@noy-db/hub 0.6.0-pre.9 → 0.7.0-pre.0

package/dist/{chunk-2GAJGUNM.js → chunk-Y3YLJORD.js}

@@ -1,10 +1,6 @@
-import {
-  hashFields,
-  validateSatelliteDeclaration
-} from "./chunk-HVQGCKY4.js";
 import {
   resolveStaleOnRead
-} from "./chunk-4HDYQL3J.js";
+} from "./chunk-VAG47QHV.js";
 import {
   isManifestReservedCollection
 } from "./chunk-EPFF7LOX.js";
@@ -14,43 +10,52 @@ import {
   isLinkCollectionName,
   linkCollectionName,
   linkRowKey
-} from "./chunk-HNHCQ556.js";
+} from "./chunk-WLLUM35R.js";
 import {
-  isBaseLive,
-  liveBaseIdSet
-} from "./chunk-GYGLAVCX.js";
+  hashFields,
+  validateSatelliteDeclaration
+} from "./chunk-JVLSU7S2.js";
 import {
   loadFence
-} from "./chunk-6BU3L4UE.js";
+} from "./chunk-Y6GZ2P4M.js";
 import {
   VectorSet,
   buildPersistedIndexCallbacks,
   encodeVecId,
   syncTierSearch
-} from "./chunk-G6S5VVHP.js";
+} from "./chunk-L6GTLZRK.js";
+import {
+  isBaseLive,
+  liveBaseIdSet
+} from "./chunk-GYGLAVCX.js";
 import {
   SchemaUpdateGate
 } from "./chunk-6LJY7X5A.js";
+import {
+  NO_ATTESTATION
+} from "./chunk-E6YA6UAP.js";
 import {
   NO_CLASSIFIED,
   guardClassifiedCompat,
   resolveClassifiedFields
-} from "./chunk-QULVCV3M.js";
+} from "./chunk-GK4DRVUD.js";
 import {
   NO_TIERS,
   classifySealedShred,
   syncDerivedOutputs
-} from "./chunk-6NVPFKN3.js";
+} from "./chunk-WK5FSW7T.js";
 import {
   NO_PORTABILITY
-} from "./chunk-FUHKW252.js";
+} from "./chunk-J4MN6XIU.js";
 import {
-  NO_CARGO,
-  runDrainBarrier
-} from "./chunk-DG27IUVI.js";
+  NO_CARGO
+} from "./chunk-XJ3FEKEY.js";
 import {
   saveSealedSecret
-} from "./chunk-XWX7GL56.js";
+} from "./chunk-Z2WK53N6.js";
+import {
+  runDrainBarrier
+} from "./chunk-CBRS2NEK.js";
 import {
   fallbackDerivationName,
   jsonSchemaToFields
@@ -58,18 +63,24 @@ import {
 import {
   derivePersistedSchema,
   isZod4Schema
-} from "./chunk-Z45YRGFO.js";
+} from "./chunk-P6ASQOZR.js";
 import {
   loadPersistedSchema
-} from "./chunk-CDB2HVQW.js";
+} from "./chunk-YXA2TCTZ.js";
+import {
+  NO_SEQUENCE,
+  SEQUENCE_COLLECTION,
+  compileSequenceFormat,
+  resolveSequenceKey
+} from "./chunk-CN6B5PEN.js";
 import {
   CustodyApi,
   NO_CUSTODY
-} from "./chunk-ADW22QSB.js";
+} from "./chunk-J4UJ5FRV.js";
 import {
   DEFAULT_POSTURE,
   ViaGraph
-} from "./chunk-7TSYBD3E.js";
+} from "./chunk-5263OEM3.js";
 import {
   buildLookupAltIndex,
   buildLookupSnapshotRows,
@@ -93,17 +104,14 @@ import {
   selfWriteFieldEqual,
   touchFor,
   updateReferencingRecords
-} from "./chunk-5ZKS6ZE2.js";
+} from "./chunk-VTG7327U.js";
 import {
   OverlayedCollection
-} from "./chunk-OF3L2SD6.js";
+} from "./chunk-3QARDAYW.js";
 import {
   INDEXED_STORE_POLICY,
   NO_SYNC
-} from "./chunk-55LKVALY.js";
-import {
-  NO_ATTESTATION
-} from "./chunk-VJFMXYKP.js";
+} from "./chunk-T7IR4N2S.js";
 import {
   NO_CONSENT
 } from "./chunk-PEOZ34EM.js";
@@ -114,7 +122,7 @@ import {
   resolvePeriodKey,
   resolveReopenState,
   samePartition
-} from "./chunk-5O5HRRTV.js";
+} from "./chunk-PCQDY6QN.js";
 import {
   PERIODS_COLLECTION,
   PERIOD_ARCHIVES_COLLECTION,
@@ -122,7 +130,7 @@ import {
   PERIOD_REOPENS_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION,
   periodExclusiveUpperBound
-} from "./chunk-HPLWFNG4.js";
+} from "./chunk-Z7ZXZL6Y.js";
 import {
   NO_SHADOW
 } from "./chunk-SMY5X46Z.js";
@@ -132,7 +140,7 @@ import {
 import {
   TxContext,
   bestEffortRevert
-} from "./chunk-35EBKWQU.js";
+} from "./chunk-VFIWDPXZ.js";
 import {
   lazy
 } from "./chunk-5D2ALSM5.js";
@@ -140,32 +148,29 @@ import {
   InvertedIndex,
   MemoryIndexStore,
   NO_SEARCH
-} from "./chunk-3JVXVJ7L.js";
+} from "./chunk-S35S77YU.js";
 import {
-  NO_SEQUENCE,
-  SEQUENCE_COLLECTION,
-  compileSequenceFormat,
-  resolveSequenceKey
-} from "./chunk-7MNBICB5.js";
+  NO_SEALED_RECORD
+} from "./chunk-UCUALOSM.js";
 import {
   Query,
   ScanBuilder
-} from "./chunk-3737A6EA.js";
+} from "./chunk-S2VG3ABP.js";
 import {
   EXPORT_AUDIT_COLLECTION,
   NO_BLOBS,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-WASHZV34.js";
+} from "./chunk-F23WQK3G.js";
 import {
   LazyQuery,
   NO_INDEXING,
   decodeIdxId,
   encodeIdxId
-} from "./chunk-JIUVJ4M7.js";
+} from "./chunk-F7ZFRPGQ.js";
 import {
   normalizeIndexDefs
-} from "./chunk-GQ3BX5EA.js";
+} from "./chunk-I3ISCYT7.js";
 import {
   IMPLICIT_LAZY,
   Lru,
@@ -179,13 +184,13 @@ import {
 } from "./chunk-YMUFFJCO.js";
 import {
   readPath
-} from "./chunk-IGJCYUT5.js";
+} from "./chunk-NSITFOCJ.js";
 import {
   NO_CRDT
 } from "./chunk-PVEWA2DU.js";
 import {
   dictCollectionName
-} from "./chunk-WFUIE565.js";
+} from "./chunk-57JTHWLQ.js";
 import {
   NO_I18N,
   getAtPath,
@@ -193,11 +198,11 @@ import {
   isDictKeyDescriptor,
   isI18nTextDescriptor,
   isStaticDictDescriptor
-} from "./chunk-7G6VDWXB.js";
+} from "./chunk-X67FCULK.js";
 import {
   isViaInstalled,
   viaBinder
-} from "./chunk-UHXCLPGC.js";
+} from "./chunk-XDVVBETV.js";
 import {
   NO_TEAM,
   describeAllUsersAuth,
@@ -220,7 +225,7 @@ import {
   saveShamirRecoveryEntries,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-O2ERS4UJ.js";
+} from "./chunk-H4M7ADXY.js";
 import {
   assertKeyringOpenAllowed,
   buildRecipientKeyringFile,
@@ -235,32 +240,36 @@ import {
   listUsers,
   loadKeyring,
   updateKeyringIdentity
-} from "./chunk-JRKZTEZZ.js";
+} from "./chunk-5W7YXFV5.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
-} from "./chunk-5JY5TSVY.js";
+} from "./chunk-DFAUMLD7.js";
 import {
   NO_BROKER,
   buildCredentialBrokerHandle
-} from "./chunk-W3TVWF6N.js";
+} from "./chunk-4A4TYISP.js";
 import {
   NO_SESSION
 } from "./chunk-VKQCVU2Z.js";
 import {
   generateULID
-} from "./chunk-ZJADGNYF.js";
+} from "./chunk-4AOERLTV.js";
 import {
   NO_HISTORY
-} from "./chunk-AFHQATY4.js";
+} from "./chunk-6EW2UCVF.js";
+import {
+  sha256Hex
+} from "./chunk-RC4BROYR.js";
 import {
   assertCutoverTierSafe,
   assertTierWritable,
+  dekKey,
   liveRecordIsElevated
-} from "./chunk-3FSX6LDG.js";
+} from "./chunk-POS53FG6.js";
 import {
-  sha256Hex
-} from "./chunk-6SAFL5YE.js";
+  NO_VAULT_HEAD
+} from "./chunk-HK67PX4J.js";
 import {
   NO_FORGET,
   addSubjectRef,
@@ -269,34 +278,36 @@ import {
   readDottedPath,
   rebuildSubjectIndex,
   removeSubjectRef
-} from "./chunk-WLZ47GSL.js";
-import {
-  NO_SEALED_RECORD
-} from "./chunk-FAXZQ5UF.js";
+} from "./chunk-467SKJ65.js";
 import {
   RecordCodec,
   SEALED_CEK_NS,
+  applyRewrappedBody,
+  buildRecordAad,
   findByDet,
   hasPerRecordKey,
+  hasSealedBody,
   makeReservedEnvelopes,
   openEnvelopeJson,
   queryByDet,
   resolveStableCek,
-  validateSchemaInput
-} from "./chunk-3URQC7EH.js";
+  rewrapBodyToDek,
+  validateSchemaInput,
+  verifyRecordIdentity
+} from "./chunk-2LPVI4PX.js";
 import {
   buildDeleteMarker,
+  buildRecordEnvelope,
   buildTombstone,
   isDeleteMarker,
   isTombstone
-} from "./chunk-7H73RIE3.js";
+} from "./chunk-N4CNVSUF.js";
 import {
   encrypt
-} from "./chunk-VCETL77O.js";
+} from "./chunk-W5LHQXZU.js";
 import {
-  NOYDB_FORMAT_VERSION,
   SealedHandle
-} from "./chunk-YPYHVOXP.js";
+} from "./chunk-RK7N4OQ5.js";
 import {
   AlreadyElevatedError,
   AttestationError,
@@ -339,7 +350,55 @@ import {
   UnsupportedTierCompositionError,
   ValidationError,
   isConflictError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-JBIV4FLR.js";
+
+// src/kernel/merge-authority.ts
+function buildMergeAuthority(keyring) {
+  return {
+    verify: async (collection, id, envelope) => {
+      const dek = keyring.deks.get(dekKey(collection, envelope._tier ?? 0));
+      if (dek === void 0) return true;
+      return verifyRecordIdentity({ collection, id }, envelope, dek);
+    },
+    advance: async (collection, id, envelope, toVersion) => {
+      if (!hasSealedBody(envelope)) return { ...envelope, _v: toVersion };
+      const dek = keyring.deks.get(dekKey(collection, envelope._tier ?? 0));
+      if (dek === void 0) {
+        throw new ValidationError(
+          `sync: cannot advance "${collection}/${id}" past the remote \u2014 no key for it, so its body cannot be re-sealed at the new version. The local copy is unchanged.`
+        );
+      }
+      const from = {
+        collection,
+        id,
+        version: envelope._v,
+        ...envelope._tier !== void 0 ? { tier: envelope._tier } : {},
+        ...envelope._by !== void 0 ? { by: envelope._by } : {}
+      };
+      const body = await rewrapBodyToDek(from, { ...from, version: toVersion }, envelope, dek, dek);
+      return { ...applyRewrappedBody(envelope, body), _v: toVersion };
+    }
+  };
+}
+
+// src/port/with/formats-strategy.ts
+var FormatsNotEnabledError = class extends Error {
+  constructor(op) {
+    super(
+      `vault.${op}() requires the formats service. Import { withFormats } from "@noy-db/hub/as" and pass formatsStrategy: withFormats() to createNoydb().`
+    );
+    this.name = "FormatsNotEnabledError";
+  }
+};
+var NO_FORMATS = {
+  enabled: false,
+  exportWith() {
+    throw new FormatsNotEnabledError("export");
+  },
+  importWith() {
+    throw new FormatsNotEnabledError("import");
+  }
+};
 
 // src/with-commit/tx/strategy.ts
 var NOT_ENABLED = new Error(
@@ -364,6 +423,7 @@ var NO_ARCHIVE = {
 
 // src/port/with/strategies.ts
 var STRATEGY_DEFAULTS = {
+  formats: NO_FORMATS,
   reduce: NO_REDUCE,
   archive: NO_ARCHIVE,
   attestation: NO_ATTESTATION,
@@ -376,6 +436,7 @@ var STRATEGY_DEFAULTS = {
   custody: NO_CUSTODY,
   forget: NO_FORGET,
   history: NO_HISTORY,
+  vaultHead: NO_VAULT_HEAD,
   i18n: NO_I18N,
   indexing: NO_INDEXING,
   lazy: IMPLICIT_LAZY,
@@ -424,7 +485,7 @@ function validateSecretModeOptions(options) {
     }
     if (!options.sealingKey) {
       throw new ValidationError(
-        '`secretMode: "managed"` requires `sealingKey: SealingKeyProvider` (see @noy-db/seal-macos-keychain / @noy-db/seal-aws-kms / etc.).'
+        '`secretMode: "managed"` requires `sealingKey: NoydbSealer` (see @noy-db/seal-macos-keychain / @noy-db/seal-aws-kms / etc.).'
       );
     }
   }
@@ -469,7 +530,7 @@ function validateSecretModeOptions(options) {
 }
 async function resolveEffectiveSecret(options, store, vault) {
   if (options.secretMode === "managed") {
-    const { resolveManagedSecret } = await import("./managed-secret-CWQ6PND5.js");
+    const { resolveManagedSecret } = await import("./managed-secret-6YC32VXG.js");
     return resolveManagedSecret(store, vault, options.sealingKey);
   }
   return options.secret;
@@ -486,9 +547,9 @@ function ownerKeyringOptions(options, secret) {
 }
 
 // src/port/by/default-provider.ts
-async function createDefaultCoordinationProvider(store) {
-  const { StoreCoordinationProvider } = await import("./store-coordination-provider-GFCUOBR6.js");
-  return new StoreCoordinationProvider(store);
+async function createDefaultMesh(store) {
+  const { StoreMesh } = await import("./store-coordination-provider-6FM26VQM.js");
+  return new StoreMesh(store);
 }
 
 // src/port/with/collection-registries.ts
@@ -547,11 +608,11 @@ var ViaPipeline = class _ViaPipeline {
   constructor(bindings, taint) {
     this.bindings = bindings;
     this.taint = taint;
-    const moneyBindings = bindings.filter((b) => b.brand === "money");
-    const computedBindings = bindings.filter((b) => b.brand === "computed");
+    const moneyVias = bindings.filter((b) => b.brand === "money");
+    const computedVias = bindings.filter((b) => b.brand === "computed");
     const restBindings = bindings.filter((b) => b.brand !== "money" && b.brand !== "computed");
-    this._presentOrder = [...moneyBindings, ...computedBindings, ...restBindings];
-    this._presentLateBoundary = moneyBindings.length + computedBindings.length;
+    this._presentOrder = [...moneyVias, ...computedVias, ...restBindings];
+    this._presentLateBoundary = moneyVias.length + computedVias.length;
   }
   bindings;
   taint;
@@ -563,7 +624,7 @@ var ViaPipeline = class _ViaPipeline {
    * everything else (existing relative order). `present()` folds over this
    * instead of `bindings` so a `mode: 'virtual'` computed field's value
    * exists before i18n/lookup's dressing `present()` hooks run on it
-   * (today's `compileViaBindings` order is money→i18n→lookup→classified→
+   * (today's `compileVias` order is money→i18n→lookup→classified→
    * blob→computed, `collection-config.ts:554`, so dressing unconditionally
    * ran BEFORE the value it dresses existed). This reorder is binding-level,
    * not conditioned on any particular field composition — it applies to
@@ -602,7 +663,7 @@ var ViaPipeline = class _ViaPipeline {
    * Money-dressing a virtual computed field's OWN output (the composed
    * `computed(virtual) + money` case) is NOT resolved by this partition
    * alone — #669 resolves it with a separate mid-fold hook instead:
-   * `ViaBinding.presentLate` runs after every binding's `present()` in this
+   * `NoydbVia.presentLate` runs after every binding's `present()` in this
    * money+computed segment, before the "everything else" segment below, so
    * money can quantize/reinterpret a virtual field's fresh MAJOR-UNITS
    * output as if it were a stored value, without perturbing this ordering
@@ -611,7 +672,7 @@ var ViaPipeline = class _ViaPipeline {
    */
   _presentOrder;
   /** #669 — index into `_presentOrder` where the money+computed segment ends and the
-   *  "everything else" segment begins (`moneyBindings.length + computedBindings.length`);
+   *  "everything else" segment begins (`moneyVias.length + computedVias.length`);
    *  `present()` runs every binding's `presentLate` at exactly this boundary. */
   _presentLateBoundary;
   /** undefined when there is nothing to enforce — the zero-via fast path is
@@ -942,13 +1003,13 @@ async function applyCutoverTransform(ctx) {
   for (const id of ids) {
     const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
     if (!env || isTombstone(env, ctx.storeCiphertext) || isDeleteMarker(env)) continue;
-    const decoded = await ctx.codec.decryptRecord(env, { skipValidation: true, id });
+    const decoded = await ctx.codec.decryptRecord({ collection: ctx.name, id }, env, { skipValidation: true });
     if (decoded === null) continue;
     const record = decoded;
     const next = ctx.transform(record);
     const nextVersion = (env._v ?? 0) + 1;
     const cek = ctx.perRecordCek ? await ctx.resolveRecordCek(id) : void 0;
-    const migEnvelope = await ctx.codec.encryptRecord(next, nextVersion, cek, void 0, void 0, ctx.vdigFields !== null ? { id, prev: env } : void 0, id);
+    const migEnvelope = await ctx.codec.encryptRecord({ collection: ctx.name, id }, next, nextVersion, cek, void 0, void 0, ctx.vdigFields !== null ? { id, prev: env } : void 0);
     await ctx.adapter.put(ctx.vault, ctx.name, id, migEnvelope);
     await ctx.onRecordMutated(id, "put", "cutover");
     if (ctx.ledger) {
@@ -1054,7 +1115,7 @@ async function rebuildIndexes(ctx) {
     const envelope = await ctx.adapter.get(ctx.vault, ctx.name, recordId);
     if (!envelope) continue;
     if ((envelope._tier ?? 0) > 0) continue;
-    const record = await ctx.codec.decryptRecord(envelope, { skipValidation: true, id: recordId });
+    const record = await ctx.codec.decryptRecord({ collection: ctx.name, id: recordId }, envelope, { skipValidation: true });
     if (record === null) continue;
     await maintainPersistedIndexesOnPut(ctx, recordId, record, null, envelope._v);
   }
@@ -1088,7 +1149,7 @@ async function reconcileIndex(ctx, field, opts = {}) {
     const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
     if (!env) continue;
     try {
-      const sidecarJson = await ctx.codec.decryptJsonString(env);
+      const sidecarJson = await ctx.codec.decryptJsonString({ collection: ctx.name, id }, env);
       if (sidecarJson === null) {
         sidecar.set(decoded.recordId, void 0);
       } else {
@@ -1108,7 +1169,7 @@ async function reconcileIndex(ctx, field, opts = {}) {
     const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
     if (!env) continue;
     if ((env._tier ?? 0) > 0) continue;
-    const record = await ctx.codec.decryptRecord(env, { skipValidation: true, id });
+    const record = await ctx.codec.decryptRecord({ collection: ctx.name, id }, env, { skipValidation: true });
     if (record === null) continue;
     const live = readPersistedValue(record, field);
     const stored = sidecar.get(id);
@@ -1169,7 +1230,7 @@ async function maintainPersistedIndexesOnPut(ctx, id, newRecord, previousRecord,
           recordId: id,
           writtenAt: (/* @__PURE__ */ new Date()).toISOString()
         });
-        const envelope = await ctx.codec.encryptJsonString(body, version);
+        const envelope = await ctx.codec.encryptJsonString({ collection: ctx.name, id: idxId }, body, version);
         await ctx.adapter.put(ctx.vault, ctx.name, idxId, envelope);
       }
     } catch (cause) {
@@ -1238,7 +1299,7 @@ async function resolveTierSyncPrior(ctx, id, priorEnvelope) {
   const cached = ctx.cache.get(id)?.record;
   if (cached !== void 0) return cached;
   if (!ctx.lazy || !priorEnvelope || (priorEnvelope._tier ?? 0) > 0) return null;
-  return await ctx.codec.decryptRecord(priorEnvelope, { skipValidation: true, id });
+  return await ctx.codec.decryptRecord({ collection: ctx.name, id }, priorEnvelope, { skipValidation: true });
 }
 
 // src/with-lookup/search/serialize.ts
@@ -2033,7 +2094,7 @@ var VIA_FIELD_MAP_FAMILY = {
   blobFields: "blob",
   computed: "computed"
 };
-function guardCrossBindingFieldCollisions(fieldMaps, callerPrefix = "compileViaBindings()") {
+function guardCrossBindingFieldCollisions(fieldMaps, callerPrefix = "compileVias()") {
   const claimantsByField = /* @__PURE__ */ new Map();
   for (const [sourceKey, map] of Object.entries(fieldMaps)) {
     for (const field of Object.keys(map ?? {})) {
@@ -2087,7 +2148,7 @@ function computedEntryParts(entry) {
 function unifyComputedFields(opts, viaComputedFields) {
   return { ...opts.computed ?? {}, ...viaComputedFields ?? {} };
 }
-function compileViaBindings(opts, classifiedGuardCtx, eraseCfgOut) {
+function compileVias(opts, classifiedGuardCtx, eraseCfgOut) {
   const { moneyFields, i18nFields, dictKeyFields, computedFields, lookupFields } = mergeViaFields(opts);
   const allComputedFields = unifyComputedFields(opts, computedFields);
   guardCrossBindingFieldCollisions({
@@ -2210,7 +2271,7 @@ function resolveComputedEdges(collectionName, computed, hasClassifiedFields, kno
   }
   return edges;
 }
-function resolveViaBindingDepsEdges(collectionName, bindings, knownFields) {
+function resolveViaDepsEdges(collectionName, bindings, knownFields) {
   const edges = [];
   for (const binding of bindings) {
     if (!binding.deps || binding.deps.length === 0) continue;
@@ -2330,7 +2391,7 @@ function resolveCollectionConfig(opts) {
   const perRecordCek = opts.perRecordKeys === true;
   const cekCache = perRecordCek ? new Lru({ maxRecords: 4096 }) : null;
   const viaEraseCfgOut = {};
-  const via2 = ViaPipeline.build(compileViaBindings(opts, classifiedGuardCtx, viaEraseCfgOut));
+  const via2 = ViaPipeline.build(compileVias(opts, classifiedGuardCtx, viaEraseCfgOut));
   const knownFields = collectKnownFieldNames({
     moneyFields: effectiveViaFields.moneyFields,
     i18nFields: effectiveViaFields.i18nFields,
@@ -2340,7 +2401,7 @@ function resolveCollectionConfig(opts) {
     lookupFields: effectiveViaFields.lookupFields
   });
   const computedEdges = resolveComputedEdges(opts.name, allComputed, resolvedClassified !== void 0, knownFields);
-  const viaDepsEdges = resolveViaBindingDepsEdges(opts.name, via2?.bindings ?? [], knownFields);
+  const viaDepsEdges = resolveViaDepsEdges(opts.name, via2?.bindings ?? [], knownFields);
   return {
     adapter: opts.adapter,
     vault: opts.vault,
@@ -2421,7 +2482,7 @@ function resolveCollectionConfig(opts) {
 }
 
 // src/with-formula/computed/lazy.ts
-var loadComputed = lazy(() => import("./computed-6G5M3UPH.js"));
+var loadComputed = lazy(() => import("./computed-ASBNTLOK.js"));
 async function loadEvalComputedFields() {
   return (await loadComputed()).evalComputedFields;
 }
@@ -2607,7 +2668,8 @@ var Collection = class {
   fieldMeta;
   /** Collection-level descriptive metadata declared via `meta`; read by `getMeta()`, surfaced in `describe()`. */
   meta;
-  /** Outbound ref declarations (snapshot from vault refRegistry at construction time); used by `describe()`. */
+  /** Outbound ref declarations (snapshot from the vault refRegistry); read by `describe()` and
+   *  {@link _txAtomicSafe}. Mutable for {@link _attachDeclaredRefs} (#1141). */
   _refs;
   /** Money field descriptors keyed by field path, typed as the opaque {@link ViaDescriptor} marker
    *  (the kernel never inspects the concrete shape); `put()` quantizes to a scaled-int string,
@@ -2877,14 +2939,14 @@ var Collection = class {
         if (crdtMode === "yjs") {
           return local._v >= remote._v ? local : remote;
         }
-        const localJson = await this.codec.decryptJsonString(local, id);
-        const remoteJson = await this.codec.decryptJsonString(remote, id);
+        const localJson = await this.codec.decryptJsonString({ collection: this.name, id }, local);
+        const remoteJson = await this.codec.decryptJsonString({ collection: this.name, id }, remote);
         if (localJson === null) return local;
         if (remoteJson === null) return remote;
         const merged = this.strategies.crdt.mergeCrdtStates(JSON.parse(localJson), JSON.parse(remoteJson));
         const mergedVersion = Math.max(local._v, remote._v) + 1;
         const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
-        return this.codec.encryptJsonString(JSON.stringify(merged), mergedVersion, cek);
+        return this.codec.encryptJsonString({ collection: this.name, id }, JSON.stringify(merged), mergedVersion, cek);
       };
       opts.onRegisterConflictResolver(this.name, crdtResolver);
     }
@@ -2925,14 +2987,14 @@ var Collection = class {
       } else {
         const mergeFn = policy;
         resolver = async (id, local, remote) => {
-          const localRecord = await this.codec.decryptRecord(local, { skipValidation: true, id });
-          const remoteRecord = await this.codec.decryptRecord(remote, { skipValidation: true, id });
+          const localRecord = await this.codec.decryptRecord({ collection: this.name, id }, local, { skipValidation: true });
+          const remoteRecord = await this.codec.decryptRecord({ collection: this.name, id }, remote, { skipValidation: true });
           if (localRecord === null) return local;
           if (remoteRecord === null) return remote;
           const merged = mergeFn(localRecord, remoteRecord);
           const mergedVersion = Math.max(local._v, remote._v) + 1;
           const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
-          return this.codec.encryptRecord(merged, mergedVersion, cek, void 0, void 0, void 0, id);
+          return this.codec.encryptRecord({ collection: this.name, id }, merged, mergedVersion, cek);
         };
       }
       opts.onRegisterConflictResolver(collectionName, resolver);
@@ -3203,7 +3265,7 @@ var Collection = class {
     }
     await this.onAccess?.("find", "*");
     if (hits.length === 0) return [];
-    const { verifyDigestField } = await import("./verify-RO5RTZOJ.js");
+    const { verifyDigestField } = await import("./verify-WYOFLSNA.js");
     const policy = {
       normalize: spec.verifyNormalize ?? "password",
       notLastN: spec.notLastN ?? 0,
@@ -3291,7 +3353,7 @@ var Collection = class {
    * `openVault`, before the user's `collection(name, { moneyFields })`
    * declaration; this reconciles that ordering. First-wins. Not public.
    *
-   * PREPENDS money rather than appending: {@link compileViaBindings} always
+   * PREPENDS money rather than appending: {@link compileVias} always
    * compiles money before i18n (money-first pipeline order — see its
    * docstring), and by the time this reconcile runs an i18n binding may
    * already be sitting in `this.via.bindings` (declared at construction).
@@ -3317,6 +3379,12 @@ var Collection = class {
   _applyMeta(meta) {
     if (this.meta === void 0) this.meta = meta;
   }
+  /** @internal #1141 — refresh the ref snapshot after a late `refs` declaration. Overwrites rather
+   *  than first-wins, deliberately: the argument is the ref registry's own merged view (see
+   *  `reconcileViaAttach`), which `RefRegistry.register` has already refused to let conflict. */
+  _attachDeclaredRefs(refs) {
+    this._refs = refs;
+  }
   /**
    * @internal — attach classified fields post-construction. See {@link _applyMoneyFields}.
    * First-wins. Note: unlike money/computed/meta, this cannot retro-seal a
@@ -3409,7 +3477,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-ARHFVL5U.js");
+      const { resolveStaleMVOnRead } = await import("./stale-MCS46TFO.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     let record;
@@ -3421,7 +3489,7 @@ var Collection = class {
         const envelope = await this.adapter.get(this.vault, this.name, id);
         if (!envelope) return null;
         if (isTombstone(envelope, this.storeCiphertext) || isDeleteMarker(envelope) || (envelope._tier ?? 0) > 0) return null;
-        record = await this.codec.decryptRecord(envelope, { id, sealedAsHandles: true });
+        record = await this.codec.decryptRecord({ collection: this.name, id }, envelope, { sealedAsHandles: true });
         if (record === null) return null;
         this.lru.set(id, { record, version: envelope._v }, estimateRecordBytes(record));
       }
@@ -3448,7 +3516,7 @@ var Collection = class {
     }
     const envelope = await this.adapter.get(this.vault, this.name, id);
     if (!envelope || (envelope._tier ?? 0) > 0) return null;
-    const json = await this.codec.decryptJsonString(envelope);
+    const json = await this.codec.decryptJsonString({ collection: this.name, id }, envelope);
     if (json === null) return null;
     return JSON.parse(json);
   }
@@ -3565,7 +3633,7 @@ var Collection = class {
       if (cached) return cached.record;
       const env = await this.adapter.get(this.vault, this.name, id);
       if (!env || (env._tier ?? 0) > 0) return void 0;
-      const rec = await this.codec.decryptRecord(env, { id });
+      const rec = await this.codec.decryptRecord({ collection: this.name, id }, env, {});
       return rec === null ? void 0 : rec;
     }
     await this.ensureHydrated();
@@ -3613,7 +3681,7 @@ var Collection = class {
       if (cached2) return { record: cached2.record, version: cached2.version };
       const env = await this.adapter.get(this.vault, this.name, id);
       if (!env || (env._tier ?? 0) > 0) return { record: null, version: 0 };
-      return { record: await this.codec.decryptRecord(env, { skipValidation: true, id }) ?? null, version: env._v };
+      return { record: await this.codec.decryptRecord({ collection: this.name, id }, env, { skipValidation: true }) ?? null, version: env._v };
     }
     await this.ensureHydrated();
     const cached = this.cache.get(id);
@@ -3635,7 +3703,7 @@ var Collection = class {
     if (this.sensitiveFields.size > 0 || this.via?.hasAtRestHooks === true) {
       const env = await this.adapter.get(this.vault, this.name, id);
       if (!env || isTombstone(env, this.storeCiphertext) || (env._tier ?? 0) > 0) return void 0;
-      const rec = await this.codec.decryptRecord(env, { skipValidation: true, id });
+      const rec = await this.codec.decryptRecord({ collection: this.name, id }, env, { skipValidation: true });
       return rec === null ? void 0 : { record: rec, version: env._v };
     }
     const cached = this.cache.get(id);
@@ -3647,7 +3715,7 @@ var Collection = class {
     const env = await this.adapter.get(this.vault, this.name, id);
     if (!env) return { env: null, record: null, elided: false };
     if ((env._tier ?? 0) > 0) return { env, record: null, elided: false };
-    return { env, record: await this.codec.decryptRecord(env, { skipValidation: true, id }), elided: false };
+    return { env, record: await this.codec.decryptRecord({ collection: this.name, id }, env, { skipValidation: true }), elided: false };
   }
   /**
    * Wraps {@link RecordCodec.toCacheRecord} with an additional strip for
@@ -3671,9 +3739,9 @@ var Collection = class {
    * payload that is not a CRDT state. The `lww-map` and `rga` branches each
    * carried a copy, byte-identical apart from the cast (#842).
    */
-  async #decodePriorCrdtState(envelope) {
+  async #decodePriorCrdtState(id, envelope) {
     if (!envelope) return void 0;
-    const prevJson = await this.codec.decryptJsonString(envelope);
+    const prevJson = await this.codec.decryptJsonString({ collection: this.name, id }, envelope);
     if (prevJson === null) return void 0;
     const prevParsed = JSON.parse(prevJson);
     if (prevParsed === null || typeof prevParsed !== "object" || !("_crdt" in prevParsed)) {
@@ -3710,7 +3778,8 @@ var Collection = class {
       this.vault,
       this.name,
       id,
-      await this.codec.encryptRecord(prior.record, prior.version, cek, void 0, void 0, vdigCtx, id)
+      await this.codec.encryptRecord(this.strategies.history.historyIdentity(this.name, id, prior.version), prior.record, prior.version, cek, void 0, void 0, vdigCtx)
+      // sealed against its _history STORAGE identity (#1041)
     );
     this.emitter.emit("history:save", { vault: this.vault, collection: this.name, id, version: prior.version });
     if (this.historyConfig.maxVersions) {
@@ -3820,20 +3889,20 @@ var Collection = class {
       const now = (/* @__PURE__ */ new Date()).toISOString();
       let crdtState;
       if (this.crdtMode === "lww-map") {
-        const existingState = await this.#decodePriorCrdtState(existingEnvelope);
+        const existingState = await this.#decodePriorCrdtState(id, existingEnvelope);
         crdtState = this.strategies.crdt.buildLwwMapState(record, existingState, now);
       } else if (this.crdtMode === "rga") {
-        const existingState = await this.#decodePriorCrdtState(existingEnvelope);
+        const existingState = await this.#decodePriorCrdtState(id, existingEnvelope);
         crdtState = this.strategies.crdt.buildRgaState(Array.isArray(record) ? record : [record], existingState, generateULID);
       } else {
         crdtState = { _crdt: "yjs", update: record };
       }
       const version = existingVersion + 1;
       const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
-      const envelope = await this.codec.encryptJsonString(JSON.stringify(crdtState), version, cek, options?.source, options?.sourceTs);
+      const envelope = await this.codec.encryptJsonString({ collection: this.name, id }, JSON.stringify(crdtState), version, cek, options?.source, options?.sourceTs);
       await this.adapter.put(this.vault, this.name, id, envelope);
       const resolvedRecord = this.strategies.crdt.resolveCrdtSnapshot(crdtState);
-      const existingResolvedRecord = existingEnvelope ? await this.codec.decryptRecord(existingEnvelope, { skipValidation: true }) : null;
+      const existingResolvedRecord = existingEnvelope ? await this.codec.decryptRecord({ collection: this.name, id }, existingEnvelope, { skipValidation: true }) : null;
       const existingResolved = existingResolvedRecord !== null ? { record: existingResolvedRecord, version: existingVersion } : void 0;
       if (existingResolved) {
         await this.#savePriorHistory(id, existingResolved, cek, this.vdigFields !== null ? { id, prev: existingEnvelope } : void 0);
@@ -3873,7 +3942,7 @@ var Collection = class {
       if (!existing) {
         priorRaw = await this.adapter.get(this.vault, this.name, id);
         if (priorRaw) {
-          const previousRecord = await this.codec.decryptRecord(priorRaw, { id });
+          const previousRecord = await this.codec.decryptRecord({ collection: this.name, id }, priorRaw, {});
           if (previousRecord !== null) {
             existing = { record: previousRecord, version: priorRaw._v };
           }
@@ -3893,7 +3962,7 @@ var Collection = class {
     this.uniqueConstraints?.check(id, record);
     const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
     const vdigCtx = this.vdigFields !== null ? { id, prev: await this.adapter.get(this.vault, this.name, id) } : void 0;
-    const envelope = await this.codec.encryptRecord(record, version, cek, options?.source, options?.sourceTs, vdigCtx, id);
+    const envelope = await this.codec.encryptRecord({ collection: this.name, id }, record, version, cek, options?.source, options?.sourceTs, vdigCtx);
     return { id, envelope, version, indexed: record, event: record, prior: existing, cek, vdigCtx, reason: options?.reason };
   }
   /**
@@ -3939,7 +4008,7 @@ var Collection = class {
    */
   async dispatchMaterializedViews(id, record, wave) {
     if (this.materializedViewSource === void 0) return;
-    const { dispatchMaterializedViews } = await import("./dispatch-FZEAWKVM.js");
+    const { dispatchMaterializedViews } = await import("./dispatch-VR4LRXZ7.js");
     return dispatchMaterializedViews(this.#mvDispatchCtx(this.materializedViewSource), id, record, wave);
   }
   /**
@@ -3967,7 +4036,7 @@ var Collection = class {
         const cached = this.lru.get(id);
         const env = await this.adapter.get(this.vault, this.name, id);
         if (!env || isTombstone(env, this.storeCiphertext) || isDeleteMarker(env)) return null;
-        raw = await this.codec.decryptRecord(env, { id });
+        raw = await this.codec.decryptRecord({ collection: this.name, id }, env, {});
         if (raw === null) return null;
         if (!cached) {
           this.lru.set(id, { record: await this.codec.toCacheRecord(raw, env, id), version: env._v }, estimateRecordBytes(raw));
@@ -3978,7 +4047,7 @@ var Collection = class {
         else {
           const env = await this.adapter.get(this.vault, this.name, id);
           if (!env || isTombstone(env, this.storeCiphertext) || isDeleteMarker(env)) return null;
-          raw = await this.codec.decryptRecord(env, { id });
+          raw = await this.codec.decryptRecord({ collection: this.name, id }, env, {});
           if (raw === null) return null;
           this.lru.set(id, { record: raw, version: env._v }, estimateRecordBytes(raw));
         }
@@ -3995,7 +4064,7 @@ var Collection = class {
   async _getStoredRecordForDispatch(id) {
     const env = await this.adapter.get(this.vault, this.name, id);
     if (!env || isTombstone(env, this.storeCiphertext) || isDeleteMarker(env)) return null;
-    const record = await this.codec.decryptRecord(env, { id });
+    const record = await this.codec.decryptRecord({ collection: this.name, id }, env, {});
     return record === null ? null : { record, version: env._v };
   }
   /**
@@ -4112,7 +4181,7 @@ var Collection = class {
    *  dispatch wave's per-target dedup; `undefined` on the local-write path (byte-identical). */
   async dispatchDerivations(id, record, version, wave) {
     if (this.derivationSource === void 0) return;
-    const { dispatchDerivations } = await import("./dispatch-MJ6SHB3Y.js");
+    const { dispatchDerivations } = await import("./dispatch-4AP4PUZU.js");
     return dispatchDerivations({
       ...this.#derivationDeleteCtx(this.derivationSource),
       via: this.via,
@@ -4295,7 +4364,7 @@ var Collection = class {
       if (!existing && this.historyConfig.enabled !== false) {
         const previousEnvelope2 = await this.adapter.get(this.vault, this.name, id);
         if (previousEnvelope2) {
-          const previousRecord = await this.codec.decryptRecord(previousEnvelope2, { id });
+          const previousRecord = await this.codec.decryptRecord({ collection: this.name, id }, previousEnvelope2, {});
           if (previousRecord !== null) {
             existing = { record: previousRecord, version: previousEnvelope2._v };
           }
@@ -4310,7 +4379,7 @@ var Collection = class {
     if (this.onDirty) {
       const live = previousEnvelope;
       if (!live || isTombstone(live, this.storeCiphertext) || isDeleteMarker(live)) return null;
-      marker = buildDeleteMarker(live._v + 1, this.keyring.userId);
+      marker = buildDeleteMarker({ collection: this.name, id }, live._v + 1, this.keyring.userId);
     }
     const snapshots = existing !== void 0 && this.historyConfig.enabled !== false;
     const cek = snapshots && this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
@@ -4332,7 +4401,7 @@ var Collection = class {
   async _commitDelete(prepared, persist = true) {
     const { id, internal, existing, previousPayloadHash, marker, cek, vdigCtx } = prepared;
     if (existing && this.historyConfig.enabled !== false) {
-      await this.strategies.history.saveHistory(this.adapter, this.vault, this.name, id, await this.codec.encryptRecord(existing.record, existing.version, cek, void 0, void 0, vdigCtx, id));
+      await this.strategies.history.saveHistory(this.adapter, this.vault, this.name, id, await this.codec.encryptRecord(this.strategies.history.historyIdentity(this.name, id, existing.version), existing.record, existing.version, cek, void 0, void 0, vdigCtx));
     }
     if (marker) {
       if (persist) await this.adapter.put(this.vault, this.name, id, marker);
@@ -4399,7 +4468,7 @@ var Collection = class {
    */
   async _decodeEnvelope(envelope, id) {
     try {
-      const rec = await this.codec.decryptRecord(envelope, { skipValidation: true, id });
+      const rec = await this.codec.decryptRecord({ collection: this.name, id }, envelope, { skipValidation: true });
       return rec === null ? null : rec;
     } catch {
       return null;
@@ -4408,7 +4477,7 @@ var Collection = class {
   async _writeTombstone(id, actor) {
     const live = await this.adapter.get(this.vault, this.name, id);
     if (!live || isTombstone(live, this.storeCiphertext) || isDeleteMarker(live)) return null;
-    await this.adapter.put(this.vault, this.name, id, buildTombstone(live._v, actor));
+    await this.adapter.put(this.vault, this.name, id, buildTombstone({ collection: this.name, id }, live._v, actor));
     this.cache.delete(id);
     this.lru?.remove(id);
     this.cekCache?.remove(id);
@@ -4427,7 +4496,7 @@ var Collection = class {
    */
   async dispatchArrayDerivationsOnDelete(id, eraseRecordShapeToo = false) {
     if (this.derivationSource === void 0) return 0;
-    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-MJ6SHB3Y.js");
+    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-4AP4PUZU.js");
     return dispatchArrayDerivationsOnDelete(this.#derivationDeleteCtx(this.derivationSource), id, eraseRecordShapeToo);
   }
   /**
@@ -4441,7 +4510,7 @@ var Collection = class {
    */
   async dispatchMaterializedViewsOnDelete(id) {
     if (this.materializedViewSource === void 0) return { deleted: 0, residueUndecodable: [], residueDeclined: [] };
-    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-FZEAWKVM.js");
+    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-VR4LRXZ7.js");
     return dispatchMaterializedViewsOnDelete(this.#mvDispatchCtx(this.materializedViewSource), id);
   }
   /**
@@ -4461,7 +4530,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-ARHFVL5U.js");
+      const { resolveStaleMVOnRead } = await import("./stale-MCS46TFO.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     await this.ensureHydrated();
@@ -4795,7 +4864,7 @@ var Collection = class {
     const entries = [];
     for (const env of envelopes) {
       if ((env._tier ?? 0) > 0) continue;
-      const record = await this.codec.decryptRecord(env, { skipValidation: true, id });
+      const record = await this.codec.decryptRecord(this.strategies.history.historyIdentity(this.name, id, env._v), env, { skipValidation: true });
       if (record === null) continue;
       entries.push({
         version: env._v,
@@ -4824,7 +4893,7 @@ var Collection = class {
       version
     );
     if (!envelope || (envelope._tier ?? 0) > 0 || await liveRecordIsElevated(this.adapter, this.vault, this.name, id)) return null;
-    return this.codec.decryptRecord(envelope, { skipValidation: true, id });
+    return this.codec.decryptRecord(this.strategies.history.historyIdentity(this.name, id, envelope._v), envelope, { skipValidation: true });
   }
   /** Revert a record to a past version. Creates a new version with the old content. */
   async revert(id, version) {
@@ -4930,7 +4999,7 @@ var Collection = class {
       const id = ids[i];
       const envelope = await this.adapter.get(this.vault, this.name, id);
       if (envelope && (envelope._tier ?? 0) === 0) {
-        const record = await this.codec.decryptRecord(envelope, { id, sealedAsHandles: true });
+        const record = await this.codec.decryptRecord({ collection: this.name, id }, envelope, { sealedAsHandles: true });
         if (record === null) continue;
         items.push(record);
         if (!this.lazy && !this.cache.has(id)) {
@@ -5012,7 +5081,7 @@ var Collection = class {
     const out = [];
     for (const { id, envelope } of items) {
       if ((envelope._tier ?? 0) > 0) continue;
-      const record = await this.codec.decryptRecord(envelope, { id, sealedAsHandles: true });
+      const record = await this.codec.decryptRecord({ collection: this.name, id }, envelope, { sealedAsHandles: true });
       if (record === null) continue;
       out.push({ id, record, version: envelope._v });
     }
@@ -5073,7 +5142,7 @@ var Collection = class {
       }
       return;
     }
-    const record = await this.codec.decryptRecord(envelope, { id, sealedAsHandles: true });
+    const record = await this.codec.decryptRecord({ collection: this.name, id }, envelope, { sealedAsHandles: true });
     if (record === null) {
       this.cache.delete(id);
       if (previous) {
@@ -5169,7 +5238,7 @@ var Collection = class {
     for (const id of ids) {
       const envelope = await this.adapter.get(this.vault, this.name, id);
       if (envelope && !isTombstone(envelope, this.storeCiphertext) && !isDeleteMarker(envelope) && (envelope._tier ?? 0) === 0) {
-        const record = await this.codec.decryptRecord(envelope, { id, sealedAsHandles: true });
+        const record = await this.codec.decryptRecord({ collection: this.name, id }, envelope, { sealedAsHandles: true });
         if (record === null) continue;
         this.cache.set(id, { record, version: envelope._v });
       } else if (envelope && isDeleteMarker(envelope)) {
@@ -5188,7 +5257,7 @@ var Collection = class {
         continue;
       }
       if (isTombstone(envelope, this.storeCiphertext) || (envelope._tier ?? 0) > 0) continue;
-      const record = await this.codec.decryptRecord(envelope, { id, sealedAsHandles: true });
+      const record = await this.codec.decryptRecord({ collection: this.name, id }, envelope, { sealedAsHandles: true });
       if (record === null) continue;
       this.cache.set(id, { record, version: envelope._v });
     }
@@ -5322,7 +5391,7 @@ var Collection = class {
     for (const [id, entry] of this.cache) {
       const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
       const prevForVdig = this.vdigFields !== null ? await this.adapter.get(this.vault, this.name, id) : null;
-      result[id] = await this.codec.encryptRecord(entry.record, entry.version, cek, void 0, void 0, this.vdigFields !== null ? { id, prev: prevForVdig } : void 0, id);
+      result[id] = await this.codec.encryptRecord({ collection: this.name, id }, entry.record, entry.version, cek, void 0, void 0, this.vdigFields !== null ? { id, prev: prevForVdig } : void 0);
     }
     return result;
   }
@@ -5437,7 +5506,7 @@ var Collection = class {
       const envelope = await this.adapter.get(this.vault, this.name, id);
       if (!envelope) continue;
       try {
-        const json = await this.codec.decryptJsonString(envelope);
+        const json = await this.codec.decryptJsonString({ collection: this.name, id }, envelope);
         if (json === null) continue;
         const body = JSON.parse(json);
         if (typeof body.recordId !== "string") continue;
@@ -5571,14 +5640,14 @@ var Collection = class {
   /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
   async _ensureClassifiedMarker() {
     if (this._markerPersisted || this.vdigFields === null) return;
-    const { persistClassifiedMarkerForFields } = await import("./classified-marker-2KJAXRRO.js");
+    const { persistClassifiedMarkerForFields } = await import("./classified-marker-BSQHU4JT.js");
     await persistClassifiedMarkerForFields(this.adapter, this.vault, this.name, this.vdigFields, await this.getDEK(this.name));
     this._markerPersisted = true;
   }
   /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
   async _classifiedMarkerDigestOnly() {
     if (this._markerDigestOnlyCache !== void 0) return this._markerDigestOnlyCache;
-    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-2KJAXRRO.js");
+    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-BSQHU4JT.js");
     this._markerDigestOnlyCache = await readClassifiedMarkerDigestOnly(this.adapter, this.vault, this.name, await this.getDEK(this.name));
     return this._markerDigestOnlyCache;
   }
@@ -5700,10 +5769,10 @@ var Collection = class {
     if (busActive) await this.subsystemBus.dispatch(busPoint, event);
   }
   _txAtomicSafe(opType) {
-    if (this.materializedViewSource !== void 0 && this.materializedViewSource.registry().mvsForSource(this.name).length > 0 || this.derivationSource !== void 0 && this.derivationSource.registry().strategiesForSource(this.name).length > 0 || this.crdtMode !== void 0 || this.uniqueConstraints !== null || this.writeHooks !== void 0 && this.writeHooks.hasBeforeHandlers && !this.writeHooks.suppressed) return false;
+    if (this.materializedViewSource !== void 0 && (this.materializedViewSource.registry().hasPendingPlans() || this.materializedViewSource.registry().mvsForSource(this.name).length > 0) || this.derivationSource !== void 0 && this.derivationSource.registry().strategiesForSource(this.name).length > 0 || this.crdtMode !== void 0 || this.uniqueConstraints !== null || this.writeHooks !== void 0 && this.writeHooks.hasBeforeHandlers && !this.writeHooks.suppressed) return false;
     return opType === "put" ? Object.keys(this._refs).length === 0 : this.refEnforcer === void 0 || !this.refEnforcer._deleteCascadesPossible(this.name);
   }
-  // @internal #893/#906-prep atomic-commit eligibility gate (Task 4) — false on any derivation/MV source (any lifecycle), CRDT mode, unique constraints, or refs on this write direction. Put uses precise outbound `_refs`; delete (#922) consults the enforcer's `_deleteCascadesPossible(name)` — Vault unions ALL THREE cascade sources `enforceRefsOnDelete` (with-shape/links/vault-facade.ts) fires from (lookup-ref edges, classic inbound refs, managed links); anything narrower (e.g. `getInbound` alone) would admit unsafe atomic deletes, because `_prepareDelete` runs those cascades DURING prepare. #931 narrows #906's hooks blanket: only BEFORE-hooks gate (they can REFUSE a write, which only `put()`/`delete()` honors); after-hooks and the `afterPut`/`afterDelete` observe bus cannot refuse, so the atomic path fires them itself post-finalize via `_fireAtomicAfterWrite` instead of forfeiting the batch (the pre-#931 db-global blanket cost multi-tab write-relay and forget-subject apps the atomic path entirely). See atomic-eligibility.ts.
+  // @internal #893/#906-prep atomic-commit eligibility gate (Task 4) — false on any derivation/MV source (any lifecycle), false while ANY query-form MV plan is still parked (#1139: an unplanned strategy has no `_bySource` entry, so `mvsForSource` cannot see that this collection is one of its sources — and the atomic path skips MV dispatch, which is the very thing that would replan it), CRDT mode, unique constraints, or refs on this write direction. Put uses precise outbound `_refs`; delete (#922) consults the enforcer's `_deleteCascadesPossible(name)` — Vault unions ALL THREE cascade sources `enforceRefsOnDelete` (with-shape/links/vault-facade.ts) fires from (lookup-ref edges, classic inbound refs, managed links); anything narrower (e.g. `getInbound` alone) would admit unsafe atomic deletes, because `_prepareDelete` runs those cascades DURING prepare. #931 narrows #906's hooks blanket: only BEFORE-hooks gate (they can REFUSE a write, which only `put()`/`delete()` honors); after-hooks and the `afterPut`/`afterDelete` observe bus cannot refuse, so the atomic path fires them itself post-finalize via `_fireAtomicAfterWrite` instead of forfeiting the batch (the pre-#931 db-global blanket cost multi-tab write-relay and forget-subject apps the atomic path entirely). See atomic-eligibility.ts.
   _reconcileReadState(patch) {
     if (patch.dictKeyFields) this.dictKeyFields = { ...patch.dictKeyFields, ...this.dictKeyFields };
     if (patch.i18nFields) this.i18nFields = { ...patch.i18nFields, ...this.i18nFields };
@@ -5730,8 +5799,9 @@ var Collection = class {
       syncIndexes: (id, rec, version, priorEnvelope) => syncTierIndexes(this.indexingContext(), id, rec, version, priorEnvelope),
       syncSearch: (id, rec, version) => syncTierSearch(this.searchContext(), id, rec, version),
       syncHistory: async (id, fromDek, toDek) => this.strategies.history.rewrapHistory(this.adapter, this.vault, this.name, id, fromDek, toDek, await this.getDEK(this.name)),
-      saveHistorySnapshot: async (id, envelope) => {
+      saveHistorySnapshot: async (id, version, seal) => {
         if (this.historyConfig.enabled === false) return;
+        const envelope = await seal(this.strategies.history.historyIdentity(this.name, id, version));
         await this.strategies.history.saveHistory(this.adapter, this.vault, this.name, id, envelope);
         this.emitter.emit("history:save", { vault: this.vault, collection: this.name, id, version: envelope._v });
         if (this.historyConfig.maxVersions) await this.strategies.history.pruneHistory(this.adapter, this.vault, this.name, id, { keepVersions: this.historyConfig.maxVersions });
@@ -6015,17 +6085,18 @@ var DeferredNumberingStore = class {
   async readJson(collection, id) {
     const env = await this.adapter.get(this.vault, collection, id);
     if (!env) return { env: null, value: null };
-    const json = this.encrypted ? await openEnvelopeJson(env, await this.dek(collection)) : env._data;
+    const json = this.encrypted ? await openEnvelopeJson({ collection, id }, env, await this.dek(collection)) : env._data;
     return { env, value: JSON.parse(json) };
   }
   async writeJson(collection, id, value, expectedVersion) {
     const json = JSON.stringify(value);
     let env;
     if (!this.encrypted) {
-      env = { _noydb: NOYDB_FORMAT_VERSION, _v: expectedVersion + 1, _ts: (/* @__PURE__ */ new Date()).toISOString(), _iv: "", _data: json, _by: this.actor };
+      env = buildRecordEnvelope({ collection, id, version: expectedVersion + 1 }, { iv: "", data: json });
     } else {
-      const { iv, data } = await encrypt(json, await this.dek(collection));
-      env = { _noydb: NOYDB_FORMAT_VERSION, _v: expectedVersion + 1, _ts: (/* @__PURE__ */ new Date()).toISOString(), _iv: iv, _data: data, _by: this.actor };
+      const identity = { collection, id, version: expectedVersion + 1 };
+      const { iv, data } = await encrypt(json, await this.dek(collection), buildRecordAad(identity));
+      env = buildRecordEnvelope(identity, { iv, data });
     }
     await this.adapter.put(this.vault, collection, id, env, expectedVersion);
   }
@@ -6575,7 +6646,7 @@ var VaultPeriods = class {
       const loaded = await this.deps.strategy.loadPeriods(
         this.deps.adapter,
         this.deps.vault,
-        (env) => this.decryptPeriodRecord(env)
+        (id, env) => this.decryptPeriodRecord(id, env)
       );
       this.periodCache = await this.mergeReopenState(loaded);
     }
@@ -6592,7 +6663,7 @@ var VaultPeriods = class {
     const loaded = await this.deps.strategy.loadPeriods(
       this.deps.adapter,
       this.deps.vault,
-      (env) => this.decryptPeriodRecord(env)
+      (id, env) => this.decryptPeriodRecord(id, env)
     );
     this.periodCache = loaded;
     return loaded;
@@ -6600,27 +6671,15 @@ var VaultPeriods = class {
   /** Generic reserved-collection writer — serves `_periods` and `_period_freezes` alike. */
   async writeReserved(collection, key, value) {
     const json = JSON.stringify(value);
+    const actor = this.deps.userId();
+    const identity = { collection, id: key, by: actor, version: 1 };
     let envelope;
     if (this.deps.encrypted) {
       const dek = await this.deps.getDEK(collection);
-      const { iv, data } = await encrypt(json, dek);
-      envelope = {
-        _noydb: NOYDB_FORMAT_VERSION,
-        _v: 1,
-        _ts: (/* @__PURE__ */ new Date()).toISOString(),
-        _iv: iv,
-        _data: data,
-        _by: this.deps.userId()
-      };
+      const { iv, data } = await encrypt(json, dek, buildRecordAad(identity));
+      envelope = buildRecordEnvelope(identity, { iv, data });
     } else {
-      envelope = {
-        _noydb: NOYDB_FORMAT_VERSION,
-        _v: 1,
-        _ts: (/* @__PURE__ */ new Date()).toISOString(),
-        _iv: "",
-        _data: json,
-        _by: this.deps.userId()
-      };
+      envelope = buildRecordEnvelope(identity, { iv: "", data: json });
     }
     await this.deps.adapter.put(this.deps.vault, collection, key, envelope);
     if (collection === PERIODS_COLLECTION && this.deps.onDirty) {
@@ -6632,14 +6691,14 @@ var VaultPeriods = class {
   async readReserved(collection, key) {
     const env = await this.deps.adapter.get(this.deps.vault, collection, key);
     if (!env) return null;
-    const json = this.deps.encrypted ? await openEnvelopeJson(env, await this.deps.getDEK(collection)) : env._data;
+    const json = this.deps.encrypted ? await openEnvelopeJson({ collection, id: key }, env, await this.deps.getDEK(collection)) : env._data;
     return JSON.parse(json);
   }
-  async decryptPeriodRecord(envelope) {
+  async decryptPeriodRecord(periodId, envelope) {
     let json;
     if (this.deps.encrypted) {
       const dek = await this.deps.getDEK(PERIODS_COLLECTION);
-      json = await openEnvelopeJson(envelope, dek);
+      json = await openEnvelopeJson({ collection: PERIODS_COLLECTION, id: periodId }, envelope, dek);
     } else {
       json = envelope._data;
     }
@@ -7214,7 +7273,7 @@ var VaultLinks = class {
 // src/with-shape/links/lazy-handle.ts
 function makeLazyLinkSetHandle(d) {
   let engine = null;
-  const load = () => engine ??= import("./link-set-E5HNY67I.js").then(
+  const load = () => engine ??= import("./link-set-76JZ6YB4.js").then(
     ({ LinkSet }) => new LinkSet(d.adapter, d.vault, d.name, d.spec, d.encrypted, d.getDEK, d.actor, d.emitter, d.endpointExists)
   );
   return {
@@ -7332,7 +7391,7 @@ function registerCollectionGraphSources(graph, name, opts) {
     ...Object.keys(cfg.i18nFields ?? {}),
     ...Object.keys(cfg.dictKeyFields ?? {}),
     // #650 Task 2 — native lookup()/enumOf()/dict() fields register their
-    // posture (`lookupBinding().posture`) the same generic way every other
+    // posture (`lookupVia().posture`) the same generic way every other
     // binding does; no `'ref'` EdgeKind / graph edge yet (Task 5).
     ...Object.keys(cfg.lookupFields ?? {}),
     ...cfg.classified !== void 0 ? Object.keys(cfg.classified.byField) : []
@@ -7444,16 +7503,16 @@ var EMPTY_POSTURE_MAP = /* @__PURE__ */ new Map();
 function hasI18nBinding(coll) {
   return (coll._via?.bindings ?? []).some((b) => b.brand === "i18n");
 }
-function insertI18nBinding(existing, i18nBinding) {
+function insertI18nBinding(existing, i18nVia) {
   const idx = existing.findIndex((b) => b.brand === "lookup" || b.brand === "classified" || b.brand === "blob" || b.brand === "computed" || b.brand === "taint");
-  return idx === -1 ? [...existing, i18nBinding] : [...existing.slice(0, idx), i18nBinding, ...existing.slice(idx)];
+  return idx === -1 ? [...existing, i18nVia] : [...existing.slice(0, idx), i18nVia, ...existing.slice(idx)];
 }
 function hasLookupBinding(coll) {
   return (coll._via?.bindings ?? []).some((b) => b.brand === "lookup");
 }
-function insertLookupBinding(existing, lookupBindingObj) {
+function insertLookupBinding(existing, lookupViaObj) {
   const idx = existing.findIndex((b) => b.brand === "classified" || b.brand === "blob" || b.brand === "computed" || b.brand === "taint");
-  return idx === -1 ? [...existing, lookupBindingObj] : [...existing.slice(0, idx), lookupBindingObj, ...existing.slice(idx)];
+  return idx === -1 ? [...existing, lookupViaObj] : [...existing.slice(0, idx), lookupViaObj, ...existing.slice(idx)];
 }
 function refuseUnattachableMatrixLookupFields(vaultCtx, lookupFields) {
   for (const [field, desc] of Object.entries(lookupFields)) {
@@ -7620,6 +7679,10 @@ function reconcileViaAttach(coll, graph, name, vaultCtx, plan) {
     classifiedFields: plan.classifiedFields,
     computed: plan.computed
   }) : void 0;
+  if (plan.refs !== void 0) {
+    vaultCtx.refRegistry.register(name, plan.refs);
+    coll._attachDeclaredRefs(vaultCtx.refRegistry.getOutbound(name));
+  }
   if (plan.effectiveViaFields.moneyFields) coll._applyMoneyFields(plan.effectiveViaFields.moneyFields);
   if (plan.computed) coll._applyComputed(plan.computed);
   if (plan.fieldMeta) coll._applyFieldMeta(plan.fieldMeta);
@@ -7861,7 +7924,7 @@ function declareSatellite(ctx, collectionName, options, existingRegistry) {
   ctx.forEachSyncEngine((e) => e.remirrorPairResolvers([spec.base, spec.satellite]));
   const registry = reg;
   const baseSchema = ctx.getBaseSchema(spec.base);
-  void import("./post-register-2XSSMGEQ.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
+  void import("./post-register-53O7AJRZ.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
   });
   return reg;
 }
@@ -8181,17 +8244,6 @@ function expandRefsWithSatellites(refs, registry) {
   return anySat ? out : refs;
 }
 
-// src/with-shape/satellites/migrate-cek.ts
-async function migrateSatelliteCek(name, coll) {
-  if (coll.getConfig()?.perRecordKeys !== true) {
-    throw new SatelliteConfigError(
-      `migrateSatellitePerRecordKeys: collection "${name}" was already opened this session without perRecordKeys (construction-only); migrate before its first open, or restart the session.`
-    );
-  }
-  const migrated = await coll._applyCutoverTransform((doc) => doc);
-  return { migrated };
-}
-
 // src/with-shape/schema-update/fence-controller.ts
 function schemaBumpAuditHook(getLedger, actor) {
   return async (generation) => {
@@ -8629,7 +8681,7 @@ var Vault = class {
     this.keyring = opts.keyring;
     this.encrypted = opts.encrypted;
     this.schemaFence = new SchemaFenceController({
-      coordination: this.noydb.coordination,
+      coordination: this.noydb.mesh,
       vault: this.name,
       onFlush: () => this.noydb._writeQueueTracker.onFlush(),
       clientId: this.noydb._clientId,
@@ -8754,6 +8806,7 @@ var Vault = class {
    *  dispatch reads/writes — from this vault's OWN privates, rather than passing `this` itself. */
   _viaReconcileCtx() {
     return {
+      refRegistry: this.refRegistry,
       i18nStrategy: this.strategies.i18n,
       locale: this.locale,
       translateText: this.translateText,
@@ -8829,6 +8882,8 @@ var Vault = class {
     if (coll) {
       reconcileViaAttach(coll, this.graph, collectionName, this._viaReconcileCtx(), {
         effectiveViaFields,
+        ...options?.refs !== void 0 ? { refs: options.refs } : {},
+        // #1141 — late `refs` declaration
         ...options?.computed !== void 0 ? { computed: options.computed } : {},
         ...options?.fieldMeta !== void 0 ? { fieldMeta: options.fieldMeta } : {},
         ...options?.meta !== void 0 ? { meta: options.meta } : {},
@@ -8844,7 +8899,7 @@ var Vault = class {
         const strategies = options.schemaUpdate ?? [];
         const work = (async () => {
           const dek = await this.getDEK(collectionName);
-          const { persistSchemaIfNeeded } = await import("./register-4EFJCVYD.js");
+          const { persistSchemaIfNeeded } = await import("./register-6TCBR6XD.js");
           const result = await persistSchemaIfNeeded({
             store: this.adapter,
             vault: this.name,
@@ -8994,7 +9049,7 @@ var Vault = class {
         const work = (async () => {
           try {
             const dek = await this.getDEK(collectionName);
-            await (await import("./register-4EFJCVYD.js")).persistSchemaIfNeeded({
+            await (await import("./register-6TCBR6XD.js")).persistSchemaIfNeeded({
               store: this.adapter,
               vault: this.name,
               collectionName,
@@ -9037,9 +9092,10 @@ var Vault = class {
    * unblocks R-S7 when a base gains forget coverage after its satellite was
    * already declared without `perRecordKeys`. Call BEFORE re-declaring with
    * `{ satelliteOf, perRecordKeys: true }` AND before this collection serves
-   * writes (unfenced walk — see {@link migrateSatelliteCek}); resumable.
+   * writes (unfenced walk — see `with-shape/satellites/migrate-cek.ts`); resumable.
    */
   async migrateSatellitePerRecordKeys(satelliteName) {
+    const { migrateSatelliteCek } = await import("./migrate-cek-LBRKYUZZ.js");
     return migrateSatelliteCek(satelliteName, this.collection(satelliteName, { perRecordKeys: true }));
   }
   /**
@@ -9221,10 +9277,10 @@ var Vault = class {
   async _ensureFenceCoordination() {
     if (this.#fenceCoordinationStarted) return;
     this.#fenceCoordinationStarted = true;
-    const { FenceWatcher } = await import("./fence-watcher-DHQ775JB.js");
+    const { FenceWatcher } = await import("./fence-watcher-ZVSMLKQD.js");
     if (!this.#fenceCoordinationStarted) return;
     this.#fenceWatcher = new FenceWatcher({
-      coordination: this.noydb.coordination,
+      coordination: this.noydb.mesh,
       vault: this.name,
       clientId: this.noydb._clientId,
       sessionId: this.noydb._sessionId,
@@ -9670,16 +9726,23 @@ var Vault = class {
    */
   // eslint-disable-next-line @typescript-eslint/consistent-type-imports
   async _loadPodSigner() {
-    const { loadSigner } = await import("./signer-TA55QB6R.js");
+    const { loadSigner } = await import("./signer-6XVS2AU3.js");
     return loadSigner(this.adapter, this.name, this.getDEK);
   }
   async writeExportAudit(entry) {
     const json = JSON.stringify(entry);
+    const exportAuditIdentity = { collection: EXPORT_AUDIT_COLLECTION, id: entry.id, by: entry.actor, version: 1 };
     const envelope = this.encrypted ? await (async () => {
       const dek = await this.getDEK(EXPORT_AUDIT_COLLECTION);
-      const { iv, data } = await encrypt(json, dek);
-      return { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: entry.startedAt, _iv: iv, _data: data, _by: entry.actor };
-    })() : { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: entry.startedAt, _iv: "", _data: json, _by: entry.actor };
+      const { iv, data } = await encrypt(json, dek, buildRecordAad(exportAuditIdentity));
+      return buildRecordEnvelope(
+        exportAuditIdentity,
+        { ts: entry.startedAt, iv, data }
+      );
+    })() : buildRecordEnvelope(
+      exportAuditIdentity,
+      { ts: entry.startedAt, iv: "", data: json }
+    );
     await this.adapter.put(this.name, EXPORT_AUDIT_COLLECTION, entry.id, envelope);
   }
   canExport(tier, format) {
@@ -9693,12 +9756,12 @@ var Vault = class {
    *
    * @internal
    */
-  async _decryptEnvelopeForBundleFilter(env, collectionName) {
+  async _decryptEnvelopeForBundleFilter(env, collectionName, recordId) {
     if (!this.encrypted) {
       return JSON.parse(env._data);
     }
     const dek = await this.getDEK(collectionName);
-    const json = await openEnvelopeJson(env, dek);
+    const json = await openEnvelopeJson({ collection: collectionName, id: recordId }, env, dek);
     return JSON.parse(json);
   }
   canImport(tier, format) {
@@ -10153,7 +10216,7 @@ var Vault = class {
   async _initGuards(handles) {
     if (handles.length === 0) return;
     const [{ GuardRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-IKUR2MXD.js"),
+      import("./registry-IWFMXCHX.js"),
       import("./read-only-facade-CHCKSEPD.js")
     ]);
     const registry = new GuardRegistry();
@@ -10181,7 +10244,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-4SDHHOJ7.js"),
+      import("./registry-DH2L4O2V.js"),
       import("./read-only-facade-CHCKSEPD.js")
     ]);
     const registry = new DerivationRegistry();
@@ -10213,7 +10276,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-OYTFGWVK.js");
+    const { MaterializedViewRegistry } = await import("./registry-YC3IFG3A.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -10238,7 +10301,7 @@ var Vault = class {
    */
   async _initOverlayedViews(handles) {
     if (handles.length === 0) return;
-    const { OverlayedViewRegistry } = await import("./registry-CZVINVQH.js");
+    const { OverlayedViewRegistry } = await import("./registry-Q3FG3OAX.js");
     const registry = new OverlayedViewRegistry();
     const mvRegistry = this.materializedViewRegistry;
     const overlayNames = /* @__PURE__ */ new Set();
@@ -10296,18 +10359,19 @@ var Vault = class {
     if (registry === null) {
       return { written: 0, deleted: 0, failed: 0, residueUndecodable: [], residueDeclined: [] };
     }
+    await registry.resolvePendingPlans();
     const reg = registry.byName(name);
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-YIQB2S6N.js");
+    const { MaterializedViewExecutor } = await import("./executor-3KFRQETS.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this,
       dispatchCtx: this._dispatchCtx({ collection: name, id: "refreshView" })
     });
-    const { clearMVStaleFully } = await import("./stale-ARHFVL5U.js");
+    const { clearMVStaleFully } = await import("./stale-MCS46TFO.js");
     await clearMVStaleFully(this.adapter, this.name, registry, name);
     return result;
   }
@@ -10320,7 +10384,7 @@ var Vault = class {
     if (registry === null) return { derived: 0, failed: 0, skippedFrozen: 0 };
     const strategies = registry.strategiesForSource(sourceCollection);
     if (strategies.length === 0) return { derived: 0, failed: 0, skippedFrozen: 0 };
-    const { DerivationExecutor } = await import("./executor-S4QIKEHW.js");
+    const { DerivationExecutor } = await import("./executor-YYDW6XQI.js");
     const sourceColl = this.collection(sourceCollection);
     const records = await sourceColl.list();
     const ctx = { vault: this.derivationFacade ?? new (await import("./read-only-facade-CHCKSEPD.js")).ReadOnlyVaultFacade(this, "derivation") };
@@ -10347,7 +10411,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-NNAJQXMX.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-IWP3R4RC.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key, this.getDEK, this.encrypted);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -10574,7 +10638,7 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-MO7YZYJS.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-XWRPYODW.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
         "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (secret) first."
@@ -10596,7 +10660,7 @@ var Vault = class {
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-MO7YZYJS.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-XWRPYODW.js");
     await revokeDelegation(this.adapter, this.name, id);
     void DELEGATIONS_COLLECTION;
   }
@@ -10612,7 +10676,7 @@ var Vault = class {
    *   - The keyring must already carry a wrap for the target tier on
    *     at least one collection (or be `owner` / `admin`, who can
    *     auto-mint). Otherwise throws {@link TierNotGrantedError}.
-   *   - Per-collection capability gates (`canExportPlaintext`,
+   *   - Per-collection capability gates (`assertCanExport`,
    *     `canExportBundle`) are NOT bypassed — elevation is a tier
    *     projection, not a privilege escalation path.
    *   - Only one elevation can be active per vault at a time.
@@ -10692,25 +10756,18 @@ var Vault = class {
   async writeElevationAudit(entry) {
     const id = `elev-${Date.now().toString(36)}-${Math.random().toString(16).slice(2, 10)}`;
     const json = JSON.stringify({ id, ...entry });
+    const elevationAuditIdentity = { collection: ELEVATION_AUDIT_COLLECTION, id, by: entry.actor, version: 1 };
     const envelope = this.encrypted ? await (async () => {
       const dek = await this.getDEK(ELEVATION_AUDIT_COLLECTION);
-      const { iv, data } = await encrypt(json, dek);
-      return {
-        _noydb: NOYDB_FORMAT_VERSION,
-        _v: 1,
-        _ts: entry.startedAt,
-        _iv: iv,
-        _data: data,
-        _by: entry.actor
-      };
-    })() : {
-      _noydb: NOYDB_FORMAT_VERSION,
-      _v: 1,
-      _ts: entry.startedAt,
-      _iv: "",
-      _data: json,
-      _by: entry.actor
-    };
+      const { iv, data } = await encrypt(json, dek, buildRecordAad(elevationAuditIdentity));
+      return buildRecordEnvelope(
+        elevationAuditIdentity,
+        { ts: entry.startedAt, iv, data }
+      );
+    })() : buildRecordEnvelope(
+      elevationAuditIdentity,
+      { ts: entry.startedAt, iv: "", data: json }
+    );
     await this.adapter.put(this.name, ELEVATION_AUDIT_COLLECTION, id, envelope);
   }
   /**
@@ -10856,7 +10913,7 @@ var Vault = class {
    * @see design-history/2026-05-22-schema-dump-design.md
    */
   async dumpSchema(opts = {}) {
-    const { dumpVaultSchema } = await import("./walk-3ZECBFDA.js");
+    const { dumpVaultSchema } = await import("./walk-JNEOYCAU.js");
     return dumpVaultSchema(this, opts);
   }
   /**
@@ -10951,15 +11008,15 @@ var Vault = class {
    * distinct handles, which is the right behavior — they're
    * separate vault instances now.
    */
-  async getBundleHandle() {
-    const { buildBundleHandle } = await import("./bundle-handle-GFNHT52M.js");
-    return buildBundleHandle(this.adapter, this.name);
+  async getPodHandle() {
+    const { buildPodHandle } = await import("./pod-handle-P6DPBM5U.js");
+    return buildPodHandle(this.adapter, this.name);
   }
   /**
    * Read the owner-curated cover for this vault (or `undefined` if
    * none is persisted). The cover lives in `_meta/public-envelope`
    * (the frozen wire name) as plaintext — readable without any KEK
-   * — so `getBundleHandle`-style callers can label a vault before
+   * — so `getPodHandle`-style callers can label a vault before
    * unlock.
    *
    * Mirrors `Noydb.getCover(vault, opts)` but scoped to a
@@ -10984,7 +11041,7 @@ var Vault = class {
    * both modes round-trip cleanly.
    */
   async dump() {
-    const { dumpVault } = await import("./backup-KULFZ2T4.js");
+    const { dumpVault } = await import("./backup-Z7ZBTAQ6.js");
     return dumpVault(this.backupContext());
   }
   /**
@@ -11036,7 +11093,7 @@ var Vault = class {
    * — there's no chain to verify against.
    */
   async load(backupJson) {
-    const { loadVault } = await import("./backup-KULFZ2T4.js");
+    const { loadVault } = await import("./backup-Z7ZBTAQ6.js");
     return loadVault(this.backupContext(), backupJson);
   }
   /**
@@ -11068,7 +11125,7 @@ var Vault = class {
    * way to detect tampering of an in-place vault.
    */
   async verifyBackupIntegrity() {
-    const { verifyBackupIntegrity } = await import("./backup-KULFZ2T4.js");
+    const { verifyBackupIntegrity } = await import("./backup-Z7ZBTAQ6.js");
     return verifyBackupIntegrity(this.backupContext());
   }
   /**
@@ -11133,6 +11190,18 @@ var Vault = class {
    * }
    * ```
    */
+  /**
+   * Serialise this vault through an `as-*` format. The gate runs before a
+   * record is read and the format never receives a vault — see
+   * `docs/adr/0004-as-format-port.md` and `port/as/active.ts`.
+   */
+  async export(format, options) {
+    return this.strategies.formats.exportWith(this, format, options);
+  }
+  /** Plan an import from an `as-*` format. Nothing is written until `apply()`. */
+  async import(format, input, options) {
+    return this.strategies.formats.importWith(this, format, input, options);
+  }
   async *exportStream(opts = {}) {
     const granularity = opts.granularity ?? "collection";
     const exportLocale = opts.resolveLabels;
@@ -11286,7 +11355,7 @@ var Vault = class {
    * is the live validator object, not a serialization of it).
    */
   async exportJSON(opts = {}) {
-    const { exportVaultJSON } = await import("./backup-KULFZ2T4.js");
+    const { exportVaultJSON } = await import("./backup-Z7ZBTAQ6.js");
     return exportVaultJSON(this.backupContext(), opts);
   }
 };
@@ -12162,7 +12231,7 @@ var TeamFacade = class {
     const p = this.deps.options.shamirRecovery;
     if (!p) {
       throw new Error(
-        "shamir recovery requires a ShamirRecoveryProvider \u2014 pass shamirRecovery: shamirRecoveryProvider() from '@noy-db/on-shamir' to createNoydb()"
+        "shamir recovery requires a NoydbShamir \u2014 pass shamirRecovery: shamirRecoveryProvider() from '@noy-db/on-shamir' to createNoydb()"
       );
     }
     return p;
@@ -12197,6 +12266,20 @@ var TeamFacade = class {
     this.deps.keyringCache.set(vault, keyring);
     return result;
   }
+  /** Gate + run the `verifyRoster` engine (#1121). See `Noydb.verifyRoster`. */
+  async runVerifyRoster(engine, vault) {
+    const keyring = await this.deps.getKeyringInternal(vault);
+    return engine(this.deps.options.store, vault, keyring);
+  }
+  /** Gate + run the `quarantineKeyring` engine (#1121). See `Noydb.quarantineKeyring`. */
+  async runQuarantine(engine, vault, userId, factors) {
+    this.deps.checkPolicyOperation(vault, "revoke");
+    await this.deps.checkGate(vault, "revoke-user", factors);
+    const keyring = await this.deps.getKeyringInternal(vault);
+    const result = await engine(this.deps.options.store, vault, keyring, userId);
+    this.deps.keyringCache.set(vault, keyring);
+    return result;
+  }
   // ─── Tier-2 enroll / remove ─────────────────────────────────────
   /**
    * Add a tier-2 authenticator slot to the calling user's keyring.
@@ -12411,7 +12494,7 @@ var TeamFacade = class {
         "rotate-secret",
         "disabled",
         { minTier: 1, enabled: false },
-        "Managed-secret mode (#14): the secret is hub-generated and sealed under the SealingKeyProvider \u2014 there is no plaintext to rotate. Use the recovery flow (follow-up issue) to mint a fresh sealed secret."
+        "Managed-secret mode (#14): the secret is hub-generated and sealed under the NoydbSealer \u2014 there is no plaintext to rotate. Use the recovery flow (follow-up issue) to mint a fresh sealed secret."
       );
     }
     await this.deps.checkGate(vault, "rotate-secret", factors);
@@ -12589,7 +12672,7 @@ var TeamFacade = class {
    * const db = await createNoydb({
    *   store, user: 'alice',
    *   secretMode: 'managed',
-   *   sealingKey: macosKeychainSealingProvider({ ... }),
+   *   sealingKey: atMacosKeychain({ ... }),
    * })
    *
    * const { vault, recoveryEnrollments } = await db.team.openVaultAndEnrollRecovery('acme', {
@@ -12641,7 +12724,7 @@ var TeamFacade = class {
    *
    * Replaces the sealed secret of a managed-mode vault with a
    * fresh 256-bit random, sealed under the configured
-   * `SealingKeyProvider`. The user never sees the new secret.
+   * `NoydbSealer`. The user never sees the new secret.
    *
    * Internally:
    *   1. Verify the recovery proof (Shamir today) and unwrap the
@@ -12939,8 +13022,8 @@ var Noydb = class {
   /** Session that owns this instance's writers (one user's writers across vaults). */
   sessionId;
   /** Drain-barrier coordination transport for the schema fence. */
-  coordinationProvider;
-  /** Pre-resolved `vault.user` API factory (mirrors `coordinationProvider` above). Public so `Vault` can call it. */
+  meshPort;
+  /** Pre-resolved `vault.user` API factory (mirrors `meshPort` above). Public so `Vault` can call it. */
   userApiFactory;
   vaultCache = /* @__PURE__ */ new Map();
   /**
@@ -13001,7 +13084,7 @@ var Noydb = class {
   }
   snapshots;
   policyManager;
-  /** Pre-resolved policy-gate engine function (mirrors `coordinationProvider`/`userApiFactory` above). */
+  /** Pre-resolved policy-gate engine function (mirrors `meshPort`/`userApiFactory` above). */
   policyCheckGate;
   /**
    * Credential and multi-user operations — enrolment, secret rotation,
@@ -13048,12 +13131,12 @@ var Noydb = class {
       );
     }
     this.sessionId = options.sessionId ?? generateULID();
-    if (!options.coordinationStrategy) {
+    if (!options.mesh) {
       throw new ValidationError(
-        "Noydb must be constructed via createNoydb(), which resolves the default coordination provider."
+        "Noydb must be constructed via createNoydb(), which resolves the default mesh."
       );
     }
-    this.coordinationProvider = options.coordinationStrategy;
+    this.meshPort = options.mesh;
     if (!options.userApiFactory) throw new ValidationError("Noydb must be constructed via createNoydb(), which resolves the default user-envelope API factory.");
     this.userApiFactory = options.userApiFactory;
     if (!options.policyFactory || !options.policyCheckGateFn) throw new ValidationError("Noydb must be constructed via createNoydb(), which resolves the default policy service.");
@@ -13102,6 +13185,7 @@ var Noydb = class {
     this.#registerGuardGate();
     this.#registerPeriodGate();
     this.#registerForgetHooks();
+    this.#registerVaultHeadObserver();
     this.resetSessionTimer();
   }
   /** @internal — resolved forget strategy (NO_FORGET when not configured). */
@@ -13118,6 +13202,22 @@ var Noydb = class {
   //   - the subsystemBus `afterDelete` observer fires on delete (onAfterWrite
   //     does NOT) — drop the ref so a deleted record never lingers in the
   //     index (RISK #2). Without it, forget() would try to shred a ghost.
+  /** #1044 — see `with-commit/vault-head/strategy.ts` for why this is an observer. */
+  #registerVaultHeadObserver() {
+    if (!this.strategies.vaultHead.enabled) return;
+    for (const point of ["afterPut", "afterDelete"]) {
+      this.subsystemBus.register(point, async (event) => {
+        const vault = this.vaultCache.get(event.vault);
+        if (!vault) return;
+        const { adapter, getDEK } = vault._introspectState();
+        await this.strategies.vaultHead.note(adapter, event.vault, getDEK, {
+          collection: event.collection,
+          id: event.docId,
+          version: event.version
+        });
+      });
+    }
+  }
   #registerForgetHooks() {
     const subjects = this.strategies.forget.subjects;
     if (Object.keys(subjects).length === 0) return;
@@ -13183,7 +13283,7 @@ var Noydb = class {
       if (!facade) return;
       const ctx = { existing, vault: facade, userId: e.userId, role: e.role };
       await registry.runChecks(e.collection, incoming, ctx);
-      const { GuardExecutor } = await import("./executor-CYJQLKKI.js");
+      const { GuardExecutor } = await import("./executor-AFHQYRAU.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, e.docId, existing, incoming, e.computedFieldNames);
       }
@@ -13304,6 +13404,7 @@ var Noydb = class {
     if (this.options.encrypt !== false && !this.policyCache.has(name)) {
       await this.bootstrapPolicy(name);
     }
+    const mergeAuthority = buildMergeAuthority(keyring);
     let syncEngine;
     const targets = normalizeSyncTargets(this.options.sync);
     if (targets.length > 0) {
@@ -13318,11 +13419,12 @@ var Noydb = class {
         emitter: this.emitter,
         syncPolicy: effectivePolicy,
         role: primary.role,
+        mergeAuthority,
         ...primary.label !== void 0 ? { label: primary.label } : {}
       });
       this.syncEngines.set(name, syncEngine);
       if (declaredPolicy) syncEngine.startScheduler();
-      for (const target of targets) {
+      for (const [index, target] of targets.entries()) {
         if (target === primary) continue;
         const targetPolicy = target.policy ?? this.options.syncPolicy ?? INDEXED_STORE_POLICY;
         const engine = this.strategies.sync.buildSyncEngine({
@@ -13333,10 +13435,10 @@ var Noydb = class {
           emitter: this.emitter,
           syncPolicy: targetPolicy,
           role: target.role,
+          mergeAuthority,
           ...target.label !== void 0 ? { label: target.label } : {}
         });
-        const key = `${name}::${target.label ?? target.role}`;
-        this.syncEngines.set(key, engine);
+        this.syncEngines.set(`${name}::${index}`, engine);
         if (target.policy ?? this.options.syncPolicy) engine.startScheduler();
       }
     }
@@ -13557,8 +13659,8 @@ var Noydb = class {
    * collection) pair that was dropped. Re-run `grant()` for those pairs, or
    * they stay locked out.
    *
-   * Unlike `revoke({ rotateKeys: true })`, this call does not REMOVE any
-   * user from the vault — they keep membership and their other collections.
+   * Unlike `revoke()`, this call does not REMOVE any user from the vault —
+   * they keep membership and their other collections.
    * This is the "just rotate" path; "revoke and rotate" lives in `revoke()`.
    *
    * Exposed on Noydb (rather than only on the lower-level keyring
@@ -13569,6 +13671,27 @@ var Noydb = class {
   async rotate(vault, collections) {
     return this.strategies.team.rotate(this.team, vault, collections);
   }
+  /**
+   * Verify every `_keyring` file in the vault. Read-only (#1121).
+   *
+   * Names each failing file and why, so the bad one need not be found by trial.
+   * Reports `checked` too: "nothing unverified" is equally true of a sweep that
+   * examined nothing.
+   */
+  async verifyRoster(vault) {
+    return this.strategies.team.verifyRoster(this.team, vault);
+  }
+  /**
+   * Remove a `_keyring` file that cannot be authenticated, and re-key behind it
+   * (#1121). Owner-only; refuses a file that verifies (use {@link revoke}).
+   *
+   * `revoke` consults the target's own `role`, so it cannot act on a file it
+   * will not trust. This ignores every claim the file makes — which is exactly
+   * why it is restricted to files that already fail authentication.
+   */
+  async quarantineKeyring(vault, userId, factors) {
+    return this.strategies.team.quarantineKeyring(this.team, vault, userId, factors);
+  }
   /** List all users with access to a vault. */
   async listUsers(vault) {
     return listUsers(this.options.store, vault);
@@ -13962,6 +14085,21 @@ var Noydb = class {
     }
     return engine.status();
   }
+  /**
+   * Per-target sync state for `vault` (#1034) — `syncStatus()` reads only the
+   * primary engine, so it cannot express "the LAN store is behind, the cloud
+   * is current". Registration order, primary first. See {@link SyncTargetStatus}.
+   */
+  syncTargetStatus(vault) {
+    const targets = [];
+    for (const [key, engine] of this.syncEngines) {
+      if (key !== vault && !key.startsWith(`${vault}::`)) continue;
+      const { dirty, lastPush, lastPull } = engine.status();
+      const { label, role } = engine;
+      targets.push({ label, role, dirty, lastPush, lastPull, caughtUp: dirty === 0 });
+    }
+    return targets;
+  }
   /**
    * Enumerate the sync targets wired for `vault` (#948) — the primary engine
    * (keyed by vault name) plus any additional targets (keyed `vault::label`
@@ -13984,7 +14122,14 @@ var Noydb = class {
   getSyncEngine(vault) {
     const engine = this.syncEngines.get(vault);
     if (!engine) {
-      throw new ValidationError("No sync adapter configured. Pass a `sync` adapter to createNoydb().");
+      if (this.syncEngines.size === 0) {
+        throw new ValidationError(
+          "No sync adapter configured. Pass a `sync` adapter to createNoydb() \u2014 a NoydbStore, a SyncTarget (`{ store, role }`), or an array of them \u2014 and `syncStrategy: withSync()` to enable the engine."
+        );
+      }
+      throw new ValidationError(
+        `No sync engine for vault "${String(vault)}". Sync is configured, but for [${[...this.syncEngines.keys()].map((k) => `"${k}"`).join(", ")}] \u2014 an engine is built per vault when it is opened, so open this vault first. Note the vault name is a REQUIRED argument: \`db.pull(vaultName)\`, not \`db.pull()\`.`
+      );
     }
     return engine;
   }
@@ -14136,10 +14281,10 @@ var Noydb = class {
   /**
    * @internal Drain-barrier coordination transport for the schema fence.
    * The default store-backed provider reproduces today's fence behavior; a
-   * `by-*` real-time transport is injected via `coordinationStrategy`.
+   * `by-*` real-time transport is injected via `mesh`.
    */
-  get coordination() {
-    return this.coordinationProvider;
+  get mesh() {
+    return this.meshPort;
   }
   /**
    * #693: true when multi-tab coordination is active at all — presence/election
@@ -14169,8 +14314,11 @@ var Noydb = class {
    * No-op when `vault` is not currently in cache (idempotent).
    */
   lockVault(vault) {
-    this.syncEngines.get(vault)?.stopAutoSync();
-    this.syncEngines.delete(vault);
+    for (const [key, engine] of [...this.syncEngines]) {
+      if (key !== vault && !key.startsWith(`${vault}::`)) continue;
+      engine.stopAutoSync();
+      this.syncEngines.delete(key);
+    }
     this.policyEnforcers.get(vault)?.destroy();
     this.policyEnforcers.delete(vault);
     this.vaultCache.get(vault)?._stopFenceCoordination();
@@ -14506,8 +14654,8 @@ var Noydb = class {
 async function createNoydb(options) {
   if (!options.store) options = { ...options, store: memoryStore() };
   validateSecretModeOptions(options);
-  if (!options.coordinationStrategy) options = { ...options, coordinationStrategy: await createDefaultCoordinationProvider(options.store) };
-  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-RXUMEKT3.js")).createUserApi };
+  if (!options.mesh) options = { ...options, mesh: await createDefaultMesh(options.store) };
+  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-EQYRTZO2.js")).createUserApi };
   if (!options.policyFactory) {
     const policyModule = await import("./policy/index.js");
     options = { ...options, policyFactory: policyModule.createNoydbPolicy, policyCheckGateFn: policyModule.checkGate };
@@ -14542,4 +14690,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-2GAJGUNM.js.map
+//# sourceMappingURL=chunk-Y3YLJORD.js.map