@noy-db/hub 0.7.1-pre.0 → 0.8.0

package/dist/{chunk-ZYIYHJ5R.js → chunk-MXOQ5JCG.js}

@@ -7,92 +7,80 @@ import {
   isLinkCollectionName,
   linkCollectionName,
   linkRowKey
-} from "./chunk-QIZPZMUI.js";
+} from "./chunk-Q4UHJ5SN.js";
 import {
   hashFields,
   validateSatelliteDeclaration
-} from "./chunk-TUFM4UZP.js";
+} from "./chunk-XQRFSKYM.js";
 import {
   resolveStaleOnRead
-} from "./chunk-SMH6SRX7.js";
+} from "./chunk-JOSPH3E5.js";
 import {
   loadFence
-} from "./chunk-453F654R.js";
+} from "./chunk-VAORSCSU.js";
 import {
   buildPersistedIndexCallbacks,
   syncTierSearch
-} from "./chunk-UP4BECPY.js";
+} from "./chunk-Y3LPTBG7.js";
 import {
   isBaseLive,
   liveBaseIdSet
-} from "./chunk-GYGLAVCX.js";
+} from "./chunk-2MG3SW7Q.js";
 import {
   SchemaUpdateGate
 } from "./chunk-6LJY7X5A.js";
-import {
-  NO_ATTESTATION
-} from "./chunk-Q7HZX3IF.js";
 import {
   NO_TIERS,
   classifySealedShred,
   syncDerivedOutputs
-} from "./chunk-M4YPHYEH.js";
+} from "./chunk-DHHGL42E.js";
 import {
   NO_PORTABILITY
-} from "./chunk-BZ3534YM.js";
+} from "./chunk-AUKKUPVB.js";
 import {
   NO_CARGO
-} from "./chunk-NQKIUNW5.js";
+} from "./chunk-52MGURXO.js";
 import {
   saveSealedSecret
-} from "./chunk-4GVM6QZA.js";
+} from "./chunk-3XJQBBZD.js";
 import {
   runDrainBarrier
-} from "./chunk-VTFVLCUH.js";
+} from "./chunk-DIZLQVAA.js";
 import {
   fallbackDerivationName
 } from "./chunk-RXLYKVTF.js";
-import {
-  NO_SEQUENCE,
-  SEQUENCE_COLLECTION,
-  compileSequenceFormat,
-  resolveSequenceKey
-} from "./chunk-GPNTB4Y7.js";
 import {
   CustodyApi,
   NO_CUSTODY
-} from "./chunk-UHHPLO3I.js";
+} from "./chunk-V3RWOOSO.js";
 import {
   DEFAULT_POSTURE,
-  EXPORT_REDACTION_MARKER,
   ViaGraph,
-  ViaPipeline,
   buildDescription,
   collectKnownFieldNames,
   computedEntryParts,
   deriveZodFields,
-  exportRedact,
   guardReconcileCollisions,
   mergeViaFields,
   resolveCollectionConfig,
   resolveComputedEdges,
   resolveDescribeFieldIds,
   resolveVirtualMoneyFields
-} from "./chunk-CUQPWYRX.js";
+} from "./chunk-IUT3GWP3.js";
 import {
   findMatchingIdsByPairs
 } from "./chunk-TFMM5DBB.js";
 import {
   encodeVecId
-} from "./chunk-RTBJ5IOO.js";
+} from "./chunk-M5B2W6YY.js";
 import {
   NO_CLASSIFIED,
   guardClassifiedCompat,
   resolveClassifiedFields
-} from "./chunk-5VCRVKOZ.js";
+} from "./chunk-GUZET4SG.js";
 import {
   derivePersistedSchema
-} from "./chunk-ACAQ2DSG.js";
+} from "./chunk-747G6CT3.js";
 import {
   findRollupSpecForIntent,
   forgetDerivedFanout,
@@ -102,7 +90,7 @@ import {
   runGraphDispatchWave,
   selfWriteFieldEqual,
   touchFor
-} from "./chunk-3BZZJJMQ.js";
+} from "./chunk-MILI22XQ.js";
 import {
   buildLookupAltIndex,
   buildLookupSnapshotRows,
@@ -117,25 +105,30 @@ import {
   resolveDictSource,
   resolveLabelFromMap,
   updateReferencingRecords
-} from "./chunk-R7BX2NB3.js";
+} from "./chunk-244QBK7Z.js";
 import {
   OverlayedCollection
-} from "./chunk-SKGMN35F.js";
+} from "./chunk-HS554XAF.js";
 import {
   INDEXED_STORE_POLICY,
   NO_SYNC
 } from "./chunk-T7IR4N2S.js";
 import {
-  NO_CONSENT
-} from "./chunk-PEOZ34EM.js";
+  NO_ATTESTATION
+} from "./chunk-PD64727P.js";
+import {
+  NO_COVERAGE
+} from "./chunk-RHVMZSUU.js";
 import {
   NO_PERIODS,
   isEffectivelyReopened,
+  isOrderableBusinessDate,
+  malformedBusinessDate,
   purgeMarkersOn,
   resolvePeriodKey,
   resolveReopenState,
   samePartition
-} from "./chunk-2ENE6445.js";
+} from "./chunk-3A5DUZ56.js";
 import {
   PERIODS_COLLECTION,
   PERIOD_ARCHIVES_COLLECTION,
@@ -143,7 +136,7 @@ import {
   PERIOD_REOPENS_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION,
   periodExclusiveUpperBound
-} from "./chunk-FAHMLERK.js";
+} from "./chunk-QBLT6POL.js";
 import {
   NO_SHADOW
 } from "./chunk-SMY5X46Z.js";
@@ -152,38 +145,37 @@ import {
 } from "./chunk-DZFQVICS.js";
 import {
   TxContext,
-  bestEffortRevert
-} from "./chunk-BLN54W3L.js";
+  bestEffortRevert,
+  trackKeyedWrite
+} from "./chunk-UA372JHH.js";
 import {
   lazy
 } from "./chunk-5D2ALSM5.js";
 import {
+  INDEX_SNAPSHOT_VERSION,
   InvertedIndex,
   MemoryIndexStore,
   NO_SEARCH
-} from "./chunk-LH5A3ZPG.js";
-import {
-  NO_SEALED_RECORD
-} from "./chunk-6YXCPL4T.js";
+} from "./chunk-RB4DOPGZ.js";
 import {
-  Query,
-  ScanBuilder
-} from "./chunk-7MG2LHO5.js";
+  NO_SEQUENCE,
+  SEQUENCE_COLLECTION,
+  compileSequenceFormat,
+  resolveSequenceKey
+} from "./chunk-VFHCKG5M.js";
 import {
   EXPORT_AUDIT_COLLECTION,
   NO_BLOBS,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-7APJ6CO6.js";
+} from "./chunk-JSMTXZR3.js";
 import {
   LazyQuery,
   NO_INDEXING,
+  compositeKey,
   decodeIdxId,
   encodeIdxId
-} from "./chunk-KTFRCC5C.js";
-import {
-  normalizeIndexDefs
-} from "./chunk-I3ISCYT7.js";
+} from "./chunk-V7ADQF5O.js";
 import {
   IMPLICIT_LAZY
 } from "./chunk-66TQOPFM.js";
@@ -193,28 +185,49 @@ import {
 import {
   canonicalGroupKey
 } from "./chunk-XZHEOSQ2.js";
+import {
+  NO_CRDT
+} from "./chunk-PVEWA2DU.js";
+import {
+  NO_CONSENT
+} from "./chunk-GSAK56VF.js";
+import {
+  NO_SEALED_RECORD
+} from "./chunk-UEFOQH74.js";
+import {
+  normalizeIndexDefs,
+  parseFieldIndexSnapshot
+} from "./chunk-2AFX33YA.js";
+import {
+  EXPORT_REDACTION_MARKER,
+  ViaPipeline,
+  exportRedact
+} from "./chunk-3EWS67C7.js";
+import {
+  ScanBuilder
+} from "./chunk-JQYKPKG6.js";
+import {
+  Query
+} from "./chunk-AL6ML4LA.js";
 import {
   NO_REDUCE
-} from "./chunk-YMUFFJCO.js";
+} from "./chunk-3TDUWVWB.js";
 import {
   readPath
-} from "./chunk-NSITFOCJ.js";
-import {
-  NO_CRDT
-} from "./chunk-PVEWA2DU.js";
+} from "./chunk-5WWDGFOS.js";
 import {
   dictCollectionName
-} from "./chunk-Q2MPFCQ7.js";
+} from "./chunk-23D6M6VM.js";
 import {
   NO_I18N,
   getAtPath,
   isDictCollectionName,
   isStaticDictDescriptor
-} from "./chunk-TRGTKX5E.js";
+} from "./chunk-OKSTSITU.js";
 import {
   isViaInstalled,
   viaBinder
-} from "./chunk-UXVWEX5L.js";
+} from "./chunk-SYNY3VB5.js";
 import {
   NO_TEAM,
   describeAllUsersAuth,
@@ -237,7 +250,7 @@ import {
   saveShamirRecoveryEntries,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-WQBG4SZS.js";
+} from "./chunk-DQESF6RP.js";
 import {
   assertKeyringOpenAllowed,
   buildRecipientKeyringFile,
@@ -252,15 +265,15 @@ import {
   listUsers,
   loadKeyring,
   updateKeyringIdentity
-} from "./chunk-3V4KWFX7.js";
+} from "./chunk-XSPFDUDG.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
-} from "./chunk-XKWGNJ26.js";
+} from "./chunk-LIOVX5TJ.js";
 import {
   NO_BROKER,
   buildCredentialBrokerHandle
-} from "./chunk-JBDFMYKQ.js";
+} from "./chunk-GZT3NQRA.js";
 import {
   NO_SESSION
 } from "./chunk-VKQCVU2Z.js";
@@ -269,19 +282,19 @@ import {
 } from "./chunk-4AOERLTV.js";
 import {
   NO_HISTORY
-} from "./chunk-AYX7AINO.js";
+} from "./chunk-LNSVGRHO.js";
 import {
   sha256Hex
-} from "./chunk-QPQUVOZ2.js";
+} from "./chunk-6QVKPHBF.js";
 import {
   assertCutoverTierSafe,
   assertTierWritable,
   dekKey,
   liveRecordIsElevated
-} from "./chunk-JMGDHKQF.js";
+} from "./chunk-FLPCETP6.js";
 import {
   NO_VAULT_HEAD
-} from "./chunk-HK67PX4J.js";
+} from "./chunk-HW7CMKUG.js";
 import {
   NO_FORGET,
   addSubjectRef,
@@ -290,36 +303,34 @@ import {
   readDottedPath,
   rebuildSubjectIndex,
   removeSubjectRef
-} from "./chunk-RF6D3Y5E.js";
+} from "./chunk-JDEYF3PJ.js";
 import {
   RecordCodec,
   SEALED_CEK_NS,
   applyRewrappedBody,
+  buildDeleteMarker,
   buildRecordAad,
+  buildRecordEnvelope,
+  buildTombstone,
+  encrypt,
   findByDet,
   hasPerRecordKey,
   hasSealedBody,
+  isDeleteMarker,
+  isTombstone,
   makeReservedEnvelopes,
   openEnvelopeJson,
   queryByDet,
   resolveStableCek,
   rewrapBodyToDek,
-  validateSchemaInput,
   verifyRecordIdentity
-} from "./chunk-4ZS56W5S.js";
-import {
-  buildDeleteMarker,
-  buildRecordEnvelope,
-  buildTombstone,
-  isDeleteMarker,
-  isTombstone
-} from "./chunk-SZJ3DLZA.js";
+} from "./chunk-EZGV6F47.js";
 import {
-  encrypt
-} from "./chunk-HPVZCW43.js";
+  validateSchemaInput
+} from "./chunk-42ALPZ2B.js";
 import {
   SealedHandle
-} from "./chunk-7MG7SJT7.js";
+} from "./chunk-SV2PM2OY.js";
 import {
   AlreadyElevatedError,
   AttestationError,
@@ -357,10 +368,9 @@ import {
   TierNotGrantedError,
   USER_ENVELOPE_COLLECTION,
   UniqueConstraintError,
-  UnsupportedIndexOptionError,
   ValidationError,
   isConflictError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/kernel/merge-authority.ts
 function buildMergeAuthority(keyring) {
@@ -442,6 +452,7 @@ var STRATEGY_DEFAULTS = {
   cargo: NO_CARGO,
   classified: NO_CLASSIFIED,
   consent: NO_CONSENT,
+  coverage: NO_COVERAGE,
   crdt: NO_CRDT,
   custody: NO_CUSTODY,
   forget: NO_FORGET,
@@ -540,7 +551,7 @@ function validateSecretModeOptions(options) {
 }
 async function resolveEffectiveSecret(options, store, vault) {
   if (options.secretMode === "managed") {
-    const { resolveManagedSecret } = await import("./managed-secret-NCWEMPUQ.js");
+    const { resolveManagedSecret } = await import("./managed-secret-MFTFT22X.js");
     return resolveManagedSecret(store, vault, options.sealingKey);
   }
   return options.secret;
@@ -558,7 +569,7 @@ function ownerKeyringOptions(options, secret) {
 
 // src/port/by/default-provider.ts
 async function createDefaultMesh(store) {
-  const { StoreMesh } = await import("./store-coordination-provider-4WZAIRHC.js");
+  const { StoreMesh } = await import("./store-coordination-provider-C4BPT5XF.js");
   return new StoreMesh(store);
 }
 
@@ -613,6 +624,60 @@ function populateCollectionRegistries(r, collectionName, options, effectiveViaFi
   }
 }
 
+// src/kernel/generation-map.ts
+var tick = 0;
+var GenerationMap = class extends Map {
+  /**
+   * ⚠️ NOT a `#private` field, and not readonly-initialised, deliberately.
+   * `Map`'s constructor calls `this.set()` for each entry of an iterable
+   * argument — which runs BEFORE this class's fields are installed. A
+   * `#private` field throws `TypeError` on touch at that point; a declared
+   * property is merely `undefined`, and assigning to it is safe. The
+   * initializer below then runs and resets it to 0, which is the correct
+   * resting state for a freshly built map.
+   */
+  gen = 0;
+  /** Mutation stamp. Equal across two reads means nothing changed between them. */
+  get generation() {
+    return this.gen;
+  }
+  set(key, value) {
+    this.gen = ++tick;
+    return super.set(key, value);
+  }
+  delete(key) {
+    this.gen = ++tick;
+    return super.delete(key);
+  }
+  clear() {
+    this.gen = ++tick;
+    super.clear();
+  }
+};
+
+// src/kernel/present-cache.ts
+var memo = /* @__PURE__ */ new WeakMap();
+function presentVariantKey(locale, layer, fallback) {
+  const chain = fallback === void 0 ? "" : Array.isArray(fallback) ? fallback.join(",") : String(fallback);
+  return `${locale ?? ""} ${layer} ${chain}`;
+}
+function memoizePresent(record, variant, compute) {
+  let variants = memo.get(record);
+  if (!variants) {
+    variants = /* @__PURE__ */ new Map();
+    memo.set(record, variants);
+  }
+  const hit = variants.get(variant);
+  if (hit !== void 0) return hit;
+  const scope = variants;
+  const pending = compute().catch((err) => {
+    scope.delete(variant);
+    throw err;
+  });
+  scope.set(variant, pending);
+  return pending;
+}
+
 // src/kernel/lazy-count.ts
 var COUNT_PAGE_SIZE = 1e3;
 function isLive(env, storeCiphertext) {
@@ -675,6 +740,121 @@ async function applyCutoverTransform(ctx) {
   return count;
 }
 
+// src/with-lookup/indexing/persisted-field-indexes.ts
+function fieldIndexFingerprint(cache) {
+  let sum = 0;
+  let xor = 0;
+  let maxVersion = 0;
+  for (const [id, entry] of cache) {
+    const h = fnv1a(`${id} ${entry.version}`);
+    sum = sum + h >>> 0;
+    xor = (xor ^ h) >>> 0;
+    if (entry.version > maxVersion) maxVersion = entry.version;
+  }
+  return { count: cache.size, maxVersion, digest: `${sum.toString(36)}.${xor.toString(36)}` };
+}
+function fnv1a(s) {
+  let h = 2166136261;
+  for (let i = 0; i < s.length; i++) {
+    h ^= s.charCodeAt(i);
+    h = Math.imul(h, 16777619) >>> 0;
+  }
+  return h >>> 0;
+}
+function fpEqual(a, b) {
+  return a.count === b.count && a.maxVersion === b.maxVersion && a.digest === b.digest;
+}
+var PersistedFieldIndexes = class {
+  constructor(cb) {
+    this.cb = cb;
+    this.debounceMs = cb.debounceMs ?? 1e3;
+  }
+  cb;
+  timer = null;
+  debounceMs;
+  /** True when at least one index on this collection asked to be persisted. */
+  get enabled() {
+    return this.cb.keys().length > 0;
+  }
+  /**
+   * Restore whatever is fresh. Returns the sidecar keys that were adopted —
+   * the caller rebuilds every other declared index from the cache. Never
+   * throws for a bad blob: an unreadable sidecar is indistinguishable from an
+   * absent one, and both mean "rebuild".
+   */
+  async restore(isLive2) {
+    const keys = this.cb.keys();
+    if (keys.length === 0) return EMPTY;
+    const live = this.cb.currentFingerprint();
+    const restored = /* @__PURE__ */ new Set();
+    for (const key of keys) {
+      let loaded = null;
+      try {
+        loaded = await this.cb.load(key);
+      } catch {
+        continue;
+      }
+      if (loaded === null || !fpEqual(loaded.fingerprint, live)) continue;
+      const snap = parseFieldIndexSnapshot(loaded.json);
+      if (snap === null) continue;
+      if (this.cb.restore(key, snap, isLive2)) restored.add(key);
+    }
+    return restored;
+  }
+  /** Schedule a debounced write of every opted-in sidecar. */
+  markDirty() {
+    if (this.cb.keys().length === 0) return;
+    if (this.timer) clearTimeout(this.timer);
+    this.timer = setTimeout(() => {
+      this.timer = null;
+      void this.persist().catch(() => {
+      });
+    }, this.debounceMs);
+  }
+  /** Force an immediate write (cancels any pending debounce). */
+  async flush() {
+    if (this.timer) {
+      clearTimeout(this.timer);
+      this.timer = null;
+    }
+    await this.persist();
+  }
+  /** Delete every sidecar — erasure, and any point the blobs must not survive. */
+  async removeAll() {
+    if (this.timer) {
+      clearTimeout(this.timer);
+      this.timer = null;
+    }
+    let purged = 0;
+    const residue = [];
+    for (const key of this.cb.keys()) {
+      try {
+        await this.cb.remove(key);
+        purged++;
+      } catch {
+        residue.push(key);
+      }
+    }
+    return { purged, residue };
+  }
+  /** Drop a pending debounce without writing (collection teardown). */
+  dispose() {
+    if (this.timer) {
+      clearTimeout(this.timer);
+      this.timer = null;
+    }
+  }
+  async persist() {
+    const fp = this.cb.currentFingerprint();
+    for (const key of this.cb.keys()) {
+      const snap = this.cb.snapshot(key);
+      if (!snap) continue;
+      await this.cb.save(key, JSON.stringify(snap), fp);
+    }
+  }
+};
+var EMPTY = /* @__PURE__ */ new Set();
+
 // src/with-lookup/indexing/collection-facade.ts
 function readPersistedValue(record, field) {
   if (!field.includes(".")) return record[field];
@@ -713,14 +893,98 @@ function valuesMatch(stored, live) {
     return false;
   }
 }
-function rebuildEagerIndexesFromCache(ctx) {
+function rebuildEagerIndexesFromCache(ctx, skip) {
   const eager = ctx.indexes;
   if (!eager || eager.fields().length === 0) return;
   const snapshot = [];
   for (const [id, entry] of ctx.cache) {
     snapshot.push({ id, record: entry.record });
   }
-  eager.build(snapshot);
+  eager.build(snapshot, skip);
+}
+var FIELD_IDX = "_fieldidx";
+function buildFieldIndexCallbacks(provideCtx, debounceMs) {
+  const sidecarId = (name, key) => `${name}/${key}`;
+  return {
+    keys: () => provideCtx().indexes?.persistableKeys() ?? [],
+    snapshot: (key) => provideCtx().indexes?.snapshotIndex(key),
+    restore: (key, snap, isLive2) => provideCtx().indexes?.restoreIndex(key, snap, isLive2) ?? false,
+    load: async (key) => {
+      const ctx = provideCtx();
+      const id = sidecarId(ctx.name, key);
+      const env = await ctx.adapter.get(ctx.vault, FIELD_IDX, id);
+      if (!env) return null;
+      const body = await ctx.codec.decryptJsonString({ collection: FIELD_IDX, id }, env);
+      if (body === null) return null;
+      try {
+        const wrapped = JSON.parse(body);
+        if (typeof wrapped?.idx !== "string" || typeof wrapped?.fp?.digest !== "string") return null;
+        return { json: wrapped.idx, fingerprint: wrapped.fp };
+      } catch {
+        return null;
+      }
+    },
+    save: async (key, json, fp) => {
+      const ctx = provideCtx();
+      const id = sidecarId(ctx.name, key);
+      const body = JSON.stringify({ fp, idx: json });
+      const env = await ctx.codec.encryptJsonString({ collection: FIELD_IDX, id }, body, fp.count);
+      await ctx.adapter.put(ctx.vault, FIELD_IDX, id, env);
+    },
+    remove: async (key) => {
+      const ctx = provideCtx();
+      await ctx.adapter.delete(ctx.vault, FIELD_IDX, sidecarId(ctx.name, key));
+    },
+    currentFingerprint: () => fieldIndexFingerprint(provideCtx().cache),
+    ...debounceMs !== void 0 ? { debounceMs } : {}
+  };
+}
+function createPersistedFieldIndexes(provideCtx, indexes) {
+  if ((indexes?.persistableKeys().length ?? 0) === 0) return null;
+  return new PersistedFieldIndexes(buildFieldIndexCallbacks(provideCtx));
+}
+async function hydrateEagerIndexes(ctx) {
+  const store = ctx.fieldIndexes;
+  if (!store || !store.enabled || !ctx.indexes) {
+    rebuildEagerIndexesFromCache(ctx);
+    return;
+  }
+  const restored = await store.restore((id) => ctx.cache.has(id));
+  rebuildEagerIndexesFromCache(ctx, restored);
+  if (restored.size < ctx.indexes.persistableKeys().length) store.markDirty();
+}
+async function checkUniqueOnPut(ctx, id, record) {
+  const set = ctx.uniqueConstraints;
+  if (!set || set.enforcement === "detect") return;
+  if (!ctx.lazy) {
+    set.check(id, record);
+    return;
+  }
+  const persisted = ctx.persistedIndexes;
+  if (!persisted) {
+    throw new Error(
+      `Collection "${ctx.name}": a unique index in lazy mode (prefetch: false) needs the indexing service. Pass \`withIndexing()\` from "@noy-db/hub/indexing" to \`createNoydb({ indexingStrategy })\`.`
+    );
+  }
+  await ctx.ensurePersistedIndexesLoaded();
+  const rec = record;
+  for (const fields of set.fieldTuples()) {
+    const values = [];
+    for (const f of fields) {
+      const v = readPersistedValue(rec, f);
+      if (v === null || v === void 0) {
+        values.length = 0;
+        break;
+      }
+      values.push(v);
+    }
+    if (values.length === 0) continue;
+    const holders = persisted.probeEqual(compositeKey(fields), fields.length === 1 ? values[0] : values);
+    if (!holders) continue;
+    for (const holder of holders) {
+      if (holder !== id) throw new UniqueConstraintError(ctx.name, id, fields, holder);
+    }
+  }
 }
 function rebuildUniqueConstraintsFromCache(ctx) {
   if (!ctx.uniqueConstraints) return;
@@ -916,10 +1180,11 @@ async function maintainPersistedIndexesOnDelete(ctx, id, previousRecord) {
   }
 }
 async function purgePersistedIndexes(ctx, id) {
+  const field = ctx.fieldIndexes ? await ctx.fieldIndexes.removeAll() : { purged: 0, residue: [] };
   const persisted = ctx.persistedIndexes;
-  if (!persisted) return { purged: 0, residue: [] };
-  let purged = 0;
-  const residue = [];
+  if (!persisted) return field;
+  let purged = field.purged;
+  const residue = [...field.residue];
   for (const def of persisted.definitions()) {
     try {
       await ctx.adapter.delete(ctx.vault, ctx.name, encodeIdxId(def.key, id));
@@ -947,19 +1212,108 @@ async function resolveTierSyncPrior(ctx, id, priorEnvelope) {
   if (!ctx.lazy || !priorEnvelope || (priorEnvelope._tier ?? 0) > 0) return null;
   return await ctx.codec.decryptRecord({ collection: ctx.name, id }, priorEnvelope, { skipValidation: true });
 }
+function resolveDeclaredIndexes(defs, collectionName, indexingEnabled) {
+  const declared = normalizeIndexDefs(defs);
+  if (indexingEnabled || declared.length === 0) return declared;
+  const fields = [...new Set(declared.flatMap((d) => [...d.fields]))];
+  console.warn(
+    `[noy-db] collection "${collectionName}" declares indexes ${JSON.stringify(fields)} but no indexingStrategy was passed to createNoydb() \u2014 every query on it will scan. Pass \`indexingStrategy: withIndexing()\` from "@noy-db/hub/indexing", or drop the \`indexes:\` declaration if a scan is intended.`
+  );
+  return declared;
+}
 
 // src/with-lookup/search/serialize.ts
 function serializeIndex(idx) {
   return JSON.stringify(idx.toSnapshot());
 }
 function deserializeIndex(json) {
-  return InvertedIndex.fromSnapshot(JSON.parse(json));
+  const snap = parseIndexSnapshot(json);
+  return snap === null ? null : InvertedIndex.fromSnapshot(snap);
+}
+function parseIndexSnapshot(json) {
+  let raw;
+  try {
+    raw = JSON.parse(json);
+  } catch {
+    return null;
+  }
+  if (typeof raw !== "object" || raw === null) return null;
+  const o = raw;
+  if (o["v"] !== INDEX_SNAPSHOT_VERSION) return null;
+  if (!isStringArray(o["posFields"])) return null;
+  if (!Array.isArray(o["fieldStats"]) || !Array.isArray(o["docs"])) return null;
+  const posFields = new Set(o["posFields"]);
+  const fieldStats = [];
+  for (const e of o["fieldStats"]) {
+    if (!Array.isArray(e) || e.length !== 2 || typeof e[0] !== "string") return null;
+    const s = e[1];
+    if (typeof s !== "object" || s === null) return null;
+    if (!isCountPairs(s["df"]) || !isNonNegInt(s["n"]) || !isNonNegInt(s["totalLen"])) return null;
+    fieldStats.push([e[0], { df: s["df"], n: s["n"], totalLen: s["totalLen"] }]);
+  }
+  const docs = [];
+  for (const e of o["docs"]) {
+    if (typeof e !== "object" || e === null) return null;
+    const d = e;
+    if (typeof d["id"] !== "string" || typeof d["field"] !== "string" || typeof d["text"] !== "string") return null;
+    if (!isNonNegInt(d["len"])) return null;
+    if (d["locale"] !== void 0 && typeof d["locale"] !== "string") return null;
+    if (!isCountPairs(d["tf"]) || !isCountPairs(d["firstOffset"])) return null;
+    const wantsPos = posFields.has(d["field"]);
+    if (wantsPos !== (d["pos"] !== void 0)) return null;
+    let pos;
+    if (d["pos"] !== void 0) {
+      if (!isPositionPairs(d["pos"], d["len"])) return null;
+      pos = d["pos"];
+    }
+    docs.push({
+      id: d["id"],
+      field: d["field"],
+      text: d["text"],
+      len: d["len"],
+      tf: d["tf"],
+      firstOffset: d["firstOffset"],
+      ...d["locale"] !== void 0 ? { locale: d["locale"] } : {},
+      ...pos !== void 0 ? { pos } : {}
+    });
+  }
+  return { v: INDEX_SNAPSHOT_VERSION, posFields: o["posFields"], fieldStats, docs };
+}
+function isNonNegInt(x) {
+  return typeof x === "number" && Number.isInteger(x) && x >= 0;
+}
+function isStringArray(x) {
+  return Array.isArray(x) && x.every((s) => typeof s === "string");
+}
+function isCountPairs(x) {
+  return Array.isArray(x) && x.every((p) => Array.isArray(p) && p.length === 2 && typeof p[0] === "string" && isNonNegInt(p[1]));
+}
+function isPositionPairs(x, len) {
+  if (!Array.isArray(x)) return false;
+  for (const p of x) {
+    if (!Array.isArray(p) || p.length !== 2 || typeof p[0] !== "string") return false;
+    const list = p[1];
+    if (!Array.isArray(list) || list.length === 0) return false;
+    let prev = -1;
+    for (const n of list) {
+      if (!isNonNegInt(n) || n <= prev || n >= len) return false;
+      prev = n;
+    }
+  }
+  return true;
 }
 
 // src/with-lookup/search/persisted-index-store.ts
-function fpEqual(a, b) {
+function fpEqual2(a, b) {
   return a.count === b.count && a.maxVersion === b.maxVersion;
 }
+function positionsMatch(idx, opts) {
+  const want = new Set(opts?.positions ?? []);
+  const have = idx.positionFields;
+  if (want.size !== have.size) return false;
+  for (const f of want) if (!have.has(f)) return false;
+  return true;
+}
 var PersistedIndexStore = class {
   constructor(cb) {
     this.cb = cb;
@@ -969,6 +1323,9 @@ var PersistedIndexStore = class {
   index;
   timer = null;
   lastBuild;
+  /** The positional-postings opt-in the last caller asked for (#1354). A loaded
+   *  sidecar that does not carry exactly these fields is discarded, not adapted. */
+  lastOpts;
   debounceMs;
   /**
    * Bumped by every purge (removePersisted). A save() captured under a since-stale
@@ -1015,16 +1372,20 @@ var PersistedIndexStore = class {
   get built() {
     return this.index !== void 0;
   }
-  async ensureBuilt(build) {
+  async ensureBuilt(build, opts) {
     await this.retryPendingCompensation();
     this.lastBuild = build;
+    this.lastOpts = opts;
     if (this.index !== void 0) return this.index;
     const loaded = await this.cb.load();
-    if (loaded !== null && fpEqual(loaded.fingerprint, this.cb.currentFingerprint())) {
-      this.index = deserializeIndex(loaded.json);
-      return this.index;
+    if (loaded !== null && fpEqual2(loaded.fingerprint, this.cb.currentFingerprint())) {
+      const restored = deserializeIndex(loaded.json);
+      if (restored !== null && positionsMatch(restored, opts)) {
+        this.index = restored;
+        return this.index;
+      }
     }
-    this.index = InvertedIndex.build(build());
+    this.index = InvertedIndex.build(build(), opts);
     await this.persist();
     return this.index;
   }
@@ -1071,7 +1432,7 @@ var PersistedIndexStore = class {
     await this.retryPendingCompensation();
     if (this.lastBuild === void 0) return;
     if (this.index === void 0) {
-      this.index = InvertedIndex.build(this.lastBuild());
+      this.index = InvertedIndex.build(this.lastBuild(), this.lastOpts);
     }
     await this.persist();
   }
@@ -1114,21 +1475,34 @@ var PersistedIndexStore = class {
 
 // src/with-lookup/indexing/unique-constraints.ts
 var UniqueConstraintSet = class {
-  constructor(collectionName, uniqueDefs) {
+  constructor(collectionName, uniqueDefs, enforcement = "prevent", report = () => {
+  }) {
     this.collectionName = collectionName;
+    this.enforcement = enforcement;
+    this.report = report;
     this.constraints = uniqueDefs.map((fields) => ({ fields, map: /* @__PURE__ */ new Map() }));
   }
   collectionName;
+  enforcement;
+  report;
   constraints;
   get size() {
     return this.constraints.length;
   }
+  /** The declared field tuples, in declaration order. */
+  fieldTuples() {
+    return this.constraints.map((c) => c.fields);
+  }
   /**
    * Compute the canonical key for a record under a given constraint.
    * Returns `null` if any constrained field is `null` or `undefined`
    * (the record is exempt — no constraint is checked).
+   *
+   * Public because the tier scan (`with-audit/tiers/index.ts`) has to compute
+   * the same key for a record it decrypted under a tier DEK, which this class
+   * cannot reach — one key function, so the two paths cannot drift.
    */
-  keyFor(fields, record) {
+  keyOf(fields, record) {
     const row = {};
     for (const f of fields) {
       const v = readPath(record, f);
@@ -1137,29 +1511,66 @@ var UniqueConstraintSet = class {
     }
     return canonicalGroupKey(fields, row);
   }
+  /**
+   * Every constraint key `record` would occupy — the probe a checker outside
+   * this class (tiers, lazy) compares against its own candidates. Exempt
+   * (null-distinct) constraints are omitted, so an empty result means "this
+   * record is unconstrained" and the caller can skip its scan entirely.
+   */
+  probe(record) {
+    const out = [];
+    for (const c of this.constraints) {
+      const key = this.keyOf(c.fields, record);
+      if (key !== null) out.push({ fields: c.fields, key });
+    }
+    return out;
+  }
   /**
    * Throw `UniqueConstraintError` if writing `id` with `record` would
    * collide with a DIFFERENT existing record. Call BEFORE the store write.
+   *
+   * In `'detect'` mode this is a deliberate NO-OP: a CRDT collection must
+   * not refuse a write it has no authority to refuse (module doc). The
+   * collision is reported from {@link upsert} / {@link build} instead.
    */
   check(id, record) {
+    if (this.enforcement === "detect") return;
+    const clash = this.collision(id, record);
+    if (clash) throw clash;
+  }
+  /**
+   * The `UniqueConstraintError` a write of `id`/`record` would produce, or
+   * `null`. Never throws — the shared core of {@link check} (which throws it)
+   * and the detect path (which reports it).
+   */
+  collision(id, record) {
     for (const c of this.constraints) {
-      const key = this.keyFor(c.fields, record);
+      const key = this.keyOf(c.fields, record);
       if (key === null) continue;
       const holder = c.map.get(key);
       if (holder !== void 0 && holder !== id) {
-        throw new UniqueConstraintError(this.collectionName, id, c.fields, holder);
+        return new UniqueConstraintError(this.collectionName, id, c.fields, holder);
       }
     }
+    return null;
   }
   /**
    * Update the constraint maps after a successful write.
    * Pass `previous` when updating an existing record (so the old key
    * is removed first). Pass `null` or `undefined` for a fresh insert.
+   *
+   * In `'detect'` mode a collision observed here is REPORTED and the write
+   * still stands (both records are kept — see the module doc). In
+   * `'prevent'` mode `check()` already ran, so there is nothing to report.
    */
   upsert(id, record, previous) {
     if (previous != null) this.remove(id, previous);
+    if (this.enforcement === "detect") {
+      const clash = this.collision(id, record);
+      if (clash) this.report(clash);
+    }
     for (const c of this.constraints) {
-      const key = this.keyFor(c.fields, record);
+      const key = this.keyOf(c.fields, record);
       if (key !== null) c.map.set(key, id);
     }
   }
@@ -1169,7 +1580,7 @@ var UniqueConstraintSet = class {
    */
   remove(id, record) {
     for (const c of this.constraints) {
-      const key = this.keyFor(c.fields, record);
+      const key = this.keyOf(c.fields, record);
       if (key !== null && c.map.get(key) === id) c.map.delete(key);
     }
   }
@@ -1177,13 +1588,18 @@ var UniqueConstraintSet = class {
    * Rebuild all constraint maps from a full snapshot.
    * Called after hydration (ensureHydrated / hydrateFromSnapshot).
    *
-   * **Last-writer-wins**: this method does NOT validate pre-existing data
-   * for duplicates. If the store already contains two records sharing a
-   * constrained value (written before the unique index was declared), the
-   * last one processed wins the map slot and the duplicate is silently
-   * displaced — no error is thrown, and the earlier holder is evicted from
-   * the map. Callers retrofitting a unique index onto populated data should
-   * run a one-time uniqueness scan before relying on enforcement.
+   * **In `'prevent'` mode this is last-writer-wins**: it does NOT validate
+   * pre-existing data for duplicates. If the store already contains two
+   * records sharing a constrained value (written before the unique index was
+   * declared), the last one processed wins the map slot and the duplicate is
+   * silently displaced — no error is thrown, and the earlier holder is
+   * evicted from the map. Callers retrofitting a unique index onto populated
+   * data should run a one-time uniqueness scan before relying on enforcement.
+   *
+   * **In `'detect'` mode this is the MERGE POINT** — the moment a session
+   * that wrote neither record first sees them together (a CRDT replica
+   * opening a store its peer has written to). Every displaced holder is
+   * reported on `unique:violation` instead of being dropped in silence.
    */
   build(entries) {
     for (const c of this.constraints) c.map.clear();
@@ -1192,7 +1608,7 @@ var UniqueConstraintSet = class {
     }
   }
 };
-function buildUniqueConstraintSet(collectionName, indexes, mode) {
+function buildUniqueConstraintSet(collectionName, indexes, mode, report) {
   const uniqueDefs = [];
   for (const def of indexes ?? []) {
     if (def !== null && typeof def === "object" && !Array.isArray(def) && def.unique === true) {
@@ -1200,25 +1616,7 @@ function buildUniqueConstraintSet(collectionName, indexes, mode) {
     }
   }
   if (uniqueDefs.length === 0) return null;
-  if (mode.lazy) {
-    throw new UnsupportedIndexOptionError(
-      "unique",
-      `unique indexes are not yet supported in lazy mode (prefetch:false) \u2014 use the default eager mode. Collection "${collectionName}".`
-    );
-  }
-  if (mode.crdt) {
-    throw new UnsupportedIndexOptionError(
-      "unique",
-      `unique indexes are not supported on CRDT collections (crdt mode is incompatible with eager unique enforcement). Collection "${collectionName}".`
-    );
-  }
-  if (mode.tiered) {
-    throw new UnsupportedIndexOptionError(
-      "unique",
-      `unique indexes are not supported on tiered collections (tier writes use a separate path that bypasses unique enforcement). Collection "${collectionName}".`
-    );
-  }
-  return new UniqueConstraintSet(collectionName, uniqueDefs);
+  return new UniqueConstraintSet(collectionName, uniqueDefs, mode.crdt ? "detect" : "prevent", report);
 }
 
 // src/kernel/put-many-atomic.ts
@@ -1325,7 +1723,7 @@ async function commitSequentially(ctx, entries, priors) {
 }
 
 // src/with-formula/computed/lazy.ts
-var loadComputed = lazy(() => import("./computed-VPOKQK4N.js"));
+var loadComputed = lazy(() => import("./computed-FAD7SED4.js"));
 async function loadEvalComputedFields() {
   return (await loadComputed()).evalComputedFields;
 }
@@ -1379,7 +1777,18 @@ var Collection = class {
   // In-memory cache of decrypted records (eager mode only). Lazy mode
   // uses `lru` instead. Both fields exist so a single Collection instance
   // doesn't need a runtime branch on every cache access.
-  cache = /* @__PURE__ */ new Map();
+  cache = new GenerationMap();
+  /** #1418 — mutation stamp for a derived-output memo, or `null` when one must NOT be used because a redundant re-write would still be observable (gate handler, history, sync, search) or there is no eager cache to stamp. The rules and their measured rationale live with the consumer, `with-formula/materialized-views/emit-memo.ts`. `_`-prefixed deliberately: `kernel-api-surface-golden` freezes the PUBLIC surface and this is an executor seam. @internal */
+  get _cacheStamp() {
+    if (this.lazy) return null;
+    if (this.historyConfigExplicit && this.historyConfig.enabled !== false) return null;
+    if (this.onDirty !== void 0 || this.searchIndexStore !== void 0) return null;
+    return this.cache.generation;
+  }
+  /** #1439 — could a `beforePut` gate fire for THIS row? Asks each handler's declared scope, not merely whether any is registered — the bus is vault-wide, the gates are not. @internal */
+  _derivedWriteGated(record) {
+    return this.subsystemBus?.gateAppliesTo("beforePut", { vault: this.vault, collection: this.name, record }) === true;
+  }
   hydrated = false;
   /**
    * #606: ids known to carry a delete marker in the store — lets the #589
@@ -1494,8 +1903,12 @@ var Collection = class {
   i18nFields;
   /** The configured string fields exposed to `retrieve()`; `undefined` for ordinary collections (zero-cost). */
   textIndexes;
+  /** #1354 — the subset of `textIndexes` carrying positional postings (phrase / proximity). */
+  textIndexPositions;
   /** Session-scoped lexical index store; `undefined` (zero-cost) unless `textIndexes` is non-empty. */
   searchIndexStore;
+  /** Encrypted field-index sidecars (#1359); `null` (zero-cost) unless an index declared `persist: true`. */
+  fieldIndexStore;
   /** Embedding config for write-time vector derivation; `undefined` (zero-cost) for ordinary
    *  collections. When set, `put()` encodes the source field(s) and stores an encrypted `_vec` sidecar. */
   embeddings;
@@ -1712,6 +2125,7 @@ var Collection = class {
     this.joinResolver = cfg.joinResolver;
     this.i18nFields = cfg.i18nFields;
     this.textIndexes = cfg.textIndexes;
+    this.textIndexPositions = cfg.textIndexPositions;
     this.searchIndexStore = opts.textIndexes && opts.textIndexes.length > 0 ? opts.textIndexPersist ? new PersistedIndexStore(buildPersistedIndexCallbacks(() => this.searchContext())) : new MemoryIndexStore() : void 0;
     this.embeddings = cfg.embeddings;
     this.vectorSet = cfg.vectorSet;
@@ -1773,6 +2187,8 @@ var Collection = class {
       getDEK: (collection) => this.getDEK(collection ?? this.name),
       cekCache: this.cekCache,
       classifiedMarkerDigestOnly: () => this._classifiedMarkerDigestOnly(),
+      onDecrypt: this.strategies.coverage.observer(this.vault, this.name, this.keyring.userId, () => this.fieldMeta, this.emitter, opts.prefetch !== false),
+      // #1363 read-coverage sensor; NO_COVERAGE returns undefined
       via: this.via
     });
     if (cfg.classifiedEraseCfg) cfg.classifiedEraseCfg.classifySealedShred = (live) => this.codec.classifySealedShred(live);
@@ -1854,14 +2270,15 @@ var Collection = class {
       defs: opts.indexes ?? [],
       lazy: this.lazy
     });
-    this.declaredIndexes = normalizeIndexDefs(opts.indexes ?? []);
+    this.declaredIndexes = resolveDeclaredIndexes(opts.indexes ?? [], this.name, this.indexState.isEnabled);
+    this.fieldIndexStore = createPersistedFieldIndexes(() => this.indexingContext(), this.indexes);
     this.indexes?.setCanonicalizer((f, v) => this.via?.canonicalizeIndexKey(f, v));
     this.persistedIndexes?.setCanonicalizer((f, v) => this.via?.canonicalizeIndexKey(f, v));
     this.uniqueConstraints = buildUniqueConstraintSet(this.name, opts.indexes, {
       lazy: this.lazy,
       crdt: this.crdtMode != null,
       tiered: this.tiers != null
-    });
+    }, (err) => this.emitter.emit("unique:violation", { vault: this.vault, collection: this.name, id: err.recordId, fields: err.fields, conflictingId: err.conflictingId, error: err }));
   }
   /**
    * Return the Standard Schema validator attached to this collection,
@@ -1889,6 +2306,11 @@ var Collection = class {
     return this.declaredIndexes;
   }
   // declared index defs, normalized; consumed by walk.ts
+  /** #1447 — `field -> via brands covering it`, for `dumpSchema()`. Brand and field only, never a binding's config; see `via/pipeline.ts#fieldCoverage`. Consumed by walk.ts. */
+  getViaCoverage() {
+    const c = this.via?.fieldCoverage();
+    return c && Object.keys(c).length > 0 ? c : void 0;
+  }
   /**
    * Aggregate all collection-level configuration options that are actively set
    * into a {@link CollectionConfig} snapshot. Returns `undefined` when no options
@@ -1994,7 +2416,7 @@ var Collection = class {
   }
   /** JSON Schema for this collection with describe() metadata as x- extensions. */
   async toJSONSchema() {
-    const { buildJsonSchema } = await import("./json-schema-V3M5MUCM.js");
+    const { buildJsonSchema } = await import("./json-schema-3SHX72CC.js");
     const desc = await this.describe({});
     let base = null;
     if (this.schema !== void 0) {
@@ -2110,7 +2532,7 @@ var Collection = class {
     }
     await this.onAccess?.("find", "*");
     if (hits.length === 0) return [];
-    const { verifyDigestField } = await import("./verify-6MDTIUEV.js");
+    const { verifyDigestField } = await import("./verify-UKALW7C2.js");
     const policy = {
       normalize: spec.verifyNormalize ?? "password",
       notLastN: spec.notLastN ?? 0,
@@ -2322,7 +2744,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-BZS6H2RY.js");
+      const { resolveStaleMVOnRead } = await import("./stale-6GCFMOOR.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     let record;
@@ -2439,30 +2861,39 @@ var Collection = class {
    *                ORIGIN refresh time across vaults. (FR-4)
    */
   async put(id, record, options) {
-    await this.schemaUpdateGate?.assertWritable();
-    await this.schemaFence?.assertWritable(this.name);
+    return trackKeyedWrite(this.adapter, this.vault, this.name, id, () => this.#putGated(id, record, options));
+  }
+  /** @internal The body of {@link put}; see the #1420 note there for why it is split. */
+  async #putGated(id, record, options) {
     const hooksActive = this.#hooksActive();
     const busAfterPut = (this.subsystemBus?.hasHandlers("afterPut") ?? false) && !(this.subsystemBus?.dispatching ?? false);
     let event;
-    if (hooksActive || busAfterPut) {
-      const prior = await this.#priorForHook(id);
-      event = {
-        op: prior.record === null ? "create" : "update",
-        vault: this.vault,
-        collection: this.name,
-        docId: id,
-        before: prior.record,
-        after: record,
-        userId: this.keyring.userId,
-        timestamp: Date.now(),
-        txId: this.#txIdForHook(),
-        baseVersion: prior.version,
-        version: prior.version + 1
-      };
-      if (hooksActive) await this.writeHooks.runBefore(event);
-    }
-    if (this.writeQueue) await this.writeQueue.track(() => this._putInternal(id, record, options));
-    else await this._putInternal(id, record, options);
+    const gated = async (committed) => {
+      await this.schemaUpdateGate?.assertWritable();
+      await this.schemaFence?.assertWritable(this.name);
+      if (hooksActive || busAfterPut) {
+        const prior = await this.#priorForHook(id);
+        event = {
+          op: prior.record === null ? "create" : "update",
+          vault: this.vault,
+          collection: this.name,
+          docId: id,
+          before: prior.record,
+          after: record,
+          userId: this.keyring.userId,
+          timestamp: Date.now(),
+          txId: this.#txIdForHook(),
+          baseVersion: prior.version,
+          version: prior.version + 1
+        };
+        if (hooksActive) await this.writeHooks.runBefore(event);
+      }
+      committed();
+      await this._putInternal(id, record, options);
+    };
+    if (this.writeQueue) await this.writeQueue.trackGated(gated);
+    else await gated(() => {
+    });
     if (event) {
       if (hooksActive) await this.writeHooks.runAfter(event);
       if (busAfterPut) await this.subsystemBus.dispatch("afterPut", event);
@@ -2805,7 +3236,8 @@ var Collection = class {
       }
       if (priorRaw && isDeleteMarker(priorRaw)) version = priorRaw._v + 1;
     }
-    this.uniqueConstraints?.check(id, record);
+    await checkUniqueOnPut(this.indexingContext(), id, record);
+    if (this.tiers !== null && this.uniqueConstraints !== null) await this.strategies.tiers.checkUnique(this.tiersContext(), id, record);
     const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
     const vdigCtx = this.vdigFields !== null ? { id, prev: await this.adapter.get(this.vault, this.name, id) } : void 0;
     const envelope = await this.codec.encryptRecord({ collection: this.name, id }, record, version, cek, options?.source, options?.sourceTs, vdigCtx);
@@ -2854,7 +3286,7 @@ var Collection = class {
    */
   async dispatchMaterializedViews(id, record, wave) {
     if (this.materializedViewSource === void 0) return;
-    const { dispatchMaterializedViews } = await import("./dispatch-IEPAVQUM.js");
+    const { dispatchMaterializedViews } = await import("./dispatch-H4HV32AM.js");
     return dispatchMaterializedViews(this.#mvDispatchCtx(this.materializedViewSource), id, record, wave);
   }
   /**
@@ -3020,13 +3452,13 @@ var Collection = class {
    *  dispatch wave's per-target dedup; `undefined` on the local-write path (byte-identical). */
   async dispatchDerivations(id, record, version, wave, prior) {
     if (this.derivationSource === void 0) return;
-    const { dispatchDerivations } = await import("./dispatch-Q6MWLOJY.js");
+    const { dispatchDerivations } = await import("./dispatch-JDZNGEB3.js");
     return dispatchDerivations(this.#derivationDispatchCtx(), id, record, version, wave, prior);
   }
   /** @internal — trigger fan-out for a deleted parent (#1249); see dispatch.ts. */
   async dispatchTriggerDerivationsOnDelete(id, deleted) {
     if (this.derivationSource === void 0) return;
-    const { dispatchTriggerDerivationsOnDelete } = await import("./dispatch-Q6MWLOJY.js");
+    const { dispatchTriggerDerivationsOnDelete } = await import("./dispatch-JDZNGEB3.js");
     return dispatchTriggerDerivationsOnDelete(this.#derivationDispatchCtx(), id, deleted);
   }
   /**
@@ -3034,30 +3466,39 @@ var Collection = class {
    * so `hub.writeQueue.pending` reflects this write.
    */
   async delete(id) {
-    await this.schemaUpdateGate?.assertWritable();
-    await this.schemaFence?.assertWritable(this.name);
+    return trackKeyedWrite(this.adapter, this.vault, this.name, id, () => this.#deleteGated(id));
+  }
+  /** @internal The body of {@link delete}; see the #1420 note on {@link put}. */
+  async #deleteGated(id) {
     const hooksActive = this.#hooksActive();
     const busAfterDelete = (this.subsystemBus?.hasHandlers("afterDelete") ?? false) && !(this.subsystemBus?.dispatching ?? false);
     let event;
-    if (hooksActive || busAfterDelete) {
-      const prior = await this.#priorForHook(id);
-      event = {
-        op: "delete",
-        vault: this.vault,
-        collection: this.name,
-        docId: id,
-        before: prior.record,
-        after: null,
-        userId: this.keyring.userId,
-        timestamp: Date.now(),
-        txId: this.#txIdForHook(),
-        baseVersion: prior.version,
-        version: prior.version + 1
-      };
-      if (hooksActive) await this.writeHooks.runBefore(event);
-    }
-    if (this.writeQueue) await this.writeQueue.track(() => this._deleteInternal(id));
-    else await this._deleteInternal(id);
+    const gated = async (committed) => {
+      await this.schemaUpdateGate?.assertWritable();
+      await this.schemaFence?.assertWritable(this.name);
+      if (hooksActive || busAfterDelete) {
+        const prior = await this.#priorForHook(id);
+        event = {
+          op: "delete",
+          vault: this.vault,
+          collection: this.name,
+          docId: id,
+          before: prior.record,
+          after: null,
+          userId: this.keyring.userId,
+          timestamp: Date.now(),
+          txId: this.#txIdForHook(),
+          baseVersion: prior.version,
+          version: prior.version + 1
+        };
+        if (hooksActive) await this.writeHooks.runBefore(event);
+      }
+      committed();
+      await this._deleteInternal(id);
+    };
+    if (this.writeQueue) await this.writeQueue.trackGated(gated);
+    else await gated(() => {
+    });
     if (event) {
       if (hooksActive) await this.writeHooks.runAfter(event);
       if (busAfterDelete) await this.subsystemBus.dispatch("afterDelete", event);
@@ -3246,6 +3687,7 @@ var Collection = class {
       if (persist) await this.adapter.put(this.vault, this.name, id, marker);
       this.markerIds.add(id);
     } else if (persist) await this.adapter.delete(this.vault, this.name, id);
+    if (this.strategies.blobs !== NO_BLOBS) await this.blob(id).releaseAll();
     if (this.ledger) {
       await this.ledger.append({ op: "delete", collection: this.name, id, version: existing?.version ?? 0, actor: this.keyring.userId, payloadHash: previousPayloadHash });
     }
@@ -3338,7 +3780,7 @@ var Collection = class {
    */
   async dispatchArrayDerivationsOnDelete(id, eraseRecordShapeToo = false) {
     if (this.derivationSource === void 0) return 0;
-    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-Q6MWLOJY.js");
+    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-JDZNGEB3.js");
     return dispatchArrayDerivationsOnDelete(this.#derivationDeleteCtx(this.derivationSource), id, eraseRecordShapeToo);
   }
   /**
@@ -3352,7 +3794,7 @@ var Collection = class {
    */
   async dispatchMaterializedViewsOnDelete(id) {
     if (this.materializedViewSource === void 0) return { deleted: 0, residueUndecodable: [], residueDeclined: [] };
-    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-IEPAVQUM.js");
+    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-H4HV32AM.js");
     return dispatchMaterializedViewsOnDelete(this.#mvDispatchCtx(this.materializedViewSource), id);
   }
   /**
@@ -3372,7 +3814,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-BZS6H2RY.js");
+      const { resolveStaleMVOnRead } = await import("./stale-6GCFMOOR.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     await this.ensureHydrated();
@@ -3430,6 +3872,7 @@ var Collection = class {
       cache: this.cache,
       lazy: this.lazy,
       textIndexes: this.textIndexes,
+      textIndexPositions: this.textIndexPositions,
       i18nFields: this.i18nFields,
       dictKeyFields: this.dictKeyFields,
       blobFields: this.blobFields,
@@ -3555,7 +3998,7 @@ var Collection = class {
       subscribe: (cb) => {
         const handler = (event) => {
           if (event.vault === this.vault && event.collection === this.name) {
-            cb();
+            cb(event.remote === true ? void 0 : { id: event.id, action: event.action });
           }
         };
         this.emitter.on("change", handler);
@@ -3567,6 +4010,11 @@ var Collection = class {
       getIndexes: () => this.getIndexes(),
       lookupById: (id) => this.cache.get(id)?.record,
       snapshotEntries: () => [...this.cache.entries()].map(([id, e]) => ({ id, record: e.record })),
+      // Binds a keyset cursor to this collection (#1346).
+      identity: `${this.vault}/${this.name}`,
+      snapshotVersion: () => this.cache.generation,
+      hydration: { label: `${this.vault}/${this.name}`, collection: this.name, isHydrated: () => this.hydrated, hydrate: () => this.ensureHydrated() },
+      // #1414 — a never-read eager collection answers by ABSENCE; the gate makes every terminal await-able and refuse a synchronous read (query/hydration.ts)
       ...this.via ? { via: this.via } : {}
     };
     const resolver = this.joinResolver;
@@ -3658,6 +4106,8 @@ var Collection = class {
     return {
       snapshot: () => [...this.cache.values()].map((e) => e.record),
       lookupById: (id) => this.cache.get(id)?.record,
+      snapshotEntries: () => [...this.cache.entries()].map(([id, e]) => ({ id, record: e.record })),
+      // #1289 right/full outer join — the id is the cache KEY, not a field on the record; same `this.cache` closure as snapshot(), so the two views cannot disagree
       subscribe: (cb) => {
         const handler = (event) => {
           if (event.vault === this.vault && event.collection === this.name) {
@@ -3668,7 +4118,10 @@ var Collection = class {
         return () => this.emitter.off("change", handler);
       },
       // Sync join dressing (#650 Task 6, #626 retirement) — i18n-text + lookup-label, from this collection's own bindings.
-      ...this.presentForJoin !== void 0 ? { presentForJoin: this.presentForJoin } : {}
+      ...this.presentForJoin !== void 0 ? { presentForJoin: this.presentForJoin } : {},
+      decodeResults: (record) => this.via && this.via.hasResultDecode ? this.via.decodeResults(record) : record,
+      via: () => this.via
+      // #1289 Via result decode for a record served under an ALIAS, and #1337/#1338's `via()` — the pipeline ITSELF, for a record ORDERED (compareForOrder) or REDUCED (wrapReducers) under one. Contract + rationale on JoinableSource in query/join.ts. Both read `this.via` per call, never a captured value: _applyMoneyFields rebuilds the pipeline after this source is handed out — which is also why `via` is a thunk and not a property
     };
   }
   /**
@@ -4006,6 +4459,15 @@ var Collection = class {
   async _applyRemoteChange(id, action) {
     await this._onRecordMutated(id, action, "tab-mirror");
   }
+  /** @internal #1362 — same as {@link _applyRemoteChange}, for a frame that carries NO verb.
+   *  A peer's claim about the verb is not evidence; the re-read decides it, exactly as
+   *  `_compensateRevertedWrite` does. Untrusted ingress is why the frame omits it. */
+  async _applyRemoteSignal(id) {
+    await this._invalidateCacheEntry(id);
+    const action = await this.get(id) !== null ? "put" : "delete";
+    this.emitter.emit("change", { vault: this.vault, collection: this.name, id, action, remote: true });
+    this.searchIndexStore?.markDirty();
+  }
   /**
    * Origin-tagged mutation choke point (#623 task 10) — the single dispatch
    * point every put/delete path funnels through, AFTER its own store write,
@@ -4035,6 +4497,7 @@ var Collection = class {
         await this.onDirty?.(this.name, id, "put", version);
         this.emitter.emit("change", { vault: this.vault, collection: this.name, id, action: "put" });
         this.searchIndexStore?.markDirty();
+        this.fieldIndexStore?.markDirty();
         await this.onAccess?.("put", id);
         await this.dispatchDerivations(id, record, version, void 0, ctx.prior);
         await this.dispatchMaterializedViews(id, record);
@@ -4044,13 +4507,15 @@ var Collection = class {
         await this.onDirty?.(this.name, id, "put", ctx.version);
         this.emitter.emit("change", { vault: this.vault, collection: this.name, id, action: "delete" });
         this.searchIndexStore?.markDirty();
+        this.fieldIndexStore?.markDirty();
         await this.onAccess?.("delete", id);
         return;
       }
       case "tab-mirror":
         await this._invalidateCacheEntry(id);
-        this.emitter.emit("change", { vault: this.vault, collection: this.name, id, action });
+        this.emitter.emit("change", { vault: this.vault, collection: this.name, id, action, remote: true });
         this.searchIndexStore?.markDirty();
+        this.fieldIndexStore?.markDirty();
         return;
       case "sync-apply": {
         this._invalidateCekCacheEntry(id);
@@ -4088,7 +4553,7 @@ var Collection = class {
       }
     }
     this.hydrated = true;
-    this.rebuildEagerIndexesFromCache();
+    await hydrateEagerIndexes(this.indexingContext());
     this.rebuildUniqueConstraintsFromCache();
   }
   /** Hydrate from a pre-loaded snapshot (used by Vault). */
@@ -4104,7 +4569,7 @@ var Collection = class {
       this.cache.set(id, { record, version: envelope._v });
     }
     this.hydrated = true;
-    this.rebuildEagerIndexesFromCache();
+    await hydrateEagerIndexes(this.indexingContext());
     this.rebuildUniqueConstraintsFromCache();
   }
   /**
@@ -4222,10 +4687,39 @@ var Collection = class {
       tiersActive: this.tiers !== null,
       keyring: this.keyring,
       debugPlaintext: this.keyring.debugPlaintext === true,
+      assertOwnerWritable: () => this._assertRecordMutable(id),
+      // #1452
       ...this.objectStore !== void 0 ? { objectStore: this.objectStore } : {},
       ...this.blobFields !== void 0 ? { blobFields: this.blobFields } : {}
     });
   }
+  /**
+   * #1452 — would an update of record `id` pass the `beforePut` gate bus right
+   * now? Runs the bus with `incoming = existing`, so closed periods and record
+   * guards refuse an attachment change exactly as they would refuse the
+   * record's own update. A record with no stored body (never written, marker,
+   * elevated tier) is not gated — attaching before the first `put()` was
+   * always allowed. @internal
+   */
+  async _assertRecordMutable(id) {
+    if (!this.subsystemBus?.hasGateHandlers("beforePut")) return;
+    const { env, record } = await this.resolveGatePrior("beforePut", id);
+    if (!env || record === null || record === void 0) return;
+    const existing = this.via ? this.via.canonicalizeStored(record) : record;
+    await this.subsystemBus.dispatchGate("beforePut", {
+      op: "update",
+      vault: this.vault,
+      collection: this.name,
+      docId: id,
+      incoming: existing,
+      existing,
+      existingVersion: env._v,
+      existingTs: env._ts,
+      userId: this.keyring.userId,
+      role: this.keyring.role,
+      ...this.computed !== void 0 ? { computedFieldNames: new Set(Object.keys(this.computed)) } : {}
+    });
+  }
   /** Get all records as encrypted envelopes (for dump). */
   async dumpEnvelopes() {
     await this.ensureHydrated();
@@ -4258,9 +4752,8 @@ var Collection = class {
     if (!this.via) return record;
     const locale = localeOpts?.locale ?? this.defaultLocale;
     const layer = localeOpts?._layer ?? "read";
-    let result = record;
-    result = await this.via.present(result, { locale, ...localeOpts?.fallback !== void 0 ? { fallback: localeOpts.fallback } : {}, layer });
-    return result;
+    const via = this.via;
+    return memoizePresent(record, presentVariantKey(locale, layer, localeOpts?.fallback), async () => await via.present(record, { locale, ...localeOpts?.fallback !== void 0 ? { fallback: localeOpts.fallback } : {}, layer }));
   }
   /**
    * Low-level: encrypt a pre-serialised JSON string into an EncryptedEnvelope.
@@ -4314,7 +4807,11 @@ var Collection = class {
    *  Called by vault.ts forget() inside a resilient try/catch; residue is reported in ForgetResult. */
   async _purgeVector(id) {
     await this.adapter.delete(this.vault, "_vec", encodeVecId(this.name, id));
-    this.vectorSet?.markDirty();
+    this.vectorSet?.removeRecord(id);
+  }
+  /** @internal #1359 — force an immediate sidecar write, cancelling the debounce. No-op when none opted in. */
+  async _flushFieldIndexes() {
+    await this.fieldIndexStore?.flush();
   }
   /** Drop the persisted lexical-index blob (forget/erasure): an opaque
    *  all-records index must not survive crypto-shred. Idempotent; no-op without persist. */
@@ -4482,14 +4979,14 @@ var Collection = class {
   /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
   async _ensureClassifiedMarker() {
     if (this._markerPersisted || this.vdigFields === null) return;
-    const { persistClassifiedMarkerForFields } = await import("./classified-marker-BWOFVYAC.js");
+    const { persistClassifiedMarkerForFields } = await import("./classified-marker-SIYKUU5L.js");
     await persistClassifiedMarkerForFields(this.adapter, this.vault, this.name, this.vdigFields, await this.getDEK(this.name));
     this._markerPersisted = true;
   }
   /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
   async _classifiedMarkerDigestOnly() {
     if (this._markerDigestOnlyCache !== void 0) return this._markerDigestOnlyCache;
-    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-BWOFVYAC.js");
+    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-SIYKUU5L.js");
     this._markerDigestOnlyCache = await readClassifiedMarkerDigestOnly(this.adapter, this.vault, this.name, await this.getDEK(this.name));
     return this._markerDigestOnlyCache;
   }
@@ -4663,7 +5160,10 @@ var Collection = class {
       tierMode: this.tierMode,
       getDEK: (key) => this.getDEK(key),
       emitCrossTierEvent: (event) => this.emitCrossTierEvent(event),
-      addSubjectRef: (id, record) => this.addSubjectRef?.(id, record) ?? Promise.resolve()
+      addSubjectRef: (id, record) => this.addSubjectRef?.(id, record) ?? Promise.resolve(),
+      // #1358 — undefined on a collection with no `unique` index, which is what keeps the tier scan free everywhere else.
+      uniqueKeys: this.uniqueConstraints ? (record) => this.uniqueConstraints.probe(record) : void 0,
+      checkUniqueLocal: this.uniqueConstraints ? (id, record) => checkUniqueOnPut(this.indexingContext(), id, record) : void 0
     };
   }
   /**
@@ -4684,6 +5184,7 @@ var Collection = class {
       indexes: this.indexes,
       uniqueConstraints: this.uniqueConstraints,
       persistedIndexes: this.persistedIndexes,
+      fieldIndexes: this.fieldIndexStore,
       ensureHydrated: () => this.ensureHydrated(),
       ensurePersistedIndexesLoaded: () => this.ensurePersistedIndexesLoaded(),
       setPersistedIndexesLoaded: (value) => {
@@ -4693,6 +5194,18 @@ var Collection = class {
   }
 };
 
+// src/with-audit/periods/reserved-collections.ts
+var PERIODS_RESERVED_COLLECTIONS = /* @__PURE__ */ new Set([
+  PERIODS_COLLECTION,
+  PERIOD_FREEZES_COLLECTION,
+  PERIOD_ARCHIVES_COLLECTION,
+  PERIOD_TARGET_PURGES_COLLECTION,
+  PERIOD_REOPENS_COLLECTION
+]);
+function isPeriodsReservedCollection(name) {
+  return PERIODS_RESERVED_COLLECTIONS.has(name);
+}
+
 // src/port/with/capabilities.ts
 function assertCanExport(keyring, tier, format) {
   if (tier === "plaintext") {
@@ -4927,7 +5440,7 @@ var DeferredNumberingStore = class {
   async readJson(collection, id) {
     const env = await this.adapter.get(this.vault, collection, id);
     if (!env) return { env: null, value: null };
-    const json = this.encrypted ? await openEnvelopeJson({ collection, id }, env, await this.dek(collection)) : env._data;
+    const json = this.encrypted ? await openEnvelopeJson({ collection, id }, env, await this.dek(collection)) : env._data ?? "";
     return { env, value: JSON.parse(json) };
   }
   async writeJson(collection, id, value, expectedVersion) {
@@ -5065,8 +5578,8 @@ var VaultPeriods = class {
   async closePeriod(options) {
     const existing = await this.loadPeriodsCache();
     this.deps.strategy.validatePeriodName(options.name, existing, options.partition);
-    if (typeof options.endDate !== "string" || options.endDate.length === 0) {
-      throw new ValidationError("closePeriod: endDate must be a non-empty ISO string.");
+    if (typeof options.endDate !== "string" || !isOrderableBusinessDate(options.endDate)) {
+      throw typeof options.endDate === "string" ? malformedBusinessDate("closePeriod: endDate", options.endDate) : new ValidationError("closePeriod: endDate must be a non-empty ISO string.");
     }
     const anchor = await this.deps.strategy.chainAnchor(existing, options.partition);
     const record = {
@@ -5481,6 +5994,32 @@ var VaultPeriods = class {
   findPeriod(all, name, options) {
     return all.find((p) => p.name === name && samePartition(p.partition, options?.partition));
   }
+  /**
+   * #1439 — could a closed period govern this record? Synchronous, and
+   * deliberately a SUPERSET of what {@link assertTsWritable} would refuse.
+   *
+   * Exists so a caller can tell "the period gate is registered" from "the
+   * period gate can fire for this row". Those were conflated, and the cost was
+   * that installing `withPeriods()` disabled an unrelated optimisation for
+   * every collection in the vault — with no period closed and no collection
+   * registered as a subject (#1439, measured: 0 → 250 redundant MV writes per
+   * source write).
+   *
+   * ⛔ Answers `true` whenever it cannot rule the gate out: the cache is not
+   * loaded yet, a closed period has no `dateField` to test against, or no row
+   * was supplied. A predicate that exists to permit an optimisation must fail
+   * towards "the gate applies", never away from it.
+   */
+  couldGovern(record) {
+    if (this.periodCache === null) return true;
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    for (const p of this.periodCache) {
+      if (p.kind !== "closed" || isEffectivelyReopened(p, now)) continue;
+      if (!p.dateField || record === void 0) return true;
+      if (record[p.dateField] !== void 0 && record[p.dateField] !== null) return true;
+    }
+    return false;
+  }
   /** Called by the gate bus before put/delete. `collection` selects the subject mapping (#1005). */
   async assertTsWritable(existing, incoming, collection) {
     if (existing === null && incoming === null) return;
@@ -5533,7 +6072,7 @@ var VaultPeriods = class {
   async readReserved(collection, key) {
     const env = await this.deps.adapter.get(this.deps.vault, collection, key);
     if (!env) return null;
-    const json = this.deps.encrypted ? await openEnvelopeJson({ collection, id: key }, env, await this.deps.getDEK(collection)) : env._data;
+    const json = this.deps.encrypted ? await openEnvelopeJson({ collection, id: key }, env, await this.deps.getDEK(collection)) : env._data ?? "";
     return JSON.parse(json);
   }
   async decryptPeriodRecord(periodId, envelope) {
@@ -5542,7 +6081,7 @@ var VaultPeriods = class {
       const dek = await this.deps.getDEK(PERIODS_COLLECTION);
       json = await openEnvelopeJson({ collection: PERIODS_COLLECTION, id: periodId }, envelope, dek);
     } else {
-      json = envelope._data;
+      json = envelope._data ?? "";
     }
     return JSON.parse(json);
   }
@@ -6115,7 +6654,7 @@ var VaultLinks = class {
 // src/with-shape/links/lazy-handle.ts
 function makeLazyLinkSetHandle(d) {
   let engine = null;
-  const load = () => engine ??= import("./link-set-2TTM3IZC.js").then(
+  const load = () => engine ??= import("./link-set-MFXC24VK.js").then(
     ({ LinkSet }) => new LinkSet(d.adapter, d.vault, d.name, d.spec, d.encrypted, d.getDEK, d.actor, d.emitter, d.endpointExists)
   );
   return {
@@ -6766,7 +7305,7 @@ function declareSatellite(ctx, collectionName, options, existingRegistry) {
   ctx.forEachSyncEngine((e) => e.remirrorPairResolvers([spec.base, spec.satellite]));
   const registry = reg;
   const baseSchema = ctx.getBaseSchema(spec.base);
-  void import("./post-register-3IPCSG6Q.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
+  void import("./post-register-7ND27CF2.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
   });
   return reg;
 }
@@ -6956,7 +7495,7 @@ function makeSatelliteProxy(target, spec, registry) {
       return filterLiveHits(hits, adapter, vaultName, spec.base);
     },
     // #591 Task 9 review fix: findByDet/queryByDet scan envelopes straight
-    // off the adapter (kernel/enclave/record-keys/deterministic.ts) and
+    // off the adapter (capsule/plumbing/deterministic.ts) and
     // return BARE records (no id), so a post-filter can't correlate a match
     // back to its base row. Instead the scan itself is scoped: re-run the
     // same det functions over the collection's own DeterministicContext
@@ -7305,6 +7844,7 @@ var COLLECTION_PASSTHROUGH_KEYS = [
   "i18nFields",
   "embeddings",
   "textIndexes",
+  "textIndexPositions",
   "warmIndexOnOpen",
   "textIndexPersist",
   "moneyFields",
@@ -7696,6 +8236,7 @@ var Vault = class {
     if (collectionName === SEQUENCE_COLLECTION) throw new ReservedCollectionNameError(collectionName);
     if (isLinkCollectionName(collectionName)) throw new ReservedCollectionNameError(collectionName);
     if (isSecretBearingReservedCollection(collectionName) || isManifestReservedCollection(collectionName)) throw new ReservedCollectionNameError(collectionName);
+    if (isPeriodsReservedCollection(collectionName)) throw new ReservedCollectionNameError(collectionName);
     if (this.satelliteRegistry?.byJoined(collectionName)) {
       throw new SatelliteConfigError(`"${collectionName}" is a joined handle \u2014 use vault.joined('${collectionName}'), not vault.collection().`);
     }
@@ -7741,7 +8282,7 @@ var Vault = class {
         const strategies = options.schemaUpdate ?? [];
         const work = (async () => {
           const dek = await this.getDEK(collectionName);
-          const { persistSchemaIfNeeded } = await import("./register-HHLXEQDN.js");
+          const { persistSchemaIfNeeded } = await import("./register-DT5HZ2LZ.js");
           const result = await persistSchemaIfNeeded({
             store: this.adapter,
             vault: this.name,
@@ -7891,7 +8432,7 @@ var Vault = class {
         const work = (async () => {
           try {
             const dek = await this.getDEK(collectionName);
-            await (await import("./register-HHLXEQDN.js")).persistSchemaIfNeeded({
+            await (await import("./register-DT5HZ2LZ.js")).persistSchemaIfNeeded({
               store: this.adapter,
               vault: this.name,
               collectionName,
@@ -7937,7 +8478,7 @@ var Vault = class {
    * writes (unfenced walk — see `with-shape/satellites/migrate-cek.ts`); resumable.
    */
   async migrateSatellitePerRecordKeys(satelliteName) {
-    const { migrateSatelliteCek } = await import("./migrate-cek-5ENH64AA.js");
+    const { migrateSatelliteCek } = await import("./migrate-cek-DZRFFOHW.js");
     return migrateSatelliteCek(satelliteName, this.collection(satelliteName, { perRecordKeys: true }));
   }
   /**
@@ -7980,6 +8521,10 @@ var Vault = class {
     if (!coll) return;
     await coll._applyRemoteChange(docId, action);
   }
+  /** @internal #1362 — verb-less variant; no-op for a collection this instance never opened. */
+  async _applyRemoteSignal(collectionName, docId) {
+    await this.collectionCache.get(collectionName)?._applyRemoteSignal(docId);
+  }
   /** @internal #598: refresh cache entries a sync-applied write rewrote underneath us. No-op if not loaded this session.
    *  #650 Task 4 (#647): a reserved-lookup collection has no `Collection` instance — instead, refresh
    *  its already-warmed `LookupHandle._syncCache` (membership/altIndex/snapshot reads never see a
@@ -8236,7 +8781,7 @@ var Vault = class {
         },
         emitter: this.emitter,
         buildDeleteMarker,
-        // #647 fix wave 1 — real kernel/enclave builder; LookupHandle can't import it directly
+        // #647 fix wave 1 — real capsule/enclave-aes builder; LookupHandle can't import it directly
         // #650 Task 4 (#647) — choke-point participation for LOCAL writes: dirty-log tracking + a
         // one-shot graph-dispatch wave (local-write's `graphDispatch.collect`-equivalent; Task 5's ref edges give it dependents).
         onDirty: this.onDirty,
@@ -8568,7 +9113,7 @@ var Vault = class {
    */
   // eslint-disable-next-line @typescript-eslint/consistent-type-imports
   async _loadPodSigner() {
-    const { loadSigner } = await import("./signer-SJQJVSM6.js");
+    const { loadSigner } = await import("./signer-MHGW3OIL.js");
     return loadSigner(this.adapter, this.name, this.getDEK);
   }
   async writeExportAudit(entry) {
@@ -8600,7 +9145,7 @@ var Vault = class {
    */
   async _decryptEnvelopeForBundleFilter(env, collectionName, recordId) {
     if (!this.encrypted) {
-      return JSON.parse(env._data);
+      return JSON.parse(env._data ?? "");
     }
     const dek = await this.getDEK(collectionName);
     const json = await openEnvelopeJson({ collection: collectionName, id: recordId }, env, dek);
@@ -9058,7 +9603,7 @@ var Vault = class {
   async _initGuards(handles) {
     if (handles.length === 0) return;
     const [{ GuardRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-4AYVUNXK.js"),
+      import("./registry-BHRZGZHF.js"),
       import("./read-only-facade-BIGO37U3.js")
     ]);
     const registry = new GuardRegistry();
@@ -9086,7 +9631,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-XX2Z7B46.js"),
+      import("./registry-ET6ZFFWA.js"),
       import("./read-only-facade-BIGO37U3.js")
     ]);
     const registry = new DerivationRegistry();
@@ -9118,7 +9663,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-JS3YFQQM.js");
+    const { MaterializedViewRegistry } = await import("./registry-THCPDEOD.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -9143,7 +9688,7 @@ var Vault = class {
    */
   async _initOverlayedViews(handles) {
     if (handles.length === 0) return;
-    const { OverlayedViewRegistry } = await import("./registry-23WF3TGH.js");
+    const { OverlayedViewRegistry } = await import("./registry-HXFGLGTG.js");
     const registry = new OverlayedViewRegistry();
     const mvRegistry = this.materializedViewRegistry;
     const overlayNames = /* @__PURE__ */ new Set();
@@ -9193,27 +9738,27 @@ var Vault = class {
   /**
    * Manual re-materialize for a single registered MV (`refresh: 'manual'` consumers,
    * stale-bit recovery on vault reopen, bulk-recompute escape hatch after a strategy
-   * change). Returns `{ written, deleted, failed, residueUndecodable, residueDeclined }` (`deleted`
-   * always 0 without tombstoning; #785 splits the #782 leftovers — undecodable vs #718-declined). Throws if not registered.
+   * change). Returns `{ written, skipped, deleted, failed, residueUndecodable, residueDeclined }` (`skipped` counts rows whose
+   * content was unchanged since the last refresh, #1418; `deleted` always 0 without tombstoning; #785 splits the #782 leftovers — undecodable vs #718-declined). Throws if not registered.
    */
   async refreshView(name) {
     const registry = this.materializedViewRegistry;
     if (registry === null) {
-      return { written: 0, deleted: 0, failed: 0, residueUndecodable: [], residueDeclined: [] };
+      return { written: 0, skipped: 0, deleted: 0, failed: 0, residueUndecodable: [], residueDeclined: [] };
     }
     await registry.resolvePendingPlans();
     const reg = registry.byName(name);
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-7UQ3BZ4F.js");
+    const { MaterializedViewExecutor } = await import("./executor-FMPVN6DT.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this,
       dispatchCtx: this._dispatchCtx({ collection: name, id: "refreshView" })
     });
-    const { clearMVStaleFully } = await import("./stale-BZS6H2RY.js");
+    const { clearMVStaleFully } = await import("./stale-6GCFMOOR.js");
     await clearMVStaleFully(this.adapter, this.name, registry, name);
     return result;
   }
@@ -9226,7 +9771,7 @@ var Vault = class {
     if (registry === null) return { derived: 0, failed: 0, skippedFrozen: 0 };
     const strategies = registry.strategiesForSource(sourceCollection);
     if (strategies.length === 0) return { derived: 0, failed: 0, skippedFrozen: 0 };
-    const { DerivationExecutor } = await import("./executor-5NIMLSKZ.js");
+    const { DerivationExecutor } = await import("./executor-OSRZST2U.js");
     const sourceColl = this.collection(sourceCollection);
     const records = await sourceColl.list();
     const ctx = { vault: this.derivationFacade ?? new (await import("./read-only-facade-BIGO37U3.js")).ReadOnlyVaultFacade(this, "derivation") };
@@ -9253,7 +9798,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-S3QL53YX.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-L7NHPIOC.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key, this.getDEK, this.encrypted);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -9480,7 +10025,7 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-DS5NRILW.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-NANZDG4N.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
         "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (secret) first."
@@ -9502,7 +10047,7 @@ var Vault = class {
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-DS5NRILW.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-NANZDG4N.js");
     await revokeDelegation(this.adapter, this.name, id);
     void DELEGATIONS_COLLECTION;
   }
@@ -9730,6 +10275,10 @@ var Vault = class {
   async _assertTsWritable(existing, incoming, collection) {
     return this.periods.assertTsWritable(existing, incoming, collection);
   }
+  /** #1439 — sync superset test: could a closed period govern this row? See `periods/vault-facade.ts#couldGovern`. @internal */
+  _periodCouldGovern(record) {
+    return this.periods.couldGovern(record);
+  }
   /** List all collection names in this vault. */
   async collections() {
     const snapshot = await this.adapter.loadAll(this.name);
@@ -9755,7 +10304,7 @@ var Vault = class {
    * @see design-history/2026-05-22-schema-dump-design.md
    */
   async dumpSchema(opts = {}) {
-    const { dumpVaultSchema } = await import("./walk-ZURCH6RZ.js");
+    const { dumpVaultSchema } = await import("./walk-4VPK7AS4.js");
     return dumpVaultSchema(this, opts);
   }
   /**
@@ -9851,7 +10400,7 @@ var Vault = class {
    * separate vault instances now.
    */
   async getPodHandle() {
-    const { buildPodHandle } = await import("./pod-handle-ECVCDIXW.js");
+    const { buildPodHandle } = await import("./pod-handle-A3LET7NO.js");
     return buildPodHandle(this.adapter, this.name);
   }
   /**
@@ -9865,7 +10414,7 @@ var Vault = class {
    * single, already-opened `Vault` instance so the
    * bundle writer can snapshot it without holding a `Noydb` reference.
    *
-   * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md
+   * @see https://github.com/noy-db/docs/blob/main/content/docs/services/public-envelope.md
    */
   async getCover(opts = {}) {
     const { readCover } = await import("./cover/index.js");
@@ -9883,7 +10432,7 @@ var Vault = class {
    * both modes round-trip cleanly.
    */
   async dump() {
-    const { dumpVault } = await import("./backup-XKCXVKV3.js");
+    const { dumpVault } = await import("./backup-YE2VQ26S.js");
     return dumpVault(this.backupContext());
   }
   /**
@@ -9935,7 +10484,7 @@ var Vault = class {
    * — there's no chain to verify against.
    */
   async load(backupJson) {
-    const { loadVault } = await import("./backup-XKCXVKV3.js");
+    const { loadVault } = await import("./backup-YE2VQ26S.js");
     return loadVault(this.backupContext(), backupJson);
   }
   /**
@@ -9967,7 +10516,7 @@ var Vault = class {
    * way to detect tampering of an in-place vault.
    */
   async verifyBackupIntegrity() {
-    const { verifyBackupIntegrity } = await import("./backup-XKCXVKV3.js");
+    const { verifyBackupIntegrity } = await import("./backup-YE2VQ26S.js");
     return verifyBackupIntegrity(this.backupContext());
   }
   /**
@@ -10197,7 +10746,7 @@ var Vault = class {
    * is the live validator object, not a serialization of it).
    */
   async exportJSON(opts = {}) {
-    const { exportVaultJSON } = await import("./backup-XKCXVKV3.js");
+    const { exportVaultJSON } = await import("./backup-YE2VQ26S.js");
     return exportVaultJSON(this.backupContext(), opts);
   }
 };
@@ -10285,6 +10834,36 @@ var WriteQueueTracker = class {
       throw error;
     }
   }
+  /**
+   * Run a write whose PRE-COMMIT phase may legitimately REFUSE — the schema
+   * gates, and a user `beforeWrite` hook that throws to abort. `fn` calls
+   * `committed()` at the point the store write itself begins.
+   *
+   * Before that point a rejection releases the depth it took but records NO
+   * queue error; after it, a rejection settles as a failure like `track`.
+   *
+   * #11 — why the phase is inside `depth` at all: `pending` is the documented
+   * shutdown guard (see the `writeQueue` getter's `beforeunload` example) and
+   * the schema fence does a fresh store read per write, so leaving the gates
+   * outside made `pending` read `false` during a real round-trip on every
+   * write. The refusal carve-out is what the old outside-the-queue placement
+   * was protecting ("a rejected write never counts toward depth") — it is kept
+   * deliberately, so a refused write cannot reject a concurrent `onFlush()`.
+   */
+  async trackGated(fn) {
+    this.begin();
+    let refusable = true;
+    try {
+      const value = await fn(() => {
+        refusable = false;
+      });
+      this.settle();
+      return value;
+    } catch (error) {
+      this.settle(refusable ? void 0 : error);
+      throw error;
+    }
+  }
   #emitChange() {
     for (const handler of this.#changeHandlers) handler();
   }
@@ -10439,7 +11018,7 @@ var ServiceBus = class {
       arr = [];
       this.#gateHandlers.set(point, arr);
     }
-    const entry = { fn: handler, needsPrior: opts?.needsPrior !== false };
+    const entry = { fn: handler, needsPrior: opts?.needsPrior !== false, scope: opts?.scope };
     arr.push(entry);
     return () => {
       const a = this.#gateHandlers.get(point);
@@ -10453,6 +11032,30 @@ var ServiceBus = class {
     const a = this.#gateHandlers.get(point);
     return a !== void 0 && a.length > 0;
   }
+  /**
+   * #1439 — could a gate at `point` fire for THIS target?
+   *
+   * ⚠️ This is the question callers almost always mean, and
+   * {@link hasGateHandlers} is not it. That one is about the bus, which is
+   * shared by the whole vault; this one consults each handler's declared
+   * {@link GateScope}. A handler that declares none counts as "may fire", so a
+   * registrant which has not thought about scope keeps today's behaviour.
+   *
+   * ⛔ A scope that throws is treated as "may fire". A predicate whose job is
+   * to permit an optimisation must never be able to disable a gate by failing.
+   */
+  gateAppliesTo(point, target) {
+    const a = this.#gateHandlers.get(point);
+    if (a === void 0 || a.length === 0) return false;
+    return a.some((e) => {
+      if (e.scope === void 0) return true;
+      try {
+        return e.scope(target);
+      } catch {
+        return true;
+      }
+    });
+  }
   /**
    * True when at least one gate handler at `point` needs the prior record
    * (the default). False when the point has no handlers or every handler
@@ -11154,6 +11757,9 @@ var TeamFacade = class {
     this.deps.checkPolicyOperation(vault, "grant");
     await this.deps.checkGate(vault, "enroll-user", factors);
     const keyring = await this.deps.getKeyringInternal(vault);
+    if (this.deps.options.periodsStrategy !== void 0) {
+      await (await ensureCollectionDEK(this.deps.options.store, vault, keyring))(PERIODS_COLLECTION);
+    }
     await engine(this.deps.options.store, vault, keyring, options);
   }
   /** Gate + run a `revoke` engine. See `Noydb.revoke` for the public contract. */
@@ -11205,9 +11811,18 @@ var TeamFacade = class {
     this.deps.keyringCache.set(vault, next);
   }
   /**
-   * Remove a tier-2 authenticator slot. Idempotent — removing a
-   * non-existent slot is a successful no-op. Gated by
+   * Remove a tier-2 authenticator slot. Idempotent — removing a slot
+   * that is not in the keyring is a successful no-op. Gated by
    * `remove-authenticator`.
+   *
+   * ⚠️ Idempotency needs the slot list to be VISIBLE, and a tier-3
+   * PIN-resumed / session-restored keyring carries an empty one
+   * (#1426). Such a session throws `ValidationError` rather than
+   * reporting a removal it did not perform — re-authenticate at tier 1
+   * first.
+   *
+   * @throws `ValidationError` when the active keyring cannot see its
+   *   slot list (`kek === null`).
    */
   async removeAuthenticator(vault, slotId, factors) {
     await this.deps.checkGate(vault, "remove-authenticator", factors);
@@ -12188,10 +12803,14 @@ var Noydb = class {
       if (!facade) return;
       const ctx = { existing, vault: facade, userId: e.userId, role: e.role };
       await registry.runChecks(e.collection, incoming, ctx);
-      const { GuardExecutor } = await import("./executor-AQVXV5GZ.js");
+      const { GuardExecutor } = await import("./executor-LBBBRTN5.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, e.docId, existing, incoming, e.computedFieldNames);
       }
+    }, {
+      // #1439 — this handler's own first two early-returns, hoisted so a caller can ask
+      // "could a guard fire HERE" without writing. See `ServiceBus.gateAppliesTo`.
+      scope: ({ vault, collection }) => (this.vaultCache.get(vault)?._getGuardRegistry()?.guardsFor(collection).length ?? 0) > 0
     });
     this.subsystemBus.registerGate("beforeDelete", async (e) => {
       const v = this.vaultCache.get(e.vault);
@@ -12235,6 +12854,9 @@ var Noydb = class {
       if (!v) return;
       const existing = e.op === "create" ? null : { ts: e.existingTs ?? null, record: e.existing ?? null };
       await v._assertTsWritable(existing, e.incoming, e.collection);
+    }, {
+      // #1439 — a period governs a row only through its `dateField`; see `couldGovern`.
+      scope: ({ vault, record }) => this.vaultCache.get(vault)?._periodCouldGovern(record) ?? true
     });
     this.subsystemBus.registerGate("beforeDelete", async (e) => {
       if (e.internal) return;
@@ -13124,6 +13746,15 @@ var Noydb = class {
     }
     return { dispose: () => this.disableTabCoordination() };
   }
+  /** @internal #1362 — `ChangeBroadcastHost`: re-read one broadcast address through THIS
+   *  instance's own keyring. No-op for a vault this instance has not opened. */
+  _applyRemoteSignal(vaultName, collectionName, id) {
+    return this.vaultCache.get(vaultName)?._applyRemoteSignal(collectionName, id) ?? Promise.resolve();
+  }
+  /** @internal #1362 — `ChangeBroadcastHost`: store backend name, for the default channel name. */
+  get _storeName() {
+    return this.options.store.name;
+  }
   #applyRemoteWrite(vaultName, collectionName, docId, action) {
     const v = this.vaultCache.get(vaultName);
     if (!v) return Promise.resolve();
@@ -13347,7 +13978,7 @@ var Noydb = class {
    * keyring file at `_keyring/<userId>` and the envelope ciphertext at
    * `_users/<keyringId>` remain observable to anyone with direct store
    * read access — only the hub-level enumeration is gated. See
-   * `https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/user-envelope.md` → "Directory visibility".
+   * `https://github.com/noy-db/docs/blob/main/content/docs/services/user-envelope.md` → "Directory visibility".
    */
   async setDirectoryEnabled(vault, enabled) {
     if (this.closed) throw new ValidationError("Instance is closed");
@@ -13431,7 +14062,7 @@ var Noydb = class {
     this.activeTier.set(vault, tier);
   }
   // ─── Tier-2 enroll / remove ─────────────────────────────────────
-  // ─── Cover (https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md) ──────
+  // ─── Cover (https://github.com/noy-db/docs/blob/main/content/docs/services/public-envelope.md) ──────
   /**
    * Set the owner-curated cover for a vault. Throws
    * `ValidationError` if the developer did not opt the hub into
@@ -13560,7 +14191,7 @@ async function createNoydb(options) {
   if (!options.store) options = { ...options, store: memoryStore() };
   validateSecretModeOptions(options);
   if (!options.mesh) options = { ...options, mesh: await createDefaultMesh(options.store) };
-  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-WYW4YEQG.js")).createUserApi };
+  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-OS747DS4.js")).createUserApi };
   if (!options.policyFactory) {
     const policyModule = await import("./policy/index.js");
     options = { ...options, policyFactory: policyModule.createNoydbPolicy, policyCheckGateFn: policyModule.checkGate };
@@ -13593,4 +14224,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-ZYIYHJ5R.js.map
+//# sourceMappingURL=chunk-MXOQ5JCG.js.map