly
+        // #650 Task 4 (#647) — choke-point participation for LOCAL writes: dirty-log tracking + a
+        // one-shot graph-dispatch wave (local-write's `graphDispatch.collect`-equivalent; Task 5's ref edges give it dependents).
+        onDirty: this.onDirty,
+        onRecordMutated: async (collection, id) => {
+          this._beginGraphBatch();
+          this._collectGraphTouch(collection, id);
+          await this._flushGraphBatch();
         },
-        emitter: this.emitter
+        checkReferencesOnDelete: (key) => this.linksEnforcer.enforceLookupRefsOnDelete(this.graph, name, dictCollectionName(name), key)
+        // #650 Task 5
       });
       this.dictionaryCache.set(name, handle);
     }
@@ -7520,65 +8603,24 @@ var Vault = class {
     return handle;
   }
   /**
-   * Build a `JoinableSource` for a dictKey field, for use in dict joins
-   *. Returns a source whose snapshot contains `{ key, ...labels }`
-   * records — one per dictionary entry — keyed by the stable key.
-   *
-   * Returns `null` when `field` is not a dictKey in `leftCollection`.
-   *
-   * The snapshot is built synchronously from whatever the dictionary
-   * handle has in its cached state. For empty dictionaries this returns
-   * an empty snapshot rather than `null`.
-   */
-  /**
-   * Build a `JoinableSource` for a dictKey field, for use in dict joins
-   *. Returns a source whose snapshot contains
-   * `{ key, labels, ...labels }` records — one per dictionary entry —
-   * keyed by the stable key.
-   *
-   * The snapshot is built synchronously from the DictionaryHandle's
-   * write-through cache, which is populated on every `put()`, `rename()`,
-   * `delete()`, and `list()` call. For pre-existing data not yet touched
-   * this session, call `await vault.dictionary(name).list()` first
-   * to warm the cache.
+   * Build a `JoinableSource` for a dictKey field, for use in dict joins.
+   * Returns a source whose snapshot contains `{ key, labels, ...labels }`
+   * records — one per dictionary entry — keyed by the stable key. Returns
+   * `null` when `field` is not a dictKey in `leftCollection`.
    *
-   * Returns `null` when `field` is not a dictKey in `leftCollection`.
+   * Body extracted to `shape/via-lookup/registry.ts` (#650 Task 1) —
+   * reached via the `port/with/lookup-strategy.ts` seam. See that
+   * function's doc comment for the static-vs-dynamic-dict split and the
+   * cache-warming caveat.
    */
   resolveDictSource(leftCollection, field) {
-    const staticFields = this.staticDescriptorByField.get(leftCollection);
-    if (staticFields && field in staticFields) {
-      const desc = staticFields[field];
-      const rows = Object.entries(desc.table).map(
-        ([key, labels]) => ({ key, labels, ...labels })
-      );
-      const source = {
-        snapshot() {
-          return rows;
-        },
-        lookupById(id) {
-          return rows.find((e) => e["key"] === id);
-        }
-      };
-      if (desc.displayLocale !== void 0) {
-        ;
-        source.displayLocale = desc.displayLocale;
-      }
-      return source;
-    }
-    const dictFields = this.dictKeyFieldRegistry.get(leftCollection);
-    if (!dictFields || !(field in dictFields)) return null;
-    const dictName = dictFields[field];
-    if (!dictName) return null;
-    const handle = this.dictionary(dictName);
-    return {
-      snapshot() {
-        return handle.snapshotEntries();
-      },
-      lookupById(id) {
-        const entries = handle.snapshotEntries();
-        return entries.find((e) => e["key"] === id);
-      }
-    };
+    return resolveDictSource(
+      leftCollection,
+      field,
+      this.staticDescriptorByField,
+      this.dictKeyFieldRegistry,
+      (name) => this.dictionary(name)
+    );
   }
   /**
    * Set or update the vault-default locale at runtime.
@@ -7782,7 +8824,9 @@ var Vault = class {
       listRecordIds: (c) => this.adapter.list(this.name, c),
       getRecord: async (c, id) => await this.collection(c).get(id, { locale: "raw" }),
       getEnvelope: (c, id) => this.adapter.get(this.name, c, id),
-      removeFromPrimary: (c, id) => this.collection(c)._internalDelete(id),
+      removeFromPrimary: async (c, id) => {
+        await this.collection(c)._internalDelete(id);
+      },
       restoreToPrimary: async (c, id, env) => {
         await this.adapter.put(this.name, c, id, env);
         await this.collection(c)._invalidateCacheEntry(id);
@@ -7869,7 +8913,7 @@ var Vault = class {
    * cascade guard. See `with-shape/links/vault-facade.ts`.
    */
   async enforceRefsOnDelete(collectionName, id) {
-    return this.linksEnforcer.enforceRefsOnDelete(collectionName, id);
+    return this.linksEnforcer.enforceRefsOnDelete(this.graph, collectionName, id);
   }
   // ─── Join resolver) ────────────────────
   /**
@@ -7973,23 +9017,19 @@ var Vault = class {
     );
   }
   /**
-   * GDPR crypto-shred of a data subject. Consults the encrypted subject
-   * index and, per matching record:
-   *   - rewrites the LIVE envelope to a tombstone (drops `_iv`/`_data`/`_cek`/`_det`),
-   *   - tombstones every `_history` version of the record,
-   * so the body and all prior versions become permanently undecryptable while
-   * the collection DEK and every OTHER record stay intact. Then appends ONE
-   * `op:'forget'` ledger entry whose `payloadHash` is `sha256Hex(subjectId)` —
-   * the chain still `verify()`s, PROVING the subject existed and was erased
-   * without retaining any plaintext.
-   *
-   * Reports — but does not silently swallow — two completeness gaps:
-   *   - `unmigratedRecords`: a record whose body was NOT yet migrated to a
-   *     per-record CEK (legacy body still under the shared collection DEK). It
-   *     is still tombstoned, but its pre-shred ciphertext (if leaked to a
-   *     backup before migration) stays decryptable. Migrate, then re-forget.
-   *   - `blobResidueCollections`: a shredded record still has blob attachments,
-   *     which are keyed off a separate `_blob` DEK and are out of scope here.
+   * GDPR crypto-shred of a data subject. Consults the encrypted subject index and, per matching
+   * record: rewrites the LIVE envelope to a tombstone (drops `_iv`/`_data`/`_cek`/`_det`), tombstones
+   * every `_history` version, and fans out to derived residue via the graph (#622) — record-grain
+   * artifacts (MV rows, derivation copies) ERASED, aggregate-grain rollups RECOMPUTED without the
+   * forgotten contribution (skip+audit in a frozen period). The body/history become permanently
+   * undecryptable while the collection DEK and every OTHER record stay intact. Then appends ONE
+   * `op:'forget'` ledger entry whose `payloadHash` is `sha256Hex(subjectId)` — the chain still
+   * `verify()`s, PROVING the subject existed and was erased without retaining any plaintext.
+   *
+   * Reports — but does not silently swallow — two completeness gaps: `unmigratedRecords` (a record
+   * whose body was NOT yet migrated to a per-record CEK — still tombstoned, but pre-shred backups
+   * stay decryptable; migrate, then re-forget) and `blobResidueCollections` (blob attachments, keyed
+   * off a separate `_blob` DEK, out of scope here).
    *
    * @throws ForgetStrategyNotConfiguredError when no `withForgetCascade` was set.
    */
@@ -8014,23 +9054,29 @@ var Vault = class {
     const indexResidue = [];
     const blobsEnabled = this.blobStrategy !== void 0;
     const actor = this.keyring.userId;
+    const fanoutStats = { recordsErased: 0, aggregatesRecomputed: 0, residueFrozen: [], lookupReferencesCascaded: 0, lookupReferencesNullified: 0, lookupReferencesResidue: [] };
     for (const ref2 of allRefs) {
       const coll = this.collection(ref2.collection);
       const satelliteOf = ref2.satelliteOf;
       const perRecordKeys = this.forgetStrategy.subjects[satelliteOf ?? ref2.collection] !== void 0;
+      const lookupCompareKeys = await this.linksEnforcer.checkLookupRefsRestrict(this.graph, ref2.collection, ref2.collection, ref2.id);
       const live = await this.adapter.get(this.name, ref2.collection, ref2.id);
       if (perRecordKeys && live && live._data && !hasPerRecordKey(live)) {
         unmigratedRecords.push(`${ref2.collection}:${ref2.id}`);
       }
       if (live?._sealed !== void 0) {
         try {
-          const cls = await coll._classifySealedShred(live);
-          for (const slot of cls.slots) {
-            if (slot.class === "shreddable" || slot.class === "live-shreddable+dekResidue-in-backups") {
-              sealedFieldsShredded += 1;
+          const viaReport = await coll._onViaErase(ref2.id, live);
+          if (viaReport) {
+            sealedFieldsShredded += viaReport.shredded;
+            for (const entry of viaReport.residue) {
+              if (entry.kind === "classified-sealed-dek-residue" && entry.field !== void 0) sealedResidue.push(`${ref2.collection}:${ref2.id}:${entry.field}`);
             }
-            if (slot.class === "dekResidue" || slot.class === "live-shreddable+dekResidue-in-backups") {
-              sealedResidue.push(`${ref2.collection}:${ref2.id}:${slot.field}`);
+          } else {
+            const cls = await coll._classifySealedShred(live);
+            for (const slot of cls.slots) {
+              if (slot.class === "shreddable" || slot.class === "live-shreddable+dekResidue-in-backups") sealedFieldsShredded += 1;
+              if (slot.class === "dekResidue" || slot.class === "live-shreddable+dekResidue-in-backups") sealedResidue.push(`${ref2.collection}:${ref2.id}:${slot.field}`);
             }
           }
         } catch {
@@ -8063,6 +9109,7 @@ var Vault = class {
       if (shred !== null) {
         recordsShredded++;
         collections.add(ref2.collection);
+        await forgetDerivedFanout(this, { collection: ref2.collection, id: ref2.id }, live, fanoutStats, lookupCompareKeys);
       }
       historyVersionsShredded += await this.historyStrategy.tombstoneHistory(
         this.adapter,
@@ -8146,7 +9193,14 @@ var Vault = class {
       sealedCekEnvelopesPurged,
       sealedCekResidue,
       sealedResidue,
-      ledgerEntry
+      ledgerEntry,
+      derivedRecordsErased: fanoutStats.recordsErased,
+      derivedAggregatesRecomputed: fanoutStats.aggregatesRecomputed,
+      derivedResidueFrozen: fanoutStats.residueFrozen,
+      lookupReferencesCascaded: fanoutStats.lookupReferencesCascaded,
+      lookupReferencesNullified: fanoutStats.lookupReferencesNullified,
+      lookupReferencesResidue: fanoutStats.lookupReferencesResidue
+      // #650 Task 5 (+ review Important fix: residue)
     };
   }
   // ─── Record-scoped CEK sealing ─────────────────────────────────────
@@ -8242,7 +9296,7 @@ var Vault = class {
     if (handles.length === 0) return;
     const [{ GuardRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
       import("./registry-VW6P6A3J.js"),
-      import("./read-only-facade-5ADRJVTM.js")
+      import("./read-only-facade-UCYNRE56.js")
     ]);
     const registry = new GuardRegistry();
     for (const h of handles) registry.register(h.spec);
@@ -8269,14 +9323,15 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-5QLETK3Q.js"),
-      import("./read-only-facade-5ADRJVTM.js")
+      import("./registry-DQRNTWRL.js"),
+      import("./read-only-facade-UCYNRE56.js")
     ]);
     const registry = new DerivationRegistry();
     for (const h of handles) {
       await registry.register(h.spec);
     }
-    registry.validate();
+    for (const edge of registry.edges()) this.graph.registerDerived(edge.target, edge.sources, edge.kind, edge.grain);
+    registry.validate(this.graph);
     this.derivationRegistry = registry;
     if (this.derivationFacade === null) {
       this.derivationFacade = new ReadOnlyVaultFacade(this, "derivation");
@@ -8300,14 +9355,15 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-DYTNLOJC.js");
+    const { MaterializedViewRegistry } = await import("./registry-LTGLERS7.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
     for (const h of handles) {
       await registry.register(h.spec, db);
     }
-    registry.validate(this.derivationRegistry);
+    for (const edge of registry.edges()) this.graph.registerDerived(edge.target, edge.sources, edge.kind, edge.grain);
+    registry.validate(this.graph);
   }
   /**
    * @internal — consumed by `Collection.put` at write-time. Returns
@@ -8324,7 +9380,7 @@ var Vault = class {
    */
   async _initOverlayedViews(handles) {
     if (handles.length === 0) return;
-    const { OverlayedViewRegistry } = await import("./registry-HSNQ4NBP.js");
+    const { OverlayedViewRegistry } = await import("./registry-5RJSK5AJ.js");
     const registry = new OverlayedViewRegistry();
     const mvRegistry = this.materializedViewRegistry;
     const overlayNames = /* @__PURE__ */ new Set();
@@ -8341,6 +9397,7 @@ var Vault = class {
         isOverlayName: (n) => overlayNames.has(n) && n !== h.spec.name,
         isMVOutput
       });
+      this.graph.registerDerived({ collection: h.spec.name, field: "*" }, [{ collection: h.spec.base, field: "*" }], "overlay", "record");
     }
     this.overlayedViewRegistry = registry;
   }
@@ -8351,16 +9408,15 @@ var Vault = class {
   _getOverlayedViewRegistry() {
     return this.overlayedViewRegistry;
   }
+  /** @internal — ctx for `putDerivedOutput`'s frozen-period skip+audit (#638 Task 5). */
+  _dispatchCtx(source) {
+    return { emit: (e, p) => this.emitter.emit(e, p), source, audit: ledgerAuditHook(this.getLedgerOrNull() ?? void 0, this.keyring.userId) };
+  }
   /**
-   * Manual re-materialize for a single registered MV. Useful
-   * for `refresh: 'manual'` MVs (whose consumer drives refreshes
-   * externally), for stale-bit recovery on vault re-open, and as the
-   * explicit bulk-recompute escape hatch after a strategy change.
-   *
-   * Returns `{ written, deleted, failed }`. `deleted` is always 0
-   * when tombstoning is not enabled.
-   *
-   * Throws if `name` is not a registered MV.
+   * Manual re-materialize for a single registered MV (`refresh: 'manual'` consumers,
+   * stale-bit recovery on vault reopen, bulk-recompute escape hatch after a strategy
+   * change). Returns `{ written, deleted, failed }` (`deleted` always 0 without
+   * tombstoning). Throws if `name` is not a registered MV.
    */
   async refreshView(name) {
     const registry = this.materializedViewRegistry;
@@ -8371,42 +9427,42 @@ var Vault = class {
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-6LHOV7MN.js");
+    const { MaterializedViewExecutor } = await import("./executor-IL7SRNUZ.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
-      getQueryContext: () => this
+      getQueryContext: () => this,
+      dispatchCtx: this._dispatchCtx({ collection: name, id: "refreshView" })
     });
-    const { clearMVStale } = await import("./stale-DP66HFT3.js");
+    const { clearMVStale } = await import("./stale-IYYXEH3U.js");
     clearMVStale(registry, name);
     return result;
   }
   /**
-   * Re-derive every record in the named source collection. Useful
-   * after a strategy change to bring previously-derived records
-   * up-to-date.
-   *
-   * Sequential in v1; parallelisation deferred to v2.
+   * Re-derive every record in the named source collection (useful after a strategy
+   * change to bring previously-derived records up-to-date). Sequential in v1.
    */
   async deriveAll(sourceCollection) {
     const registry = this._getDerivationRegistry();
-    if (registry === null) return { derived: 0, failed: 0 };
+    if (registry === null) return { derived: 0, failed: 0, skippedFrozen: 0 };
     const strategies = registry.strategiesForSource(sourceCollection);
-    if (strategies.length === 0) return { derived: 0, failed: 0 };
-    const { DerivationExecutor } = await import("./executor-EUPYHCLU.js");
+    if (strategies.length === 0) return { derived: 0, failed: 0, skippedFrozen: 0 };
+    const { DerivationExecutor } = await import("./executor-WAEI6PDV.js");
     const sourceColl = this.collection(sourceCollection);
     const records = await sourceColl.list();
-    const ctx = { vault: this.derivationFacade ?? new (await import("./read-only-facade-5ADRJVTM.js")).ReadOnlyVaultFacade(this, "derivation") };
+    const ctx = { vault: this.derivationFacade ?? new (await import("./read-only-facade-UCYNRE56.js")).ReadOnlyVaultFacade(this, "derivation") };
     let derived = 0;
     let failed = 0;
+    let skippedFrozen = 0;
     for (const record of records) {
       if (typeof record !== "object" || record === null) continue;
       const id = record.id;
       if (typeof id !== "string") continue;
+      const dispatchCtx = this._dispatchCtx({ collection: sourceCollection, id });
       for (const { spec, strategyHash } of strategies) {
         const sourceWithId = { ...record, id };
         const result = await DerivationExecutor.run(spec, sourceWithId, 0, strategyHash, ctx);
-        let anyFailed = false;
+        let anyFailed = false, anyFrozenSkip = false;
         for (const key of Object.keys(spec.outputs)) {
           const out = result.outputs[key];
           if (!out) continue;
@@ -8418,7 +9474,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-BDKLP5GG.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-CI5BCMQM.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key, this.getDEK, this.encrypted);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -8428,7 +9484,7 @@ var Vault = class {
               await outputColl._internalDelete(k);
             }
             for (const entry of out.entries) {
-              await outputColl.put(entry.key, entry.value);
+              if (await putDerivedOutput(outputColl, entry.key, entry.value, dispatchCtx) === "skipped-frozen") anyFrozenSkip = true;
             }
             await saveFanoutSidecar(this.adapter, this.name, {
               source: spec.source,
@@ -8443,13 +9499,14 @@ var Vault = class {
             await outputColl._internalDelete(id);
             continue;
           }
-          await outputColl.put(id, out.value);
+          if (await putDerivedOutput(outputColl, id, out.value, dispatchCtx) === "skipped-frozen") anyFrozenSkip = true;
         }
         if (anyFailed) failed++;
+        else if (anyFrozenSkip) skippedFrozen++;
         else derived++;
       }
     }
-    return { derived, failed };
+    return { derived, failed, skippedFrozen };
   }
   /**
    * @internal — exposed for `runTransaction({ amendment: true })` so
@@ -8640,7 +9697,7 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-FDOXXHNG.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-ZKII5UBI.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
         "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (passphrase) first."
@@ -8662,7 +9719,7 @@ var Vault = class {
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-FDOXXHNG.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-ZKII5UBI.js");
     await revokeDelegation(this.adapter, this.name, id);
     void DELEGATIONS_COLLECTION;
   }
@@ -8849,6 +9906,38 @@ var Vault = class {
   async getPeriod(name) {
     return this.periods.getPeriod(name);
   }
+  /**
+   * Freeze a closed period (#604): purges in-window delete markers and
+   * records a `_period_freezes` companion, never mutating the chained
+   * `_periods` record. Idempotent. Purges the LOCAL adapter only — a
+   * synced target's markers survive there and re-import on pull (benign),
+   * and purging re-opens the #589 resurrection window for a peer offline
+   * since before the cutoff (see periods.ts's "Freeze" section).
+   */
+  async freezePeriod(name) {
+    return this.periods.freezePeriod(name);
+  }
+  /**
+   * Archive a closed period (#613): relocates its in-window records from the
+   * hot store to the configured cold tier (via the routeStore's cold route),
+   * recording a `_period_archives` companion + ledger entry, never mutating
+   * the chained `_periods` record. Non-destructive (reads fall through to
+   * cold) and idempotent. Requires a routeStore with a cold route.
+   */
+  async archivePeriod(name) {
+    return this.periods.archivePeriod(name);
+  }
+  /**
+   * Target-purge a closed+frozen period (#615): sweeps delete markers off the
+   * vault's push-only sync targets (`backup`/`archive`), recording a
+   * `_period_target_purges` companion + ledger entry, never mutating the chained
+   * `_periods` record. `sync-peer` targets are skipped. Requires the period be
+   * frozen first. Idempotent; a vault with no push-only targets writes no
+   * companion and is re-runnable.
+   */
+  async purgePeriodTargets(name) {
+    return this.periods.purgePeriodTargets(name);
+  }
   /** @internal — called by the gate bus before put/delete. */
   async _assertTsWritable(existing, incoming) {
     return this.periods.assertTsWritable(existing, incoming);
@@ -8878,7 +9967,7 @@ var Vault = class {
    * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
    */
   async dumpSchema(opts = {}) {
-    const { dumpVaultSchema } = await import("./walk-3SB25HF2.js");
+    const { dumpVaultSchema } = await import("./walk-76UCFXYV.js");
     return dumpVaultSchema(this, opts);
   }
   /**
@@ -9013,7 +10102,7 @@ var Vault = class {
    * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md
    */
   async getPublicEnvelope(opts = {}) {
-    const { readPublicEnvelope } = await import("./public-envelope-CBRIJORQ.js");
+    const { readPublicEnvelope } = await import("./public-envelope-J5PLQOW2.js");
     return readPublicEnvelope(this.adapter, this.name, opts);
   }
   /**
@@ -9028,7 +10117,7 @@ var Vault = class {
    * both modes round-trip cleanly.
    */
   async dump() {
-    const { dumpVault } = await import("./backup-7PX6NDKT.js");
+    const { dumpVault } = await import("./backup-ODXO7OGA.js");
     return dumpVault(this.backupContext());
   }
   /**
@@ -9080,7 +10169,7 @@ var Vault = class {
    * — there's no chain to verify against.
    */
   async load(backupJson) {
-    const { loadVault } = await import("./backup-7PX6NDKT.js");
+    const { loadVault } = await import("./backup-ODXO7OGA.js");
     return loadVault(this.backupContext(), backupJson);
   }
   /**
@@ -9112,7 +10201,7 @@ var Vault = class {
    * way to detect tampering of an in-place vault.
    */
   async verifyBackupIntegrity() {
-    const { verifyBackupIntegrity } = await import("./backup-7PX6NDKT.js");
+    const { verifyBackupIntegrity } = await import("./backup-ODXO7OGA.js");
     return verifyBackupIntegrity(this.backupContext());
   }
   /**
@@ -9218,7 +10307,7 @@ var Vault = class {
         const records = [];
         for (const id of ids) {
           const record = await coll.get(id, localeOpts);
-          if (record !== null) records.push(record);
+          if (record !== null) records.push(exportRedact(coll, record));
         }
         const chunk = {
           collection: collectionName,
@@ -9237,7 +10326,7 @@ var Vault = class {
             collection: collectionName,
             schema,
             refs,
-            records: [record],
+            records: [exportRedact(coll, record)],
             ...dictionaries !== void 0 ? { dictionaries } : {},
             ...ledgerHead ? { ledgerHead } : {}
           };
@@ -9330,7 +10419,7 @@ var Vault = class {
    * is the live validator object, not a serialization of it).
    */
   async exportJSON(opts = {}) {
-    const { exportVaultJSON } = await import("./backup-7PX6NDKT.js");
+    const { exportVaultJSON } = await import("./backup-ODXO7OGA.js");
     return exportVaultJSON(this.backupContext(), opts);
   }
 };
@@ -10044,17 +11133,17 @@ function memoryStore() {
 }
 
 // src/with-party/session/strategy.ts
-function notEnabled4(op) {
+function notEnabled3(op) {
   return new Error(
     `${op} requires the session strategy. Import \`{ withSession }\` from "@noy-db/hub/session" and pass it to \`createNoydb({ sessionStrategy: withSession() })\`.`
   );
 }
 var NO_SESSION = {
   validateSessionPolicy() {
-    throw notEnabled4("sessionPolicy");
+    throw notEnabled3("sessionPolicy");
   },
   createEnforcer() {
-    throw notEnabled4("session policy enforcement");
+    throw notEnabled3("session policy enforcement");
   },
   revokeAllSessions() {
   }
@@ -10958,6 +12047,7 @@ function createPlaintextKeyring(userId, debugPlaintext = false) {
     ...debugPlaintext ? { debugPlaintext } : {}
   };
 }
+var emptyPullResult = () => ({ pulled: 0, conflicts: [], errors: [] });
 var Noydb = class {
   options;
   emitter = new NoydbEventEmitter();
@@ -11202,7 +12292,7 @@ var Noydb = class {
       if (!facade) return;
       const ctx = { existing, vault: facade, userId: e.userId, role: e.role };
       await registry.runChecks(e.collection, incoming, ctx);
-      const { GuardExecutor } = await import("./executor-KZ4B3PRT.js");
+      const { GuardExecutor } = await import("./executor-OUA2Y6YC.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, e.docId, existing, incoming, e.computedFieldNames);
       }
@@ -11374,6 +12464,7 @@ var Noydb = class {
       } : void 0,
       onRegisterConflictResolver: syncEngine ? (resolverName, resolver) => syncEngine.registerConflictResolver(resolverName, resolver) : void 0,
       syncAdapter: targets.length > 0 ? targets[0].store : void 0,
+      getPurgeableTargets: () => targets.filter((t) => t.role === "backup" || t.role === "archive").map((t) => ({ store: t.store, role: t.role, ...t.label !== void 0 ? { label: t.label } : {} })),
       historyConfig: this.options.history,
       ...this.options.blobStrategy !== void 0 ? { blobStrategy: this.options.blobStrategy } : {},
       ...this.options.objectStore !== void 0 ? { objectStore: this.options.objectStore } : {},
@@ -11422,6 +12513,8 @@ var Noydb = class {
     });
     this._forEachSyncEngine(name, (engine) => {
       engine.setCacheInvalidator((collection, id) => comp._invalidateSyncApplied(collection, id));
+      engine.setGraphBatchController({ begin: () => comp._beginGraphBatch(), flush: () => comp._flushGraphBatch() });
+      engine.setReservedLookupSource({ collections: () => comp._reservedLookupCollectionNames() });
     });
     await comp._initGuards(this.options.guardStrategies ?? []);
     await comp._initDerivations(this.options.derivationStrategies ?? []);
@@ -11894,9 +12987,13 @@ var Noydb = class {
     const engine = this.getSyncEngine(vault);
     return engine.push(options);
   }
-  /** Pull remote changes to local for a vault. */
+  /**
+   * Pull remote changes to local for a vault. A `backup`/`archive` primary is a
+   * push-only sink and is never pulled from (#616) — returns an empty result.
+   */
   async pull(vault, options) {
     const engine = this.getSyncEngine(vault);
+    if (engine.role !== "sync-peer") return emptyPullResult();
     return engine.pull(options);
   }
   /**
@@ -11905,7 +13002,7 @@ var Noydb = class {
    */
   async sync(vault, options) {
     const primary = this.getSyncEngine(vault);
-    const result = await primary.sync(options);
+    const result = primary.role === "sync-peer" ? await primary.sync(options) : { pull: emptyPullResult(), push: await primary.push(options?.push) };
     for (const [key, engine] of this.syncEngines) {
       if (key === vault) continue;
       if (!key.startsWith(`${vault}::`)) continue;
@@ -12462,7 +13559,7 @@ var Noydb = class {
         "setPublicEnvelope: the public-envelope feature is not enabled. Pass `publicEnvelope: true` (or a schema object) to `createNoydb`."
       );
     }
-    const { loadPublicEnvelope, savePublicEnvelope, resolveSchema, validatePublicEnvelopeInput } = await import("./public-envelope-CBRIJORQ.js");
+    const { loadPublicEnvelope, savePublicEnvelope, resolveSchema, validatePublicEnvelopeInput } = await import("./public-envelope-J5PLQOW2.js");
     const schema = resolveSchema(this.options.publicEnvelope);
     validatePublicEnvelopeInput(input, schema);
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -12491,7 +13588,7 @@ var Noydb = class {
    * regardless).
    */
   async getPublicEnvelope(vault, opts = {}) {
-    const { readPublicEnvelope } = await import("./public-envelope-CBRIJORQ.js");
+    const { readPublicEnvelope } = await import("./public-envelope-J5PLQOW2.js");
     return readPublicEnvelope(this.options.store, vault, opts);
   }
   // ─── Auth introspection ─────────────────────────────────────────
@@ -12682,9 +13779,9 @@ async function createNoydb(options) {
     throw new ValidationError("A secret (passphrase) or getKeyring callback is required when encryption is enabled");
   }
   if (!options.coordinationStrategy) options = { ...options, coordinationStrategy: await createDefaultCoordinationProvider(options.store) };
-  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-Z66JMGOU.js")).createUserApi };
+  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-HV4PDUWF.js")).createUserApi };
   if (!options.policyFactory) {
-    const policyModule = await import("./policy-SXPLTQS4.js");
+    const policyModule = await import("./policy-SDGRWVIL.js");
     options = { ...options, policyFactory: policyModule.createNoydbPolicy, policyCheckGateFn: policyModule.checkGate };
   }
   return new Noydb(options);
@@ -12701,6 +13798,9 @@ function normalizeSyncTargets(sync) {
 export {
   memoryStore,
   withArchive,
+  buildLookupSnapshot,
+  via,
+  isViaFieldSpec,
   Collection,
   ELEVATION_AUDIT_COLLECTION,
   ElevatedHandle,
@@ -12719,4 +13819,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-5K7KZMXG.js.map
+//# sourceMappingURL=chunk-4C4WBS4V.js.map