@noy-db/hub 0.4.0 → 0.5.0

package/dist/{chunk-ZBYFMI6D.js → chunk-5UKUOMO6.js}

@@ -1,16 +1,16 @@
-import {
-  hashFields,
-  validateSatelliteDeclaration
-} from "./chunk-SHEEBRZ4.js";
 import {
   resolveStaleOnRead
-} from "./chunk-NJ4DYYO5.js";
+} from "./chunk-F5UWVF6Z.js";
 import {
   LinkIntegrityError,
   isLinkCollectionName,
   linkCollectionName,
   linkRowKey
-} from "./chunk-4JQK3L4V.js";
+} from "./chunk-EBETHILL.js";
+import {
+  hashFields,
+  validateSatelliteDeclaration
+} from "./chunk-FT5Y4VSP.js";
 import {
   isBaseLive,
   liveBaseIdSet
@@ -23,7 +23,7 @@ import {
   buildPersistedIndexCallbacks,
   encodeVecId,
   syncTierSearch
-} from "./chunk-PWPYO73B.js";
+} from "./chunk-6RDTG6E5.js";
 import {
   SchemaUpdateGate
 } from "./chunk-6LJY7X5A.js";
@@ -31,19 +31,19 @@ import {
   NO_CLASSIFIED,
   guardClassifiedCompat,
   resolveClassifiedFields
-} from "./chunk-DAFBJS4Y.js";
+} from "./chunk-7P4LL3JH.js";
 import {
   NO_TIERS,
   classifySealedShred,
   syncDerivedOutputs
-} from "./chunk-RQ4ZI4ZI.js";
+} from "./chunk-QITP2JGX.js";
 import {
   NO_PORTABILITY
-} from "./chunk-BLBAQRBM.js";
+} from "./chunk-NIKQQXI2.js";
 import {
   NO_CARGO,
   runDrainBarrier
-} from "./chunk-TG634KCO.js";
+} from "./chunk-QTMZDMJ6.js";
 import {
   resolveManagedSecret,
   saveSealedSecret
@@ -54,15 +54,15 @@ import {
 import {
   derivePersistedSchema,
   isZod4Schema
-} from "./chunk-6ZNSB3H6.js";
+} from "./chunk-3LYMOSY7.js";
 import {
   CustodyApi,
   NO_CUSTODY
-} from "./chunk-TS5XLBZR.js";
+} from "./chunk-NMYH55MW.js";
 import {
   DEFAULT_POSTURE,
   ViaGraph
-} from "./chunk-4ZKNC6A6.js";
+} from "./chunk-QQL6XPPG.js";
 import {
   buildLookupAltIndex,
   buildLookupSnapshotRows,
@@ -86,30 +86,30 @@ import {
   selfWriteFieldEqual,
   touchFor,
   updateReferencingRecords
-} from "./chunk-LRRX57UA.js";
+} from "./chunk-4MSNAB64.js";
 import {
   OverlayedCollection
-} from "./chunk-ZTLOXFPB.js";
+} from "./chunk-Y2PTKKIN.js";
 import {
   INDEXED_STORE_POLICY,
   NO_SYNC
 } from "./chunk-55LKVALY.js";
 import {
   NO_ATTESTATION
-} from "./chunk-5GQEU4DN.js";
+} from "./chunk-IJV56FWY.js";
 import {
   NO_CONSENT
 } from "./chunk-PEOZ34EM.js";
 import {
   NO_PERIODS
-} from "./chunk-ZFG5EBI3.js";
+} from "./chunk-F2WWHKO7.js";
 import {
   PERIODS_COLLECTION,
   PERIOD_ARCHIVES_COLLECTION,
   PERIOD_FREEZES_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION,
   periodExclusiveUpperBound
-} from "./chunk-NM5UYF6Q.js";
+} from "./chunk-SBGXQK5I.js";
 import {
   NO_SHADOW
 } from "./chunk-SMY5X46Z.js";
@@ -118,9 +118,8 @@ import {
 } from "./chunk-DZFQVICS.js";
 import {
   TxContext,
-  bestEffortRevert,
-  revertExecuted
-} from "./chunk-GTYFIVIZ.js";
+  bestEffortRevert
+} from "./chunk-NWK6SVBM.js";
 import {
   lazy
 } from "./chunk-5D2ALSM5.js";
@@ -128,29 +127,29 @@ import {
   InvertedIndex,
   MemoryIndexStore,
   NO_SEARCH
-} from "./chunk-KYRDJI5O.js";
+} from "./chunk-YA7Y3EZP.js";
 import {
   NO_SEQUENCE,
   SEQUENCE_COLLECTION,
   compileSequenceFormat,
   resolveSequenceKey
-} from "./chunk-NBXFCQX4.js";
+} from "./chunk-RQILGK3N.js";
 import {
   Query,
   ScanBuilder
-} from "./chunk-WBKZUO5V.js";
+} from "./chunk-QMCWYN6O.js";
 import {
   EXPORT_AUDIT_COLLECTION,
   NO_BLOBS,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-WUHEP3HH.js";
+} from "./chunk-XX7YB5BI.js";
 import {
   LazyQuery,
   NO_INDEXING,
   decodeIdxId,
   encodeIdxId
-} from "./chunk-L3YYLT4E.js";
+} from "./chunk-ALUVACKT.js";
 import {
   IMPLICIT_LAZY,
   Lru,
@@ -170,7 +169,7 @@ import {
 } from "./chunk-PVEWA2DU.js";
 import {
   dictCollectionName
-} from "./chunk-OWHP3H5C.js";
+} from "./chunk-MPW6AHTC.js";
 import {
   NO_I18N,
   getAtPath,
@@ -178,11 +177,11 @@ import {
   isDictKeyDescriptor,
   isI18nTextDescriptor,
   isStaticDictDescriptor
-} from "./chunk-UADPR6F4.js";
+} from "./chunk-5EKL6BXI.js";
 import {
   isViaInstalled,
   viaBinder
-} from "./chunk-6UBZ6I5Z.js";
+} from "./chunk-DDB626I7.js";
 import {
   NO_TEAM,
   describeAllUsersAuth,
@@ -205,7 +204,7 @@ import {
   saveShamirRecoveryEntries,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-ZNWSG7XC.js";
+} from "./chunk-IHYSIPEK.js";
 import {
   assertKeyringOpenAllowed,
   buildRecipientKeyringFile,
@@ -220,15 +219,15 @@ import {
   listUsers,
   loadKeyring,
   updateKeyringIdentity
-} from "./chunk-Q5YJCVJY.js";
+} from "./chunk-FZAP4JNC.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
-} from "./chunk-2BET5QTS.js";
+} from "./chunk-6PFST3FC.js";
 import {
   NO_BROKER,
   buildCredentialBrokerHandle
-} from "./chunk-IXNCZTWA.js";
+} from "./chunk-PWEMRXPO.js";
 import {
   NO_SESSION
 } from "./chunk-VKQCVU2Z.js";
@@ -242,10 +241,10 @@ import {
   assertCutoverTierSafe,
   assertTierWritable,
   liveRecordIsElevated
-} from "./chunk-JYJFGD2H.js";
+} from "./chunk-GYJRDALN.js";
 import {
   sha256Hex
-} from "./chunk-DQZXPGGZ.js";
+} from "./chunk-V3EGXDFN.js";
 import {
   NO_FORGET,
   addSubjectRef,
@@ -254,10 +253,10 @@ import {
   readDottedPath,
   rebuildSubjectIndex,
   removeSubjectRef
-} from "./chunk-ZHDSUZQU.js";
+} from "./chunk-V4O6YZSP.js";
 import {
   NO_SEALED_RECORD
-} from "./chunk-QD46HPZG.js";
+} from "./chunk-U2ID5A2I.js";
 import {
   RecordCodec,
   SEALED_CEK_NS,
@@ -268,7 +267,7 @@ import {
   queryByDet,
   resolveStableCek,
   validateSchemaInput
-} from "./chunk-SU6SGWXM.js";
+} from "./chunk-623QEHDB.js";
 import {
   buildDeleteMarker,
   buildTombstone,
@@ -277,7 +276,7 @@ import {
 } from "./chunk-EFJAAFBW.js";
 import {
   encrypt
-} from "./chunk-AKKRXT23.js";
+} from "./chunk-RPWMDIGK.js";
 import {
   NOYDB_FORMAT_VERSION,
   SealedHandle
@@ -321,8 +320,9 @@ import {
   UniqueConstraintError,
   UnsupportedIndexOptionError,
   UnsupportedTierCompositionError,
-  ValidationError
-} from "./chunk-QZWTRENR.js";
+  ValidationError,
+  isConflictError
+} from "./chunk-AR5D76T2.js";
 
 // src/with-commit/tx/strategy.ts
 var NOT_ENABLED = new Error(
@@ -1710,6 +1710,109 @@ function buildDescription(input) {
   };
 }
 
+// src/kernel/put-many-atomic.ts
+var toRevertLeg = ({ op, priorEnvelope }) => ({
+  vaultName: op.vaultName,
+  collectionName: op.collectionName,
+  id: op.id,
+  prior: priorEnvelope
+});
+async function runPutManyAtomic(ctx, entries) {
+  const { store, vault, name } = ctx;
+  const priors = /* @__PURE__ */ new Map();
+  let duplicateId = false;
+  for (const [id, , opts] of entries) {
+    if (priors.has(id)) duplicateId = true;
+    else priors.set(id, await store.get(vault, name, id));
+    if (opts?.expectedVersion !== void 0) {
+      const actual = priors.get(id)?._v ?? 0;
+      if (actual !== opts.expectedVersion) {
+        throw new ConflictError(
+          actual,
+          `putMany atomic: ${vault}/${name}/${id} expected v${opts.expectedVersion}, found v${actual}`
+        );
+      }
+    }
+  }
+  if (!duplicateId && store.capabilities?.txAtomic === true && typeof store.tx === "function" && ctx.host._txAtomicSafe("put")) {
+    return commitViaStoreTx(ctx, entries, priors);
+  }
+  return commitSequentially(ctx, entries, priors);
+}
+async function commitViaStoreTx(ctx, entries, priors) {
+  const { host, store, vault, name } = ctx;
+  await host._assertWriteGates();
+  const executed = [];
+  const legs = [];
+  for (const [id, record] of entries) {
+    const prior = priors.get(id) ?? null;
+    executed.push({ op: { type: "put", vaultName: vault, collectionName: name, id }, priorEnvelope: prior });
+    const prepared = await host._preparePut(id, record);
+    legs.push({
+      prepared,
+      // Every leg carries CAS against the Phase-1 snapshot, so a writer
+      // landing between prepare and the batch reaching the store loses.
+      txOp: { type: "put", vault, collection: name, id, expectedVersion: prior?._v ?? 0, envelope: prepared.envelope }
+    });
+  }
+  await store.tx(legs.map((l) => l.txOp));
+  try {
+    for (const leg of legs) {
+      await host._finalizePut(leg.prepared);
+      await host._fireAtomicAfterWrite("put", leg.prepared);
+    }
+  } catch (err) {
+    await bestEffortRevert(executed.map(toRevertLeg), store);
+    for (const { op } of [...executed].reverse()) {
+      try {
+        await host._invalidateCacheEntry(op.id);
+      } catch {
+      }
+    }
+    throw err;
+  }
+  return { ok: true, success: entries.map(([id]) => id), failures: [] };
+}
+async function commitSequentially(ctx, entries, priors) {
+  const { host, store, vault, name, derivationSource } = ctx;
+  const txCtx = derivationSource?.createTxContext() ?? null;
+  if (txCtx !== null && derivationSource) {
+    derivationSource.setActiveTxContext(txCtx);
+  }
+  const localExecuted = [];
+  try {
+    for (const [id, record] of entries) {
+      const entry = {
+        op: { type: "put", vaultName: vault, collectionName: name, id },
+        priorEnvelope: priors.get(id) ?? null
+      };
+      if (txCtx !== null) txCtx._executed.push(entry);
+      else localExecuted.push(entry);
+      await host.put(id, record);
+    }
+    return { ok: true, success: entries.map(([id]) => id), failures: [] };
+  } catch (err) {
+    const executedForRevert = txCtx !== null ? txCtx._executed : localExecuted;
+    await bestEffortRevert(executedForRevert.map(toRevertLeg), store);
+    for (const { op } of [...executedForRevert].reverse()) {
+      if (op.vaultName !== vault) continue;
+      try {
+        if (op.collectionName === name) {
+          await host._invalidateCacheEntry(op.id);
+        } else if (derivationSource) {
+          await derivationSource.getCollection(op.collectionName)._invalidateCacheEntry(op.id);
+        }
+      } catch {
+      }
+    }
+    throw err;
+  } finally {
+    if (txCtx !== null && derivationSource) {
+      derivationSource.clearActiveTxContext(txCtx);
+    }
+  }
+}
+
 // src/kernel/via/compose.ts
 function via(...descriptors) {
   if (descriptors.length === 0) {
@@ -2174,7 +2277,7 @@ function resolveCollectionConfig(opts) {
 }
 
 // src/with-formula/computed/lazy.ts
-var loadComputed = lazy(() => import("./computed-AB45PS4V.js"));
+var loadComputed = lazy(() => import("./computed-YOQCGUCS.js"));
 async function loadEvalComputedFields() {
   return (await loadComputed()).evalComputedFields;
 }
@@ -2952,7 +3055,7 @@ var Collection = class {
     }
     await this.onAccess?.("find", "*");
     if (hits.length === 0) return [];
-    const { verifyDigestField } = await import("./verify-7XWHJWUN.js");
+    const { verifyDigestField } = await import("./verify-JEIXSK5U.js");
     const policy = {
       normalize: spec.verifyNormalize ?? "password",
       notLastN: spec.notLastN ?? 0,
@@ -3158,7 +3261,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-T3V7XEOB.js");
+      const { resolveStaleMVOnRead } = await import("./stale-U3WO5MYN.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     let record;
@@ -3688,7 +3791,7 @@ var Collection = class {
    */
   async dispatchMaterializedViews(id, record, wave) {
     if (this.materializedViewSource === void 0) return;
-    const { dispatchMaterializedViews } = await import("./dispatch-6TV3DGO6.js");
+    const { dispatchMaterializedViews } = await import("./dispatch-VNR3TLBX.js");
     return dispatchMaterializedViews(this.#mvDispatchCtx(this.materializedViewSource), id, record, wave);
   }
   /**
@@ -3861,7 +3964,7 @@ var Collection = class {
    *  dispatch wave's per-target dedup; `undefined` on the local-write path (byte-identical). */
   async dispatchDerivations(id, record, version, wave) {
     if (this.derivationSource === void 0) return;
-    const { dispatchDerivations } = await import("./dispatch-W7NWQ637.js");
+    const { dispatchDerivations } = await import("./dispatch-TKV4UCKB.js");
     return dispatchDerivations({
       ...this.#derivationDeleteCtx(this.derivationSource),
       via: this.via,
@@ -4186,7 +4289,7 @@ var Collection = class {
    */
   async dispatchArrayDerivationsOnDelete(id, eraseRecordShapeToo = false) {
     if (this.derivationSource === void 0) return 0;
-    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-W7NWQ637.js");
+    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-TKV4UCKB.js");
     return dispatchArrayDerivationsOnDelete(this.#derivationDeleteCtx(this.derivationSource), id, eraseRecordShapeToo);
   }
   /**
@@ -4200,7 +4303,7 @@ var Collection = class {
    */
   async dispatchMaterializedViewsOnDelete(id) {
     if (this.materializedViewSource === void 0) return { deleted: 0, residueUndecodable: [], residueDeclined: [] };
-    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-6TV3DGO6.js");
+    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-VNR3TLBX.js");
     return dispatchMaterializedViewsOnDelete(this.#mvDispatchCtx(this.materializedViewSource), id);
   }
   /**
@@ -4220,7 +4323,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-T3V7XEOB.js");
+      const { resolveStaleMVOnRead } = await import("./stale-U3WO5MYN.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     await this.ensureHydrated();
@@ -4308,8 +4411,11 @@ var Collection = class {
    * **True tx-atomic putMany** — pass `{ atomic: true }` to switch
    * to the  transaction executor: pre-flight CAS against every
    * item's `expectedVersion`, then commit all ops with best-effort
-   * revert on mid-batch failure. Atomic mode throws on failure rather
-   * than returning a mixed-results object.
+   * revert on mid-batch failure. On a store that declares `txAtomic`
+   * the whole batch is instead submitted as ONE `store.tx()` call with
+   * per-leg CAS (#921) — genuinely all-or-nothing, with history/ledger/
+   * change events firing after the batch is durable. Atomic mode throws
+   * on failure rather than returning a mixed-results object.
    *
    * ## Change events
    *
@@ -4334,66 +4440,20 @@ var Collection = class {
     return { ok: failures.length === 0, success, failures };
   }
   /**
-   * Atomic-mode implementation of {@link putMany}. Pre-flights every
-   * `expectedVersion`, executes all puts in declaration order, and
-   * reverts executed ops via the raw adapter on mid-batch failure.
-   * See `runTransaction` for the shared semantics + crash-window caveat.
+   * Atomic-mode implementation of {@link putMany} — both branches live in
+   * `kernel/put-many-atomic.ts`: #921 delegates the batch through ONE
+   * `store.tx()` on a `txAtomic` store when the single-collection
+   * reduction of the #906 gate admits it (store bits + no duplicate ids +
+   * `_txAtomicSafe('put')`); anything else keeps the sequential pre-flight
+   * → execute → best-effort-revert loop.
    *
    * @internal
    */
-  async putManyAtomic(entries) {
-    const priors = /* @__PURE__ */ new Map();
-    for (const [id, , opts] of entries) {
-      if (!priors.has(id)) {
-        priors.set(id, await this.adapter.get(this.vault, this.name, id));
-      }
-      if (opts?.expectedVersion !== void 0) {
-        const env = priors.get(id) ?? null;
-        const actual = env?._v ?? 0;
-        if (actual !== opts.expectedVersion) {
-          throw new ConflictError(
-            actual,
-            `putMany atomic: ${this.vault}/${this.name}/${id} expected v${opts.expectedVersion}, found v${actual}`
-          );
-        }
-      }
-    }
-    const txCtx = this.derivationSource?.createTxContext() ?? null;
-    if (txCtx !== null && this.derivationSource) {
-      this.derivationSource.setActiveTxContext(txCtx);
-    }
-    const localExecuted = [];
-    try {
-      for (const [id, record] of entries) {
-        const entry = {
-          op: { type: "put", vaultName: this.vault, collectionName: this.name, id },
-          priorEnvelope: priors.get(id) ?? null
-        };
-        if (txCtx !== null) txCtx._executed.push(entry);
-        else localExecuted.push(entry);
-        await this.put(id, record);
-      }
-      return { ok: true, success: entries.map(([id]) => id), failures: [] };
-    } catch (err) {
-      const executedForRevert = txCtx !== null ? txCtx._executed : localExecuted;
-      await revertExecuted(executedForRevert, this.adapter);
-      for (const { op } of [...executedForRevert].reverse()) {
-        if (op.vaultName !== this.vault) continue;
-        try {
-          if (op.collectionName === this.name) {
-            await this._invalidateCacheEntry(op.id);
-          } else if (this.derivationSource) {
-            await this.derivationSource.getCollection(op.collectionName)._invalidateCacheEntry(op.id);
-          }
-        } catch {
-        }
-      }
-      throw err;
-    } finally {
-      if (txCtx !== null && this.derivationSource) {
-        this.derivationSource.clearActiveTxContext(txCtx);
-      }
-    }
+  putManyAtomic(entries) {
+    return runPutManyAtomic(
+      { host: this, store: this.adapter, vault: this.vault, name: this.name, derivationSource: this.derivationSource },
+      entries
+    );
   }
   /**
    * Get many records in one call. Returns a `Map<id, T | null>` —
@@ -5373,14 +5433,14 @@ var Collection = class {
   /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
   async _ensureClassifiedMarker() {
     if (this._markerPersisted || this.vdigFields === null) return;
-    const { persistClassifiedMarkerForFields } = await import("./classified-marker-LE54HWSX.js");
+    const { persistClassifiedMarkerForFields } = await import("./classified-marker-ZALWKOBC.js");
     await persistClassifiedMarkerForFields(this.adapter, this.vault, this.name, this.vdigFields, await this.getDEK(this.name));
     this._markerPersisted = true;
   }
   /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
   async _classifiedMarkerDigestOnly() {
     if (this._markerDigestOnlyCache !== void 0) return this._markerDigestOnlyCache;
-    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-LE54HWSX.js");
+    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-ZALWKOBC.js");
     this._markerDigestOnlyCache = await readClassifiedMarkerDigestOnly(this.adapter, this.vault, this.name, await this.getDEK(this.name));
     return this._markerDigestOnlyCache;
   }
@@ -5479,11 +5539,33 @@ var Collection = class {
     await this.schemaFence?.assertWritable(this.name);
   }
   // @internal #906 — the two refusals `put()`/`delete()` assert BEFORE anything else: the schema-update gate (an opt-in but persistent `reject` decision) and the schema fence (stale generation → MigrationRequiredError; draining/migrating vault or pending per-collection cutover → SchemaFenceError). Neither lives in the prepare halves, and the atomic commit path calls those directly — so it asserts here, per op, mirroring put()/delete() exactly (the fence does a fresh store read per call, so per-op matches today's cost model). Deliberately NOT moved into the prepare halves: that would double-assert on the OCC path.
+  /**
+   * @internal #931 — the after-write OBSERVERS `put()`/`delete()` fire in
+   * their wrappers (user `onAfterWrite` hooks, then the `afterPut`/
+   * `afterDelete` observe bus), replayed for one atomic-path leg after its
+   * finalize. Neither can refuse a completed write, so since #931 they no
+   * longer gate `_txAtomicSafe`; skipping them silently would still be a
+   * policy hole (forget's subject index and the cross-tab write relay are
+   * both wired this way), so the atomic path calls this per leg. The
+   * WriteEvent is built from the prepared carrier — same prior basis the
+   * wrappers use — and the same re-entrancy guards apply (`runAfter`
+   * suppresses nested hook firing; the bus gate checks `dispatching`).
+   */
+  async _fireAtomicAfterWrite(opType, prepared) {
+    const hooksActive = this.#hooksActive();
+    const busPoint = opType === "put" ? "afterPut" : "afterDelete";
+    const busActive = (this.subsystemBus?.hasHandlers(busPoint) ?? false) && !(this.subsystemBus?.dispatching ?? false);
+    if (!hooksActive && !busActive) return;
+    const base = { vault: this.vault, collection: this.name, userId: this.keyring.userId, timestamp: Date.now(), txId: this.#txIdForHook() };
+    const event = opType === "put" ? { ...base, op: prepared.prior ? "update" : "create", docId: prepared.id, before: prepared.prior?.record ?? null, after: prepared.event, baseVersion: prepared.prior?.version ?? 0, version: prepared.version } : { ...base, op: "delete", docId: prepared.id, before: prepared.existing?.record ?? null, after: null, baseVersion: prepared.existing?.version ?? 0, version: (prepared.existing?.version ?? 0) + 1 };
+    if (hooksActive) await this.writeHooks.runAfter(event);
+    if (busActive) await this.subsystemBus.dispatch(busPoint, event);
+  }
   _txAtomicSafe(opType) {
-    if (this.materializedViewSource !== void 0 && this.materializedViewSource.registry().mvsForSource(this.name).length > 0 || this.derivationSource !== void 0 && this.derivationSource.registry().strategiesForSource(this.name).length > 0 || this.crdtMode !== void 0 || this.uniqueConstraints !== null || this.#hooksActive() || (this.subsystemBus?.hasHandlers(opType === "put" ? "afterPut" : "afterDelete") ?? false)) return false;
-    return opType === "put" ? Object.keys(this._refs).length === 0 : this.refEnforcer === void 0;
+    if (this.materializedViewSource !== void 0 && this.materializedViewSource.registry().mvsForSource(this.name).length > 0 || this.derivationSource !== void 0 && this.derivationSource.registry().strategiesForSource(this.name).length > 0 || this.crdtMode !== void 0 || this.uniqueConstraints !== null || this.writeHooks !== void 0 && this.writeHooks.hasBeforeHandlers && !this.writeHooks.suppressed) return false;
+    return opType === "put" ? Object.keys(this._refs).length === 0 : this.refEnforcer === void 0 || !this.refEnforcer._deleteCascadesPossible(this.name);
   }
-  // @internal #893/#906-prep atomic-commit eligibility gate (Task 4) — false on any derivation/MV source (any lifecycle), CRDT mode, unique constraints, or refs on this write direction. Put uses precise outbound `_refs`; delete deliberately uses blanket `refEnforcer` presence, NOT `refRegistry.getInbound()` — `enforceRefsOnDelete` (with-shape/links/vault-facade.ts) cascades from THREE sources (lookup-ref edges, classic inbound refs, managed links), and only the blanket check is >= as strict as all three. #906: also false while user write-hooks or an `afterPut`/`afterDelete` bus handler are live — note both signals are db-GLOBAL (one `onAfterWrite` anywhere, including the auto-registered cross-tab write relay, keeps every collection on the OCC path) — both fire in `put()`/`delete()`, which the atomic path bypasses (a `beforeWrite` hook can REFUSE a write, so silently skipping them would be a policy hole). See atomic-eligibility.ts.
+  // @internal #893/#906-prep atomic-commit eligibility gate (Task 4) — false on any derivation/MV source (any lifecycle), CRDT mode, unique constraints, or refs on this write direction. Put uses precise outbound `_refs`; delete (#922) consults the enforcer's `_deleteCascadesPossible(name)` — Vault unions ALL THREE cascade sources `enforceRefsOnDelete` (with-shape/links/vault-facade.ts) fires from (lookup-ref edges, classic inbound refs, managed links); anything narrower (e.g. `getInbound` alone) would admit unsafe atomic deletes, because `_prepareDelete` runs those cascades DURING prepare. #931 narrows #906's hooks blanket: only BEFORE-hooks gate (they can REFUSE a write, which only `put()`/`delete()` honors); after-hooks and the `afterPut`/`afterDelete` observe bus cannot refuse, so the atomic path fires them itself post-finalize via `_fireAtomicAfterWrite` instead of forfeiting the batch (the pre-#931 db-global blanket cost multi-tab write-relay and forget-subject apps the atomic path entirely). See atomic-eligibility.ts.
   _reconcileReadState(patch) {
     if (patch.dictKeyFields) this.dictKeyFields = { ...patch.dictKeyFields, ...this.dictKeyFields };
     if (patch.i18nFields) this.i18nFields = { ...patch.i18nFields, ...this.i18nFields };
@@ -5889,7 +5971,7 @@ var DeferredNumberingStore = class {
     try {
       await this.writeJson(NUMBERING_HEAD_COLLECTION, series, { series, lastSerial: serial, watermark: now.earliest }, headEnv?._v ?? 0);
     } catch (err) {
-      if (err instanceof ConflictError) return [];
+      if (isConflictError(err)) return [];
       throw err;
     }
     for (const { id, entry } of settled) {
@@ -6833,7 +6915,7 @@ var VaultLinks = class {
 // src/with-shape/links/lazy-handle.ts
 function makeLazyLinkSetHandle(d) {
   let engine = null;
-  const load = () => engine ??= import("./link-set-CGYC3OH5.js").then(
+  const load = () => engine ??= import("./link-set-7F5ZPDEB.js").then(
     ({ LinkSet }) => new LinkSet(d.adapter, d.vault, d.name, d.spec, d.encrypted, d.getDEK, d.actor, d.emitter, d.endpointExists)
   );
   return {
@@ -7371,7 +7453,7 @@ function declareSatellite(ctx, collectionName, options, existingRegistry) {
   ctx.forEachSyncEngine((e) => e.remirrorPairResolvers([spec.base, spec.satellite]));
   const registry = reg;
   const baseSchema = ctx.getBaseSchema(spec.base);
-  void import("./post-register-LY35EDTJ.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
+  void import("./post-register-PQSY544J.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
   });
   return reg;
 }
@@ -8327,7 +8409,7 @@ var Vault = class {
         const strategies = options.schemaUpdate ?? [];
         const work = (async () => {
           const dek = await this.getDEK(collectionName);
-          const { persistSchemaIfNeeded } = await import("./register-6RIBIT3I.js");
+          const { persistSchemaIfNeeded } = await import("./register-S3ECUZPV.js");
           const result = await persistSchemaIfNeeded({
             store: this.adapter,
             vault: this.name,
@@ -8476,7 +8558,7 @@ var Vault = class {
         const work = (async () => {
           try {
             const dek = await this.getDEK(collectionName);
-            await (await import("./register-6RIBIT3I.js")).persistSchemaIfNeeded({
+            await (await import("./register-S3ECUZPV.js")).persistSchemaIfNeeded({
               store: this.adapter,
               vault: this.name,
               collectionName,
@@ -9230,6 +9312,27 @@ var Vault = class {
   async enforceRefsOnDelete(collectionName, id) {
     return this.linksEnforcer.enforceRefsOnDelete(this.graph, collectionName, id);
   }
+  /**
+   * #922 — can a delete on `collectionName` trigger ANY cross-record work in
+   * `enforceRefsOnDelete` above? Unions ALL THREE of its cascade sources —
+   * lookup-ref edges (`graph.referencingEdgesOf`), classic inbound refs
+   * (`refRegistry.getInbound`), and managed link sets whose either endpoint
+   * is this collection. `Collection._txAtomicSafe('delete')` consults this
+   * instead of the pre-#922 blanket enforcer-presence check: `_prepareDelete`
+   * runs those cascades DURING prepare (not abortable), so a delete may take
+   * the atomic tx path only when all three sources are provably absent.
+   * Registry state only — no store reads, safe to call at commit time.
+   *
+   * @internal
+   */
+  _deleteCascadesPossible(collectionName) {
+    if (this.graph.referencingEdgesOf(collectionName).length > 0) return true;
+    if (this.refRegistry.getInbound(collectionName).length > 0) return true;
+    for (const spec of this.linkRegistry.values()) {
+      if (spec.a === collectionName || spec.b === collectionName) return true;
+    }
+    return false;
+  }
   // ─── Join resolver) ────────────────────
   /**
    * Look up the `RefDescriptor` the left collection declared for a
@@ -9663,7 +9766,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-RON4WHAP.js"),
+      import("./registry-FZOHKUME.js"),
       import("./read-only-facade-CHCKSEPD.js")
     ]);
     const registry = new DerivationRegistry();
@@ -9695,7 +9798,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-MUSL4AW6.js");
+    const { MaterializedViewRegistry } = await import("./registry-RISV7IDZ.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -9720,7 +9823,7 @@ var Vault = class {
    */
   async _initOverlayedViews(handles) {
     if (handles.length === 0) return;
-    const { OverlayedViewRegistry } = await import("./registry-7Y5WF7GS.js");
+    const { OverlayedViewRegistry } = await import("./registry-ZE35A7WC.js");
     const registry = new OverlayedViewRegistry();
     const mvRegistry = this.materializedViewRegistry;
     const overlayNames = /* @__PURE__ */ new Set();
@@ -9767,14 +9870,14 @@ var Vault = class {
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-FPHKWDWT.js");
+    const { MaterializedViewExecutor } = await import("./executor-M4ZZNX6S.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this,
       dispatchCtx: this._dispatchCtx({ collection: name, id: "refreshView" })
     });
-    const { clearMVStaleFully } = await import("./stale-T3V7XEOB.js");
+    const { clearMVStaleFully } = await import("./stale-U3WO5MYN.js");
     await clearMVStaleFully(this.adapter, this.name, registry, name);
     return result;
   }
@@ -9787,7 +9890,7 @@ var Vault = class {
     if (registry === null) return { derived: 0, failed: 0, skippedFrozen: 0 };
     const strategies = registry.strategiesForSource(sourceCollection);
     if (strategies.length === 0) return { derived: 0, failed: 0, skippedFrozen: 0 };
-    const { DerivationExecutor } = await import("./executor-IEBLTBCW.js");
+    const { DerivationExecutor } = await import("./executor-TI64S4LE.js");
     const sourceColl = this.collection(sourceCollection);
     const records = await sourceColl.list();
     const ctx = { vault: this.derivationFacade ?? new (await import("./read-only-facade-CHCKSEPD.js")).ReadOnlyVaultFacade(this, "derivation") };
@@ -9814,7 +9917,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-273RDMYS.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-WYXO6QQT.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key, this.getDEK, this.encrypted);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -10041,7 +10144,7 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-JDUMAF6L.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-WMO3Q3O5.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
         "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (secret) first."
@@ -10063,7 +10166,7 @@ var Vault = class {
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-JDUMAF6L.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-WMO3Q3O5.js");
     await revokeDelegation(this.adapter, this.name, id);
     void DELEGATIONS_COLLECTION;
   }
@@ -10311,7 +10414,7 @@ var Vault = class {
    * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
    */
   async dumpSchema(opts = {}) {
-    const { dumpVaultSchema } = await import("./walk-G3NFEP5L.js");
+    const { dumpVaultSchema } = await import("./walk-BF36V4SR.js");
     return dumpVaultSchema(this, opts);
   }
   /**
@@ -10461,7 +10564,7 @@ var Vault = class {
    * both modes round-trip cleanly.
    */
   async dump() {
-    const { dumpVault } = await import("./backup-X7F3TCFV.js");
+    const { dumpVault } = await import("./backup-ENTZYW37.js");
     return dumpVault(this.backupContext());
   }
   /**
@@ -10513,7 +10616,7 @@ var Vault = class {
    * — there's no chain to verify against.
    */
   async load(backupJson) {
-    const { loadVault } = await import("./backup-X7F3TCFV.js");
+    const { loadVault } = await import("./backup-ENTZYW37.js");
     return loadVault(this.backupContext(), backupJson);
   }
   /**
@@ -10545,7 +10648,7 @@ var Vault = class {
    * way to detect tampering of an in-place vault.
    */
   async verifyBackupIntegrity() {
-    const { verifyBackupIntegrity } = await import("./backup-X7F3TCFV.js");
+    const { verifyBackupIntegrity } = await import("./backup-ENTZYW37.js");
     return verifyBackupIntegrity(this.backupContext());
   }
   /**
@@ -10763,7 +10866,7 @@ var Vault = class {
    * is the live validator object, not a serialization of it).
    */
   async exportJSON(opts = {}) {
-    const { exportVaultJSON } = await import("./backup-X7F3TCFV.js");
+    const { exportVaultJSON } = await import("./backup-ENTZYW37.js");
     return exportVaultJSON(this.backupContext(), opts);
   }
 };
@@ -10879,6 +10982,14 @@ var WriteHookRegistry = class {
   get hasHandlers() {
     return this.#before.length > 0 || this.#after.length > 0;
   }
+  /**
+   * True when any BEFORE hook is registered — the refusal-capable kind. #931:
+   * the atomic-commit eligibility gate keys on this alone; after-hooks are
+   * observers and fire post-finalize on the atomic path instead of gating it.
+   */
+  get hasBeforeHandlers() {
+    return this.#before.length > 0;
+  }
   onBeforeWrite(handler) {
     this.#before.push(handler);
     return () => {
@@ -12652,7 +12763,7 @@ var Noydb = class {
       if (!facade) return;
       const ctx = { existing, vault: facade, userId: e.userId, role: e.role };
       await registry.runChecks(e.collection, incoming, ctx);
-      const { GuardExecutor } = await import("./executor-RM7XWQDU.js");
+      const { GuardExecutor } = await import("./executor-YBK3I2OT.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, e.docId, existing, incoming, e.computedFieldNames);
       }
@@ -13990,7 +14101,7 @@ async function createNoydb(options) {
     throw new ValidationError("A secret (secret) or getKeyring callback is required when encryption is enabled");
   }
   if (!options.coordinationStrategy) options = { ...options, coordinationStrategy: await createDefaultCoordinationProvider(options.store) };
-  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-SI2IVBQO.js")).createUserApi };
+  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-M7REIE7H.js")).createUserApi };
   if (!options.policyFactory) {
     const policyModule = await import("./policy/index.js");
     options = { ...options, policyFactory: policyModule.createNoydbPolicy, policyCheckGateFn: policyModule.checkGate };
@@ -14025,4 +14136,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-ZBYFMI6D.js.map
+//# sourceMappingURL=chunk-5UKUOMO6.js.map