@noy-db/hub 0.4.0-pre.3 → 0.4.0-pre.5

package/dist/{chunk-LUH2MPEF.js → chunk-EEZCB74X.js}

@@ -1,3 +1,6 @@
+import {
+  loadVaultPolicy
+} from "./chunk-QMZ5A6FQ.js";
 import {
   jsonSchemaToFields
 } from "./chunk-VYYM3MEN.js";
@@ -6,23 +9,23 @@ import {
   SEQUENCE_COLLECTION,
   compileSequenceFormat,
   resolveSequenceKey
-} from "./chunk-NOT7XA7Q.js";
-import {
-  loadVaultPolicy
-} from "./chunk-QDNVHA2F.js";
+} from "./chunk-X3MWEFPT.js";
 import {
   LinkIntegrityError,
   isLinkCollectionName,
   linkCollectionName,
   linkRowKey
-} from "./chunk-IUIVDVXM.js";
+} from "./chunk-MUPZ6IZX.js";
 import {
   hashFields,
   validateSatelliteDeclaration
-} from "./chunk-L4OA7G5T.js";
+} from "./chunk-522MBPE5.js";
+import {
+  resolveStaleOnRead
+} from "./chunk-XUFAFHQM.js";
 import {
   loadFence
-} from "./chunk-JA5B3SLH.js";
+} from "./chunk-M6QA2KK2.js";
 import {
   InvertedIndex,
   MemoryIndexStore,
@@ -31,11 +34,11 @@ import {
   buildPersistedIndexCallbacks,
   encodeVecId,
   syncTierSearch
-} from "./chunk-J6U4BOKP.js";
+} from "./chunk-HAPY7WFP.js";
 import {
   derivePersistedSchema,
   isZod4Schema
-} from "./chunk-EDC6MLXV.js";
+} from "./chunk-SEU6QHH4.js";
 import {
   isBaseLive,
   liveBaseIdSet
@@ -44,11 +47,11 @@ import {
   CustodyApi,
   NO_CARGO,
   NO_CUSTODY
-} from "./chunk-SN75YVM5.js";
+} from "./chunk-L2CAWCQL.js";
 import {
   resolveManagedSecret,
-  saveSealedPassphrase
-} from "./chunk-BCOKZC4B.js";
+  saveSealedSecret
+} from "./chunk-OHV6T5JB.js";
 import {
   ServiceBus,
   WriteHookRegistry,
@@ -56,35 +59,35 @@ import {
   assertCanImport,
   canExport,
   canImport
-} from "./chunk-WEC3JGBA.js";
+} from "./chunk-IGLU4ME7.js";
 import {
   runDrainBarrier
-} from "./chunk-KMONEHDJ.js";
+} from "./chunk-AFAPBZAA.js";
 import {
   NO_ATTESTATION
-} from "./chunk-XW7NWO4A.js";
+} from "./chunk-GTNRMJYH.js";
 import {
   NO_CLASSIFIED,
   guardClassifiedCompat,
   resolveClassifiedFields
-} from "./chunk-IZX3WZBF.js";
+} from "./chunk-YZNKFYDC.js";
 import {
   NO_TIERS,
   classifySealedShred,
   syncDerivedOutputs
-} from "./chunk-N4A3DCBT.js";
+} from "./chunk-FTCGEUOY.js";
 import {
   NO_PORTABILITY
-} from "./chunk-GYB2QK5H.js";
+} from "./chunk-OWLZONGX.js";
 import {
   TxContext,
   bestEffortRevert,
   revertExecuted
-} from "./chunk-FLHOTGOO.js";
+} from "./chunk-QVGEVZ5F.js";
 import {
   DEFAULT_POSTURE,
   ViaGraph
-} from "./chunk-E2R5NRZD.js";
+} from "./chunk-Z4D3YGAB.js";
 import {
   buildLookupAltIndex,
   buildLookupSnapshotRows,
@@ -105,27 +108,28 @@ import {
   resolveLabelFromMap,
   resolveRollupDeleteIntents,
   runGraphDispatchWave,
+  selfWriteFieldEqual,
   touchFor,
   updateReferencingRecords
-} from "./chunk-HGVFJL63.js";
+} from "./chunk-7BIJS6II.js";
 import {
   OverlayedCollection
-} from "./chunk-2ITLQZV5.js";
+} from "./chunk-PWWWMRT7.js";
 import {
   NO_AGGREGATE,
   Query,
   ScanBuilder
-} from "./chunk-GU5AYA2Q.js";
+} from "./chunk-HQKRZIX6.js";
 import {
   EXPORT_AUDIT_COLLECTION,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-2KL6NDD4.js";
+} from "./chunk-J5TEU77Q.js";
 import {
   LazyQuery,
   decodeIdxId,
   encodeIdxId
-} from "./chunk-CGPO3ZYB.js";
+} from "./chunk-BY5YBSXA.js";
 import {
   IMPLICIT_LAZY,
   Lru,
@@ -133,13 +137,13 @@ import {
 } from "./chunk-NO272T7Q.js";
 import {
   canonicalGroupKey
-} from "./chunk-JIMEB4C6.js";
+} from "./chunk-QMMOMBH6.js";
 import {
   readPath
 } from "./chunk-IGJCYUT5.js";
 import {
   dictCollectionName
-} from "./chunk-BZEPJJOK.js";
+} from "./chunk-K7BADAOS.js";
 import {
   NO_I18N,
   getAtPath,
@@ -147,23 +151,23 @@ import {
   isDictKeyDescriptor,
   isI18nTextDescriptor,
   isStaticDictDescriptor
-} from "./chunk-XGVDLQJE.js";
+} from "./chunk-JN3SGXJE.js";
 import {
   installViaBinder,
   isViaInstalled,
   viaBinder
-} from "./chunk-STR7WBOB.js";
+} from "./chunk-ZUDAK436.js";
 import {
   NO_TEAM,
   enrollAuthenticator,
   findAuthenticator,
-  recoverPassphrase,
+  recoverSecret,
   recoverUser,
   removeAuthenticator,
-  rotatePassphrase,
+  rotateSecret,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-UBF7HTOR.js";
+} from "./chunk-FIP7KI2P.js";
 import {
   assertKeyringOpenAllowed,
   buildRecipientKeyringFile,
@@ -176,11 +180,11 @@ import {
   listUsers,
   loadKeyring,
   updateKeyringIdentity
-} from "./chunk-WJDYZP3U.js";
+} from "./chunk-3LJYHE7S.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
-} from "./chunk-7B4GPCX7.js";
+} from "./chunk-6RPWILRH.js";
 import {
   hasRecoveryEnrolled,
   hasStrongRecoveryEnrolled,
@@ -190,7 +194,7 @@ import {
   mintShamirRecoveryEntry,
   savePaperRecoveryEntries,
   saveShamirRecoveryEntries
-} from "./chunk-3O62PVDW.js";
+} from "./chunk-CJVEAVYH.js";
 import {
   INDEXED_STORE_POLICY
 } from "./chunk-VQNJ7UZL.js";
@@ -200,11 +204,11 @@ import {
   PERIOD_FREEZES_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION,
   periodExclusiveUpperBound
-} from "./chunk-F4COUZLL.js";
+} from "./chunk-TMR64XPL.js";
 import {
   NO_BROKER,
   buildCredentialBrokerHandle
-} from "./chunk-VEX6G3YL.js";
+} from "./chunk-P4NUJVWL.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
@@ -212,10 +216,10 @@ import {
   assertCutoverTierSafe,
   assertTierWritable,
   liveRecordIsElevated
-} from "./chunk-NM4LVUXH.js";
+} from "./chunk-PTT2NB46.js";
 import {
   sha256Hex
-} from "./chunk-JLHKBAFY.js";
+} from "./chunk-RWW3I3PO.js";
 import {
   NO_FORGET,
   addSubjectRef,
@@ -224,10 +228,10 @@ import {
   readDottedPath,
   rebuildSubjectIndex,
   removeSubjectRef
-} from "./chunk-OWE4BNTM.js";
+} from "./chunk-I2XEBEEF.js";
 import {
   NO_SEALED_RECORD
-} from "./chunk-J3VW4J4E.js";
+} from "./chunk-7LP7FFJ2.js";
 import {
   RecordCodec,
   SEALED_CEK_NS,
@@ -238,20 +242,20 @@ import {
   queryByDet,
   resolveStableCek,
   validateSchemaInput
-} from "./chunk-PEY6ZTCF.js";
+} from "./chunk-GEEJPID6.js";
 import {
   buildDeleteMarker,
   buildTombstone,
   isDeleteMarker,
   isTombstone
-} from "./chunk-QXPOEAKR.js";
+} from "./chunk-SC4JLMZI.js";
 import {
   encrypt
-} from "./chunk-5P5AAXYA.js";
+} from "./chunk-7U6AB7DZ.js";
 import {
   NOYDB_FORMAT_VERSION,
   SealedHandle
-} from "./chunk-5BHNQNBI.js";
+} from "./chunk-YTW6ZIPD.js";
 import {
   AlreadyElevatedError,
   AttestationError,
@@ -260,7 +264,6 @@ import {
   ClassifiedVerifyError,
   ConflictError,
   DebugPlaintextError,
-  DerivationCapExceededError,
   DictKeyInUseError,
   ElevationExpiredError,
   FieldNotQueryableError,
@@ -291,11 +294,289 @@ import {
   UnsupportedIndexOptionError,
   UnsupportedTierCompositionError,
   ValidationError
-} from "./chunk-IGM563N5.js";
+} from "./chunk-6SYOHUHM.js";
+
+// src/via/blob/binding.ts
+async function eraseBlobs(ctx, cfg) {
+  if (cfg.purgeBlobsForRecord) return cfg.purgeBlobsForRecord(ctx.id);
+  return { shredded: 0, residue: [] };
+}
+function buildBlobDescribeFragment(fields) {
+  return {
+    blobFields: Object.fromEntries(
+      Object.entries(fields).map(([field, p]) => [field, {
+        ...p.retainDays !== void 0 ? { retainDays: p.retainDays } : {},
+        ...p.evictWhen !== void 0 ? { evictWhen: true } : {},
+        ...p.legalHold !== void 0 ? { legalHold: true } : {},
+        ...p.retainUntil !== void 0 ? { retainUntil: true } : {},
+        ...p.external === true ? { external: true } : {},
+        ...p.public === true ? { public: true } : {},
+        ...p.backlink !== void 0 ? { backlink: p.backlink } : {}
+      }])
+    )
+  };
+}
+function blobBinding(cfg) {
+  return {
+    brand: "blob",
+    // encryptedAtRest: 'envelope' — blob chunks are AEAD-encrypted envelopes
+    // in `_blob_chunks` (service-side), not sealed record fields; queryable:
+    // 'none' — nothing indexes blob content; exportable — vault.exportBlobs()
+    // is a first-class door; forgettable — shredAllForRecord participates in
+    // vault.forget().
+    posture: { encryptedAtRest: "envelope", queryable: "none", exportable: true, forgettable: true },
+    covers: (field) => field in cfg.fields,
+    erase: (ctx) => eraseBlobs(ctx, cfg),
+    describeFragment: () => buildBlobDescribeFragment(cfg.fields)
+  };
+}
+function linkBlobVia() {
+  installViaBinder("blob", (c) => blobBinding(c));
+}
+
+// src/port/with/blob-strategy.ts
+linkBlobVia();
+var NO_BLOBS = {
+  openSlot() {
+    throw new Error(
+      'Blob storage is not enabled on this Noydb instance. Import `{ withBlobs }` from "@noy-db/hub/blobs" and pass `withBlobs()` to `createNoydb({ blobStrategy: withBlobs() })`.'
+    );
+  }
+};
+
+// src/with-audit/consent/strategy.ts
+var NO_CONSENT = {
+  async write() {
+  },
+  async read() {
+    return [];
+  }
+};
+
+// src/with-commit/crdt/strategy.ts
+var NOT_ENABLED = new Error(
+  'CRDT mode requires the CRDT strategy. Import `{ withCrdt }` from "@noy-db/hub/crdt" and pass it to `createNoydb({ crdtStrategy: withCrdt() })`.'
+);
+var NO_CRDT = {
+  buildLwwMapState() {
+    throw NOT_ENABLED;
+  },
+  buildRgaState() {
+    throw NOT_ENABLED;
+  },
+  mergeCrdtStates() {
+    throw NOT_ENABLED;
+  },
+  resolveCrdtSnapshot() {
+    throw NOT_ENABLED;
+  }
+};
+
+// src/with-commit/history/strategy.ts
+function notEnabled(op) {
+  return new Error(
+    `${op} requires the history strategy. Import \`{ withHistory }\` from "@noy-db/hub/history" and pass it to \`createNoydb({ historyStrategy: withHistory() })\`.`
+  );
+}
+var NO_HISTORY = {
+  async saveHistory() {
+  },
+  async getHistoryEntries() {
+    throw notEnabled("collection.history()");
+  },
+  async getVersionEnvelope() {
+    throw notEnabled("collection.getVersion()");
+  },
+  async pruneHistory() {
+    return 0;
+  },
+  async clearHistory() {
+    return 0;
+  },
+  async tombstoneHistory() {
+    return 0;
+  },
+  async rewrapHistory() {
+  },
+  async envelopePayloadHash() {
+    return "";
+  },
+  computePatch() {
+    return [];
+  },
+  diff() {
+    throw notEnabled("collection.diff()");
+  },
+  buildLedger() {
+    return null;
+  },
+  buildVaultInstant() {
+    throw notEnabled("vault.at() / vault.timeMachine()");
+  }
+};
+
+// src/with-lookup/indexing/strategy.ts
+var NO_INDEXING = {
+  createState() {
+    return DISABLED_STATE;
+  }
+};
+var DISABLED_STATE = {
+  isEnabled: false,
+  getEagerIndexes: () => null,
+  getPersistedIndexes: () => null
+};
+
+// src/with-audit/periods/strategy.ts
+var NOT_ENABLED2 = new Error(
+  'Accounting periods require the periods strategy. Import `{ withPeriods }` from "@noy-db/hub/periods" and pass it to `createNoydb({ periodsStrategy: withPeriods() })`.'
+);
+var NO_PERIODS = {
+  async loadPeriods() {
+    return [];
+  },
+  async chainAnchor() {
+    return { priorPeriodHash: "" };
+  },
+  assertTsWritable() {
+  },
+  validatePeriodName() {
+    throw NOT_ENABLED2;
+  },
+  async appendPeriodLedgerEntry() {
+    throw NOT_ENABLED2;
+  }
+};
+
+// src/with-party/session/strategy.ts
+function notEnabled2(op) {
+  return new Error(
+    `${op} requires the session strategy. Import \`{ withSession }\` from "@noy-db/hub/session" and pass it to \`createNoydb({ sessionStrategy: withSession() })\`.`
+  );
+}
+var NO_SESSION = {
+  validateSessionPolicy() {
+    throw notEnabled2("sessionPolicy");
+  },
+  createEnforcer() {
+    throw notEnabled2("session policy enforcement");
+  },
+  revokeAllSessions() {
+  }
+};
+
+// src/with-fork/shadow/strategy.ts
+var NOT_ENABLED3 = new Error(
+  'VaultFrame requires the shadow strategy. Import `{ withShadow }` from "@noy-db/hub/shadow" and pass it to `createNoydb({ shadowStrategy: withShadow() })`.'
+);
+var NO_SHADOW = {
+  buildFrame() {
+    throw NOT_ENABLED3;
+  }
+};
+
+// src/with-fork/snapshots/strategy.ts
+var NOT_ENABLED4 = new Error(
+  'Snapshots require the snapshot strategy. Import `{ withSnapshots }` from "@noy-db/hub/snapshots" and pass it to `createNoydb({ snapshotStrategy: withSnapshots({ store }) })`.'
+);
+var NO_SNAPSHOTS = {
+  async snapshot() {
+    throw NOT_ENABLED4;
+  },
+  async listSnapshots() {
+    throw NOT_ENABLED4;
+  },
+  async restoreSnapshot() {
+    throw NOT_ENABLED4;
+  },
+  async autoSnapshot() {
+    throw NOT_ENABLED4;
+  }
+};
+
+// src/with-party/team/sync-strategy.ts
+function notEnabled3(op) {
+  return new Error(
+    `${op} requires the sync strategy. Import \`{ withSync }\` from "@noy-db/hub/sync" and pass it to \`createNoydb({ syncStrategy: withSync() })\`.`
+  );
+}
+var NO_SYNC = {
+  buildSyncEngine() {
+    throw notEnabled3("SyncEngine");
+  },
+  buildSyncTransaction() {
+    throw notEnabled3("SyncTransaction");
+  },
+  buildPresence() {
+    throw notEnabled3("collection.presence()");
+  }
+};
+
+// src/with-commit/tx/strategy.ts
+var NOT_ENABLED5 = new Error(
+  'Multi-record transactions require the tx strategy. Import `{ withTransactions }` from "@noy-db/hub/tx" and pass it to `createNoydb({ txStrategy: withTransactions() })`.'
+);
+var NO_TX = {
+  async runTransaction(_db, _fn, _options, _txInvariants) {
+    throw NOT_ENABLED5;
+  },
+  async runDryRun() {
+    throw NOT_ENABLED5;
+  }
+};
+
+// src/port/with/archive-strategy.ts
+var ARCHIVE_NOT_ENABLED = "vault.archive/restore/listArchived require `archiveStrategy: withArchive({ store })` in createNoydb";
+var NO_ARCHIVE = {
+  get store() {
+    throw new Error(ARCHIVE_NOT_ENABLED);
+  }
+};
+
+// src/port/with/strategies.ts
+var STRATEGY_DEFAULTS = {
+  aggregate: NO_AGGREGATE,
+  archive: NO_ARCHIVE,
+  attestation: NO_ATTESTATION,
+  blob: NO_BLOBS,
+  broker: NO_BROKER,
+  cargo: NO_CARGO,
+  classified: NO_CLASSIFIED,
+  consent: NO_CONSENT,
+  crdt: NO_CRDT,
+  custody: NO_CUSTODY,
+  forget: NO_FORGET,
+  history: NO_HISTORY,
+  i18n: NO_I18N,
+  index: NO_INDEXING,
+  lazy: IMPLICIT_LAZY,
+  periods: NO_PERIODS,
+  portability: NO_PORTABILITY,
+  sealedRecord: NO_SEALED_RECORD,
+  search: NO_SEARCH,
+  sequence: NO_SEQUENCE,
+  session: NO_SESSION,
+  shadow: NO_SHADOW,
+  snapshot: NO_SNAPSHOTS,
+  sync: NO_SYNC,
+  team: NO_TEAM,
+  tiers: NO_TIERS,
+  tx: NO_TX
+};
+var STRATEGY_KEYS = Object.keys(STRATEGY_DEFAULTS);
+function resolveStrategies(options) {
+  const provided = options;
+  const resolved = { ...STRATEGY_DEFAULTS };
+  for (const key of STRATEGY_KEYS) {
+    const value = provided[`${key}Strategy`];
+    if (value !== void 0) resolved[key] = value;
+  }
+  return resolved;
+}
 
 // src/port/by/default-provider.ts
 async function createDefaultCoordinationProvider(store) {
-  const { StoreCoordinationProvider } = await import("./store-coordination-provider-3AELCZ4Y.js");
+  const { StoreCoordinationProvider } = await import("./store-coordination-provider-P3IU5JHD.js");
   return new StoreCoordinationProvider(store);
 }
 
@@ -964,61 +1245,6 @@ async function resolveTierSyncPrior(ctx, id, priorEnvelope) {
   return await ctx.codec.decryptRecord(priorEnvelope, { skipValidation: true, id });
 }
 
-// src/with-commit/history/strategy.ts
-function notEnabled(op) {
-  return new Error(
-    `${op} requires the history strategy. Import \`{ withHistory }\` from "@noy-db/hub/history" and pass it to \`createNoydb({ historyStrategy: withHistory() })\`.`
-  );
-}
-var NO_HISTORY = {
-  async saveHistory() {
-  },
-  async getHistoryEntries() {
-    throw notEnabled("collection.history()");
-  },
-  async getVersionEnvelope() {
-    throw notEnabled("collection.getVersion()");
-  },
-  async pruneHistory() {
-    return 0;
-  },
-  async clearHistory() {
-    return 0;
-  },
-  async tombstoneHistory() {
-    return 0;
-  },
-  async rewrapHistory() {
-  },
-  async envelopePayloadHash() {
-    return "";
-  },
-  computePatch() {
-    return [];
-  },
-  diff() {
-    throw notEnabled("collection.diff()");
-  },
-  buildLedger() {
-    return null;
-  },
-  buildVaultInstant() {
-    throw notEnabled("vault.at() / vault.timeMachine()");
-  }
-};
-
-// src/with-lookup/indexing/strategy.ts
-var NO_INDEXING = {
-  createState() {
-    return DISABLED_STATE;
-  }
-};
-var DISABLED_STATE = {
-  isEnabled: false,
-  getEagerIndexes: () => null,
-  getPersistedIndexes: () => null
-};
-
 // src/with-lookup/search/serialize.ts
 function serializeIndex(idx) {
   return JSON.stringify(idx.toSnapshot());
@@ -1621,164 +1847,6 @@ function buildDescription(input) {
   };
 }
 
-// src/via/blob/binding.ts
-async function eraseBlobs(ctx, cfg) {
-  if (cfg.purgeBlobsForRecord) return cfg.purgeBlobsForRecord(ctx.id);
-  return { shredded: 0, residue: [] };
-}
-function buildBlobDescribeFragment(fields) {
-  return {
-    blobFields: Object.fromEntries(
-      Object.entries(fields).map(([field, p]) => [field, {
-        ...p.retainDays !== void 0 ? { retainDays: p.retainDays } : {},
-        ...p.evictWhen !== void 0 ? { evictWhen: true } : {},
-        ...p.legalHold !== void 0 ? { legalHold: true } : {},
-        ...p.retainUntil !== void 0 ? { retainUntil: true } : {},
-        ...p.external === true ? { external: true } : {},
-        ...p.public === true ? { public: true } : {},
-        ...p.backlink !== void 0 ? { backlink: p.backlink } : {}
-      }])
-    )
-  };
-}
-function blobBinding(cfg) {
-  return {
-    brand: "blob",
-    // encryptedAtRest: 'envelope' — blob chunks are AEAD-encrypted envelopes
-    // in `_blob_chunks` (service-side), not sealed record fields; queryable:
-    // 'none' — nothing indexes blob content; exportable — vault.exportBlobs()
-    // is a first-class door; forgettable — shredAllForRecord participates in
-    // vault.forget().
-    posture: { encryptedAtRest: "envelope", queryable: "none", exportable: true, forgettable: true },
-    covers: (field) => field in cfg.fields,
-    erase: (ctx) => eraseBlobs(ctx, cfg),
-    describeFragment: () => buildBlobDescribeFragment(cfg.fields)
-  };
-}
-function linkBlobVia() {
-  installViaBinder("blob", (c) => blobBinding(c));
-}
-
-// src/port/with/blob-strategy.ts
-linkBlobVia();
-var NO_BLOBS = {
-  openSlot() {
-    throw new Error(
-      'Blob storage is not enabled on this Noydb instance. Import `{ withBlobs }` from "@noy-db/hub/blobs" and pass `withBlobs()` to `createNoydb({ blobStrategy: withBlobs() })`.'
-    );
-  }
-};
-
-// src/with-formula/derivations/stale.ts
-var _staleByRegistry = /* @__PURE__ */ new WeakMap();
-var keyFor = (source, sourceId) => `${source}/${sourceId}`;
-async function markStale(registry, strategy, sourceId) {
-  let map = _staleByRegistry.get(registry);
-  if (!map) {
-    map = /* @__PURE__ */ new Map();
-    _staleByRegistry.set(registry, map);
-  }
-  const k = keyFor(strategy.source, sourceId);
-  let set = map.get(k);
-  if (!set) {
-    set = /* @__PURE__ */ new Set();
-    map.set(k, set);
-  }
-  set.add(strategy);
-}
-async function resolveStaleOnRead(accessor, outputCollection, id) {
-  const registry = accessor.registry();
-  const producers = registry.strategiesProducingOutput(outputCollection);
-  if (producers.length === 0) return;
-  const map = _staleByRegistry.get(registry);
-  if (!map) return;
-  let DerivationExecutor = null;
-  for (const { spec, strategyHash } of producers) {
-    const k = keyFor(spec.source, id);
-    const pending = map.get(k);
-    if (!pending || !pending.has(spec)) continue;
-    const sourceColl = accessor.getCollection(spec.source);
-    const source = await sourceColl.get(id);
-    if (!source) {
-      pending.delete(spec);
-      continue;
-    }
-    const sourceWithId = { ...source, id };
-    if (DerivationExecutor === null) {
-      ({ DerivationExecutor } = await import("./executor-TEZYRDN3.js"));
-    }
-    const ctx = { vault: accessor.getReadOnlyFacade() };
-    const result = await DerivationExecutor.run(spec, sourceWithId, 0, strategyHash, ctx);
-    for (const key of Object.keys(spec.outputs)) {
-      const out = result.outputs[key];
-      if (!out) continue;
-      if (out.kind === "failed") {
-        const err = out.error;
-        if (spec.strict) {
-          throw err;
-        }
-        console.warn(
-          `[derivation] lazy output "${key}" for source "${spec.source}" id="${id}" failed:`,
-          err
-        );
-        continue;
-      }
-      if (out.kind === "array") {
-        console.warn(
-          `[derivation] unexpected array-shape output "${key}" in lazy resolve path; array-shape derivations require lifecycle: "eager".`
-        );
-        continue;
-      }
-      const outSpec = spec.outputs[key];
-      if (!outSpec) continue;
-      const outputColl = accessor.getCollection(outSpec.collection);
-      if (out.skipped === true) {
-        await outputColl._internalDelete(id, accessor.getActiveTxContext());
-        continue;
-      }
-      await outputColl.put(id, out.value);
-    }
-    pending.delete(spec);
-  }
-}
-
-// src/with-commit/crdt/strategy.ts
-var NOT_ENABLED = new Error(
-  'CRDT mode requires the CRDT strategy. Import `{ withCrdt }` from "@noy-db/hub/crdt" and pass it to `createNoydb({ crdtStrategy: withCrdt() })`.'
-);
-var NO_CRDT = {
-  buildLwwMapState() {
-    throw NOT_ENABLED;
-  },
-  buildRgaState() {
-    throw NOT_ENABLED;
-  },
-  mergeCrdtStates() {
-    throw NOT_ENABLED;
-  },
-  resolveCrdtSnapshot() {
-    throw NOT_ENABLED;
-  }
-};
-
-// src/with-party/team/sync-strategy.ts
-function notEnabled2(op) {
-  return new Error(
-    `${op} requires the sync strategy. Import \`{ withSync }\` from "@noy-db/hub/sync" and pass it to \`createNoydb({ syncStrategy: withSync() })\`.`
-  );
-}
-var NO_SYNC = {
-  buildSyncEngine() {
-    throw notEnabled2("SyncEngine");
-  },
-  buildSyncTransaction() {
-    throw notEnabled2("SyncTransaction");
-  },
-  buildPresence() {
-    throw notEnabled2("collection.presence()");
-  }
-};
-
 // src/kernel/via/compose.ts
 function via(...descriptors) {
   if (descriptors.length === 0) {
@@ -1942,7 +2010,7 @@ function compileViaBindings(opts, classifiedGuardCtx, eraseCfgOut) {
       ...i18nFields !== void 0 ? { i18nFields } : {},
       ...dictKeyFields !== void 0 ? { dictKeyFields } : {},
       ...i18nDensifyFields !== void 0 ? { i18nDensifyFields } : {},
-      strategy: opts.i18nStrategy ?? NO_I18N,
+      strategy: opts.strategies.i18n,
       ...opts.defaultLocale !== void 0 ? { defaultLocale: opts.defaultLocale } : {},
       ...opts.autoTranslateHook !== void 0 ? { autoTranslateHook: opts.autoTranslateHook } : {},
       ...opts.dictLabelResolver !== void 0 ? { dictLabelResolver: opts.dictLabelResolver } : {},
@@ -2177,14 +2245,9 @@ function resolveCollectionConfig(opts) {
     writeHooks: opts.writeHooks,
     subsystemBus: opts.subsystemBus,
     activeTxId: opts.activeTxId,
-    blobStrategy: opts.blobStrategy ?? NO_BLOBS,
+    strategies: opts.strategies,
     objectStore: opts.objectStore,
     blobFields: opts.blobFields,
-    aggregateStrategy: opts.aggregateStrategy ?? NO_AGGREGATE,
-    crdtStrategy: opts.crdtStrategy ?? NO_CRDT,
-    historyStrategy: opts.historyStrategy ?? NO_HISTORY,
-    i18nStrategy: opts.i18nStrategy ?? NO_I18N,
-    syncStrategy: opts.syncStrategy ?? NO_SYNC,
     reconcileOnOpen: opts.reconcileOnOpen ?? "off",
     getDEK: opts.getDEK,
     onDirty: opts.onDirty,
@@ -2213,7 +2276,6 @@ function resolveCollectionConfig(opts) {
     moneyFields: effectiveViaFields.moneyFields,
     classified: resolvedClassified,
     classifiedGuardCtx,
-    classifiedStrategy: opts.classifiedStrategy ?? NO_CLASSIFIED,
     computed: mergedComputed,
     computedEdges,
     viaDepsEdges,
@@ -2235,8 +2297,6 @@ function resolveCollectionConfig(opts) {
     materializedViewSource: opts.materializedViewSource,
     graphDispatch: opts.graphDispatch,
     tiers: opts.tiers && opts.tiers.length > 0 ? new Set(opts.tiers) : null,
-    tiersStrategy: opts.tiersStrategy ?? NO_TIERS,
-    searchStrategy: opts.searchStrategy ?? NO_SEARCH,
     tierMode: opts.tierMode ?? "invisibility",
     blobTierPolicy: opts.blobTierPolicy ?? "isolate",
     onCrossTierAccess: opts.onCrossTierAccess,
@@ -2253,20 +2313,11 @@ function resolveCollectionConfig(opts) {
 // src/with-formula/computed/lazy.ts
 var fn = null;
 async function loadEvalComputedFields() {
-  fn ??= (await import("./computed-WZNKRLCY.js")).evalComputedFields;
+  fn ??= (await import("./computed-33DRJDOC.js")).evalComputedFields;
   return fn;
 }
 
 // src/kernel/collection.ts
-function selfWriteFieldEqual(a, b) {
-  if (a === b) return true;
-  if (a === null || b === null || typeof a !== "object" || typeof b !== "object") return false;
-  try {
-    return JSON.stringify(a) === JSON.stringify(b);
-  } catch {
-    return false;
-  }
-}
 var fallbackWarned = /* @__PURE__ */ new Set();
 function warnOnceFallback(adapterName) {
   if (fallbackWarned.has(adapterName)) return;
@@ -2298,25 +2349,20 @@ var Collection = class {
   /** True when the caller explicitly provided a `historyConfig` option (vs. inheriting the vault default). */
   historyConfigExplicit;
   /**
-   * tree-shake seam — the strategy that backs `collection.blob(id)`.
-   * Defaults to `NO_BLOBS`, a ~10-line stub that throws with an actionable
-   * message. Consumers opt into real blob storage by importing
-   * `{ blobs }` from `@noy-db/hub/blobs` and passing the returned
-   * strategy to `createNoydb({ blobStrategy: blobs() })`. With the
-   * default stub, none of the BlobSet / chunk / MIME-magic machinery
-   * reaches the bundle.
+   * Every opt-in service, resolved once by `createNoydb` (#838) and shared by
+   * reference with the owning `Vault` and `Noydb`.
+   *
+   * Each entry is a tree-shake seam. An un-opted-in service resolves to its
+   * `NO_*` stub — a tiny module that throws with an actionable message —
+   * so, for example, none of the BlobSet / chunk / MIME-magic machinery
+   * reaches the bundle unless the consumer imports `@noy-db/hub/blobs` and
+   * passes `blobStrategy: blobs()` to `createNoydb`.
    */
-  blobStrategy;
+  strategies;
   objectStore;
   blobFields;
   blobTierPolicy;
   // #724 T2/T3
-  aggregateStrategy;
-  crdtStrategy;
-  tiersStrategy;
-  searchStrategy;
-  historyStrategy;
-  syncStrategy;
   // In-memory cache of decrypted records (eager mode only). Lazy mode
   // uses `lru` instead. Both fields exist so a single Collection instance
   // doesn't need a runtime branch on every cache access.
@@ -2486,12 +2532,6 @@ var Collection = class {
   /** C-A/R10 memoization: marker declared-set lookup (undefined=unresolved) + classified-handle persist-once flag. */
   _markerDigestOnlyCache = void 0;
   _markerPersisted = false;
-  /**
-   * Tree-shake seam for `reveal()` — defaults to `NO_CLASSIFIED`, which
-   * throws `ClassifiedNotEnabledError`. Set via the `classifiedStrategy`
-   * `createNoydb()` option (opt in with `withClassified()`).
-   */
-  classifiedStrategy;
   /** Async callback provided by the Vault to open a dynamic dictionary handle (for label-map pre-computation in the search index). Only used in `resolveDictLabelMaps()`; static dicts bypass this entirely. Mutable, assign-once — see {@link _reconcileReadState} (#671 item 1). */
   getDictionary;
   /**
@@ -2640,16 +2680,10 @@ var Collection = class {
     this.writeHooks = cfg.writeHooks;
     this.subsystemBus = cfg.subsystemBus;
     this.activeTxId = cfg.activeTxId;
-    this.blobStrategy = cfg.blobStrategy;
+    this.strategies = cfg.strategies;
     this.objectStore = cfg.objectStore;
     this.blobFields = cfg.blobFields;
     this.blobTierPolicy = cfg.blobTierPolicy ?? "isolate";
-    this.aggregateStrategy = cfg.aggregateStrategy;
-    this.crdtStrategy = cfg.crdtStrategy;
-    this.tiersStrategy = cfg.tiersStrategy;
-    this.searchStrategy = cfg.searchStrategy;
-    this.historyStrategy = cfg.historyStrategy;
-    this.syncStrategy = cfg.syncStrategy;
     this.reconcileOnOpen = cfg.reconcileOnOpen;
     this.getDEK = cfg.getDEK;
     this.onDirty = cfg.onDirty;
@@ -2676,7 +2710,6 @@ var Collection = class {
     this.classified = cfg.classified;
     this.classifiedGuardCtx = cfg.classifiedGuardCtx;
     this.vdigFields = cfg.vdigFields;
-    this.classifiedStrategy = cfg.classifiedStrategy;
     this.computed = cfg.computed;
     this.getDictionary = cfg.getDictionary;
     this.defaultLocale = cfg.defaultLocale;
@@ -2724,7 +2757,7 @@ var Collection = class {
       deterministicFields: this.deterministicFields,
       vdigFields: this.vdigFields,
       crdtMode: this.crdtMode,
-      crdtStrategy: this.crdtStrategy,
+      crdtStrategy: this.strategies.crdt,
       schema: this.schema,
       getDEK: (collection) => this.getDEK(collection ?? this.name),
       cekCache: this.cekCache,
@@ -2742,7 +2775,7 @@ var Collection = class {
         const remoteJson = await this.codec.decryptJsonString(remote, id);
         if (localJson === null) return local;
         if (remoteJson === null) return remote;
-        const merged = this.crdtStrategy.mergeCrdtStates(JSON.parse(localJson), JSON.parse(remoteJson));
+        const merged = this.strategies.crdt.mergeCrdtStates(JSON.parse(localJson), JSON.parse(remoteJson));
         const mergedVersion = Math.max(local._v, remote._v) + 1;
         const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
         return this.codec.encryptJsonString(JSON.stringify(merged), mergedVersion, cek);
@@ -2800,12 +2833,12 @@ var Collection = class {
     }
     this.lazy = opts.prefetch === false;
     if (this.lazy) {
-      this.lru = (opts.lazyStrategy ?? IMPLICIT_LAZY).createCache(this.name, opts.cache);
+      this.lru = opts.strategies.lazy.createCache(this.name, opts.cache);
       this.hydrated = true;
     } else {
       this.lru = null;
     }
-    const strategy = opts.indexStrategy ?? NO_INDEXING;
+    const strategy = opts.strategies.index;
     this.indexState = strategy.createState({
       defs: opts.indexes ?? [],
       lazy: this.lazy
@@ -2960,7 +2993,7 @@ var Collection = class {
     if (spec.storage === "digest-only") {
       throw new ClassifiedRevealError(this.name, field, `storage:'digest-only' \u2014 verify-only; nothing recoverable to reveal`);
     }
-    return this.classifiedStrategy.reveal({
+    return this.strategies.classified.reveal({
       collection: this.name,
       spec,
       encrypted: this.storeCiphertext,
@@ -2980,7 +3013,7 @@ var Collection = class {
       throw new ClassifiedVerifyError(this.name, field, `storage:'never' \u2014 nothing is stored to verify against`);
     }
     const ctx = this._classifiedVerifyCtx(spec);
-    return spec.storage === "digest-only" ? this.classifiedStrategy.verify(ctx, id, field, candidate) : this.classifiedStrategy.verifyText(ctx, id, field, candidate);
+    return spec.storage === "digest-only" ? this.strategies.classified.verify(ctx, id, field, candidate) : this.strategies.classified.verifyText(ctx, id, field, candidate);
   }
   /** k-of-n challenge over the collection's secretAnswer members. Requires withClassified(). */
   async verifyGroup(id, answers, opts) {
@@ -2989,7 +3022,7 @@ var Collection = class {
       throw new ClassifiedVerifyError(this.name, "*", "no groupable digest-only (secretAnswer) fields declared");
     }
     const ctx = { ...this._classifiedVerifyCtx(members[0].spec), groupMembers: members };
-    return this.classifiedStrategy.matchGroup(ctx, id, answers, opts);
+    return this.strategies.classified.matchGroup(ctx, id, answers, opts);
   }
   _classifiedVerifyCtx(spec) {
     return {
@@ -3044,7 +3077,7 @@ var Collection = class {
     if (typeof candidate !== "string") {
       throw new ClassifiedVerifyError(this.name, "*", "candidate must be a string");
     }
-    const target = await this.classifiedStrategy.computeTarget(this._classifiedVerifyCtx(spec), field, candidate);
+    const target = await this.strategies.classified.computeTarget(this._classifiedVerifyCtx(spec), field, candidate);
     const ids = await this.adapter.list(this.vault, this.name);
     const hits = [];
     const hitMap = /* @__PURE__ */ new Map();
@@ -3057,7 +3090,7 @@ var Collection = class {
     }
     await this.onAccess?.("find", "*");
     if (hits.length === 0) return [];
-    const { verifyDigestField } = await import("./verify-MXN66IIH.js");
+    const { verifyDigestField } = await import("./verify-5X37OXRY.js");
     const policy = {
       normalize: spec.verifyNormalize ?? "password",
       notLastN: spec.notLastN ?? 0,
@@ -3131,7 +3164,7 @@ var Collection = class {
           id,
           version: scrubbed._v,
           actor: this.keyring.userId,
-          payloadHash: await this.historyStrategy.envelopePayloadHash(scrubbed),
+          payloadHash: await this.strategies.history.envelopePayloadHash(scrubbed),
           reason: "classified:scrub-equatable-tags"
         });
       }
@@ -3263,7 +3296,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-4UNPHWOU.js");
+      const { resolveStaleMVOnRead } = await import("./stale-NBROTA66.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     let record;
@@ -3357,7 +3390,7 @@ var Collection = class {
     if (this.syncAdapter !== void 0) presenceOpts.syncAdapter = this.syncAdapter;
     if (opts?.staleMs !== void 0) presenceOpts.staleMs = opts.staleMs;
     if (opts?.pollIntervalMs !== void 0) presenceOpts.pollIntervalMs = opts.pollIntervalMs;
-    return this.syncStrategy.buildPresence(presenceOpts);
+    return this.strategies.sync.buildPresence(presenceOpts);
   }
   /**
    * Create or update a record. Runs inside the hub's write-queue tracker
@@ -3519,6 +3552,103 @@ var Collection = class {
     return clone;
   }
   /** @internal Untracked put body — call {@link put}, not this. */
+  /**
+   * Decode a prior envelope's CRDT state, or `undefined` when there is no
+   * usable prior: no envelope, a shredded body decrypting to `null`, or a
+   * payload that is not a CRDT state. The `lww-map` and `rga` branches each
+   * carried a copy, byte-identical apart from the cast (#842).
+   */
+  async #decodePriorCrdtState(envelope) {
+    if (!envelope) return void 0;
+    const prevJson = await this.codec.decryptJsonString(envelope);
+    if (prevJson === null) return void 0;
+    const prevParsed = JSON.parse(prevJson);
+    if (prevParsed === null || typeof prevParsed !== "object" || !("_crdt" in prevParsed)) {
+      return void 0;
+    }
+    return prevParsed;
+  }
+  /**
+   * Record a write on the active transaction so a mid-batch failure rolls it
+   * back. Four sites in the derivation/MV dispatch hand-built this literal (#842).
+   */
+  #trackPut(txCtx, collectionName, id, priorEnvelope) {
+    txCtx._executed.push({
+      op: { type: "put", vaultName: this.vault, collectionName, id },
+      priorEnvelope
+    });
+  }
+  /**
+   * Snapshot the PRIOR version into history, emit, and prune.
+   *
+   * Deliberately does NOT carry `source` from the current write — a history
+   * entry describes the version being replaced, not the one replacing it.
+   *
+   * Kept OUT of {@link #commitWriteTail} because the two paths call it at
+   * different points: the normal path snapshots BEFORE `adapter.put` (so a
+   * history failure leaves no write behind), while the CRDT path must merge
+   * and persist first to resolve the prior record at all. Folding it into the
+   * tail would silently reorder one of them (#842).
+   */
+  async #savePriorHistory(id, prior, cek, vdigCtx) {
+    if (this.historyConfig.enabled === false) return;
+    await this.strategies.history.saveHistory(
+      this.adapter,
+      this.vault,
+      this.name,
+      id,
+      await this.codec.encryptRecord(prior.record, prior.version, cek, void 0, void 0, vdigCtx, id)
+    );
+    this.emitter.emit("history:save", { vault: this.vault, collection: this.name, id, version: prior.version });
+    if (this.historyConfig.maxVersions) {
+      await this.strategies.history.pruneHistory(this.adapter, this.vault, this.name, id, { keepVersions: this.historyConfig.maxVersions });
+    }
+  }
+  /**
+   * Everything both write paths do once the envelope is on the adapter:
+   * classified marker, embedding sidecar, ledger append, cache/index
+   * maintenance, and the mutation event that drives derivation dispatch.
+   *
+   * The CRDT branch used to re-implement all of it, and in doing so skipped
+   * `_ensureClassifiedMarker`, the unique-constraint upsert and
+   * `_toCacheableRecord` (#835). All three were unreachable — each blocked by
+   * a config-time refusal on CRDT collections — but only by accident of what
+   * that copy happened to omit. One tail makes the divergence unrepresentable
+   * rather than merely unreachable; on a CRDT collection the extra steps are
+   * provably no-ops (classified/unique + crdt are refused at construction, and
+   * a CRDT body never produces a `_sealed` slot, so `_toCacheableRecord` is
+   * the identity).
+   */
+  async #commitWriteTail(args) {
+    const { id, envelope, version, indexed, event, prior, reason } = args;
+    await this._ensureClassifiedMarker();
+    if (this.embeddings) {
+      await this.strategies.search.embedOnWrite(this.searchContext(), id, indexed, version);
+    }
+    if (this.ledger) {
+      const appendInput = {
+        op: "put",
+        collection: this.name,
+        id,
+        version,
+        actor: this.keyring.userId,
+        payloadHash: await this.strategies.history.envelopePayloadHash(envelope)
+      };
+      if (prior) appendInput.delta = this.strategies.history.computePatch(indexed, prior.record);
+      if (reason !== void 0) appendInput.reason = reason;
+      await this.ledger.append(appendInput);
+    }
+    const cacheable = await this._toCacheableRecord(indexed, envelope, id);
+    if (this.lazy && this.lru) {
+      this.lru.set(id, { record: cacheable, version }, estimateRecordBytes(indexed));
+      await this.maintainPersistedIndexesOnPut(id, indexed, prior ? prior.record : null, version);
+    } else {
+      this.cache.set(id, { record: cacheable, version });
+      this.indexes?.upsert(id, indexed, prior ? prior.record : null);
+      this.uniqueConstraints?.upsert(id, indexed, prior?.record);
+    }
+    await this._onRecordMutated(id, "put", "local-write", { record: event, version });
+  }
   async _putInternal(id, record, options) {
     if (!hasWritePermission(this.keyring, this.name)) {
       throw new ReadOnlyError();
@@ -3567,29 +3697,11 @@ var Collection = class {
       const now = (/* @__PURE__ */ new Date()).toISOString();
       let crdtState;
       if (this.crdtMode === "lww-map") {
-        let existingState;
-        if (existingEnvelope) {
-          const prevJson = await this.codec.decryptJsonString(existingEnvelope);
-          if (prevJson !== null) {
-            const prevParsed = JSON.parse(prevJson);
-            if (prevParsed !== null && typeof prevParsed === "object" && "_crdt" in prevParsed) {
-              existingState = prevParsed;
-            }
-          }
-        }
-        crdtState = this.crdtStrategy.buildLwwMapState(record, existingState, now);
+        const existingState = await this.#decodePriorCrdtState(existingEnvelope);
+        crdtState = this.strategies.crdt.buildLwwMapState(record, existingState, now);
       } else if (this.crdtMode === "rga") {
-        let existingState;
-        if (existingEnvelope) {
-          const prevJson = await this.codec.decryptJsonString(existingEnvelope);
-          if (prevJson !== null) {
-            const prevParsed = JSON.parse(prevJson);
-            if (prevParsed !== null && typeof prevParsed === "object" && "_crdt" in prevParsed) {
-              existingState = prevParsed;
-            }
-          }
-        }
-        crdtState = this.crdtStrategy.buildRgaState(Array.isArray(record) ? record : [record], existingState, generateULID);
+        const existingState = await this.#decodePriorCrdtState(existingEnvelope);
+        crdtState = this.strategies.crdt.buildRgaState(Array.isArray(record) ? record : [record], existingState, generateULID);
       } else {
         crdtState = { _crdt: "yjs", update: record };
       }
@@ -3597,42 +3709,21 @@ var Collection = class {
       const cek2 = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
       const envelope2 = await this.codec.encryptJsonString(JSON.stringify(crdtState), version2, cek2, options?.source, options?.sourceTs);
       await this.adapter.put(this.vault, this.name, id, envelope2);
-      const resolvedRecord = this.crdtStrategy.resolveCrdtSnapshot(crdtState);
+      const resolvedRecord = this.strategies.crdt.resolveCrdtSnapshot(crdtState);
       const existingResolvedRecord = existingEnvelope ? await this.codec.decryptRecord(existingEnvelope, { skipValidation: true }) : null;
       const existingResolved = existingResolvedRecord !== null ? { record: existingResolvedRecord, version: existingVersion } : void 0;
-      if (existingResolved && this.historyConfig.enabled !== false) {
-        await this.historyStrategy.saveHistory(this.adapter, this.vault, this.name, id, await this.codec.encryptRecord(existingResolved.record, existingResolved.version, cek2, void 0, void 0, this.vdigFields !== null ? { id, prev: existingEnvelope } : void 0, id));
-        this.emitter.emit("history:save", { vault: this.vault, collection: this.name, id, version: existingResolved.version });
-        if (this.historyConfig.maxVersions) {
-          await this.historyStrategy.pruneHistory(this.adapter, this.vault, this.name, id, { keepVersions: this.historyConfig.maxVersions });
-        }
-      }
-      if (this.ledger) {
-        const appendInput = {
-          op: "put",
-          collection: this.name,
-          id,
-          version: version2,
-          actor: this.keyring.userId,
-          payloadHash: await this.historyStrategy.envelopePayloadHash(envelope2)
-        };
-        if (existingResolved) appendInput.delta = this.historyStrategy.computePatch(resolvedRecord, existingResolved.record);
-        if (options?.reason !== void 0) appendInput.reason = options.reason;
-        await this.ledger.append(appendInput);
-      }
-      if (this.lazy && this.lru) {
-        this.lru.set(id, { record: resolvedRecord, version: version2 }, estimateRecordBytes(resolvedRecord));
-        await this.maintainPersistedIndexesOnPut(
-          id,
-          resolvedRecord,
-          existingResolved ? existingResolved.record : null,
-          version2
-        );
-      } else {
-        this.cache.set(id, { record: resolvedRecord, version: version2 });
-        this.indexes?.upsert(id, resolvedRecord, existingResolved ? existingResolved.record : null);
+      if (existingResolved) {
+        await this.#savePriorHistory(id, existingResolved, cek2, this.vdigFields !== null ? { id, prev: existingEnvelope } : void 0);
       }
-      await this._onRecordMutated(id, "put", "local-write", { record, version: version2 });
+      await this.#commitWriteTail({
+        id,
+        envelope: envelope2,
+        version: version2,
+        indexed: resolvedRecord,
+        event: record,
+        prior: existingResolved,
+        reason: options?.reason
+      });
       return;
     }
     let existing;
@@ -3657,52 +3748,24 @@ var Collection = class {
       if (priorRaw === null && (this.markerIds.has(id) || this.tabCoordinated?.())) {
         priorRaw = await this.adapter.get(this.vault, this.name, id);
       }
-      if (priorRaw && isDeleteMarker(priorRaw)) version = priorRaw._v + 1;
-    }
-    this.uniqueConstraints?.check(id, record);
-    const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
-    const vdigCtx = this.vdigFields !== null ? { id, prev: await this.adapter.get(this.vault, this.name, id) } : void 0;
-    if (existing && this.historyConfig.enabled !== false) {
-      await this.historyStrategy.saveHistory(this.adapter, this.vault, this.name, id, await this.codec.encryptRecord(existing.record, existing.version, cek, void 0, void 0, vdigCtx, id));
-      this.emitter.emit("history:save", {
-        vault: this.vault,
-        collection: this.name,
-        id,
-        version: existing.version
-      });
-      if (this.historyConfig.maxVersions) await this.historyStrategy.pruneHistory(this.adapter, this.vault, this.name, id, { keepVersions: this.historyConfig.maxVersions });
-    }
-    const envelope = await this.codec.encryptRecord(record, version, cek, options?.source, options?.sourceTs, vdigCtx, id);
-    await this.adapter.put(this.vault, this.name, id, envelope);
-    this.markerIds.delete(id);
-    await this._ensureClassifiedMarker();
-    if (this.embeddings) {
-      await this.searchStrategy.embedOnWrite(this.searchContext(), id, record, version);
-    }
-    if (this.ledger) {
-      const appendInput = {
-        op: "put",
-        collection: this.name,
-        id,
-        version,
-        actor: this.keyring.userId,
-        payloadHash: await this.historyStrategy.envelopePayloadHash(envelope)
-      };
-      if (existing) {
-        appendInput.delta = this.historyStrategy.computePatch(record, existing.record);
-      }
-      if (options?.reason !== void 0) appendInput.reason = options.reason;
-      await this.ledger.append(appendInput);
-    }
-    if (this.lazy && this.lru) {
-      this.lru.set(id, { record: await this._toCacheableRecord(record, envelope, id), version }, estimateRecordBytes(record));
-      await this.maintainPersistedIndexesOnPut(id, record, existing ? existing.record : null, version);
-    } else {
-      this.cache.set(id, { record: await this._toCacheableRecord(record, envelope, id), version });
-      this.indexes?.upsert(id, record, existing ? existing.record : null);
-      this.uniqueConstraints?.upsert(id, record, existing?.record);
+      if (priorRaw && isDeleteMarker(priorRaw)) version = priorRaw._v + 1;
     }
-    await this._onRecordMutated(id, "put", "local-write", { record, version });
+    this.uniqueConstraints?.check(id, record);
+    const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
+    const vdigCtx = this.vdigFields !== null ? { id, prev: await this.adapter.get(this.vault, this.name, id) } : void 0;
+    if (existing) await this.#savePriorHistory(id, existing, cek, vdigCtx);
+    const envelope = await this.codec.encryptRecord(record, version, cek, options?.source, options?.sourceTs, vdigCtx, id);
+    await this.adapter.put(this.vault, this.name, id, envelope);
+    this.markerIds.delete(id);
+    await this.#commitWriteTail({
+      id,
+      envelope,
+      version,
+      indexed: record,
+      event: record,
+      prior: existing,
+      reason: options?.reason
+    });
   }
   /**
    * Fire registered MV strategies whose dependency set includes this
@@ -3719,34 +3782,8 @@ var Collection = class {
    */
   async dispatchMaterializedViews(id, record, wave) {
     if (this.materializedViewSource === void 0) return;
-    const incoming = record;
-    if (incoming && typeof incoming === "object" && "_materializedFrom" in incoming) return;
-    const registry = this.materializedViewSource.registry();
-    const mvs = registry.mvsForSource(this.name);
-    if (mvs.length === 0) return;
-    let executor = null;
-    let staleHelpers = null;
-    for (const reg of mvs) {
-      const mode = reg.spec.refresh;
-      if (mode === "eager") {
-        if (wave?.seen(`mv\0${reg.spec.name}`)) continue;
-        if (executor === null) {
-          ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-YORMIBWV.js"));
-        }
-        await executor.refresh(reg, {
-          getCollection: (name) => this.materializedViewSource.getCollection(name),
-          getActiveTxContext: () => this.materializedViewSource.getActiveTxContext(),
-          getQueryContext: () => this.materializedViewSource.getQueryContext(),
-          dispatchCtx: this.#dispatchCtx({ collection: this.name, id })
-        });
-      } else if (mode === "lazy") {
-        if (staleHelpers === null) {
-          staleHelpers = await import("./stale-4UNPHWOU.js");
-        }
-        staleHelpers.markMVStale(registry, reg.spec.name);
-      }
-    }
+    const { dispatchMaterializedViews } = await import("./dispatch-SMXUO7W5.js");
+    return dispatchMaterializedViews(this.#mvDispatchCtx(this.materializedViewSource), id, record, wave);
   }
   /**
    * Fire registered derivation strategies for this source collection.
@@ -3834,6 +3871,32 @@ var Collection = class {
     return out;
   }
   /** @internal — ctx for `putDerivedOutput`'s frozen-period skip+audit (#638 Task 5). */
+  /** What `with-formula/materialized-views/dispatch.ts` needs from this collection (#842). */
+  #mvDispatchCtx(materializedViewSource) {
+    return {
+      materializedViewSource,
+      collectionName: this.name,
+      dispatchCtx: (source) => this.#dispatchCtx(source)
+    };
+  }
+  /**
+   * What `with-formula/derivations/dispatch.ts` needs from this collection (#842).
+   *
+   * The return type is inferred, not annotated: importing `DerivationDeleteCtx`
+   * would be a STATIC spine→service import, which `port-layering` rejects even
+   * when it is type-only — the guard scans import statements, not their
+   * erasure. The dynamic `import()` at the call site still types the argument.
+   */
+  #derivationDeleteCtx(derivationSource) {
+    return {
+      derivationSource,
+      collectionName: this.name,
+      adapter: this.adapter,
+      vault: this.vault,
+      getDEK: this.getDEK,
+      storeCiphertext: this.storeCiphertext
+    };
+  }
   #dispatchCtx(source) {
     return { emit: (e, p) => this.emitter.emit(e, p), source, audit: ledgerAuditHook(this.ledger, this.keyring.userId) };
   }
@@ -3859,11 +3922,7 @@ var Collection = class {
     const patched = { ...base, [field]: newValue };
     const txCtx = this.derivationSource.getActiveTxContext();
     if (txCtx !== null) {
-      const prior = await this.adapter.get(this.vault, into, parentId);
-      txCtx._executed.push({
-        op: { type: "put", vaultName: this.vault, collectionName: into, id: parentId },
-        priorEnvelope: prior
-      });
+      this.#trackPut(txCtx, into, parentId, await this.adapter.get(this.vault, into, parentId));
     }
     return putDerivedOutput(intoColl, parentId, patched, this.#dispatchCtx(source));
   }
@@ -3896,150 +3955,14 @@ var Collection = class {
    *  dispatch wave's per-target dedup; `undefined` on the local-write path (byte-identical). */
   async dispatchDerivations(id, record, version, wave) {
     if (this.derivationSource === void 0) return;
-    const incoming = this.via ? this.via.canonicalizeStored(record) : record;
-    if (incoming && typeof incoming === "object" && "_derivedFrom" in incoming) return;
-    const registry = this.derivationSource.registry();
-    const strategies = registry.strategiesForSource(this.name);
-    if (strategies.length === 0) return;
-    let DerivationExecutor = null;
-    for (const { spec, strategyHash } of strategies) {
-      const mode = typeof spec.lifecycle === "string" ? spec.lifecycle : spec.lifecycle.mode;
-      if (spec.rollup) {
-        if (mode !== "eager") continue;
-        let parentId;
-        if (this.name === spec.rollup.from) {
-          const kv = incoming[spec.rollup.key];
-          parentId = typeof kv === "string" || typeof kv === "number" ? String(kv) : null;
-        } else {
-          parentId = id;
-        }
-        if (parentId !== null) await this.recomputeRollup(spec, parentId, { collection: this.name, id }, wave);
-        continue;
-      }
-      const isSource = spec.source === this.name;
-      const isSibling = !isSource && (spec.sources?.includes(this.name) ?? false);
-      const trigger = !isSource && !isSibling ? spec.triggerBy?.find((t) => t.collection === this.name) : void 0;
-      const runs = [];
-      if (isSource) {
-        runs.push({ input: { ...incoming, id }, base: incoming, runId: id, version });
-      } else if (isSibling) {
-        const p = await this.derivationSource.getCollection(spec.source).get(id);
-        if (p !== null && p !== void 0) {
-          const raw = await this.derivationSource.getCollection(spec.source)._getStoredRecord(id);
-          runs.push({ input: { ...p, id }, base: raw ?? p, runId: id, version: 0 });
-        }
-      } else if (trigger) {
-        const srcColl = this.derivationSource.getCollection(spec.source);
-        const ids = await srcColl._findMatchingIds(trigger.on, id);
-        if (trigger.maxFanout !== void 0 && ids.length > trigger.maxFanout) {
-          throw new DerivationCapExceededError(`triggerBy ${this.name}\u2192${spec.source}`, ids.length, trigger.maxFanout);
-        }
-        for (const sid of ids) {
-          const raw = await srcColl._getStoredRecord(sid);
-          if (raw === null) continue;
-          runs.push({ input: { ...raw, id: sid }, base: raw, runId: sid, version: 0 });
-        }
-      }
-      if (runs.length === 0) continue;
-      if (mode !== "eager") {
-        for (const run of runs) await markStale(registry, spec, run.runId);
-        continue;
-      }
-      if (DerivationExecutor === null) {
-        ({ DerivationExecutor } = await import("./executor-TEZYRDN3.js"));
-      }
-      for (const run of runs) {
-        const ctx = { vault: this.derivationSource.getReadOnlyFacade() };
-        const outCtx = this.#dispatchCtx({ collection: spec.source, id: run.runId });
-        const result = await DerivationExecutor.run(spec, run.input, run.version, strategyHash, ctx);
-        for (const key of Object.keys(spec.outputs)) {
-          const out = result.outputs[key];
-          if (!out) continue;
-          if (out.kind === "failed") {
-            const err = out.error;
-            if (spec.strict) throw err;
-            console.warn(`[derivation] output "${key}" for source "${spec.source}" id="${run.runId}" failed:`, err);
-            continue;
-          }
-          const outSpec = spec.outputs[key];
-          if (!outSpec) continue;
-          const outputCollection = this.derivationSource.getCollection(outSpec.collection);
-          const txCtx = this.derivationSource.getActiveTxContext();
-          if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-HJV3A7PM.js");
-            const prior = await loadFanoutSidecar(this.adapter, this.vault, spec.source, run.runId, key, this.getDEK, this.storeCiphertext);
-            const prevKeys = new Set(prior?.keys ?? []);
-            const newKeysList = out.entries.map((e) => e.key);
-            const newKeysSet = new Set(newKeysList);
-            for (const k of prevKeys) {
-              if (newKeysSet.has(k)) continue;
-              await outputCollection._internalDelete(k, txCtx);
-            }
-            for (const entry of out.entries) {
-              if (txCtx !== null) {
-                const priorEnvelope = await this.adapter.get(this.vault, outSpec.collection, entry.key);
-                txCtx._executed.push({
-                  op: {
-                    type: "put",
-                    vaultName: this.vault,
-                    collectionName: outSpec.collection,
-                    id: entry.key
-                  },
-                  priorEnvelope
-                });
-              }
-              await putDerivedOutput(outputCollection, entry.key, entry.value, outCtx, { source: "derived" });
-            }
-            await saveFanoutSidecar(this.adapter, this.vault, {
-              source: spec.source,
-              sourceId: run.runId,
-              outputKey: key,
-              outputCollection: outSpec.collection,
-              keys: newKeysList
-            }, this.getDEK, this.storeCiphertext);
-            continue;
-          }
-          if (out.skipped === true) {
-            await outputCollection._internalDelete(run.runId, txCtx);
-            continue;
-          }
-          if (outSpec.shape === "record" && outSpec.denorm !== void 0 && outSpec.collection === spec.source) {
-            const value = out.value;
-            const patched = { ...run.base };
-            let changed = false;
-            for (const f of outSpec.denorm) {
-              if (!selfWriteFieldEqual(run.base[f], value[f])) {
-                patched[f] = value[f];
-                changed = true;
-              }
-            }
-            if (!changed) continue;
-            if (txCtx !== null) {
-              const prior = await this.adapter.get(this.vault, outSpec.collection, run.runId);
-              txCtx._executed.push({
-                op: { type: "put", vaultName: this.vault, collectionName: outSpec.collection, id: run.runId },
-                priorEnvelope: prior
-              });
-            }
-            await putDerivedOutput(outputCollection, run.runId, patched, outCtx, { source: "derived" });
-            continue;
-          }
-          if (txCtx !== null) {
-            const prior = await this.adapter.get(this.vault, outSpec.collection, run.runId);
-            txCtx._executed.push({
-              op: {
-                type: "put",
-                vaultName: this.vault,
-                collectionName: outSpec.collection,
-                id: run.runId
-              },
-              priorEnvelope: prior
-            });
-          }
-          await putDerivedOutput(outputCollection, run.runId, out.value, outCtx, { source: "derived" });
-        }
-      }
-    }
+    const { dispatchDerivations } = await import("./dispatch-PKQQFDBT.js");
+    return dispatchDerivations({
+      ...this.#derivationDeleteCtx(this.derivationSource),
+      via: this.via,
+      recomputeRollup: (spec, parentId, source, w) => this.recomputeRollup(spec, parentId, source, w),
+      dispatchCtx: (source) => this.#dispatchCtx(source),
+      trackPut: (txCtx, collectionName, rid, prior) => this.#trackPut(txCtx, collectionName, rid, prior)
+    }, id, record, version, wave);
   }
   /**
    * Delete a record by ID. Runs inside the hub's write-queue tracker
@@ -4208,10 +4131,10 @@ var Collection = class {
     if (existing && this.historyConfig.enabled !== false) {
       const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
       const prevForVdig = this.vdigFields !== null ? await this.adapter.get(this.vault, this.name, id) : null;
-      await this.historyStrategy.saveHistory(this.adapter, this.vault, this.name, id, await this.codec.encryptRecord(existing.record, existing.version, cek, void 0, void 0, this.vdigFields !== null ? { id, prev: prevForVdig } : void 0, id));
+      await this.strategies.history.saveHistory(this.adapter, this.vault, this.name, id, await this.codec.encryptRecord(existing.record, existing.version, cek, void 0, void 0, this.vdigFields !== null ? { id, prev: prevForVdig } : void 0, id));
     }
     const previousEnvelope = await this.adapter.get(this.vault, this.name, id);
-    const previousPayloadHash = await this.historyStrategy.envelopePayloadHash(previousEnvelope);
+    const previousPayloadHash = await this.strategies.history.envelopePayloadHash(previousEnvelope);
     let markerVersion;
     if (this.onDirty) {
       const live = previousEnvelope;
@@ -4309,33 +4232,8 @@ var Collection = class {
    */
   async dispatchArrayDerivationsOnDelete(id, eraseRecordShapeToo = false) {
     if (this.derivationSource === void 0) return 0;
-    const registry = this.derivationSource.registry();
-    const strategies = registry.strategiesForSource(this.name);
-    if (strategies.length === 0) return 0;
-    let helpers = null;
-    const txCtx = this.derivationSource.getActiveTxContext();
-    let erased = 0;
-    for (const { spec } of strategies) {
-      for (const [outputKey, outSpec] of Object.entries(spec.outputs)) {
-        if (outSpec.shape === "record") {
-          if (eraseRecordShapeToo && spec.source === this.name && outSpec.collection !== this.name) {
-            if (await this.derivationSource.getCollection(outSpec.collection)._internalDelete(id, txCtx)) erased += 1;
-          }
-          continue;
-        }
-        if (helpers === null) {
-          helpers = await import("./fanout-sidecar-HJV3A7PM.js");
-        }
-        const sidecar = await helpers.loadFanoutSidecar(this.adapter, this.vault, spec.source, id, outputKey, this.getDEK, this.storeCiphertext);
-        if (!sidecar) continue;
-        const outputCollection = this.derivationSource.getCollection(outSpec.collection);
-        for (const derivedId of sidecar.keys) {
-          if (await outputCollection._internalDelete(derivedId, txCtx)) erased += 1;
-        }
-        await helpers.deleteFanoutSidecar(this.adapter, this.vault, spec.source, id, outputKey);
-      }
-    }
-    return erased;
+    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-PKQQFDBT.js");
+    return dispatchArrayDerivationsOnDelete(this.#derivationDeleteCtx(this.derivationSource), id, eraseRecordShapeToo);
   }
   /**
    * Mirror of {@link dispatchMaterializedViews} for the delete/forget path — no `_materializedFrom`
@@ -4348,41 +4246,8 @@ var Collection = class {
    */
   async dispatchMaterializedViewsOnDelete(id) {
     if (this.materializedViewSource === void 0) return { deleted: 0, residueUndecodable: [], residueDeclined: [] };
-    const registry = this.materializedViewSource.registry();
-    const mvs = registry.mvsForSource(this.name);
-    if (mvs.length === 0) return { deleted: 0, residueUndecodable: [], residueDeclined: [] };
-    let executor = null;
-    let staleHelpers = null;
-    let deleted = 0;
-    const residueUndecodable = [];
-    const residueDeclined = [];
-    for (const reg of mvs) {
-      const mode = reg.spec.refresh;
-      if (mode === "eager") {
-        if (executor === null) {
-          ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-YORMIBWV.js"));
-        }
-        const rr = await executor.refresh(reg, {
-          getCollection: (name) => this.materializedViewSource.getCollection(name),
-          getActiveTxContext: () => this.materializedViewSource.getActiveTxContext(),
-          getQueryContext: () => this.materializedViewSource.getQueryContext(),
-          dispatchCtx: this.#dispatchCtx({ collection: this.name, id })
-        });
-        deleted += rr.deleted;
-        residueUndecodable.push(...rr.residueUndecodable);
-        residueDeclined.push(...rr.residueDeclined);
-      } else {
-        if (staleHelpers === null) {
-          staleHelpers = await import("./stale-4UNPHWOU.js");
-        }
-        const inv = await staleHelpers.invalidateMVAtRest(this.materializedViewSource, reg, mode);
-        deleted += inv.deleted;
-        residueUndecodable.push(...inv.residueUndecodable.map((rid) => `${reg.outputCollection}:${rid}`));
-        residueDeclined.push(...inv.residueDeclined.map((rid) => `${reg.outputCollection}:${rid}`));
-      }
-    }
-    return { deleted, residueUndecodable, residueDeclined };
+    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-SMXUO7W5.js");
+    return dispatchMaterializedViewsOnDelete(this.#mvDispatchCtx(this.materializedViewSource), id);
   }
   /**
    * List all records in the collection.
@@ -4401,7 +4266,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-4UNPHWOU.js");
+      const { resolveStaleMVOnRead } = await import("./stale-NBROTA66.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     await this.ensureHydrated();
@@ -4422,28 +4287,28 @@ var Collection = class {
    * see `src/search/tokenize.ts` for the Thai/CJK caveat.
    */
   search(field, query, opts = {}) {
-    return this.searchStrategy.search(this.searchContext(), field, query, opts);
+    return this.strategies.search.search(this.searchContext(), field, query, opts);
   }
   /** Force-persist the lexical index now — gated behind `searchStrategy: withSearch()`. */
   flushIndex() {
-    return this.searchStrategy.flushIndex(this.searchContext());
+    return this.strategies.search.flushIndex(this.searchContext());
   }
   /** Pre-build the lexical index — gated behind `searchStrategy: withSearch()`. */
   warmIndex() {
-    return this.searchStrategy.warmIndex(this.searchContext());
+    return this.strategies.search.warmIndex(this.searchContext());
   }
   /** Retrieval (lexical | semantic | hybrid) — gated behind `searchStrategy: withSearch()`. */
   retrieve(query, opts = {}) {
-    return this.searchStrategy.retrieve(this.searchContext(), query, opts);
+    return this.strategies.search.retrieve(this.searchContext(), query, opts);
   }
   /** Raw-vector kNN — gated behind `searchStrategy: withSearch()`. */
   similarTo(vector, opts = {}) {
-    return this.searchStrategy.similarTo(this.searchContext(), vector, opts);
+    return this.strategies.search.similarTo(this.searchContext(), vector, opts);
   }
   /** Opt-in bulk `_vec` re-derive (#788) — a plain collection has nothing to rebuild; gated behind `searchStrategy: withSearch()` otherwise. */
   rebuildEmbeddings() {
     if (!this.embeddings) return Promise.resolve({ rebuilt: 0, skipped: 0 });
-    return this.searchStrategy.rebuildEmbeddings(this.searchContext());
+    return this.strategies.search.rebuildEmbeddings(this.searchContext());
   }
   /**
    * Bind the {@link SearchContext} the search/retrieval surface needs. The
@@ -4653,7 +4518,7 @@ var Collection = class {
       ...this.defaultLocale !== void 0 ? { defaultLocale: this.defaultLocale } : {},
       ...resolver.resolveDictSource ? { resolveDictSource: (field) => resolver.resolveDictSource(leftCollection, field) } : {}
     } : void 0;
-    return new Query(source, void 0, joinContext, this.aggregateStrategy);
+    return new Query(source, void 0, joinContext, this.strategies.aggregate);
   }
   /**
    * Subscribe to every put/delete on this collection. Returns an
@@ -4767,7 +4632,7 @@ var Collection = class {
   // ─── History Methods ────────────────────────────────────────────
   /** Get version history for a record, newest first. */
   async history(id, options) {
-    const envelopes = await this.historyStrategy.getHistoryEntries(
+    const envelopes = await this.strategies.history.getHistoryEntries(
       this.adapter,
       this.vault,
       this.name,
@@ -4799,7 +4664,7 @@ var Collection = class {
    * and re-put the records through the normal `put()` path.
    */
   async getVersion(id, version) {
-    const envelope = await this.historyStrategy.getVersionEnvelope(
+    const envelope = await this.strategies.history.getVersionEnvelope(
       this.adapter,
       this.vault,
       this.name,
@@ -4824,7 +4689,7 @@ var Collection = class {
    */
   async diff(id, versionA, versionB) {
     const recordA = versionA === 0 ? null : await this.resolveVersion(id, versionA);
-    return this.historyStrategy.diff(recordA, versionB === void 0 || versionB === 0 ? versionB === 0 ? null : await this.resolveCurrentOrVersion(id) : await this.resolveVersion(id, versionB));
+    return this.strategies.history.diff(recordA, versionB === void 0 || versionB === 0 ? versionB === 0 ? null : await this.resolveCurrentOrVersion(id) : await this.resolveVersion(id, versionB));
   }
   /** Resolve a version: try history first, then check if it's the current version. */
   async resolveVersion(id, version) {
@@ -4841,7 +4706,7 @@ var Collection = class {
   }
   /** Prune history entries for a record (or all records if id is undefined). */
   async pruneRecordHistory(id, options) {
-    const pruned = await this.historyStrategy.pruneHistory(
+    const pruned = await this.strategies.history.pruneHistory(
       this.adapter,
       this.vault,
       this.name,
@@ -4860,7 +4725,7 @@ var Collection = class {
   }
   /** Clear all history for this collection (or a specific record). */
   async clearHistory(id) {
-    return this.historyStrategy.clearHistory(this.adapter, this.vault, this.name, id);
+    return this.strategies.history.clearHistory(this.adapter, this.vault, this.name, id);
   }
   // ─── Core Methods ─────────────────────────────────────────────
   /**
@@ -5282,7 +5147,7 @@ var Collection = class {
    * vault-shared `_blob` DEK (enabling cross-collection deduplication).
    */
   blob(id) {
-    return this.blobStrategy.openSlot({
+    return this.strategies.blob.openSlot({
       store: this.adapter,
       vault: this.vault,
       collection: this.name,
@@ -5554,14 +5419,14 @@ var Collection = class {
   /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
   async _ensureClassifiedMarker() {
     if (this._markerPersisted || this.vdigFields === null) return;
-    const { persistClassifiedMarkerForFields } = await import("./classified-marker-7S5IEP6Q.js");
+    const { persistClassifiedMarkerForFields } = await import("./classified-marker-52P3D72W.js");
     await persistClassifiedMarkerForFields(this.adapter, this.vault, this.name, this.vdigFields, await this.getDEK(this.name));
     this._markerPersisted = true;
   }
   /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
   async _classifiedMarkerDigestOnly() {
     if (this._markerDigestOnlyCache !== void 0) return this._markerDigestOnlyCache;
-    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-7S5IEP6Q.js");
+    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-52P3D72W.js");
     this._markerDigestOnlyCache = await readClassifiedMarkerDigestOnly(this.adapter, this.vault, this.name, await this.getDEK(this.name));
     return this._markerDigestOnlyCache;
   }
@@ -5603,23 +5468,23 @@ var Collection = class {
   // ─── Hierarchical Access ──────────────────────────
   /** tier-aware put — gated behind `tiersStrategy: withTiers()`. `searchResidue: true` = stuck search compensation (#774, mirroring #764's elevate/demote posture); the write itself always completes. */
   putAtTier(id, record, tier, opts) {
-    return this.tiersStrategy.putAtTier(this.tiersContext(), id, record, tier, opts);
+    return this.strategies.tiers.putAtTier(this.tiersContext(), id, record, tier, opts);
   }
   /** tier-aware get — gated behind `tiersStrategy: withTiers()`. */
   getAtTier(id) {
-    return this.tiersStrategy.getAtTier(this.tiersContext(), id);
+    return this.strategies.tiers.getAtTier(this.tiersContext(), id);
   }
   /** list ids grouped by the caller's readability — gated behind `withTiers()`. */
   listAtTier() {
-    return this.tiersStrategy.listAtTier(this.tiersContext());
+    return this.strategies.tiers.listAtTier(this.tiersContext());
   }
   /** elevate a record to a higher tier — gated behind `withTiers()`. `searchResidue: true` = stuck search compensation (#764); the move itself always completes. */
   elevate(id, toTier) {
-    return this.tiersStrategy.elevate(this.tiersContext(), id, toTier);
+    return this.strategies.tiers.elevate(this.tiersContext(), id, toTier);
   }
   /** demote a record to a lower tier — gated behind `withTiers()`. Same `searchResidue` posture as {@link elevate} (#764). */
   demote(id, toTier) {
-    return this.tiersStrategy.demote(this.tiersContext(), id, toTier);
+    return this.strategies.tiers.demote(this.tiersContext(), id, toTier);
   }
   /**
    * Emit a cross-tier access event. The subscriber sink stays collection-resident (it captures `onCrossTierAccess`); the tiers module reaches it via the {@link TiersContext.emitCrossTierEvent} callback.
@@ -5680,16 +5545,16 @@ var Collection = class {
       },
       syncIndexes: (id, rec, version, priorEnvelope) => syncTierIndexes(this.indexingContext(), id, rec, version, priorEnvelope),
       syncSearch: (id, rec, version) => syncTierSearch(this.searchContext(), id, rec, version),
-      syncHistory: async (id, fromDek, toDek) => this.historyStrategy.rewrapHistory(this.adapter, this.vault, this.name, id, fromDek, toDek, await this.getDEK(this.name)),
+      syncHistory: async (id, fromDek, toDek) => this.strategies.history.rewrapHistory(this.adapter, this.vault, this.name, id, fromDek, toDek, await this.getDEK(this.name)),
       saveHistorySnapshot: async (id, envelope) => {
         if (this.historyConfig.enabled === false) return;
-        await this.historyStrategy.saveHistory(this.adapter, this.vault, this.name, id, envelope);
+        await this.strategies.history.saveHistory(this.adapter, this.vault, this.name, id, envelope);
         this.emitter.emit("history:save", { vault: this.vault, collection: this.name, id, version: envelope._v });
-        if (this.historyConfig.maxVersions) await this.historyStrategy.pruneHistory(this.adapter, this.vault, this.name, id, { keepVersions: this.historyConfig.maxVersions });
+        if (this.historyConfig.maxVersions) await this.strategies.history.pruneHistory(this.adapter, this.vault, this.name, id, { keepVersions: this.historyConfig.maxVersions });
       },
-      historyEnabled: this.historyConfig.enabled !== false && this.historyStrategy !== NO_HISTORY,
+      historyEnabled: this.historyConfig.enabled !== false && this.strategies.history !== NO_HISTORY,
       // #728/#737: lets putAtTier skip decrypting `existing` when no real history strategy is wired
-      syncBlobs: (id, fromTier, toTier) => this.blobStrategy !== NO_BLOBS ? this.blob(id).syncTierMove(fromTier, toTier, this.blobTierPolicy) : Promise.resolve(),
+      syncBlobs: (id, fromTier, toTier) => this.strategies.blob !== NO_BLOBS ? this.blob(id).syncTierMove(fromTier, toTier, this.blobTierPolicy) : Promise.resolve(),
       // #724 I1: gate on blob storage enabled (not on declared blobFields) so undeclared-field blobs still rehome; #746: syncTierMove mints/resumes the rehome journal marker; self-no-ops on an empty slot map
       syncLedger: async (id) => {
         await this.ledger?.purgeRecordDeltas(this.name, id);
@@ -6017,46 +5882,6 @@ var DeferredNumberingStore = class {
   }
 };
 
-// src/with-fork/shadow/strategy.ts
-var NOT_ENABLED2 = new Error(
-  'VaultFrame requires the shadow strategy. Import `{ withShadow }` from "@noy-db/hub/shadow" and pass it to `createNoydb({ shadowStrategy: withShadow() })`.'
-);
-var NO_SHADOW = {
-  buildFrame() {
-    throw NOT_ENABLED2;
-  }
-};
-
-// src/with-audit/consent/strategy.ts
-var NO_CONSENT = {
-  async write() {
-  },
-  async read() {
-    return [];
-  }
-};
-
-// src/with-audit/periods/strategy.ts
-var NOT_ENABLED3 = new Error(
-  'Accounting periods require the periods strategy. Import `{ withPeriods }` from "@noy-db/hub/periods" and pass it to `createNoydb({ periodsStrategy: withPeriods() })`.'
-);
-var NO_PERIODS = {
-  async loadPeriods() {
-    return [];
-  },
-  async chainAnchor() {
-    return { priorPeriodHash: "" };
-  },
-  assertTsWritable() {
-  },
-  validatePeriodName() {
-    throw NOT_ENABLED3;
-  },
-  async appendPeriodLedgerEntry() {
-    throw NOT_ENABLED3;
-  }
-};
-
 // src/with-audit/periods/vault-facade.ts
 var VaultPeriods = class {
   constructor(deps) {
@@ -6986,7 +6811,7 @@ var VaultLinks = class {
 // src/with-shape/links/lazy-handle.ts
 function makeLazyLinkSetHandle(d) {
   let engine = null;
-  const load = () => engine ??= import("./link-set-GNGGCFI4.js").then(
+  const load = () => engine ??= import("./link-set-ZU4E5J5S.js").then(
     ({ LinkSet }) => new LinkSet(d.adapter, d.vault, d.name, d.spec, d.encrypted, d.getDEK, d.actor, d.emitter, d.endpointExists)
   );
   return {
@@ -7524,7 +7349,7 @@ function declareSatellite(ctx, collectionName, options, existingRegistry) {
   ctx.forEachSyncEngine((e) => e.remirrorPairResolvers([spec.base, spec.satellite]));
   const registry = reg;
   const baseSchema = ctx.getBaseSchema(spec.base);
-  void import("./post-register-A7HCFBP5.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
+  void import("./post-register-XIAHB6KF.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
   });
   return reg;
 }
@@ -8041,6 +7866,43 @@ var VaultAttestation = class {
 };
 
 // src/kernel/vault.ts
+var COLLECTION_PASSTHROUGH_KEYS = [
+  "indexes",
+  "reconcileOnOpen",
+  "prefetch",
+  "cache",
+  "schema",
+  "conflictPolicy",
+  "crdt",
+  "deterministicFields",
+  "acknowledgeDeterministicRisk",
+  "acknowledgeEquatableRisk",
+  "sensitive",
+  "perRecordKeys",
+  "provenance",
+  "ramCiphertext",
+  "tiers",
+  "tierMode",
+  "blobTierPolicy",
+  "i18nFields",
+  "embeddings",
+  "textIndexes",
+  "warmIndexOnOpen",
+  "textIndexPersist",
+  "moneyFields",
+  "viaFields",
+  "computed",
+  "classifiedFields",
+  "fieldMeta",
+  "meta"
+];
+function copyDefined(dst, src, keys) {
+  if (src === void 0) return;
+  for (const key of keys) {
+    const value = src[key];
+    if (value !== void 0) dst[key] = value;
+  }
+}
 var Vault = class {
   adapter;
   /** The vault's name as passed to `openVault()`. Stable for the instance lifetime. */
@@ -8058,36 +7920,22 @@ var Vault = class {
   syncAdapter;
   getPurgeableTargets;
   historyConfig;
-  /** tree-shake seam for the optional blob service; `undefined` means "blobs are off for this
-   *  vault" — every `collection.blob(id)` call throws with a pointer at `@noy-db/hub/blobs`. */
-  blobStrategy;
+  /**
+   * Every opt-in service, resolved once by `createNoydb` (#838). Shared by
+   * reference with the owning `Noydb` and with every `Collection` this vault
+   * opens, so all three always agree about which services are enabled.
+   */
+  strategies;
   objectStore;
-  /** Cold-storage archival strategy (the archive target store). */
-  archiveStrategy;
   /** Per-collection record archival policies. Indexed by collection name. */
   archiveRegistry = /* @__PURE__ */ new Map();
-  indexStrategy;
-  lazyStrategy;
-  aggregateStrategy;
-  crdtStrategy;
-  tiersStrategy;
-  searchStrategy;
-  /** Cargo (partition extraction) strategy — `NO_CARGO` (throwing) unless `withCargo()` was passed.
-   *  Public so the `extractPartition` free function (which takes a `Vault`) routes through it. */
-  cargoStrategy;
-  brokerStrategy;
-  sealedRecordStrategy;
-  portabilityStrategy;
-  sequenceStrategy;
-  consentStrategy;
   periods;
   linksEnforcer;
-  shadowStrategy;
-  historyStrategy;
-  forgetStrategy;
-  i18nStrategy;
-  syncStrategy;
-  classifiedStrategy;
+  /** Cargo (partition extraction) strategy — `NO_CARGO` (throwing) unless `withCargo()` was passed.
+   *  Public so the `extractPartition` free function (which takes a `Vault`) routes through it. */
+  get cargoStrategy() {
+    return this.strategies.cargo;
+  }
   /** Per-vault guard registry; `null` until `_initGuards()` runs (or for vaults that never register
    *  one) — the runtime class is dynamic-imported on demand to keep it out of the floor bundle. */
   guardRegistry = null;
@@ -8136,7 +7984,7 @@ var Vault = class {
    * @see docs/superpowers/specs/2026-06-17-fr6-deed-custodian-liberate-design.md
    */
   custody;
-  /** Re-derives an UnlockedKeyring from the adapter using the active user's passphrase; called by
+  /** Re-derives an UnlockedKeyring from the adapter using the active user's secret; called by
    *  `load()` after the on-disk keyring file has been replaced. Provided by Noydb at openVault()
    *  time; `undefined` in tests that construct Vault directly (load() then skips the refresh). */
   reloadKeyring;
@@ -8269,23 +8117,10 @@ var Vault = class {
     this.onRegisterConflictResolver = opts.onRegisterConflictResolver;
     this.syncAdapter = opts.syncAdapter;
     this.getPurgeableTargets = opts.getPurgeableTargets ?? (() => []);
-    this.blobStrategy = opts.blobStrategy;
+    this.strategies = opts.strategies;
     this.objectStore = opts.objectStore;
-    this.archiveStrategy = opts.archiveStrategy;
-    this.indexStrategy = opts.indexStrategy;
-    this.lazyStrategy = opts.lazyStrategy;
-    this.aggregateStrategy = opts.aggregateStrategy;
-    this.crdtStrategy = opts.crdtStrategy;
-    this.tiersStrategy = opts.tiersStrategy;
-    this.searchStrategy = opts.searchStrategy;
-    this.cargoStrategy = opts.cargoStrategy ?? NO_CARGO;
-    this.brokerStrategy = opts.brokerStrategy ?? NO_BROKER;
-    this.sealedRecordStrategy = opts.sealedRecordStrategy ?? NO_SEALED_RECORD;
-    this.portabilityStrategy = opts.portabilityStrategy ?? NO_PORTABILITY;
-    this.sequenceStrategy = opts.sequenceStrategy ?? NO_SEQUENCE;
-    this.consentStrategy = opts.consentStrategy ?? NO_CONSENT;
     this.periods = new VaultPeriods({
-      strategy: opts.periodsStrategy ?? NO_PERIODS,
+      strategy: this.strategies.periods,
       adapter: this.adapter,
       vault: this.name,
       encrypted: this.encrypted,
@@ -8310,12 +8145,6 @@ var Vault = class {
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       emitter: this.emitter
     });
-    this.shadowStrategy = opts.shadowStrategy ?? NO_SHADOW;
-    this.historyStrategy = opts.historyStrategy ?? NO_HISTORY;
-    this.forgetStrategy = opts.forgetStrategy ?? NO_FORGET;
-    this.i18nStrategy = opts.i18nStrategy ?? NO_I18N;
-    this.syncStrategy = opts.syncStrategy ?? NO_SYNC;
-    this.classifiedStrategy = opts.classifiedStrategy ?? NO_CLASSIFIED;
     this.graph = new ViaGraph();
     void opts.guardStrategies;
     this.historyConfig = opts.historyConfig ?? { enabled: true };
@@ -8330,19 +8159,19 @@ var Vault = class {
       getDEK: (collection) => this.getDEK(collection),
       role: () => this.keyring.role,
       getRawRecord: async (collection, recId) => await this.collection(collection).get(recId, { locale: "raw" })
-    }, opts.attestationStrategy ?? NO_ATTESTATION);
+    }, this.strategies.attestation);
     this.user = this.noydb.userApiFactory({
       adapter: this.adapter,
       vaultName: this.name,
       writerKeyringId: this.keyring.userId,
       getDek: () => this.getDEK(USER_ENVELOPE_COLLECTION),
       checkGate: (gate, presented) => this.noydb.checkGate(this.name, gate, presented),
-      exportAccessible: (opts2) => this.portabilityStrategy.exportAccessibleData(this, opts2),
-      unilateralWithdraw: (opts2) => this.portabilityStrategy.withdrawAccessibleData(this, opts2),
-      requestWithdraw: (opts2) => this.portabilityStrategy.requestWithdrawal(this, opts2),
-      listWithdrawals: (opts2) => this.portabilityStrategy.listWithdrawalRequests(this, opts2),
-      approveWithdraw: (requestId, opts2) => this.portabilityStrategy.approveWithdrawal(this, requestId, opts2),
-      rejectWithdraw: (requestId, opts2) => this.portabilityStrategy.rejectWithdrawal(this, requestId, opts2)
+      exportAccessible: (opts2) => this.strategies.portability.exportAccessibleData(this, opts2),
+      unilateralWithdraw: (opts2) => this.strategies.portability.withdrawAccessibleData(this, opts2),
+      requestWithdraw: (opts2) => this.strategies.portability.requestWithdrawal(this, opts2),
+      listWithdrawals: (opts2) => this.strategies.portability.listWithdrawalRequests(this, opts2),
+      approveWithdraw: (requestId, opts2) => this.strategies.portability.approveWithdrawal(this, requestId, opts2),
+      rejectWithdraw: (requestId, opts2) => this.strategies.portability.rejectWithdrawal(this, requestId, opts2)
     });
     this.custody = new CustodyApi(
       (options, factors) => this.noydb.grantCustodian(this.name, options, factors),
@@ -8400,7 +8229,7 @@ var Vault = class {
    *  dispatch reads/writes — from this vault's OWN privates, rather than passing `this` itself. */
   _viaReconcileCtx() {
     return {
-      i18nStrategy: this.i18nStrategy,
+      i18nStrategy: this.strategies.i18n,
       locale: this.locale,
       translateText: this.translateText,
       i18nFieldRegistry: this.i18nFieldRegistry,
@@ -8441,7 +8270,7 @@ var Vault = class {
       this.satelliteRegistry = declareSatellite({
         adapter: this.adapter,
         vaultName: this.name,
-        forgetSubjects: this.forgetStrategy.subjects,
+        forgetSubjects: this.strategies.forget.subjects,
         getDEK: this.getDEK,
         getBaseSchema: (base) => this.collectionCache.get(base)?.getSchema(),
         getBaseCrdt: (base) => this.collectionCache.get(base)?.getConfig()?.crdt,
@@ -8520,7 +8349,7 @@ var Vault = class {
         const strategies = options.schemaUpdate ?? [];
         const work = (async () => {
           const dek = await this.getDEK(collectionName);
-          const { persistSchemaIfNeeded } = await import("./register-YBMRLZLO.js");
+          const { persistSchemaIfNeeded } = await import("./register-HB4TQZSV.js");
           const result = await persistSchemaIfNeeded({
             store: this.adapter,
             vault: this.name,
@@ -8561,22 +8390,9 @@ var Vault = class {
         // #693: re-create gate fallback
         historyConfig: effectiveHistoryConfig,
         historyConfigExplicit: options?.historyConfig !== void 0,
-        // thread the vault-wide blob strategy into every
-        // collection. `undefined` is intentionally preserved so the
-        // Collection constructor uses its NO_BLOBS default.
-        ...this.blobStrategy !== void 0 ? { blobStrategy: this.blobStrategy } : {},
         ...this.objectStore !== void 0 ? { objectStore: this.objectStore } : {},
         ...options?.blobFields !== void 0 ? { blobFields: options.blobFields } : {},
-        ...this.indexStrategy !== void 0 ? { indexStrategy: this.indexStrategy } : {},
-        ...this.lazyStrategy !== void 0 ? { lazyStrategy: this.lazyStrategy } : {},
-        ...this.aggregateStrategy !== void 0 ? { aggregateStrategy: this.aggregateStrategy } : {},
-        ...this.crdtStrategy !== void 0 ? { crdtStrategy: this.crdtStrategy } : {},
-        ...this.tiersStrategy !== void 0 ? { tiersStrategy: this.tiersStrategy } : {},
-        ...this.searchStrategy !== void 0 ? { searchStrategy: this.searchStrategy } : {},
-        historyStrategy: this.historyStrategy,
-        i18nStrategy: this.i18nStrategy,
-        syncStrategy: this.syncStrategy,
-        classifiedStrategy: this.classifiedStrategy,
+        strategies: this.strategies,
         // Per-collection ledger opt-out: when this collection sets
         // `historyConfig.ledger: false`, withhold the ledger reference so all
         // four `if (this.ledger)` append sites in Collection no-op. The chain
@@ -8614,27 +8430,8 @@ var Vault = class {
           }
         } : {}
       };
-      if (options?.indexes !== void 0) collOpts.indexes = options.indexes;
-      if (options?.reconcileOnOpen !== void 0) collOpts.reconcileOnOpen = options.reconcileOnOpen;
-      if (options?.prefetch !== void 0) collOpts.prefetch = options.prefetch;
-      if (options?.cache !== void 0) collOpts.cache = options.cache;
-      if (options?.schema !== void 0) collOpts.schema = options.schema;
-      if (options?.conflictPolicy !== void 0) collOpts.conflictPolicy = options.conflictPolicy;
-      if (options?.crdt !== void 0) collOpts.crdt = options.crdt;
-      if (options?.deterministicFields !== void 0) {
-        collOpts.deterministicFields = options.deterministicFields;
-      }
-      if (options?.acknowledgeDeterministicRisk !== void 0) {
-        collOpts.acknowledgeDeterministicRisk = options.acknowledgeDeterministicRisk;
-      }
-      if (options?.acknowledgeEquatableRisk !== void 0) {
-        collOpts.acknowledgeEquatableRisk = options.acknowledgeEquatableRisk;
-      }
-      if (options?.sensitive !== void 0) {
-        collOpts.sensitive = options.sensitive;
-      }
-      if (options?.perRecordKeys !== void 0) collOpts.perRecordKeys = options.perRecordKeys;
-      const subjectKey = this.forgetStrategy.subjects[collectionName];
+      copyDefined(collOpts, options, COLLECTION_PASSTHROUGH_KEYS);
+      const subjectKey = this.strategies.forget.subjects[collectionName];
       if (subjectKey !== void 0) {
         if (options?.perRecordKeys === false) {
           console.warn(
@@ -8648,22 +8445,8 @@ var Vault = class {
           if (value !== void 0 && value !== null) await this._addSubjectRef(coerceSubjectId(value), { collection: collectionName, id });
         };
       }
-      if (options?.provenance !== void 0) collOpts.provenance = options.provenance;
-      if (options?.ramCiphertext !== void 0) collOpts.ramCiphertext = options.ramCiphertext;
-      if (options?.tiers !== void 0) collOpts.tiers = options.tiers;
-      if (options?.tierMode !== void 0) collOpts.tierMode = options.tierMode;
-      if (options?.blobTierPolicy !== void 0) collOpts.blobTierPolicy = options.blobTierPolicy;
       collOpts.onCrossTierAccess = (event) => this.emitCrossTier(event);
       if (this.syncAdapter !== void 0) collOpts.syncAdapter = this.syncAdapter;
-      if (options?.i18nFields !== void 0) collOpts.i18nFields = options.i18nFields;
-      if (options?.embeddings !== void 0) collOpts.embeddings = options.embeddings;
-      if (options?.textIndexes !== void 0) collOpts.textIndexes = options.textIndexes;
-      if (options?.warmIndexOnOpen !== void 0) collOpts.warmIndexOnOpen = options.warmIndexOnOpen;
-      if (options?.textIndexPersist !== void 0) collOpts.textIndexPersist = options.textIndexPersist;
-      if (options?.moneyFields !== void 0) collOpts.moneyFields = options.moneyFields;
-      if (options?.viaFields !== void 0) collOpts.viaFields = options.viaFields;
-      if (options?.computed !== void 0) collOpts.computed = options.computed;
-      if (options?.classifiedFields !== void 0) collOpts.classifiedFields = options.classifiedFields;
       if (effectiveViaFields.dictKeyFields !== void 0 || effectiveViaFields.lookupFields !== void 0) {
         collOpts.dictLabelResolver = async (dictName, key, locale, fallback) => {
           const stat = this.staticByName.get(dictName);
@@ -8697,10 +8480,6 @@ var Vault = class {
       if (effectiveViaFields.i18nFields !== void 0 && this.translateText) {
         collOpts.autoTranslateHook = this.translateText;
       }
-      if (options?.fieldMeta !== void 0) {
-        collOpts.fieldMeta = options.fieldMeta;
-      }
-      if (options?.meta !== void 0) collOpts.meta = options.meta;
       if (options?.refs !== void 0) {
         collOpts.declaredRefs = this.refRegistry.getOutbound(collectionName);
       }
@@ -8719,7 +8498,7 @@ var Vault = class {
         const work = (async () => {
           try {
             const dek = await this.getDEK(collectionName);
-            await (await import("./register-YBMRLZLO.js")).persistSchemaIfNeeded({
+            await (await import("./register-HB4TQZSV.js")).persistSchemaIfNeeded({
               store: this.adapter,
               vault: this.name,
               collectionName,
@@ -9015,7 +8794,7 @@ var Vault = class {
       const values = getAtPath(obj, field);
       for (const value of values) {
         if (value === void 0 || value === null) continue;
-        this.i18nStrategy.validateI18nTextValue(value, field, descriptor);
+        this.strategies.i18n.validateI18nTextValue(value, field, descriptor);
       }
     }
   }
@@ -9056,7 +8835,7 @@ var Vault = class {
     this.reservedLookupCollections.set(dictCollectionName(name), name);
     let handle = this.dictionaryCache.get(name);
     if (!handle) {
-      handle = this.i18nStrategy.buildDictionaryHandle({
+      handle = this.strategies.i18n.buildDictionaryHandle({
         adapter: this.adapter,
         compartmentName: this.name,
         dictionaryName: name,
@@ -9217,7 +8996,7 @@ var Vault = class {
    * is re-keyed for distinct recipients.
    *
    * Each recipient becomes its own `KeyringFile` sealed with that
-   * recipient's passphrase. The DEKs wrapped into each slot are
+   * recipient's secret. The DEKs wrapped into each slot are
    * exactly those the recipient's role + permissions justify, and
    * never wider than the source keyring's own DEK set
    * (privilege-escalation check).
@@ -9269,7 +9048,7 @@ var Vault = class {
       };
     }
     if (!this.sequenceStore) {
-      this.sequenceStore = this.sequenceStrategy.createStore({
+      this.sequenceStore = this.strategies.sequence.createStore({
         adapter: this.adapter,
         vault: this.name,
         encrypted: this.encrypted,
@@ -9367,7 +9146,7 @@ var Vault = class {
     return runListArchived(this._archiveContext(), collection);
   }
   _archiveContext() {
-    const strategy = this.archiveStrategy;
+    const strategy = this.strategies.archive;
     if (!strategy) {
       throw new Error(
         "vault.archive/restore/listArchived require `archiveStrategy: withArchive({ store })` in createNoydb"
@@ -9534,7 +9313,7 @@ var Vault = class {
    */
   getLedgerOrNull() {
     if (!this.ledgerStore) {
-      this.ledgerStore = this.historyStrategy.buildLedger({
+      this.ledgerStore = this.strategies.history.buildLedger({
         adapter: this.adapter,
         vault: this.name,
         encrypted: this.encrypted,
@@ -9559,7 +9338,7 @@ var Vault = class {
    * number of distinct subjects re-indexed.
    */
   async rebuildSubjectIndex() {
-    if (Object.keys(this.forgetStrategy.subjects).length === 0) {
+    if (Object.keys(this.strategies.forget.subjects).length === 0) {
       throw new ForgetStrategyNotConfiguredError();
     }
     return rebuildSubjectIndex(
@@ -9567,7 +9346,7 @@ var Vault = class {
       this.name,
       this.getDEK,
       this.encrypted,
-      this.forgetStrategy.subjects,
+      this.strategies.forget.subjects,
       async (collectionName, id, env) => {
         const coll = this.collection(collectionName);
         return coll._decodeEnvelope(env, id);
@@ -9592,7 +9371,7 @@ var Vault = class {
    * @throws ForgetStrategyNotConfiguredError when no `withForgetCascade` was set.
    */
   async forget(subjectId) {
-    if (Object.keys(this.forgetStrategy.subjects).length === 0) {
+    if (Object.keys(this.strategies.forget.subjects).length === 0) {
       throw new ForgetStrategyNotConfiguredError();
     }
     const ledger = this.getLedgerOrNull();
@@ -9614,17 +9393,17 @@ var Vault = class {
     const sealedResidue = [];
     const indexResidue = [];
     const ledgerDeltaResidue = [];
-    const blobsEnabled = this.blobStrategy !== void 0;
+    const blobsEnabled = this.strategies.blob !== NO_BLOBS;
     const actor = this.keyring.userId;
     const fanoutStats = { recordsErased: 0, aggregatesRecomputed: 0, residueFrozen: [], lookupReferencesCascaded: 0, lookupReferencesNullified: 0, lookupReferencesResidue: [], derivedResidueUndecodable: [], derivedResidueDeclined: [] };
     const { partitionSealedCekKeys, shouldSkipBlobScan, bumpResidueCount, residueNoticesFromMap } = await import("./purge-scope-FGNNLWHD.js");
-    const scopedPurge = this.forgetStrategy.scopedPurge === true;
+    const scopedPurge = this.strategies.forget.scopedPurge === true;
     const sealedCekScopedSkipped = /* @__PURE__ */ new Map();
     const blobScopedSkipped = /* @__PURE__ */ new Map();
     for (const ref2 of allRefs) {
       const coll = this.collection(ref2.collection);
       const satelliteOf = ref2.satelliteOf;
-      const perRecordKeys = this.forgetStrategy.subjects[satelliteOf ?? ref2.collection] !== void 0;
+      const perRecordKeys = this.strategies.forget.subjects[satelliteOf ?? ref2.collection] !== void 0;
       const lookupCompareKeys = await this.linksEnforcer.checkLookupRefsRestrict(this.graph, ref2.collection, ref2.collection, ref2.id);
       const live = await this.adapter.get(this.name, ref2.collection, ref2.id);
       if (perRecordKeys && live && live._data && !hasPerRecordKey(live)) {
@@ -9684,7 +9463,7 @@ var Vault = class {
         collections.add(ref2.collection);
         await forgetDerivedFanout(this, { collection: ref2.collection, id: ref2.id }, live, fanoutStats, lookupCompareKeys);
       }
-      historyVersionsShredded += await this.historyStrategy.tombstoneHistory(
+      historyVersionsShredded += await this.strategies.history.tombstoneHistory(
         this.adapter,
         this.name,
         ref2.collection,
@@ -9814,7 +9593,7 @@ var Vault = class {
    *   `<collection>/<id>/<pid>` key the delivery envelope was written under.
    */
   async sealRecordToHost(collection, id, hostSealer, opts) {
-    return this.sealedRecordStrategy.sealRecordToHost(this._sealingContext(), collection, id, hostSealer, opts);
+    return this.strategies.sealedRecord.sealRecordToHost(this._sealingContext(), collection, id, hostSealer, opts);
   }
   /**
    * Revoke a sealed-CEK grant. **Default is SOFT**: deletes the `pid` delivery
@@ -9824,7 +9603,7 @@ var Vault = class {
    * longer open the record. See `revokeSealedRecord` in `record-keys/sealing.ts`.
    */
   async revokeSealedRecord(collection, id, pid, opts) {
-    return this.sealedRecordStrategy.revokeSealedRecord(this._sealingContext(), collection, id, pid, opts);
+    return this.strategies.sealedRecord.revokeSealedRecord(this._sealingContext(), collection, id, pid, opts);
   }
   /**
    * HARD-rotate a record's CEK: decrypt the live body under the old CEK,
@@ -9844,7 +9623,7 @@ var Vault = class {
    * @throws {@link RecordCekNotFoundError} if the record is missing or has no `_cek`.
    */
   async rotateRecordCek(collection, id) {
-    return this.sealedRecordStrategy.rotateRecordCek(this._sealingContext(), collection, id);
+    return this.strategies.sealedRecord.rotateRecordCek(this._sealingContext(), collection, id);
   }
   /**
    * Build the {@link SealingContext} the record-keys grantor functions need:
@@ -9906,7 +9685,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-ZULMLCJK.js"),
+      import("./registry-JOFO7RAH.js"),
       import("./read-only-facade-CHCKSEPD.js")
     ]);
     const registry = new DerivationRegistry();
@@ -9938,7 +9717,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-4V4YQCXJ.js");
+    const { MaterializedViewRegistry } = await import("./registry-6BMBFEXT.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -9963,7 +9742,7 @@ var Vault = class {
    */
   async _initOverlayedViews(handles) {
     if (handles.length === 0) return;
-    const { OverlayedViewRegistry } = await import("./registry-3LXKNXWI.js");
+    const { OverlayedViewRegistry } = await import("./registry-7CZWF3EQ.js");
     const registry = new OverlayedViewRegistry();
     const mvRegistry = this.materializedViewRegistry;
     const overlayNames = /* @__PURE__ */ new Set();
@@ -10010,14 +9789,14 @@ var Vault = class {
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-YORMIBWV.js");
+    const { MaterializedViewExecutor } = await import("./executor-SHYLIBOM.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this,
       dispatchCtx: this._dispatchCtx({ collection: name, id: "refreshView" })
     });
-    const { clearMVStaleFully } = await import("./stale-4UNPHWOU.js");
+    const { clearMVStaleFully } = await import("./stale-NBROTA66.js");
     await clearMVStaleFully(this.adapter, this.name, registry, name);
     return result;
   }
@@ -10030,7 +9809,7 @@ var Vault = class {
     if (registry === null) return { derived: 0, failed: 0, skippedFrozen: 0 };
     const strategies = registry.strategiesForSource(sourceCollection);
     if (strategies.length === 0) return { derived: 0, failed: 0, skippedFrozen: 0 };
-    const { DerivationExecutor } = await import("./executor-TEZYRDN3.js");
+    const { DerivationExecutor } = await import("./executor-FCJEH3FU.js");
     const sourceColl = this.collection(sourceCollection);
     const records = await sourceColl.list();
     const ctx = { vault: this.derivationFacade ?? new (await import("./read-only-facade-CHCKSEPD.js")).ReadOnlyVaultFacade(this, "derivation") };
@@ -10057,7 +9836,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-HJV3A7PM.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-WWXVHHUH.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key, this.getDEK, this.encrypted);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -10151,7 +9930,7 @@ var Vault = class {
    */
   at(timestamp) {
     const iso = timestamp instanceof Date ? timestamp.toISOString() : timestamp;
-    return this.historyStrategy.buildVaultInstant(
+    return this.strategies.history.buildVaultInstant(
       {
         adapter: this.adapter,
         name: this.name,
@@ -10183,11 +9962,11 @@ var Vault = class {
    *.
    */
   frame() {
-    return this.shadowStrategy.buildFrame(this);
+    return this.strategies.shadow.buildFrame(this);
   }
   /** Credential-broker handle (#479); `NO_BROKER` throws unless `brokerStrategy: withBroker(config)` was passed to createNoydb(). */
   broker() {
-    return buildCredentialBrokerHandle(this.brokerStrategy, this.adapter, this.name, () => this.keyring);
+    return buildCredentialBrokerHandle(this.strategies.broker, this.adapter, this.name, () => this.keyring);
   }
   /**
    * Run `fn` under a consent scope. Every `get` / `put` / `delete`
@@ -10229,7 +10008,7 @@ var Vault = class {
    *.
    */
   async consentAudit(filter = {}) {
-    return this.consentStrategy.read(this.adapter, this.name, this.encrypted, this.getDEK, filter);
+    return this.strategies.consent.read(this.adapter, this.name, this.encrypted, this.getDEK, filter);
   }
   /**
    * Called by Collection after every access when a consent scope is
@@ -10240,7 +10019,7 @@ var Vault = class {
   async _logConsent(op, collection, recordId) {
     const ctx = this.consentContext;
     if (!ctx) return;
-    await this.consentStrategy.write(
+    await this.strategies.consent.write(
       this.adapter,
       this.name,
       this.encrypted,
@@ -10284,10 +10063,10 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-UT76AQIG.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-WWZPEDK2.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
-        "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (passphrase) first."
+        "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (secret) first."
       );
     }
     const targetKek = this.keyring.kek;
@@ -10306,7 +10085,7 @@ var Vault = class {
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-UT76AQIG.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-WWZPEDK2.js");
     await revokeDelegation(this.adapter, this.name, id);
     void DELEGATIONS_COLLECTION;
   }
@@ -10554,7 +10333,7 @@ var Vault = class {
    * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
    */
   async dumpSchema(opts = {}) {
-    const { dumpVaultSchema } = await import("./walk-H4YE52S2.js");
+    const { dumpVaultSchema } = await import("./walk-E3OVLBFR.js");
     return dumpVaultSchema(this, opts);
   }
   /**
@@ -10689,7 +10468,7 @@ var Vault = class {
    * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md
    */
   async getCover(opts = {}) {
-    const { readCover } = await import("./cover-B5MY43CK.js");
+    const { readCover } = await import("./cover-5BSNJREH.js");
     return readCover(this.adapter, this.name, opts);
   }
   /**
@@ -10704,7 +10483,7 @@ var Vault = class {
    * both modes round-trip cleanly.
    */
   async dump() {
-    const { dumpVault } = await import("./backup-JL2GOTYQ.js");
+    const { dumpVault } = await import("./backup-YCHAC575.js");
     return dumpVault(this.backupContext());
   }
   /**
@@ -10719,7 +10498,7 @@ var Vault = class {
       vault: this.name,
       userId: () => this.keyring.userId,
       getLedgerOrNull: () => this.getLedgerOrNull(),
-      envelopePayloadHash: (envelope) => this.historyStrategy.envelopePayloadHash(envelope),
+      envelopePayloadHash: (envelope) => this.strategies.history.envelopePayloadHash(envelope),
       reloadKeyringAndRebuildDEK: async () => {
         if (this.reloadKeyring) {
           this.keyring = await this.reloadKeyring();
@@ -10756,7 +10535,7 @@ var Vault = class {
    * — there's no chain to verify against.
    */
   async load(backupJson) {
-    const { loadVault } = await import("./backup-JL2GOTYQ.js");
+    const { loadVault } = await import("./backup-YCHAC575.js");
     return loadVault(this.backupContext(), backupJson);
   }
   /**
@@ -10788,7 +10567,7 @@ var Vault = class {
    * way to detect tampering of an in-place vault.
    */
   async verifyBackupIntegrity() {
-    const { verifyBackupIntegrity } = await import("./backup-JL2GOTYQ.js");
+    const { verifyBackupIntegrity } = await import("./backup-YCHAC575.js");
     return verifyBackupIntegrity(this.backupContext());
   }
   /**
@@ -11006,7 +10785,7 @@ var Vault = class {
    * is the live validator object, not a serialization of it).
    */
   async exportJSON(opts = {}) {
-    const { exportVaultJSON } = await import("./backup-JL2GOTYQ.js");
+    const { exportVaultJSON } = await import("./backup-YCHAC575.js");
     return exportVaultJSON(this.backupContext(), opts);
   }
 };
@@ -11404,25 +11183,6 @@ var QuickUnlockStore = class {
   }
 };
 
-// src/with-fork/snapshots/strategy.ts
-var NOT_ENABLED4 = new Error(
-  'Snapshots require the snapshot strategy. Import `{ withSnapshots }` from "@noy-db/hub/snapshots" and pass it to `createNoydb({ snapshotStrategy: withSnapshots({ store }) })`.'
-);
-var NO_SNAPSHOTS = {
-  async snapshot() {
-    throw NOT_ENABLED4;
-  },
-  async listSnapshots() {
-    throw NOT_ENABLED4;
-  },
-  async restoreSnapshot() {
-    throw NOT_ENABLED4;
-  },
-  async autoSnapshot() {
-    throw NOT_ENABLED4;
-  }
-};
-
 // src/with-fork/snapshots/scheduler.ts
 var SnapshotScheduler = class {
   policy;
@@ -11623,19 +11383,6 @@ var NoydbSnapshots = class {
   }
 };
 
-// src/with-commit/tx/strategy.ts
-var NOT_ENABLED5 = new Error(
-  'Multi-record transactions require the tx strategy. Import `{ withTransactions }` from "@noy-db/hub/tx" and pass it to `createNoydb({ txStrategy: withTransactions() })`.'
-);
-var NO_TX = {
-  async runTransaction(_db, _fn, _options, _txInvariants) {
-    throw NOT_ENABLED5;
-  },
-  async runDryRun() {
-    throw NOT_ENABLED5;
-  }
-};
-
 // src/kernel/memory-store.ts
 function memoryStore() {
   const store = /* @__PURE__ */ new Map();
@@ -11719,23 +11466,6 @@ function memoryStore() {
   };
 }
 
-// src/with-party/session/strategy.ts
-function notEnabled3(op) {
-  return new Error(
-    `${op} requires the session strategy. Import \`{ withSession }\` from "@noy-db/hub/session" and pass it to \`createNoydb({ sessionStrategy: withSession() })\`.`
-  );
-}
-var NO_SESSION = {
-  validateSessionPolicy() {
-    throw notEnabled3("sessionPolicy");
-  },
-  createEnforcer() {
-    throw notEnabled3("session policy enforcement");
-  },
-  revokeAllSessions() {
-  }
-};
-
 // src/with-party/auth-introspection/index.ts
 async function describeAuthConfig(store, vault) {
   const policy = await loadVaultPolicy(store, vault) ?? defaultPolicySnapshot();
@@ -11743,8 +11473,8 @@ async function describeAuthConfig(store, vault) {
   const lines = [];
   lines.push(`Vault "${vault}" \u2014 three-tier authentication`);
   lines.push("");
-  lines.push("Tier 1 \u2014 Passphrase (master)");
-  lines.push(`  Phrase format: ${policy.passphrase?.minWords ?? 6}+ words, lowercase letters, \u2265${policy.passphrase?.minWordLength ?? 3} chars/word`);
+  lines.push("Tier 1 \u2014 Secret (master)");
+  lines.push(`  Phrase format: ${policy.secret?.minWords ?? 6}+ words, lowercase letters, \u2265${policy.secret?.minWordLength ?? 3} chars/word`);
   lines.push("  Strength validator: enforced (override available for tests only)");
   lines.push("");
   lines.push("Tier 2 \u2014 Authenticate (routine login)");
@@ -11755,7 +11485,7 @@ async function describeAuthConfig(store, vault) {
   lines.push("  Method: PIN (per-app configurable)");
   lines.push("");
   lines.push(`Recovery profiles enrolled: ${recoveryProfiles.length === 0 ? "none" : recoveryProfiles.join(", ")}`);
-  lines.push("Managed-passphrase mode: off (post-1.0)");
+  lines.push("Managed-secret mode: off (post-1.0)");
   lines.push("");
   lines.push("Sensitive-action gates:");
   for (const [gate, gp] of Object.entries(policy.gates)) {
@@ -11768,7 +11498,7 @@ async function diagramAuthConfig(store, vault) {
   const lines = [];
   lines.push("flowchart TB");
   lines.push(`  vault["Vault: ${escapeMermaid(vault)}"]`);
-  lines.push('  tier1["Tier 1<br/>Passphrase"]');
+  lines.push('  tier1["Tier 1<br/>Secret"]');
   lines.push('  tier2["Tier 2<br/>Multi-slot Authenticate"]');
   lines.push('  tier3["Tier 3<br/>PIN / Quick-resume"]');
   lines.push("  vault --> tier1");
@@ -11842,7 +11572,7 @@ function describeGatePolicy(gp) {
 }
 function defaultPolicySnapshot() {
   return {
-    passphrase: { minWords: 6, minWordLength: 3, rejectRepeatedAdjacent: true },
+    secret: { minWords: 6, minWordLength: 3, rejectRepeatedAdjacent: true },
     gates: {}
   };
 }
@@ -11992,7 +11722,7 @@ var TeamFacade = class {
    * ```ts
    * import { enrollWebAuthn } from '@noy-db/on-webauthn'
    *
-   * await db.enrollWebAuthn('demo', async (keyring) => {
+   * await db.team.enrollWebAuthn('demo', async (keyring) => {
    *   const e = await enrollWebAuthn(keyring, 'demo', { rp: {...} })
    *   return {
    *     id: `webauthn-${e.credentialId.slice(0, 8)}`,
@@ -12021,7 +11751,7 @@ var TeamFacade = class {
     const slotOptions = await ceremony(keyring);
     if (slotOptions.method !== "webauthn") {
       throw new ValidationError(
-        `enrollWebAuthn: ceremony returned method "${slotOptions.method}"; expected "webauthn". Use db.enrollAuthenticator() for non-webauthn methods.`
+        `enrollWebAuthn: ceremony returned method "${slotOptions.method}"; expected "webauthn". Use db.team.enrollAuthenticator() for non-webauthn methods.`
       );
     }
     const credentialId = slotOptions.meta.credentialId;
@@ -12099,44 +11829,44 @@ var TeamFacade = class {
   }
   // ─── Tier-1 change flows ────────────────────────────────────────
   /**
-   * Rotate the user's passphrase (user remembers old). Validates the
-   * new phrase against the configured `passphrase` policy, runs the
-   * `rotate-passphrase` gate, then re-derives + re-wraps every DEK.
+   * Rotate the user's secret (user remembers old). Validates the
+   * new phrase against the configured `secret` policy, runs the
+   * `rotate-secret` gate, then re-derives + re-wraps every DEK.
    *
    * Tier-2 authenticator slots are dropped — each slot wraps the old
    * KEK and would need its derivation key to be re-presented. Re-enrol
    * via `db.enrollAuthenticator` after rotation.
    *
-   * @throws `WeakPassphraseError` on a weak new phrase.
+   * @throws `WeakSecretError` on a weak new phrase.
    * @throws `PolicyDeniedError` when the gate denies (missing factor, …).
-   * @throws `InvalidKeyError` when `oldPassphrase` is wrong.
+   * @throws `InvalidKeyError` when `oldSecret` is wrong.
    */
-  async rotatePassphrase(vault, input, factors) {
-    if (this.deps.options.passphraseMode === "managed") {
+  async rotateSecret(vault, input, factors) {
+    if (this.deps.options.secretMode === "managed") {
       throw new PolicyDeniedError(
-        "rotate-passphrase",
+        "rotate-secret",
         "disabled",
         { minTier: 1, enabled: false },
-        "Managed-passphrase mode (#14): the passphrase is hub-generated and sealed under the SealingKeyProvider \u2014 there is no plaintext to rotate. Use the recovery flow (follow-up issue) to mint a fresh sealed passphrase."
+        "Managed-secret mode (#14): the secret is hub-generated and sealed under the SealingKeyProvider \u2014 there is no plaintext to rotate. Use the recovery flow (follow-up issue) to mint a fresh sealed secret."
       );
     }
-    await this.deps.checkGate(vault, "rotate-passphrase", factors);
+    await this.deps.checkGate(vault, "rotate-secret", factors);
     const userId = this.deps.options.user;
-    const next = await rotatePassphrase(this.deps.options.store, vault, userId, input);
+    const next = await rotateSecret(this.deps.options.store, vault, userId, input);
     this.deps.keyringCache.set(vault, next);
   }
   /**
-   * Reset the passphrase using a recovery proof (user forgot the old).
+   * Reset the secret using a recovery proof (user forgot the old).
    * Currently supports the `'paper'` profile end-to-end; the
    * other profiles throw {@link RecoveryProfileNotImplementedError}.
    *
    * Burns the used recovery entry on success.
    */
-  async recoverPassphrase(vault, input, factors) {
-    await this.deps.checkGate(vault, "recover-passphrase", factors);
+  async recoverSecret(vault, input, factors) {
+    await this.deps.checkGate(vault, "recover-secret", factors);
     const userId = this.deps.options.user;
     const entriesBeforeRecovery = await loadPaperRecoveryEntries(this.deps.options.store, vault);
-    const next = await recoverPassphrase(this.deps.options.shamirRecovery, this.deps.options.store, vault, userId, input);
+    const next = await recoverSecret(this.deps.options.shamirRecovery, this.deps.options.store, vault, userId, input);
     this.deps.keyringCache.set(vault, next);
     const rotateRemaining = input.rotateRemainingCodes ?? true;
     const remainingAfterBurn = Math.max(0, entriesBeforeRecovery.length - 1);
@@ -12158,15 +11888,15 @@ var TeamFacade = class {
   }
   /**
    * Deliberate paper-recovery-code regeneration. User knows their
-   * passphrase but wants a fresh sheet — they lost the printout or
+   * secret but wants a fresh sheet — they lost the printout or
    * suspect compromise of the off-site copy.
    *
-   * Symmetric to {@link rotatePassphrase} for the recovery profile:
+   * Symmetric to {@link rotateSecret} for the recovery profile:
    * gated, audit-trackable, ergonomic. Replaces (not appends) the
    * paper sheet under `_meta/recovery-paper` in a single envelope `put`.
    *
    * Gated by the `rotate-recovery` policy gate:
-   *   - PERSONAL_POLICY: `{ minTier: 1 }` — knowing the passphrase
+   *   - PERSONAL_POLICY: `{ minTier: 1 }` — knowing the secret
    *     suffices, matching the lower-level flow's bar.
    *   - STRICT_POLICY: `{ minTier: 1, factors: [{ anyOf: ['totp',
    *     'email-otp', 'webauthn-roaming'] }] }` — rotation is an
@@ -12186,13 +11916,13 @@ var TeamFacade = class {
    *
    * @example Default count + show-once UI
    * ```ts
-   * const { newCodes } = await db.rotateRecovery('acme', { profile: 'paper' })
+   * const { newCodes } = await db.team.rotateRecovery('acme', { profile: 'paper' })
    * showCodesToUser(newCodes)
    * ```
    *
    * @example STRICT-policy site with TOTP factor proof
    * ```ts
-   * await db.rotateRecovery(
+   * await db.team.rotateRecovery(
    *   'acme',
    *   { profile: 'paper', count: 10 },
    *   { factors: [{ kind: 'totp', proof: '123456' }] },
@@ -12216,7 +11946,7 @@ var TeamFacade = class {
     const existing = await loadPaperRecoveryEntries(this.deps.options.store, vault);
     if (existing.length === 0) {
       throw new Error(
-        `db.rotateRecovery: no recovery codes are enrolled for vault "${vault}". Call db.enrollRecovery({ profile: 'paper', entries }) first; rotateRecovery replaces an existing sheet rather than minting one from scratch.`
+        `db.rotateRecovery: no recovery codes are enrolled for vault "${vault}". Call db.team.enrollRecovery({ profile: 'paper', entries }) first; rotateRecovery replaces an existing sheet rather than minting one from scratch.`
       );
     }
     const keyring = await this.getKeyring(vault);
@@ -12238,7 +11968,7 @@ var TeamFacade = class {
     const existing = await loadShamirRecoveryEntries(this.deps.options.store, vault);
     if (existing.length === 0) {
       throw new Error(
-        `db.rotateRecovery: no Shamir recovery entry is enrolled for vault "${vault}". Call db.enrollRecovery({ profile: 'shamir', k, n }) first; rotateRecovery replaces an existing entry rather than minting one from scratch.`
+        `db.rotateRecovery: no Shamir recovery entry is enrolled for vault "${vault}". Call db.team.enrollRecovery({ profile: 'shamir', k, n }) first; rotateRecovery replaces an existing entry rather than minting one from scratch.`
       );
     }
     let targetEntryId;
@@ -12275,7 +12005,7 @@ var TeamFacade = class {
    * **Atomic create-and-enroll for managed-mode vaults.**
    *
    * Bootstraps a managed-mode vault and enrolls strong recovery in
-   * a single ceremony. Under `passphraseMode: 'managed'`, every
+   * a single ceremony. Under `secretMode: 'managed'`, every
    * `openVault` call requires a strong recovery profile (Shamir
    * today) to be enrolled — otherwise it throws
    * {@link ManagedRecoveryNotEnrolledError}. This method bypasses
@@ -12294,11 +12024,11 @@ var TeamFacade = class {
    * ```ts
    * const db = await createNoydb({
    *   store, user: 'alice',
-   *   passphraseMode: 'managed',
+   *   secretMode: 'managed',
    *   sealingKey: macosKeychainSealingProvider({ ... }),
    * })
    *
-   * const { vault, recoveryEnrollments } = await db.openVaultAndEnrollRecovery('acme', {
+   * const { vault, recoveryEnrollments } = await db.team.openVaultAndEnrollRecovery('acme', {
    *   recovery: [{ profile: 'shamir', k: 2, n: 3 }],
    * })
    * for (const r of recoveryEnrollments) {
@@ -12315,11 +12045,11 @@ var TeamFacade = class {
         "openVaultAndEnrollRecovery: at least one recovery enrollment is required."
       );
     }
-    if (this.deps.options.passphraseMode === "managed") {
+    if (this.deps.options.secretMode === "managed") {
       const hasStrong = opts.recovery.some((r) => r.profile === "shamir");
       if (!hasStrong) {
         throw new ValidationError(
-          'openVaultAndEnrollRecovery: managed-mode vaults require at least one strong recovery profile in the `recovery` array. Paper alone is not strong under managed mode (no user passphrase to fall back on). Include { profile: "shamir", k, n } in `recovery`.'
+          'openVaultAndEnrollRecovery: managed-mode vaults require at least one strong recovery profile in the `recovery` array. Paper alone is not strong under managed mode (no user secret to fall back on). Include { profile: "shamir", k, n } in `recovery`.'
         );
       }
     }
@@ -12334,7 +12064,7 @@ var TeamFacade = class {
     for (const enrollment of opts.recovery) {
       recoveryEnrollments.push(await this.enrollRecovery(vault, enrollment));
     }
-    if (this.deps.options.passphraseMode === "managed") {
+    if (this.deps.options.secretMode === "managed") {
       const policy = this.deps.policyCache.get(vault);
       if (policy) {
         await this.deps.assertRecoveryEnrolled(vault, policy);
@@ -12343,20 +12073,20 @@ var TeamFacade = class {
     return { vault: vaultHandle, recoveryEnrollments };
   }
   /**
-   * **Recovery flow under managed-passphrase mode.**
+   * **Recovery flow under managed-secret mode.**
    *
-   * Replaces the sealed passphrase of a managed-mode vault with a
+   * Replaces the sealed secret of a managed-mode vault with a
    * fresh 256-bit random, sealed under the configured
-   * `SealingKeyProvider`. The user never sees the new passphrase.
+   * `SealingKeyProvider`. The user never sees the new secret.
    *
    * Internally:
    *   1. Verify the recovery proof (Shamir today) and unwrap the
    *      DEK set.
-   *   2. Mint a fresh 256-bit random as the new effective passphrase.
+   *   2. Mint a fresh 256-bit random as the new effective secret.
    *   3. Rewrap the DEK set under a fresh KEK derived from the new
-   *      passphrase (via the existing `recoverPassphrase` path).
+   *      secret (via the existing `recoverSecret` path).
    *   4. Seal the random bytes under the provider and overwrite
-   *      `_meta/sealed-passphrase`.
+   *      `_meta/sealed-secret`.
    *   5. Drop the keyring cache so the next operation re-derives.
    *
    * The vault's strong-recovery enrollment is preserved across
@@ -12364,40 +12094,40 @@ var TeamFacade = class {
    *
    * @throws ValidationError if the Noydb instance is not in managed mode.
    */
-  async recoverManagedPassphrase(vault, options) {
-    if (this.deps.options.passphraseMode !== "managed") {
+  async recoverManagedSecret(vault, options) {
+    if (this.deps.options.secretMode !== "managed") {
       throw new ValidationError(
-        "recoverManagedPassphrase: this method only applies to vaults opened in managed-passphrase mode. For standard mode, use db.recoverPassphrase."
+        "recoverManagedSecret: this method only applies to vaults opened in managed-secret mode. For standard mode, use db.recoverSecret."
       );
     }
     const provider = this.deps.options.sealingKey;
     if (!provider) {
       throw new ValidationError(
-        'recoverManagedPassphrase: createNoydb({ passphraseMode: "managed" }) requires `sealingKey` to be supplied; without it the new sealed passphrase cannot be persisted.'
+        'recoverManagedSecret: createNoydb({ secretMode: "managed" }) requires `sealingKey` to be supplied; without it the new sealed secret cannot be persisted.'
       );
     }
     const randomBytes = new Uint8Array(32);
     globalThis.crypto.getRandomValues(randomBytes);
     let binary = "";
     for (let i = 0; i < randomBytes.length; i++) binary += String.fromCharCode(randomBytes[i]);
-    const newPassphrase = btoa(binary);
+    const newSecret = btoa(binary);
     try {
       const sealed = await provider.seal(randomBytes);
-      await recoverPassphrase(
+      await recoverSecret(
         this.deps.options.shamirRecovery,
         this.deps.options.store,
         vault,
         this.deps.options.user,
         {
-          newPassphrase,
+          newSecret,
           recoveryProof: options.recoveryProof,
-          // The new passphrase IS 256 bits of random; policy gates on
+          // The new secret IS 256 bits of random; policy gates on
           // length/entropy don't apply.
-          allowWeakPassphrase: true,
-          ...options.passphrasePolicy !== void 0 ? { passphrasePolicy: options.passphrasePolicy } : {}
+          allowWeakSecret: true,
+          ...options.secretPolicy !== void 0 ? { secretPolicy: options.secretPolicy } : {}
         }
       );
-      await saveSealedPassphrase(this.deps.options.store, vault, {
+      await saveSealedSecret(this.deps.options.store, vault, {
         providerId: provider.id,
         sealed
       });
@@ -12408,7 +12138,7 @@ var TeamFacade = class {
   }
   /**
    * Atomic peer-recovery — re-wraps an EXISTING user's keyring under
-   * a fresh temp passphrase in a single store write. Closes the
+   * a fresh temp secret in a single store write. Closes the
    * partial-failure window (the previous compose-from-primitives
    * pattern was `db.revoke + db.grant`, two writes — if the issuer
    * cancelled between them the target was locked out entirely).
@@ -12427,17 +12157,17 @@ var TeamFacade = class {
    * recovery / TOTP / email-OTP factor proof at the moment of
    * recovery, so the issuer affirmatively re-asserts identity.
    *
-   * The recipient should call `db.rotatePassphrase` on first session
+   * The recipient should call `db.rotateSecret` on first session
    * to choose their own phrase — the temp acts as a single-use
    * bridge.
    *
    * ```ts
-   * await db.recoverUser('acme', {
+   * await db.team.recoverUser('acme', {
    *   userId: 'bob',
-   *   passphrase: 'temporary-correct-horse-battery-staple-printer',
+   *   secret: 'temporary-correct-horse-battery-staple-printer',
    * }, { factors: [{ kind: 'recovery' }] })
    * // Bob opens createNoydb({ user: 'bob', secret: tempPhrase })
-   * // and immediately calls db.rotatePassphrase to set his own.
+   * // and immediately calls db.rotateSecret to set his own.
    * ```
    *
    * @throws `NoAccessError` when no keyring exists for the target.
@@ -12463,17 +12193,17 @@ var TeamFacade = class {
    * The hub wraps the user's DEK set (not the KEK) under a code-derived
    * AES-GCM key — see `team/recovery.ts` for the rationale. The mint
    * helper {@link mintPaperRecoveryEntry} is the canonical primitive;
-   * pair it with `db.getKeyring(vault)` to obtain the live DEK set:
+   * pair it with `db.team.getKeyring(vault)` to obtain the live DEK set:
    *
    * ```ts
    * import { mintPaperRecoveryEntry } from '@noy-db/hub'
    *
-   * const keyring = await db.getKeyring('acme')
+   * const keyring = await db.team.getKeyring('acme')
    * const codes: string[] = ['CORRECT-HORSE-1', 'BATTERY-STAPLE-2', ...]
    * const entries = await Promise.all(
    *   codes.map((code, i) => mintPaperRecoveryEntry(keyring.deks, code, `code-${i}`)),
    * )
-   * await db.enrollRecovery('acme', { profile: 'paper', entries })
+   * await db.team.enrollRecovery('acme', { profile: 'paper', entries })
    * showCodesToUser(codes)
    * ```
    *
@@ -12484,7 +12214,7 @@ var TeamFacade = class {
    * ```ts
    * import { generateRecoveryCodeSet } from '@noy-db/on-recovery'
    * const { codes, entries } = await generateRecoveryCodeSet({ deks: keyring.deks, count: 8 })
-   * await db.enrollRecovery('acme', { profile: 'paper', entries })
+   * await db.team.enrollRecovery('acme', { profile: 'paper', entries })
    * ```
    */
   async enrollRecovery(vault, enrollment) {
@@ -12584,7 +12314,7 @@ var TeamFacade = class {
    * and no `secret` / `getKeyring` is configured.
    *
    * ```ts
-   * const keyring = await db.getKeyring('acme')
+   * const keyring = await db.team.getKeyring('acme')
    * // keyring.deks: Map<collection, CryptoKey>
    * // keyring.kek:  CryptoKey | null   (null for tier-3 / wrap-DEKs sessions)
    * // keyring.role / .permissions / .authenticators
@@ -12661,7 +12391,7 @@ var Noydb = class {
   keyringCache = /* @__PURE__ */ new Map();
   syncEngines = /* @__PURE__ */ new Map();
   /**
-   * Per-vault active session tier — defaults to `1` after a passphrase
+   * Per-vault active session tier — defaults to `1` after a secret
    * unlock; tier-2 / tier-3 unlocks downgrade it. Used by
    * {@link checkGate} to evaluate `gate.minTier`.
    */
@@ -12689,26 +12419,43 @@ var Noydb = class {
   writeRelay;
   /** Per-vault policy enforcers. */
   policyEnforcers = /* @__PURE__ */ new Map();
-  txStrategy;
-  forgetStrategy;
   /**
-   * Opt-in sovereign-custody (FR-6) strategy — `NO_CUSTODY` (throwing) unless
-   * `withCustody()` was passed. Public so `Vault` routes `vault.custody.liberate`
-   * through it; grant/revoke route through it from this class. @internal
+   * Every opt-in service, resolved once (#838). Shared by reference with each
+   * `Vault` this instance opens and, through them, every `Collection` — so
+   * there is exactly one resolution and no construction path can disagree
+   * about which services are enabled (the #834 bug class).
    */
-  custodyStrategy;
+  strategies;
   /**
-   * Opt-in multi-user team strategy (#267 keyring-grant → team split) —
-   * `NO_TEAM` (throwing) unless `withTeam()` was passed; the keyring
-   * engines are linked only by the active strategy, not by this file. */
-  teamStrategy;
-  sessionStrategy;
-  syncStrategy;
+   * Opt-in sovereign-custody (FR-6) strategy — `NO_CUSTODY` (throwing) unless
+   * `withCustody()` was passed. Kept as a public accessor because `Vault`
+   * routes `vault.custody.liberate` through `this.noydb.custodyStrategy`.
+   * @internal
+   */
+  get custodyStrategy() {
+    return this.strategies.custody;
+  }
   snapshots;
   policyManager;
   /** Pre-resolved policy-gate engine function (mirrors `coordinationProvider`/`userApiFactory` above). */
   policyCheckGate;
-  team;
+  /**
+   * Credential and multi-user operations — enrolment, secret rotation,
+   * recovery, quick-unlock (#846).
+   *
+   * Public because 23 methods on this class did nothing but restate a
+   * TeamFacade signature and forward to it, so every signature had to be
+   * hand-kept in sync with its counterpart. `db.team.rotateSecret(…)`
+   * reads the same and has one source of truth.
+   *
+   * A getter, not a field, so it appears in the prototype-based kernel API
+   * manifest — an instance field is invisible to it (the same reason
+   * `custodyStrategy` became one in #838).
+   */
+  get team() {
+    return this.#team;
+  }
+  #team;
   /**
    * Currently-running multi-record transaction, set by
    * `runTransaction` at the start of Phase 2 (commit) and cleared in
@@ -12747,14 +12494,9 @@ var Noydb = class {
     this.userApiFactory = options.userApiFactory;
     if (!options.policyFactory || !options.policyCheckGateFn) throw new ValidationError("Noydb must be constructed via createNoydb(), which resolves the default policy service.");
     this.policyCheckGate = options.policyCheckGateFn;
-    this.txStrategy = options.txStrategy ?? NO_TX;
-    this.forgetStrategy = options.forgetStrategy ?? NO_FORGET;
-    this.custodyStrategy = options.custodyStrategy ?? NO_CUSTODY;
-    this.teamStrategy = options.teamStrategy ?? NO_TEAM;
-    this.sessionStrategy = options.sessionStrategy ?? NO_SESSION;
-    this.syncStrategy = options.syncStrategy ?? NO_SYNC;
+    this.strategies = resolveStrategies(options);
     this.snapshots = new NoydbSnapshots({
-      strategy: options.snapshotStrategy ?? NO_SNAPSHOTS,
+      strategy: this.strategies.snapshot,
       user: options.user,
       isClosed: () => this.closed,
       getVault: (name) => this.vaultCache.get(name),
@@ -12775,7 +12517,7 @@ var Noydb = class {
         this.vaultCache.delete(vault);
       }
     });
-    this.team = new TeamFacade({
+    this.#team = new TeamFacade({
       options: this.options,
       keyringCache: this.keyringCache,
       activeTier: this.activeTier,
@@ -12791,7 +12533,7 @@ var Noydb = class {
       }
     });
     if (options.sessionPolicy) {
-      this.sessionStrategy.validateSessionPolicy(options.sessionPolicy);
+      this.strategies.session.validateSessionPolicy(options.sessionPolicy);
     }
     this.#registerGuardGate();
     this.#registerPeriodGate();
@@ -12800,7 +12542,7 @@ var Noydb = class {
   }
   /** @internal — resolved forget strategy (NO_FORGET when not configured). */
   get _forgetStrategy() {
-    return this.forgetStrategy;
+    return this.strategies.forget;
   }
   // GDPR subject-index maintenance. When `withForgetCascade` declares
   // any subject fields, keep the encrypted `_subject_index` in lock-step with
@@ -12813,7 +12555,7 @@ var Noydb = class {
   //     does NOT) — drop the ref so a deleted record never lingers in the
   //     index (RISK #2). Without it, forget() would try to shred a ghost.
   #registerForgetHooks() {
-    const subjects = this.forgetStrategy.subjects;
+    const subjects = this.strategies.forget.subjects;
     if (Object.keys(subjects).length === 0) return;
     const subjectFieldFor = (collection) => subjects[collection];
     this.writeHooks.onAfterWrite(async (event) => {
@@ -12877,7 +12619,7 @@ var Noydb = class {
       if (!facade) return;
       const ctx = { existing, vault: facade, userId: e.userId, role: e.role };
       await registry.runChecks(e.collection, incoming, ctx);
-      const { GuardExecutor } = await import("./executor-WQQRU6DO.js");
+      const { GuardExecutor } = await import("./executor-OHET7TF7.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, e.docId, existing, incoming, e.computedFieldNames);
       }
@@ -13002,7 +12744,7 @@ var Noydb = class {
     if (targets.length > 0) {
       const primary = targets.find((t) => t.role === "sync-peer") ?? targets[0];
       const effectivePolicy = this.options.syncPolicy ?? primary.policy ?? INDEXED_STORE_POLICY;
-      syncEngine = this.syncStrategy.buildSyncEngine({
+      syncEngine = this.strategies.sync.buildSyncEngine({
         local: this.options.store,
         remote: primary.store,
         vault: name,
@@ -13016,7 +12758,7 @@ var Noydb = class {
       for (const target of targets) {
         if (target === primary) continue;
         const targetPolicy = target.policy ?? this.options.syncPolicy ?? INDEXED_STORE_POLICY;
-        const engine = this.syncStrategy.buildSyncEngine({
+        const engine = this.strategies.sync.buildSyncEngine({
           local: this.options.store,
           remote: target.store,
           vault: name,
@@ -13049,31 +12791,14 @@ var Noydb = class {
       syncAdapter: targets.length > 0 ? targets[0].store : void 0,
       getPurgeableTargets: () => targets.filter((t) => t.role === "backup" || t.role === "archive").map((t) => ({ store: t.store, role: t.role, ...t.label !== void 0 ? { label: t.label } : {} })),
       historyConfig: this.options.history,
-      ...this.options.blobStrategy !== void 0 ? { blobStrategy: this.options.blobStrategy } : {},
+      // #838 — the 21 conditional strategy spreads that used to live here are
+      // one shared reference. This block is where #834's drift happened: a
+      // copy of it silently omitted six strategies, and there was nothing to
+      // catch that. There is no longer a per-service line to omit.
+      strategies: this.strategies,
       ...this.options.objectStore !== void 0 ? { objectStore: this.options.objectStore } : {},
-      ...this.options.archiveStrategy !== void 0 ? { archiveStrategy: this.options.archiveStrategy } : {},
-      ...this.options.indexStrategy !== void 0 ? { indexStrategy: this.options.indexStrategy } : {},
-      ...this.options.lazyStrategy !== void 0 ? { lazyStrategy: this.options.lazyStrategy } : {},
-      ...this.options.aggregateStrategy !== void 0 ? { aggregateStrategy: this.options.aggregateStrategy } : {},
-      ...this.options.crdtStrategy !== void 0 ? { crdtStrategy: this.options.crdtStrategy } : {},
-      ...this.options.tiersStrategy !== void 0 ? { tiersStrategy: this.options.tiersStrategy } : {},
-      ...this.options.searchStrategy !== void 0 ? { searchStrategy: this.options.searchStrategy } : {},
-      ...this.options.cargoStrategy !== void 0 ? { cargoStrategy: this.options.cargoStrategy } : {},
-      ...this.options.brokerStrategy !== void 0 ? { brokerStrategy: this.options.brokerStrategy } : {},
-      ...this.options.consentStrategy !== void 0 ? { consentStrategy: this.options.consentStrategy } : {},
-      ...this.options.periodsStrategy !== void 0 ? { periodsStrategy: this.options.periodsStrategy } : {},
-      ...this.options.shadowStrategy !== void 0 ? { shadowStrategy: this.options.shadowStrategy } : {},
-      ...this.options.historyStrategy !== void 0 ? { historyStrategy: this.options.historyStrategy } : {},
-      ...this.options.i18nStrategy !== void 0 ? { i18nStrategy: this.options.i18nStrategy } : {},
-      ...this.options.syncStrategy !== void 0 ? { syncStrategy: this.options.syncStrategy } : {},
       ...this.options.guardStrategies !== void 0 ? { guardStrategies: this.options.guardStrategies } : {},
       ...this.options.numbering !== void 0 ? { numberingConfigs: this.options.numbering } : {},
-      forgetStrategy: this.forgetStrategy,
-      ...this.options.attestationStrategy !== void 0 ? { attestationStrategy: this.options.attestationStrategy } : {},
-      ...this.options.classifiedStrategy !== void 0 ? { classifiedStrategy: this.options.classifiedStrategy } : {},
-      ...this.options.sealedRecordStrategy !== void 0 ? { sealedRecordStrategy: this.options.sealedRecordStrategy } : {},
-      ...this.options.portabilityStrategy !== void 0 ? { portabilityStrategy: this.options.portabilityStrategy } : {},
-      ...this.options.sequenceStrategy !== void 0 ? { sequenceStrategy: this.options.sequenceStrategy } : {},
       locale: opts?.locale,
       ...opts?.meta !== void 0 ? { meta: opts.meta } : {},
       // Thread the translator hook so Collection.put() can invoke it
@@ -13142,7 +12867,7 @@ var Noydb = class {
    * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
    */
   async grant(vault, options, factors) {
-    return this.teamStrategy.grant(this.team, vault, options, factors);
+    return this.strategies.team.grant(this.team, vault, options, factors);
   }
   /**
    * Revoke a user's access to a vault.
@@ -13155,7 +12880,7 @@ var Noydb = class {
    * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
    */
   async revoke(vault, options, factors) {
-    return this.teamStrategy.revoke(this.team, vault, options, factors);
+    return this.strategies.team.revoke(this.team, vault, options, factors);
   }
   /**
    * Grant the FR-6 `custodian` role to a user (owner-only custody API).
@@ -13168,7 +12893,7 @@ var Noydb = class {
    * owner-only invariant even if a host mis-configures the gate.
    */
   async grantCustodian(vault, options, factors) {
-    return this.custodyStrategy.grantCustodian(this, vault, options, factors);
+    return this.strategies.custody.grantCustodian(this, vault, options, factors);
   }
   /** @internal — grant-custodian engine, reached only via withCustody(); the
    * keyring engine arrives as an argument so the floor never carries it (#267). */
@@ -13187,7 +12912,7 @@ var Noydb = class {
    * 'owner'` check, so an admin cannot unwind a custodianship.
    */
   async revokeCustodian(vault, options, factors) {
-    return this.custodyStrategy.revokeCustodian(this, vault, options, factors);
+    return this.strategies.custody.revokeCustodian(this, vault, options, factors);
   }
   /** @internal — revoke-custodian engine, reached only via withCustody().
    * Mirrors `_grantCustodianImpl` (#267: engine passed in). */
@@ -13266,7 +12991,7 @@ var Noydb = class {
    * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
    */
   async rotate(vault, collections) {
-    return this.teamStrategy.rotate(this.team, vault, collections);
+    return this.strategies.team.rotate(this.team, vault, collections);
   }
   /** List all users with access to a vault. */
   async listUsers(vault) {
@@ -13279,9 +13004,9 @@ var Noydb = class {
    *
    * The walk is a two-step pipeline: first ask the adapter for the
    * universe of compartments it stores, then for each one attempt to
-   * load the calling user's keyring with the in-memory passphrase.
+   * load the calling user's keyring with the in-memory secret.
    * Compartments where the user has no keyring file (`NoAccessError`)
-   * or where the passphrase doesn't unwrap (`InvalidKeyError`) are
+   * or where the secret doesn't unwrap (`InvalidKeyError`) are
    * silently dropped from the result — the existence of those
    * compartments is **not** confirmed in the return value.
    *
@@ -13302,15 +13027,15 @@ var Noydb = class {
    * **Known edge case.** A vault whose keyring file
    * happens to have an empty wrapped-DEKs map (because the owner
    * granted access before any collection was created) will pass the
-   * `loadKeyring` probe with *any* passphrase — there are no DEKs to
+   * `loadKeyring` probe with *any* secret — there are no DEKs to
    * unwrap, so the integrity-checked unwrap that normally rejects
-   * wrong passphrases never runs. The result is that an unrelated
+   * wrong secrets never runs. The result is that an unrelated
    * principal who happens to know the user-id and the vault
    * name can show up in `listAccessibleVaults()` as having
    * access to that empty vault. They cannot read any actual
    * data (their DEK set is empty), so this is a metadata leak
    * (vault name + user-id), not a content leak. Hardening this
-   * via a passphrase canary in the keyring file is a deferred
+   * via a secret canary in the keyring file is a deferred
    * follow-up.
    *
    * **Cost.** O(compartments × keyring-load) — one `loadKeyring`
@@ -13351,7 +13076,7 @@ var Noydb = class {
     }
     if (!this.options.secret) {
       throw new ValidationError(
-        "Noydb.listAccessibleVaults(): a secret (passphrase) is required when encryption is enabled."
+        "Noydb.listAccessibleVaults(): a secret (secret) is required when encryption is enabled."
       );
     }
     const minRank = ROLE_RANK[options.minRole ?? "client"];
@@ -13490,21 +13215,21 @@ var Noydb = class {
     return store.resolveBackend ? store.resolveBackend(vaultId) : this.options.store;
   }
   /**
-   * Change the current user's passphrase for a vault.
+   * Change the current user's secret for a vault.
    *
-   * Validates the new passphrase against the strength rules. Pass
-   * `{ allowWeakPassphrase: true }` to skip — typically only useful for
-   * fixtures and migrations. Pass a `PassphrasePolicy` to override the
+   * Validates the new secret against the strength rules. Pass
+   * `{ allowWeakSecret: true }` to skip — typically only useful for
+   * fixtures and migrations. Pass a `SecretPolicy` to override the
    * default rules (e.g. consumer-tunable `pattern` / `customValidator`).
    */
-  async changeSecret(vault, newPassphrase, options) {
+  async changeSecret(vault, newSecret, options) {
     this.checkPolicyOperation(vault, "changeSecret");
     const keyring = await this._getKeyringInternal(vault);
     const updated = await changeSecret(
       this.options.store,
       vault,
       keyring,
-      newPassphrase,
+      newSecret,
       options
     );
     this.keyringCache.set(vault, updated);
@@ -13556,7 +13281,7 @@ var Noydb = class {
   }
   transaction(arg, maybeFn) {
     if (typeof arg === "function") {
-      return this.txStrategy.runTransaction(this, arg);
+      return this.strategies.tx.runTransaction(this, arg);
     }
     if (typeof arg === "object" && arg !== null && arg.dryRun === true) {
       if (typeof maybeFn !== "function") {
@@ -13564,7 +13289,7 @@ var Noydb = class {
           "db.transaction({ dryRun: true }, fn) requires the callback as the second argument."
         );
       }
-      return this.txStrategy.runDryRun(this, maybeFn);
+      return this.strategies.tx.runDryRun(this, maybeFn);
     }
     if (typeof arg === "object" && arg !== null && arg.amendment === true) {
       if (typeof maybeFn !== "function") {
@@ -13572,7 +13297,7 @@ var Noydb = class {
           "db.transaction({ amendment: true }, fn) requires the callback as the second argument."
         );
       }
-      return this.txStrategy.runTransaction(this, maybeFn, arg);
+      return this.strategies.tx.runTransaction(this, maybeFn, arg);
     }
     const vault = arg;
     const comp = this.vaultCache.get(vault);
@@ -13582,7 +13307,7 @@ var Noydb = class {
       );
     }
     const engine = this.getSyncEngine(vault);
-    return this.syncStrategy.buildSyncTransaction(comp, engine);
+    return this.strategies.sync.buildSyncTransaction(comp, engine);
   }
   /**
    * Internal accessor for the primary store — used by the tx
@@ -13863,7 +13588,7 @@ var Noydb = class {
       enforcer.destroy();
     }
     this.policyEnforcers.clear();
-    this.sessionStrategy.revokeAllSessions();
+    this.strategies.session.revokeAllSessions();
     for (const engine of this.syncEngines.values()) {
       engine.stopAutoSync();
     }
@@ -13985,7 +13710,7 @@ var Noydb = class {
    * denial; resolves with `void` on success.
    *
    * @param vault    The vault whose policy applies.
-   * @param gate     Gate name — built-in (e.g. `'rotate-passphrase'`)
+   * @param gate     Gate name — built-in (e.g. `'rotate-secret'`)
    *                 or app-defined (`app:*`).
    * @param presented Caller-supplied factor proofs.
    */
@@ -14010,12 +13735,12 @@ var Noydb = class {
    * Two enforcement modes:
    *
    * 1. **Managed-mode mandatory strong-recovery.** When
-   *    `passphraseMode === 'managed'`, the vault MUST have at least
+   *    `secretMode === 'managed'`, the vault MUST have at least
    *    one **strong** recovery profile (Shamir today). Paper alone is
    *    rejected because under managed mode the user has no memorized
-   *    passphrase, so losing the paper sheet = losing every record.
+   *    secret, so losing the paper sheet = losing every record.
    *    This check is unconditional — independent of `requireRecovery`
-   *    and the `recover-passphrase` gate.
+   *    and the `recover-secret` gate.
    *
    * 2. **Opt-in strict mandatory-recovery.** When
    *    `requireRecovery: true` is set on createNoydb (and the gate is
@@ -14029,14 +13754,14 @@ var Noydb = class {
    */
   async assertRecoveryEnrolled(vault, policy, opts) {
     const skipManaged = (opts?.skipManagedCheck ?? false) || this._skipNextManagedRecoveryCheck;
-    if (this.options.passphraseMode === "managed" && !skipManaged) {
+    if (this.options.secretMode === "managed" && !skipManaged) {
       const enrolled2 = await hasStrongRecoveryEnrolled(this.options.store, vault);
       if (!enrolled2) {
         throw new ManagedRecoveryNotEnrolledError(vault);
       }
     }
     if (this.options.requireRecovery !== true) return;
-    const gate = policy.gates["recover-passphrase"];
+    const gate = policy.gates["recover-secret"];
     if (gate?.enabled === false) return;
     const enrolled = await hasRecoveryEnrolled(this.options.store, vault);
     if (enrolled) return;
@@ -14051,34 +13776,6 @@ var Noydb = class {
     this.activeTier.set(vault, tier);
   }
   // ─── Tier-2 enroll / remove ─────────────────────────────────────
-  /** Add a tier-2 authenticator slot — see {@link TeamFacade.enrollAuthenticator}. */
-  async enrollAuthenticator(vault, options, factors) {
-    return this.team.enrollAuthenticator(vault, options, factors);
-  }
-  /** Remove a tier-2 authenticator slot — see {@link TeamFacade.removeAuthenticator}. */
-  async removeAuthenticator(vault, slotId, factors) {
-    return this.team.removeAuthenticator(vault, slotId, factors);
-  }
-  /** Read the slot list for a vault — see {@link TeamFacade.listAuthenticators}. */
-  async listAuthenticators(vault) {
-    return this.team.listAuthenticators(vault);
-  }
-  /** Mutate an authenticator slot's `meta` — see {@link TeamFacade.updateAuthenticator}. */
-  async updateAuthenticator(vault, slotId, options, factors) {
-    return this.team.updateAuthenticator(vault, slotId, options, factors);
-  }
-  /** Native WebAuthn enrollment — see {@link TeamFacade.enrollWebAuthn}. */
-  async enrollWebAuthn(vault, ceremony, factors) {
-    return this.team.enrollWebAuthn(vault, ceremony, factors);
-  }
-  /** List webauthn-method slots — see {@link TeamFacade.listWebAuthnSlots}. */
-  async listWebAuthnSlots(vault) {
-    return this.team.listWebAuthnSlots(vault);
-  }
-  /** Unlock via a tier-2 authenticator slot — see {@link TeamFacade.unlockViaAuthenticator}. */
-  async unlockViaAuthenticator(vault, slotId, verify) {
-    return this.team.unlockViaAuthenticator(vault, slotId, verify);
-  }
   // ─── Cover (https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md) ──────
   /**
    * Set the owner-curated cover for a vault. Throws
@@ -14102,7 +13799,7 @@ var Noydb = class {
         "setCover: the cover feature is not enabled. Pass `cover: true` (or a schema object) to `createNoydb`."
       );
     }
-    const { loadCover, saveCover, resolveSchema, validateCoverInput, mergeCustom, validateCoverSize } = await import("./cover-B5MY43CK.js");
+    const { loadCover, saveCover, resolveSchema, validateCoverInput, mergeCustom, validateCoverSize } = await import("./cover-5BSNJREH.js");
     const schema = resolveSchema(coverOption);
     validateCoverInput(input, schema);
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -14134,76 +13831,12 @@ var Noydb = class {
    * regardless).
    */
   async getCover(vault, opts = {}) {
-    const { readCover } = await import("./cover-B5MY43CK.js");
+    const { readCover } = await import("./cover-5BSNJREH.js");
     return readCover(this.options.store, vault, opts);
   }
   // ─── Auth introspection ─────────────────────────────────────────
-  /** English summary of the configured auth model — see {@link TeamFacade.describeAuthConfig}. */
-  async describeAuthConfig(vault) {
-    return this.team.describeAuthConfig(vault);
-  }
-  /** Mermaid `flowchart TB` source for the auth graph — see {@link TeamFacade.diagramAuthConfig}. */
-  async diagramAuthConfig(vault) {
-    return this.team.diagramAuthConfig(vault);
-  }
-  /** Per-user enrollment summary — see {@link TeamFacade.describeUserAuth}. */
-  async describeUserAuth(vault, userId, factors) {
-    return this.team.describeUserAuth(vault, userId, factors);
-  }
-  /** Bulk per-user enrollment summary — see {@link TeamFacade.describeAllUsersAuth}. */
-  async describeAllUsersAuth(vault, factors) {
-    return this.team.describeAllUsersAuth(vault, factors);
-  }
   // ─── Tier-1 change flows ────────────────────────────────────────
-  /** Rotate the user's passphrase (user remembers old) — see {@link TeamFacade.rotatePassphrase}. */
-  async rotatePassphrase(vault, input, factors) {
-    return this.team.rotatePassphrase(vault, input, factors);
-  }
-  /** Reset the passphrase using a recovery proof — see {@link TeamFacade.recoverPassphrase}. */
-  async recoverPassphrase(vault, input, factors) {
-    return this.team.recoverPassphrase(vault, input, factors);
-  }
-  /** Deliberate paper/Shamir recovery-code regeneration — see {@link TeamFacade.rotateRecovery}. */
-  async rotateRecovery(vault, options, factors) {
-    return this.team.rotateRecovery(vault, options, factors);
-  }
-  /** Atomic create-and-enroll for managed-mode vaults — see {@link TeamFacade.openVaultAndEnrollRecovery}. */
-  async openVaultAndEnrollRecovery(vault, opts) {
-    return this.team.openVaultAndEnrollRecovery(vault, opts);
-  }
-  /** Recovery flow under managed-passphrase mode — see {@link TeamFacade.recoverManagedPassphrase}. */
-  async recoverManagedPassphrase(vault, options) {
-    return this.team.recoverManagedPassphrase(vault, options);
-  }
-  /** Atomic peer-recovery of an existing user's keyring — see {@link TeamFacade.recoverUser}. */
-  async recoverUser(vault, options, factors) {
-    return this.team.recoverUser(vault, options, factors);
-  }
-  /** Persist a recovery enrollment (paper or Shamir) — see {@link TeamFacade.enrollRecovery}. */
-  async enrollRecovery(vault, enrollment) {
-    return this.team.enrollRecovery(vault, enrollment);
-  }
-  /** Read the persisted recovery entries (paper + Shamir) — see {@link TeamFacade.listRecoveryEntries}. */
-  async listRecoveryEntries(vault) {
-    return this.team.listRecoveryEntries(vault);
-  }
   // ─── Tier-3 enroll / unlock ─────────────────────────────────────
-  /** Register a tier-3 quick-unlock state — see {@link TeamFacade.enrollUnlock}. */
-  async enrollUnlock(vault, state, factors) {
-    return this.team.enrollUnlock(vault, state, factors);
-  }
-  /** Resume a session via the registered tier-3 state — see {@link TeamFacade.unlockViaPin}. */
-  async unlockViaPin(vault, resume) {
-    return this.team.unlockViaPin(vault, resume);
-  }
-  /** Drop the tier-3 state for a vault — see {@link TeamFacade.clearQuickUnlock}. */
-  clearQuickUnlock(vault) {
-    this.team.clearQuickUnlock(vault);
-  }
-  /** Public defensive-copy accessor for the unlocked keyring — see {@link TeamFacade.getKeyring}. */
-  async getKeyring(vault) {
-    return this.team.getKeyring(vault);
-  }
   /**
    * Live-reference variant used by the hub's own code paths. Internal
    * mutations on `deks` (e.g. {@link ensureCollectionDEK} adding a
@@ -14224,7 +13857,7 @@ var Noydb = class {
     }
     await assertKeyringOpenAllowed(this.options.store, vault, this.options.user, opts.create);
     let effectiveSecret;
-    if (this.options.passphraseMode === "managed") {
+    if (this.options.secretMode === "managed") {
       effectiveSecret = await resolveManagedSecret(
         this.options.store,
         vault,
@@ -14234,7 +13867,7 @@ var Noydb = class {
       effectiveSecret = this.options.secret;
     }
     if (!effectiveSecret) {
-      throw new ValidationError("A secret (passphrase) or getKeyring callback is required when encryption is enabled");
+      throw new ValidationError("A secret (secret) or getKeyring callback is required when encryption is enabled");
     }
     let keyring;
     try {
@@ -14248,10 +13881,10 @@ var Noydb = class {
           effectiveSecret,
           {
             // Managed mode generates 256-bit base64 strings that don't satisfy
-            // the human-passphrase strength rules (no spaces, no "words").
+            // the human-secret strength rules (no spaces, no "words").
             // Skip validation in managed mode — the entropy floor is already
             // 256 bits by construction.
-            validate: this.options.passphraseMode === "managed" ? false : this.options.validatePassphrase === true
+            validate: this.options.secretMode === "managed" ? false : this.options.validateSecret === true
           }
         );
       } else if (err instanceof InvalidKeyError && this.options.onInvalidKey === "reset") {
@@ -14262,7 +13895,7 @@ var Noydb = class {
           this.options.user,
           effectiveSecret,
           {
-            validate: this.options.passphraseMode === "managed" ? false : this.options.validatePassphrase === true
+            validate: this.options.secretMode === "managed" ? false : this.options.validateSecret === true
           }
         );
       } else {
@@ -14300,34 +13933,34 @@ var Noydb = class {
 async function createNoydb(options) {
   if (!options.store) options = { ...options, store: memoryStore() };
   const encrypted = options.encrypt !== false;
-  const managed = options.passphraseMode === "managed";
+  const managed = options.secretMode === "managed";
   if (options.secret && options.getKeyring) {
     throw new ValidationError("Provide either `secret` or `getKeyring`, not both");
   }
   if (managed) {
     if (options.secret) {
       throw new ValidationError(
-        '`passphraseMode: "managed"` is mutually exclusive with `secret` \u2014 managed mode generates the passphrase itself. Drop `secret`.'
+        '`secretMode: "managed"` is mutually exclusive with `secret` \u2014 managed mode generates the secret itself. Drop `secret`.'
       );
     }
     if (options.getKeyring) {
       throw new ValidationError(
-        '`passphraseMode: "managed"` is mutually exclusive with `getKeyring` \u2014 a custom unlock callback would bypass the sealing flow. Drop `getKeyring`.'
+        '`secretMode: "managed"` is mutually exclusive with `getKeyring` \u2014 a custom unlock callback would bypass the sealing flow. Drop `getKeyring`.'
       );
     }
     if (!options.sealingKey) {
       throw new ValidationError(
-        '`passphraseMode: "managed"` requires `sealingKey: SealingKeyProvider` (see @noy-db/seal-macos-keychain / @noy-db/seal-aws-kms / etc.).'
+        '`secretMode: "managed"` requires `sealingKey: SealingKeyProvider` (see @noy-db/seal-macos-keychain / @noy-db/seal-aws-kms / etc.).'
       );
     }
   }
   if (encrypted && !managed && !options.secret && !options.getKeyring) {
-    throw new ValidationError("A secret (passphrase) or getKeyring callback is required when encryption is enabled");
+    throw new ValidationError("A secret (secret) or getKeyring callback is required when encryption is enabled");
   }
   if (!options.coordinationStrategy) options = { ...options, coordinationStrategy: await createDefaultCoordinationProvider(options.store) };
-  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-UPAT2O3M.js")).createUserApi };
+  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-22ES33N3.js")).createUserApi };
   if (!options.policyFactory) {
-    const policyModule = await import("./policy-EAXSJNOT.js");
+    const policyModule = await import("./policy-IY2YEA3A.js");
     options = { ...options, policyFactory: policyModule.createNoydbPolicy, policyCheckGateFn: policyModule.checkGate };
   }
   return new Noydb(options);
@@ -14364,4 +13997,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-LUH2MPEF.js.map
+//# sourceMappingURL=chunk-EEZCB74X.js.map