@noy-db/hub 0.4.0-pre.9 → 0.4.0

package/dist/{chunk-OW5Y6HA6.js → chunk-ZBYFMI6D.js}

@@ -1,3 +1,7 @@
+import {
+  hashFields,
+  validateSatelliteDeclaration
+} from "./chunk-SHEEBRZ4.js";
 import {
   resolveStaleOnRead
 } from "./chunk-NJ4DYYO5.js";
@@ -8,30 +12,31 @@ import {
   linkRowKey
 } from "./chunk-4JQK3L4V.js";
 import {
-  hashFields,
-  validateSatelliteDeclaration
-} from "./chunk-SHEEBRZ4.js";
+  isBaseLive,
+  liveBaseIdSet
+} from "./chunk-GYGLAVCX.js";
 import {
   loadFence
-} from "./chunk-6M2I3DKF.js";
+} from "./chunk-WK7ULBTP.js";
 import {
   VectorSet,
   buildPersistedIndexCallbacks,
   encodeVecId,
   syncTierSearch
-} from "./chunk-CCDP6EPB.js";
+} from "./chunk-PWPYO73B.js";
 import {
   SchemaUpdateGate
 } from "./chunk-6LJY7X5A.js";
 import {
-  isBaseLive,
-  liveBaseIdSet
-} from "./chunk-GYGLAVCX.js";
+  NO_CLASSIFIED,
+  guardClassifiedCompat,
+  resolveClassifiedFields
+} from "./chunk-DAFBJS4Y.js";
 import {
   NO_TIERS,
   classifySealedShred,
   syncDerivedOutputs
-} from "./chunk-6R6Q3MRN.js";
+} from "./chunk-RQ4ZI4ZI.js";
 import {
   NO_PORTABILITY
 } from "./chunk-BLBAQRBM.js";
@@ -42,7 +47,7 @@ import {
 import {
   resolveManagedSecret,
   saveSealedSecret
-} from "./chunk-OLIWCCFM.js";
+} from "./chunk-CLE3TMIS.js";
 import {
   jsonSchemaToFields
 } from "./chunk-VYYM3MEN.js";
@@ -50,6 +55,10 @@ import {
   derivePersistedSchema,
   isZod4Schema
 } from "./chunk-6ZNSB3H6.js";
+import {
+  CustodyApi,
+  NO_CUSTODY
+} from "./chunk-TS5XLBZR.js";
 import {
   DEFAULT_POSTURE,
   ViaGraph
@@ -77,24 +86,30 @@ import {
   selfWriteFieldEqual,
   touchFor,
   updateReferencingRecords
-} from "./chunk-GP3UWP22.js";
+} from "./chunk-LRRX57UA.js";
 import {
   OverlayedCollection
 } from "./chunk-ZTLOXFPB.js";
 import {
+  INDEXED_STORE_POLICY,
   NO_SYNC
-} from "./chunk-EP5L47XV.js";
+} from "./chunk-55LKVALY.js";
 import {
   NO_ATTESTATION
 } from "./chunk-5GQEU4DN.js";
 import {
-  NO_CLASSIFIED,
-  guardClassifiedCompat,
-  resolveClassifiedFields
-} from "./chunk-ZFUFAHZ3.js";
+  NO_CONSENT
+} from "./chunk-PEOZ34EM.js";
 import {
   NO_PERIODS
-} from "./chunk-N5PLUFH2.js";
+} from "./chunk-ZFG5EBI3.js";
+import {
+  PERIODS_COLLECTION,
+  PERIOD_ARCHIVES_COLLECTION,
+  PERIOD_FREEZES_COLLECTION,
+  PERIOD_TARGET_PURGES_COLLECTION,
+  periodExclusiveUpperBound
+} from "./chunk-NM5UYF6Q.js";
 import {
   NO_SHADOW
 } from "./chunk-SMY5X46Z.js";
@@ -105,7 +120,7 @@ import {
   TxContext,
   bestEffortRevert,
   revertExecuted
-} from "./chunk-NGSJZFGL.js";
+} from "./chunk-GTYFIVIZ.js";
 import {
   lazy
 } from "./chunk-5D2ALSM5.js";
@@ -113,17 +128,13 @@ import {
   InvertedIndex,
   MemoryIndexStore,
   NO_SEARCH
-} from "./chunk-QADFHRQM.js";
+} from "./chunk-KYRDJI5O.js";
 import {
   NO_SEQUENCE,
   SEQUENCE_COLLECTION,
   compileSequenceFormat,
   resolveSequenceKey
-} from "./chunk-EBKCYQ2D.js";
-import {
-  CustodyApi,
-  NO_CUSTODY
-} from "./chunk-SKM35Y4Q.js";
+} from "./chunk-NBXFCQX4.js";
 import {
   Query,
   ScanBuilder
@@ -133,7 +144,7 @@ import {
   NO_BLOBS,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-IF6WNGAK.js";
+} from "./chunk-WUHEP3HH.js";
 import {
   LazyQuery,
   NO_INDEXING,
@@ -157,12 +168,9 @@ import {
 import {
   NO_CRDT
 } from "./chunk-PVEWA2DU.js";
-import {
-  NO_CONSENT
-} from "./chunk-PEOZ34EM.js";
 import {
   dictCollectionName
-} from "./chunk-NEX7JCMO.js";
+} from "./chunk-OWHP3H5C.js";
 import {
   NO_I18N,
   getAtPath,
@@ -197,17 +205,7 @@ import {
   saveShamirRecoveryEntries,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-C25JXSOR.js";
-import {
-  INDEXED_STORE_POLICY
-} from "./chunk-MTJLOC3Y.js";
-import {
-  PERIODS_COLLECTION,
-  PERIOD_ARCHIVES_COLLECTION,
-  PERIOD_FREEZES_COLLECTION,
-  PERIOD_TARGET_PURGES_COLLECTION,
-  periodExclusiveUpperBound
-} from "./chunk-EZNTORXE.js";
+} from "./chunk-ZNWSG7XC.js";
 import {
   assertKeyringOpenAllowed,
   buildRecipientKeyringFile,
@@ -222,11 +220,11 @@ import {
   listUsers,
   loadKeyring,
   updateKeyringIdentity
-} from "./chunk-KPXM4WO6.js";
+} from "./chunk-Q5YJCVJY.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
-} from "./chunk-WZ3NCMK6.js";
+} from "./chunk-2BET5QTS.js";
 import {
   NO_BROKER,
   buildCredentialBrokerHandle
@@ -247,7 +245,7 @@ import {
 } from "./chunk-JYJFGD2H.js";
 import {
   sha256Hex
-} from "./chunk-ISRKW4YN.js";
+} from "./chunk-DQZXPGGZ.js";
 import {
   NO_FORGET,
   addSubjectRef,
@@ -256,7 +254,7 @@ import {
   readDottedPath,
   rebuildSubjectIndex,
   removeSubjectRef
-} from "./chunk-KFRPNHWR.js";
+} from "./chunk-ZHDSUZQU.js";
 import {
   NO_SEALED_RECORD
 } from "./chunk-QD46HPZG.js";
@@ -270,20 +268,20 @@ import {
   queryByDet,
   resolveStableCek,
   validateSchemaInput
-} from "./chunk-RZPOZPZU.js";
+} from "./chunk-SU6SGWXM.js";
 import {
   buildDeleteMarker,
   buildTombstone,
   isDeleteMarker,
   isTombstone
-} from "./chunk-VH6SOCXH.js";
+} from "./chunk-EFJAAFBW.js";
 import {
   encrypt
 } from "./chunk-AKKRXT23.js";
 import {
   NOYDB_FORMAT_VERSION,
   SealedHandle
-} from "./chunk-GZACYEOB.js";
+} from "./chunk-77AEMXFA.js";
 import {
   AlreadyElevatedError,
   AttestationError,
@@ -390,7 +388,7 @@ function resolveStrategies(options) {
 
 // src/port/by/default-provider.ts
 async function createDefaultCoordinationProvider(store) {
-  const { StoreCoordinationProvider } = await import("./store-coordination-provider-5LX2UFU2.js");
+  const { StoreCoordinationProvider } = await import("./store-coordination-provider-AHGFEMFA.js");
   return new StoreCoordinationProvider(store);
 }
 
@@ -2237,7 +2235,7 @@ var Collection = class {
    * re-create version-continuity gate in `_putInternal` read the store ONLY
    * for a known marker prior, instead of unconditionally on every insert.
    * Populated on hydration (`ensureHydrated`/`hydrateFromSnapshot`), local
-   * delete (`_doDelete`), and the sync/tab/cutover choke point
+   * delete (`_commitDelete`), and the sync/tab/cutover choke point
    * (`_invalidateCacheEntry`). Accepted drift: `vault._purgeDeleteMarkers`/
    * `_purgeMarkersOn` remove markers directly on the raw store, bypassing
    * Collection, so this set can hold stale ids after a purge on an
@@ -3160,7 +3158,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-JOE7GBAE.js");
+      const { resolveStaleMVOnRead } = await import("./stale-T3V7XEOB.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     let record;
@@ -3513,7 +3511,13 @@ var Collection = class {
     }
     await this._onRecordMutated(id, "put", "local-write", { record: event, version });
   }
-  async _putInternal(id, record, options) {
+  /**
+   * The pre-envelope stages both write paths share (#904): permission + tier
+   * refusal, Via ingest, the beforePut gate bus, Via enforceWrite, computed
+   * fields, schema validation, Via encodeWrite and ref enforcement. Reads and
+   * throws; commits nothing. Returns the record in the shape that gets stored.
+   */
+  async #prepareWriteRecord(id, record) {
     if (!hasWritePermission(this.keyring, this.name)) {
       throw new ReadOnlyError();
     }
@@ -3555,7 +3559,11 @@ var Collection = class {
     if (this.refEnforcer !== void 0) {
       await this.refEnforcer.enforceRefsOnPut(this.name, record);
     }
+    return record;
+  }
+  async _putInternal(id, record, options) {
     if (this.crdtMode) {
+      record = await this.#prepareWriteRecord(id, record);
       const existingEnvelope = await this.adapter.get(this.vault, this.name, id);
       const existingVersion = existingEnvelope?._v ?? 0;
       const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -3569,20 +3577,20 @@ var Collection = class {
       } else {
         crdtState = { _crdt: "yjs", update: record };
       }
-      const version2 = existingVersion + 1;
-      const cek2 = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
-      const envelope2 = await this.codec.encryptJsonString(JSON.stringify(crdtState), version2, cek2, options?.source, options?.sourceTs);
-      await this.adapter.put(this.vault, this.name, id, envelope2);
+      const version = existingVersion + 1;
+      const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
+      const envelope = await this.codec.encryptJsonString(JSON.stringify(crdtState), version, cek, options?.source, options?.sourceTs);
+      await this.adapter.put(this.vault, this.name, id, envelope);
       const resolvedRecord = this.strategies.crdt.resolveCrdtSnapshot(crdtState);
       const existingResolvedRecord = existingEnvelope ? await this.codec.decryptRecord(existingEnvelope, { skipValidation: true }) : null;
       const existingResolved = existingResolvedRecord !== null ? { record: existingResolvedRecord, version: existingVersion } : void 0;
       if (existingResolved) {
-        await this.#savePriorHistory(id, existingResolved, cek2, this.vdigFields !== null ? { id, prev: existingEnvelope } : void 0);
+        await this.#savePriorHistory(id, existingResolved, cek, this.vdigFields !== null ? { id, prev: existingEnvelope } : void 0);
       }
       await this.#commitWriteTail({
         id,
-        envelope: envelope2,
-        version: version2,
+        envelope,
+        version,
         indexed: resolvedRecord,
         event: record,
         prior: existingResolved,
@@ -3590,6 +3598,23 @@ var Collection = class {
       });
       return;
     }
+    await this._commitPut(await this._preparePut(id, record, options));
+  }
+  /**
+   * Prepare half of the ordinary (non-CRDT) write (#893/#904): run every
+   * pre-envelope stage, resolve the prior version, and produce the encrypted
+   * envelope — with ZERO observable side effects. No store write, no cache or
+   * index mutation, no history entry, no ledger append, no event. It may READ
+   * the store (gate prior, lazy prior, vdig prior) and it may THROW; refusing
+   * a write before anything commits is precisely its job.
+   *
+   * Pairs with {@link _commitPut}. Split out so a batch can prepare every op,
+   * submit ONE `store.tx()`, then finalize each op.
+   *
+   * @internal
+   */
+  async _preparePut(id, record, options) {
+    record = await this.#prepareWriteRecord(id, record);
     let existing;
     let priorRaw = null;
     if (this.lazy && this.lru) {
@@ -3617,19 +3642,36 @@ var Collection = class {
     this.uniqueConstraints?.check(id, record);
     const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
     const vdigCtx = this.vdigFields !== null ? { id, prev: await this.adapter.get(this.vault, this.name, id) } : void 0;
-    if (existing) await this.#savePriorHistory(id, existing, cek, vdigCtx);
     const envelope = await this.codec.encryptRecord(record, version, cek, options?.source, options?.sourceTs, vdigCtx, id);
-    await this.adapter.put(this.vault, this.name, id, envelope);
+    return { id, envelope, version, indexed: record, event: record, prior: existing, cek, vdigCtx, reason: options?.reason };
+  }
+  /**
+   * Commit half (#893/#904): the only place an ordinary put becomes
+   * observable — history snapshot of the prior version, store write, marker
+   * clear, then the shared write tail.
+   *
+   * History still runs BEFORE the store write, so a history failure leaves no
+   * write behind. It now runs AFTER `encryptRecord` rather than before it —
+   * the split's one sanctioned reorder, which also stops an encrypt failure
+   * from leaving an orphan snapshot behind.
+   *
+   * @internal `persist: false` skips the `adapter.put` — see {@link _finalizePut}.
+   */
+  async _commitPut(prepared, persist = true) {
+    const { id, envelope, version, indexed, event, prior, cek, vdigCtx, reason } = prepared;
+    if (prior) await this.#savePriorHistory(id, prior, cek, vdigCtx);
+    if (persist) await this.adapter.put(this.vault, this.name, id, envelope);
     this.markerIds.delete(id);
-    await this.#commitWriteTail({
-      id,
-      envelope,
-      version,
-      indexed: record,
-      event: record,
-      prior: existing,
-      reason: options?.reason
-    });
+    await this.#commitWriteTail({ id, envelope, version, indexed, event, prior, reason });
+  }
+  /**
+   * {@link _commitPut} minus the `adapter.put`: the store already holds this
+   * envelope because it was written as one leg of a `store.tx()` batch.
+   *
+   * @internal
+   */
+  _finalizePut(prepared) {
+    return this._commitPut(prepared, false);
   }
   /**
    * Fire registered MV strategies whose dependency set includes this
@@ -3646,7 +3688,7 @@ var Collection = class {
    */
   async dispatchMaterializedViews(id, record, wave) {
     if (this.materializedViewSource === void 0) return;
-    const { dispatchMaterializedViews } = await import("./dispatch-RPTLK7LJ.js");
+    const { dispatchMaterializedViews } = await import("./dispatch-6TV3DGO6.js");
     return dispatchMaterializedViews(this.#mvDispatchCtx(this.materializedViewSource), id, record, wave);
   }
   /**
@@ -3819,7 +3861,7 @@ var Collection = class {
    *  dispatch wave's per-target dedup; `undefined` on the local-write path (byte-identical). */
   async dispatchDerivations(id, record, version, wave) {
     if (this.derivationSource === void 0) return;
-    const { dispatchDerivations } = await import("./dispatch-7T45NN7C.js");
+    const { dispatchDerivations } = await import("./dispatch-W7NWQ637.js");
     return dispatchDerivations({
       ...this.#derivationDeleteCtx(this.derivationSource),
       via: this.via,
@@ -3953,11 +3995,40 @@ var Collection = class {
     return await this._doDelete(id, true);
   }
   async _doDelete(id, internal) {
+    const prepared = await this._prepareDelete(id, internal);
+    return prepared === null ? false : await this._commitDelete(prepared);
+  }
+  /**
+   * Prepare half of the delete (#893/#905): every refusal (write permission,
+   * tier, the beforeDelete gate bus, foreign-key refs), the prior-version
+   * resolution, the pre-delete payload hash, and the #589 marker DECISION —
+   * the marker is minted here but NOT written.
+   *
+   * Commits nothing of its own: no store write, no history entry, no ledger
+   * append, no cache/index mutation, no event, no `markerIds` entry. It READS
+   * the store and it may THROW — refusing a delete before anything commits is
+   * precisely its job. `null` is the "nothing to delete" answer that the early
+   * `return false` paths gave: no live record, an already-shredded tombstone,
+   * an existing marker, or the #718 elevated-internal skip.
+   *
+   * ONE exception to that guarantee: on a collection with `cascade` inbound
+   * refs, prepare itself deletes the referencing children (via
+   * `enforceRefsOnDelete`, as it always has) — prepare is NOT abortable there.
+   * The transaction atomic path must never call this on such a collection; its
+   * eligibility gate excludes refs-bearing collections.
+   *
+   * Pairs with {@link _commitDelete}. A deliberately separate split from the
+   * put pair (#842c) — delete differs in hydration, in the history-read gate
+   * and in the marker rules.
+   *
+   * @internal
+   */
+  async _prepareDelete(id, internal) {
     if (!hasWritePermission(this.keyring, this.name)) {
       throw new ReadOnlyError();
     }
     await assertTierWritable(this.adapter, this.vault, this.name, id, !internal && this.tiers !== null);
-    if (internal && this.tiers !== null && await liveRecordIsElevated(this.adapter, this.vault, this.name, id)) return false;
+    if (internal && this.tiers !== null && await liveRecordIsElevated(this.adapter, this.vault, this.name, id)) return null;
     if (this.subsystemBus?.hasGateHandlers("beforeDelete")) {
       const { env: existingEnv, record: existingRecord, elided } = await this.resolveGatePrior("beforeDelete", id);
       if (existingEnv || elided) {
@@ -3992,32 +4063,42 @@ var Collection = class {
     } else {
       existing = await this.resolvePriorValues(id);
     }
-    if (existing && this.historyConfig.enabled !== false) {
-      const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
-      const prevForVdig = this.vdigFields !== null ? await this.adapter.get(this.vault, this.name, id) : null;
-      await this.strategies.history.saveHistory(this.adapter, this.vault, this.name, id, await this.codec.encryptRecord(existing.record, existing.version, cek, void 0, void 0, this.vdigFields !== null ? { id, prev: prevForVdig } : void 0, id));
-    }
     const previousEnvelope = await this.adapter.get(this.vault, this.name, id);
     const previousPayloadHash = await this.strategies.history.envelopePayloadHash(previousEnvelope);
-    let markerVersion;
+    let marker;
     if (this.onDirty) {
       const live = previousEnvelope;
-      if (!live || isTombstone(live, this.storeCiphertext) || isDeleteMarker(live)) return false;
-      markerVersion = live._v + 1;
-      await this.adapter.put(this.vault, this.name, id, buildDeleteMarker(markerVersion, this.keyring.userId));
-      this.markerIds.add(id);
-    } else {
-      await this.adapter.delete(this.vault, this.name, id);
+      if (!live || isTombstone(live, this.storeCiphertext) || isDeleteMarker(live)) return null;
+      marker = buildDeleteMarker(live._v + 1, this.keyring.userId);
     }
+    const snapshots = existing !== void 0 && this.historyConfig.enabled !== false;
+    const cek = snapshots && this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
+    const vdigCtx = snapshots && this.vdigFields !== null ? { id, prev: previousEnvelope } : void 0;
+    return { id, internal, existing, previousPayloadHash, marker, cek, vdigCtx };
+  }
+  /**
+   * Commit half (#893/#905): the only place a delete becomes observable —
+   * history snapshot of the deleted version, the store write (the #589 marker
+   * put, or the physical removal when sync is off), then the ledger entry,
+   * cache/index teardown, the mutation event, and the user-initiated
+   * derivation dispatch.
+   *
+   * History still runs BEFORE the store write, exactly as today, so a history
+   * failure leaves no delete behind.
+   *
+   * @internal `persist: false` skips the store write — see {@link _finalizeDelete}.
+   */
+  async _commitDelete(prepared, persist = true) {
+    const { id, internal, existing, previousPayloadHash, marker, cek, vdigCtx } = prepared;
+    if (existing && this.historyConfig.enabled !== false) {
+      await this.strategies.history.saveHistory(this.adapter, this.vault, this.name, id, await this.codec.encryptRecord(existing.record, existing.version, cek, void 0, void 0, vdigCtx, id));
+    }
+    if (marker) {
+      if (persist) await this.adapter.put(this.vault, this.name, id, marker);
+      this.markerIds.add(id);
+    } else if (persist) await this.adapter.delete(this.vault, this.name, id);
     if (this.ledger) {
-      await this.ledger.append({
-        op: "delete",
-        collection: this.name,
-        id,
-        version: existing?.version ?? 0,
-        actor: this.keyring.userId,
-        payloadHash: previousPayloadHash
-      });
+      await this.ledger.append({ op: "delete", collection: this.name, id, version: existing?.version ?? 0, actor: this.keyring.userId, payloadHash: previousPayloadHash });
     }
     if (this.lazy && this.lru) {
       this.lru.remove(id);
@@ -4031,7 +4112,7 @@ var Collection = class {
         this.uniqueConstraints?.remove(id, existing.record);
       }
     }
-    await this._onRecordMutated(id, "delete", "local-delete", { version: markerVersion ?? (existing?.version ?? 0) + 1 });
+    await this._onRecordMutated(id, "delete", "local-delete", { version: marker?._v ?? (existing?.version ?? 0) + 1 });
     if (!internal) {
       await this.dispatchMaterializedViewsOnDelete(id);
       await this.dispatchArrayDerivationsOnDelete(id);
@@ -4039,6 +4120,15 @@ var Collection = class {
     }
     return true;
   }
+  /**
+   * {@link _commitDelete} minus the store write: the marker (or the removal)
+   * already landed as one leg of a `store.tx()` batch.
+   *
+   * @internal
+   */
+  _finalizeDelete(prepared) {
+    return this._commitDelete(prepared, false);
+  }
   /**
    * @internal — GDPR crypto-shred a LIVE record to a tombstone.
    *
@@ -4096,7 +4186,7 @@ var Collection = class {
    */
   async dispatchArrayDerivationsOnDelete(id, eraseRecordShapeToo = false) {
     if (this.derivationSource === void 0) return 0;
-    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-7T45NN7C.js");
+    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-W7NWQ637.js");
     return dispatchArrayDerivationsOnDelete(this.#derivationDeleteCtx(this.derivationSource), id, eraseRecordShapeToo);
   }
   /**
@@ -4110,7 +4200,7 @@ var Collection = class {
    */
   async dispatchMaterializedViewsOnDelete(id) {
     if (this.materializedViewSource === void 0) return { deleted: 0, residueUndecodable: [], residueDeclined: [] };
-    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-RPTLK7LJ.js");
+    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-6TV3DGO6.js");
     return dispatchMaterializedViewsOnDelete(this.#mvDispatchCtx(this.materializedViewSource), id);
   }
   /**
@@ -4130,7 +4220,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-JOE7GBAE.js");
+      const { resolveStaleMVOnRead } = await import("./stale-T3V7XEOB.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     await this.ensureHydrated();
@@ -5283,14 +5373,14 @@ var Collection = class {
   /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
   async _ensureClassifiedMarker() {
     if (this._markerPersisted || this.vdigFields === null) return;
-    const { persistClassifiedMarkerForFields } = await import("./classified-marker-EOOSMWFC.js");
+    const { persistClassifiedMarkerForFields } = await import("./classified-marker-LE54HWSX.js");
     await persistClassifiedMarkerForFields(this.adapter, this.vault, this.name, this.vdigFields, await this.getDEK(this.name));
     this._markerPersisted = true;
   }
   /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
   async _classifiedMarkerDigestOnly() {
     if (this._markerDigestOnlyCache !== void 0) return this._markerDigestOnlyCache;
-    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-EOOSMWFC.js");
+    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-LE54HWSX.js");
     this._markerDigestOnlyCache = await readClassifiedMarkerDigestOnly(this.adapter, this.vault, this.name, await this.getDEK(this.name));
     return this._markerDigestOnlyCache;
   }
@@ -5384,6 +5474,16 @@ var Collection = class {
     return { i18nFields: this.i18nFields, lookupFields: this.lookupFields };
   }
   // @internal reconcile.ts's presentForJoin-rebuild union reader (#671 item 3)
+  async _assertWriteGates() {
+    await this.schemaUpdateGate?.assertWritable();
+    await this.schemaFence?.assertWritable(this.name);
+  }
+  // @internal #906 — the two refusals `put()`/`delete()` assert BEFORE anything else: the schema-update gate (an opt-in but persistent `reject` decision) and the schema fence (stale generation → MigrationRequiredError; draining/migrating vault or pending per-collection cutover → SchemaFenceError). Neither lives in the prepare halves, and the atomic commit path calls those directly — so it asserts here, per op, mirroring put()/delete() exactly (the fence does a fresh store read per call, so per-op matches today's cost model). Deliberately NOT moved into the prepare halves: that would double-assert on the OCC path.
+  _txAtomicSafe(opType) {
+    if (this.materializedViewSource !== void 0 && this.materializedViewSource.registry().mvsForSource(this.name).length > 0 || this.derivationSource !== void 0 && this.derivationSource.registry().strategiesForSource(this.name).length > 0 || this.crdtMode !== void 0 || this.uniqueConstraints !== null || this.#hooksActive() || (this.subsystemBus?.hasHandlers(opType === "put" ? "afterPut" : "afterDelete") ?? false)) return false;
+    return opType === "put" ? Object.keys(this._refs).length === 0 : this.refEnforcer === void 0;
+  }
+  // @internal #893/#906-prep atomic-commit eligibility gate (Task 4) — false on any derivation/MV source (any lifecycle), CRDT mode, unique constraints, or refs on this write direction. Put uses precise outbound `_refs`; delete deliberately uses blanket `refEnforcer` presence, NOT `refRegistry.getInbound()` — `enforceRefsOnDelete` (with-shape/links/vault-facade.ts) cascades from THREE sources (lookup-ref edges, classic inbound refs, managed links), and only the blanket check is >= as strict as all three. #906: also false while user write-hooks or an `afterPut`/`afterDelete` bus handler are live — note both signals are db-GLOBAL (one `onAfterWrite` anywhere, including the auto-registered cross-tab write relay, keeps every collection on the OCC path) — both fire in `put()`/`delete()`, which the atomic path bypasses (a `beforeWrite` hook can REFUSE a write, so silently skipping them would be a policy hole). See atomic-eligibility.ts.
   _reconcileReadState(patch) {
     if (patch.dictKeyFields) this.dictKeyFields = { ...patch.dictKeyFields, ...this.dictKeyFields };
     if (patch.i18nFields) this.i18nFields = { ...patch.i18nFields, ...this.i18nFields };
@@ -6733,7 +6833,7 @@ var VaultLinks = class {
 // src/with-shape/links/lazy-handle.ts
 function makeLazyLinkSetHandle(d) {
   let engine = null;
-  const load = () => engine ??= import("./link-set-POQB7BU5.js").then(
+  const load = () => engine ??= import("./link-set-CGYC3OH5.js").then(
     ({ LinkSet }) => new LinkSet(d.adapter, d.vault, d.name, d.spec, d.encrypted, d.getDEK, d.actor, d.emitter, d.endpointExists)
   );
   return {
@@ -7271,7 +7371,7 @@ function declareSatellite(ctx, collectionName, options, existingRegistry) {
   ctx.forEachSyncEngine((e) => e.remirrorPairResolvers([spec.base, spec.satellite]));
   const registry = reg;
   const baseSchema = ctx.getBaseSchema(spec.base);
-  void import("./post-register-URQANI3B.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
+  void import("./post-register-LY35EDTJ.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
   });
   return reg;
 }
@@ -8227,7 +8327,7 @@ var Vault = class {
         const strategies = options.schemaUpdate ?? [];
         const work = (async () => {
           const dek = await this.getDEK(collectionName);
-          const { persistSchemaIfNeeded } = await import("./register-5W6CG4RM.js");
+          const { persistSchemaIfNeeded } = await import("./register-6RIBIT3I.js");
           const result = await persistSchemaIfNeeded({
             store: this.adapter,
             vault: this.name,
@@ -8376,7 +8476,7 @@ var Vault = class {
         const work = (async () => {
           try {
             const dek = await this.getDEK(collectionName);
-            await (await import("./register-5W6CG4RM.js")).persistSchemaIfNeeded({
+            await (await import("./register-6RIBIT3I.js")).persistSchemaIfNeeded({
               store: this.adapter,
               vault: this.name,
               collectionName,
@@ -9563,7 +9663,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-MCSGBZXI.js"),
+      import("./registry-RON4WHAP.js"),
       import("./read-only-facade-CHCKSEPD.js")
     ]);
     const registry = new DerivationRegistry();
@@ -9595,7 +9695,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-UJFP3NWF.js");
+    const { MaterializedViewRegistry } = await import("./registry-MUSL4AW6.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -9667,14 +9767,14 @@ var Vault = class {
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-XZYM4KHT.js");
+    const { MaterializedViewExecutor } = await import("./executor-FPHKWDWT.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this,
       dispatchCtx: this._dispatchCtx({ collection: name, id: "refreshView" })
     });
-    const { clearMVStaleFully } = await import("./stale-JOE7GBAE.js");
+    const { clearMVStaleFully } = await import("./stale-T3V7XEOB.js");
     await clearMVStaleFully(this.adapter, this.name, registry, name);
     return result;
   }
@@ -9714,7 +9814,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-TV7CXAJ6.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-273RDMYS.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key, this.getDEK, this.encrypted);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -9941,7 +10041,7 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-ONOZVPIP.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-JDUMAF6L.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
         "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (secret) first."
@@ -9963,7 +10063,7 @@ var Vault = class {
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-ONOZVPIP.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-JDUMAF6L.js");
     await revokeDelegation(this.adapter, this.name, id);
     void DELEGATIONS_COLLECTION;
   }
@@ -10211,7 +10311,7 @@ var Vault = class {
    * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
    */
   async dumpSchema(opts = {}) {
-    const { dumpVaultSchema } = await import("./walk-6OHAWGBS.js");
+    const { dumpVaultSchema } = await import("./walk-G3NFEP5L.js");
     return dumpVaultSchema(this, opts);
   }
   /**
@@ -10361,7 +10461,7 @@ var Vault = class {
    * both modes round-trip cleanly.
    */
   async dump() {
-    const { dumpVault } = await import("./backup-PTSVXDDW.js");
+    const { dumpVault } = await import("./backup-X7F3TCFV.js");
     return dumpVault(this.backupContext());
   }
   /**
@@ -10413,7 +10513,7 @@ var Vault = class {
    * — there's no chain to verify against.
    */
   async load(backupJson) {
-    const { loadVault } = await import("./backup-PTSVXDDW.js");
+    const { loadVault } = await import("./backup-X7F3TCFV.js");
     return loadVault(this.backupContext(), backupJson);
   }
   /**
@@ -10445,7 +10545,7 @@ var Vault = class {
    * way to detect tampering of an in-place vault.
    */
   async verifyBackupIntegrity() {
-    const { verifyBackupIntegrity } = await import("./backup-PTSVXDDW.js");
+    const { verifyBackupIntegrity } = await import("./backup-X7F3TCFV.js");
     return verifyBackupIntegrity(this.backupContext());
   }
   /**
@@ -10663,7 +10763,7 @@ var Vault = class {
    * is the live validator object, not a serialization of it).
    */
   async exportJSON(opts = {}) {
-    const { exportVaultJSON } = await import("./backup-PTSVXDDW.js");
+    const { exportVaultJSON } = await import("./backup-X7F3TCFV.js");
     return exportVaultJSON(this.backupContext(), opts);
   }
 };
@@ -10943,7 +11043,7 @@ var ServiceBus = class {
   }
 };
 
-// src/with-party/tab-coordination.ts
+// src/with-sync/tab-coordination.ts
 var TabCoordinator = class {
   tabId;
   role = "unknown";
@@ -11124,7 +11224,7 @@ function defaultChannel(name = "noydb:tabs") {
   };
 }
 
-// src/with-party/tab-write-relay.ts
+// src/with-sync/tab-write-relay.ts
 var CrossTabWriteRelay = class {
   #channel;
   #writerId;
@@ -12676,7 +12776,8 @@ var Noydb = class {
     const targets = normalizeSyncTargets(this.options.sync);
     if (targets.length > 0) {
       const primary = targets.find((t) => t.role === "sync-peer") ?? targets[0];
-      const effectivePolicy = this.options.syncPolicy ?? primary.policy ?? INDEXED_STORE_POLICY;
+      const declaredPolicy = this.options.syncPolicy ?? primary.policy;
+      const effectivePolicy = declaredPolicy ?? INDEXED_STORE_POLICY;
       syncEngine = this.strategies.sync.buildSyncEngine({
         local: this.options.store,
         remote: primary.store,
@@ -12688,6 +12789,7 @@ var Noydb = class {
         ...primary.label !== void 0 ? { label: primary.label } : {}
       });
       this.syncEngines.set(name, syncEngine);
+      if (declaredPolicy) syncEngine.startScheduler();
       for (const target of targets) {
         if (target === primary) continue;
         const targetPolicy = target.policy ?? this.options.syncPolicy ?? INDEXED_STORE_POLICY;
@@ -12703,6 +12805,7 @@ var Noydb = class {
         });
         const key = `${name}::${target.label ?? target.role}`;
         this.syncEngines.set(key, engine);
+        if (target.policy ?? this.options.syncPolicy) engine.startScheduler();
       }
     }
     const comp = new Vault({
@@ -13516,6 +13619,7 @@ var Noydb = class {
   close() {
     this.closed = true;
     this.snapshots.stop();
+    for (const engine of this.syncEngines.values()) engine.stopScheduler();
     if (this.sessionTimer) {
       clearTimeout(this.sessionTimer);
       this.sessionTimer = null;
@@ -13886,7 +13990,7 @@ async function createNoydb(options) {
     throw new ValidationError("A secret (secret) or getKeyring callback is required when encryption is enabled");
   }
   if (!options.coordinationStrategy) options = { ...options, coordinationStrategy: await createDefaultCoordinationProvider(options.store) };
-  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-3NKVNZPM.js")).createUserApi };
+  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-SI2IVBQO.js")).createUserApi };
   if (!options.policyFactory) {
     const policyModule = await import("./policy/index.js");
     options = { ...options, policyFactory: policyModule.createNoydbPolicy, policyCheckGateFn: policyModule.checkGate };
@@ -13921,4 +14025,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-OW5Y6HA6.js.map
+//# sourceMappingURL=chunk-ZBYFMI6D.js.map