@noy-db/hub 0.6.0-pre.9 → 0.7.0-pre.0

package/dist/with-party/team/tiers.d.ts

@@ -18,7 +18,8 @@
  */
 import type { UnlockedKeyring } from './keyring.js';
 /** Canonical DEK key for a given collection + tier. Tier 0 → bare name. */
-export declare function dekKey(collection: string, tier: number): string;
+import { dekKey } from '../../kernel/tier-visibility.js';
+export { dekKey };
 /**
  * Returns the user's effective clearance for a given collection: the
  * maximum tier for which their keyring holds a DEK. Falls back to 0

package/dist/with-pod/format.d.ts

@@ -47,14 +47,14 @@
  */
 import type { Cover } from '../with-party/directory/cover/types.js';
 import type { Redirect } from './redirect.js';
-/** Magic bytes 'NDB1' (ASCII), identifying a NOYDB bundle. */
-export declare const NOYDB_BUNDLE_MAGIC: Uint8Array<ArrayBuffer>;
+/** Magic bytes 'NDB1' (ASCII) — `NoyDB 1` — identifying a NOYDB pod (`.noydb` container). */
+export declare const NOYDB_POD_MAGIC: Uint8Array<ArrayBuffer>;
 /** Total fixed prefix before the header JSON: 4+1+1+4 bytes. */
-export declare const NOYDB_BUNDLE_PREFIX_BYTES = 10;
+export declare const NOYDB_POD_PREFIX_BYTES = 10;
 /** Current bundle format version. Bumped on layout changes. Default for unsigned pods. */
-export declare const NOYDB_BUNDLE_FORMAT_VERSION = 1;
+export declare const NOYDB_POD_FORMAT_VERSION = 1;
 /** Format version for pods carrying a header signature (`sig`/`keyId`/`sigAlg`). */
-export declare const NOYDB_BUNDLE_FORMAT_VERSION_SIGNED = 2;
+export declare const NOYDB_POD_FORMAT_VERSION_SIGNED = 2;
 /**
  * Bitfield interpretation of the flags byte.
  *
@@ -85,7 +85,7 @@ export type CompressionAlgo = 0 | 1 | 2;
  *
  * **Minimum-disclosure rules:** these are the ONLY allowed keys.
  * Any other key in a parsed header causes
- * `validateBundleHeader` to throw. The set is kept short to
+ * `validatePodHeaderFields` to throw. The set is kept short to
  * minimize attack surface from cloud-storage metadata indexing —
  * see the file-level doc comment for the rationale.
  *
@@ -132,7 +132,7 @@ export interface NoydbPodHeader {
      * Auto-unlock material indicator. When present, the bundle
      * body wraps the dump JSON in a structure carrying per-user
      * secrets — either plaintext (`'unsealed'`, public-by-design)
-     * or sealed under a `SealingKeyProvider` (`'sealed'`, requires
+     * or sealed under a `NoydbSealer` (`'sealed'`, requires
      * matching provider on the recipient side).
      *
      * Visible pre-decompression so cloud listing UIs can warn before
@@ -249,8 +249,6 @@ export interface NoydbPodHeader {
  * family (see `unlockMethods` doc comment on `NoydbPodHeader`).
  */
 export type UnlockMethod = 'password' | 'webauthn' | 'oidc' | 'totp' | 'email-otp' | 'magic-link' | 'pin' | 'recovery' | 'shamir';
-/** @deprecated Use `NoydbPodHeader`. */
-export type NoydbBundleHeader = NoydbPodHeader;
 /**
  * Validate a parsed bundle header. Throws on any deviation from
  * the minimum-disclosure schema:
@@ -266,18 +264,18 @@ export type NoydbBundleHeader = NoydbPodHeader;
  * The error messages name the offending field so consumers can
  * fix the producer rather than the reader.
  */
-export declare function validateBundleHeader(parsed: unknown): asserts parsed is NoydbPodHeader;
+export declare function validatePodHeaderFields(parsed: unknown): asserts parsed is NoydbPodHeader;
 /**
  * Encode a header object to UTF-8 JSON bytes after validating
  * minimum disclosure. Used by the writer to serialize the header
  * region of the container.
  */
-export declare function encodeBundleHeader(header: NoydbPodHeader): Uint8Array;
+export declare function encodePodHeader(header: NoydbPodHeader): Uint8Array;
 /**
  * Parse a bundle header from its UTF-8 JSON bytes. Throws on
  * invalid JSON or any minimum-disclosure violation.
  */
-export declare function decodeBundleHeader(bytes: Uint8Array): NoydbPodHeader;
+export declare function decodePodHeader(bytes: Uint8Array): NoydbPodHeader;
 /**
  * Read a uint32 from `bytes` at `offset` in big-endian byte order.
  * No bounds check — callers must guarantee `offset + 4 <= bytes.length`.
@@ -295,4 +293,4 @@ export declare function writeUint32BE(bytes: Uint8Array, offset: number, value:
  * 4 bytes match `NDB1`. Used by readers as a fast file-type check
  * before any further parsing.
  */
-export declare function hasNoydbBundleMagic(bytes: Uint8Array): boolean;
+export declare function hasNoydbPodMagic(bytes: Uint8Array): boolean;

package/dist/with-pod/index.d.ts

@@ -11,19 +11,19 @@
  * omit this subpath and save ~805 LOC of format code + Brotli/gzip
  * wiring.
  */
-export { writePod, readPod, readPodHeader, readPodCover, writeNoydbBundle, readNoydbBundle, readNoydbBundleHeader, resetBrotliSupportCache, } from './bundle.js';
+export { writePod, readPod, readPodHeader, readPodCover, resetBrotliSupportCache, } from './pod.js';
 export type { Cover } from '../with-party/directory/cover/types.js';
-export type { WritePodOptions, WriteNoydbBundleOptions, ReadNoydbBundleOptions, NoydbBundleReadResult, } from './bundle.js';
-export { verifyPodHeader } from './bundle.js';
-export type { PodVerifyResult } from './bundle.js';
+export type { WritePodOptions, ReadPodOptions, PodReadResult, } from './pod.js';
+export { verifyPodHeader } from './pod.js';
+export type { PodVerifyResult } from './pod.js';
 export { signRecord, verifyRecord, signedBytes, POD_SIG_ALG } from './signature.js';
-export { NOYDB_BUNDLE_MAGIC, NOYDB_BUNDLE_PREFIX_BYTES, NOYDB_BUNDLE_FORMAT_VERSION, FLAG_COMPRESSED, FLAG_HAS_INTEGRITY_HASH, COMPRESSION_NONE, COMPRESSION_GZIP, COMPRESSION_BROTLI, validateBundleHeader, encodeBundleHeader, hasNoydbBundleMagic, } from './format.js';
-export type { CompressionAlgo, NoydbPodHeader, NoydbBundleHeader, UnlockMethod, } from './format.js';
+export { NOYDB_POD_MAGIC, NOYDB_POD_PREFIX_BYTES, NOYDB_POD_FORMAT_VERSION, FLAG_COMPRESSED, FLAG_HAS_INTEGRITY_HASH, COMPRESSION_NONE, COMPRESSION_GZIP, COMPRESSION_BROTLI, validatePodHeaderFields, encodePodHeader, hasNoydbPodMagic, } from './format.js';
+export type { CompressionAlgo, NoydbPodHeader, UnlockMethod, } from './format.js';
 export { generateULID, isULID } from './ulid.js';
-export { wrapPodStore, createPodStore, wrapBundleStore, createBundleStore } from './pod-store.js';
-export type { WrappedPodNoydbStore, WrapPodStoreOptions, WrappedBundleNoydbStore, WrapBundleStoreOptions, } from './pod-store.js';
-export { BundleIntegrityError, BundleSealMismatchError, PodVersionConflictError, BundleVersionConflictError, BackupLedgerError, BackupCorruptedError, } from '../kernel/errors.js';
-export { readPodRedirect } from './bundle.js';
+export { wrapPodStore, createPodStore } from './pod-store.js';
+export type { WrappedPodNoydbStore, WrapPodStoreOptions, } from './pod-store.js';
+export { PodIntegrityError, PodSealMismatchError, PodVersionConflictError, BackupLedgerError, BackupCorruptedError, } from '../kernel/errors.js';
+export { readPodRedirect } from './pod.js';
 export { signRedirect, verifyRedirect, followRedirects } from './redirect.js';
 export type { Redirect, RedirectHop, FollowRedirectsResult } from './redirect.js';
 export type { DocSigner } from '../with-audit/attestation/signer.js';

package/dist/with-pod/open.d.ts

@@ -6,7 +6,7 @@
  * reachable through published seams). Composes, in order:
  *
  *   1. `readPod` — parse + integrity-check the container (throws
- *      `BundleIntegrityError` on a corrupted/truncated pod).
+ *      `PodIntegrityError` on a corrupted/truncated pod).
  *   2. `verifyPodHeader` — only when `opts.trustedKeys` is supplied.
  *      `'unsigned'` is benign (legacy pod, or `writePod({ sign: false })`)
  *      and open() proceeds; `'untrusted'` / `'tampered'` are fail-closed —
@@ -63,7 +63,7 @@
  * @module
  */
 import type { NoydbPodHeader } from './format.js';
-import type { PodVerifyResult } from './bundle.js';
+import type { PodVerifyResult } from './pod.js';
 import type { Noydb } from '../kernel/noydb.js';
 import type { Vault } from '../kernel/vault.js';
 import type { NoydbOptions, NoydbStore, EchoSecretParts } from '../kernel/types.js';

package/dist/with-pod/pod-handle.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Vault bundle handle — the stable opaque ULID identifying a vault
+ * across `.noydb` exports.
+ *
+ * Behaviour is byte-identical to the inline `Vault.getPodHandle`
+ * method this function replaced. `Vault` keeps the public method as
+ * a thin delegator.
+ *
+ * Internal — reached through `vault.getPodHandle()`.
+ */
+import type { NoydbStore } from '../kernel/types.js';
+/**
+ * Return the stable opaque bundle handle for the given vault adapter,
+ * generating and persisting a fresh ULID on first call.
+ *
+ * See {@link import('../kernel/vault.js').Vault.getPodHandle} for
+ * the full rationale and storage-path documentation.
+ */
+export declare function buildPodHandle(adapter: NoydbStore, name: string): Promise<string>;

package/dist/with-pod/pod-store.d.ts

@@ -44,11 +44,3 @@ export declare function wrapPodStore(bundle: NoydbPodStore, options?: WrapPodSto
  * analogous to `createStore` for KV stores.
  */
 export declare function createPodStore<TOptions>(factory: (options: TOptions) => NoydbPodStore): (options: TOptions) => NoydbPodStore;
-/** @deprecated Use wrapPodStore. */
-export declare const wrapBundleStore: typeof wrapPodStore;
-/** @deprecated Use createPodStore. */
-export declare const createBundleStore: typeof createPodStore;
-/** @deprecated Use WrappedPodNoydbStore. */
-export type WrappedBundleNoydbStore = WrappedPodNoydbStore;
-/** @deprecated Use WrapPodStoreOptions. */
-export type WrapBundleStoreOptions = WrapPodStoreOptions;

package/dist/with-pod/{bundle.d.ts → pod.d.ts}

@@ -36,9 +36,9 @@ import { type NoydbPodHeader, type UnlockMethod } from './format.js';
 import type { Redirect } from './redirect.js';
 import type { DocSigner } from '../with-audit/attestation/signer.js';
 import type { Vault } from '../kernel/vault.js';
-import type { BundleRecipient } from '../with-party/team/keyring.js';
+import type { PodRecipient } from '../with-party/team/keyring.js';
 import type { Cover } from '../with-party/directory/cover/types.js';
-import type { SealingKeyProvider, RecipientSealer, RecipientHint } from '../with-party/team/managed-secret.js';
+import type { NoydbSealer, RecipientSealer, RecipientHint } from '../with-party/team/managed-secret.js';
 /**
  * The credential kinds that can be bundled for auto-unlock.
  * WebAuthn is intentionally excluded — it is hardware-bound and
@@ -128,7 +128,7 @@ export interface WritePodOptions {
      * the bundle inherits the source keyring as-is (today's behaviour,
      * suited to personal backup-and-restore).
      */
-    readonly recipients?: readonly BundleRecipient[];
+    readonly recipients?: readonly PodRecipient[];
     /**
      * Auto-unlock — unsealed per-user credentials.
      *
@@ -152,7 +152,7 @@ export interface WritePodOptions {
     };
     /**
      * Auto-unlock — per-user credentials sealed under a
-     * {@link SealingKeyProvider}.
+     * {@link NoydbSealer}.
      *
      * Generalises `sealedSecrets` to support any bundleable
      * credential kind (`secret` | `password` | `pin`).
@@ -177,7 +177,7 @@ export interface WritePodOptions {
      */
     readonly sealedCredentials?: {
         readonly mode: 'self-target';
-        readonly provider: SealingKeyProvider;
+        readonly provider: NoydbSealer;
         readonly perUser: Record<string, AutoCredential>;
     } | {
         readonly mode: 'recipient-target';
@@ -211,7 +211,7 @@ export interface WritePodOptions {
      * @deprecated Use `sealedCredentials` instead.
      *
      * Auto-unlock — per-user secrets sealed under a
-     * {@link SealingKeyProvider} (self-target only).
+     * {@link NoydbSealer} (self-target only).
      *
      * The hub seals each user's plaintext secret under `provider`
      * and embeds the resulting sealed envelopes in the bundle. The
@@ -229,7 +229,7 @@ export interface WritePodOptions {
      */
     readonly sealedSecrets?: {
         readonly mode: 'self-target';
-        readonly provider: SealingKeyProvider;
+        readonly provider: NoydbSealer;
         readonly perUser: Record<string, string>;
     };
     /**
@@ -266,8 +266,6 @@ export interface WritePodOptions {
      */
     readonly redirect?: Redirect;
 }
-/** @deprecated Use `WritePodOptions`. */
-export type WriteNoydbBundleOptions = WritePodOptions;
 /**
  * Every key `writePod` reads, in declaration order (#991).
  *
@@ -289,7 +287,7 @@ export declare const WRITE_POD_OPTION_KEYS: readonly ["compression", "collection
  * actually restore a vault. Splitting the layers keeps the
  * bundle module free of crypto concerns — see file-level docs.
  */
-export interface NoydbBundleReadResult {
+export interface PodReadResult {
     readonly header: NoydbPodHeader;
     readonly dumpJson: string;
     /**
@@ -317,7 +315,7 @@ export interface NoydbBundleReadResult {
  * auto-unlock paths. Without these the reader behaves exactly as before
  * (header parsed; body returned as `dumpJson`).
  */
-export interface ReadNoydbBundleOptions {
+export interface ReadPodOptions {
     /**
      * Recipient-side sealing providers used to unseal entries from
      * `sealedSecrets`. The reader picks the one whose `.id`
@@ -328,7 +326,7 @@ export interface ReadNoydbBundleOptions {
      * `autoUnlock.perUser` map remains the SEALED entries unmodified
      * — callers can inspect them or unseal elsewhere.
      */
-    readonly sealingProviders?: readonly SealingKeyProvider[];
+    readonly sealingProviders?: readonly NoydbSealer[];
     /**
      * Opt-in trial mode for unsealing — when an entry's `pid` doesn't
      * match a registered provider, try each provider whose alg
@@ -373,7 +371,7 @@ export declare function resetBrotliSupportCache(): void;
  *
  * Pipeline:
  *   1. Resolve or create the compartment's stable bundle handle
- *      via `vault.getBundleHandle()` — same handle on
+ *      via `vault.getPodHandle()` — same handle on
  *      every export from the same vault instance, so cloud
  *      adapters can use it as a primary key.
  *   2. `vault.dump()` → JSON string with encrypted records
@@ -398,7 +396,7 @@ export declare function resetBrotliSupportCache(): void;
  *
  * @internal
  */
-export declare function assembleBundleContainer(opts: {
+export declare function assemblePodContainer(opts: {
     handle: string;
     bodyJsonStr: string;
     compression: WritePodOptions['compression'];
@@ -413,8 +411,6 @@ export declare function assembleBundleContainer(opts: {
     signer?: DocSigner;
 }): Promise<Uint8Array>;
 export declare function writePod(vault: Vault, opts?: WritePodOptions): Promise<Uint8Array>;
-/** @deprecated Use `writePod`. */
-export declare const writeNoydbBundle: typeof writePod;
 /**
  * Read just the bundle header — no body decompression, no
  * integrity verification. Intended for cloud-listing UIs that want
@@ -430,8 +426,6 @@ export declare const writeNoydbBundle: typeof writePod;
  * range requests against bundles that may carry icons.
  */
 export declare function readPodHeader(bytes: Uint8Array): NoydbPodHeader;
-/** @deprecated Use `readPodHeader`. */
-export declare const readNoydbBundleHeader: typeof readPodHeader;
 /**
  * Outcome of {@link verifyPodHeader}.
  *
@@ -457,7 +451,7 @@ export interface PodVerifyResult {
  * (`keyId → publicKeyB64` the caller already trusts), it reports whether the
  * header was signed by a trusted document signer.
  *
- * Pairs with the signing half in `assembleBundleContainer`/`writePod`: the
+ * Pairs with the signing half in `assemblePodContainer`/`writePod`: the
  * signed payload is the final wire header with `sig` removed, so verification
  * reconstructs it by stripping EXACTLY the `sig` field — `keyId`, `sigAlg`,
  * and every other header field stay in the verified payload.
@@ -469,7 +463,7 @@ export interface PodVerifyResult {
  * header (which includes the *claimed* `bodySha256`) is signed by a trusted
  * key; it does NOT prove the body matches that hash. To trust the pod's
  * BODY you MUST also confirm the body hashes to `header.bodySha256` — call
- * `readPod`, which throws `BundleIntegrityError` on mismatch. A `verified`
+ * `readPod`, which throws `PodIntegrityError` on mismatch. A `verified`
  * header paired with a swapped body is caught only by that integrity check.
  * This function stays body-free by design so a static page can authenticate a
  * header without decompressing the body; composing the two checks is the
@@ -498,7 +492,7 @@ export declare function readPodCover(bytes: Uint8Array, opts?: {
  * the header's `redirect` field or `undefined` if the bundle was written
  * without one.
  *
- * The record is returned UNVERIFIED: `validateBundleHeader` only checks
+ * The record is returned UNVERIFIED: `validatePodHeaderFields` only checks
  * its shape at parse time (a parser has no `trustedKeys`). Callers that
  * intend to follow the redirect MUST separately call `verifyRedirect`
  * (`redirect.js`) before trusting `target`.
@@ -510,7 +504,7 @@ export declare function readPodRedirect(bytes: Uint8Array): Redirect | undefined
  * original `vault.dump()` JSON string ready to pass to
  * `vault.load()`.
  *
- * Throws `BundleIntegrityError` if the body's actual SHA-256 does
+ * Throws `PodIntegrityError` if the body's actual SHA-256 does
  * not match the value declared in the header. Distinct from a
  * format error so consumers can pattern-match in catch blocks
  * (corrupted-in-transit vs malformed-by-producer).
@@ -522,6 +516,4 @@ export declare function readPodRedirect(bytes: Uint8Array): Redirect | undefined
  * free of crypto concerns and lets the same code feed format
  * inspectors that never decrypt anything.
  */
-export declare function readPod(bytes: Uint8Array, opts?: ReadNoydbBundleOptions): Promise<NoydbBundleReadResult>;
-/** @deprecated Use `readPod`. */
-export declare const readNoydbBundle: typeof readPod;
+export declare function readPod(bytes: Uint8Array, opts?: ReadPodOptions): Promise<PodReadResult>;

package/dist/with-pod/ulid.d.ts

@@ -39,7 +39,7 @@
  *
  * If a future use case needs timestamp-free handles, a v2 of the
  * format could specify "use the random portion only" without a
- * format break — `validateBundleHeader` only checks the regex
+ * format break — `validatePodHeaderFields` only checks the regex
  * shape, not the encoded timestamp.
  */
 /**

package/dist/with-shape/blobs/blob-compaction.d.ts

@@ -30,6 +30,7 @@
  */
 import type { NoydbStore, SlotInfo } from '../../kernel/types.js';
 import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import { type OrphanChunkReport } from './orphan-report.js';
 export interface BlobFieldPolicy<T = unknown> {
     /**
      * Via port brand marker — lets a `BlobFieldPolicy` satisfy the kernel's
@@ -145,6 +146,18 @@ export interface CompactionResult {
         records: number;
         evicted: number;
     }>;
+    /**
+     * #1133 — chunk rows in `_blob_chunks` with no surviving `_blob_index` entry.
+     * Pre-#1127 residue: unreachable by every reader AND by rotation, so for a
+     * legacy blob the bytes stay openable under a retired `_blob` DEK.
+     *
+     * REPORTED, never reclaimed — deciding "orphaned" means trusting the store's
+     * `list`, and a store that withholds one index row would have us destroy a
+     * LIVE blob's chunks. See `orphan-report.ts` for the full argument. A vault
+     * that has run `migrate()` has no legacy chunks to strand, and `chunks: 0`
+     * is the expected reading everywhere else.
+     */
+    readonly orphanBlobChunks: OrphanChunkReport;
 }
 export interface CompactRunOptions {
     /** Override "now" for deterministic testing. */

package/dist/with-shape/blobs/blob-set.d.ts

@@ -13,7 +13,7 @@ export declare const BLOB_COLLECTION = "_blob";
 /** Stores `BlobObject` metadata envelopes, keyed by eTag. */
 export declare const BLOB_INDEX_COLLECTION = "_blob_index";
 /**
- * Stores encrypted chunk envelopes, keyed by `{eTag}/{chunkIndex}`.
+ * Stores encrypted chunk envelopes, keyed by `{eTag}_{chunkIndex}`.
  * NOT loaded into the in-memory query layer. Fetched on demand by
  * `BlobSet.get()` / `BlobSet.response()`.
  */
@@ -39,14 +39,14 @@ export declare const DEFAULT_CHUNK_SIZE: number;
  *
  * ```
  * _blob_index/{eTag}                            BlobObject metadata (vault-shared DEK)
- * _blob_chunks/{eTag}/{chunkIndex}              Encrypted chunk data (vault-shared DEK + AAD)
+ * _blob_chunks/{eTag}_{chunkIndex}              Encrypted chunk data (vault-shared DEK + AAD)
  * _blob_slots_{collection}/{recordId}           Slot map (parent collection DEK)
  * _blob_versions_{collection}/{recordId}/{slot}/{label}  Published versions (parent collection DEK)
  * ```
  *
  * ## Deduplication
  *
- * `put()` computes `eTag = HMAC-SHA-256(blobDEK, plaintext)` — keyed so the
+ * `put()` computes `eTag = HMAC-SHA-256(addressKey(tier), plaintext)` — keyed so the
  * store cannot predict eTags for known content. If another record already
  * uploaded the same bytes, the chunks are reused and `refCount` is incremented.
  *
@@ -179,6 +179,24 @@ export declare class BlobSet {
      * write throws an AEAD decrypt error rather than silently writing under
      * the wrong key.
      */
+    /**
+     * The content-addressing key for `tier` (#1126).
+     *
+     * Derived from `_blob_addr`, a vault-lifetime keyring slot `rotateKeys`
+     * refuses to touch — so a rotation re-keys chunk BODIES while every stored
+     * eTag, and therefore every chunk AAD and every `_blob_index` /
+     * `_blob_slots_*` / `_blob_versions_*` row, survives it unchanged.
+     *
+     * Before this the address was keyed by the `_blob` DEK itself, so after any
+     * rotation `HMAC(live DEK, plaintext) !== storedETag` permanently, for every
+     * blob written earlier: `decryptResponse()` raised `TamperedError` on the
+     * presigned-URL path forever, and dedup split.
+     *
+     * Still derived PER TIER, because the address is meant to be tier-scoped —
+     * `rehomeForTier` re-addresses on a tier move for exactly that reason. Only
+     * the ROTATION coupling was ever wrong.
+     */
+    private addressKey;
     private ownerTier;
     /**
      * The sanctioned cleared-read path to an elevated record's blobs (#749).
@@ -424,16 +442,70 @@ export declare class BlobSet {
      *  - not yet stamped → apply via `casUpdateRefCountStamped`, then proceed
      *    exactly like the unstamped path below.
      *
-     * A crash can also land AFTER the index row is deleted but BEFORE every
-     * chunk is — `loadBlobObject` then returns null (indistinguishable from
-     * "never existed") and the object's `chunkCount` is gone with it. A
-     * stamped caller who knows the true count (the journal marker's captured
-     * `holds`, once that plumbing lands) supplies it via `chunkCountHint` so
-     * this call can still finish the chunk deletion; without it, an
-     * already-index-gone eTag is reported `'shredded'` same as today (best
+     * A crash can also land part-way through the deletion itself. Since #1127
+     * that deletion runs CHUNKS FIRST (see `deleteChunksThenIndex`), so what
+     * survives is an index row with some chunks already gone — a reachable,
+     * re-runnable state rather than chunks nothing can ever address again.
+     *
+     * An eTag whose index row is ALREADY absent on entry is therefore either
+     * pre-#1127 residue or a completed deletion. `loadBlobObject` returns null
+     * (indistinguishable from "never existed") and the object's `chunkCount` is
+     * gone with it. A stamped caller who knows the true count (the journal
+     * marker's captured `holds`, once that plumbing lands) supplies it via
+     * `chunkCountHint` so this call can still finish the chunk deletion; without
+     * it, an already-index-gone eTag is reported `'shredded'` same as today (best
      * effort — nothing left to key the cleanup off of).
      */
     private releaseRef;
+    /**
+     * Delete a blob's chunks, THEN its index row. The order is the whole point
+     * (#1127).
+     *
+     * Both deletions used to run index-first, which meant a crash in between
+     * stranded chunks with no index row. Nothing can ever reach those again:
+     * `loadBlobObject` returns null, so no reader addresses them — and
+     * `rekeyBlobSet` derives its chunk ids from each index entry's `chunkCount`,
+     * so a rotation never visits them either. For a LEGACY blob (bytes under the
+     * `_blob` DEK itself rather than a per-blob content CEK) the bodies then stay
+     * openable under the retired `_blob` DEK — precisely the key a revoked member
+     * walked away with. Crash during `forget()`, revoke later, and real blob
+     * content sits readable indefinitely, with no error on either side.
+     *
+     * Reversing it removes the class rather than cleaning up after it: every
+     * chunk that still exists has an index row, so every chunk is reachable by
+     * `rekeyBlobSet` and gets re-keyed. There is no orphan to sweep because none
+     * is produced.
+     *
+     * The residue this ordering leaves instead is an index row whose chunks are
+     * partly gone. That state is better, but it is NOT free — it cost one reader
+     * correction (`resolveRehomedVersionETag`, which read an old blob's bytes
+     * while resuming a rehome and now checks `refCount <= 0` instead of relying
+     * on the row having vanished). An earlier draft of this comment called the
+     * new state "strictly better"; the full suite disproved that, and any future
+     * path that reads a blob by index needs the same care. What is true of it:
+     *   - it is REACHABLE, so a re-run of `releaseRef` completes the deletion
+     *     idempotently (both `store.delete` calls are void on an absent key);
+     *   - `rekeyBlobSet` already tolerates it — a missing chunk hits its
+     *     `if (!chunkEnv || !chunkEnv._iv) continue`, so a rotation still
+     *     succeeds and still re-keys every chunk that remains;
+     *   - it cannot leak, because the bytes that survive are the ones still
+     *     covered by rotation.
+     *
+     * This also makes one ordering rule true across the blob subsystem rather
+     * than two opposite ones: `kernel/enclave/record-keys/rekey-blob.ts` already
+     * re-encrypts chunks before re-sealing their index entry, and documents that
+     * order as its resume property.
+     *
+     * Deliberately NOT paired with a sweep that deletes pre-existing orphans:
+     * such a sweep must decide "orphaned" from `store.list(_blob_index)`, and the
+     * store is untrusted. A store that withholds one index row could make a LIVE
+     * blob's chunks look orphaned and have us destroy them — turning withholding,
+     * which is reversible, into permanent loss. Reporting them is safe; deleting
+     * them on the store's word is not. The report half shipped as
+     * `reportOrphanBlobChunks` (#1133), surfaced through `vault.compact()`; a
+     * reclaim pass remains deliberately unbuilt for the reason above.
+     */
+    private deleteChunksThenIndex;
     /**
      * Crypto-shred this record's blob attachments — called by
      * `vault.forget()`.
@@ -986,7 +1058,7 @@ export declare class BlobSet {
      * attacker-controlled content pulled from the same forged row and would
      * make the check tautological). After assembling the plaintext, we
      * recompute the SAME content address every write path mints
-     * (`hmacSha256Hex(flatBlobDEK, plaintext)` — `writeBlobContent`'s Step 1,
+     * (`hmacSha256Hex(addressKey(tier), plaintext)` — `writeBlobContent`'s Step 1,
      * unconditional on `_cek`) and compare it to that requested eTag. A
      * forged row can produce valid ciphertext under the flat DEK, but can't
      * produce plaintext that re-hashes to an address it doesn't control.

package/dist/with-shape/blobs/orphan-report.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Orphan blob-chunk REPORT (#1133) — the read-only half of the residue #1127
+ * stopped producing.
+ *
+ * Before #1127, `releaseRef` deleted a blob's index row BEFORE its chunks, so a
+ * crash in between stranded chunk bodies nothing can ever reach: `loadBlobObject`
+ * returns null so no reader addresses them, and `rekeyBlobSet` derives its chunk
+ * ids from each index entry's `chunkCount` so a rotation never visits them. For a
+ * LEGACY blob (bytes under the shared `_blob` DEK rather than a per-blob content
+ * CEK) those bodies then stay openable under the retired DEK indefinitely.
+ *
+ * #1127 reversed the order, which removes the class at the source. It does
+ * nothing for orphans created before the fix, and this module does not delete
+ * them either. It counts them.
+ *
+ * ## Why this REPORTS and does not RECLAIM
+ *
+ * Deciding "orphaned" requires `store.list(_blob_index)`, and the store is
+ * untrusted — that is the premise of the product, not a caveat on it. A store
+ * that withholds a single index row makes a LIVE blob's chunks look orphaned. A
+ * reclaim pass acting on that would convert **withholding**, which is reversible
+ * the moment the store stops lying, into **permanent destruction** — handing an
+ * untrusted store a data-loss primitive it does not currently have, in order to
+ * tidy up residue.
+ *
+ * Reporting inverts the risk to something harmless: a lying store can only
+ * inflate this count. Nothing is deleted on its word, so the worst outcome is an
+ * operator investigating residue that turns out not to exist.
+ *
+ * Re-keying is not an alternative either: the chunk AAD is
+ * `{eTag}:{chunkIndex}:{chunkCount}`, and `chunkCount` lives only in the index
+ * row that is already gone — an orphan's AAD is unreconstructable, so it cannot
+ * be decrypted-and-re-encrypted at all.
+ */
+import type { NoydbStore } from '../../kernel/types.js';
+export interface OrphanChunkReport {
+    /** Chunk rows whose eTag has no `_blob_index` entry. */
+    readonly chunks: number;
+    /** Distinct eTags those chunks belong to. */
+    readonly eTags: number;
+    /**
+     * Up to {@link SAMPLE_LIMIT} of those eTags, so an operator can inspect a real
+     * one rather than only a count. Deterministic (store list order), not random.
+     */
+    readonly sampleETags: readonly string[];
+    /**
+     * Chunk ids that do not match the `{eTag}_{index}` grammar at all. Counted
+     * rather than skipped: an id this module cannot parse is a thing it cannot
+     * classify either way, and reporting zero orphans while silently dropping
+     * such ids would be the reassuring-but-wrong answer.
+     */
+    readonly unparseable: number;
+}
+/**
+ * Count chunk rows with no surviving index row. Read-only: two `list` calls and
+ * no `get`, no `delete`, and no decryption — an orphan cannot be opened anyway.
+ *
+ * A store that cannot list either collection yields an empty report rather than
+ * throwing: this is a diagnostic riding along with a maintenance pass, and it
+ * must not be able to fail one.
+ */
+export declare function reportOrphanBlobChunks(adapter: NoydbStore, vault: string): Promise<OrphanChunkReport>;

package/dist/with-shape/introspection/describe.d.ts

@@ -71,7 +71,7 @@ export interface DescribedField {
     };
     /**
      * Normalized lookup metadata (#650 Task 7 — the first-ever
-     * `ViaBinding.describeFragment` consumer; sourced from the `'lookup'`
+     * `NoydbVia.describeFragment` consumer; sourced from the `'lookup'`
      * binding's fragment, NOT from config directly — see `buildDescription`).
      * Present for every `lookup()`/`enumOf()`/`dict()` field, ALONGSIDE the
      * pre-existing `dict` block above (kept byte-stable for the
@@ -245,7 +245,7 @@ export interface BuildDescriptionInput {
     } | undefined;
     /**
      * Per-binding `describeFragment()` output, keyed by binding brand (#650
-     * Task 7 — first-ever consumer of `ViaBinding.describeFragment`,
+     * Task 7 — first-ever consumer of `NoydbVia.describeFragment`,
      * `via/index.ts:136`). `Collection.describe()`/`describeAsync()` build this
      * from `this.via?.describeFragments()`. The `'lookup'` brand's fragment
      * feeds the `lookup` block below; `'blob'`'s feeds the `blob` block

package/dist/with-shape/schema-update/fence-controller.d.ts

@@ -7,14 +7,14 @@
  * migrator waits for the active client set (registry heartbeats) to ack
  * the draining generation before transforming. No leader election.
  *
- * The transport is the injected {@link CoordinationProvider} port: the
- * default {@link StoreCoordinationProvider} maps it onto today's
+ * The transport is the injected {@link NoydbMesh} port: the
+ * default {@link StoreMesh} maps it onto today's
  * `_meta/schema-fence` store ops, so behavior is byte-for-byte the same;
  * `by-tabs` / `by-peer` swap in real-time push transports.
  */
 import { type FenceState } from './fence.js';
 import type { TransformFn } from './types.js';
-import { type CoordinationProvider } from '../../port/by/index.js';
+import { type NoydbMesh } from '../../port/by/index.js';
 /** Runs one collection's transform; supplied by the Vault (binds to a Collection). */
 export type RunTransform = (collection: string, transform: TransformFn) => Promise<void>;
 /** Structural (no static import — kernel-spine port-layering carve-out, same rationale as
@@ -51,7 +51,7 @@ export declare function schemaBumpAuditHook(getLedger: () => AuditLedgerLike | n
 export declare class SchemaFenceController {
     #private;
     constructor(opts: {
-        coordination: CoordinationProvider;
+        coordination: NoydbMesh;
         vault: string;
         onFlush: () => Promise<void>;
         /** Stable per-instance id; the migrator excludes itself from the barrier. */