@noy-db/hub 0.7.0 → 0.8.0-pre.0

package/dist/{chunk-6GOE5PGN.js → chunk-T2LBQ5DV.js}

@@ -1,27 +1,27 @@
-import {
-  isManifestReservedCollection
-} from "./chunk-EPFF7LOX.js";
 import {
   LinkIntegrityError,
   declareLink,
   isLinkCollectionName,
   linkCollectionName,
   linkRowKey
-} from "./chunk-QIZPZMUI.js";
+} from "./chunk-AOWGXU6D.js";
 import {
   hashFields,
   validateSatelliteDeclaration
-} from "./chunk-TUFM4UZP.js";
+} from "./chunk-6K7DPM7D.js";
 import {
   resolveStaleOnRead
-} from "./chunk-SMH6SRX7.js";
+} from "./chunk-TROR3ALR.js";
+import {
+  isManifestReservedCollection
+} from "./chunk-EPFF7LOX.js";
 import {
   loadFence
-} from "./chunk-453F654R.js";
+} from "./chunk-L7DOS3TE.js";
 import {
   buildPersistedIndexCallbacks,
   syncTierSearch
-} from "./chunk-SPXXX5E4.js";
+} from "./chunk-6LNL42F5.js";
 import {
   isBaseLive,
   liveBaseIdSet
@@ -29,80 +29,99 @@ import {
 import {
   SchemaUpdateGate
 } from "./chunk-6LJY7X5A.js";
-import {
-  NO_ATTESTATION
-} from "./chunk-Q7HZX3IF.js";
 import {
   NO_TIERS,
   classifySealedShred,
   syncDerivedOutputs
-} from "./chunk-KJIMGIWO.js";
+} from "./chunk-UPD5NWI5.js";
 import {
   NO_PORTABILITY
-} from "./chunk-BZ3534YM.js";
+} from "./chunk-ZUVBC32X.js";
 import {
   NO_CARGO
-} from "./chunk-NQKIUNW5.js";
+} from "./chunk-A6IJU4TK.js";
+import {
+  fallbackDerivationName
+} from "./chunk-RXLYKVTF.js";
 import {
   saveSealedSecret
-} from "./chunk-4GVM6QZA.js";
+} from "./chunk-ENAG3IY7.js";
 import {
   runDrainBarrier
-} from "./chunk-VTFVLCUH.js";
+} from "./chunk-3JWHAR6E.js";
 import {
-  fallbackDerivationName
-} from "./chunk-RXLYKVTF.js";
+  findRollupSpecForIntent,
+  forgetDerivedFanout,
+  ledgerAuditHook,
+  putDerivedOutput,
+  resolveRollupDeleteIntents,
+  runGraphDispatchWave,
+  selfWriteFieldEqual,
+  touchFor
+} from "./chunk-K6W7BVZ6.js";
+import {
+  OverlayedCollection
+} from "./chunk-MLPHLJIQ.js";
+import {
+  INDEXED_STORE_POLICY,
+  NO_SYNC
+} from "./chunk-T7IR4N2S.js";
+import {
+  NO_ATTESTATION
+} from "./chunk-X4773RBR.js";
+import {
+  NO_SHADOW
+} from "./chunk-SMY5X46Z.js";
+import {
+  NO_SNAPSHOTS
+} from "./chunk-DZFQVICS.js";
+import {
+  TxContext,
+  bestEffortRevert,
+  trackKeyedWrite
+} from "./chunk-5FDLC6G7.js";
+import {
+  lazy
+} from "./chunk-5D2ALSM5.js";
+import {
+  INDEX_SNAPSHOT_VERSION,
+  InvertedIndex,
+  MemoryIndexStore,
+  NO_SEARCH
+} from "./chunk-I3JDRCMW.js";
 import {
   NO_SEQUENCE,
   SEQUENCE_COLLECTION,
   compileSequenceFormat,
   resolveSequenceKey
-} from "./chunk-ZVO4QVPD.js";
+} from "./chunk-M522UYZ2.js";
 import {
   CustodyApi,
   NO_CUSTODY
-} from "./chunk-GPEQUXHL.js";
+} from "./chunk-B6SJIBQK.js";
 import {
   DEFAULT_POSTURE,
-  EXPORT_REDACTION_MARKER,
   ViaGraph,
-  ViaPipeline,
   buildDescription,
   collectKnownFieldNames,
   computedEntryParts,
   deriveZodFields,
-  exportRedact,
   guardReconcileCollisions,
   mergeViaFields,
   resolveCollectionConfig,
   resolveComputedEdges,
   resolveDescribeFieldIds,
   resolveVirtualMoneyFields
-} from "./chunk-2C3AQB46.js";
+} from "./chunk-UD5EVGZ7.js";
 import {
   findMatchingIdsByPairs
 } from "./chunk-TFMM5DBB.js";
 import {
   encodeVecId
-} from "./chunk-RTBJ5IOO.js";
-import {
-  NO_CLASSIFIED,
-  guardClassifiedCompat,
-  resolveClassifiedFields
-} from "./chunk-5VCRVKOZ.js";
+} from "./chunk-MDWKM2XC.js";
 import {
   derivePersistedSchema
-} from "./chunk-REDOOY2Q.js";
-import {
-  findRollupSpecForIntent,
-  forgetDerivedFanout,
-  ledgerAuditHook,
-  putDerivedOutput,
-  resolveRollupDeleteIntents,
-  runGraphDispatchWave,
-  selfWriteFieldEqual,
-  touchFor
-} from "./chunk-CARABLSQ.js";
+} from "./chunk-PSIV7CJV.js";
 import {
   buildLookupAltIndex,
   buildLookupSnapshotRows,
@@ -117,25 +136,47 @@ import {
   resolveDictSource,
   resolveLabelFromMap,
   updateReferencingRecords
-} from "./chunk-U4FOQDY4.js";
+} from "./chunk-FH2L2E34.js";
 import {
-  OverlayedCollection
-} from "./chunk-SKGMN35F.js";
+  NO_CLASSIFIED,
+  guardClassifiedCompat,
+  resolveClassifiedFields
+} from "./chunk-QOOUUR4A.js";
 import {
-  INDEXED_STORE_POLICY,
-  NO_SYNC
-} from "./chunk-T7IR4N2S.js";
+  LazyQuery,
+  NO_INDEXING,
+  compositeKey,
+  decodeIdxId,
+  encodeIdxId
+} from "./chunk-HBRLNOHL.js";
+import {
+  IMPLICIT_LAZY
+} from "./chunk-66TQOPFM.js";
+import {
+  estimateRecordBytes
+} from "./chunk-V4PXLYWM.js";
+import {
+  canonicalGroupKey
+} from "./chunk-XZHEOSQ2.js";
+import {
+  NO_CRDT
+} from "./chunk-PVEWA2DU.js";
 import {
   NO_CONSENT
 } from "./chunk-PEOZ34EM.js";
+import {
+  NO_COVERAGE
+} from "./chunk-RHVMZSUU.js";
 import {
   NO_PERIODS,
   isEffectivelyReopened,
+  isOrderableBusinessDate,
+  malformedBusinessDate,
   purgeMarkersOn,
   resolvePeriodKey,
   resolveReopenState,
   samePartition
-} from "./chunk-PT43Y56J.js";
+} from "./chunk-NRT6QZQB.js";
 import {
   PERIODS_COLLECTION,
   PERIOD_ARCHIVES_COLLECTION,
@@ -143,78 +184,50 @@ import {
   PERIOD_REOPENS_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION,
   periodExclusiveUpperBound
-} from "./chunk-FAHMLERK.js";
+} from "./chunk-FW22ZCXT.js";
 import {
-  NO_SHADOW
-} from "./chunk-SMY5X46Z.js";
+  NO_SEALED_RECORD
+} from "./chunk-PDCG6PR5.js";
 import {
-  NO_SNAPSHOTS
-} from "./chunk-DZFQVICS.js";
+  normalizeIndexDefs,
+  parseFieldIndexSnapshot
+} from "./chunk-YSK2CU2Q.js";
 import {
-  TxContext,
-  bestEffortRevert
-} from "./chunk-BLN54W3L.js";
+  EXPORT_REDACTION_MARKER,
+  ViaPipeline,
+  exportRedact
+} from "./chunk-ORDURZBU.js";
 import {
-  lazy
-} from "./chunk-5D2ALSM5.js";
+  ScanBuilder
+} from "./chunk-F24ZZTHQ.js";
 import {
-  InvertedIndex,
-  MemoryIndexStore,
-  NO_SEARCH
-} from "./chunk-UXWB3FPF.js";
+  Query
+} from "./chunk-7JE7BDYJ.js";
 import {
-  NO_SEALED_RECORD
-} from "./chunk-6YXCPL4T.js";
+  NO_REDUCE
+} from "./chunk-3TDUWVWB.js";
 import {
-  Query,
-  ScanBuilder
-} from "./chunk-7MG2LHO5.js";
+  readPath
+} from "./chunk-HLEK5VAN.js";
 import {
   EXPORT_AUDIT_COLLECTION,
   NO_BLOBS,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-AO42KJO6.js";
-import {
-  LazyQuery,
-  NO_INDEXING,
-  decodeIdxId,
-  encodeIdxId
-} from "./chunk-KTFRCC5C.js";
-import {
-  normalizeIndexDefs
-} from "./chunk-I3ISCYT7.js";
-import {
-  IMPLICIT_LAZY
-} from "./chunk-66TQOPFM.js";
-import {
-  estimateRecordBytes
-} from "./chunk-V4PXLYWM.js";
-import {
-  canonicalGroupKey
-} from "./chunk-XZHEOSQ2.js";
-import {
-  NO_REDUCE
-} from "./chunk-YMUFFJCO.js";
-import {
-  readPath
-} from "./chunk-NSITFOCJ.js";
-import {
-  NO_CRDT
-} from "./chunk-PVEWA2DU.js";
+} from "./chunk-GF5BZ7D4.js";
 import {
   dictCollectionName
-} from "./chunk-6I2RQCET.js";
+} from "./chunk-DF73H4UN.js";
 import {
   NO_I18N,
   getAtPath,
   isDictCollectionName,
   isStaticDictDescriptor
-} from "./chunk-TRGTKX5E.js";
+} from "./chunk-GHLTDZRS.js";
 import {
   isViaInstalled,
   viaBinder
-} from "./chunk-UXVWEX5L.js";
+} from "./chunk-Z5HTYMMQ.js";
 import {
   NO_TEAM,
   describeAllUsersAuth,
@@ -237,7 +250,7 @@ import {
   saveShamirRecoveryEntries,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-RRNRNANG.js";
+} from "./chunk-ZE4CHIED.js";
 import {
   assertKeyringOpenAllowed,
   buildRecipientKeyringFile,
@@ -252,15 +265,15 @@ import {
   listUsers,
   loadKeyring,
   updateKeyringIdentity
-} from "./chunk-G56KBWFY.js";
+} from "./chunk-M7NI3IWE.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
-} from "./chunk-KG7TZKZG.js";
+} from "./chunk-7VCXZDA4.js";
 import {
   NO_BROKER,
   buildCredentialBrokerHandle
-} from "./chunk-JBDFMYKQ.js";
+} from "./chunk-4AF3TUMP.js";
 import {
   NO_SESSION
 } from "./chunk-VKQCVU2Z.js";
@@ -269,16 +282,16 @@ import {
 } from "./chunk-4AOERLTV.js";
 import {
   NO_HISTORY
-} from "./chunk-X2DLENDQ.js";
+} from "./chunk-QWGU66MP.js";
 import {
   sha256Hex
-} from "./chunk-BOET4NA4.js";
+} from "./chunk-CKNGS5MH.js";
 import {
   assertCutoverTierSafe,
   assertTierWritable,
   dekKey,
   liveRecordIsElevated
-} from "./chunk-JMGDHKQF.js";
+} from "./chunk-JCN44NCY.js";
 import {
   NO_VAULT_HEAD
 } from "./chunk-HK67PX4J.js";
@@ -290,7 +303,7 @@ import {
   readDottedPath,
   rebuildSubjectIndex,
   removeSubjectRef
-} from "./chunk-7V4TP3AF.js";
+} from "./chunk-J6UOHJY5.js";
 import {
   RecordCodec,
   SEALED_CEK_NS,
@@ -306,20 +319,20 @@ import {
   rewrapBodyToDek,
   validateSchemaInput,
   verifyRecordIdentity
-} from "./chunk-77K4PG6P.js";
+} from "./chunk-KJFW62P4.js";
 import {
   buildDeleteMarker,
   buildRecordEnvelope,
   buildTombstone,
   isDeleteMarker,
   isTombstone
-} from "./chunk-SZJ3DLZA.js";
+} from "./chunk-SEE332EV.js";
 import {
   encrypt
-} from "./chunk-SL3JAAKN.js";
+} from "./chunk-UYB234ZR.js";
 import {
   SealedHandle
-} from "./chunk-7MG7SJT7.js";
+} from "./chunk-ODVPTDPK.js";
 import {
   AlreadyElevatedError,
   AttestationError,
@@ -357,10 +370,9 @@ import {
   TierNotGrantedError,
   USER_ENVELOPE_COLLECTION,
   UniqueConstraintError,
-  UnsupportedIndexOptionError,
   ValidationError,
   isConflictError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-244VXYPG.js";
 
 // src/kernel/merge-authority.ts
 function buildMergeAuthority(keyring) {
@@ -442,6 +454,7 @@ var STRATEGY_DEFAULTS = {
   cargo: NO_CARGO,
   classified: NO_CLASSIFIED,
   consent: NO_CONSENT,
+  coverage: NO_COVERAGE,
   crdt: NO_CRDT,
   custody: NO_CUSTODY,
   forget: NO_FORGET,
@@ -540,7 +553,7 @@ function validateSecretModeOptions(options) {
 }
 async function resolveEffectiveSecret(options, store, vault) {
   if (options.secretMode === "managed") {
-    const { resolveManagedSecret } = await import("./managed-secret-PQYKSR6T.js");
+    const { resolveManagedSecret } = await import("./managed-secret-S3MQ6SH6.js");
     return resolveManagedSecret(store, vault, options.sealingKey);
   }
   return options.secret;
@@ -558,7 +571,7 @@ function ownerKeyringOptions(options, secret) {
 
 // src/port/by/default-provider.ts
 async function createDefaultMesh(store) {
-  const { StoreMesh } = await import("./store-coordination-provider-MEQ2MJQG.js");
+  const { StoreMesh } = await import("./store-coordination-provider-2O2VUHKW.js");
   return new StoreMesh(store);
 }
 
@@ -613,6 +626,60 @@ function populateCollectionRegistries(r, collectionName, options, effectiveViaFi
   }
 }
 
+// src/kernel/generation-map.ts
+var tick = 0;
+var GenerationMap = class extends Map {
+  /**
+   * ⚠️ NOT a `#private` field, and not readonly-initialised, deliberately.
+   * `Map`'s constructor calls `this.set()` for each entry of an iterable
+   * argument — which runs BEFORE this class's fields are installed. A
+   * `#private` field throws `TypeError` on touch at that point; a declared
+   * property is merely `undefined`, and assigning to it is safe. The
+   * initializer below then runs and resets it to 0, which is the correct
+   * resting state for a freshly built map.
+   */
+  gen = 0;
+  /** Mutation stamp. Equal across two reads means nothing changed between them. */
+  get generation() {
+    return this.gen;
+  }
+  set(key, value) {
+    this.gen = ++tick;
+    return super.set(key, value);
+  }
+  delete(key) {
+    this.gen = ++tick;
+    return super.delete(key);
+  }
+  clear() {
+    this.gen = ++tick;
+    super.clear();
+  }
+};
+
+// src/kernel/present-cache.ts
+var memo = /* @__PURE__ */ new WeakMap();
+function presentVariantKey(locale, layer, fallback) {
+  const chain = fallback === void 0 ? "" : Array.isArray(fallback) ? fallback.join(",") : String(fallback);
+  return `${locale ?? ""} ${layer} ${chain}`;
+}
+function memoizePresent(record, variant, compute) {
+  let variants = memo.get(record);
+  if (!variants) {
+    variants = /* @__PURE__ */ new Map();
+    memo.set(record, variants);
+  }
+  const hit = variants.get(variant);
+  if (hit !== void 0) return hit;
+  const scope = variants;
+  const pending = compute().catch((err) => {
+    scope.delete(variant);
+    throw err;
+  });
+  scope.set(variant, pending);
+  return pending;
+}
+
 // src/kernel/lazy-count.ts
 var COUNT_PAGE_SIZE = 1e3;
 function isLive(env, storeCiphertext) {
@@ -675,6 +742,121 @@ async function applyCutoverTransform(ctx) {
   return count;
 }
 
+// src/with-lookup/indexing/persisted-field-indexes.ts
+function fieldIndexFingerprint(cache) {
+  let sum = 0;
+  let xor = 0;
+  let maxVersion = 0;
+  for (const [id, entry] of cache) {
+    const h = fnv1a(`${id} ${entry.version}`);
+    sum = sum + h >>> 0;
+    xor = (xor ^ h) >>> 0;
+    if (entry.version > maxVersion) maxVersion = entry.version;
+  }
+  return { count: cache.size, maxVersion, digest: `${sum.toString(36)}.${xor.toString(36)}` };
+}
+function fnv1a(s) {
+  let h = 2166136261;
+  for (let i = 0; i < s.length; i++) {
+    h ^= s.charCodeAt(i);
+    h = Math.imul(h, 16777619) >>> 0;
+  }
+  return h >>> 0;
+}
+function fpEqual(a, b) {
+  return a.count === b.count && a.maxVersion === b.maxVersion && a.digest === b.digest;
+}
+var PersistedFieldIndexes = class {
+  constructor(cb) {
+    this.cb = cb;
+    this.debounceMs = cb.debounceMs ?? 1e3;
+  }
+  cb;
+  timer = null;
+  debounceMs;
+  /** True when at least one index on this collection asked to be persisted. */
+  get enabled() {
+    return this.cb.keys().length > 0;
+  }
+  /**
+   * Restore whatever is fresh. Returns the sidecar keys that were adopted —
+   * the caller rebuilds every other declared index from the cache. Never
+   * throws for a bad blob: an unreadable sidecar is indistinguishable from an
+   * absent one, and both mean "rebuild".
+   */
+  async restore(isLive2) {
+    const keys = this.cb.keys();
+    if (keys.length === 0) return EMPTY;
+    const live = this.cb.currentFingerprint();
+    const restored = /* @__PURE__ */ new Set();
+    for (const key of keys) {
+      let loaded = null;
+      try {
+        loaded = await this.cb.load(key);
+      } catch {
+        continue;
+      }
+      if (loaded === null || !fpEqual(loaded.fingerprint, live)) continue;
+      const snap = parseFieldIndexSnapshot(loaded.json);
+      if (snap === null) continue;
+      if (this.cb.restore(key, snap, isLive2)) restored.add(key);
+    }
+    return restored;
+  }
+  /** Schedule a debounced write of every opted-in sidecar. */
+  markDirty() {
+    if (this.cb.keys().length === 0) return;
+    if (this.timer) clearTimeout(this.timer);
+    this.timer = setTimeout(() => {
+      this.timer = null;
+      void this.persist().catch(() => {
+      });
+    }, this.debounceMs);
+  }
+  /** Force an immediate write (cancels any pending debounce). */
+  async flush() {
+    if (this.timer) {
+      clearTimeout(this.timer);
+      this.timer = null;
+    }
+    await this.persist();
+  }
+  /** Delete every sidecar — erasure, and any point the blobs must not survive. */
+  async removeAll() {
+    if (this.timer) {
+      clearTimeout(this.timer);
+      this.timer = null;
+    }
+    let purged = 0;
+    const residue = [];
+    for (const key of this.cb.keys()) {
+      try {
+        await this.cb.remove(key);
+        purged++;
+      } catch {
+        residue.push(key);
+      }
+    }
+    return { purged, residue };
+  }
+  /** Drop a pending debounce without writing (collection teardown). */
+  dispose() {
+    if (this.timer) {
+      clearTimeout(this.timer);
+      this.timer = null;
+    }
+  }
+  async persist() {
+    const fp = this.cb.currentFingerprint();
+    for (const key of this.cb.keys()) {
+      const snap = this.cb.snapshot(key);
+      if (!snap) continue;
+      await this.cb.save(key, JSON.stringify(snap), fp);
+    }
+  }
+};
+var EMPTY = /* @__PURE__ */ new Set();
+
 // src/with-lookup/indexing/collection-facade.ts
 function readPersistedValue(record, field) {
   if (!field.includes(".")) return record[field];
@@ -713,14 +895,98 @@ function valuesMatch(stored, live) {
     return false;
   }
 }
-function rebuildEagerIndexesFromCache(ctx) {
+function rebuildEagerIndexesFromCache(ctx, skip) {
   const eager = ctx.indexes;
   if (!eager || eager.fields().length === 0) return;
   const snapshot = [];
   for (const [id, entry] of ctx.cache) {
     snapshot.push({ id, record: entry.record });
   }
-  eager.build(snapshot);
+  eager.build(snapshot, skip);
+}
+var FIELD_IDX = "_fieldidx";
+function buildFieldIndexCallbacks(provideCtx, debounceMs) {
+  const sidecarId = (name, key) => `${name}/${key}`;
+  return {
+    keys: () => provideCtx().indexes?.persistableKeys() ?? [],
+    snapshot: (key) => provideCtx().indexes?.snapshotIndex(key),
+    restore: (key, snap, isLive2) => provideCtx().indexes?.restoreIndex(key, snap, isLive2) ?? false,
+    load: async (key) => {
+      const ctx = provideCtx();
+      const id = sidecarId(ctx.name, key);
+      const env = await ctx.adapter.get(ctx.vault, FIELD_IDX, id);
+      if (!env) return null;
+      const body = await ctx.codec.decryptJsonString({ collection: FIELD_IDX, id }, env);
+      if (body === null) return null;
+      try {
+        const wrapped = JSON.parse(body);
+        if (typeof wrapped?.idx !== "string" || typeof wrapped?.fp?.digest !== "string") return null;
+        return { json: wrapped.idx, fingerprint: wrapped.fp };
+      } catch {
+        return null;
+      }
+    },
+    save: async (key, json, fp) => {
+      const ctx = provideCtx();
+      const id = sidecarId(ctx.name, key);
+      const body = JSON.stringify({ fp, idx: json });
+      const env = await ctx.codec.encryptJsonString({ collection: FIELD_IDX, id }, body, fp.count);
+      await ctx.adapter.put(ctx.vault, FIELD_IDX, id, env);
+    },
+    remove: async (key) => {
+      const ctx = provideCtx();
+      await ctx.adapter.delete(ctx.vault, FIELD_IDX, sidecarId(ctx.name, key));
+    },
+    currentFingerprint: () => fieldIndexFingerprint(provideCtx().cache),
+    ...debounceMs !== void 0 ? { debounceMs } : {}
+  };
+}
+function createPersistedFieldIndexes(provideCtx, indexes) {
+  if ((indexes?.persistableKeys().length ?? 0) === 0) return null;
+  return new PersistedFieldIndexes(buildFieldIndexCallbacks(provideCtx));
+}
+async function hydrateEagerIndexes(ctx) {
+  const store = ctx.fieldIndexes;
+  if (!store || !store.enabled || !ctx.indexes) {
+    rebuildEagerIndexesFromCache(ctx);
+    return;
+  }
+  const restored = await store.restore((id) => ctx.cache.has(id));
+  rebuildEagerIndexesFromCache(ctx, restored);
+  if (restored.size < ctx.indexes.persistableKeys().length) store.markDirty();
+}
+async function checkUniqueOnPut(ctx, id, record) {
+  const set = ctx.uniqueConstraints;
+  if (!set || set.enforcement === "detect") return;
+  if (!ctx.lazy) {
+    set.check(id, record);
+    return;
+  }
+  const persisted = ctx.persistedIndexes;
+  if (!persisted) {
+    throw new Error(
+      `Collection "${ctx.name}": a unique index in lazy mode (prefetch: false) needs the indexing service. Pass \`withIndexing()\` from "@noy-db/hub/indexing" to \`createNoydb({ indexingStrategy })\`.`
+    );
+  }
+  await ctx.ensurePersistedIndexesLoaded();
+  const rec = record;
+  for (const fields of set.fieldTuples()) {
+    const values = [];
+    for (const f of fields) {
+      const v = readPersistedValue(rec, f);
+      if (v === null || v === void 0) {
+        values.length = 0;
+        break;
+      }
+      values.push(v);
+    }
+    if (values.length === 0) continue;
+    const holders = persisted.probeEqual(compositeKey(fields), fields.length === 1 ? values[0] : values);
+    if (!holders) continue;
+    for (const holder of holders) {
+      if (holder !== id) throw new UniqueConstraintError(ctx.name, id, fields, holder);
+    }
+  }
 }
 function rebuildUniqueConstraintsFromCache(ctx) {
   if (!ctx.uniqueConstraints) return;
@@ -916,10 +1182,11 @@ async function maintainPersistedIndexesOnDelete(ctx, id, previousRecord) {
   }
 }
 async function purgePersistedIndexes(ctx, id) {
+  const field = ctx.fieldIndexes ? await ctx.fieldIndexes.removeAll() : { purged: 0, residue: [] };
   const persisted = ctx.persistedIndexes;
-  if (!persisted) return { purged: 0, residue: [] };
-  let purged = 0;
-  const residue = [];
+  if (!persisted) return field;
+  let purged = field.purged;
+  const residue = [...field.residue];
   for (const def of persisted.definitions()) {
     try {
       await ctx.adapter.delete(ctx.vault, ctx.name, encodeIdxId(def.key, id));
@@ -947,19 +1214,108 @@ async function resolveTierSyncPrior(ctx, id, priorEnvelope) {
   if (!ctx.lazy || !priorEnvelope || (priorEnvelope._tier ?? 0) > 0) return null;
   return await ctx.codec.decryptRecord({ collection: ctx.name, id }, priorEnvelope, { skipValidation: true });
 }
+function resolveDeclaredIndexes(defs, collectionName, indexingEnabled) {
+  const declared = normalizeIndexDefs(defs);
+  if (indexingEnabled || declared.length === 0) return declared;
+  const fields = [...new Set(declared.flatMap((d) => [...d.fields]))];
+  console.warn(
+    `[noy-db] collection "${collectionName}" declares indexes ${JSON.stringify(fields)} but no indexingStrategy was passed to createNoydb() \u2014 every query on it will scan. Pass \`indexingStrategy: withIndexing()\` from "@noy-db/hub/indexing", or drop the \`indexes:\` declaration if a scan is intended.`
+  );
+  return declared;
+}
 
 // src/with-lookup/search/serialize.ts
 function serializeIndex(idx) {
   return JSON.stringify(idx.toSnapshot());
 }
 function deserializeIndex(json) {
-  return InvertedIndex.fromSnapshot(JSON.parse(json));
+  const snap = parseIndexSnapshot(json);
+  return snap === null ? null : InvertedIndex.fromSnapshot(snap);
+}
+function parseIndexSnapshot(json) {
+  let raw;
+  try {
+    raw = JSON.parse(json);
+  } catch {
+    return null;
+  }
+  if (typeof raw !== "object" || raw === null) return null;
+  const o = raw;
+  if (o["v"] !== INDEX_SNAPSHOT_VERSION) return null;
+  if (!isStringArray(o["posFields"])) return null;
+  if (!Array.isArray(o["fieldStats"]) || !Array.isArray(o["docs"])) return null;
+  const posFields = new Set(o["posFields"]);
+  const fieldStats = [];
+  for (const e of o["fieldStats"]) {
+    if (!Array.isArray(e) || e.length !== 2 || typeof e[0] !== "string") return null;
+    const s = e[1];
+    if (typeof s !== "object" || s === null) return null;
+    if (!isCountPairs(s["df"]) || !isNonNegInt(s["n"]) || !isNonNegInt(s["totalLen"])) return null;
+    fieldStats.push([e[0], { df: s["df"], n: s["n"], totalLen: s["totalLen"] }]);
+  }
+  const docs = [];
+  for (const e of o["docs"]) {
+    if (typeof e !== "object" || e === null) return null;
+    const d = e;
+    if (typeof d["id"] !== "string" || typeof d["field"] !== "string" || typeof d["text"] !== "string") return null;
+    if (!isNonNegInt(d["len"])) return null;
+    if (d["locale"] !== void 0 && typeof d["locale"] !== "string") return null;
+    if (!isCountPairs(d["tf"]) || !isCountPairs(d["firstOffset"])) return null;
+    const wantsPos = posFields.has(d["field"]);
+    if (wantsPos !== (d["pos"] !== void 0)) return null;
+    let pos;
+    if (d["pos"] !== void 0) {
+      if (!isPositionPairs(d["pos"], d["len"])) return null;
+      pos = d["pos"];
+    }
+    docs.push({
+      id: d["id"],
+      field: d["field"],
+      text: d["text"],
+      len: d["len"],
+      tf: d["tf"],
+      firstOffset: d["firstOffset"],
+      ...d["locale"] !== void 0 ? { locale: d["locale"] } : {},
+      ...pos !== void 0 ? { pos } : {}
+    });
+  }
+  return { v: INDEX_SNAPSHOT_VERSION, posFields: o["posFields"], fieldStats, docs };
+}
+function isNonNegInt(x) {
+  return typeof x === "number" && Number.isInteger(x) && x >= 0;
+}
+function isStringArray(x) {
+  return Array.isArray(x) && x.every((s) => typeof s === "string");
+}
+function isCountPairs(x) {
+  return Array.isArray(x) && x.every((p) => Array.isArray(p) && p.length === 2 && typeof p[0] === "string" && isNonNegInt(p[1]));
+}
+function isPositionPairs(x, len) {
+  if (!Array.isArray(x)) return false;
+  for (const p of x) {
+    if (!Array.isArray(p) || p.length !== 2 || typeof p[0] !== "string") return false;
+    const list = p[1];
+    if (!Array.isArray(list) || list.length === 0) return false;
+    let prev = -1;
+    for (const n of list) {
+      if (!isNonNegInt(n) || n <= prev || n >= len) return false;
+      prev = n;
+    }
+  }
+  return true;
 }
 
 // src/with-lookup/search/persisted-index-store.ts
-function fpEqual(a, b) {
+function fpEqual2(a, b) {
   return a.count === b.count && a.maxVersion === b.maxVersion;
 }
+function positionsMatch(idx, opts) {
+  const want = new Set(opts?.positions ?? []);
+  const have = idx.positionFields;
+  if (want.size !== have.size) return false;
+  for (const f of want) if (!have.has(f)) return false;
+  return true;
+}
 var PersistedIndexStore = class {
   constructor(cb) {
     this.cb = cb;
@@ -969,6 +1325,9 @@ var PersistedIndexStore = class {
   index;
   timer = null;
   lastBuild;
+  /** The positional-postings opt-in the last caller asked for (#1354). A loaded
+   *  sidecar that does not carry exactly these fields is discarded, not adapted. */
+  lastOpts;
   debounceMs;
   /**
    * Bumped by every purge (removePersisted). A save() captured under a since-stale
@@ -1015,16 +1374,20 @@ var PersistedIndexStore = class {
   get built() {
     return this.index !== void 0;
   }
-  async ensureBuilt(build) {
+  async ensureBuilt(build, opts) {
     await this.retryPendingCompensation();
     this.lastBuild = build;
+    this.lastOpts = opts;
     if (this.index !== void 0) return this.index;
     const loaded = await this.cb.load();
-    if (loaded !== null && fpEqual(loaded.fingerprint, this.cb.currentFingerprint())) {
-      this.index = deserializeIndex(loaded.json);
-      return this.index;
+    if (loaded !== null && fpEqual2(loaded.fingerprint, this.cb.currentFingerprint())) {
+      const restored = deserializeIndex(loaded.json);
+      if (restored !== null && positionsMatch(restored, opts)) {
+        this.index = restored;
+        return this.index;
+      }
     }
-    this.index = InvertedIndex.build(build());
+    this.index = InvertedIndex.build(build(), opts);
     await this.persist();
     return this.index;
   }
@@ -1071,7 +1434,7 @@ var PersistedIndexStore = class {
     await this.retryPendingCompensation();
     if (this.lastBuild === void 0) return;
     if (this.index === void 0) {
-      this.index = InvertedIndex.build(this.lastBuild());
+      this.index = InvertedIndex.build(this.lastBuild(), this.lastOpts);
     }
     await this.persist();
   }
@@ -1114,21 +1477,34 @@ var PersistedIndexStore = class {
 
 // src/with-lookup/indexing/unique-constraints.ts
 var UniqueConstraintSet = class {
-  constructor(collectionName, uniqueDefs) {
+  constructor(collectionName, uniqueDefs, enforcement = "prevent", report = () => {
+  }) {
     this.collectionName = collectionName;
+    this.enforcement = enforcement;
+    this.report = report;
     this.constraints = uniqueDefs.map((fields) => ({ fields, map: /* @__PURE__ */ new Map() }));
   }
   collectionName;
+  enforcement;
+  report;
   constraints;
   get size() {
     return this.constraints.length;
   }
+  /** The declared field tuples, in declaration order. */
+  fieldTuples() {
+    return this.constraints.map((c) => c.fields);
+  }
   /**
    * Compute the canonical key for a record under a given constraint.
    * Returns `null` if any constrained field is `null` or `undefined`
    * (the record is exempt — no constraint is checked).
+   *
+   * Public because the tier scan (`with-audit/tiers/index.ts`) has to compute
+   * the same key for a record it decrypted under a tier DEK, which this class
+   * cannot reach — one key function, so the two paths cannot drift.
    */
-  keyFor(fields, record) {
+  keyOf(fields, record) {
     const row = {};
     for (const f of fields) {
       const v = readPath(record, f);
@@ -1137,29 +1513,66 @@ var UniqueConstraintSet = class {
     }
     return canonicalGroupKey(fields, row);
   }
+  /**
+   * Every constraint key `record` would occupy — the probe a checker outside
+   * this class (tiers, lazy) compares against its own candidates. Exempt
+   * (null-distinct) constraints are omitted, so an empty result means "this
+   * record is unconstrained" and the caller can skip its scan entirely.
+   */
+  probe(record) {
+    const out = [];
+    for (const c of this.constraints) {
+      const key = this.keyOf(c.fields, record);
+      if (key !== null) out.push({ fields: c.fields, key });
+    }
+    return out;
+  }
   /**
    * Throw `UniqueConstraintError` if writing `id` with `record` would
    * collide with a DIFFERENT existing record. Call BEFORE the store write.
+   *
+   * In `'detect'` mode this is a deliberate NO-OP: a CRDT collection must
+   * not refuse a write it has no authority to refuse (module doc). The
+   * collision is reported from {@link upsert} / {@link build} instead.
    */
   check(id, record) {
+    if (this.enforcement === "detect") return;
+    const clash = this.collision(id, record);
+    if (clash) throw clash;
+  }
+  /**
+   * The `UniqueConstraintError` a write of `id`/`record` would produce, or
+   * `null`. Never throws — the shared core of {@link check} (which throws it)
+   * and the detect path (which reports it).
+   */
+  collision(id, record) {
     for (const c of this.constraints) {
-      const key = this.keyFor(c.fields, record);
+      const key = this.keyOf(c.fields, record);
       if (key === null) continue;
       const holder = c.map.get(key);
       if (holder !== void 0 && holder !== id) {
-        throw new UniqueConstraintError(this.collectionName, id, c.fields, holder);
+        return new UniqueConstraintError(this.collectionName, id, c.fields, holder);
       }
     }
+    return null;
   }
   /**
    * Update the constraint maps after a successful write.
    * Pass `previous` when updating an existing record (so the old key
    * is removed first). Pass `null` or `undefined` for a fresh insert.
+   *
+   * In `'detect'` mode a collision observed here is REPORTED and the write
+   * still stands (both records are kept — see the module doc). In
+   * `'prevent'` mode `check()` already ran, so there is nothing to report.
    */
   upsert(id, record, previous) {
     if (previous != null) this.remove(id, previous);
+    if (this.enforcement === "detect") {
+      const clash = this.collision(id, record);
+      if (clash) this.report(clash);
+    }
     for (const c of this.constraints) {
-      const key = this.keyFor(c.fields, record);
+      const key = this.keyOf(c.fields, record);
       if (key !== null) c.map.set(key, id);
     }
   }
@@ -1169,7 +1582,7 @@ var UniqueConstraintSet = class {
    */
   remove(id, record) {
     for (const c of this.constraints) {
-      const key = this.keyFor(c.fields, record);
+      const key = this.keyOf(c.fields, record);
       if (key !== null && c.map.get(key) === id) c.map.delete(key);
     }
   }
@@ -1177,13 +1590,18 @@ var UniqueConstraintSet = class {
    * Rebuild all constraint maps from a full snapshot.
    * Called after hydration (ensureHydrated / hydrateFromSnapshot).
    *
-   * **Last-writer-wins**: this method does NOT validate pre-existing data
-   * for duplicates. If the store already contains two records sharing a
-   * constrained value (written before the unique index was declared), the
-   * last one processed wins the map slot and the duplicate is silently
-   * displaced — no error is thrown, and the earlier holder is evicted from
-   * the map. Callers retrofitting a unique index onto populated data should
-   * run a one-time uniqueness scan before relying on enforcement.
+   * **In `'prevent'` mode this is last-writer-wins**: it does NOT validate
+   * pre-existing data for duplicates. If the store already contains two
+   * records sharing a constrained value (written before the unique index was
+   * declared), the last one processed wins the map slot and the duplicate is
+   * silently displaced — no error is thrown, and the earlier holder is
+   * evicted from the map. Callers retrofitting a unique index onto populated
+   * data should run a one-time uniqueness scan before relying on enforcement.
+   *
+   * **In `'detect'` mode this is the MERGE POINT** — the moment a session
+   * that wrote neither record first sees them together (a CRDT replica
+   * opening a store its peer has written to). Every displaced holder is
+   * reported on `unique:violation` instead of being dropped in silence.
    */
   build(entries) {
     for (const c of this.constraints) c.map.clear();
@@ -1192,7 +1610,7 @@ var UniqueConstraintSet = class {
     }
   }
 };
-function buildUniqueConstraintSet(collectionName, indexes, mode) {
+function buildUniqueConstraintSet(collectionName, indexes, mode, report) {
   const uniqueDefs = [];
   for (const def of indexes ?? []) {
     if (def !== null && typeof def === "object" && !Array.isArray(def) && def.unique === true) {
@@ -1200,25 +1618,7 @@ function buildUniqueConstraintSet(collectionName, indexes, mode) {
     }
   }
   if (uniqueDefs.length === 0) return null;
-  if (mode.lazy) {
-    throw new UnsupportedIndexOptionError(
-      "unique",
-      `unique indexes are not yet supported in lazy mode (prefetch:false) \u2014 use the default eager mode. Collection "${collectionName}".`
-    );
-  }
-  if (mode.crdt) {
-    throw new UnsupportedIndexOptionError(
-      "unique",
-      `unique indexes are not supported on CRDT collections (crdt mode is incompatible with eager unique enforcement). Collection "${collectionName}".`
-    );
-  }
-  if (mode.tiered) {
-    throw new UnsupportedIndexOptionError(
-      "unique",
-      `unique indexes are not supported on tiered collections (tier writes use a separate path that bypasses unique enforcement). Collection "${collectionName}".`
-    );
-  }
-  return new UniqueConstraintSet(collectionName, uniqueDefs);
+  return new UniqueConstraintSet(collectionName, uniqueDefs, mode.crdt ? "detect" : "prevent", report);
 }
 
 // src/kernel/put-many-atomic.ts
@@ -1325,7 +1725,7 @@ async function commitSequentially(ctx, entries, priors) {
 }
 
 // src/with-formula/computed/lazy.ts
-var loadComputed = lazy(() => import("./computed-VPOKQK4N.js"));
+var loadComputed = lazy(() => import("./computed-TPFBX7U4.js"));
 async function loadEvalComputedFields() {
   return (await loadComputed()).evalComputedFields;
 }
@@ -1379,7 +1779,18 @@ var Collection = class {
   // In-memory cache of decrypted records (eager mode only). Lazy mode
   // uses `lru` instead. Both fields exist so a single Collection instance
   // doesn't need a runtime branch on every cache access.
-  cache = /* @__PURE__ */ new Map();
+  cache = new GenerationMap();
+  /** #1418 — mutation stamp for a derived-output memo, or `null` when one must NOT be used because a redundant re-write would still be observable (gate handler, history, sync, search) or there is no eager cache to stamp. The rules and their measured rationale live with the consumer, `with-formula/materialized-views/emit-memo.ts`. `_`-prefixed deliberately: `kernel-api-surface-golden` freezes the PUBLIC surface and this is an executor seam. @internal */
+  get _cacheStamp() {
+    if (this.lazy) return null;
+    if (this.historyConfigExplicit && this.historyConfig.enabled !== false) return null;
+    if (this.onDirty !== void 0 || this.searchIndexStore !== void 0) return null;
+    return this.cache.generation;
+  }
+  /** #1439 — could a `beforePut` gate fire for THIS row? Asks each handler's declared scope, not merely whether any is registered — the bus is vault-wide, the gates are not. @internal */
+  _derivedWriteGated(record) {
+    return this.subsystemBus?.gateAppliesTo("beforePut", { vault: this.vault, collection: this.name, record }) === true;
+  }
   hydrated = false;
   /**
    * #606: ids known to carry a delete marker in the store — lets the #589
@@ -1494,8 +1905,12 @@ var Collection = class {
   i18nFields;
   /** The configured string fields exposed to `retrieve()`; `undefined` for ordinary collections (zero-cost). */
   textIndexes;
+  /** #1354 — the subset of `textIndexes` carrying positional postings (phrase / proximity). */
+  textIndexPositions;
   /** Session-scoped lexical index store; `undefined` (zero-cost) unless `textIndexes` is non-empty. */
   searchIndexStore;
+  /** Encrypted field-index sidecars (#1359); `null` (zero-cost) unless an index declared `persist: true`. */
+  fieldIndexStore;
   /** Embedding config for write-time vector derivation; `undefined` (zero-cost) for ordinary
    *  collections. When set, `put()` encodes the source field(s) and stores an encrypted `_vec` sidecar. */
   embeddings;
@@ -1712,6 +2127,7 @@ var Collection = class {
     this.joinResolver = cfg.joinResolver;
     this.i18nFields = cfg.i18nFields;
     this.textIndexes = cfg.textIndexes;
+    this.textIndexPositions = cfg.textIndexPositions;
     this.searchIndexStore = opts.textIndexes && opts.textIndexes.length > 0 ? opts.textIndexPersist ? new PersistedIndexStore(buildPersistedIndexCallbacks(() => this.searchContext())) : new MemoryIndexStore() : void 0;
     this.embeddings = cfg.embeddings;
     this.vectorSet = cfg.vectorSet;
@@ -1773,6 +2189,8 @@ var Collection = class {
       getDEK: (collection) => this.getDEK(collection ?? this.name),
       cekCache: this.cekCache,
       classifiedMarkerDigestOnly: () => this._classifiedMarkerDigestOnly(),
+      onDecrypt: this.strategies.coverage.observer(this.vault, this.name, this.keyring.userId, () => this.fieldMeta, this.emitter, opts.prefetch !== false),
+      // #1363 read-coverage sensor; NO_COVERAGE returns undefined
       via: this.via
     });
     if (cfg.classifiedEraseCfg) cfg.classifiedEraseCfg.classifySealedShred = (live) => this.codec.classifySealedShred(live);
@@ -1854,14 +2272,15 @@ var Collection = class {
       defs: opts.indexes ?? [],
       lazy: this.lazy
     });
-    this.declaredIndexes = normalizeIndexDefs(opts.indexes ?? []);
+    this.declaredIndexes = resolveDeclaredIndexes(opts.indexes ?? [], this.name, this.indexState.isEnabled);
+    this.fieldIndexStore = createPersistedFieldIndexes(() => this.indexingContext(), this.indexes);
     this.indexes?.setCanonicalizer((f, v) => this.via?.canonicalizeIndexKey(f, v));
     this.persistedIndexes?.setCanonicalizer((f, v) => this.via?.canonicalizeIndexKey(f, v));
     this.uniqueConstraints = buildUniqueConstraintSet(this.name, opts.indexes, {
       lazy: this.lazy,
       crdt: this.crdtMode != null,
       tiered: this.tiers != null
-    });
+    }, (err) => this.emitter.emit("unique:violation", { vault: this.vault, collection: this.name, id: err.recordId, fields: err.fields, conflictingId: err.conflictingId, error: err }));
   }
   /**
    * Return the Standard Schema validator attached to this collection,
@@ -1889,6 +2308,11 @@ var Collection = class {
     return this.declaredIndexes;
   }
   // declared index defs, normalized; consumed by walk.ts
+  /** #1447 — `field -> via brands covering it`, for `dumpSchema()`. Brand and field only, never a binding's config; see `via/pipeline.ts#fieldCoverage`. Consumed by walk.ts. */
+  getViaCoverage() {
+    const c = this.via?.fieldCoverage();
+    return c && Object.keys(c).length > 0 ? c : void 0;
+  }
   /**
    * Aggregate all collection-level configuration options that are actively set
    * into a {@link CollectionConfig} snapshot. Returns `undefined` when no options
@@ -1994,7 +2418,7 @@ var Collection = class {
   }
   /** JSON Schema for this collection with describe() metadata as x- extensions. */
   async toJSONSchema() {
-    const { buildJsonSchema } = await import("./json-schema-V3M5MUCM.js");
+    const { buildJsonSchema } = await import("./json-schema-3SHX72CC.js");
     const desc = await this.describe({});
     let base = null;
     if (this.schema !== void 0) {
@@ -2110,7 +2534,7 @@ var Collection = class {
     }
     await this.onAccess?.("find", "*");
     if (hits.length === 0) return [];
-    const { verifyDigestField } = await import("./verify-KOV2G5D6.js");
+    const { verifyDigestField } = await import("./verify-RVT67IMH.js");
     const policy = {
       normalize: spec.verifyNormalize ?? "password",
       notLastN: spec.notLastN ?? 0,
@@ -2322,7 +2746,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-DDL7WQEZ.js");
+      const { resolveStaleMVOnRead } = await import("./stale-TJ3DYZMQ.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     let record;
@@ -2439,6 +2863,10 @@ var Collection = class {
    *                ORIGIN refresh time across vaults. (FR-4)
    */
   async put(id, record, options) {
+    return trackKeyedWrite(this.adapter, this.vault, this.name, id, () => this.#putGated(id, record, options));
+  }
+  /** @internal The body of {@link put}; see the #1420 note there for why it is split. */
+  async #putGated(id, record, options) {
     await this.schemaUpdateGate?.assertWritable();
     await this.schemaFence?.assertWritable(this.name);
     const hooksActive = this.#hooksActive();
@@ -2805,7 +3233,8 @@ var Collection = class {
       }
       if (priorRaw && isDeleteMarker(priorRaw)) version = priorRaw._v + 1;
     }
-    this.uniqueConstraints?.check(id, record);
+    await checkUniqueOnPut(this.indexingContext(), id, record);
+    if (this.tiers !== null && this.uniqueConstraints !== null) await this.strategies.tiers.checkUnique(this.tiersContext(), id, record);
     const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
     const vdigCtx = this.vdigFields !== null ? { id, prev: await this.adapter.get(this.vault, this.name, id) } : void 0;
     const envelope = await this.codec.encryptRecord({ collection: this.name, id }, record, version, cek, options?.source, options?.sourceTs, vdigCtx);
@@ -2854,7 +3283,7 @@ var Collection = class {
    */
   async dispatchMaterializedViews(id, record, wave) {
     if (this.materializedViewSource === void 0) return;
-    const { dispatchMaterializedViews } = await import("./dispatch-WC6X2M6C.js");
+    const { dispatchMaterializedViews } = await import("./dispatch-3CQDJV5Q.js");
     return dispatchMaterializedViews(this.#mvDispatchCtx(this.materializedViewSource), id, record, wave);
   }
   /**
@@ -3020,13 +3449,13 @@ var Collection = class {
    *  dispatch wave's per-target dedup; `undefined` on the local-write path (byte-identical). */
   async dispatchDerivations(id, record, version, wave, prior) {
     if (this.derivationSource === void 0) return;
-    const { dispatchDerivations } = await import("./dispatch-S73TK3IY.js");
+    const { dispatchDerivations } = await import("./dispatch-RH4LHKBH.js");
     return dispatchDerivations(this.#derivationDispatchCtx(), id, record, version, wave, prior);
   }
   /** @internal — trigger fan-out for a deleted parent (#1249); see dispatch.ts. */
   async dispatchTriggerDerivationsOnDelete(id, deleted) {
     if (this.derivationSource === void 0) return;
-    const { dispatchTriggerDerivationsOnDelete } = await import("./dispatch-S73TK3IY.js");
+    const { dispatchTriggerDerivationsOnDelete } = await import("./dispatch-RH4LHKBH.js");
     return dispatchTriggerDerivationsOnDelete(this.#derivationDispatchCtx(), id, deleted);
   }
   /**
@@ -3034,6 +3463,10 @@ var Collection = class {
    * so `hub.writeQueue.pending` reflects this write.
    */
   async delete(id) {
+    return trackKeyedWrite(this.adapter, this.vault, this.name, id, () => this.#deleteGated(id));
+  }
+  /** @internal The body of {@link delete}; see the #1420 note on {@link put}. */
+  async #deleteGated(id) {
     await this.schemaUpdateGate?.assertWritable();
     await this.schemaFence?.assertWritable(this.name);
     const hooksActive = this.#hooksActive();
@@ -3246,6 +3679,7 @@ var Collection = class {
       if (persist) await this.adapter.put(this.vault, this.name, id, marker);
       this.markerIds.add(id);
     } else if (persist) await this.adapter.delete(this.vault, this.name, id);
+    if (this.strategies.blobs !== NO_BLOBS) await this.blob(id).releaseAll();
     if (this.ledger) {
       await this.ledger.append({ op: "delete", collection: this.name, id, version: existing?.version ?? 0, actor: this.keyring.userId, payloadHash: previousPayloadHash });
     }
@@ -3338,7 +3772,7 @@ var Collection = class {
    */
   async dispatchArrayDerivationsOnDelete(id, eraseRecordShapeToo = false) {
     if (this.derivationSource === void 0) return 0;
-    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-S73TK3IY.js");
+    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-RH4LHKBH.js");
     return dispatchArrayDerivationsOnDelete(this.#derivationDeleteCtx(this.derivationSource), id, eraseRecordShapeToo);
   }
   /**
@@ -3352,7 +3786,7 @@ var Collection = class {
    */
   async dispatchMaterializedViewsOnDelete(id) {
     if (this.materializedViewSource === void 0) return { deleted: 0, residueUndecodable: [], residueDeclined: [] };
-    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-WC6X2M6C.js");
+    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-3CQDJV5Q.js");
     return dispatchMaterializedViewsOnDelete(this.#mvDispatchCtx(this.materializedViewSource), id);
   }
   /**
@@ -3372,7 +3806,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-DDL7WQEZ.js");
+      const { resolveStaleMVOnRead } = await import("./stale-TJ3DYZMQ.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     await this.ensureHydrated();
@@ -3430,6 +3864,7 @@ var Collection = class {
       cache: this.cache,
       lazy: this.lazy,
       textIndexes: this.textIndexes,
+      textIndexPositions: this.textIndexPositions,
       i18nFields: this.i18nFields,
       dictKeyFields: this.dictKeyFields,
       blobFields: this.blobFields,
@@ -3555,7 +3990,7 @@ var Collection = class {
       subscribe: (cb) => {
         const handler = (event) => {
           if (event.vault === this.vault && event.collection === this.name) {
-            cb();
+            cb(event.remote === true ? void 0 : { id: event.id, action: event.action });
           }
         };
         this.emitter.on("change", handler);
@@ -3567,6 +4002,11 @@ var Collection = class {
       getIndexes: () => this.getIndexes(),
       lookupById: (id) => this.cache.get(id)?.record,
       snapshotEntries: () => [...this.cache.entries()].map(([id, e]) => ({ id, record: e.record })),
+      // Binds a keyset cursor to this collection (#1346).
+      identity: `${this.vault}/${this.name}`,
+      snapshotVersion: () => this.cache.generation,
+      hydration: { label: `${this.vault}/${this.name}`, collection: this.name, isHydrated: () => this.hydrated, hydrate: () => this.ensureHydrated() },
+      // #1414 — a never-read eager collection answers by ABSENCE; the gate makes every terminal await-able and refuse a synchronous read (query/hydration.ts)
       ...this.via ? { via: this.via } : {}
     };
     const resolver = this.joinResolver;
@@ -3658,6 +4098,8 @@ var Collection = class {
     return {
       snapshot: () => [...this.cache.values()].map((e) => e.record),
       lookupById: (id) => this.cache.get(id)?.record,
+      snapshotEntries: () => [...this.cache.entries()].map(([id, e]) => ({ id, record: e.record })),
+      // #1289 right/full outer join — the id is the cache KEY, not a field on the record; same `this.cache` closure as snapshot(), so the two views cannot disagree
       subscribe: (cb) => {
         const handler = (event) => {
           if (event.vault === this.vault && event.collection === this.name) {
@@ -3668,7 +4110,10 @@ var Collection = class {
         return () => this.emitter.off("change", handler);
       },
       // Sync join dressing (#650 Task 6, #626 retirement) — i18n-text + lookup-label, from this collection's own bindings.
-      ...this.presentForJoin !== void 0 ? { presentForJoin: this.presentForJoin } : {}
+      ...this.presentForJoin !== void 0 ? { presentForJoin: this.presentForJoin } : {},
+      decodeResults: (record) => this.via && this.via.hasResultDecode ? this.via.decodeResults(record) : record,
+      via: () => this.via
+      // #1289 Via result decode for a record served under an ALIAS, and #1337/#1338's `via()` — the pipeline ITSELF, for a record ORDERED (compareForOrder) or REDUCED (wrapReducers) under one. Contract + rationale on JoinableSource in query/join.ts. Both read `this.via` per call, never a captured value: _applyMoneyFields rebuilds the pipeline after this source is handed out — which is also why `via` is a thunk and not a property
     };
   }
   /**
@@ -4006,6 +4451,15 @@ var Collection = class {
   async _applyRemoteChange(id, action) {
     await this._onRecordMutated(id, action, "tab-mirror");
   }
+  /** @internal #1362 — same as {@link _applyRemoteChange}, for a frame that carries NO verb.
+   *  A peer's claim about the verb is not evidence; the re-read decides it, exactly as
+   *  `_compensateRevertedWrite` does. Untrusted ingress is why the frame omits it. */
+  async _applyRemoteSignal(id) {
+    await this._invalidateCacheEntry(id);
+    const action = await this.get(id) !== null ? "put" : "delete";
+    this.emitter.emit("change", { vault: this.vault, collection: this.name, id, action, remote: true });
+    this.searchIndexStore?.markDirty();
+  }
   /**
    * Origin-tagged mutation choke point (#623 task 10) — the single dispatch
    * point every put/delete path funnels through, AFTER its own store write,
@@ -4035,6 +4489,7 @@ var Collection = class {
         await this.onDirty?.(this.name, id, "put", version);
         this.emitter.emit("change", { vault: this.vault, collection: this.name, id, action: "put" });
         this.searchIndexStore?.markDirty();
+        this.fieldIndexStore?.markDirty();
         await this.onAccess?.("put", id);
         await this.dispatchDerivations(id, record, version, void 0, ctx.prior);
         await this.dispatchMaterializedViews(id, record);
@@ -4044,13 +4499,15 @@ var Collection = class {
         await this.onDirty?.(this.name, id, "put", ctx.version);
         this.emitter.emit("change", { vault: this.vault, collection: this.name, id, action: "delete" });
         this.searchIndexStore?.markDirty();
+        this.fieldIndexStore?.markDirty();
         await this.onAccess?.("delete", id);
         return;
       }
       case "tab-mirror":
         await this._invalidateCacheEntry(id);
-        this.emitter.emit("change", { vault: this.vault, collection: this.name, id, action });
+        this.emitter.emit("change", { vault: this.vault, collection: this.name, id, action, remote: true });
         this.searchIndexStore?.markDirty();
+        this.fieldIndexStore?.markDirty();
         return;
       case "sync-apply": {
         this._invalidateCekCacheEntry(id);
@@ -4088,7 +4545,7 @@ var Collection = class {
       }
     }
     this.hydrated = true;
-    this.rebuildEagerIndexesFromCache();
+    await hydrateEagerIndexes(this.indexingContext());
     this.rebuildUniqueConstraintsFromCache();
   }
   /** Hydrate from a pre-loaded snapshot (used by Vault). */
@@ -4104,7 +4561,7 @@ var Collection = class {
       this.cache.set(id, { record, version: envelope._v });
     }
     this.hydrated = true;
-    this.rebuildEagerIndexesFromCache();
+    await hydrateEagerIndexes(this.indexingContext());
     this.rebuildUniqueConstraintsFromCache();
   }
   /**
@@ -4222,10 +4679,39 @@ var Collection = class {
       tiersActive: this.tiers !== null,
       keyring: this.keyring,
       debugPlaintext: this.keyring.debugPlaintext === true,
+      assertOwnerWritable: () => this._assertRecordMutable(id),
+      // #1452
       ...this.objectStore !== void 0 ? { objectStore: this.objectStore } : {},
       ...this.blobFields !== void 0 ? { blobFields: this.blobFields } : {}
     });
   }
+  /**
+   * #1452 — would an update of record `id` pass the `beforePut` gate bus right
+   * now? Runs the bus with `incoming = existing`, so closed periods and record
+   * guards refuse an attachment change exactly as they would refuse the
+   * record's own update. A record with no stored body (never written, marker,
+   * elevated tier) is not gated — attaching before the first `put()` was
+   * always allowed. @internal
+   */
+  async _assertRecordMutable(id) {
+    if (!this.subsystemBus?.hasGateHandlers("beforePut")) return;
+    const { env, record } = await this.resolveGatePrior("beforePut", id);
+    if (!env || record === null || record === void 0) return;
+    const existing = this.via ? this.via.canonicalizeStored(record) : record;
+    await this.subsystemBus.dispatchGate("beforePut", {
+      op: "update",
+      vault: this.vault,
+      collection: this.name,
+      docId: id,
+      incoming: existing,
+      existing,
+      existingVersion: env._v,
+      existingTs: env._ts,
+      userId: this.keyring.userId,
+      role: this.keyring.role,
+      ...this.computed !== void 0 ? { computedFieldNames: new Set(Object.keys(this.computed)) } : {}
+    });
+  }
   /** Get all records as encrypted envelopes (for dump). */
   async dumpEnvelopes() {
     await this.ensureHydrated();
@@ -4258,9 +4744,8 @@ var Collection = class {
     if (!this.via) return record;
     const locale = localeOpts?.locale ?? this.defaultLocale;
     const layer = localeOpts?._layer ?? "read";
-    let result = record;
-    result = await this.via.present(result, { locale, ...localeOpts?.fallback !== void 0 ? { fallback: localeOpts.fallback } : {}, layer });
-    return result;
+    const via = this.via;
+    return memoizePresent(record, presentVariantKey(locale, layer, localeOpts?.fallback), async () => await via.present(record, { locale, ...localeOpts?.fallback !== void 0 ? { fallback: localeOpts.fallback } : {}, layer }));
   }
   /**
    * Low-level: encrypt a pre-serialised JSON string into an EncryptedEnvelope.
@@ -4314,7 +4799,11 @@ var Collection = class {
    *  Called by vault.ts forget() inside a resilient try/catch; residue is reported in ForgetResult. */
   async _purgeVector(id) {
     await this.adapter.delete(this.vault, "_vec", encodeVecId(this.name, id));
-    this.vectorSet?.markDirty();
+    this.vectorSet?.removeRecord(id);
+  }
+  /** @internal #1359 — force an immediate sidecar write, cancelling the debounce. No-op when none opted in. */
+  async _flushFieldIndexes() {
+    await this.fieldIndexStore?.flush();
   }
   /** Drop the persisted lexical-index blob (forget/erasure): an opaque
    *  all-records index must not survive crypto-shred. Idempotent; no-op without persist. */
@@ -4482,14 +4971,14 @@ var Collection = class {
   /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
   async _ensureClassifiedMarker() {
     if (this._markerPersisted || this.vdigFields === null) return;
-    const { persistClassifiedMarkerForFields } = await import("./classified-marker-LI2SF2E4.js");
+    const { persistClassifiedMarkerForFields } = await import("./classified-marker-W3USLL5M.js");
     await persistClassifiedMarkerForFields(this.adapter, this.vault, this.name, this.vdigFields, await this.getDEK(this.name));
     this._markerPersisted = true;
   }
   /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
   async _classifiedMarkerDigestOnly() {
     if (this._markerDigestOnlyCache !== void 0) return this._markerDigestOnlyCache;
-    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-LI2SF2E4.js");
+    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-W3USLL5M.js");
     this._markerDigestOnlyCache = await readClassifiedMarkerDigestOnly(this.adapter, this.vault, this.name, await this.getDEK(this.name));
     return this._markerDigestOnlyCache;
   }
@@ -4663,7 +5152,10 @@ var Collection = class {
       tierMode: this.tierMode,
       getDEK: (key) => this.getDEK(key),
       emitCrossTierEvent: (event) => this.emitCrossTierEvent(event),
-      addSubjectRef: (id, record) => this.addSubjectRef?.(id, record) ?? Promise.resolve()
+      addSubjectRef: (id, record) => this.addSubjectRef?.(id, record) ?? Promise.resolve(),
+      // #1358 — undefined on a collection with no `unique` index, which is what keeps the tier scan free everywhere else.
+      uniqueKeys: this.uniqueConstraints ? (record) => this.uniqueConstraints.probe(record) : void 0,
+      checkUniqueLocal: this.uniqueConstraints ? (id, record) => checkUniqueOnPut(this.indexingContext(), id, record) : void 0
     };
   }
   /**
@@ -4684,6 +5176,7 @@ var Collection = class {
       indexes: this.indexes,
       uniqueConstraints: this.uniqueConstraints,
       persistedIndexes: this.persistedIndexes,
+      fieldIndexes: this.fieldIndexStore,
       ensureHydrated: () => this.ensureHydrated(),
       ensurePersistedIndexesLoaded: () => this.ensurePersistedIndexesLoaded(),
       setPersistedIndexesLoaded: (value) => {
@@ -4693,6 +5186,18 @@ var Collection = class {
   }
 };
 
+// src/with-audit/periods/reserved-collections.ts
+var PERIODS_RESERVED_COLLECTIONS = /* @__PURE__ */ new Set([
+  PERIODS_COLLECTION,
+  PERIOD_FREEZES_COLLECTION,
+  PERIOD_ARCHIVES_COLLECTION,
+  PERIOD_TARGET_PURGES_COLLECTION,
+  PERIOD_REOPENS_COLLECTION
+]);
+function isPeriodsReservedCollection(name) {
+  return PERIODS_RESERVED_COLLECTIONS.has(name);
+}
+
 // src/port/with/capabilities.ts
 function assertCanExport(keyring, tier, format) {
   if (tier === "plaintext") {
@@ -5065,8 +5570,8 @@ var VaultPeriods = class {
   async closePeriod(options) {
     const existing = await this.loadPeriodsCache();
     this.deps.strategy.validatePeriodName(options.name, existing, options.partition);
-    if (typeof options.endDate !== "string" || options.endDate.length === 0) {
-      throw new ValidationError("closePeriod: endDate must be a non-empty ISO string.");
+    if (typeof options.endDate !== "string" || !isOrderableBusinessDate(options.endDate)) {
+      throw typeof options.endDate === "string" ? malformedBusinessDate("closePeriod: endDate", options.endDate) : new ValidationError("closePeriod: endDate must be a non-empty ISO string.");
     }
     const anchor = await this.deps.strategy.chainAnchor(existing, options.partition);
     const record = {
@@ -5481,6 +5986,32 @@ var VaultPeriods = class {
   findPeriod(all, name, options) {
     return all.find((p) => p.name === name && samePartition(p.partition, options?.partition));
   }
+  /**
+   * #1439 — could a closed period govern this record? Synchronous, and
+   * deliberately a SUPERSET of what {@link assertTsWritable} would refuse.
+   *
+   * Exists so a caller can tell "the period gate is registered" from "the
+   * period gate can fire for this row". Those were conflated, and the cost was
+   * that installing `withPeriods()` disabled an unrelated optimisation for
+   * every collection in the vault — with no period closed and no collection
+   * registered as a subject (#1439, measured: 0 → 250 redundant MV writes per
+   * source write).
+   *
+   * ⛔ Answers `true` whenever it cannot rule the gate out: the cache is not
+   * loaded yet, a closed period has no `dateField` to test against, or no row
+   * was supplied. A predicate that exists to permit an optimisation must fail
+   * towards "the gate applies", never away from it.
+   */
+  couldGovern(record) {
+    if (this.periodCache === null) return true;
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    for (const p of this.periodCache) {
+      if (p.kind !== "closed" || isEffectivelyReopened(p, now)) continue;
+      if (!p.dateField || record === void 0) return true;
+      if (record[p.dateField] !== void 0 && record[p.dateField] !== null) return true;
+    }
+    return false;
+  }
   /** Called by the gate bus before put/delete. `collection` selects the subject mapping (#1005). */
   async assertTsWritable(existing, incoming, collection) {
     if (existing === null && incoming === null) return;
@@ -6115,7 +6646,7 @@ var VaultLinks = class {
 // src/with-shape/links/lazy-handle.ts
 function makeLazyLinkSetHandle(d) {
   let engine = null;
-  const load = () => engine ??= import("./link-set-FKNWAYKS.js").then(
+  const load = () => engine ??= import("./link-set-JCMJ7ULP.js").then(
     ({ LinkSet }) => new LinkSet(d.adapter, d.vault, d.name, d.spec, d.encrypted, d.getDEK, d.actor, d.emitter, d.endpointExists)
   );
   return {
@@ -6766,7 +7297,7 @@ function declareSatellite(ctx, collectionName, options, existingRegistry) {
   ctx.forEachSyncEngine((e) => e.remirrorPairResolvers([spec.base, spec.satellite]));
   const registry = reg;
   const baseSchema = ctx.getBaseSchema(spec.base);
-  void import("./post-register-LNE2FE2A.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
+  void import("./post-register-SLSXIPBV.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
   });
   return reg;
 }
@@ -7305,6 +7836,7 @@ var COLLECTION_PASSTHROUGH_KEYS = [
   "i18nFields",
   "embeddings",
   "textIndexes",
+  "textIndexPositions",
   "warmIndexOnOpen",
   "textIndexPersist",
   "moneyFields",
@@ -7696,6 +8228,7 @@ var Vault = class {
     if (collectionName === SEQUENCE_COLLECTION) throw new ReservedCollectionNameError(collectionName);
     if (isLinkCollectionName(collectionName)) throw new ReservedCollectionNameError(collectionName);
     if (isSecretBearingReservedCollection(collectionName) || isManifestReservedCollection(collectionName)) throw new ReservedCollectionNameError(collectionName);
+    if (isPeriodsReservedCollection(collectionName)) throw new ReservedCollectionNameError(collectionName);
     if (this.satelliteRegistry?.byJoined(collectionName)) {
       throw new SatelliteConfigError(`"${collectionName}" is a joined handle \u2014 use vault.joined('${collectionName}'), not vault.collection().`);
     }
@@ -7741,7 +8274,7 @@ var Vault = class {
         const strategies = options.schemaUpdate ?? [];
         const work = (async () => {
           const dek = await this.getDEK(collectionName);
-          const { persistSchemaIfNeeded } = await import("./register-I2DZXGAR.js");
+          const { persistSchemaIfNeeded } = await import("./register-F3OYE7MJ.js");
           const result = await persistSchemaIfNeeded({
             store: this.adapter,
             vault: this.name,
@@ -7891,7 +8424,7 @@ var Vault = class {
         const work = (async () => {
           try {
             const dek = await this.getDEK(collectionName);
-            await (await import("./register-I2DZXGAR.js")).persistSchemaIfNeeded({
+            await (await import("./register-F3OYE7MJ.js")).persistSchemaIfNeeded({
               store: this.adapter,
               vault: this.name,
               collectionName,
@@ -7937,7 +8470,7 @@ var Vault = class {
    * writes (unfenced walk — see `with-shape/satellites/migrate-cek.ts`); resumable.
    */
   async migrateSatellitePerRecordKeys(satelliteName) {
-    const { migrateSatelliteCek } = await import("./migrate-cek-5ENH64AA.js");
+    const { migrateSatelliteCek } = await import("./migrate-cek-V7GKJZ7O.js");
     return migrateSatelliteCek(satelliteName, this.collection(satelliteName, { perRecordKeys: true }));
   }
   /**
@@ -7980,6 +8513,10 @@ var Vault = class {
     if (!coll) return;
     await coll._applyRemoteChange(docId, action);
   }
+  /** @internal #1362 — verb-less variant; no-op for a collection this instance never opened. */
+  async _applyRemoteSignal(collectionName, docId) {
+    await this.collectionCache.get(collectionName)?._applyRemoteSignal(docId);
+  }
   /** @internal #598: refresh cache entries a sync-applied write rewrote underneath us. No-op if not loaded this session.
    *  #650 Task 4 (#647): a reserved-lookup collection has no `Collection` instance — instead, refresh
    *  its already-warmed `LookupHandle._syncCache` (membership/altIndex/snapshot reads never see a
@@ -8568,7 +9105,7 @@ var Vault = class {
    */
   // eslint-disable-next-line @typescript-eslint/consistent-type-imports
   async _loadPodSigner() {
-    const { loadSigner } = await import("./signer-WAMDZHEN.js");
+    const { loadSigner } = await import("./signer-MBZZMXTC.js");
     return loadSigner(this.adapter, this.name, this.getDEK);
   }
   async writeExportAudit(entry) {
@@ -9058,7 +9595,7 @@ var Vault = class {
   async _initGuards(handles) {
     if (handles.length === 0) return;
     const [{ GuardRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-4AYVUNXK.js"),
+      import("./registry-CILQFXFK.js"),
       import("./read-only-facade-BIGO37U3.js")
     ]);
     const registry = new GuardRegistry();
@@ -9086,7 +9623,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-YLEWMGAC.js"),
+      import("./registry-YCDZV3VW.js"),
       import("./read-only-facade-BIGO37U3.js")
     ]);
     const registry = new DerivationRegistry();
@@ -9118,7 +9655,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-VSSQPIGF.js");
+    const { MaterializedViewRegistry } = await import("./registry-ZGYS33TE.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -9143,7 +9680,7 @@ var Vault = class {
    */
   async _initOverlayedViews(handles) {
     if (handles.length === 0) return;
-    const { OverlayedViewRegistry } = await import("./registry-23WF3TGH.js");
+    const { OverlayedViewRegistry } = await import("./registry-XNNYQVKV.js");
     const registry = new OverlayedViewRegistry();
     const mvRegistry = this.materializedViewRegistry;
     const overlayNames = /* @__PURE__ */ new Set();
@@ -9193,27 +9730,27 @@ var Vault = class {
   /**
    * Manual re-materialize for a single registered MV (`refresh: 'manual'` consumers,
    * stale-bit recovery on vault reopen, bulk-recompute escape hatch after a strategy
-   * change). Returns `{ written, deleted, failed, residueUndecodable, residueDeclined }` (`deleted`
-   * always 0 without tombstoning; #785 splits the #782 leftovers — undecodable vs #718-declined). Throws if not registered.
+   * change). Returns `{ written, skipped, deleted, failed, residueUndecodable, residueDeclined }` (`skipped` counts rows whose
+   * content was unchanged since the last refresh, #1418; `deleted` always 0 without tombstoning; #785 splits the #782 leftovers — undecodable vs #718-declined). Throws if not registered.
    */
   async refreshView(name) {
     const registry = this.materializedViewRegistry;
     if (registry === null) {
-      return { written: 0, deleted: 0, failed: 0, residueUndecodable: [], residueDeclined: [] };
+      return { written: 0, skipped: 0, deleted: 0, failed: 0, residueUndecodable: [], residueDeclined: [] };
     }
     await registry.resolvePendingPlans();
     const reg = registry.byName(name);
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-PUAO6AKJ.js");
+    const { MaterializedViewExecutor } = await import("./executor-B6SRO2QS.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this,
       dispatchCtx: this._dispatchCtx({ collection: name, id: "refreshView" })
     });
-    const { clearMVStaleFully } = await import("./stale-DDL7WQEZ.js");
+    const { clearMVStaleFully } = await import("./stale-TJ3DYZMQ.js");
     await clearMVStaleFully(this.adapter, this.name, registry, name);
     return result;
   }
@@ -9226,7 +9763,7 @@ var Vault = class {
     if (registry === null) return { derived: 0, failed: 0, skippedFrozen: 0 };
     const strategies = registry.strategiesForSource(sourceCollection);
     if (strategies.length === 0) return { derived: 0, failed: 0, skippedFrozen: 0 };
-    const { DerivationExecutor } = await import("./executor-5NIMLSKZ.js");
+    const { DerivationExecutor } = await import("./executor-RBKM5W5K.js");
     const sourceColl = this.collection(sourceCollection);
     const records = await sourceColl.list();
     const ctx = { vault: this.derivationFacade ?? new (await import("./read-only-facade-BIGO37U3.js")).ReadOnlyVaultFacade(this, "derivation") };
@@ -9253,7 +9790,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-WUFXNYP4.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-OT6RYLOL.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key, this.getDEK, this.encrypted);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -9480,7 +10017,7 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-OVIFFPG4.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-S3AEPW2T.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
         "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (secret) first."
@@ -9502,7 +10039,7 @@ var Vault = class {
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-OVIFFPG4.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-S3AEPW2T.js");
     await revokeDelegation(this.adapter, this.name, id);
     void DELEGATIONS_COLLECTION;
   }
@@ -9730,6 +10267,10 @@ var Vault = class {
   async _assertTsWritable(existing, incoming, collection) {
     return this.periods.assertTsWritable(existing, incoming, collection);
   }
+  /** #1439 — sync superset test: could a closed period govern this row? See `periods/vault-facade.ts#couldGovern`. @internal */
+  _periodCouldGovern(record) {
+    return this.periods.couldGovern(record);
+  }
   /** List all collection names in this vault. */
   async collections() {
     const snapshot = await this.adapter.loadAll(this.name);
@@ -9755,7 +10296,7 @@ var Vault = class {
    * @see design-history/2026-05-22-schema-dump-design.md
    */
   async dumpSchema(opts = {}) {
-    const { dumpVaultSchema } = await import("./walk-3UQBRMDV.js");
+    const { dumpVaultSchema } = await import("./walk-HJ42EISE.js");
     return dumpVaultSchema(this, opts);
   }
   /**
@@ -9851,7 +10392,7 @@ var Vault = class {
    * separate vault instances now.
    */
   async getPodHandle() {
-    const { buildPodHandle } = await import("./pod-handle-Q736KYON.js");
+    const { buildPodHandle } = await import("./pod-handle-WGDFB4C2.js");
     return buildPodHandle(this.adapter, this.name);
   }
   /**
@@ -9865,7 +10406,7 @@ var Vault = class {
    * single, already-opened `Vault` instance so the
    * bundle writer can snapshot it without holding a `Noydb` reference.
    *
-   * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md
+   * @see https://github.com/noy-db/docs/blob/main/content/docs/services/public-envelope.md
    */
   async getCover(opts = {}) {
     const { readCover } = await import("./cover/index.js");
@@ -9883,7 +10424,7 @@ var Vault = class {
    * both modes round-trip cleanly.
    */
   async dump() {
-    const { dumpVault } = await import("./backup-IJTB4S4M.js");
+    const { dumpVault } = await import("./backup-7TFRVFLH.js");
     return dumpVault(this.backupContext());
   }
   /**
@@ -9935,7 +10476,7 @@ var Vault = class {
    * — there's no chain to verify against.
    */
   async load(backupJson) {
-    const { loadVault } = await import("./backup-IJTB4S4M.js");
+    const { loadVault } = await import("./backup-7TFRVFLH.js");
     return loadVault(this.backupContext(), backupJson);
   }
   /**
@@ -9967,7 +10508,7 @@ var Vault = class {
    * way to detect tampering of an in-place vault.
    */
   async verifyBackupIntegrity() {
-    const { verifyBackupIntegrity } = await import("./backup-IJTB4S4M.js");
+    const { verifyBackupIntegrity } = await import("./backup-7TFRVFLH.js");
     return verifyBackupIntegrity(this.backupContext());
   }
   /**
@@ -10197,7 +10738,7 @@ var Vault = class {
    * is the live validator object, not a serialization of it).
    */
   async exportJSON(opts = {}) {
-    const { exportVaultJSON } = await import("./backup-IJTB4S4M.js");
+    const { exportVaultJSON } = await import("./backup-7TFRVFLH.js");
     return exportVaultJSON(this.backupContext(), opts);
   }
 };
@@ -10439,7 +10980,7 @@ var ServiceBus = class {
       arr = [];
       this.#gateHandlers.set(point, arr);
     }
-    const entry = { fn: handler, needsPrior: opts?.needsPrior !== false };
+    const entry = { fn: handler, needsPrior: opts?.needsPrior !== false, scope: opts?.scope };
     arr.push(entry);
     return () => {
       const a = this.#gateHandlers.get(point);
@@ -10453,6 +10994,30 @@ var ServiceBus = class {
     const a = this.#gateHandlers.get(point);
     return a !== void 0 && a.length > 0;
   }
+  /**
+   * #1439 — could a gate at `point` fire for THIS target?
+   *
+   * ⚠️ This is the question callers almost always mean, and
+   * {@link hasGateHandlers} is not it. That one is about the bus, which is
+   * shared by the whole vault; this one consults each handler's declared
+   * {@link GateScope}. A handler that declares none counts as "may fire", so a
+   * registrant which has not thought about scope keeps today's behaviour.
+   *
+   * ⛔ A scope that throws is treated as "may fire". A predicate whose job is
+   * to permit an optimisation must never be able to disable a gate by failing.
+   */
+  gateAppliesTo(point, target) {
+    const a = this.#gateHandlers.get(point);
+    if (a === void 0 || a.length === 0) return false;
+    return a.some((e) => {
+      if (e.scope === void 0) return true;
+      try {
+        return e.scope(target);
+      } catch {
+        return true;
+      }
+    });
+  }
   /**
    * True when at least one gate handler at `point` needs the prior record
    * (the default). False when the point has no handlers or every handler
@@ -10981,10 +11546,24 @@ var NoydbSnapshots = class {
 };
 
 // src/kernel/memory-store.ts
-function memoryStore() {
+var MEMORY_STORE_OPTION_KEYS = ["full", "clockUncertaintyMs"];
+function memoryStore(options = {}) {
+  for (const k of Object.keys(options)) {
+    if (!MEMORY_STORE_OPTION_KEYS.includes(k)) {
+      throw new Error(
+        `memoryStore: unknown option \`${k}\`. Known options: ${MEMORY_STORE_OPTION_KEYS.join(", ")}.`
+      );
+    }
+  }
+  const full = options.full === true;
+  if (options.clockUncertaintyMs !== void 0 && !full) {
+    throw new Error(
+      "memoryStore: `clockUncertaintyMs` requires `full: true` \u2014 the default store clock is a counter, not milliseconds, so an ms epsilon around it would be meaningless."
+    );
+  }
+  const epsilon = options.clockUncertaintyMs ?? 0;
   const store = /* @__PURE__ */ new Map();
   let clock = 0;
-  const epsilon = 0;
   const coll = (vault, collection) => {
     let comp = store.get(vault);
     if (!comp) {
@@ -10998,11 +11577,16 @@ function memoryStore() {
     }
     return c;
   };
-  return {
+  const core = {
     name: "memory",
-    capabilities: { casAtomic: true, serverWriteTime: true, auth: { kind: "none", required: false, flow: "static" } },
+    capabilities: {
+      casAtomic: true,
+      serverWriteTime: true,
+      ...full ? { txAtomic: true } : {},
+      auth: { kind: "none", required: false, flow: "static" }
+    },
     async getStoreTime() {
-      const now = ++clock;
+      const now = full ? clock = Math.max(clock + 1, Date.now()) : ++clock;
       return { earliest: now - epsilon, latest: now + epsilon };
     },
     async get(vault, collection, id) {
@@ -11061,6 +11645,50 @@ function memoryStore() {
       return { items, nextCursor: end < ids.length ? String(end) : null };
     }
   };
+  if (!full) return core;
+  return {
+    ...core,
+    async ping() {
+      return true;
+    },
+    /**
+     * Enumerate every top-level vault held by this store — the outer Map's
+     * keys, O(vaults). Intentionally unsorted; sort at the call site if you
+     * need a stable order.
+     */
+    async listVaults() {
+      return [...store.keys()];
+    },
+    /**
+     * Multi-record atomic transaction. Validates every op's
+     * `expectedVersion` against current state first and throws on the first
+     * mismatch with nothing written, then applies every op in one
+     * synchronous burst — the Map mutations cannot interleave in the JS
+     * event loop, so this is truly atomic.
+     */
+    async tx(ops) {
+      for (const op of ops) {
+        if (op.type === "put" && !op.envelope) {
+          throw new Error(`tx: put op for ${op.id} is missing envelope`);
+        }
+        if (op.expectedVersion === void 0) continue;
+        const actual = store.get(op.vault)?.get(op.collection)?.get(op.id)?._v ?? 0;
+        if (actual !== op.expectedVersion) {
+          throw new ConflictError(
+            actual,
+            `tx: ${op.vault}/${op.collection}/${op.id} expected v${op.expectedVersion}, found v${actual}`
+          );
+        }
+      }
+      for (const op of ops) {
+        if (op.type === "put") {
+          coll(op.vault, op.collection).set(op.id, op.envelope);
+        } else {
+          store.get(op.vault)?.get(op.collection)?.delete(op.id);
+        }
+      }
+    }
+  };
 }
 
 // src/with-party/team/noydb-facade.ts
@@ -11091,6 +11719,9 @@ var TeamFacade = class {
     this.deps.checkPolicyOperation(vault, "grant");
     await this.deps.checkGate(vault, "enroll-user", factors);
     const keyring = await this.deps.getKeyringInternal(vault);
+    if (this.deps.options.periodsStrategy !== void 0) {
+      await (await ensureCollectionDEK(this.deps.options.store, vault, keyring))(PERIODS_COLLECTION);
+    }
     await engine(this.deps.options.store, vault, keyring, options);
   }
   /** Gate + run a `revoke` engine. See `Noydb.revoke` for the public contract. */
@@ -11142,9 +11773,18 @@ var TeamFacade = class {
     this.deps.keyringCache.set(vault, next);
   }
   /**
-   * Remove a tier-2 authenticator slot. Idempotent — removing a
-   * non-existent slot is a successful no-op. Gated by
+   * Remove a tier-2 authenticator slot. Idempotent — removing a slot
+   * that is not in the keyring is a successful no-op. Gated by
    * `remove-authenticator`.
+   *
+   * ⚠️ Idempotency needs the slot list to be VISIBLE, and a tier-3
+   * PIN-resumed / session-restored keyring carries an empty one
+   * (#1426). Such a session throws `ValidationError` rather than
+   * reporting a removal it did not perform — re-authenticate at tier 1
+   * first.
+   *
+   * @throws `ValidationError` when the active keyring cannot see its
+   *   slot list (`kek === null`).
    */
   async removeAuthenticator(vault, slotId, factors) {
     await this.deps.checkGate(vault, "remove-authenticator", factors);
@@ -12125,10 +12765,14 @@ var Noydb = class {
       if (!facade) return;
       const ctx = { existing, vault: facade, userId: e.userId, role: e.role };
       await registry.runChecks(e.collection, incoming, ctx);
-      const { GuardExecutor } = await import("./executor-AQVXV5GZ.js");
+      const { GuardExecutor } = await import("./executor-BI5CHWRY.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, e.docId, existing, incoming, e.computedFieldNames);
       }
+    }, {
+      // #1439 — this handler's own first two early-returns, hoisted so a caller can ask
+      // "could a guard fire HERE" without writing. See `ServiceBus.gateAppliesTo`.
+      scope: ({ vault, collection }) => (this.vaultCache.get(vault)?._getGuardRegistry()?.guardsFor(collection).length ?? 0) > 0
     });
     this.subsystemBus.registerGate("beforeDelete", async (e) => {
       const v = this.vaultCache.get(e.vault);
@@ -12172,6 +12816,9 @@ var Noydb = class {
       if (!v) return;
       const existing = e.op === "create" ? null : { ts: e.existingTs ?? null, record: e.existing ?? null };
       await v._assertTsWritable(existing, e.incoming, e.collection);
+    }, {
+      // #1439 — a period governs a row only through its `dateField`; see `couldGovern`.
+      scope: ({ vault, record }) => this.vaultCache.get(vault)?._periodCouldGovern(record) ?? true
     });
     this.subsystemBus.registerGate("beforeDelete", async (e) => {
       if (e.internal) return;
@@ -13061,6 +13708,15 @@ var Noydb = class {
     }
     return { dispose: () => this.disableTabCoordination() };
   }
+  /** @internal #1362 — `ChangeBroadcastHost`: re-read one broadcast address through THIS
+   *  instance's own keyring. No-op for a vault this instance has not opened. */
+  _applyRemoteSignal(vaultName, collectionName, id) {
+    return this.vaultCache.get(vaultName)?._applyRemoteSignal(collectionName, id) ?? Promise.resolve();
+  }
+  /** @internal #1362 — `ChangeBroadcastHost`: store backend name, for the default channel name. */
+  get _storeName() {
+    return this.options.store.name;
+  }
   #applyRemoteWrite(vaultName, collectionName, docId, action) {
     const v = this.vaultCache.get(vaultName);
     if (!v) return Promise.resolve();
@@ -13284,7 +13940,7 @@ var Noydb = class {
    * keyring file at `_keyring/<userId>` and the envelope ciphertext at
    * `_users/<keyringId>` remain observable to anyone with direct store
    * read access — only the hub-level enumeration is gated. See
-   * `https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/user-envelope.md` → "Directory visibility".
+   * `https://github.com/noy-db/docs/blob/main/content/docs/services/user-envelope.md` → "Directory visibility".
    */
   async setDirectoryEnabled(vault, enabled) {
     if (this.closed) throw new ValidationError("Instance is closed");
@@ -13368,7 +14024,7 @@ var Noydb = class {
     this.activeTier.set(vault, tier);
   }
   // ─── Tier-2 enroll / remove ─────────────────────────────────────
-  // ─── Cover (https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md) ──────
+  // ─── Cover (https://github.com/noy-db/docs/blob/main/content/docs/services/public-envelope.md) ──────
   /**
    * Set the owner-curated cover for a vault. Throws
    * `ValidationError` if the developer did not opt the hub into
@@ -13497,7 +14153,7 @@ async function createNoydb(options) {
   if (!options.store) options = { ...options, store: memoryStore() };
   validateSecretModeOptions(options);
   if (!options.mesh) options = { ...options, mesh: await createDefaultMesh(options.store) };
-  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-TXFOVOXX.js")).createUserApi };
+  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-GVYEKSJE.js")).createUserApi };
   if (!options.policyFactory) {
     const policyModule = await import("./policy/index.js");
     options = { ...options, policyFactory: policyModule.createNoydbPolicy, policyCheckGateFn: policyModule.checkGate };
@@ -13530,4 +14186,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-6GOE5PGN.js.map
+//# sourceMappingURL=chunk-T2LBQ5DV.js.map