@noy-db/hub 0.4.0-pre.0 → 0.4.0-pre.10

package/dist/{chunk-PK6JIDQ4.js → chunk-NFIBXF4V.js}

@@ -1,96 +1,59 @@
 import {
-  jsonSchemaToFields
-} from "./chunk-VYYM3MEN.js";
-import {
-  NO_SEQUENCE,
-  SEQUENCE_COLLECTION,
-  compileSequenceFormat,
-  resolveSequenceKey
-} from "./chunk-DSBQODMZ.js";
-import {
-  loadVaultPolicy
-} from "./chunk-XDIAFPUM.js";
+  resolveStaleOnRead
+} from "./chunk-NJ4DYYO5.js";
 import {
   LinkIntegrityError,
   isLinkCollectionName,
   linkCollectionName,
   linkRowKey
-} from "./chunk-RTEK4C4I.js";
+} from "./chunk-4JQK3L4V.js";
 import {
   hashFields,
   validateSatelliteDeclaration
-} from "./chunk-2PCAVW2I.js";
+} from "./chunk-SHEEBRZ4.js";
 import {
   loadFence
-} from "./chunk-XJMBYYQK.js";
+} from "./chunk-LNZKOUJR.js";
 import {
-  InvertedIndex,
-  MemoryIndexStore,
-  NO_SEARCH,
   VectorSet,
   buildPersistedIndexCallbacks,
   encodeVecId,
   syncTierSearch
-} from "./chunk-IK43HLDQ.js";
+} from "./chunk-7YVBQJ7K.js";
 import {
-  derivePersistedSchema,
-  isZod4Schema
-} from "./chunk-BOKIKJJB.js";
+  SchemaUpdateGate
+} from "./chunk-6LJY7X5A.js";
 import {
   isBaseLive,
   liveBaseIdSet
 } from "./chunk-GYGLAVCX.js";
-import {
-  CustodyApi,
-  NO_CARGO,
-  NO_CUSTODY
-} from "./chunk-SV6EAJEP.js";
-import {
-  ServiceBus,
-  WriteHookRegistry,
-  assertCanExport,
-  assertCanImport,
-  canExport,
-  canImport
-} from "./chunk-EWPOHMN2.js";
-import {
-  runDrainBarrier
-} from "./chunk-ISMV2QVG.js";
-import {
-  OverlayedCollection
-} from "./chunk-5WZXVULX.js";
-import {
-  NO_ATTESTATION
-} from "./chunk-S6Q37VGE.js";
-import {
-  NO_CLASSIFIED,
-  guardClassifiedCompat,
-  resolveClassifiedFields
-} from "./chunk-Z4PD65VQ.js";
 import {
   NO_TIERS,
   classifySealedShred,
   syncDerivedOutputs
-} from "./chunk-CZTLE22N.js";
+} from "./chunk-Y2NJBNX3.js";
 import {
   NO_PORTABILITY
-} from "./chunk-M75ZZHSR.js";
+} from "./chunk-BLBAQRBM.js";
 import {
-  PERIODS_COLLECTION,
-  PERIOD_ARCHIVES_COLLECTION,
-  PERIOD_FREEZES_COLLECTION,
-  PERIOD_TARGET_PURGES_COLLECTION,
-  periodExclusiveUpperBound
-} from "./chunk-XTHCN77N.js";
+  NO_CARGO,
+  runDrainBarrier
+} from "./chunk-TG634KCO.js";
 import {
-  TxContext,
-  bestEffortRevert,
-  revertExecuted
-} from "./chunk-JRBNCUNT.js";
+  resolveManagedSecret,
+  saveSealedSecret
+} from "./chunk-FQZ6XTQ7.js";
+import {
+  jsonSchemaToFields
+} from "./chunk-VYYM3MEN.js";
+import {
+  derivePersistedSchema,
+  isZod4Schema
+} from "./chunk-6ZNSB3H6.js";
 import {
   DEFAULT_POSTURE,
   ViaGraph
-} from "./chunk-3ELCWU56.js";
+} from "./chunk-4ZKNC6A6.js";
 import {
   buildLookupAltIndex,
   buildLookupSnapshotRows,
@@ -111,24 +74,80 @@ import {
   resolveLabelFromMap,
   resolveRollupDeleteIntents,
   runGraphDispatchWave,
+  selfWriteFieldEqual,
   touchFor,
   updateReferencingRecords
-} from "./chunk-LVGTA624.js";
+} from "./chunk-IPUG56GJ.js";
+import {
+  OverlayedCollection
+} from "./chunk-ZTLOXFPB.js";
+import {
+  INDEXED_STORE_POLICY,
+  NO_SYNC
+} from "./chunk-55LKVALY.js";
+import {
+  NO_ATTESTATION
+} from "./chunk-5GQEU4DN.js";
+import {
+  NO_CLASSIFIED,
+  guardClassifiedCompat,
+  resolveClassifiedFields
+} from "./chunk-EE7UHLKH.js";
+import {
+  NO_PERIODS
+} from "./chunk-UDHBXYGG.js";
+import {
+  PERIODS_COLLECTION,
+  PERIOD_ARCHIVES_COLLECTION,
+  PERIOD_FREEZES_COLLECTION,
+  PERIOD_TARGET_PURGES_COLLECTION,
+  periodExclusiveUpperBound
+} from "./chunk-NM5UYF6Q.js";
+import {
+  NO_SHADOW
+} from "./chunk-SMY5X46Z.js";
+import {
+  NO_SNAPSHOTS
+} from "./chunk-DZFQVICS.js";
+import {
+  TxContext,
+  bestEffortRevert,
+  revertExecuted
+} from "./chunk-NGSJZFGL.js";
+import {
+  lazy
+} from "./chunk-5D2ALSM5.js";
+import {
+  InvertedIndex,
+  MemoryIndexStore,
+  NO_SEARCH
+} from "./chunk-MCHBCNCE.js";
+import {
+  NO_SEQUENCE,
+  SEQUENCE_COLLECTION,
+  compileSequenceFormat,
+  resolveSequenceKey
+} from "./chunk-L2DGWBCT.js";
+import {
+  CustodyApi,
+  NO_CUSTODY
+} from "./chunk-YWWQM7KP.js";
 import {
-  NO_AGGREGATE,
   Query,
   ScanBuilder
-} from "./chunk-A5BDDEXK.js";
+} from "./chunk-WBKZUO5V.js";
 import {
   EXPORT_AUDIT_COLLECTION,
+  NO_BLOBS,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-U6JMEH2P.js";
+} from "./chunk-CXQW2NWO.js";
 import {
   LazyQuery,
+  NO_INDEXING,
   decodeIdxId,
   encodeIdxId
-} from "./chunk-VEALDPHW.js";
+} from "./chunk-L3YYLT4E.js";
 import {
   IMPLICIT_LAZY,
   Lru,
@@ -136,17 +155,22 @@ import {
 } from "./chunk-NO272T7Q.js";
 import {
   canonicalGroupKey
-} from "./chunk-TAGR72IR.js";
+} from "./chunk-XZHEOSQ2.js";
+import {
+  NO_REDUCE
+} from "./chunk-YMUFFJCO.js";
 import {
   readPath
 } from "./chunk-IGJCYUT5.js";
 import {
-  resolveManagedSecret,
-  saveSealedPassphrase
-} from "./chunk-RFI7GGFO.js";
+  NO_CRDT
+} from "./chunk-PVEWA2DU.js";
+import {
+  NO_CONSENT
+} from "./chunk-PEOZ34EM.js";
 import {
   dictCollectionName
-} from "./chunk-MT62YSPZ.js";
+} from "./chunk-FRMPM7WG.js";
 import {
   NO_I18N,
   getAtPath,
@@ -154,36 +178,34 @@ import {
   isDictKeyDescriptor,
   isI18nTextDescriptor,
   isStaticDictDescriptor
-} from "./chunk-GULTLPFB.js";
+} from "./chunk-UADPR6F4.js";
 import {
-  installViaBinder,
   isViaInstalled,
   viaBinder
-} from "./chunk-JVBO4SZL.js";
+} from "./chunk-6UBZ6I5Z.js";
 import {
   NO_TEAM,
+  describeAllUsersAuth,
+  describeAuthConfig,
+  describeUserAuth,
+  diagramAuthConfig,
   enrollAuthenticator,
   findAuthenticator,
-  recoverPassphrase,
-  recoverUser,
-  removeAuthenticator,
-  rotatePassphrase,
-  updateAuthenticator,
-  writeMagicLinkGrant
-} from "./chunk-VKCADNMR.js";
-import {
   hasRecoveryEnrolled,
   hasStrongRecoveryEnrolled,
   loadPaperRecoveryEntries,
   loadShamirRecoveryEntries,
   mintPaperRecoveryEntry,
   mintShamirRecoveryEntry,
+  recoverSecret,
+  recoverUser,
+  removeAuthenticator,
+  rotateSecret,
   savePaperRecoveryEntries,
-  saveShamirRecoveryEntries
-} from "./chunk-ANATMTOA.js";
-import {
-  INDEXED_STORE_POLICY
-} from "./chunk-VQNJ7UZL.js";
+  saveShamirRecoveryEntries,
+  updateAuthenticator,
+  writeMagicLinkGrant
+} from "./chunk-NFNJLRY7.js";
 import {
   assertKeyringOpenAllowed,
   buildRecipientKeyringFile,
@@ -191,31 +213,39 @@ import {
   createOwnerKeyring,
   ensureCollectionDEK,
   hasAccess,
+  hasExportCapability,
+  hasImportCapability,
   hasWritePermission,
   isSecretBearingReservedCollection,
   listUsers,
   loadKeyring,
   updateKeyringIdentity
-} from "./chunk-554KLAAN.js";
+} from "./chunk-BLCWSJLN.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
-} from "./chunk-NCCBLYEB.js";
+} from "./chunk-JJZGIE4U.js";
 import {
   NO_BROKER,
   buildCredentialBrokerHandle
-} from "./chunk-SMIRGMS7.js";
+} from "./chunk-IXNCZTWA.js";
+import {
+  NO_SESSION
+} from "./chunk-VKQCVU2Z.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
+import {
+  NO_HISTORY
+} from "./chunk-AFHQATY4.js";
 import {
   assertCutoverTierSafe,
   assertTierWritable,
   liveRecordIsElevated
-} from "./chunk-DRWBEDYO.js";
+} from "./chunk-JYJFGD2H.js";
 import {
   sha256Hex
-} from "./chunk-WQIYTNJV.js";
+} from "./chunk-IXTSNGYY.js";
 import {
   NO_FORGET,
   addSubjectRef,
@@ -224,10 +254,10 @@ import {
   readDottedPath,
   rebuildSubjectIndex,
   removeSubjectRef
-} from "./chunk-IFJTPAQQ.js";
+} from "./chunk-OLEPKFTW.js";
 import {
   NO_SEALED_RECORD
-} from "./chunk-RDXW3OBQ.js";
+} from "./chunk-QD46HPZG.js";
 import {
   RecordCodec,
   SEALED_CEK_NS,
@@ -238,20 +268,20 @@ import {
   queryByDet,
   resolveStableCek,
   validateSchemaInput
-} from "./chunk-W4TCUGQR.js";
+} from "./chunk-G2JUIDFA.js";
 import {
   buildDeleteMarker,
   buildTombstone,
   isDeleteMarker,
   isTombstone
-} from "./chunk-A4FXFAKF.js";
+} from "./chunk-W3L64Y3J.js";
 import {
   encrypt
-} from "./chunk-HOONYZY2.js";
+} from "./chunk-AKKRXT23.js";
 import {
   NOYDB_FORMAT_VERSION,
   SealedHandle
-} from "./chunk-VCTXU4AT.js";
+} from "./chunk-QBAC3GXA.js";
 import {
   AlreadyElevatedError,
   AttestationError,
@@ -260,11 +290,12 @@ import {
   ClassifiedVerifyError,
   ConflictError,
   DebugPlaintextError,
-  DerivationCapExceededError,
   DictKeyInUseError,
   ElevationExpiredError,
+  ExportCapabilityError,
   FieldNotQueryableError,
   ForgetStrategyNotConfiguredError,
+  ImportCapabilityError,
   IndexWriteFailureError,
   InvalidKeyError,
   KeyringCorruptError,
@@ -291,14 +322,127 @@ import {
   UnsupportedIndexOptionError,
   UnsupportedTierCompositionError,
   ValidationError
-} from "./chunk-W2OG6JOL.js";
+} from "./chunk-QZWTRENR.js";
+
+// src/with-commit/tx/strategy.ts
+var NOT_ENABLED = new Error(
+  'Multi-record transactions require the tx strategy. Import `{ withTransactions }` from "@noy-db/hub/transactions" and pass it to `createNoydb({ transactionsStrategy: withTransactions() })`.'
+);
+var NO_TRANSACTIONS = {
+  async runTransaction(_db, _fn, _options, _txInvariants) {
+    throw NOT_ENABLED;
+  },
+  async runDryRun() {
+    throw NOT_ENABLED;
+  }
+};
+
+// src/port/with/archive-strategy.ts
+var ARCHIVE_NOT_ENABLED = "vault.archive/restore/listArchived require `archiveStrategy: withArchive({ store })` in createNoydb";
+var NO_ARCHIVE = {
+  get store() {
+    throw new Error(ARCHIVE_NOT_ENABLED);
+  }
+};
+
+// src/port/with/strategies.ts
+var STRATEGY_DEFAULTS = {
+  reduce: NO_REDUCE,
+  archive: NO_ARCHIVE,
+  attestation: NO_ATTESTATION,
+  blobs: NO_BLOBS,
+  broker: NO_BROKER,
+  cargo: NO_CARGO,
+  classified: NO_CLASSIFIED,
+  consent: NO_CONSENT,
+  crdt: NO_CRDT,
+  custody: NO_CUSTODY,
+  forget: NO_FORGET,
+  history: NO_HISTORY,
+  i18n: NO_I18N,
+  indexing: NO_INDEXING,
+  lazy: IMPLICIT_LAZY,
+  periods: NO_PERIODS,
+  portability: NO_PORTABILITY,
+  sealedRecord: NO_SEALED_RECORD,
+  search: NO_SEARCH,
+  sequence: NO_SEQUENCE,
+  session: NO_SESSION,
+  shadow: NO_SHADOW,
+  snapshots: NO_SNAPSHOTS,
+  sync: NO_SYNC,
+  team: NO_TEAM,
+  tiers: NO_TIERS,
+  transactions: NO_TRANSACTIONS
+};
+var STRATEGY_KEYS = Object.keys(STRATEGY_DEFAULTS);
+function resolveStrategies(options) {
+  const provided = options;
+  const resolved = { ...STRATEGY_DEFAULTS };
+  for (const key of STRATEGY_KEYS) {
+    const value = provided[`${key}Strategy`];
+    if (value !== void 0) resolved[key] = value;
+  }
+  return resolved;
+}
 
 // src/port/by/default-provider.ts
 async function createDefaultCoordinationProvider(store) {
-  const { StoreCoordinationProvider } = await import("./store-coordination-provider-FKX3F6TQ.js");
+  const { StoreCoordinationProvider } = await import("./store-coordination-provider-EWRZL7XF.js");
   return new StoreCoordinationProvider(store);
 }
 
+// src/port/with/collection-registries.ts
+function populateCollectionRegistries(r, collectionName, options, effectiveViaFields) {
+  if (options?.refs) {
+    r.refRegistry.register(collectionName, options.refs);
+  }
+  if (effectiveViaFields.i18nFields) {
+    r.i18nFieldRegistry.set(collectionName, effectiveViaFields.i18nFields);
+  }
+  if (options?.blobFields) {
+    r.blobFieldsRegistry.set(collectionName, options.blobFields);
+  }
+  if (options?.archive) {
+    r.archiveRegistry.set(collectionName, options.archive);
+  }
+  if (options?.attestation !== void 0) {
+    r.attestation.register(collectionName, options.attestation);
+  }
+  if (effectiveViaFields.dictKeyFields || effectiveViaFields.lookupFields) {
+    const dictFieldMap = {};
+    const staticFieldMap = {};
+    for (const [field, desc] of Object.entries(effectiveViaFields.dictKeyFields ?? {})) {
+      if (isStaticDictDescriptor(desc)) {
+        staticFieldMap[field] = desc;
+        r.staticDictNames.add(desc.name);
+        r.staticByName.set(desc.name, desc);
+      } else {
+        dictFieldMap[field] = desc.name;
+      }
+    }
+    const lookupCompat = collectLookupDictCompat(effectiveViaFields.lookupFields);
+    Object.assign(dictFieldMap, lookupCompat.dictFieldMap);
+    for (const [field, desc] of lookupCompat.staticEntries) {
+      staticFieldMap[field] = desc;
+      r.staticDictNames.add(desc.name);
+      r.staticByName.set(desc.name, desc);
+    }
+    if (Object.keys(dictFieldMap).length > 0) {
+      r.dictKeyFieldRegistry.set(collectionName, dictFieldMap);
+      for (const dictName of new Set(Object.values(dictFieldMap))) {
+        r.reservedLookupCollections.set(dictCollectionName(dictName), dictName);
+      }
+    }
+    if (Object.keys(staticFieldMap).length > 0) {
+      r.staticDescriptorByField.set(collectionName, staticFieldMap);
+    }
+  }
+  if ((options?.schemaUpdate?.length ?? 0) > 0) {
+    r.schemaUpdateNames.set(collectionName, (options.schemaUpdate ?? []).map((s) => s.name));
+  }
+}
+
 // src/kernel/via/pipeline.ts
 var ViaPipeline = class _ViaPipeline {
   constructor(bindings, taint) {
@@ -792,7 +936,7 @@ async function reconcileIndex(ctx, field, opts = {}) {
   const persisted = ctx.persistedIndexes;
   if (!persisted) {
     throw new Error(
-      `Collection "${ctx.name}": indexing is disabled on this Noydb instance. Pass \`withIndexing()\` from "@noy-db/hub/indexing" to \`createNoydb({ indexStrategy })\`.`
+      `Collection "${ctx.name}": indexing is disabled on this Noydb instance. Pass \`withIndexing()\` from "@noy-db/hub/indexing" to \`createNoydb({ indexingStrategy })\`.`
     );
   }
   if (!persisted.has(field)) {
@@ -964,61 +1108,6 @@ async function resolveTierSyncPrior(ctx, id, priorEnvelope) {
   return await ctx.codec.decryptRecord(priorEnvelope, { skipValidation: true, id });
 }
 
-// src/with-commit/history/strategy.ts
-function notEnabled(op) {
-  return new Error(
-    `${op} requires the history strategy. Import \`{ withHistory }\` from "@noy-db/hub/history" and pass it to \`createNoydb({ historyStrategy: withHistory() })\`.`
-  );
-}
-var NO_HISTORY = {
-  async saveHistory() {
-  },
-  async getHistoryEntries() {
-    throw notEnabled("collection.history()");
-  },
-  async getVersionEnvelope() {
-    throw notEnabled("collection.getVersion()");
-  },
-  async pruneHistory() {
-    return 0;
-  },
-  async clearHistory() {
-    return 0;
-  },
-  async tombstoneHistory() {
-    return 0;
-  },
-  async rewrapHistory() {
-  },
-  async envelopePayloadHash() {
-    return "";
-  },
-  computePatch() {
-    return [];
-  },
-  diff() {
-    throw notEnabled("collection.diff()");
-  },
-  buildLedger() {
-    return null;
-  },
-  buildVaultInstant() {
-    throw notEnabled("vault.at() / vault.timeMachine()");
-  }
-};
-
-// src/with-lookup/indexing/strategy.ts
-var NO_INDEXING = {
-  createState() {
-    return DISABLED_STATE;
-  }
-};
-var DISABLED_STATE = {
-  isEnabled: false,
-  getEagerIndexes: () => null,
-  getPersistedIndexes: () => null
-};
-
 // src/with-lookup/search/serialize.ts
 function serializeIndex(idx) {
   return JSON.stringify(idx.toSnapshot());
@@ -1621,164 +1710,6 @@ function buildDescription(input) {
   };
 }
 
-// src/via/blob/binding.ts
-async function eraseBlobs(ctx, cfg) {
-  if (cfg.purgeBlobsForRecord) return cfg.purgeBlobsForRecord(ctx.id);
-  return { shredded: 0, residue: [] };
-}
-function buildBlobDescribeFragment(fields) {
-  return {
-    blobFields: Object.fromEntries(
-      Object.entries(fields).map(([field, p]) => [field, {
-        ...p.retainDays !== void 0 ? { retainDays: p.retainDays } : {},
-        ...p.evictWhen !== void 0 ? { evictWhen: true } : {},
-        ...p.legalHold !== void 0 ? { legalHold: true } : {},
-        ...p.retainUntil !== void 0 ? { retainUntil: true } : {},
-        ...p.external === true ? { external: true } : {},
-        ...p.public === true ? { public: true } : {},
-        ...p.backlink !== void 0 ? { backlink: p.backlink } : {}
-      }])
-    )
-  };
-}
-function blobBinding(cfg) {
-  return {
-    brand: "blob",
-    // encryptedAtRest: 'envelope' — blob chunks are AEAD-encrypted envelopes
-    // in `_blob_chunks` (service-side), not sealed record fields; queryable:
-    // 'none' — nothing indexes blob content; exportable — vault.exportBlobs()
-    // is a first-class door; forgettable — shredAllForRecord participates in
-    // vault.forget().
-    posture: { encryptedAtRest: "envelope", queryable: "none", exportable: true, forgettable: true },
-    covers: (field) => field in cfg.fields,
-    erase: (ctx) => eraseBlobs(ctx, cfg),
-    describeFragment: () => buildBlobDescribeFragment(cfg.fields)
-  };
-}
-function linkBlobVia() {
-  installViaBinder("blob", (c) => blobBinding(c));
-}
-
-// src/port/with/blob-strategy.ts
-linkBlobVia();
-var NO_BLOBS = {
-  openSlot() {
-    throw new Error(
-      'Blob storage is not enabled on this Noydb instance. Import `{ withBlobs }` from "@noy-db/hub/blobs" and pass `withBlobs()` to `createNoydb({ blobStrategy: withBlobs() })`.'
-    );
-  }
-};
-
-// src/with-formula/derivations/stale.ts
-var _staleByRegistry = /* @__PURE__ */ new WeakMap();
-var keyFor = (source, sourceId) => `${source}/${sourceId}`;
-async function markStale(registry, strategy, sourceId) {
-  let map = _staleByRegistry.get(registry);
-  if (!map) {
-    map = /* @__PURE__ */ new Map();
-    _staleByRegistry.set(registry, map);
-  }
-  const k = keyFor(strategy.source, sourceId);
-  let set = map.get(k);
-  if (!set) {
-    set = /* @__PURE__ */ new Set();
-    map.set(k, set);
-  }
-  set.add(strategy);
-}
-async function resolveStaleOnRead(accessor, outputCollection, id) {
-  const registry = accessor.registry();
-  const producers = registry.strategiesProducingOutput(outputCollection);
-  if (producers.length === 0) return;
-  const map = _staleByRegistry.get(registry);
-  if (!map) return;
-  let DerivationExecutor = null;
-  for (const { spec, strategyHash } of producers) {
-    const k = keyFor(spec.source, id);
-    const pending = map.get(k);
-    if (!pending || !pending.has(spec)) continue;
-    const sourceColl = accessor.getCollection(spec.source);
-    const source = await sourceColl.get(id);
-    if (!source) {
-      pending.delete(spec);
-      continue;
-    }
-    const sourceWithId = { ...source, id };
-    if (DerivationExecutor === null) {
-      ({ DerivationExecutor } = await import("./executor-XGIS6CR7.js"));
-    }
-    const ctx = { vault: accessor.getReadOnlyFacade() };
-    const result = await DerivationExecutor.run(spec, sourceWithId, 0, strategyHash, ctx);
-    for (const key of Object.keys(spec.outputs)) {
-      const out = result.outputs[key];
-      if (!out) continue;
-      if (out.kind === "failed") {
-        const err = out.error;
-        if (spec.strict) {
-          throw err;
-        }
-        console.warn(
-          `[derivation] lazy output "${key}" for source "${spec.source}" id="${id}" failed:`,
-          err
-        );
-        continue;
-      }
-      if (out.kind === "array") {
-        console.warn(
-          `[derivation] unexpected array-shape output "${key}" in lazy resolve path; array-shape derivations require lifecycle: "eager".`
-        );
-        continue;
-      }
-      const outSpec = spec.outputs[key];
-      if (!outSpec) continue;
-      const outputColl = accessor.getCollection(outSpec.collection);
-      if (out.skipped === true) {
-        await outputColl._internalDelete(id, accessor.getActiveTxContext());
-        continue;
-      }
-      await outputColl.put(id, out.value);
-    }
-    pending.delete(spec);
-  }
-}
-
-// src/with-commit/crdt/strategy.ts
-var NOT_ENABLED = new Error(
-  'CRDT mode requires the CRDT strategy. Import `{ withCrdt }` from "@noy-db/hub/crdt" and pass it to `createNoydb({ crdtStrategy: withCrdt() })`.'
-);
-var NO_CRDT = {
-  buildLwwMapState() {
-    throw NOT_ENABLED;
-  },
-  buildRgaState() {
-    throw NOT_ENABLED;
-  },
-  mergeCrdtStates() {
-    throw NOT_ENABLED;
-  },
-  resolveCrdtSnapshot() {
-    throw NOT_ENABLED;
-  }
-};
-
-// src/with-party/team/sync-strategy.ts
-function notEnabled2(op) {
-  return new Error(
-    `${op} requires the sync strategy. Import \`{ withSync }\` from "@noy-db/hub/sync" and pass it to \`createNoydb({ syncStrategy: withSync() })\`.`
-  );
-}
-var NO_SYNC = {
-  buildSyncEngine() {
-    throw notEnabled2("SyncEngine");
-  },
-  buildSyncTransaction() {
-    throw notEnabled2("SyncTransaction");
-  },
-  buildPresence() {
-    throw notEnabled2("collection.presence()");
-  }
-};
-
 // src/kernel/via/compose.ts
 function via(...descriptors) {
   if (descriptors.length === 0) {
@@ -1942,7 +1873,7 @@ function compileViaBindings(opts, classifiedGuardCtx, eraseCfgOut) {
       ...i18nFields !== void 0 ? { i18nFields } : {},
       ...dictKeyFields !== void 0 ? { dictKeyFields } : {},
       ...i18nDensifyFields !== void 0 ? { i18nDensifyFields } : {},
-      strategy: opts.i18nStrategy ?? NO_I18N,
+      strategy: opts.strategies.i18n,
       ...opts.defaultLocale !== void 0 ? { defaultLocale: opts.defaultLocale } : {},
       ...opts.autoTranslateHook !== void 0 ? { autoTranslateHook: opts.autoTranslateHook } : {},
       ...opts.dictLabelResolver !== void 0 ? { dictLabelResolver: opts.dictLabelResolver } : {},
@@ -2056,6 +1987,11 @@ function resolveCollectionConfig(opts) {
       `Collection "${opts.name}": embeddings are not supported on CRDT collections (L2). Use a non-CRDT collection for semantic search.`
     );
   }
+  if (opts.sensitive && opts.sensitive.length > 0 && opts.crdt) {
+    throw new Error(
+      `Collection "${opts.name}": sensitive (structural group-encryption) is not supported on CRDT collections \u2014 the CRDT write path bypasses per-field sealing, so the fields would be stored in the ordinary encrypted body with no \`_sealed\` slot and no per-field key. Use a non-CRDT collection for sealed fields.`
+    );
+  }
   if (opts.tiers && opts.tiers.length > 0 && opts.blobFields !== void 0 && Object.keys(opts.blobFields).length > 0 && opts.perRecordKeys !== true) {
     throw new UnsupportedTierCompositionError(
       "blobs",
@@ -2172,14 +2108,9 @@ function resolveCollectionConfig(opts) {
     writeHooks: opts.writeHooks,
     subsystemBus: opts.subsystemBus,
     activeTxId: opts.activeTxId,
-    blobStrategy: opts.blobStrategy ?? NO_BLOBS,
+    strategies: opts.strategies,
     objectStore: opts.objectStore,
     blobFields: opts.blobFields,
-    aggregateStrategy: opts.aggregateStrategy ?? NO_AGGREGATE,
-    crdtStrategy: opts.crdtStrategy ?? NO_CRDT,
-    historyStrategy: opts.historyStrategy ?? NO_HISTORY,
-    i18nStrategy: opts.i18nStrategy ?? NO_I18N,
-    syncStrategy: opts.syncStrategy ?? NO_SYNC,
     reconcileOnOpen: opts.reconcileOnOpen ?? "off",
     getDEK: opts.getDEK,
     onDirty: opts.onDirty,
@@ -2208,7 +2139,6 @@ function resolveCollectionConfig(opts) {
     moneyFields: effectiveViaFields.moneyFields,
     classified: resolvedClassified,
     classifiedGuardCtx,
-    classifiedStrategy: opts.classifiedStrategy ?? NO_CLASSIFIED,
     computed: mergedComputed,
     computedEdges,
     viaDepsEdges,
@@ -2230,8 +2160,6 @@ function resolveCollectionConfig(opts) {
     materializedViewSource: opts.materializedViewSource,
     graphDispatch: opts.graphDispatch,
     tiers: opts.tiers && opts.tiers.length > 0 ? new Set(opts.tiers) : null,
-    tiersStrategy: opts.tiersStrategy ?? NO_TIERS,
-    searchStrategy: opts.searchStrategy ?? NO_SEARCH,
     tierMode: opts.tierMode ?? "invisibility",
     blobTierPolicy: opts.blobTierPolicy ?? "isolate",
     onCrossTierAccess: opts.onCrossTierAccess,
@@ -2246,22 +2174,12 @@ function resolveCollectionConfig(opts) {
 }
 
 // src/with-formula/computed/lazy.ts
-var fn = null;
+var loadComputed = lazy(() => import("./computed-AB45PS4V.js"));
 async function loadEvalComputedFields() {
-  fn ??= (await import("./computed-DSMPXG2Y.js")).evalComputedFields;
-  return fn;
+  return (await loadComputed()).evalComputedFields;
 }
 
 // src/kernel/collection.ts
-function selfWriteFieldEqual(a, b) {
-  if (a === b) return true;
-  if (a === null || b === null || typeof a !== "object" || typeof b !== "object") return false;
-  try {
-    return JSON.stringify(a) === JSON.stringify(b);
-  } catch {
-    return false;
-  }
-}
 var fallbackWarned = /* @__PURE__ */ new Set();
 function warnOnceFallback(adapterName) {
   if (fallbackWarned.has(adapterName)) return;
@@ -2293,25 +2211,20 @@ var Collection = class {
   /** True when the caller explicitly provided a `historyConfig` option (vs. inheriting the vault default). */
   historyConfigExplicit;
   /**
-   * tree-shake seam — the strategy that backs `collection.blob(id)`.
-   * Defaults to `NO_BLOBS`, a ~10-line stub that throws with an actionable
-   * message. Consumers opt into real blob storage by importing
-   * `{ blobs }` from `@noy-db/hub/blobs` and passing the returned
-   * strategy to `createNoydb({ blobStrategy: blobs() })`. With the
-   * default stub, none of the BlobSet / chunk / MIME-magic machinery
-   * reaches the bundle.
+   * Every opt-in service, resolved once by `createNoydb` (#838) and shared by
+   * reference with the owning `Vault` and `Noydb`.
+   *
+   * Each entry is a tree-shake seam. An un-opted-in service resolves to its
+   * `NO_*` stub — a tiny module that throws with an actionable message —
+   * so, for example, none of the BlobSet / chunk / MIME-magic machinery
+   * reaches the bundle unless the consumer imports `@noy-db/hub/blobs` and
+   * passes `blobsStrategy: blobs()` to `createNoydb`.
    */
-  blobStrategy;
+  strategies;
   objectStore;
   blobFields;
   blobTierPolicy;
   // #724 T2/T3
-  aggregateStrategy;
-  crdtStrategy;
-  tiersStrategy;
-  searchStrategy;
-  historyStrategy;
-  syncStrategy;
   // In-memory cache of decrypted records (eager mode only). Lazy mode
   // uses `lru` instead. Both fields exist so a single Collection instance
   // doesn't need a runtime branch on every cache access.
@@ -2347,7 +2260,7 @@ var Collection = class {
   lru;
   /**
    * tree-shake seam — per-Collection indexing state. Owned by the
-   * `IndexStrategy` passed through from `createNoydb({ indexStrategy })`.
+   * `IndexingStrategy` passed through from `createNoydb({ indexingStrategy })`.
    * Defaults to a disabled state (both accessors return null) so the
    * `CollectionIndexes` / `PersistedCollectionIndex` / `LazyQuery`
    * classes never reach the bundle when indexing is unused.
@@ -2481,12 +2394,6 @@ var Collection = class {
   /** C-A/R10 memoization: marker declared-set lookup (undefined=unresolved) + classified-handle persist-once flag. */
   _markerDigestOnlyCache = void 0;
   _markerPersisted = false;
-  /**
-   * Tree-shake seam for `reveal()` — defaults to `NO_CLASSIFIED`, which
-   * throws `ClassifiedNotEnabledError`. Set via the `classifiedStrategy`
-   * `createNoydb()` option (opt in with `withClassified()`).
-   */
-  classifiedStrategy;
   /** Async callback provided by the Vault to open a dynamic dictionary handle (for label-map pre-computation in the search index). Only used in `resolveDictLabelMaps()`; static dicts bypass this entirely. Mutable, assign-once — see {@link _reconcileReadState} (#671 item 1). */
   getDictionary;
   /**
@@ -2635,16 +2542,10 @@ var Collection = class {
     this.writeHooks = cfg.writeHooks;
     this.subsystemBus = cfg.subsystemBus;
     this.activeTxId = cfg.activeTxId;
-    this.blobStrategy = cfg.blobStrategy;
+    this.strategies = cfg.strategies;
     this.objectStore = cfg.objectStore;
     this.blobFields = cfg.blobFields;
     this.blobTierPolicy = cfg.blobTierPolicy ?? "isolate";
-    this.aggregateStrategy = cfg.aggregateStrategy;
-    this.crdtStrategy = cfg.crdtStrategy;
-    this.tiersStrategy = cfg.tiersStrategy;
-    this.searchStrategy = cfg.searchStrategy;
-    this.historyStrategy = cfg.historyStrategy;
-    this.syncStrategy = cfg.syncStrategy;
     this.reconcileOnOpen = cfg.reconcileOnOpen;
     this.getDEK = cfg.getDEK;
     this.onDirty = cfg.onDirty;
@@ -2671,7 +2572,6 @@ var Collection = class {
     this.classified = cfg.classified;
     this.classifiedGuardCtx = cfg.classifiedGuardCtx;
     this.vdigFields = cfg.vdigFields;
-    this.classifiedStrategy = cfg.classifiedStrategy;
     this.computed = cfg.computed;
     this.getDictionary = cfg.getDictionary;
     this.defaultLocale = cfg.defaultLocale;
@@ -2719,7 +2619,7 @@ var Collection = class {
       deterministicFields: this.deterministicFields,
       vdigFields: this.vdigFields,
       crdtMode: this.crdtMode,
-      crdtStrategy: this.crdtStrategy,
+      crdtStrategy: this.strategies.crdt,
       schema: this.schema,
       getDEK: (collection) => this.getDEK(collection ?? this.name),
       cekCache: this.cekCache,
@@ -2737,7 +2637,7 @@ var Collection = class {
         const remoteJson = await this.codec.decryptJsonString(remote, id);
         if (localJson === null) return local;
         if (remoteJson === null) return remote;
-        const merged = this.crdtStrategy.mergeCrdtStates(JSON.parse(localJson), JSON.parse(remoteJson));
+        const merged = this.strategies.crdt.mergeCrdtStates(JSON.parse(localJson), JSON.parse(remoteJson));
         const mergedVersion = Math.max(local._v, remote._v) + 1;
         const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
         return this.codec.encryptJsonString(JSON.stringify(merged), mergedVersion, cek);
@@ -2795,12 +2695,12 @@ var Collection = class {
     }
     this.lazy = opts.prefetch === false;
     if (this.lazy) {
-      this.lru = (opts.lazyStrategy ?? IMPLICIT_LAZY).createCache(this.name, opts.cache);
+      this.lru = opts.strategies.lazy.createCache(this.name, opts.cache);
       this.hydrated = true;
     } else {
       this.lru = null;
     }
-    const strategy = opts.indexStrategy ?? NO_INDEXING;
+    const strategy = opts.strategies.indexing;
     this.indexState = strategy.createState({
       defs: opts.indexes ?? [],
       lazy: this.lazy
@@ -2955,7 +2855,7 @@ var Collection = class {
     if (spec.storage === "digest-only") {
       throw new ClassifiedRevealError(this.name, field, `storage:'digest-only' \u2014 verify-only; nothing recoverable to reveal`);
     }
-    return this.classifiedStrategy.reveal({
+    return this.strategies.classified.reveal({
       collection: this.name,
       spec,
       encrypted: this.storeCiphertext,
@@ -2975,7 +2875,7 @@ var Collection = class {
       throw new ClassifiedVerifyError(this.name, field, `storage:'never' \u2014 nothing is stored to verify against`);
     }
     const ctx = this._classifiedVerifyCtx(spec);
-    return spec.storage === "digest-only" ? this.classifiedStrategy.verify(ctx, id, field, candidate) : this.classifiedStrategy.verifyText(ctx, id, field, candidate);
+    return spec.storage === "digest-only" ? this.strategies.classified.verify(ctx, id, field, candidate) : this.strategies.classified.verifyText(ctx, id, field, candidate);
   }
   /** k-of-n challenge over the collection's secretAnswer members. Requires withClassified(). */
   async verifyGroup(id, answers, opts) {
@@ -2984,7 +2884,7 @@ var Collection = class {
       throw new ClassifiedVerifyError(this.name, "*", "no groupable digest-only (secretAnswer) fields declared");
     }
     const ctx = { ...this._classifiedVerifyCtx(members[0].spec), groupMembers: members };
-    return this.classifiedStrategy.matchGroup(ctx, id, answers, opts);
+    return this.strategies.classified.matchGroup(ctx, id, answers, opts);
   }
   _classifiedVerifyCtx(spec) {
     return {
@@ -3039,7 +2939,7 @@ var Collection = class {
     if (typeof candidate !== "string") {
       throw new ClassifiedVerifyError(this.name, "*", "candidate must be a string");
     }
-    const target = await this.classifiedStrategy.computeTarget(this._classifiedVerifyCtx(spec), field, candidate);
+    const target = await this.strategies.classified.computeTarget(this._classifiedVerifyCtx(spec), field, candidate);
     const ids = await this.adapter.list(this.vault, this.name);
     const hits = [];
     const hitMap = /* @__PURE__ */ new Map();
@@ -3052,7 +2952,7 @@ var Collection = class {
     }
     await this.onAccess?.("find", "*");
     if (hits.length === 0) return [];
-    const { verifyDigestField } = await import("./verify-26Y5GNMK.js");
+    const { verifyDigestField } = await import("./verify-7XWHJWUN.js");
     const policy = {
       normalize: spec.verifyNormalize ?? "password",
       notLastN: spec.notLastN ?? 0,
@@ -3126,7 +3026,7 @@ var Collection = class {
           id,
           version: scrubbed._v,
           actor: this.keyring.userId,
-          payloadHash: await this.historyStrategy.envelopePayloadHash(scrubbed),
+          payloadHash: await this.strategies.history.envelopePayloadHash(scrubbed),
           reason: "classified:scrub-equatable-tags"
         });
       }
@@ -3258,7 +3158,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-VZL4OGUB.js");
+      const { resolveStaleMVOnRead } = await import("./stale-A4J26OIC.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     let record;
@@ -3352,7 +3252,7 @@ var Collection = class {
     if (this.syncAdapter !== void 0) presenceOpts.syncAdapter = this.syncAdapter;
     if (opts?.staleMs !== void 0) presenceOpts.staleMs = opts.staleMs;
     if (opts?.pollIntervalMs !== void 0) presenceOpts.pollIntervalMs = opts.pollIntervalMs;
-    return this.syncStrategy.buildPresence(presenceOpts);
+    return this.strategies.sync.buildPresence(presenceOpts);
   }
   /**
    * Create or update a record. Runs inside the hub's write-queue tracker
@@ -3514,6 +3414,103 @@ var Collection = class {
     return clone;
   }
   /** @internal Untracked put body — call {@link put}, not this. */
+  /**
+   * Decode a prior envelope's CRDT state, or `undefined` when there is no
+   * usable prior: no envelope, a shredded body decrypting to `null`, or a
+   * payload that is not a CRDT state. The `lww-map` and `rga` branches each
+   * carried a copy, byte-identical apart from the cast (#842).
+   */
+  async #decodePriorCrdtState(envelope) {
+    if (!envelope) return void 0;
+    const prevJson = await this.codec.decryptJsonString(envelope);
+    if (prevJson === null) return void 0;
+    const prevParsed = JSON.parse(prevJson);
+    if (prevParsed === null || typeof prevParsed !== "object" || !("_crdt" in prevParsed)) {
+      return void 0;
+    }
+    return prevParsed;
+  }
+  /**
+   * Record a write on the active transaction so a mid-batch failure rolls it
+   * back. Four sites in the derivation/MV dispatch hand-built this literal (#842).
+   */
+  #trackPut(txCtx, collectionName, id, priorEnvelope) {
+    txCtx._executed.push({
+      op: { type: "put", vaultName: this.vault, collectionName, id },
+      priorEnvelope
+    });
+  }
+  /**
+   * Snapshot the PRIOR version into history, emit, and prune.
+   *
+   * Deliberately does NOT carry `source` from the current write — a history
+   * entry describes the version being replaced, not the one replacing it.
+   *
+   * Kept OUT of {@link #commitWriteTail} because the two paths call it at
+   * different points: the normal path snapshots BEFORE `adapter.put` (so a
+   * history failure leaves no write behind), while the CRDT path must merge
+   * and persist first to resolve the prior record at all. Folding it into the
+   * tail would silently reorder one of them (#842).
+   */
+  async #savePriorHistory(id, prior, cek, vdigCtx) {
+    if (this.historyConfig.enabled === false) return;
+    await this.strategies.history.saveHistory(
+      this.adapter,
+      this.vault,
+      this.name,
+      id,
+      await this.codec.encryptRecord(prior.record, prior.version, cek, void 0, void 0, vdigCtx, id)
+    );
+    this.emitter.emit("history:save", { vault: this.vault, collection: this.name, id, version: prior.version });
+    if (this.historyConfig.maxVersions) {
+      await this.strategies.history.pruneHistory(this.adapter, this.vault, this.name, id, { keepVersions: this.historyConfig.maxVersions });
+    }
+  }
+  /**
+   * Everything both write paths do once the envelope is on the adapter:
+   * classified marker, embedding sidecar, ledger append, cache/index
+   * maintenance, and the mutation event that drives derivation dispatch.
+   *
+   * The CRDT branch used to re-implement all of it, and in doing so skipped
+   * `_ensureClassifiedMarker`, the unique-constraint upsert and
+   * `_toCacheableRecord` (#835). All three were unreachable — each blocked by
+   * a config-time refusal on CRDT collections — but only by accident of what
+   * that copy happened to omit. One tail makes the divergence unrepresentable
+   * rather than merely unreachable; on a CRDT collection the extra steps are
+   * provably no-ops (classified/unique + crdt are refused at construction, and
+   * a CRDT body never produces a `_sealed` slot, so `_toCacheableRecord` is
+   * the identity).
+   */
+  async #commitWriteTail(args) {
+    const { id, envelope, version, indexed, event, prior, reason } = args;
+    await this._ensureClassifiedMarker();
+    if (this.embeddings) {
+      await this.strategies.search.embedOnWrite(this.searchContext(), id, indexed, version);
+    }
+    if (this.ledger) {
+      const appendInput = {
+        op: "put",
+        collection: this.name,
+        id,
+        version,
+        actor: this.keyring.userId,
+        payloadHash: await this.strategies.history.envelopePayloadHash(envelope)
+      };
+      if (prior) appendInput.delta = this.strategies.history.computePatch(indexed, prior.record);
+      if (reason !== void 0) appendInput.reason = reason;
+      await this.ledger.append(appendInput);
+    }
+    const cacheable = await this._toCacheableRecord(indexed, envelope, id);
+    if (this.lazy && this.lru) {
+      this.lru.set(id, { record: cacheable, version }, estimateRecordBytes(indexed));
+      await this.maintainPersistedIndexesOnPut(id, indexed, prior ? prior.record : null, version);
+    } else {
+      this.cache.set(id, { record: cacheable, version });
+      this.indexes?.upsert(id, indexed, prior ? prior.record : null);
+      this.uniqueConstraints?.upsert(id, indexed, prior?.record);
+    }
+    await this._onRecordMutated(id, "put", "local-write", { record: event, version });
+  }
   async _putInternal(id, record, options) {
     if (!hasWritePermission(this.keyring, this.name)) {
       throw new ReadOnlyError();
@@ -3562,29 +3559,11 @@ var Collection = class {
       const now = (/* @__PURE__ */ new Date()).toISOString();
       let crdtState;
       if (this.crdtMode === "lww-map") {
-        let existingState;
-        if (existingEnvelope) {
-          const prevJson = await this.codec.decryptJsonString(existingEnvelope);
-          if (prevJson !== null) {
-            const prevParsed = JSON.parse(prevJson);
-            if (prevParsed !== null && typeof prevParsed === "object" && "_crdt" in prevParsed) {
-              existingState = prevParsed;
-            }
-          }
-        }
-        crdtState = this.crdtStrategy.buildLwwMapState(record, existingState, now);
+        const existingState = await this.#decodePriorCrdtState(existingEnvelope);
+        crdtState = this.strategies.crdt.buildLwwMapState(record, existingState, now);
       } else if (this.crdtMode === "rga") {
-        let existingState;
-        if (existingEnvelope) {
-          const prevJson = await this.codec.decryptJsonString(existingEnvelope);
-          if (prevJson !== null) {
-            const prevParsed = JSON.parse(prevJson);
-            if (prevParsed !== null && typeof prevParsed === "object" && "_crdt" in prevParsed) {
-              existingState = prevParsed;
-            }
-          }
-        }
-        crdtState = this.crdtStrategy.buildRgaState(Array.isArray(record) ? record : [record], existingState, generateULID);
+        const existingState = await this.#decodePriorCrdtState(existingEnvelope);
+        crdtState = this.strategies.crdt.buildRgaState(Array.isArray(record) ? record : [record], existingState, generateULID);
       } else {
         crdtState = { _crdt: "yjs", update: record };
       }
@@ -3592,42 +3571,21 @@ var Collection = class {
       const cek2 = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
       const envelope2 = await this.codec.encryptJsonString(JSON.stringify(crdtState), version2, cek2, options?.source, options?.sourceTs);
       await this.adapter.put(this.vault, this.name, id, envelope2);
-      const resolvedRecord = this.crdtStrategy.resolveCrdtSnapshot(crdtState);
+      const resolvedRecord = this.strategies.crdt.resolveCrdtSnapshot(crdtState);
       const existingResolvedRecord = existingEnvelope ? await this.codec.decryptRecord(existingEnvelope, { skipValidation: true }) : null;
       const existingResolved = existingResolvedRecord !== null ? { record: existingResolvedRecord, version: existingVersion } : void 0;
-      if (existingResolved && this.historyConfig.enabled !== false) {
-        await this.historyStrategy.saveHistory(this.adapter, this.vault, this.name, id, await this.codec.encryptRecord(existingResolved.record, existingResolved.version, cek2, void 0, void 0, this.vdigFields !== null ? { id, prev: existingEnvelope } : void 0, id));
-        this.emitter.emit("history:save", { vault: this.vault, collection: this.name, id, version: existingResolved.version });
-        if (this.historyConfig.maxVersions) {
-          await this.historyStrategy.pruneHistory(this.adapter, this.vault, this.name, id, { keepVersions: this.historyConfig.maxVersions });
-        }
+      if (existingResolved) {
+        await this.#savePriorHistory(id, existingResolved, cek2, this.vdigFields !== null ? { id, prev: existingEnvelope } : void 0);
       }
-      if (this.ledger) {
-        const appendInput = {
-          op: "put",
-          collection: this.name,
-          id,
-          version: version2,
-          actor: this.keyring.userId,
-          payloadHash: await this.historyStrategy.envelopePayloadHash(envelope2)
-        };
-        if (existingResolved) appendInput.delta = this.historyStrategy.computePatch(resolvedRecord, existingResolved.record);
-        if (options?.reason !== void 0) appendInput.reason = options.reason;
-        await this.ledger.append(appendInput);
-      }
-      if (this.lazy && this.lru) {
-        this.lru.set(id, { record: resolvedRecord, version: version2 }, estimateRecordBytes(resolvedRecord));
-        await this.maintainPersistedIndexesOnPut(
-          id,
-          resolvedRecord,
-          existingResolved ? existingResolved.record : null,
-          version2
-        );
-      } else {
-        this.cache.set(id, { record: resolvedRecord, version: version2 });
-        this.indexes?.upsert(id, resolvedRecord, existingResolved ? existingResolved.record : null);
-      }
-      await this._onRecordMutated(id, "put", "local-write", { record, version: version2 });
+      await this.#commitWriteTail({
+        id,
+        envelope: envelope2,
+        version: version2,
+        indexed: resolvedRecord,
+        event: record,
+        prior: existingResolved,
+        reason: options?.reason
+      });
       return;
     }
     let existing;
@@ -3657,47 +3615,19 @@ var Collection = class {
     this.uniqueConstraints?.check(id, record);
     const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
     const vdigCtx = this.vdigFields !== null ? { id, prev: await this.adapter.get(this.vault, this.name, id) } : void 0;
-    if (existing && this.historyConfig.enabled !== false) {
-      await this.historyStrategy.saveHistory(this.adapter, this.vault, this.name, id, await this.codec.encryptRecord(existing.record, existing.version, cek, void 0, void 0, vdigCtx, id));
-      this.emitter.emit("history:save", {
-        vault: this.vault,
-        collection: this.name,
-        id,
-        version: existing.version
-      });
-      if (this.historyConfig.maxVersions) await this.historyStrategy.pruneHistory(this.adapter, this.vault, this.name, id, { keepVersions: this.historyConfig.maxVersions });
-    }
+    if (existing) await this.#savePriorHistory(id, existing, cek, vdigCtx);
     const envelope = await this.codec.encryptRecord(record, version, cek, options?.source, options?.sourceTs, vdigCtx, id);
     await this.adapter.put(this.vault, this.name, id, envelope);
     this.markerIds.delete(id);
-    await this._ensureClassifiedMarker();
-    if (this.embeddings) {
-      await this.searchStrategy.embedOnWrite(this.searchContext(), id, record, version);
-    }
-    if (this.ledger) {
-      const appendInput = {
-        op: "put",
-        collection: this.name,
-        id,
-        version,
-        actor: this.keyring.userId,
-        payloadHash: await this.historyStrategy.envelopePayloadHash(envelope)
-      };
-      if (existing) {
-        appendInput.delta = this.historyStrategy.computePatch(record, existing.record);
-      }
-      if (options?.reason !== void 0) appendInput.reason = options.reason;
-      await this.ledger.append(appendInput);
-    }
-    if (this.lazy && this.lru) {
-      this.lru.set(id, { record: await this._toCacheableRecord(record, envelope, id), version }, estimateRecordBytes(record));
-      await this.maintainPersistedIndexesOnPut(id, record, existing ? existing.record : null, version);
-    } else {
-      this.cache.set(id, { record: await this._toCacheableRecord(record, envelope, id), version });
-      this.indexes?.upsert(id, record, existing ? existing.record : null);
-      this.uniqueConstraints?.upsert(id, record, existing?.record);
-    }
-    await this._onRecordMutated(id, "put", "local-write", { record, version });
+    await this.#commitWriteTail({
+      id,
+      envelope,
+      version,
+      indexed: record,
+      event: record,
+      prior: existing,
+      reason: options?.reason
+    });
   }
   /**
    * Fire registered MV strategies whose dependency set includes this
@@ -3714,34 +3644,8 @@ var Collection = class {
    */
   async dispatchMaterializedViews(id, record, wave) {
     if (this.materializedViewSource === void 0) return;
-    const incoming = record;
-    if (incoming && typeof incoming === "object" && "_materializedFrom" in incoming) return;
-    const registry = this.materializedViewSource.registry();
-    const mvs = registry.mvsForSource(this.name);
-    if (mvs.length === 0) return;
-    let executor = null;
-    let staleHelpers = null;
-    for (const reg of mvs) {
-      const mode = reg.spec.refresh;
-      if (mode === "eager") {
-        if (wave?.seen(`mv\0${reg.spec.name}`)) continue;
-        if (executor === null) {
-          ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-UX4FASYZ.js"));
-        }
-        await executor.refresh(reg, {
-          getCollection: (name) => this.materializedViewSource.getCollection(name),
-          getActiveTxContext: () => this.materializedViewSource.getActiveTxContext(),
-          getQueryContext: () => this.materializedViewSource.getQueryContext(),
-          dispatchCtx: this.#dispatchCtx({ collection: this.name, id })
-        });
-      } else if (mode === "lazy") {
-        if (staleHelpers === null) {
-          staleHelpers = await import("./stale-VZL4OGUB.js");
-        }
-        staleHelpers.markMVStale(registry, reg.spec.name);
-      }
-    }
+    const { dispatchMaterializedViews } = await import("./dispatch-EGGC7UD7.js");
+    return dispatchMaterializedViews(this.#mvDispatchCtx(this.materializedViewSource), id, record, wave);
   }
   /**
    * Fire registered derivation strategies for this source collection.
@@ -3829,6 +3733,32 @@ var Collection = class {
     return out;
   }
   /** @internal — ctx for `putDerivedOutput`'s frozen-period skip+audit (#638 Task 5). */
+  /** What `with-formula/materialized-views/dispatch.ts` needs from this collection (#842). */
+  #mvDispatchCtx(materializedViewSource) {
+    return {
+      materializedViewSource,
+      collectionName: this.name,
+      dispatchCtx: (source) => this.#dispatchCtx(source)
+    };
+  }
+  /**
+   * What `with-formula/derivations/dispatch.ts` needs from this collection (#842).
+   *
+   * The return type is inferred, not annotated: importing `DerivationDeleteCtx`
+   * would be a STATIC spine→service import, which `port-layering` rejects even
+   * when it is type-only — the guard scans import statements, not their
+   * erasure. The dynamic `import()` at the call site still types the argument.
+   */
+  #derivationDeleteCtx(derivationSource) {
+    return {
+      derivationSource,
+      collectionName: this.name,
+      adapter: this.adapter,
+      vault: this.vault,
+      getDEK: this.getDEK,
+      storeCiphertext: this.storeCiphertext
+    };
+  }
   #dispatchCtx(source) {
     return { emit: (e, p) => this.emitter.emit(e, p), source, audit: ledgerAuditHook(this.ledger, this.keyring.userId) };
   }
@@ -3854,11 +3784,7 @@ var Collection = class {
     const patched = { ...base, [field]: newValue };
     const txCtx = this.derivationSource.getActiveTxContext();
     if (txCtx !== null) {
-      const prior = await this.adapter.get(this.vault, into, parentId);
-      txCtx._executed.push({
-        op: { type: "put", vaultName: this.vault, collectionName: into, id: parentId },
-        priorEnvelope: prior
-      });
+      this.#trackPut(txCtx, into, parentId, await this.adapter.get(this.vault, into, parentId));
     }
     return putDerivedOutput(intoColl, parentId, patched, this.#dispatchCtx(source));
   }
@@ -3891,150 +3817,14 @@ var Collection = class {
    *  dispatch wave's per-target dedup; `undefined` on the local-write path (byte-identical). */
   async dispatchDerivations(id, record, version, wave) {
     if (this.derivationSource === void 0) return;
-    const incoming = this.via ? this.via.canonicalizeStored(record) : record;
-    if (incoming && typeof incoming === "object" && "_derivedFrom" in incoming) return;
-    const registry = this.derivationSource.registry();
-    const strategies = registry.strategiesForSource(this.name);
-    if (strategies.length === 0) return;
-    let DerivationExecutor = null;
-    for (const { spec, strategyHash } of strategies) {
-      const mode = typeof spec.lifecycle === "string" ? spec.lifecycle : spec.lifecycle.mode;
-      if (spec.rollup) {
-        if (mode !== "eager") continue;
-        let parentId;
-        if (this.name === spec.rollup.from) {
-          const kv = incoming[spec.rollup.key];
-          parentId = typeof kv === "string" || typeof kv === "number" ? String(kv) : null;
-        } else {
-          parentId = id;
-        }
-        if (parentId !== null) await this.recomputeRollup(spec, parentId, { collection: this.name, id }, wave);
-        continue;
-      }
-      const isSource = spec.source === this.name;
-      const isSibling = !isSource && (spec.sources?.includes(this.name) ?? false);
-      const trigger = !isSource && !isSibling ? spec.triggerBy?.find((t) => t.collection === this.name) : void 0;
-      const runs = [];
-      if (isSource) {
-        runs.push({ input: { ...incoming, id }, base: incoming, runId: id, version });
-      } else if (isSibling) {
-        const p = await this.derivationSource.getCollection(spec.source).get(id);
-        if (p !== null && p !== void 0) {
-          const raw = await this.derivationSource.getCollection(spec.source)._getStoredRecord(id);
-          runs.push({ input: { ...p, id }, base: raw ?? p, runId: id, version: 0 });
-        }
-      } else if (trigger) {
-        const srcColl = this.derivationSource.getCollection(spec.source);
-        const ids = await srcColl._findMatchingIds(trigger.on, id);
-        if (trigger.maxFanout !== void 0 && ids.length > trigger.maxFanout) {
-          throw new DerivationCapExceededError(`triggerBy ${this.name}\u2192${spec.source}`, ids.length, trigger.maxFanout);
-        }
-        for (const sid of ids) {
-          const raw = await srcColl._getStoredRecord(sid);
-          if (raw === null) continue;
-          runs.push({ input: { ...raw, id: sid }, base: raw, runId: sid, version: 0 });
-        }
-      }
-      if (runs.length === 0) continue;
-      if (mode !== "eager") {
-        for (const run of runs) await markStale(registry, spec, run.runId);
-        continue;
-      }
-      if (DerivationExecutor === null) {
-        ({ DerivationExecutor } = await import("./executor-XGIS6CR7.js"));
-      }
-      for (const run of runs) {
-        const ctx = { vault: this.derivationSource.getReadOnlyFacade() };
-        const outCtx = this.#dispatchCtx({ collection: spec.source, id: run.runId });
-        const result = await DerivationExecutor.run(spec, run.input, run.version, strategyHash, ctx);
-        for (const key of Object.keys(spec.outputs)) {
-          const out = result.outputs[key];
-          if (!out) continue;
-          if (out.kind === "failed") {
-            const err = out.error;
-            if (spec.strict) throw err;
-            console.warn(`[derivation] output "${key}" for source "${spec.source}" id="${run.runId}" failed:`, err);
-            continue;
-          }
-          const outSpec = spec.outputs[key];
-          if (!outSpec) continue;
-          const outputCollection = this.derivationSource.getCollection(outSpec.collection);
-          const txCtx = this.derivationSource.getActiveTxContext();
-          if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-B5LVUMQX.js");
-            const prior = await loadFanoutSidecar(this.adapter, this.vault, spec.source, run.runId, key, this.getDEK, this.storeCiphertext);
-            const prevKeys = new Set(prior?.keys ?? []);
-            const newKeysList = out.entries.map((e) => e.key);
-            const newKeysSet = new Set(newKeysList);
-            for (const k of prevKeys) {
-              if (newKeysSet.has(k)) continue;
-              await outputCollection._internalDelete(k, txCtx);
-            }
-            for (const entry of out.entries) {
-              if (txCtx !== null) {
-                const priorEnvelope = await this.adapter.get(this.vault, outSpec.collection, entry.key);
-                txCtx._executed.push({
-                  op: {
-                    type: "put",
-                    vaultName: this.vault,
-                    collectionName: outSpec.collection,
-                    id: entry.key
-                  },
-                  priorEnvelope
-                });
-              }
-              await putDerivedOutput(outputCollection, entry.key, entry.value, outCtx, { source: "derived" });
-            }
-            await saveFanoutSidecar(this.adapter, this.vault, {
-              source: spec.source,
-              sourceId: run.runId,
-              outputKey: key,
-              outputCollection: outSpec.collection,
-              keys: newKeysList
-            }, this.getDEK, this.storeCiphertext);
-            continue;
-          }
-          if (out.skipped === true) {
-            await outputCollection._internalDelete(run.runId, txCtx);
-            continue;
-          }
-          if (outSpec.shape === "record" && outSpec.denorm !== void 0 && outSpec.collection === spec.source) {
-            const value = out.value;
-            const patched = { ...run.base };
-            let changed = false;
-            for (const f of outSpec.denorm) {
-              if (!selfWriteFieldEqual(run.base[f], value[f])) {
-                patched[f] = value[f];
-                changed = true;
-              }
-            }
-            if (!changed) continue;
-            if (txCtx !== null) {
-              const prior = await this.adapter.get(this.vault, outSpec.collection, run.runId);
-              txCtx._executed.push({
-                op: { type: "put", vaultName: this.vault, collectionName: outSpec.collection, id: run.runId },
-                priorEnvelope: prior
-              });
-            }
-            await putDerivedOutput(outputCollection, run.runId, patched, outCtx, { source: "derived" });
-            continue;
-          }
-          if (txCtx !== null) {
-            const prior = await this.adapter.get(this.vault, outSpec.collection, run.runId);
-            txCtx._executed.push({
-              op: {
-                type: "put",
-                vaultName: this.vault,
-                collectionName: outSpec.collection,
-                id: run.runId
-              },
-              priorEnvelope: prior
-            });
-          }
-          await putDerivedOutput(outputCollection, run.runId, out.value, outCtx, { source: "derived" });
-        }
-      }
-    }
+    const { dispatchDerivations } = await import("./dispatch-GDSTUTVP.js");
+    return dispatchDerivations({
+      ...this.#derivationDeleteCtx(this.derivationSource),
+      via: this.via,
+      recomputeRollup: (spec, parentId, source, w) => this.recomputeRollup(spec, parentId, source, w),
+      dispatchCtx: (source) => this.#dispatchCtx(source),
+      trackPut: (txCtx, collectionName, rid, prior) => this.#trackPut(txCtx, collectionName, rid, prior)
+    }, id, record, version, wave);
   }
   /**
    * Delete a record by ID. Runs inside the hub's write-queue tracker
@@ -4203,10 +3993,10 @@ var Collection = class {
     if (existing && this.historyConfig.enabled !== false) {
       const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
       const prevForVdig = this.vdigFields !== null ? await this.adapter.get(this.vault, this.name, id) : null;
-      await this.historyStrategy.saveHistory(this.adapter, this.vault, this.name, id, await this.codec.encryptRecord(existing.record, existing.version, cek, void 0, void 0, this.vdigFields !== null ? { id, prev: prevForVdig } : void 0, id));
+      await this.strategies.history.saveHistory(this.adapter, this.vault, this.name, id, await this.codec.encryptRecord(existing.record, existing.version, cek, void 0, void 0, this.vdigFields !== null ? { id, prev: prevForVdig } : void 0, id));
     }
     const previousEnvelope = await this.adapter.get(this.vault, this.name, id);
-    const previousPayloadHash = await this.historyStrategy.envelopePayloadHash(previousEnvelope);
+    const previousPayloadHash = await this.strategies.history.envelopePayloadHash(previousEnvelope);
     let markerVersion;
     if (this.onDirty) {
       const live = previousEnvelope;
@@ -4304,33 +4094,8 @@ var Collection = class {
    */
   async dispatchArrayDerivationsOnDelete(id, eraseRecordShapeToo = false) {
     if (this.derivationSource === void 0) return 0;
-    const registry = this.derivationSource.registry();
-    const strategies = registry.strategiesForSource(this.name);
-    if (strategies.length === 0) return 0;
-    let helpers = null;
-    const txCtx = this.derivationSource.getActiveTxContext();
-    let erased = 0;
-    for (const { spec } of strategies) {
-      for (const [outputKey, outSpec] of Object.entries(spec.outputs)) {
-        if (outSpec.shape === "record") {
-          if (eraseRecordShapeToo && spec.source === this.name && outSpec.collection !== this.name) {
-            if (await this.derivationSource.getCollection(outSpec.collection)._internalDelete(id, txCtx)) erased += 1;
-          }
-          continue;
-        }
-        if (helpers === null) {
-          helpers = await import("./fanout-sidecar-B5LVUMQX.js");
-        }
-        const sidecar = await helpers.loadFanoutSidecar(this.adapter, this.vault, spec.source, id, outputKey, this.getDEK, this.storeCiphertext);
-        if (!sidecar) continue;
-        const outputCollection = this.derivationSource.getCollection(outSpec.collection);
-        for (const derivedId of sidecar.keys) {
-          if (await outputCollection._internalDelete(derivedId, txCtx)) erased += 1;
-        }
-        await helpers.deleteFanoutSidecar(this.adapter, this.vault, spec.source, id, outputKey);
-      }
-    }
-    return erased;
+    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-GDSTUTVP.js");
+    return dispatchArrayDerivationsOnDelete(this.#derivationDeleteCtx(this.derivationSource), id, eraseRecordShapeToo);
   }
   /**
    * Mirror of {@link dispatchMaterializedViews} for the delete/forget path — no `_materializedFrom`
@@ -4343,41 +4108,8 @@ var Collection = class {
    */
   async dispatchMaterializedViewsOnDelete(id) {
     if (this.materializedViewSource === void 0) return { deleted: 0, residueUndecodable: [], residueDeclined: [] };
-    const registry = this.materializedViewSource.registry();
-    const mvs = registry.mvsForSource(this.name);
-    if (mvs.length === 0) return { deleted: 0, residueUndecodable: [], residueDeclined: [] };
-    let executor = null;
-    let staleHelpers = null;
-    let deleted = 0;
-    const residueUndecodable = [];
-    const residueDeclined = [];
-    for (const reg of mvs) {
-      const mode = reg.spec.refresh;
-      if (mode === "eager") {
-        if (executor === null) {
-          ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-UX4FASYZ.js"));
-        }
-        const rr = await executor.refresh(reg, {
-          getCollection: (name) => this.materializedViewSource.getCollection(name),
-          getActiveTxContext: () => this.materializedViewSource.getActiveTxContext(),
-          getQueryContext: () => this.materializedViewSource.getQueryContext(),
-          dispatchCtx: this.#dispatchCtx({ collection: this.name, id })
-        });
-        deleted += rr.deleted;
-        residueUndecodable.push(...rr.residueUndecodable);
-        residueDeclined.push(...rr.residueDeclined);
-      } else {
-        if (staleHelpers === null) {
-          staleHelpers = await import("./stale-VZL4OGUB.js");
-        }
-        const inv = await staleHelpers.invalidateMVAtRest(this.materializedViewSource, reg, mode);
-        deleted += inv.deleted;
-        residueUndecodable.push(...inv.residueUndecodable.map((rid) => `${reg.outputCollection}:${rid}`));
-        residueDeclined.push(...inv.residueDeclined.map((rid) => `${reg.outputCollection}:${rid}`));
-      }
-    }
-    return { deleted, residueUndecodable, residueDeclined };
+    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-EGGC7UD7.js");
+    return dispatchMaterializedViewsOnDelete(this.#mvDispatchCtx(this.materializedViewSource), id);
   }
   /**
    * List all records in the collection.
@@ -4396,7 +4128,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-VZL4OGUB.js");
+      const { resolveStaleMVOnRead } = await import("./stale-A4J26OIC.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     await this.ensureHydrated();
@@ -4417,28 +4149,28 @@ var Collection = class {
    * see `src/search/tokenize.ts` for the Thai/CJK caveat.
    */
   search(field, query, opts = {}) {
-    return this.searchStrategy.search(this.searchContext(), field, query, opts);
+    return this.strategies.search.search(this.searchContext(), field, query, opts);
   }
   /** Force-persist the lexical index now — gated behind `searchStrategy: withSearch()`. */
   flushIndex() {
-    return this.searchStrategy.flushIndex(this.searchContext());
+    return this.strategies.search.flushIndex(this.searchContext());
   }
   /** Pre-build the lexical index — gated behind `searchStrategy: withSearch()`. */
   warmIndex() {
-    return this.searchStrategy.warmIndex(this.searchContext());
+    return this.strategies.search.warmIndex(this.searchContext());
   }
   /** Retrieval (lexical | semantic | hybrid) — gated behind `searchStrategy: withSearch()`. */
   retrieve(query, opts = {}) {
-    return this.searchStrategy.retrieve(this.searchContext(), query, opts);
+    return this.strategies.search.retrieve(this.searchContext(), query, opts);
   }
   /** Raw-vector kNN — gated behind `searchStrategy: withSearch()`. */
   similarTo(vector, opts = {}) {
-    return this.searchStrategy.similarTo(this.searchContext(), vector, opts);
+    return this.strategies.search.similarTo(this.searchContext(), vector, opts);
   }
   /** Opt-in bulk `_vec` re-derive (#788) — a plain collection has nothing to rebuild; gated behind `searchStrategy: withSearch()` otherwise. */
   rebuildEmbeddings() {
     if (!this.embeddings) return Promise.resolve({ rebuilt: 0, skipped: 0 });
-    return this.searchStrategy.rebuildEmbeddings(this.searchContext());
+    return this.strategies.search.rebuildEmbeddings(this.searchContext());
   }
   /**
    * Bind the {@link SearchContext} the search/retrieval surface needs. The
@@ -4648,7 +4380,7 @@ var Collection = class {
       ...this.defaultLocale !== void 0 ? { defaultLocale: this.defaultLocale } : {},
       ...resolver.resolveDictSource ? { resolveDictSource: (field) => resolver.resolveDictSource(leftCollection, field) } : {}
     } : void 0;
-    return new Query(source, void 0, joinContext, this.aggregateStrategy);
+    return new Query(source, void 0, joinContext, this.strategies.reduce);
   }
   /**
    * Subscribe to every put/delete on this collection. Returns an
@@ -4762,7 +4494,7 @@ var Collection = class {
   // ─── History Methods ────────────────────────────────────────────
   /** Get version history for a record, newest first. */
   async history(id, options) {
-    const envelopes = await this.historyStrategy.getHistoryEntries(
+    const envelopes = await this.strategies.history.getHistoryEntries(
       this.adapter,
       this.vault,
       this.name,
@@ -4794,7 +4526,7 @@ var Collection = class {
    * and re-put the records through the normal `put()` path.
    */
   async getVersion(id, version) {
-    const envelope = await this.historyStrategy.getVersionEnvelope(
+    const envelope = await this.strategies.history.getVersionEnvelope(
       this.adapter,
       this.vault,
       this.name,
@@ -4819,7 +4551,7 @@ var Collection = class {
    */
   async diff(id, versionA, versionB) {
     const recordA = versionA === 0 ? null : await this.resolveVersion(id, versionA);
-    return this.historyStrategy.diff(recordA, versionB === void 0 || versionB === 0 ? versionB === 0 ? null : await this.resolveCurrentOrVersion(id) : await this.resolveVersion(id, versionB));
+    return this.strategies.history.diff(recordA, versionB === void 0 || versionB === 0 ? versionB === 0 ? null : await this.resolveCurrentOrVersion(id) : await this.resolveVersion(id, versionB));
   }
   /** Resolve a version: try history first, then check if it's the current version. */
   async resolveVersion(id, version) {
@@ -4836,7 +4568,7 @@ var Collection = class {
   }
   /** Prune history entries for a record (or all records if id is undefined). */
   async pruneRecordHistory(id, options) {
-    const pruned = await this.historyStrategy.pruneHistory(
+    const pruned = await this.strategies.history.pruneHistory(
       this.adapter,
       this.vault,
       this.name,
@@ -4855,7 +4587,7 @@ var Collection = class {
   }
   /** Clear all history for this collection (or a specific record). */
   async clearHistory(id) {
-    return this.historyStrategy.clearHistory(this.adapter, this.vault, this.name, id);
+    return this.strategies.history.clearHistory(this.adapter, this.vault, this.name, id);
   }
   // ─── Core Methods ─────────────────────────────────────────────
   /**
@@ -5277,7 +5009,7 @@ var Collection = class {
    * vault-shared `_blob` DEK (enabling cross-collection deduplication).
    */
   blob(id) {
-    return this.blobStrategy.openSlot({
+    return this.strategies.blobs.openSlot({
       store: this.adapter,
       vault: this.vault,
       collection: this.name,
@@ -5510,7 +5242,7 @@ var Collection = class {
     const persisted = this.persistedIndexes;
     if (!persisted) {
       throw new Error(
-        `Collection "${this.name}": lazyQuery() requires indexing to be enabled. Pass \`withIndexing()\` from "@noy-db/hub/indexing" to \`createNoydb({ indexStrategy: withIndexing() })\`.`
+        `Collection "${this.name}": lazyQuery() requires indexing to be enabled. Pass \`withIndexing()\` from "@noy-db/hub/indexing" to \`createNoydb({ indexingStrategy: withIndexing() })\`.`
       );
     }
     if (persisted.fields().length === 0) {
@@ -5549,14 +5281,14 @@ var Collection = class {
   /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
   async _ensureClassifiedMarker() {
     if (this._markerPersisted || this.vdigFields === null) return;
-    const { persistClassifiedMarkerForFields } = await import("./classified-marker-QWMASIT7.js");
+    const { persistClassifiedMarkerForFields } = await import("./classified-marker-7PKJBFCG.js");
     await persistClassifiedMarkerForFields(this.adapter, this.vault, this.name, this.vdigFields, await this.getDEK(this.name));
     this._markerPersisted = true;
   }
   /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
   async _classifiedMarkerDigestOnly() {
     if (this._markerDigestOnlyCache !== void 0) return this._markerDigestOnlyCache;
-    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-QWMASIT7.js");
+    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-7PKJBFCG.js");
     this._markerDigestOnlyCache = await readClassifiedMarkerDigestOnly(this.adapter, this.vault, this.name, await this.getDEK(this.name));
     return this._markerDigestOnlyCache;
   }
@@ -5598,23 +5330,23 @@ var Collection = class {
   // ─── Hierarchical Access ──────────────────────────
   /** tier-aware put — gated behind `tiersStrategy: withTiers()`. `searchResidue: true` = stuck search compensation (#774, mirroring #764's elevate/demote posture); the write itself always completes. */
   putAtTier(id, record, tier, opts) {
-    return this.tiersStrategy.putAtTier(this.tiersContext(), id, record, tier, opts);
+    return this.strategies.tiers.putAtTier(this.tiersContext(), id, record, tier, opts);
   }
   /** tier-aware get — gated behind `tiersStrategy: withTiers()`. */
   getAtTier(id) {
-    return this.tiersStrategy.getAtTier(this.tiersContext(), id);
+    return this.strategies.tiers.getAtTier(this.tiersContext(), id);
   }
   /** list ids grouped by the caller's readability — gated behind `withTiers()`. */
   listAtTier() {
-    return this.tiersStrategy.listAtTier(this.tiersContext());
+    return this.strategies.tiers.listAtTier(this.tiersContext());
   }
   /** elevate a record to a higher tier — gated behind `withTiers()`. `searchResidue: true` = stuck search compensation (#764); the move itself always completes. */
   elevate(id, toTier) {
-    return this.tiersStrategy.elevate(this.tiersContext(), id, toTier);
+    return this.strategies.tiers.elevate(this.tiersContext(), id, toTier);
   }
   /** demote a record to a lower tier — gated behind `withTiers()`. Same `searchResidue` posture as {@link elevate} (#764). */
   demote(id, toTier) {
-    return this.tiersStrategy.demote(this.tiersContext(), id, toTier);
+    return this.strategies.tiers.demote(this.tiersContext(), id, toTier);
   }
   /**
    * Emit a cross-tier access event. The subscriber sink stays collection-resident (it captures `onCrossTierAccess`); the tiers module reaches it via the {@link TiersContext.emitCrossTierEvent} callback.
@@ -5675,16 +5407,16 @@ var Collection = class {
       },
       syncIndexes: (id, rec, version, priorEnvelope) => syncTierIndexes(this.indexingContext(), id, rec, version, priorEnvelope),
       syncSearch: (id, rec, version) => syncTierSearch(this.searchContext(), id, rec, version),
-      syncHistory: async (id, fromDek, toDek) => this.historyStrategy.rewrapHistory(this.adapter, this.vault, this.name, id, fromDek, toDek, await this.getDEK(this.name)),
+      syncHistory: async (id, fromDek, toDek) => this.strategies.history.rewrapHistory(this.adapter, this.vault, this.name, id, fromDek, toDek, await this.getDEK(this.name)),
       saveHistorySnapshot: async (id, envelope) => {
         if (this.historyConfig.enabled === false) return;
-        await this.historyStrategy.saveHistory(this.adapter, this.vault, this.name, id, envelope);
+        await this.strategies.history.saveHistory(this.adapter, this.vault, this.name, id, envelope);
         this.emitter.emit("history:save", { vault: this.vault, collection: this.name, id, version: envelope._v });
-        if (this.historyConfig.maxVersions) await this.historyStrategy.pruneHistory(this.adapter, this.vault, this.name, id, { keepVersions: this.historyConfig.maxVersions });
+        if (this.historyConfig.maxVersions) await this.strategies.history.pruneHistory(this.adapter, this.vault, this.name, id, { keepVersions: this.historyConfig.maxVersions });
       },
-      historyEnabled: this.historyConfig.enabled !== false && this.historyStrategy !== NO_HISTORY,
+      historyEnabled: this.historyConfig.enabled !== false && this.strategies.history !== NO_HISTORY,
       // #728/#737: lets putAtTier skip decrypting `existing` when no real history strategy is wired
-      syncBlobs: (id, fromTier, toTier) => this.blobStrategy !== NO_BLOBS ? this.blob(id).syncTierMove(fromTier, toTier, this.blobTierPolicy) : Promise.resolve(),
+      syncBlobs: (id, fromTier, toTier) => this.strategies.blobs !== NO_BLOBS ? this.blob(id).syncTierMove(fromTier, toTier, this.blobTierPolicy) : Promise.resolve(),
       // #724 I1: gate on blob storage enabled (not on declared blobFields) so undeclared-field blobs still rehome; #746: syncTierMove mints/resumes the rehome journal marker; self-no-ops on an empty slot map
       syncLedger: async (id) => {
         await this.ledger?.purgeRecordDeltas(this.name, id);
@@ -5727,6 +5459,64 @@ var Collection = class {
   }
 };
 
+// src/port/with/capabilities.ts
+function assertCanExport(keyring, tier, format) {
+  if (tier === "plaintext") {
+    if (format === void 0) {
+      throw new Error("vault.assertCanExport: plaintext tier requires a format");
+    }
+    if (!hasExportCapability(keyring, "plaintext", format)) {
+      throw new ExportCapabilityError({
+        tier: "plaintext",
+        userId: keyring.userId,
+        format
+      });
+    }
+    return;
+  }
+  if (!hasExportCapability(keyring, "bundle")) {
+    throw new ExportCapabilityError({
+      tier: "bundle",
+      userId: keyring.userId
+    });
+  }
+}
+function assertCanImport(keyring, tier, format) {
+  if (tier === "plaintext") {
+    if (format === void 0) {
+      throw new Error("vault.assertCanImport: plaintext tier requires a format");
+    }
+    if (!hasImportCapability(keyring, "plaintext", format)) {
+      throw new ImportCapabilityError({
+        tier: "plaintext",
+        userId: keyring.userId,
+        format
+      });
+    }
+    return;
+  }
+  if (!hasImportCapability(keyring, "bundle")) {
+    throw new ImportCapabilityError({
+      tier: "bundle",
+      userId: keyring.userId
+    });
+  }
+}
+function canExport(keyring, tier, format) {
+  if (tier === "plaintext") {
+    if (format === void 0) return false;
+    return hasExportCapability(keyring, "plaintext", format);
+  }
+  return hasExportCapability(keyring, "bundle");
+}
+function canImport(keyring, tier, format) {
+  if (tier === "plaintext") {
+    if (format === void 0) return false;
+    return hasImportCapability(keyring, "plaintext", format);
+  }
+  return hasImportCapability(keyring, "bundle");
+}
+
 // src/with-commit/tx/elevated-handle.ts
 var ELEVATION_AUDIT_COLLECTION = "_elevation_audit";
 var ElevatedHandle = class {
@@ -6008,47 +5798,7 @@ var DeferredNumberingStore = class {
         this.waiters.delete(id);
       }
     }
-    return assignments;
-  }
-};
-
-// src/with-fork/shadow/strategy.ts
-var NOT_ENABLED2 = new Error(
-  'VaultFrame requires the shadow strategy. Import `{ withShadow }` from "@noy-db/hub/shadow" and pass it to `createNoydb({ shadowStrategy: withShadow() })`.'
-);
-var NO_SHADOW = {
-  buildFrame() {
-    throw NOT_ENABLED2;
-  }
-};
-
-// src/with-audit/consent/strategy.ts
-var NO_CONSENT = {
-  async write() {
-  },
-  async read() {
-    return [];
-  }
-};
-
-// src/with-audit/periods/strategy.ts
-var NOT_ENABLED3 = new Error(
-  'Accounting periods require the periods strategy. Import `{ withPeriods }` from "@noy-db/hub/periods" and pass it to `createNoydb({ periodsStrategy: withPeriods() })`.'
-);
-var NO_PERIODS = {
-  async loadPeriods() {
-    return [];
-  },
-  async chainAnchor() {
-    return { priorPeriodHash: "" };
-  },
-  assertTsWritable() {
-  },
-  validatePeriodName() {
-    throw NOT_ENABLED3;
-  },
-  async appendPeriodLedgerEntry() {
-    throw NOT_ENABLED3;
+    return assignments;
   }
 };
 
@@ -6298,6 +6048,7 @@ var VaultPeriods = class {
   }
   /** Return every closed / opened period in `closedAt` order, merged with any freeze + archive companions. */
   async listPeriods() {
+    this.periodCache = null;
     const all = await this.loadPeriodsCache();
     const freezeIds = await this.deps.adapter.list(this.deps.vault, PERIOD_FREEZES_COLLECTION);
     const freezes = /* @__PURE__ */ new Map();
@@ -6389,6 +6140,9 @@ var VaultPeriods = class {
       };
     }
     await this.deps.adapter.put(this.deps.vault, collection, key, envelope);
+    if (collection === PERIODS_COLLECTION && this.deps.onDirty) {
+      await this.deps.onDirty(collection, key, "put", envelope._v);
+    }
     return envelope;
   }
   /** Generic reserved-collection reader — serves `_period_freezes` companion reads. */
@@ -6977,7 +6731,7 @@ var VaultLinks = class {
 // src/with-shape/links/lazy-handle.ts
 function makeLazyLinkSetHandle(d) {
   let engine = null;
-  const load = () => engine ??= import("./link-set-SLJHDNRB.js").then(
+  const load = () => engine ??= import("./link-set-NK6L2A5S.js").then(
     ({ LinkSet }) => new LinkSet(d.adapter, d.vault, d.name, d.spec, d.encrypted, d.getDEK, d.actor, d.emitter, d.endpointExists)
   );
   return {
@@ -7460,7 +7214,7 @@ var SatelliteRegistry = class {
     if (reason !== void 0) throw new SatelliteConfigError(reason);
   }
   /** Per-base async mutex: chains sections on a stored promise tail. */
-  async withPairLock(base, fn2) {
+  async withPairLock(base, fn) {
     const tail = this.locks.get(base) ?? Promise.resolve();
     let release;
     const gate = new Promise((res) => {
@@ -7469,7 +7223,7 @@ var SatelliteRegistry = class {
     this.locks.set(base, tail.then(() => gate));
     await tail;
     try {
-      return await fn2();
+      return await fn();
     } finally {
       release();
     }
@@ -7515,7 +7269,7 @@ function declareSatellite(ctx, collectionName, options, existingRegistry) {
   ctx.forEachSyncEngine((e) => e.remirrorPairResolvers([spec.base, spec.satellite]));
   const registry = reg;
   const baseSchema = ctx.getBaseSchema(spec.base);
-  void import("./post-register-2YHSADFI.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
+  void import("./post-register-VFIYISUK.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
   });
   return reg;
 }
@@ -7846,20 +7600,6 @@ async function migrateSatelliteCek(name, coll) {
   return { migrated };
 }
 
-// src/with-shape/schema-update/gate.ts
-var SchemaUpdateGate = class {
-  #decision;
-  constructor(decision) {
-    this.#decision = decision.catch(() => null);
-  }
-  async assertWritable() {
-    const decision = await this.#decision;
-    if (decision && decision.action === "reject") {
-      throw decision.error;
-    }
-  }
-};
-
 // src/with-shape/schema-update/fence-controller.ts
 var SchemaFenceController = class {
   #coordination;
@@ -8032,6 +7772,43 @@ var VaultAttestation = class {
 };
 
 // src/kernel/vault.ts
+var COLLECTION_PASSTHROUGH_KEYS = [
+  "indexes",
+  "reconcileOnOpen",
+  "prefetch",
+  "cache",
+  "schema",
+  "conflictPolicy",
+  "crdt",
+  "deterministicFields",
+  "acknowledgeDeterministicRisk",
+  "acknowledgeEquatableRisk",
+  "sensitive",
+  "perRecordKeys",
+  "provenance",
+  "ramCiphertext",
+  "tiers",
+  "tierMode",
+  "blobTierPolicy",
+  "i18nFields",
+  "embeddings",
+  "textIndexes",
+  "warmIndexOnOpen",
+  "textIndexPersist",
+  "moneyFields",
+  "viaFields",
+  "computed",
+  "classifiedFields",
+  "fieldMeta",
+  "meta"
+];
+function copyDefined(dst, src, keys) {
+  if (src === void 0) return;
+  for (const key of keys) {
+    const value = src[key];
+    if (value !== void 0) dst[key] = value;
+  }
+}
 var Vault = class {
   adapter;
   /** The vault's name as passed to `openVault()`. Stable for the instance lifetime. */
@@ -8049,36 +7826,22 @@ var Vault = class {
   syncAdapter;
   getPurgeableTargets;
   historyConfig;
-  /** tree-shake seam for the optional blob service; `undefined` means "blobs are off for this
-   *  vault" — every `collection.blob(id)` call throws with a pointer at `@noy-db/hub/blobs`. */
-  blobStrategy;
+  /**
+   * Every opt-in service, resolved once by `createNoydb` (#838). Shared by
+   * reference with the owning `Noydb` and with every `Collection` this vault
+   * opens, so all three always agree about which services are enabled.
+   */
+  strategies;
   objectStore;
-  /** Cold-storage archival strategy (the archive target store). */
-  archiveStrategy;
   /** Per-collection record archival policies. Indexed by collection name. */
   archiveRegistry = /* @__PURE__ */ new Map();
-  indexStrategy;
-  lazyStrategy;
-  aggregateStrategy;
-  crdtStrategy;
-  tiersStrategy;
-  searchStrategy;
-  /** Cargo (partition extraction) strategy — `NO_CARGO` (throwing) unless `withCargo()` was passed.
-   *  Public so the `extractPartition` free function (which takes a `Vault`) routes through it. */
-  cargoStrategy;
-  brokerStrategy;
-  sealedRecordStrategy;
-  portabilityStrategy;
-  sequenceStrategy;
-  consentStrategy;
   periods;
   linksEnforcer;
-  shadowStrategy;
-  historyStrategy;
-  forgetStrategy;
-  i18nStrategy;
-  syncStrategy;
-  classifiedStrategy;
+  /** Cargo (partition extraction) strategy — `NO_CARGO` (throwing) unless `withCargo()` was passed.
+   *  Public so the `extractPartition` free function (which takes a `Vault`) routes through it. */
+  get cargoStrategy() {
+    return this.strategies.cargo;
+  }
   /** Per-vault guard registry; `null` until `_initGuards()` runs (or for vaults that never register
    *  one) — the runtime class is dynamic-imported on demand to keep it out of the floor bundle. */
   guardRegistry = null;
@@ -8127,7 +7890,7 @@ var Vault = class {
    * @see docs/superpowers/specs/2026-06-17-fr6-deed-custodian-liberate-design.md
    */
   custody;
-  /** Re-derives an UnlockedKeyring from the adapter using the active user's passphrase; called by
+  /** Re-derives an UnlockedKeyring from the adapter using the active user's secret; called by
    *  `load()` after the on-disk keyring file has been replaced. Provided by Noydb at openVault()
    *  time; `undefined` in tests that construct Vault directly (load() then skips the refresh). */
   reloadKeyring;
@@ -8260,23 +8023,10 @@ var Vault = class {
     this.onRegisterConflictResolver = opts.onRegisterConflictResolver;
     this.syncAdapter = opts.syncAdapter;
     this.getPurgeableTargets = opts.getPurgeableTargets ?? (() => []);
-    this.blobStrategy = opts.blobStrategy;
+    this.strategies = opts.strategies;
     this.objectStore = opts.objectStore;
-    this.archiveStrategy = opts.archiveStrategy;
-    this.indexStrategy = opts.indexStrategy;
-    this.lazyStrategy = opts.lazyStrategy;
-    this.aggregateStrategy = opts.aggregateStrategy;
-    this.crdtStrategy = opts.crdtStrategy;
-    this.tiersStrategy = opts.tiersStrategy;
-    this.searchStrategy = opts.searchStrategy;
-    this.cargoStrategy = opts.cargoStrategy ?? NO_CARGO;
-    this.brokerStrategy = opts.brokerStrategy ?? NO_BROKER;
-    this.sealedRecordStrategy = opts.sealedRecordStrategy ?? NO_SEALED_RECORD;
-    this.portabilityStrategy = opts.portabilityStrategy ?? NO_PORTABILITY;
-    this.sequenceStrategy = opts.sequenceStrategy ?? NO_SEQUENCE;
-    this.consentStrategy = opts.consentStrategy ?? NO_CONSENT;
     this.periods = new VaultPeriods({
-      strategy: opts.periodsStrategy ?? NO_PERIODS,
+      strategy: this.strategies.periods,
       adapter: this.adapter,
       vault: this.name,
       encrypted: this.encrypted,
@@ -8286,7 +8036,9 @@ var Vault = class {
       collection: (name) => this.collection(name),
       purgeDeleteMarkers: (before) => this._purgeDeleteMarkers(before),
       archiveRecords: (before) => this._archiveClosedPeriod(before),
-      purgeTargets: (before) => this._purgePeriodTargets(before)
+      purgeTargets: (before) => this._purgePeriodTargets(before),
+      // #822: push symmetry for the period summaries — see writeReserved.
+      onDirty: this.onDirty
     });
     this.linksEnforcer = new VaultLinks({
       refRegistry: this.refRegistry,
@@ -8299,12 +8051,6 @@ var Vault = class {
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       emitter: this.emitter
     });
-    this.shadowStrategy = opts.shadowStrategy ?? NO_SHADOW;
-    this.historyStrategy = opts.historyStrategy ?? NO_HISTORY;
-    this.forgetStrategy = opts.forgetStrategy ?? NO_FORGET;
-    this.i18nStrategy = opts.i18nStrategy ?? NO_I18N;
-    this.syncStrategy = opts.syncStrategy ?? NO_SYNC;
-    this.classifiedStrategy = opts.classifiedStrategy ?? NO_CLASSIFIED;
     this.graph = new ViaGraph();
     void opts.guardStrategies;
     this.historyConfig = opts.historyConfig ?? { enabled: true };
@@ -8319,19 +8065,19 @@ var Vault = class {
       getDEK: (collection) => this.getDEK(collection),
       role: () => this.keyring.role,
       getRawRecord: async (collection, recId) => await this.collection(collection).get(recId, { locale: "raw" })
-    }, opts.attestationStrategy ?? NO_ATTESTATION);
+    }, this.strategies.attestation);
     this.user = this.noydb.userApiFactory({
       adapter: this.adapter,
       vaultName: this.name,
       writerKeyringId: this.keyring.userId,
       getDek: () => this.getDEK(USER_ENVELOPE_COLLECTION),
       checkGate: (gate, presented) => this.noydb.checkGate(this.name, gate, presented),
-      exportAccessible: (opts2) => this.portabilityStrategy.exportAccessibleData(this, opts2),
-      unilateralWithdraw: (opts2) => this.portabilityStrategy.withdrawAccessibleData(this, opts2),
-      requestWithdraw: (opts2) => this.portabilityStrategy.requestWithdrawal(this, opts2),
-      listWithdrawals: (opts2) => this.portabilityStrategy.listWithdrawalRequests(this, opts2),
-      approveWithdraw: (requestId, opts2) => this.portabilityStrategy.approveWithdrawal(this, requestId, opts2),
-      rejectWithdraw: (requestId, opts2) => this.portabilityStrategy.rejectWithdrawal(this, requestId, opts2)
+      exportAccessible: (opts2) => this.strategies.portability.exportAccessibleData(this, opts2),
+      unilateralWithdraw: (opts2) => this.strategies.portability.withdrawAccessibleData(this, opts2),
+      requestWithdraw: (opts2) => this.strategies.portability.requestWithdrawal(this, opts2),
+      listWithdrawals: (opts2) => this.strategies.portability.listWithdrawalRequests(this, opts2),
+      approveWithdraw: (requestId, opts2) => this.strategies.portability.approveWithdrawal(this, requestId, opts2),
+      rejectWithdraw: (requestId, opts2) => this.strategies.portability.rejectWithdrawal(this, requestId, opts2)
     });
     this.custody = new CustodyApi(
       (options, factors) => this.noydb.grantCustodian(this.name, options, factors),
@@ -8389,7 +8135,7 @@ var Vault = class {
    *  dispatch reads/writes — from this vault's OWN privates, rather than passing `this` itself. */
   _viaReconcileCtx() {
     return {
-      i18nStrategy: this.i18nStrategy,
+      i18nStrategy: this.strategies.i18n,
       locale: this.locale,
       translateText: this.translateText,
       i18nFieldRegistry: this.i18nFieldRegistry,
@@ -8405,6 +8151,22 @@ var Vault = class {
       enforceStaticDictOnPut: (collectionName, record) => this.enforceStaticDictOnPut(collectionName, record)
     };
   }
+  /** The registries `populateCollectionRegistries` writes into (#841). */
+  #registries() {
+    return {
+      refRegistry: this.refRegistry,
+      i18nFieldRegistry: this.i18nFieldRegistry,
+      blobFieldsRegistry: this.blobFieldsRegistry,
+      archiveRegistry: this.archiveRegistry,
+      attestation: this.attestation,
+      dictKeyFieldRegistry: this.dictKeyFieldRegistry,
+      staticDictNames: this.staticDictNames,
+      staticByName: this.staticByName,
+      staticDescriptorByField: this.staticDescriptorByField,
+      reservedLookupCollections: this.reservedLookupCollections,
+      schemaUpdateNames: this.#schemaUpdateNames
+    };
+  }
   collection(collectionName, options) {
     const overlayRegistry = this.overlayedViewRegistry;
     if (overlayRegistry !== null && overlayRegistry.isOverlay(collectionName)) {
@@ -8430,7 +8192,7 @@ var Vault = class {
       this.satelliteRegistry = declareSatellite({
         adapter: this.adapter,
         vaultName: this.name,
-        forgetSubjects: this.forgetStrategy.subjects,
+        forgetSubjects: this.strategies.forget.subjects,
         getDEK: this.getDEK,
         getBaseSchema: (base) => this.collectionCache.get(base)?.getSchema(),
         getBaseCrdt: (base) => this.collectionCache.get(base)?.getConfig()?.crdt,
@@ -8438,8 +8200,8 @@ var Vault = class {
         registerPoisonHook: (hook) => {
           this.noydb._writeHooks.onBeforeWrite(hook);
         },
-        forEachSyncEngine: (fn2) => {
-          this.noydb._forEachSyncEngine(this.name, fn2);
+        forEachSyncEngine: (fn) => {
+          this.noydb._forEachSyncEngine(this.name, fn);
         }
       }, collectionName, { ...options, satelliteOf: options.satelliteOf }, this.satelliteRegistry);
     }
@@ -8456,60 +8218,14 @@ var Vault = class {
       });
     }
     if (!coll) {
-      if (options?.refs) {
-        this.refRegistry.register(collectionName, options.refs);
-      }
-      if (effectiveViaFields.i18nFields) {
-        this.i18nFieldRegistry.set(collectionName, effectiveViaFields.i18nFields);
-      }
-      if (options?.blobFields) {
-        this.blobFieldsRegistry.set(collectionName, options.blobFields);
-      }
-      if (options?.archive) {
-        this.archiveRegistry.set(collectionName, options.archive);
-      }
-      if (options?.attestation !== void 0) {
-        this.attestation.register(collectionName, options.attestation);
-      }
-      if (effectiveViaFields.dictKeyFields || effectiveViaFields.lookupFields) {
-        const dictFieldMap = {};
-        const staticFieldMap = {};
-        for (const [field, desc] of Object.entries(effectiveViaFields.dictKeyFields ?? {})) {
-          if (isStaticDictDescriptor(desc)) {
-            staticFieldMap[field] = desc;
-            this.staticDictNames.add(desc.name);
-            this.staticByName.set(desc.name, desc);
-          } else {
-            dictFieldMap[field] = desc.name;
-          }
-        }
-        const lookupCompat = collectLookupDictCompat(effectiveViaFields.lookupFields);
-        Object.assign(dictFieldMap, lookupCompat.dictFieldMap);
-        for (const [field, desc] of lookupCompat.staticEntries) {
-          staticFieldMap[field] = desc;
-          this.staticDictNames.add(desc.name);
-          this.staticByName.set(desc.name, desc);
-        }
-        if (Object.keys(dictFieldMap).length > 0) {
-          this.dictKeyFieldRegistry.set(collectionName, dictFieldMap);
-          for (const dictName of new Set(Object.values(dictFieldMap))) {
-            this.reservedLookupCollections.set(dictCollectionName(dictName), dictName);
-          }
-        }
-        if (Object.keys(staticFieldMap).length > 0) {
-          this.staticDescriptorByField.set(collectionName, staticFieldMap);
-        }
-      }
-      if ((options?.schemaUpdate?.length ?? 0) > 0) {
-        this.#schemaUpdateNames.set(collectionName, (options.schemaUpdate ?? []).map((s) => s.name));
-      }
+      populateCollectionRegistries(this.#registries(), collectionName, options, effectiveViaFields);
       let schemaUpdateGate;
       if (options?.persistJsonSchema === true && options.schema !== void 0 && (options.schemaUpdate?.length ?? 0) > 0) {
         const validator = options.schema;
         const strategies = options.schemaUpdate ?? [];
         const work = (async () => {
           const dek = await this.getDEK(collectionName);
-          const { persistSchemaIfNeeded } = await import("./register-PAM3ASRZ.js");
+          const { persistSchemaIfNeeded } = await import("./register-UKU2J6MN.js");
           const result = await persistSchemaIfNeeded({
             store: this.adapter,
             vault: this.name,
@@ -8550,22 +8266,9 @@ var Vault = class {
         // #693: re-create gate fallback
         historyConfig: effectiveHistoryConfig,
         historyConfigExplicit: options?.historyConfig !== void 0,
-        // thread the vault-wide blob strategy into every
-        // collection. `undefined` is intentionally preserved so the
-        // Collection constructor uses its NO_BLOBS default.
-        ...this.blobStrategy !== void 0 ? { blobStrategy: this.blobStrategy } : {},
         ...this.objectStore !== void 0 ? { objectStore: this.objectStore } : {},
         ...options?.blobFields !== void 0 ? { blobFields: options.blobFields } : {},
-        ...this.indexStrategy !== void 0 ? { indexStrategy: this.indexStrategy } : {},
-        ...this.lazyStrategy !== void 0 ? { lazyStrategy: this.lazyStrategy } : {},
-        ...this.aggregateStrategy !== void 0 ? { aggregateStrategy: this.aggregateStrategy } : {},
-        ...this.crdtStrategy !== void 0 ? { crdtStrategy: this.crdtStrategy } : {},
-        ...this.tiersStrategy !== void 0 ? { tiersStrategy: this.tiersStrategy } : {},
-        ...this.searchStrategy !== void 0 ? { searchStrategy: this.searchStrategy } : {},
-        historyStrategy: this.historyStrategy,
-        i18nStrategy: this.i18nStrategy,
-        syncStrategy: this.syncStrategy,
-        classifiedStrategy: this.classifiedStrategy,
+        strategies: this.strategies,
         // Per-collection ledger opt-out: when this collection sets
         // `historyConfig.ledger: false`, withhold the ledger reference so all
         // four `if (this.ledger)` append sites in Collection no-op. The chain
@@ -8603,31 +8306,12 @@ var Vault = class {
           }
         } : {}
       };
-      if (options?.indexes !== void 0) collOpts.indexes = options.indexes;
-      if (options?.reconcileOnOpen !== void 0) collOpts.reconcileOnOpen = options.reconcileOnOpen;
-      if (options?.prefetch !== void 0) collOpts.prefetch = options.prefetch;
-      if (options?.cache !== void 0) collOpts.cache = options.cache;
-      if (options?.schema !== void 0) collOpts.schema = options.schema;
-      if (options?.conflictPolicy !== void 0) collOpts.conflictPolicy = options.conflictPolicy;
-      if (options?.crdt !== void 0) collOpts.crdt = options.crdt;
-      if (options?.deterministicFields !== void 0) {
-        collOpts.deterministicFields = options.deterministicFields;
-      }
-      if (options?.acknowledgeDeterministicRisk !== void 0) {
-        collOpts.acknowledgeDeterministicRisk = options.acknowledgeDeterministicRisk;
-      }
-      if (options?.acknowledgeEquatableRisk !== void 0) {
-        collOpts.acknowledgeEquatableRisk = options.acknowledgeEquatableRisk;
-      }
-      if (options?.sensitive !== void 0) {
-        collOpts.sensitive = options.sensitive;
-      }
-      if (options?.perRecordKeys !== void 0) collOpts.perRecordKeys = options.perRecordKeys;
-      const subjectKey = this.forgetStrategy.subjects[collectionName];
+      copyDefined(collOpts, options, COLLECTION_PASSTHROUGH_KEYS);
+      const subjectKey = this.strategies.forget.subjects[collectionName];
       if (subjectKey !== void 0) {
         if (options?.perRecordKeys === false) {
           console.warn(
-            `[noy-db] Collection "${collectionName}" is declared in withForgetCascade but opened with perRecordKeys: false. Forcing perRecordKeys: true \u2014 GDPR crypto-shred requires per-record CEKs.`
+            `[noy-db] Collection "${collectionName}" is declared in withForget but opened with perRecordKeys: false. Forcing perRecordKeys: true \u2014 GDPR crypto-shred requires per-record CEKs.`
           );
         }
         collOpts.perRecordKeys = true;
@@ -8637,22 +8321,8 @@ var Vault = class {
           if (value !== void 0 && value !== null) await this._addSubjectRef(coerceSubjectId(value), { collection: collectionName, id });
         };
       }
-      if (options?.provenance !== void 0) collOpts.provenance = options.provenance;
-      if (options?.ramCiphertext !== void 0) collOpts.ramCiphertext = options.ramCiphertext;
-      if (options?.tiers !== void 0) collOpts.tiers = options.tiers;
-      if (options?.tierMode !== void 0) collOpts.tierMode = options.tierMode;
-      if (options?.blobTierPolicy !== void 0) collOpts.blobTierPolicy = options.blobTierPolicy;
       collOpts.onCrossTierAccess = (event) => this.emitCrossTier(event);
       if (this.syncAdapter !== void 0) collOpts.syncAdapter = this.syncAdapter;
-      if (options?.i18nFields !== void 0) collOpts.i18nFields = options.i18nFields;
-      if (options?.embeddings !== void 0) collOpts.embeddings = options.embeddings;
-      if (options?.textIndexes !== void 0) collOpts.textIndexes = options.textIndexes;
-      if (options?.warmIndexOnOpen !== void 0) collOpts.warmIndexOnOpen = options.warmIndexOnOpen;
-      if (options?.textIndexPersist !== void 0) collOpts.textIndexPersist = options.textIndexPersist;
-      if (options?.moneyFields !== void 0) collOpts.moneyFields = options.moneyFields;
-      if (options?.viaFields !== void 0) collOpts.viaFields = options.viaFields;
-      if (options?.computed !== void 0) collOpts.computed = options.computed;
-      if (options?.classifiedFields !== void 0) collOpts.classifiedFields = options.classifiedFields;
       if (effectiveViaFields.dictKeyFields !== void 0 || effectiveViaFields.lookupFields !== void 0) {
         collOpts.dictLabelResolver = async (dictName, key, locale, fallback) => {
           const stat = this.staticByName.get(dictName);
@@ -8686,10 +8356,6 @@ var Vault = class {
       if (effectiveViaFields.i18nFields !== void 0 && this.translateText) {
         collOpts.autoTranslateHook = this.translateText;
       }
-      if (options?.fieldMeta !== void 0) {
-        collOpts.fieldMeta = options.fieldMeta;
-      }
-      if (options?.meta !== void 0) collOpts.meta = options.meta;
       if (options?.refs !== void 0) {
         collOpts.declaredRefs = this.refRegistry.getOutbound(collectionName);
       }
@@ -8708,7 +8374,7 @@ var Vault = class {
         const work = (async () => {
           try {
             const dek = await this.getDEK(collectionName);
-            await (await import("./register-PAM3ASRZ.js")).persistSchemaIfNeeded({
+            await (await import("./register-UKU2J6MN.js")).persistSchemaIfNeeded({
               store: this.adapter,
               vault: this.name,
               collectionName,
@@ -9004,7 +8670,7 @@ var Vault = class {
       const values = getAtPath(obj, field);
       for (const value of values) {
         if (value === void 0 || value === null) continue;
-        this.i18nStrategy.validateI18nTextValue(value, field, descriptor);
+        this.strategies.i18n.validateI18nTextValue(value, field, descriptor);
       }
     }
   }
@@ -9045,7 +8711,7 @@ var Vault = class {
     this.reservedLookupCollections.set(dictCollectionName(name), name);
     let handle = this.dictionaryCache.get(name);
     if (!handle) {
-      handle = this.i18nStrategy.buildDictionaryHandle({
+      handle = this.strategies.i18n.buildDictionaryHandle({
         adapter: this.adapter,
         compartmentName: this.name,
         dictionaryName: name,
@@ -9206,7 +8872,7 @@ var Vault = class {
    * is re-keyed for distinct recipients.
    *
    * Each recipient becomes its own `KeyringFile` sealed with that
-   * recipient's passphrase. The DEKs wrapped into each slot are
+   * recipient's secret. The DEKs wrapped into each slot are
    * exactly those the recipient's role + permissions justify, and
    * never wider than the source keyring's own DEK set
    * (privilege-escalation check).
@@ -9258,7 +8924,7 @@ var Vault = class {
       };
     }
     if (!this.sequenceStore) {
-      this.sequenceStore = this.sequenceStrategy.createStore({
+      this.sequenceStore = this.strategies.sequence.createStore({
         adapter: this.adapter,
         vault: this.name,
         encrypted: this.encrypted,
@@ -9331,7 +8997,9 @@ var Vault = class {
       deleteSlot: async (name, id, slotName) => {
         const coll = this.collection(name);
         await coll.blob(id).delete(slotName);
-      }
+      },
+      dropLocalCache: async (name, id, slotName) => this.collection(name).blob(id).dropLocalCache(slotName)
+      // #808: budget pass drops device-local external cache copies
     }, options);
   }
   /**
@@ -9354,7 +9022,7 @@ var Vault = class {
     return runListArchived(this._archiveContext(), collection);
   }
   _archiveContext() {
-    const strategy = this.archiveStrategy;
+    const strategy = this.strategies.archive;
     if (!strategy) {
       throw new Error(
         "vault.archive/restore/listArchived require `archiveStrategy: withArchive({ store })` in createNoydb"
@@ -9521,7 +9189,7 @@ var Vault = class {
    */
   getLedgerOrNull() {
     if (!this.ledgerStore) {
-      this.ledgerStore = this.historyStrategy.buildLedger({
+      this.ledgerStore = this.strategies.history.buildLedger({
         adapter: this.adapter,
         vault: this.name,
         encrypted: this.encrypted,
@@ -9546,7 +9214,7 @@ var Vault = class {
    * number of distinct subjects re-indexed.
    */
   async rebuildSubjectIndex() {
-    if (Object.keys(this.forgetStrategy.subjects).length === 0) {
+    if (Object.keys(this.strategies.forget.subjects).length === 0) {
       throw new ForgetStrategyNotConfiguredError();
     }
     return rebuildSubjectIndex(
@@ -9554,7 +9222,7 @@ var Vault = class {
       this.name,
       this.getDEK,
       this.encrypted,
-      this.forgetStrategy.subjects,
+      this.strategies.forget.subjects,
       async (collectionName, id, env) => {
         const coll = this.collection(collectionName);
         return coll._decodeEnvelope(env, id);
@@ -9576,10 +9244,10 @@ var Vault = class {
    * stay decryptable; migrate, then re-forget) and `blobResidueCollections` (blob attachments, keyed
    * off a separate `_blob` DEK, out of scope here).
    *
-   * @throws ForgetStrategyNotConfiguredError when no `withForgetCascade` was set.
+   * @throws ForgetStrategyNotConfiguredError when no `withForget` was set.
    */
   async forget(subjectId) {
-    if (Object.keys(this.forgetStrategy.subjects).length === 0) {
+    if (Object.keys(this.strategies.forget.subjects).length === 0) {
       throw new ForgetStrategyNotConfiguredError();
     }
     const ledger = this.getLedgerOrNull();
@@ -9601,17 +9269,17 @@ var Vault = class {
     const sealedResidue = [];
     const indexResidue = [];
     const ledgerDeltaResidue = [];
-    const blobsEnabled = this.blobStrategy !== void 0;
+    const blobsEnabled = this.strategies.blobs !== NO_BLOBS;
     const actor = this.keyring.userId;
     const fanoutStats = { recordsErased: 0, aggregatesRecomputed: 0, residueFrozen: [], lookupReferencesCascaded: 0, lookupReferencesNullified: 0, lookupReferencesResidue: [], derivedResidueUndecodable: [], derivedResidueDeclined: [] };
     const { partitionSealedCekKeys, shouldSkipBlobScan, bumpResidueCount, residueNoticesFromMap } = await import("./purge-scope-FGNNLWHD.js");
-    const scopedPurge = this.forgetStrategy.scopedPurge === true;
+    const scopedPurge = this.strategies.forget.scopedPurge === true;
     const sealedCekScopedSkipped = /* @__PURE__ */ new Map();
     const blobScopedSkipped = /* @__PURE__ */ new Map();
     for (const ref2 of allRefs) {
       const coll = this.collection(ref2.collection);
       const satelliteOf = ref2.satelliteOf;
-      const perRecordKeys = this.forgetStrategy.subjects[satelliteOf ?? ref2.collection] !== void 0;
+      const perRecordKeys = this.strategies.forget.subjects[satelliteOf ?? ref2.collection] !== void 0;
       const lookupCompareKeys = await this.linksEnforcer.checkLookupRefsRestrict(this.graph, ref2.collection, ref2.collection, ref2.id);
       const live = await this.adapter.get(this.name, ref2.collection, ref2.id);
       if (perRecordKeys && live && live._data && !hasPerRecordKey(live)) {
@@ -9671,7 +9339,7 @@ var Vault = class {
         collections.add(ref2.collection);
         await forgetDerivedFanout(this, { collection: ref2.collection, id: ref2.id }, live, fanoutStats, lookupCompareKeys);
       }
-      historyVersionsShredded += await this.historyStrategy.tombstoneHistory(
+      historyVersionsShredded += await this.strategies.history.tombstoneHistory(
         this.adapter,
         this.name,
         ref2.collection,
@@ -9801,7 +9469,7 @@ var Vault = class {
    *   `<collection>/<id>/<pid>` key the delivery envelope was written under.
    */
   async sealRecordToHost(collection, id, hostSealer, opts) {
-    return this.sealedRecordStrategy.sealRecordToHost(this._sealingContext(), collection, id, hostSealer, opts);
+    return this.strategies.sealedRecord.sealRecordToHost(this._sealingContext(), collection, id, hostSealer, opts);
   }
   /**
    * Revoke a sealed-CEK grant. **Default is SOFT**: deletes the `pid` delivery
@@ -9811,7 +9479,7 @@ var Vault = class {
    * longer open the record. See `revokeSealedRecord` in `record-keys/sealing.ts`.
    */
   async revokeSealedRecord(collection, id, pid, opts) {
-    return this.sealedRecordStrategy.revokeSealedRecord(this._sealingContext(), collection, id, pid, opts);
+    return this.strategies.sealedRecord.revokeSealedRecord(this._sealingContext(), collection, id, pid, opts);
   }
   /**
    * HARD-rotate a record's CEK: decrypt the live body under the old CEK,
@@ -9831,7 +9499,7 @@ var Vault = class {
    * @throws {@link RecordCekNotFoundError} if the record is missing or has no `_cek`.
    */
   async rotateRecordCek(collection, id) {
-    return this.sealedRecordStrategy.rotateRecordCek(this._sealingContext(), collection, id);
+    return this.strategies.sealedRecord.rotateRecordCek(this._sealingContext(), collection, id);
   }
   /**
    * Build the {@link SealingContext} the record-keys grantor functions need:
@@ -9865,7 +9533,7 @@ var Vault = class {
   async _initGuards(handles) {
     if (handles.length === 0) return;
     const [{ GuardRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-VW6P6A3J.js"),
+      import("./registry-BWD2ED52.js"),
       import("./read-only-facade-CHCKSEPD.js")
     ]);
     const registry = new GuardRegistry();
@@ -9893,7 +9561,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-VZ3CCI2R.js"),
+      import("./registry-DTWRJLSF.js"),
       import("./read-only-facade-CHCKSEPD.js")
     ]);
     const registry = new DerivationRegistry();
@@ -9925,7 +9593,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-4S2U2TR4.js");
+    const { MaterializedViewRegistry } = await import("./registry-2VCWVHZS.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -9950,7 +9618,7 @@ var Vault = class {
    */
   async _initOverlayedViews(handles) {
     if (handles.length === 0) return;
-    const { OverlayedViewRegistry } = await import("./registry-NPOWJHC4.js");
+    const { OverlayedViewRegistry } = await import("./registry-7Y5WF7GS.js");
     const registry = new OverlayedViewRegistry();
     const mvRegistry = this.materializedViewRegistry;
     const overlayNames = /* @__PURE__ */ new Set();
@@ -9997,14 +9665,14 @@ var Vault = class {
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-UX4FASYZ.js");
+    const { MaterializedViewExecutor } = await import("./executor-OTF556PL.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this,
       dispatchCtx: this._dispatchCtx({ collection: name, id: "refreshView" })
     });
-    const { clearMVStaleFully } = await import("./stale-VZL4OGUB.js");
+    const { clearMVStaleFully } = await import("./stale-A4J26OIC.js");
     await clearMVStaleFully(this.adapter, this.name, registry, name);
     return result;
   }
@@ -10017,7 +9685,7 @@ var Vault = class {
     if (registry === null) return { derived: 0, failed: 0, skippedFrozen: 0 };
     const strategies = registry.strategiesForSource(sourceCollection);
     if (strategies.length === 0) return { derived: 0, failed: 0, skippedFrozen: 0 };
-    const { DerivationExecutor } = await import("./executor-XGIS6CR7.js");
+    const { DerivationExecutor } = await import("./executor-IEBLTBCW.js");
     const sourceColl = this.collection(sourceCollection);
     const records = await sourceColl.list();
     const ctx = { vault: this.derivationFacade ?? new (await import("./read-only-facade-CHCKSEPD.js")).ReadOnlyVaultFacade(this, "derivation") };
@@ -10044,7 +9712,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-B5LVUMQX.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-SSMRSC2L.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key, this.getDEK, this.encrypted);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -10138,7 +9806,7 @@ var Vault = class {
    */
   at(timestamp) {
     const iso = timestamp instanceof Date ? timestamp.toISOString() : timestamp;
-    return this.historyStrategy.buildVaultInstant(
+    return this.strategies.history.buildVaultInstant(
       {
         adapter: this.adapter,
         name: this.name,
@@ -10170,11 +9838,11 @@ var Vault = class {
    *.
    */
   frame() {
-    return this.shadowStrategy.buildFrame(this);
+    return this.strategies.shadow.buildFrame(this);
   }
   /** Credential-broker handle (#479); `NO_BROKER` throws unless `brokerStrategy: withBroker(config)` was passed to createNoydb(). */
   broker() {
-    return buildCredentialBrokerHandle(this.brokerStrategy, this.adapter, this.name, () => this.keyring);
+    return buildCredentialBrokerHandle(this.strategies.broker, this.adapter, this.name, () => this.keyring);
   }
   /**
    * Run `fn` under a consent scope. Every `get` / `put` / `delete`
@@ -10199,11 +9867,11 @@ var Vault = class {
    *
    *.
    */
-  async withConsent(ctx, fn2) {
+  async withConsent(ctx, fn) {
     const prior = this.consentContext;
     this.consentContext = ctx;
     try {
-      return await fn2();
+      return await fn();
     } finally {
       this.consentContext = prior;
     }
@@ -10216,7 +9884,7 @@ var Vault = class {
    *.
    */
   async consentAudit(filter = {}) {
-    return this.consentStrategy.read(this.adapter, this.name, this.encrypted, this.getDEK, filter);
+    return this.strategies.consent.read(this.adapter, this.name, this.encrypted, this.getDEK, filter);
   }
   /**
    * Called by Collection after every access when a consent scope is
@@ -10227,7 +9895,7 @@ var Vault = class {
   async _logConsent(op, collection, recordId) {
     const ctx = this.consentContext;
     if (!ctx) return;
-    await this.consentStrategy.write(
+    await this.strategies.consent.write(
       this.adapter,
       this.name,
       this.encrypted,
@@ -10271,10 +9939,10 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-SU6CV3W7.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-QXZ4MPPH.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
-        "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (passphrase) first."
+        "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (secret) first."
       );
     }
     const targetKek = this.keyring.kek;
@@ -10293,7 +9961,7 @@ var Vault = class {
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-SU6CV3W7.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-QXZ4MPPH.js");
     await revokeDelegation(this.adapter, this.name, id);
     void DELEGATIONS_COLLECTION;
   }
@@ -10541,7 +10209,7 @@ var Vault = class {
    * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
    */
   async dumpSchema(opts = {}) {
-    const { dumpVaultSchema } = await import("./walk-IPLXE36W.js");
+    const { dumpVaultSchema } = await import("./walk-P5D6CF4V.js");
     return dumpVaultSchema(this, opts);
   }
   /**
@@ -10676,13 +10344,9 @@ var Vault = class {
    * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md
    */
   async getCover(opts = {}) {
-    const { readCover } = await import("./cover-QJRXINN5.js");
+    const { readCover } = await import("./cover/index.js");
     return readCover(this.adapter, this.name, opts);
   }
-  /** @deprecated Use {@link Vault.getCover} (#799 rename). */
-  async getPublicEnvelope(opts = {}) {
-    return this.getCover(opts);
-  }
   /**
    * Dump vault as a verifiable encrypted JSON backup string.
    *
@@ -10695,7 +10359,7 @@ var Vault = class {
    * both modes round-trip cleanly.
    */
   async dump() {
-    const { dumpVault } = await import("./backup-YPUEKIJC.js");
+    const { dumpVault } = await import("./backup-2UX7PRM5.js");
     return dumpVault(this.backupContext());
   }
   /**
@@ -10710,7 +10374,7 @@ var Vault = class {
       vault: this.name,
       userId: () => this.keyring.userId,
       getLedgerOrNull: () => this.getLedgerOrNull(),
-      envelopePayloadHash: (envelope) => this.historyStrategy.envelopePayloadHash(envelope),
+      envelopePayloadHash: (envelope) => this.strategies.history.envelopePayloadHash(envelope),
       reloadKeyringAndRebuildDEK: async () => {
         if (this.reloadKeyring) {
           this.keyring = await this.reloadKeyring();
@@ -10747,7 +10411,7 @@ var Vault = class {
    * — there's no chain to verify against.
    */
   async load(backupJson) {
-    const { loadVault } = await import("./backup-YPUEKIJC.js");
+    const { loadVault } = await import("./backup-2UX7PRM5.js");
     return loadVault(this.backupContext(), backupJson);
   }
   /**
@@ -10779,7 +10443,7 @@ var Vault = class {
    * way to detect tampering of an in-place vault.
    */
   async verifyBackupIntegrity() {
-    const { verifyBackupIntegrity } = await import("./backup-YPUEKIJC.js");
+    const { verifyBackupIntegrity } = await import("./backup-2UX7PRM5.js");
     return verifyBackupIntegrity(this.backupContext());
   }
   /**
@@ -10997,7 +10661,7 @@ var Vault = class {
    * is the live validator object, not a serialization of it).
    */
   async exportJSON(opts = {}) {
-    const { exportVaultJSON } = await import("./backup-YPUEKIJC.js");
+    const { exportVaultJSON } = await import("./backup-2UX7PRM5.js");
     return exportVaultJSON(this.backupContext(), opts);
   }
 };
@@ -11074,10 +10738,10 @@ var WriteQueueTracker = class {
    * (success or failure). The fn's resolved value is returned; a thrown
    * error is re-thrown after the queue is decremented.
    */
-  async track(fn2) {
+  async track(fn) {
     this.begin();
     try {
-      const value = await fn2();
+      const value = await fn();
       this.settle();
       return value;
     } catch (error) {
@@ -11100,7 +10764,184 @@ var WriteQueueTracker = class {
   }
 };
 
-// src/with-party/tab-coordination.ts
+// src/port/with/write-hooks.ts
+var WriteHookRegistry = class {
+  #before = [];
+  #after = [];
+  #suppressed = false;
+  /** True while handlers are running — used by the write path to skip nested firing. */
+  get suppressed() {
+    return this.#suppressed;
+  }
+  /** True when any hook is registered (cheap gate for the write path). */
+  get hasHandlers() {
+    return this.#before.length > 0 || this.#after.length > 0;
+  }
+  onBeforeWrite(handler) {
+    this.#before.push(handler);
+    return () => {
+      const i = this.#before.indexOf(handler);
+      if (i >= 0) this.#before.splice(i, 1);
+    };
+  }
+  onAfterWrite(handler) {
+    this.#after.push(handler);
+    return () => {
+      const i = this.#after.indexOf(handler);
+      if (i >= 0) this.#after.splice(i, 1);
+    };
+  }
+  /** Run before-hooks (awaited, in order). A throw propagates and aborts the write. */
+  async runBefore(event) {
+    if (this.#before.length === 0) return;
+    this.#suppressed = true;
+    try {
+      for (const h of this.#before.slice()) await h(event);
+    } finally {
+      this.#suppressed = false;
+    }
+  }
+  /** Run after-hooks (awaited, in order). Per-handler errors are warned, not thrown. */
+  async runAfter(event) {
+    if (this.#after.length === 0) return;
+    this.#suppressed = true;
+    try {
+      for (const h of this.#after.slice()) {
+        try {
+          await h(event);
+        } catch (err) {
+          console.warn(
+            `[noy-db] onAfterWrite handler failed for ${event.collection}/${event.docId}: ` + (err instanceof Error ? err.message : String(err))
+          );
+        }
+      }
+    } finally {
+      this.#suppressed = false;
+    }
+  }
+};
+
+// src/port/with/service-bus.ts
+var ServiceBus = class {
+  #handlers = /* @__PURE__ */ new Map();
+  #gateHandlers = /* @__PURE__ */ new Map();
+  #depth = 0;
+  /** Register a handler for an observe point. Returns an unsubscribe fn. */
+  register(point, handler) {
+    let arr = this.#handlers.get(point);
+    if (!arr) {
+      arr = [];
+      this.#handlers.set(point, arr);
+    }
+    arr.push(handler);
+    return () => {
+      const a = this.#handlers.get(point);
+      if (!a) return;
+      const i = a.indexOf(handler);
+      if (i >= 0) a.splice(i, 1);
+    };
+  }
+  /** Cheap gate for the write path — true when any handler is registered for the point. */
+  hasHandlers(point) {
+    const a = this.#handlers.get(point);
+    return a !== void 0 && a.length > 0;
+  }
+  /**
+   * True while one or more dispatches are in flight. Backed by a depth counter
+   * so that two concurrent async dispatches (`Promise.all([put('a'), put('b')])`
+   * each captured `busAfterPut=true` at their respective put() tops while depth
+   * was 0) both proceed independently — the counter stays > 0 until BOTH finish,
+   * so any nested write attempted by a handler still sees `dispatching === true`
+   * and is suppressed by the write-path gate in `collection.ts`
+   * (`busAfterPut = hasHandlers('afterPut') && !dispatching`). Re-entrancy
+   * suppression lives exclusively on that write-path gate; concurrent independent
+   * dispatches must not drop each other's events.
+   */
+  get dispatching() {
+    return this.#depth > 0;
+  }
+  /**
+   * Dispatch in registration order, awaited. Per-handler errors are warned, not
+   * thrown — an observe handler must never abort a completed write. A
+   * re-entrancy guard suppresses nested firing so a handler that itself writes
+   * cannot loop (same rationale as WriteHookRegistry.#suppressed).
+   */
+  async dispatch(point, event) {
+    const a = this.#handlers.get(point);
+    if (!a || a.length === 0) return;
+    this.#depth++;
+    try {
+      for (const h of a.slice()) {
+        try {
+          await h(event);
+        } catch (err) {
+          console.warn(
+            `[noy-db] service observe handler failed at ${point}: ` + (err instanceof Error ? err.message : String(err))
+          );
+        }
+      }
+    } finally {
+      this.#depth--;
+    }
+  }
+  /**
+   * Register a write-gating handler. A throw from the handler ABORTS the
+   * write. Returns an unsubscribe fn. See {@link GateRegisterOptions} for
+   * the `needsPrior` prior-read declaration (#267).
+   */
+  registerGate(point, handler, opts) {
+    let arr = this.#gateHandlers.get(point);
+    if (!arr) {
+      arr = [];
+      this.#gateHandlers.set(point, arr);
+    }
+    const entry = { fn: handler, needsPrior: opts?.needsPrior !== false };
+    arr.push(entry);
+    return () => {
+      const a = this.#gateHandlers.get(point);
+      if (!a) return;
+      const i = a.indexOf(entry);
+      if (i >= 0) a.splice(i, 1);
+    };
+  }
+  /** Cheap gate for the write path — true when any gate handler is registered for the point. */
+  hasGateHandlers(point) {
+    const a = this.#gateHandlers.get(point);
+    return a !== void 0 && a.length > 0;
+  }
+  /**
+   * True when at least one gate handler at `point` needs the prior record
+   * (the default). False when the point has no handlers or every handler
+   * registered with `needsPrior: false` — the write path then skips the
+   * prior-read before dispatching (#267 prior-read elision).
+   */
+  gateNeedsPrior(point) {
+    const a = this.#gateHandlers.get(point);
+    if (!a) return false;
+    return a.some((e) => e.needsPrior);
+  }
+  /**
+   * Run gate handlers in registration order, awaited. Unlike `dispatch`
+   * (observe), a handler throw is NOT swallowed — it PROPAGATES, aborting the
+   * write before it reaches the store. The first throw stops the remaining
+   * handlers (fail-fast). This is the seam guards/periods migrate onto.
+   *
+   * Note: gate handlers are validators that read, not write. A gate handler
+   * that writes back into the same collection would re-enter the write path
+   * and re-dispatch this point; loop-suppression for that case is deferred to
+   * the migration slice (contract: gate handlers must not perform writes that
+   * re-trigger their own point).
+   */
+  async dispatchGate(point, event) {
+    const a = this.#gateHandlers.get(point);
+    if (!a || a.length === 0) return;
+    for (const e of a.slice()) {
+      await e.fn(event);
+    }
+  }
+};
+
+// src/with-sync/tab-coordination.ts
 var TabCoordinator = class {
   tabId;
   role = "unknown";
@@ -11162,13 +11003,13 @@ var TabCoordinator = class {
     const out = [self, ...[...this.#peers.values()].filter((p) => p.lastSeen >= cutoff)];
     return out.sort((a, b) => a.tabId.localeCompare(b.tabId));
   }
-  onTabRoleChange(fn2) {
-    this.#roleHandlers.add(fn2);
-    return () => this.#roleHandlers.delete(fn2);
+  onTabRoleChange(fn) {
+    this.#roleHandlers.add(fn);
+    return () => this.#roleHandlers.delete(fn);
   }
-  onActiveTabsChange(fn2) {
-    this.#tabsHandlers.add(fn2);
-    return () => this.#tabsHandlers.delete(fn2);
+  onActiveTabsChange(fn) {
+    this.#tabsHandlers.add(fn);
+    return () => this.#tabsHandlers.delete(fn);
   }
   dispose() {
     if (this.#disposed) return;
@@ -11281,7 +11122,7 @@ function defaultChannel(name = "noydb:tabs") {
   };
 }
 
-// src/with-party/tab-write-relay.ts
+// src/with-sync/tab-write-relay.ts
 var CrossTabWriteRelay = class {
   #channel;
   #writerId;
@@ -11395,25 +11236,6 @@ var QuickUnlockStore = class {
   }
 };
 
-// src/with-fork/snapshots/strategy.ts
-var NOT_ENABLED4 = new Error(
-  'Snapshots require the snapshot strategy. Import `{ withSnapshots }` from "@noy-db/hub/snapshots" and pass it to `createNoydb({ snapshotStrategy: withSnapshots({ store }) })`.'
-);
-var NO_SNAPSHOTS = {
-  async snapshot() {
-    throw NOT_ENABLED4;
-  },
-  async listSnapshots() {
-    throw NOT_ENABLED4;
-  },
-  async restoreSnapshot() {
-    throw NOT_ENABLED4;
-  },
-  async autoSnapshot() {
-    throw NOT_ENABLED4;
-  }
-};
-
 // src/with-fork/snapshots/scheduler.ts
 var SnapshotScheduler = class {
   policy;
@@ -11535,7 +11357,7 @@ var NoydbSnapshots = class {
   dirtyVaults = /* @__PURE__ */ new Set();
   /**
    * Take an on-demand checkpoint of the given vault.
-   * Requires `snapshotStrategy: withSnapshots({ store })` in `createNoydb`.
+   * Requires `snapshotsStrategy: withSnapshots({ store })` in `createNoydb`.
    * @throws ValidationError when the vault is not open
    */
   async snapshot(vault, opts) {
@@ -11614,19 +11436,6 @@ var NoydbSnapshots = class {
   }
 };
 
-// src/with-commit/tx/strategy.ts
-var NOT_ENABLED5 = new Error(
-  'Multi-record transactions require the tx strategy. Import `{ withTransactions }` from "@noy-db/hub/tx" and pass it to `createNoydb({ txStrategy: withTransactions() })`.'
-);
-var NO_TX = {
-  async runTransaction(_db, _fn, _options, _txInvariants) {
-    throw NOT_ENABLED5;
-  },
-  async runDryRun() {
-    throw NOT_ENABLED5;
-  }
-};
-
 // src/kernel/memory-store.ts
 function memoryStore() {
   const store = /* @__PURE__ */ new Map();
@@ -11710,146 +11519,6 @@ function memoryStore() {
   };
 }
 
-// src/with-party/session/strategy.ts
-function notEnabled3(op) {
-  return new Error(
-    `${op} requires the session strategy. Import \`{ withSession }\` from "@noy-db/hub/session" and pass it to \`createNoydb({ sessionStrategy: withSession() })\`.`
-  );
-}
-var NO_SESSION = {
-  validateSessionPolicy() {
-    throw notEnabled3("sessionPolicy");
-  },
-  createEnforcer() {
-    throw notEnabled3("session policy enforcement");
-  },
-  revokeAllSessions() {
-  }
-};
-
-// src/with-party/auth-introspection/index.ts
-async function describeAuthConfig(store, vault) {
-  const policy = await loadVaultPolicy(store, vault) ?? defaultPolicySnapshot();
-  const recoveryProfiles = await listRecoveryProfilesEnrolled(store, vault);
-  const lines = [];
-  lines.push(`Vault "${vault}" \u2014 three-tier authentication`);
-  lines.push("");
-  lines.push("Tier 1 \u2014 Passphrase (master)");
-  lines.push(`  Phrase format: ${policy.passphrase?.minWords ?? 6}+ words, lowercase letters, \u2265${policy.passphrase?.minWordLength ?? 3} chars/word`);
-  lines.push("  Strength validator: enforced (override available for tests only)");
-  lines.push("");
-  lines.push("Tier 2 \u2014 Authenticate (routine login)");
-  lines.push("  Allowed methods: WebAuthn (passkey), OIDC, Password");
-  lines.push("  Slots per user: unlimited");
-  lines.push("");
-  lines.push("Tier 3 \u2014 Unlock (quick resume)");
-  lines.push("  Method: PIN (per-app configurable)");
-  lines.push("");
-  lines.push(`Recovery profiles enrolled: ${recoveryProfiles.length === 0 ? "none" : recoveryProfiles.join(", ")}`);
-  lines.push("Managed-passphrase mode: off (post-1.0)");
-  lines.push("");
-  lines.push("Sensitive-action gates:");
-  for (const [gate, gp] of Object.entries(policy.gates)) {
-    lines.push(`  ${gate} \u2014 ${describeGatePolicy(gp)}`);
-  }
-  return lines.join("\n");
-}
-async function diagramAuthConfig(store, vault) {
-  const policy = await loadVaultPolicy(store, vault) ?? defaultPolicySnapshot();
-  const lines = [];
-  lines.push("flowchart TB");
-  lines.push(`  vault["Vault: ${escapeMermaid(vault)}"]`);
-  lines.push('  tier1["Tier 1<br/>Passphrase"]');
-  lines.push('  tier2["Tier 2<br/>Multi-slot Authenticate"]');
-  lines.push('  tier3["Tier 3<br/>PIN / Quick-resume"]');
-  lines.push("  vault --> tier1");
-  lines.push("  tier1 --> tier2");
-  lines.push("  tier2 --> tier3");
-  for (const [gateName, gp] of Object.entries(policy.gates)) {
-    if (gp.enabled === false) continue;
-    const id = sanitizeId(gateName);
-    const label = `${gateName}<br/>tier \u2265 ${gp.minTier}`;
-    lines.push(`  ${id}["${escapeMermaid(label)}"]`);
-    const tierNode = gp.minTier === 1 ? "tier1" : gp.minTier === 2 ? "tier2" : "tier3";
-    lines.push(`  ${tierNode} --> ${id}`);
-  }
-  return lines.join("\n");
-}
-async function describeUserAuth(store, vault, userId) {
-  const env = await store.get(vault, "_keyring", userId);
-  if (!env) return "";
-  const file = JSON.parse(env._data);
-  const lines = [];
-  lines.push(
-    `User: ${file.user_id} (joined ${file.created_at.slice(0, 10)}, role: ${file.role})`
-  );
-  lines.push("");
-  lines.push("Tier 2 enrollments:");
-  if (!file.authenticators || file.authenticators.length === 0) {
-    lines.push("  (none enrolled)");
-  } else {
-    for (const slot of file.authenticators) {
-      lines.push(`  - ${describeSlot(slot)}`);
-    }
-  }
-  return lines.join("\n");
-}
-async function describeAllUsersAuth(store, vault) {
-  const ids = await store.list(vault, "_keyring");
-  const results = [];
-  for (const userId of ids) {
-    const description = await describeUserAuth(store, vault, userId);
-    if (description !== "") results.push({ userId, description });
-  }
-  return results;
-}
-var SLOT_FIELD_ALLOWLIST = [
-  "id",
-  "method",
-  "enrolled_at",
-  "enrolled_via_tier"
-];
-function describeSlot(slot) {
-  const sanitized = {};
-  for (const key of SLOT_FIELD_ALLOWLIST) {
-    if (key in slot) {
-      sanitized[key] = slot[key];
-    }
-  }
-  const date = (sanitized.enrolled_at ?? "").slice(0, 10);
-  return `${sanitized.method ?? "?"} (id=${sanitized.id ?? "?"}, enrolled ${date}, via tier ${sanitized.enrolled_via_tier ?? "?"})`;
-}
-function describeGatePolicy(gp) {
-  if (gp.enabled === false) return "disabled";
-  const parts = [];
-  parts.push(`tier ${gp.minTier}`);
-  if (gp.factors && gp.factors.length > 0) {
-    for (const f of gp.factors) {
-      parts.push(`+ ${f.count ?? 1}\xD7 ${f.anyOf.join("|")}`);
-    }
-  }
-  if (gp.warn?.sharedDevice === "block") parts.push("block-on-shared-device");
-  return parts.join(" ");
-}
-function defaultPolicySnapshot() {
-  return {
-    passphrase: { minWords: 6, minWordLength: 3, rejectRepeatedAdjacent: true },
-    gates: {}
-  };
-}
-async function listRecoveryProfilesEnrolled(store, vault) {
-  const enrolled = [];
-  const paper = await loadPaperRecoveryEntries(store, vault);
-  if (paper.length > 0) enrolled.push(`paper (${paper.length} codes)`);
-  return enrolled;
-}
-function escapeMermaid(s) {
-  return s.replace(/"/g, '\\"').replace(/\n/g, " ");
-}
-function sanitizeId(s) {
-  return s.replace(/[^a-zA-Z0-9]/g, "_");
-}
-
 // src/with-party/team/noydb-facade.ts
 var TeamFacade = class {
   constructor(deps) {
@@ -11891,8 +11560,9 @@ var TeamFacade = class {
   async runRotate(engine, vault, collections) {
     this.deps.checkPolicyOperation(vault, "rotate");
     const keyring = await this.deps.getKeyringInternal(vault);
-    await engine(this.deps.options.store, vault, keyring, collections);
+    const result = await engine(this.deps.options.store, vault, keyring, { collections });
     this.deps.keyringCache.set(vault, keyring);
+    return result;
   }
   // ─── Tier-2 enroll / remove ─────────────────────────────────────
   /**
@@ -11983,7 +11653,7 @@ var TeamFacade = class {
    * ```ts
    * import { enrollWebAuthn } from '@noy-db/on-webauthn'
    *
-   * await db.enrollWebAuthn('demo', async (keyring) => {
+   * await db.team.enrollWebAuthn('demo', async (keyring) => {
    *   const e = await enrollWebAuthn(keyring, 'demo', { rp: {...} })
    *   return {
    *     id: `webauthn-${e.credentialId.slice(0, 8)}`,
@@ -12012,7 +11682,7 @@ var TeamFacade = class {
     const slotOptions = await ceremony(keyring);
     if (slotOptions.method !== "webauthn") {
       throw new ValidationError(
-        `enrollWebAuthn: ceremony returned method "${slotOptions.method}"; expected "webauthn". Use db.enrollAuthenticator() for non-webauthn methods.`
+        `enrollWebAuthn: ceremony returned method "${slotOptions.method}"; expected "webauthn". Use db.team.enrollAuthenticator() for non-webauthn methods.`
       );
     }
     const credentialId = slotOptions.meta.credentialId;
@@ -12090,44 +11760,44 @@ var TeamFacade = class {
   }
   // ─── Tier-1 change flows ────────────────────────────────────────
   /**
-   * Rotate the user's passphrase (user remembers old). Validates the
-   * new phrase against the configured `passphrase` policy, runs the
-   * `rotate-passphrase` gate, then re-derives + re-wraps every DEK.
+   * Rotate the user's secret (user remembers old). Validates the
+   * new phrase against the configured `secret` policy, runs the
+   * `rotate-secret` gate, then re-derives + re-wraps every DEK.
    *
    * Tier-2 authenticator slots are dropped — each slot wraps the old
    * KEK and would need its derivation key to be re-presented. Re-enrol
    * via `db.enrollAuthenticator` after rotation.
    *
-   * @throws `WeakPassphraseError` on a weak new phrase.
+   * @throws `WeakSecretError` on a weak new phrase.
    * @throws `PolicyDeniedError` when the gate denies (missing factor, …).
-   * @throws `InvalidKeyError` when `oldPassphrase` is wrong.
+   * @throws `InvalidKeyError` when `oldSecret` is wrong.
    */
-  async rotatePassphrase(vault, input, factors) {
-    if (this.deps.options.passphraseMode === "managed") {
+  async rotateSecret(vault, input, factors) {
+    if (this.deps.options.secretMode === "managed") {
       throw new PolicyDeniedError(
-        "rotate-passphrase",
+        "rotate-secret",
         "disabled",
         { minTier: 1, enabled: false },
-        "Managed-passphrase mode (#14): the passphrase is hub-generated and sealed under the SealingKeyProvider \u2014 there is no plaintext to rotate. Use the recovery flow (follow-up issue) to mint a fresh sealed passphrase."
+        "Managed-secret mode (#14): the secret is hub-generated and sealed under the SealingKeyProvider \u2014 there is no plaintext to rotate. Use the recovery flow (follow-up issue) to mint a fresh sealed secret."
       );
     }
-    await this.deps.checkGate(vault, "rotate-passphrase", factors);
+    await this.deps.checkGate(vault, "rotate-secret", factors);
     const userId = this.deps.options.user;
-    const next = await rotatePassphrase(this.deps.options.store, vault, userId, input);
+    const next = await rotateSecret(this.deps.options.store, vault, userId, input);
     this.deps.keyringCache.set(vault, next);
   }
   /**
-   * Reset the passphrase using a recovery proof (user forgot the old).
+   * Reset the secret using a recovery proof (user forgot the old).
    * Currently supports the `'paper'` profile end-to-end; the
    * other profiles throw {@link RecoveryProfileNotImplementedError}.
    *
    * Burns the used recovery entry on success.
    */
-  async recoverPassphrase(vault, input, factors) {
-    await this.deps.checkGate(vault, "recover-passphrase", factors);
+  async recoverSecret(vault, input, factors) {
+    await this.deps.checkGate(vault, "recover-secret", factors);
     const userId = this.deps.options.user;
     const entriesBeforeRecovery = await loadPaperRecoveryEntries(this.deps.options.store, vault);
-    const next = await recoverPassphrase(this.deps.options.shamirRecovery, this.deps.options.store, vault, userId, input);
+    const next = await recoverSecret(this.deps.options.shamirRecovery, this.deps.options.store, vault, userId, input);
     this.deps.keyringCache.set(vault, next);
     const rotateRemaining = input.rotateRemainingCodes ?? true;
     const remainingAfterBurn = Math.max(0, entriesBeforeRecovery.length - 1);
@@ -12149,15 +11819,15 @@ var TeamFacade = class {
   }
   /**
    * Deliberate paper-recovery-code regeneration. User knows their
-   * passphrase but wants a fresh sheet — they lost the printout or
+   * secret but wants a fresh sheet — they lost the printout or
    * suspect compromise of the off-site copy.
    *
-   * Symmetric to {@link rotatePassphrase} for the recovery profile:
+   * Symmetric to {@link rotateSecret} for the recovery profile:
    * gated, audit-trackable, ergonomic. Replaces (not appends) the
    * paper sheet under `_meta/recovery-paper` in a single envelope `put`.
    *
    * Gated by the `rotate-recovery` policy gate:
-   *   - PERSONAL_POLICY: `{ minTier: 1 }` — knowing the passphrase
+   *   - PERSONAL_POLICY: `{ minTier: 1 }` — knowing the secret
    *     suffices, matching the lower-level flow's bar.
    *   - STRICT_POLICY: `{ minTier: 1, factors: [{ anyOf: ['totp',
    *     'email-otp', 'webauthn-roaming'] }] }` — rotation is an
@@ -12177,13 +11847,13 @@ var TeamFacade = class {
    *
    * @example Default count + show-once UI
    * ```ts
-   * const { newCodes } = await db.rotateRecovery('acme', { profile: 'paper' })
+   * const { newCodes } = await db.team.rotateRecovery('acme', { profile: 'paper' })
    * showCodesToUser(newCodes)
    * ```
    *
    * @example STRICT-policy site with TOTP factor proof
    * ```ts
-   * await db.rotateRecovery(
+   * await db.team.rotateRecovery(
    *   'acme',
    *   { profile: 'paper', count: 10 },
    *   { factors: [{ kind: 'totp', proof: '123456' }] },
@@ -12207,7 +11877,7 @@ var TeamFacade = class {
     const existing = await loadPaperRecoveryEntries(this.deps.options.store, vault);
     if (existing.length === 0) {
       throw new Error(
-        `db.rotateRecovery: no recovery codes are enrolled for vault "${vault}". Call db.enrollRecovery({ profile: 'paper', entries }) first; rotateRecovery replaces an existing sheet rather than minting one from scratch.`
+        `db.rotateRecovery: no recovery codes are enrolled for vault "${vault}". Call db.team.enrollRecovery({ profile: 'paper', entries }) first; rotateRecovery replaces an existing sheet rather than minting one from scratch.`
       );
     }
     const keyring = await this.getKeyring(vault);
@@ -12229,7 +11899,7 @@ var TeamFacade = class {
     const existing = await loadShamirRecoveryEntries(this.deps.options.store, vault);
     if (existing.length === 0) {
       throw new Error(
-        `db.rotateRecovery: no Shamir recovery entry is enrolled for vault "${vault}". Call db.enrollRecovery({ profile: 'shamir', k, n }) first; rotateRecovery replaces an existing entry rather than minting one from scratch.`
+        `db.rotateRecovery: no Shamir recovery entry is enrolled for vault "${vault}". Call db.team.enrollRecovery({ profile: 'shamir', k, n }) first; rotateRecovery replaces an existing entry rather than minting one from scratch.`
       );
     }
     let targetEntryId;
@@ -12266,7 +11936,7 @@ var TeamFacade = class {
    * **Atomic create-and-enroll for managed-mode vaults.**
    *
    * Bootstraps a managed-mode vault and enrolls strong recovery in
-   * a single ceremony. Under `passphraseMode: 'managed'`, every
+   * a single ceremony. Under `secretMode: 'managed'`, every
    * `openVault` call requires a strong recovery profile (Shamir
    * today) to be enrolled — otherwise it throws
    * {@link ManagedRecoveryNotEnrolledError}. This method bypasses
@@ -12285,11 +11955,11 @@ var TeamFacade = class {
    * ```ts
    * const db = await createNoydb({
    *   store, user: 'alice',
-   *   passphraseMode: 'managed',
+   *   secretMode: 'managed',
    *   sealingKey: macosKeychainSealingProvider({ ... }),
    * })
    *
-   * const { vault, recoveryEnrollments } = await db.openVaultAndEnrollRecovery('acme', {
+   * const { vault, recoveryEnrollments } = await db.team.openVaultAndEnrollRecovery('acme', {
    *   recovery: [{ profile: 'shamir', k: 2, n: 3 }],
    * })
    * for (const r of recoveryEnrollments) {
@@ -12306,11 +11976,11 @@ var TeamFacade = class {
         "openVaultAndEnrollRecovery: at least one recovery enrollment is required."
       );
     }
-    if (this.deps.options.passphraseMode === "managed") {
+    if (this.deps.options.secretMode === "managed") {
       const hasStrong = opts.recovery.some((r) => r.profile === "shamir");
       if (!hasStrong) {
         throw new ValidationError(
-          'openVaultAndEnrollRecovery: managed-mode vaults require at least one strong recovery profile in the `recovery` array. Paper alone is not strong under managed mode (no user passphrase to fall back on). Include { profile: "shamir", k, n } in `recovery`.'
+          'openVaultAndEnrollRecovery: managed-mode vaults require at least one strong recovery profile in the `recovery` array. Paper alone is not strong under managed mode (no user secret to fall back on). Include { profile: "shamir", k, n } in `recovery`.'
         );
       }
     }
@@ -12325,7 +11995,7 @@ var TeamFacade = class {
     for (const enrollment of opts.recovery) {
       recoveryEnrollments.push(await this.enrollRecovery(vault, enrollment));
     }
-    if (this.deps.options.passphraseMode === "managed") {
+    if (this.deps.options.secretMode === "managed") {
       const policy = this.deps.policyCache.get(vault);
       if (policy) {
         await this.deps.assertRecoveryEnrolled(vault, policy);
@@ -12334,20 +12004,20 @@ var TeamFacade = class {
     return { vault: vaultHandle, recoveryEnrollments };
   }
   /**
-   * **Recovery flow under managed-passphrase mode.**
+   * **Recovery flow under managed-secret mode.**
    *
-   * Replaces the sealed passphrase of a managed-mode vault with a
+   * Replaces the sealed secret of a managed-mode vault with a
    * fresh 256-bit random, sealed under the configured
-   * `SealingKeyProvider`. The user never sees the new passphrase.
+   * `SealingKeyProvider`. The user never sees the new secret.
    *
    * Internally:
    *   1. Verify the recovery proof (Shamir today) and unwrap the
    *      DEK set.
-   *   2. Mint a fresh 256-bit random as the new effective passphrase.
+   *   2. Mint a fresh 256-bit random as the new effective secret.
    *   3. Rewrap the DEK set under a fresh KEK derived from the new
-   *      passphrase (via the existing `recoverPassphrase` path).
+   *      secret (via the existing `recoverSecret` path).
    *   4. Seal the random bytes under the provider and overwrite
-   *      `_meta/sealed-passphrase`.
+   *      `_meta/sealed-secret`.
    *   5. Drop the keyring cache so the next operation re-derives.
    *
    * The vault's strong-recovery enrollment is preserved across
@@ -12355,40 +12025,40 @@ var TeamFacade = class {
    *
    * @throws ValidationError if the Noydb instance is not in managed mode.
    */
-  async recoverManagedPassphrase(vault, options) {
-    if (this.deps.options.passphraseMode !== "managed") {
+  async recoverManagedSecret(vault, options) {
+    if (this.deps.options.secretMode !== "managed") {
       throw new ValidationError(
-        "recoverManagedPassphrase: this method only applies to vaults opened in managed-passphrase mode. For standard mode, use db.recoverPassphrase."
+        "recoverManagedSecret: this method only applies to vaults opened in managed-secret mode. For standard mode, use db.recoverSecret."
       );
     }
     const provider = this.deps.options.sealingKey;
     if (!provider) {
       throw new ValidationError(
-        'recoverManagedPassphrase: createNoydb({ passphraseMode: "managed" }) requires `sealingKey` to be supplied; without it the new sealed passphrase cannot be persisted.'
+        'recoverManagedSecret: createNoydb({ secretMode: "managed" }) requires `sealingKey` to be supplied; without it the new sealed secret cannot be persisted.'
       );
     }
     const randomBytes = new Uint8Array(32);
     globalThis.crypto.getRandomValues(randomBytes);
     let binary = "";
     for (let i = 0; i < randomBytes.length; i++) binary += String.fromCharCode(randomBytes[i]);
-    const newPassphrase = btoa(binary);
+    const newSecret = btoa(binary);
     try {
       const sealed = await provider.seal(randomBytes);
-      await recoverPassphrase(
+      await recoverSecret(
         this.deps.options.shamirRecovery,
         this.deps.options.store,
         vault,
         this.deps.options.user,
         {
-          newPassphrase,
+          newSecret,
           recoveryProof: options.recoveryProof,
-          // The new passphrase IS 256 bits of random; policy gates on
+          // The new secret IS 256 bits of random; policy gates on
           // length/entropy don't apply.
-          allowWeakPassphrase: true,
-          ...options.passphrasePolicy !== void 0 ? { passphrasePolicy: options.passphrasePolicy } : {}
+          allowWeakSecret: true,
+          ...options.secretPolicy !== void 0 ? { secretPolicy: options.secretPolicy } : {}
         }
       );
-      await saveSealedPassphrase(this.deps.options.store, vault, {
+      await saveSealedSecret(this.deps.options.store, vault, {
         providerId: provider.id,
         sealed
       });
@@ -12399,7 +12069,7 @@ var TeamFacade = class {
   }
   /**
    * Atomic peer-recovery — re-wraps an EXISTING user's keyring under
-   * a fresh temp passphrase in a single store write. Closes the
+   * a fresh temp secret in a single store write. Closes the
    * partial-failure window (the previous compose-from-primitives
    * pattern was `db.revoke + db.grant`, two writes — if the issuer
    * cancelled between them the target was locked out entirely).
@@ -12418,17 +12088,17 @@ var TeamFacade = class {
    * recovery / TOTP / email-OTP factor proof at the moment of
    * recovery, so the issuer affirmatively re-asserts identity.
    *
-   * The recipient should call `db.rotatePassphrase` on first session
+   * The recipient should call `db.rotateSecret` on first session
    * to choose their own phrase — the temp acts as a single-use
    * bridge.
    *
    * ```ts
-   * await db.recoverUser('acme', {
+   * await db.team.recoverUser('acme', {
    *   userId: 'bob',
-   *   passphrase: 'temporary-correct-horse-battery-staple-printer',
+   *   secret: 'temporary-correct-horse-battery-staple-printer',
    * }, { factors: [{ kind: 'recovery' }] })
    * // Bob opens createNoydb({ user: 'bob', secret: tempPhrase })
-   * // and immediately calls db.rotatePassphrase to set his own.
+   * // and immediately calls db.rotateSecret to set his own.
    * ```
    *
    * @throws `NoAccessError` when no keyring exists for the target.
@@ -12454,17 +12124,17 @@ var TeamFacade = class {
    * The hub wraps the user's DEK set (not the KEK) under a code-derived
    * AES-GCM key — see `team/recovery.ts` for the rationale. The mint
    * helper {@link mintPaperRecoveryEntry} is the canonical primitive;
-   * pair it with `db.getKeyring(vault)` to obtain the live DEK set:
+   * pair it with `db.team.getKeyring(vault)` to obtain the live DEK set:
    *
    * ```ts
    * import { mintPaperRecoveryEntry } from '@noy-db/hub'
    *
-   * const keyring = await db.getKeyring('acme')
+   * const keyring = await db.team.getKeyring('acme')
    * const codes: string[] = ['CORRECT-HORSE-1', 'BATTERY-STAPLE-2', ...]
    * const entries = await Promise.all(
    *   codes.map((code, i) => mintPaperRecoveryEntry(keyring.deks, code, `code-${i}`)),
    * )
-   * await db.enrollRecovery('acme', { profile: 'paper', entries })
+   * await db.team.enrollRecovery('acme', { profile: 'paper', entries })
    * showCodesToUser(codes)
    * ```
    *
@@ -12475,7 +12145,7 @@ var TeamFacade = class {
    * ```ts
    * import { generateRecoveryCodeSet } from '@noy-db/on-recovery'
    * const { codes, entries } = await generateRecoveryCodeSet({ deks: keyring.deks, count: 8 })
-   * await db.enrollRecovery('acme', { profile: 'paper', entries })
+   * await db.team.enrollRecovery('acme', { profile: 'paper', entries })
    * ```
    */
   async enrollRecovery(vault, enrollment) {
@@ -12575,7 +12245,7 @@ var TeamFacade = class {
    * and no `secret` / `getKeyring` is configured.
    *
    * ```ts
-   * const keyring = await db.getKeyring('acme')
+   * const keyring = await db.team.getKeyring('acme')
    * // keyring.deks: Map<collection, CryptoKey>
    * // keyring.kek:  CryptoKey | null   (null for tier-3 / wrap-DEKs sessions)
    * // keyring.role / .permissions / .authenticators
@@ -12652,7 +12322,7 @@ var Noydb = class {
   keyringCache = /* @__PURE__ */ new Map();
   syncEngines = /* @__PURE__ */ new Map();
   /**
-   * Per-vault active session tier — defaults to `1` after a passphrase
+   * Per-vault active session tier — defaults to `1` after a secret
    * unlock; tier-2 / tier-3 unlocks downgrade it. Used by
    * {@link checkGate} to evaluate `gate.minTier`.
    */
@@ -12680,26 +12350,43 @@ var Noydb = class {
   writeRelay;
   /** Per-vault policy enforcers. */
   policyEnforcers = /* @__PURE__ */ new Map();
-  txStrategy;
-  forgetStrategy;
   /**
-   * Opt-in sovereign-custody (FR-6) strategy — `NO_CUSTODY` (throwing) unless
-   * `withCustody()` was passed. Public so `Vault` routes `vault.custody.liberate`
-   * through it; grant/revoke route through it from this class. @internal
+   * Every opt-in service, resolved once (#838). Shared by reference with each
+   * `Vault` this instance opens and, through them, every `Collection` — so
+   * there is exactly one resolution and no construction path can disagree
+   * about which services are enabled (the #834 bug class).
    */
-  custodyStrategy;
+  strategies;
   /**
-   * Opt-in multi-user team strategy (#267 keyring-grant → team split) —
-   * `NO_TEAM` (throwing) unless `withTeam()` was passed; the keyring
-   * engines are linked only by the active strategy, not by this file. */
-  teamStrategy;
-  sessionStrategy;
-  syncStrategy;
+   * Opt-in sovereign-custody (FR-6) strategy — `NO_CUSTODY` (throwing) unless
+   * `withCustody()` was passed. Kept as a public accessor because `Vault`
+   * routes `vault.custody.liberate` through `this.noydb.custodyStrategy`.
+   * @internal
+   */
+  get custodyStrategy() {
+    return this.strategies.custody;
+  }
   snapshots;
   policyManager;
   /** Pre-resolved policy-gate engine function (mirrors `coordinationProvider`/`userApiFactory` above). */
   policyCheckGate;
-  team;
+  /**
+   * Credential and multi-user operations — enrolment, secret rotation,
+   * recovery, quick-unlock (#846).
+   *
+   * Public because 23 methods on this class did nothing but restate a
+   * TeamFacade signature and forward to it, so every signature had to be
+   * hand-kept in sync with its counterpart. `db.team.rotateSecret(…)`
+   * reads the same and has one source of truth.
+   *
+   * A getter, not a field, so it appears in the prototype-based kernel API
+   * manifest — an instance field is invisible to it (the same reason
+   * `custodyStrategy` became one in #838).
+   */
+  get team() {
+    return this.#team;
+  }
+  #team;
   /**
    * Currently-running multi-record transaction, set by
    * `runTransaction` at the start of Phase 2 (commit) and cleared in
@@ -12738,14 +12425,9 @@ var Noydb = class {
     this.userApiFactory = options.userApiFactory;
     if (!options.policyFactory || !options.policyCheckGateFn) throw new ValidationError("Noydb must be constructed via createNoydb(), which resolves the default policy service.");
     this.policyCheckGate = options.policyCheckGateFn;
-    this.txStrategy = options.txStrategy ?? NO_TX;
-    this.forgetStrategy = options.forgetStrategy ?? NO_FORGET;
-    this.custodyStrategy = options.custodyStrategy ?? NO_CUSTODY;
-    this.teamStrategy = options.teamStrategy ?? NO_TEAM;
-    this.sessionStrategy = options.sessionStrategy ?? NO_SESSION;
-    this.syncStrategy = options.syncStrategy ?? NO_SYNC;
+    this.strategies = resolveStrategies(options);
     this.snapshots = new NoydbSnapshots({
-      strategy: options.snapshotStrategy ?? NO_SNAPSHOTS,
+      strategy: this.strategies.snapshots,
       user: options.user,
       isClosed: () => this.closed,
       getVault: (name) => this.vaultCache.get(name),
@@ -12766,7 +12448,7 @@ var Noydb = class {
         this.vaultCache.delete(vault);
       }
     });
-    this.team = new TeamFacade({
+    this.#team = new TeamFacade({
       options: this.options,
       keyringCache: this.keyringCache,
       activeTier: this.activeTier,
@@ -12782,7 +12464,7 @@ var Noydb = class {
       }
     });
     if (options.sessionPolicy) {
-      this.sessionStrategy.validateSessionPolicy(options.sessionPolicy);
+      this.strategies.session.validateSessionPolicy(options.sessionPolicy);
     }
     this.#registerGuardGate();
     this.#registerPeriodGate();
@@ -12791,9 +12473,9 @@ var Noydb = class {
   }
   /** @internal — resolved forget strategy (NO_FORGET when not configured). */
   get _forgetStrategy() {
-    return this.forgetStrategy;
+    return this.strategies.forget;
   }
-  // GDPR subject-index maintenance. When `withForgetCascade` declares
+  // GDPR subject-index maintenance. When `withForget` declares
   // any subject fields, keep the encrypted `_subject_index` in lock-step with
   // writes so `vault.forget(subjectId)` can find every record for a subject.
   //
@@ -12804,7 +12486,7 @@ var Noydb = class {
   //     does NOT) — drop the ref so a deleted record never lingers in the
   //     index (RISK #2). Without it, forget() would try to shred a ghost.
   #registerForgetHooks() {
-    const subjects = this.forgetStrategy.subjects;
+    const subjects = this.strategies.forget.subjects;
     if (Object.keys(subjects).length === 0) return;
     const subjectFieldFor = (collection) => subjects[collection];
     this.writeHooks.onAfterWrite(async (event) => {
@@ -12868,7 +12550,7 @@ var Noydb = class {
       if (!facade) return;
       const ctx = { existing, vault: facade, userId: e.userId, role: e.role };
       await registry.runChecks(e.collection, incoming, ctx);
-      const { GuardExecutor } = await import("./executor-KGNLJD6M.js");
+      const { GuardExecutor } = await import("./executor-RM7XWQDU.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, e.docId, existing, incoming, e.computedFieldNames);
       }
@@ -12992,8 +12674,9 @@ var Noydb = class {
     const targets = normalizeSyncTargets(this.options.sync);
     if (targets.length > 0) {
       const primary = targets.find((t) => t.role === "sync-peer") ?? targets[0];
-      const effectivePolicy = this.options.syncPolicy ?? primary.policy ?? INDEXED_STORE_POLICY;
-      syncEngine = this.syncStrategy.buildSyncEngine({
+      const declaredPolicy = this.options.syncPolicy ?? primary.policy;
+      const effectivePolicy = declaredPolicy ?? INDEXED_STORE_POLICY;
+      syncEngine = this.strategies.sync.buildSyncEngine({
         local: this.options.store,
         remote: primary.store,
         vault: name,
@@ -13004,10 +12687,11 @@ var Noydb = class {
         ...primary.label !== void 0 ? { label: primary.label } : {}
       });
       this.syncEngines.set(name, syncEngine);
+      if (declaredPolicy) syncEngine.startScheduler();
       for (const target of targets) {
         if (target === primary) continue;
         const targetPolicy = target.policy ?? this.options.syncPolicy ?? INDEXED_STORE_POLICY;
-        const engine = this.syncStrategy.buildSyncEngine({
+        const engine = this.strategies.sync.buildSyncEngine({
           local: this.options.store,
           remote: target.store,
           vault: name,
@@ -13019,6 +12703,7 @@ var Noydb = class {
         });
         const key = `${name}::${target.label ?? target.role}`;
         this.syncEngines.set(key, engine);
+        if (target.policy ?? this.options.syncPolicy) engine.startScheduler();
       }
     }
     const comp = new Vault({
@@ -13040,31 +12725,14 @@ var Noydb = class {
       syncAdapter: targets.length > 0 ? targets[0].store : void 0,
       getPurgeableTargets: () => targets.filter((t) => t.role === "backup" || t.role === "archive").map((t) => ({ store: t.store, role: t.role, ...t.label !== void 0 ? { label: t.label } : {} })),
       historyConfig: this.options.history,
-      ...this.options.blobStrategy !== void 0 ? { blobStrategy: this.options.blobStrategy } : {},
+      // #838 — the 21 conditional strategy spreads that used to live here are
+      // one shared reference. This block is where #834's drift happened: a
+      // copy of it silently omitted six strategies, and there was nothing to
+      // catch that. There is no longer a per-service line to omit.
+      strategies: this.strategies,
       ...this.options.objectStore !== void 0 ? { objectStore: this.options.objectStore } : {},
-      ...this.options.archiveStrategy !== void 0 ? { archiveStrategy: this.options.archiveStrategy } : {},
-      ...this.options.indexStrategy !== void 0 ? { indexStrategy: this.options.indexStrategy } : {},
-      ...this.options.lazyStrategy !== void 0 ? { lazyStrategy: this.options.lazyStrategy } : {},
-      ...this.options.aggregateStrategy !== void 0 ? { aggregateStrategy: this.options.aggregateStrategy } : {},
-      ...this.options.crdtStrategy !== void 0 ? { crdtStrategy: this.options.crdtStrategy } : {},
-      ...this.options.tiersStrategy !== void 0 ? { tiersStrategy: this.options.tiersStrategy } : {},
-      ...this.options.searchStrategy !== void 0 ? { searchStrategy: this.options.searchStrategy } : {},
-      ...this.options.cargoStrategy !== void 0 ? { cargoStrategy: this.options.cargoStrategy } : {},
-      ...this.options.brokerStrategy !== void 0 ? { brokerStrategy: this.options.brokerStrategy } : {},
-      ...this.options.consentStrategy !== void 0 ? { consentStrategy: this.options.consentStrategy } : {},
-      ...this.options.periodsStrategy !== void 0 ? { periodsStrategy: this.options.periodsStrategy } : {},
-      ...this.options.shadowStrategy !== void 0 ? { shadowStrategy: this.options.shadowStrategy } : {},
-      ...this.options.historyStrategy !== void 0 ? { historyStrategy: this.options.historyStrategy } : {},
-      ...this.options.i18nStrategy !== void 0 ? { i18nStrategy: this.options.i18nStrategy } : {},
-      ...this.options.syncStrategy !== void 0 ? { syncStrategy: this.options.syncStrategy } : {},
       ...this.options.guardStrategies !== void 0 ? { guardStrategies: this.options.guardStrategies } : {},
       ...this.options.numbering !== void 0 ? { numberingConfigs: this.options.numbering } : {},
-      forgetStrategy: this.forgetStrategy,
-      ...this.options.attestationStrategy !== void 0 ? { attestationStrategy: this.options.attestationStrategy } : {},
-      ...this.options.classifiedStrategy !== void 0 ? { classifiedStrategy: this.options.classifiedStrategy } : {},
-      ...this.options.sealedRecordStrategy !== void 0 ? { sealedRecordStrategy: this.options.sealedRecordStrategy } : {},
-      ...this.options.portabilityStrategy !== void 0 ? { portabilityStrategy: this.options.portabilityStrategy } : {},
-      ...this.options.sequenceStrategy !== void 0 ? { sequenceStrategy: this.options.sequenceStrategy } : {},
       locale: opts?.locale,
       ...opts?.meta !== void 0 ? { meta: opts.meta } : {},
       // Thread the translator hook so Collection.put() can invoke it
@@ -13076,12 +12744,10 @@ var Noydb = class {
       // compartments leave it null and load() skips the refresh.
       reloadKeyring: this.options.encrypt !== false && this.options.secret ? async () => {
         this.keyringCache.delete(name);
-        const refreshed = await loadKeyring(
-          this.options.store,
-          name,
-          this.options.user,
-          this.options.secret
-        );
+        const refreshed = await loadKeyring(this.options.store, name, {
+          userId: this.options.user,
+          secret: this.options.secret
+        });
         this.keyringCache.set(name, refreshed);
         return refreshed;
       } : void 0
@@ -13091,6 +12757,7 @@ var Noydb = class {
       engine.setGraphBatchController({ begin: () => comp._beginGraphBatch(), flush: () => comp._flushGraphBatch() });
       engine.setReservedLookupSource({ collections: () => comp._reservedLookupCollectionNames() });
       engine.setReservedDictExpander((names) => comp._reservedDictDepsOf(names));
+      engine.setPeriodPullSource({ periods: () => comp.listPeriods() });
     });
     await comp._initGuards(this.options.guardStrategies ?? []);
     await comp._initDerivations(this.options.derivationStrategies ?? []);
@@ -13100,85 +12767,25 @@ var Noydb = class {
     this.vaultCache.set(name, comp);
     return comp;
   }
-  /** Synchronous vault access (must call openVault first, or auto-opens). */
+  /**
+   * Synchronous access to an ALREADY-OPEN vault.
+   *
+   * Returns the instance `openVault()` produced, or throws — it never
+   * constructs. It used to fall back to building a Vault itself (once for
+   * plaintext, once for encrypted-with-cached-keyring), and those copies
+   * drifted from the real open path: the encrypted one silently omitted six
+   * strategies, so a vault reached this way threw `*NotEnabledError` for
+   * services the caller had configured (#834). Both fallbacks also skipped
+   * the async registry init and schema-fence snapshot that `openVault`
+   * performs, which a synchronous method cannot await. One construction
+   * path is the only way that divergence stays fixed.
+   */
   vault(name) {
     const cached = this.vaultCache.get(name);
     if (cached) return cached;
-    if (this.options.encrypt === false) {
-      const keyring2 = createPlaintextKeyring(this.options.user, this.options.debugPlaintext === true);
-      const comp2 = new Vault({
-        adapter: this.options.store,
-        name,
-        noydb: this,
-        keyring: keyring2,
-        encrypted: false,
-        emitter: this.emitter,
-        historyConfig: this.options.history,
-        ...this.options.blobStrategy !== void 0 ? { blobStrategy: this.options.blobStrategy } : {},
-        ...this.options.objectStore !== void 0 ? { objectStore: this.options.objectStore } : {},
-        ...this.options.archiveStrategy !== void 0 ? { archiveStrategy: this.options.archiveStrategy } : {},
-        ...this.options.indexStrategy !== void 0 ? { indexStrategy: this.options.indexStrategy } : {},
-        ...this.options.lazyStrategy !== void 0 ? { lazyStrategy: this.options.lazyStrategy } : {},
-        ...this.options.aggregateStrategy !== void 0 ? { aggregateStrategy: this.options.aggregateStrategy } : {},
-        ...this.options.crdtStrategy !== void 0 ? { crdtStrategy: this.options.crdtStrategy } : {},
-        ...this.options.tiersStrategy !== void 0 ? { tiersStrategy: this.options.tiersStrategy } : {},
-        ...this.options.searchStrategy !== void 0 ? { searchStrategy: this.options.searchStrategy } : {},
-        ...this.options.cargoStrategy !== void 0 ? { cargoStrategy: this.options.cargoStrategy } : {},
-        ...this.options.brokerStrategy !== void 0 ? { brokerStrategy: this.options.brokerStrategy } : {},
-        ...this.options.consentStrategy !== void 0 ? { consentStrategy: this.options.consentStrategy } : {},
-        ...this.options.periodsStrategy !== void 0 ? { periodsStrategy: this.options.periodsStrategy } : {},
-        ...this.options.shadowStrategy !== void 0 ? { shadowStrategy: this.options.shadowStrategy } : {},
-        ...this.options.historyStrategy !== void 0 ? { historyStrategy: this.options.historyStrategy } : {},
-        ...this.options.i18nStrategy !== void 0 ? { i18nStrategy: this.options.i18nStrategy } : {},
-        ...this.options.syncStrategy !== void 0 ? { syncStrategy: this.options.syncStrategy } : {},
-        ...this.options.guardStrategies !== void 0 ? { guardStrategies: this.options.guardStrategies } : {},
-        ...this.options.numbering !== void 0 ? { numberingConfigs: this.options.numbering } : {},
-        forgetStrategy: this.forgetStrategy,
-        ...this.options.attestationStrategy !== void 0 ? { attestationStrategy: this.options.attestationStrategy } : {},
-        ...this.options.classifiedStrategy !== void 0 ? { classifiedStrategy: this.options.classifiedStrategy } : {},
-        ...this.options.sealedRecordStrategy !== void 0 ? { sealedRecordStrategy: this.options.sealedRecordStrategy } : {},
-        ...this.options.portabilityStrategy !== void 0 ? { portabilityStrategy: this.options.portabilityStrategy } : {},
-        ...this.options.sequenceStrategy !== void 0 ? { sequenceStrategy: this.options.sequenceStrategy } : {}
-      });
-      this.vaultCache.set(name, comp2);
-      return comp2;
-    }
-    const keyring = this.keyringCache.get(name);
-    if (!keyring) {
-      throw new ValidationError(
-        `Vault "${name}" not opened. Use await db.openVault("${name}") first.`
-      );
-    }
-    const comp = new Vault({
-      adapter: this.options.store,
-      name,
-      noydb: this,
-      keyring,
-      encrypted: true,
-      historyConfig: this.options.history,
-      ...this.options.blobStrategy !== void 0 ? { blobStrategy: this.options.blobStrategy } : {},
-      ...this.options.objectStore !== void 0 ? { objectStore: this.options.objectStore } : {},
-      ...this.options.archiveStrategy !== void 0 ? { archiveStrategy: this.options.archiveStrategy } : {},
-      ...this.options.indexStrategy !== void 0 ? { indexStrategy: this.options.indexStrategy } : {},
-      ...this.options.lazyStrategy !== void 0 ? { lazyStrategy: this.options.lazyStrategy } : {},
-      ...this.options.aggregateStrategy !== void 0 ? { aggregateStrategy: this.options.aggregateStrategy } : {},
-      ...this.options.crdtStrategy !== void 0 ? { crdtStrategy: this.options.crdtStrategy } : {},
-      ...this.options.tiersStrategy !== void 0 ? { tiersStrategy: this.options.tiersStrategy } : {},
-      ...this.options.searchStrategy !== void 0 ? { searchStrategy: this.options.searchStrategy } : {},
-      ...this.options.cargoStrategy !== void 0 ? { cargoStrategy: this.options.cargoStrategy } : {},
-      ...this.options.brokerStrategy !== void 0 ? { brokerStrategy: this.options.brokerStrategy } : {},
-      ...this.options.consentStrategy !== void 0 ? { consentStrategy: this.options.consentStrategy } : {},
-      ...this.options.periodsStrategy !== void 0 ? { periodsStrategy: this.options.periodsStrategy } : {},
-      ...this.options.shadowStrategy !== void 0 ? { shadowStrategy: this.options.shadowStrategy } : {},
-      ...this.options.historyStrategy !== void 0 ? { historyStrategy: this.options.historyStrategy } : {},
-      ...this.options.i18nStrategy !== void 0 ? { i18nStrategy: this.options.i18nStrategy } : {},
-      ...this.options.syncStrategy !== void 0 ? { syncStrategy: this.options.syncStrategy } : {},
-      ...this.options.guardStrategies !== void 0 ? { guardStrategies: this.options.guardStrategies } : {},
-      ...this.options.numbering !== void 0 ? { numberingConfigs: this.options.numbering } : {},
-      emitter: this.emitter
-    });
-    this.vaultCache.set(name, comp);
-    return comp;
+    throw new ValidationError(
+      `Vault "${name}" is not open. Call \`await db.openVault("${name}")\` first \u2014 vault() only returns an already-open vault, because opening involves async work (registry init, schema fence) that a sync accessor cannot do.`
+    );
   }
   /**
    * Grant access to a user for a vault.
@@ -13192,7 +12799,7 @@ var Noydb = class {
    * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
    */
   async grant(vault, options, factors) {
-    return this.teamStrategy.grant(this.team, vault, options, factors);
+    return this.strategies.team.grant(this.team, vault, options, factors);
   }
   /**
    * Revoke a user's access to a vault.
@@ -13205,7 +12812,7 @@ var Noydb = class {
    * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
    */
   async revoke(vault, options, factors) {
-    return this.teamStrategy.revoke(this.team, vault, options, factors);
+    return this.strategies.team.revoke(this.team, vault, options, factors);
   }
   /**
    * Grant the FR-6 `custodian` role to a user (owner-only custody API).
@@ -13218,7 +12825,7 @@ var Noydb = class {
    * owner-only invariant even if a host mis-configures the gate.
    */
   async grantCustodian(vault, options, factors) {
-    return this.custodyStrategy.grantCustodian(this, vault, options, factors);
+    return this.strategies.custody.grantCustodian(this, vault, options, factors);
   }
   /** @internal — grant-custodian engine, reached only via withCustody(); the
    * keyring engine arrives as an argument so the floor never carries it (#267). */
@@ -13237,7 +12844,7 @@ var Noydb = class {
    * 'owner'` check, so an admin cannot unwind a custodianship.
    */
   async revokeCustodian(vault, options, factors) {
-    return this.custodyStrategy.revokeCustodian(this, vault, options, factors);
+    return this.strategies.custody.revokeCustodian(this, vault, options, factors);
   }
   /** @internal — revoke-custodian engine, reached only via withCustody().
    * Mirrors `_grantCustodianImpl` (#267: engine passed in). */
@@ -13299,16 +12906,26 @@ var Noydb = class {
   /**
    * Rotate the DEKs for the given collections in a vault.
    *
-   * Generates fresh DEKs, re-encrypts every record in each collection,
-   * and re-wraps the new DEKs into every remaining user's keyring. The
-   * old DEKs become unreachable — useful as a defense-in-depth measure
-   * after a suspected key leak, or as the scheduled half of a
-   * key-rotation policy.
+   * Generates fresh DEKs and re-encrypts every record in each collection.
+   * The old DEKs become unreachable — useful as a defense-in-depth measure
+   * after a suspected key leak, or as the scheduled half of a key-rotation
+   * policy.
    *
-   * Unlike `revoke({ rotateKeys: true })`, this call does NOT remove
-   * any users — every current member keeps access, but with fresh
-   * keys. This is the "just rotate" path; the "revoke and rotate"
-   * path still lives in `revoke()`.
+   * ## Other members LOSE access to the rotated collections (#854)
+   *
+   * A member's DEKs are wrapped under that member's KEK, and a KEK derives
+   * only from that member's secret. The caller cannot derive anyone else's
+   * KEK, so re-wrapping a fresh DEK for them is impossible — that is the
+   * zero-knowledge property working as designed. Rotation therefore DROPS
+   * the rotated collections from every other member's keyring.
+   *
+   * The returned {@link RotateResult.needsRegrant} names each (member,
+   * collection) pair that was dropped. Re-run `grant()` for those pairs, or
+   * they stay locked out.
+   *
+   * Unlike `revoke({ rotateKeys: true })`, this call does not REMOVE any
+   * user from the vault — they keep membership and their other collections.
+   * This is the "just rotate" path; "revoke and rotate" lives in `revoke()`.
    *
    * Exposed on Noydb (rather than only on the lower-level keyring
    * module) so CLI and admin tooling can trigger rotation without
@@ -13316,7 +12933,7 @@ var Noydb = class {
    * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
    */
   async rotate(vault, collections) {
-    return this.teamStrategy.rotate(this.team, vault, collections);
+    return this.strategies.team.rotate(this.team, vault, collections);
   }
   /** List all users with access to a vault. */
   async listUsers(vault) {
@@ -13329,9 +12946,9 @@ var Noydb = class {
    *
    * The walk is a two-step pipeline: first ask the adapter for the
    * universe of compartments it stores, then for each one attempt to
-   * load the calling user's keyring with the in-memory passphrase.
+   * load the calling user's keyring with the in-memory secret.
    * Compartments where the user has no keyring file (`NoAccessError`)
-   * or where the passphrase doesn't unwrap (`InvalidKeyError`) are
+   * or where the secret doesn't unwrap (`InvalidKeyError`) are
    * silently dropped from the result — the existence of those
    * compartments is **not** confirmed in the return value.
    *
@@ -13352,15 +12969,15 @@ var Noydb = class {
    * **Known edge case.** A vault whose keyring file
    * happens to have an empty wrapped-DEKs map (because the owner
    * granted access before any collection was created) will pass the
-   * `loadKeyring` probe with *any* passphrase — there are no DEKs to
+   * `loadKeyring` probe with *any* secret — there are no DEKs to
    * unwrap, so the integrity-checked unwrap that normally rejects
-   * wrong passphrases never runs. The result is that an unrelated
+   * wrong secrets never runs. The result is that an unrelated
    * principal who happens to know the user-id and the vault
    * name can show up in `listAccessibleVaults()` as having
    * access to that empty vault. They cannot read any actual
    * data (their DEK set is empty), so this is a metadata leak
    * (vault name + user-id), not a content leak. Hardening this
-   * via a passphrase canary in the keyring file is a deferred
+   * via a secret canary in the keyring file is a deferred
    * follow-up.
    *
    * **Cost.** O(compartments × keyring-load) — one `loadKeyring`
@@ -13401,7 +13018,7 @@ var Noydb = class {
     }
     if (!this.options.secret) {
       throw new ValidationError(
-        "Noydb.listAccessibleVaults(): a secret (passphrase) is required when encryption is enabled."
+        "Noydb.listAccessibleVaults(): a secret (secret) is required when encryption is enabled."
       );
     }
     const minRank = ROLE_RANK[options.minRole ?? "client"];
@@ -13410,12 +13027,10 @@ var Noydb = class {
     for (const vault of universe) {
       let keyring;
       try {
-        keyring = await loadKeyring(
-          adapter,
-          vault,
-          this.options.user,
-          this.options.secret
-        );
+        keyring = await loadKeyring(adapter, vault, {
+          userId: this.options.user,
+          secret: this.options.secret
+        });
       } catch (err) {
         if (err instanceof NoAccessError || err instanceof InvalidKeyError || err instanceof KeyringCorruptError) {
           continue;
@@ -13476,7 +13091,7 @@ var Noydb = class {
    * })
    * ```
    */
-  async queryAcross(vaultIds, fn2, options = {}) {
+  async queryAcross(vaultIds, fn, options = {}) {
     if (this.closed) throw new ValidationError("Instance is closed");
     this.resetSessionTimer();
     const concurrency = Math.max(1, options.concurrency ?? 1);
@@ -13490,7 +13105,7 @@ var Noydb = class {
       const task = (async () => {
         try {
           const comp = await this.openVault(vaultId, { create: options.create !== false });
-          const result = await fn2(comp);
+          const result = await fn(comp);
           results[idx] = { vault: vaultId, result };
         } catch (err) {
           results[idx] = {
@@ -13540,23 +13155,20 @@ var Noydb = class {
     return store.resolveBackend ? store.resolveBackend(vaultId) : this.options.store;
   }
   /**
-   * Change the current user's passphrase for a vault.
+   * Change the current user's secret for a vault.
    *
-   * Validates the new passphrase against the strength rules. Pass
-   * `{ allowWeakPassphrase: true }` to skip — typically only useful for
-   * fixtures and migrations. Pass a `PassphrasePolicy` to override the
+   * Validates the new secret against the strength rules. Pass
+   * `{ allowWeakSecret: true }` to skip — typically only useful for
+   * fixtures and migrations. Pass a `SecretPolicy` to override the
    * default rules (e.g. consumer-tunable `pattern` / `customValidator`).
    */
-  async changeSecret(vault, newPassphrase, options) {
+  async changeSecret(vault, newSecret, options) {
     this.checkPolicyOperation(vault, "changeSecret");
     const keyring = await this._getKeyringInternal(vault);
-    const updated = await changeSecret(
-      this.options.store,
-      vault,
-      keyring,
-      newPassphrase,
-      options
-    );
+    const updated = await changeSecret(this.options.store, vault, keyring, {
+      ...options,
+      newSecret
+    });
     this.keyringCache.set(vault, updated);
   }
   // ─── Sync ──────────────────────────────────────────────────────
@@ -13606,7 +13218,7 @@ var Noydb = class {
   }
   transaction(arg, maybeFn) {
     if (typeof arg === "function") {
-      return this.txStrategy.runTransaction(this, arg);
+      return this.strategies.transactions.runTransaction(this, arg);
     }
     if (typeof arg === "object" && arg !== null && arg.dryRun === true) {
       if (typeof maybeFn !== "function") {
@@ -13614,7 +13226,7 @@ var Noydb = class {
           "db.transaction({ dryRun: true }, fn) requires the callback as the second argument."
         );
       }
-      return this.txStrategy.runDryRun(this, maybeFn);
+      return this.strategies.transactions.runDryRun(this, maybeFn);
     }
     if (typeof arg === "object" && arg !== null && arg.amendment === true) {
       if (typeof maybeFn !== "function") {
@@ -13622,7 +13234,7 @@ var Noydb = class {
           "db.transaction({ amendment: true }, fn) requires the callback as the second argument."
         );
       }
-      return this.txStrategy.runTransaction(this, maybeFn, arg);
+      return this.strategies.transactions.runTransaction(this, maybeFn, arg);
     }
     const vault = arg;
     const comp = this.vaultCache.get(vault);
@@ -13632,7 +13244,7 @@ var Noydb = class {
       );
     }
     const engine = this.getSyncEngine(vault);
-    return this.syncStrategy.buildSyncTransaction(comp, engine);
+    return this.strategies.sync.buildSyncTransaction(comp, engine);
   }
   /**
    * Internal accessor for the primary store — used by the tx
@@ -13712,8 +13324,8 @@ var Noydb = class {
     }
     return engine;
   }
-  _forEachSyncEngine(vault, fn2) {
-    for (const [key, engine] of this.syncEngines) if (key === vault || key.startsWith(`${vault}::`)) fn2(engine);
+  _forEachSyncEngine(vault, fn) {
+    for (const [key, engine] of this.syncEngines) if (key === vault || key.startsWith(`${vault}::`)) fn(engine);
   }
   // ─── Events ────────────────────────────────────────────────────
   on(event, handler) {
@@ -13757,9 +13369,9 @@ var Noydb = class {
     return this.writeHooks.onAfterWrite(handler);
   }
   /** Subscribe to cross-tab write conflicts. Returns an unsubscribe. */
-  onWriteConflict(fn2) {
-    this.on("write:conflict", fn2);
-    return () => this.off("write:conflict", fn2);
+  onWriteConflict(fn) {
+    this.on("write:conflict", fn);
+    return () => this.off("write:conflict", fn);
   }
   /**
    * Enable same-device multi-tab coordination: primary/secondary
@@ -13833,12 +13445,12 @@ var Noydb = class {
   activeTabs() {
     return this.tabCoordinator?.activeTabs() ?? [];
   }
-  onTabRoleChange(fn2) {
-    return this.tabCoordinator?.onTabRoleChange(fn2) ?? (() => {
+  onTabRoleChange(fn) {
+    return this.tabCoordinator?.onTabRoleChange(fn) ?? (() => {
     });
   }
-  onActiveTabsChange(fn2) {
-    return this.tabCoordinator?.onActiveTabsChange(fn2) ?? (() => {
+  onActiveTabsChange(fn) {
+    return this.tabCoordinator?.onActiveTabsChange(fn) ?? (() => {
     });
   }
   /** @internal The write-hook registry, threaded into each Collection. */
@@ -13905,6 +13517,7 @@ var Noydb = class {
   close() {
     this.closed = true;
     this.snapshots.stop();
+    for (const engine of this.syncEngines.values()) engine.stopScheduler();
     if (this.sessionTimer) {
       clearTimeout(this.sessionTimer);
       this.sessionTimer = null;
@@ -13913,7 +13526,7 @@ var Noydb = class {
       enforcer.destroy();
     }
     this.policyEnforcers.clear();
-    this.sessionStrategy.revokeAllSessions();
+    this.strategies.session.revokeAllSessions();
     for (const engine of this.syncEngines.values()) {
       engine.stopAutoSync();
     }
@@ -14035,7 +13648,7 @@ var Noydb = class {
    * denial; resolves with `void` on success.
    *
    * @param vault    The vault whose policy applies.
-   * @param gate     Gate name — built-in (e.g. `'rotate-passphrase'`)
+   * @param gate     Gate name — built-in (e.g. `'rotate-secret'`)
    *                 or app-defined (`app:*`).
    * @param presented Caller-supplied factor proofs.
    */
@@ -14060,12 +13673,12 @@ var Noydb = class {
    * Two enforcement modes:
    *
    * 1. **Managed-mode mandatory strong-recovery.** When
-   *    `passphraseMode === 'managed'`, the vault MUST have at least
+   *    `secretMode === 'managed'`, the vault MUST have at least
    *    one **strong** recovery profile (Shamir today). Paper alone is
    *    rejected because under managed mode the user has no memorized
-   *    passphrase, so losing the paper sheet = losing every record.
+   *    secret, so losing the paper sheet = losing every record.
    *    This check is unconditional — independent of `requireRecovery`
-   *    and the `recover-passphrase` gate.
+   *    and the `recover-secret` gate.
    *
    * 2. **Opt-in strict mandatory-recovery.** When
    *    `requireRecovery: true` is set on createNoydb (and the gate is
@@ -14079,14 +13692,14 @@ var Noydb = class {
    */
   async assertRecoveryEnrolled(vault, policy, opts) {
     const skipManaged = (opts?.skipManagedCheck ?? false) || this._skipNextManagedRecoveryCheck;
-    if (this.options.passphraseMode === "managed" && !skipManaged) {
+    if (this.options.secretMode === "managed" && !skipManaged) {
       const enrolled2 = await hasStrongRecoveryEnrolled(this.options.store, vault);
       if (!enrolled2) {
         throw new ManagedRecoveryNotEnrolledError(vault);
       }
     }
     if (this.options.requireRecovery !== true) return;
-    const gate = policy.gates["recover-passphrase"];
+    const gate = policy.gates["recover-secret"];
     if (gate?.enabled === false) return;
     const enrolled = await hasRecoveryEnrolled(this.options.store, vault);
     if (enrolled) return;
@@ -14101,34 +13714,6 @@ var Noydb = class {
     this.activeTier.set(vault, tier);
   }
   // ─── Tier-2 enroll / remove ─────────────────────────────────────
-  /** Add a tier-2 authenticator slot — see {@link TeamFacade.enrollAuthenticator}. */
-  async enrollAuthenticator(vault, options, factors) {
-    return this.team.enrollAuthenticator(vault, options, factors);
-  }
-  /** Remove a tier-2 authenticator slot — see {@link TeamFacade.removeAuthenticator}. */
-  async removeAuthenticator(vault, slotId, factors) {
-    return this.team.removeAuthenticator(vault, slotId, factors);
-  }
-  /** Read the slot list for a vault — see {@link TeamFacade.listAuthenticators}. */
-  async listAuthenticators(vault) {
-    return this.team.listAuthenticators(vault);
-  }
-  /** Mutate an authenticator slot's `meta` — see {@link TeamFacade.updateAuthenticator}. */
-  async updateAuthenticator(vault, slotId, options, factors) {
-    return this.team.updateAuthenticator(vault, slotId, options, factors);
-  }
-  /** Native WebAuthn enrollment — see {@link TeamFacade.enrollWebAuthn}. */
-  async enrollWebAuthn(vault, ceremony, factors) {
-    return this.team.enrollWebAuthn(vault, ceremony, factors);
-  }
-  /** List webauthn-method slots — see {@link TeamFacade.listWebAuthnSlots}. */
-  async listWebAuthnSlots(vault) {
-    return this.team.listWebAuthnSlots(vault);
-  }
-  /** Unlock via a tier-2 authenticator slot — see {@link TeamFacade.unlockViaAuthenticator}. */
-  async unlockViaAuthenticator(vault, slotId, verify) {
-    return this.team.unlockViaAuthenticator(vault, slotId, verify);
-  }
   // ─── Cover (https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md) ──────
   /**
    * Set the owner-curated cover for a vault. Throws
@@ -14146,13 +13731,13 @@ var Noydb = class {
    * value, absent ones are preserved, `null` deletes (#800).
    */
   async setCover(vault, input) {
-    const coverOption = this.options.cover ?? this.options.publicEnvelope;
+    const coverOption = this.options.cover;
     if (!coverOption) {
       throw new ValidationError(
         "setCover: the cover feature is not enabled. Pass `cover: true` (or a schema object) to `createNoydb`."
       );
     }
-    const { loadCover, saveCover, resolveSchema, validateCoverInput, mergeCustom, validateCoverSize } = await import("./cover-QJRXINN5.js");
+    const { loadCover, saveCover, resolveSchema, validateCoverInput, mergeCustom, validateCoverSize } = await import("./cover/index.js");
     const schema = resolveSchema(coverOption);
     validateCoverInput(input, schema);
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -14184,84 +13769,12 @@ var Noydb = class {
    * regardless).
    */
   async getCover(vault, opts = {}) {
-    const { readCover } = await import("./cover-QJRXINN5.js");
+    const { readCover } = await import("./cover/index.js");
     return readCover(this.options.store, vault, opts);
   }
-  /** @deprecated Use {@link Noydb.setCover} (#799 rename). */
-  async setPublicEnvelope(vault, input) {
-    return this.setCover(vault, input);
-  }
-  /** @deprecated Use {@link Noydb.getCover} (#799 rename). */
-  async getPublicEnvelope(vault, opts = {}) {
-    return this.getCover(vault, opts);
-  }
   // ─── Auth introspection ─────────────────────────────────────────
-  /** English summary of the configured auth model — see {@link TeamFacade.describeAuthConfig}. */
-  async describeAuthConfig(vault) {
-    return this.team.describeAuthConfig(vault);
-  }
-  /** Mermaid `flowchart TB` source for the auth graph — see {@link TeamFacade.diagramAuthConfig}. */
-  async diagramAuthConfig(vault) {
-    return this.team.diagramAuthConfig(vault);
-  }
-  /** Per-user enrollment summary — see {@link TeamFacade.describeUserAuth}. */
-  async describeUserAuth(vault, userId, factors) {
-    return this.team.describeUserAuth(vault, userId, factors);
-  }
-  /** Bulk per-user enrollment summary — see {@link TeamFacade.describeAllUsersAuth}. */
-  async describeAllUsersAuth(vault, factors) {
-    return this.team.describeAllUsersAuth(vault, factors);
-  }
   // ─── Tier-1 change flows ────────────────────────────────────────
-  /** Rotate the user's passphrase (user remembers old) — see {@link TeamFacade.rotatePassphrase}. */
-  async rotatePassphrase(vault, input, factors) {
-    return this.team.rotatePassphrase(vault, input, factors);
-  }
-  /** Reset the passphrase using a recovery proof — see {@link TeamFacade.recoverPassphrase}. */
-  async recoverPassphrase(vault, input, factors) {
-    return this.team.recoverPassphrase(vault, input, factors);
-  }
-  /** Deliberate paper/Shamir recovery-code regeneration — see {@link TeamFacade.rotateRecovery}. */
-  async rotateRecovery(vault, options, factors) {
-    return this.team.rotateRecovery(vault, options, factors);
-  }
-  /** Atomic create-and-enroll for managed-mode vaults — see {@link TeamFacade.openVaultAndEnrollRecovery}. */
-  async openVaultAndEnrollRecovery(vault, opts) {
-    return this.team.openVaultAndEnrollRecovery(vault, opts);
-  }
-  /** Recovery flow under managed-passphrase mode — see {@link TeamFacade.recoverManagedPassphrase}. */
-  async recoverManagedPassphrase(vault, options) {
-    return this.team.recoverManagedPassphrase(vault, options);
-  }
-  /** Atomic peer-recovery of an existing user's keyring — see {@link TeamFacade.recoverUser}. */
-  async recoverUser(vault, options, factors) {
-    return this.team.recoverUser(vault, options, factors);
-  }
-  /** Persist a recovery enrollment (paper or Shamir) — see {@link TeamFacade.enrollRecovery}. */
-  async enrollRecovery(vault, enrollment) {
-    return this.team.enrollRecovery(vault, enrollment);
-  }
-  /** Read the persisted recovery entries (paper + Shamir) — see {@link TeamFacade.listRecoveryEntries}. */
-  async listRecoveryEntries(vault) {
-    return this.team.listRecoveryEntries(vault);
-  }
   // ─── Tier-3 enroll / unlock ─────────────────────────────────────
-  /** Register a tier-3 quick-unlock state — see {@link TeamFacade.enrollUnlock}. */
-  async enrollUnlock(vault, state, factors) {
-    return this.team.enrollUnlock(vault, state, factors);
-  }
-  /** Resume a session via the registered tier-3 state — see {@link TeamFacade.unlockViaPin}. */
-  async unlockViaPin(vault, resume) {
-    return this.team.unlockViaPin(vault, resume);
-  }
-  /** Drop the tier-3 state for a vault — see {@link TeamFacade.clearQuickUnlock}. */
-  clearQuickUnlock(vault) {
-    this.team.clearQuickUnlock(vault);
-  }
-  /** Public defensive-copy accessor for the unlocked keyring — see {@link TeamFacade.getKeyring}. */
-  async getKeyring(vault) {
-    return this.team.getKeyring(vault);
-  }
   /**
    * Live-reference variant used by the hub's own code paths. Internal
    * mutations on `deks` (e.g. {@link ensureCollectionDEK} adding a
@@ -14282,7 +13795,7 @@ var Noydb = class {
     }
     await assertKeyringOpenAllowed(this.options.store, vault, this.options.user, opts.create);
     let effectiveSecret;
-    if (this.options.passphraseMode === "managed") {
+    if (this.options.secretMode === "managed") {
       effectiveSecret = await resolveManagedSecret(
         this.options.store,
         vault,
@@ -14292,37 +13805,29 @@ var Noydb = class {
       effectiveSecret = this.options.secret;
     }
     if (!effectiveSecret) {
-      throw new ValidationError("A secret (passphrase) or getKeyring callback is required when encryption is enabled");
+      throw new ValidationError("A secret (secret) or getKeyring callback is required when encryption is enabled");
     }
     let keyring;
     try {
-      keyring = await loadKeyring(this.options.store, vault, this.options.user, effectiveSecret);
+      keyring = await loadKeyring(this.options.store, vault, { userId: this.options.user, secret: effectiveSecret });
     } catch (err) {
       if (err instanceof NoAccessError) {
-        keyring = await createOwnerKeyring(
-          this.options.store,
-          vault,
-          this.options.user,
-          effectiveSecret,
-          {
-            // Managed mode generates 256-bit base64 strings that don't satisfy
-            // the human-passphrase strength rules (no spaces, no "words").
-            // Skip validation in managed mode — the entropy floor is already
-            // 256 bits by construction.
-            validate: this.options.passphraseMode === "managed" ? false : this.options.validatePassphrase === true
-          }
-        );
+        keyring = await createOwnerKeyring(this.options.store, vault, {
+          userId: this.options.user,
+          secret: effectiveSecret,
+          // Managed mode generates 256-bit base64 strings that don't satisfy
+          // the human-secret strength rules (no spaces, no "words").
+          // Skip validation in managed mode — the entropy floor is already
+          // 256 bits by construction.
+          validate: this.options.secretMode === "managed" ? false : this.options.validateSecret === true
+        });
       } else if (err instanceof InvalidKeyError && this.options.onInvalidKey === "reset") {
         await this.options.store.delete(vault, "_keyring", this.options.user);
-        keyring = await createOwnerKeyring(
-          this.options.store,
-          vault,
-          this.options.user,
-          effectiveSecret,
-          {
-            validate: this.options.passphraseMode === "managed" ? false : this.options.validatePassphrase === true
-          }
-        );
+        keyring = await createOwnerKeyring(this.options.store, vault, {
+          userId: this.options.user,
+          secret: effectiveSecret,
+          validate: this.options.secretMode === "managed" ? false : this.options.validateSecret === true
+        });
       } else {
         throw err;
       }
@@ -14332,7 +13837,7 @@ var Noydb = class {
   }
   /**
    * Take an on-demand checkpoint of the given vault.
-   * Requires `snapshotStrategy: withSnapshots({ store })` in `createNoydb`.
+   * Requires `snapshotsStrategy: withSnapshots({ store })` in `createNoydb`.
    * @throws ValidationError when the vault is not open
    */
   async snapshot(vault, opts) {
@@ -14358,34 +13863,34 @@ var Noydb = class {
 async function createNoydb(options) {
   if (!options.store) options = { ...options, store: memoryStore() };
   const encrypted = options.encrypt !== false;
-  const managed = options.passphraseMode === "managed";
+  const managed = options.secretMode === "managed";
   if (options.secret && options.getKeyring) {
     throw new ValidationError("Provide either `secret` or `getKeyring`, not both");
   }
   if (managed) {
     if (options.secret) {
       throw new ValidationError(
-        '`passphraseMode: "managed"` is mutually exclusive with `secret` \u2014 managed mode generates the passphrase itself. Drop `secret`.'
+        '`secretMode: "managed"` is mutually exclusive with `secret` \u2014 managed mode generates the secret itself. Drop `secret`.'
       );
     }
     if (options.getKeyring) {
       throw new ValidationError(
-        '`passphraseMode: "managed"` is mutually exclusive with `getKeyring` \u2014 a custom unlock callback would bypass the sealing flow. Drop `getKeyring`.'
+        '`secretMode: "managed"` is mutually exclusive with `getKeyring` \u2014 a custom unlock callback would bypass the sealing flow. Drop `getKeyring`.'
       );
     }
     if (!options.sealingKey) {
       throw new ValidationError(
-        '`passphraseMode: "managed"` requires `sealingKey: SealingKeyProvider` (see @noy-db/seal-macos-keychain / @noy-db/seal-aws-kms / etc.).'
+        '`secretMode: "managed"` requires `sealingKey: SealingKeyProvider` (see @noy-db/seal-macos-keychain / @noy-db/seal-aws-kms / etc.).'
       );
     }
   }
   if (encrypted && !managed && !options.secret && !options.getKeyring) {
-    throw new ValidationError("A secret (passphrase) or getKeyring callback is required when encryption is enabled");
+    throw new ValidationError("A secret (secret) or getKeyring callback is required when encryption is enabled");
   }
   if (!options.coordinationStrategy) options = { ...options, coordinationStrategy: await createDefaultCoordinationProvider(options.store) };
-  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-3A3S4SHH.js")).createUserApi };
+  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-ZDKTWNBB.js")).createUserApi };
   if (!options.policyFactory) {
-    const policyModule = await import("./policy-YDLCOX4P.js");
+    const policyModule = await import("./policy/index.js");
     options = { ...options, policyFactory: policyModule.createNoydbPolicy, policyCheckGateFn: policyModule.checkGate };
   }
   return new Noydb(options);
@@ -14415,11 +13920,7 @@ export {
   RefRegistry,
   Vault,
   QuickUnlockStore,
-  describeAuthConfig,
-  diagramAuthConfig,
-  describeUserAuth,
-  describeAllUsersAuth,
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-PK6JIDQ4.js.map
+//# sourceMappingURL=chunk-NFIBXF4V.js.map