@noy-db/hub 0.7.1-pre.0 → 0.8.0

package/dist/kernel/collection.d.ts

@@ -11,17 +11,17 @@ import { type ViaDescriptor, type ViaEraseReport } from './via/index.js';
 import type { MutationOrigin } from './mutation.js';
 import { type WaveContext, type RollupOutcome, type RollupDeleteIntent } from './via/dispatch.js';
 import type { ComputedFields } from '../with-formula/computed/index.js';
-import { type SealedShredSlot } from './enclave/index.js';
+import { type SealedShredSlot } from '../capsule/index.js';
 import { type TierMoveResult } from '../with-audit/tiers/index.js';
 import type { GhostRecord } from './types.js';
 import type { StandardSchemaV1 } from './schema.js';
 import type { DiffEntry } from '../with-commit/history/diff.js';
 import { Query, ScanBuilder } from './query/index.js';
-import type { JoinableSource } from './query/index.js';
+import type { JoinableSource } from './query/relate/join.js';
 import { type CollectionIndexes } from '../with-lookup/indexing/eager-indexes.js';
 import { LazyQuery } from '../with-lookup/indexing/lazy-builder.js';
 import type { SearchOptions, SearchResult } from '../with-lookup/search/index.js';
-import type { RetrieveOptions, RetrieveHit } from '../with-lookup/search/retrieve-types.js';
+import type { RetrieveOptions, RetrieveHit, SimilarToOptions } from '../with-lookup/search/retrieve-types.js';
 import type { RefDescriptor } from './refs.js';
 import { type CollectionDescription, type DescribeOptions } from '../with-shape/introspection/describe.js';
 import type { CollectionConfig } from '../with-shape/introspection/types.js';
@@ -112,6 +112,10 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
     private readonly blobFields;
     private readonly blobTierPolicy;
     private readonly cache;
+    /** #1418 — mutation stamp for a derived-output memo, or `null` when one must NOT be used because a redundant re-write would still be observable (gate handler, history, sync, search) or there is no eager cache to stamp. The rules and their measured rationale live with the consumer, `with-formula/materialized-views/emit-memo.ts`. `_`-prefixed deliberately: `kernel-api-surface-golden` freezes the PUBLIC surface and this is an executor seam. @internal */
+    get _cacheStamp(): number | null;
+    /** #1439 — could a `beforePut` gate fire for THIS row? Asks each handler's declared scope, not merely whether any is registered — the bus is vault-wide, the gates are not. @internal */
+    _derivedWriteGated(record: Record<string, unknown>): boolean;
     private hydrated;
     /**
      * #606: ids known to carry a delete marker in the store — lets the #589
@@ -221,8 +225,12 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
     private i18nFields;
     /** The configured string fields exposed to `retrieve()`; `undefined` for ordinary collections (zero-cost). */
     private readonly textIndexes;
+    /** #1354 — the subset of `textIndexes` carrying positional postings (phrase / proximity). */
+    private readonly textIndexPositions;
     /** Session-scoped lexical index store; `undefined` (zero-cost) unless `textIndexes` is non-empty. */
     private readonly searchIndexStore;
+    /** Encrypted field-index sidecars (#1359); `null` (zero-cost) unless an index declared `persist: true`. */
+    private readonly fieldIndexStore;
     /** Embedding config for write-time vector derivation; `undefined` (zero-cost) for ordinary
      *  collections. When set, `put()` encodes the source field(s) and stores an encrypted `_vec` sidecar. */
     private readonly embeddings;
@@ -427,6 +435,8 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
         readonly fields: readonly string[];
         readonly unique?: boolean;
     }>;
+    /** #1447 — `field -> via brands covering it`, for `dumpSchema()`. Brand and field only, never a binding's config; see `via/pipeline.ts#fieldCoverage`. Consumed by walk.ts. */
+    getViaCoverage(): Record<string, readonly string[]> | undefined;
     /**
      * Aggregate all collection-level configuration options that are actively set
      * into a {@link CollectionConfig} snapshot. Returns `undefined` when no options
@@ -971,11 +981,7 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
     /** Retrieval (lexical | semantic | hybrid) — gated behind `searchStrategy: withSearch()`. */
     retrieve(query: string, opts?: RetrieveOptions<T>): Promise<RetrieveHit<T>[]>;
     /** Raw-vector kNN — gated behind `searchStrategy: withSearch()`. */
-    similarTo(vector: Float32Array, opts?: {
-        k?: number;
-        minScore?: number;
-        includeRecord?: boolean;
-    }): Promise<RetrieveHit<T>[]>;
+    similarTo(vector: Float32Array, opts?: SimilarToOptions): Promise<RetrieveHit<T>[]>;
     /** Opt-in bulk `_vec` re-derive (#788) — a plain collection has nothing to rebuild; gated behind `searchStrategy: withSearch()` otherwise. */
     rebuildEmbeddings(): Promise<{
         rebuilt: number;
@@ -1055,7 +1061,7 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
      * the filtered records directly (the API). Prefer the chainable
      * form for new code.
      *
-     * **Lazy-MV gap:** `query()` is synchronous and does NOT
+     * **Cold-collection gate (#1414):** until something has bulk-loaded this collection (`list()`, `get()`), every terminal returns a value that hydrates when AWAITED and throws `CollectionNotHydratedError` on synchronous use — an unloaded collection is not an empty one; see `query/hydration.ts`. **Lazy-MV gap:** `query()` is synchronous and does NOT
      * trigger lazy materialized-view resolve-on-read. If this
      * collection is a lazy MV's output and the MV is currently stale,
      * `query().toArray()` returns the pre-stale snapshot. To force a
@@ -1275,6 +1281,10 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
      * Never writes to the store and never fires write hooks, so it cannot loop.
      */
     _applyRemoteChange(id: string, action: 'put' | 'delete'): Promise<void>;
+    /** @internal #1362 — same as {@link _applyRemoteChange}, for a frame that carries NO verb.
+     *  A peer's claim about the verb is not evidence; the re-read decides it, exactly as
+     *  `_compensateRevertedWrite` does. Untrusted ingress is why the frame omits it. */
+    _applyRemoteSignal(id: string): Promise<void>;
     /**
      * Origin-tagged mutation choke point (#623 task 10) — the single dispatch
      * point every put/delete path funnels through, AFTER its own store write,
@@ -1401,6 +1411,15 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
      * vault-shared `_blob` DEK (enabling cross-collection deduplication).
      */
     blob(id: string): BlobSet;
+    /**
+     * #1452 — would an update of record `id` pass the `beforePut` gate bus right
+     * now? Runs the bus with `incoming = existing`, so closed periods and record
+     * guards refuse an attachment change exactly as they would refuse the
+     * record's own update. A record with no stored body (never written, marker,
+     * elevated tier) is not gated — attaching before the first `put()` was
+     * always allowed. @internal
+     */
+    _assertRecordMutable(id: string): Promise<void>;
     /** Get all records as encrypted envelopes (for dump). */
     dumpEnvelopes(): Promise<Record<string, EncryptedEnvelope>>;
     /**
@@ -1469,6 +1488,8 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
     /** Drop a record's encrypted _vec sidecar on erasure (a vector is text-invertible).
      *  Called by vault.ts forget() inside a resilient try/catch; residue is reported in ForgetResult. */
     _purgeVector(id: string): Promise<void>;
+    /** @internal #1359 — force an immediate sidecar write, cancelling the debounce. No-op when none opted in. */
+    _flushFieldIndexes(): Promise<void>;
     /** Drop the persisted lexical-index blob (forget/erasure): an opaque
      *  all-records index must not survive crypto-shred. Idempotent; no-op without persist. */
     _purgeSearchIndex(): Promise<void>;

package/dist/kernel/cutover-transform.d.ts

@@ -10,7 +10,7 @@
  * @internal
  */
 import type { EncryptedEnvelope, NoydbStore, VdigFieldPolicy } from './types.js';
-import { type RecordCodec, type EnclaveKey } from './enclave/index.js';
+import { type RecordCodec, type EnclaveKey } from '../capsule/index.js';
 import type { MutationOrigin } from './mutation.js';
 /**
  * @internal Structural (not imported) view of `UnlockedKeyring` — only

package/dist/kernel/errors.d.ts

@@ -37,7 +37,8 @@
  *       │    ├─ IndexWriteFailureError            — index side-car put/delete failed post-main
  *       │    ├─ UniqueConstraintError             — duplicate value on unique index
  *       │    ├─ UnsupportedIndexOptionError       — unique+lazy or unique+crdt at registration
- *       │    └─ FieldNotQueryableError            — field's Via posture is queryable: 'none'
+ *       │    ├─ FieldNotQueryableError            — field's Via posture is queryable: 'none'
+ *       │    └─ CollectionNotHydratedError        — sync terminal used on a never-loaded collection
  *       ├─ i18n / Dictionary errors
  *       │    ├─ ReservedCollectionNameError
  *       │    ├─ DictKeyMissingError
@@ -136,32 +137,102 @@ export declare class DecryptionError extends NoydbError {
     constructor(message?: string);
 }
 /**
- * Thrown when GCM tag verification fails, indicating the ciphertext was
- * modified after encryption.
- *
- * AES-256-GCM is authenticated encryption — the tag over the ciphertext
- * is checked on every decrypt. If any byte was flipped (accidental
- * corruption or deliberate tampering), decryption throws this error.
- * Treat it as a security alert: the stored bytes are not what NOYDB wrote.
- */
+ * **Means exactly: "this envelope carries no sealed body, and this path needs
+ * one."** (#15)
+ *
+ * Since `_iv`/`_data` became optional, an envelope written by an *exclave*
+ * capsule has no ciphertext body at all. Handed to an AES decrypt path, that
+ * is neither corruption nor an attack — it is a capsule mismatch, and it must
+ * not be reported as one of the two errors it superficially resembles:
+ *
+ *  - **not {@link TamperedError}**, whose entire documented meaning is "the
+ *    AEAD tag did not verify under this key". That class is hub's security
+ *    alert; raising it for a structurally absent body would manufacture a
+ *    tamper signal out of a configuration difference, and the operator
+ *    response to the two is completely different.
+ *  - **not a bare `TypeError`**, which is what reading `.length` or passing
+ *    `undefined` into `decrypt()` produced before this issue — an internal
+ *    slip surfacing as if hub had a bug in its own arithmetic.
+ *
+ * `where` names the call path that required the body, because the same
+ * absence is legitimate two frames earlier: {@link hasSealedBody} answers
+ * false for it, and a tombstone, a `_del` marker and a plaintext collection
+ * all reach that answer by design.
+ */
+export declare class MissingEnvelopeBodyError extends NoydbError {
+    /** The operation that required a sealed body, e.g. `'openEnvelopeJson'`. */
+    readonly where: string;
+    constructor(where: string);
+}
+/**
+ * **Means exactly: "AEAD failed under this key."** Nothing more (lanna-db #4,
+ * 2026-09-03). AES-256-GCM authenticates the ciphertext on every decrypt; if
+ * the tag does not verify under the DEK the caller supplied, the enclave
+ * throws this. Only the enclave throws it *for* an AEAD failure — everywhere
+ * else in hub that names this class is either passing one through or
+ * attaching evidence it holds (see {@link reason}).
+ *
+ * What it does NOT mean on its own: "someone modified the bytes". Four
+ * situations all present as an AEAD failure — the bytes were altered; the
+ * caller holds no key for this collection and a fabricated one was tried; the
+ * body is identity-bound to another vault; the body was sealed under a format
+ * this build does not read. The first is the security alert; the other three
+ * are evidence a caller can hold BEFORE decrypting, and when it does it says
+ * so in `reason`. **With `reason` absent, treat this as the alert it has
+ * always been.** Hub's own tier-fallback code (`with-shape/blobs`) branches
+ * on this class as "not ours at this tier — try the next", which is the
+ * correct reading of "did not open under this key".
+ *
+ * A key derived from a user credential (recovery code, password, share set)
+ * that fails to open a blob is a wrong KEY, and surfaces as
+ * {@link InvalidKeyError}, never this class — `wrapped-deks.ts` translates.
+ */
+/** See {@link TamperedError.reason}. */
+export type TamperedReason = 'unbound-legacy-format' | 'key-absent' | 'generation-mismatch' | 'foreign-stamp';
 export declare class TamperedError extends NoydbError {
     /**
-     * Why the tag check failed, when the enclave could tell (#1103).
+     * Evidence the thrower held BEFORE decrypting, when it held any. Additive
+     * (#1103 pattern): the throw and the class are unchanged, so
+     * `catch (e) { if (e instanceof TamperedError) … }` keeps working; callers
+     * that want to tell a migration or a missing grant from a breach read this.
      *
-     * `'unbound-legacy-format'` — the body opens under an EMPTY AAD, so it was
-     * sealed before identity binding (#1041) and this is a format transition, not
-     * an attack. Positive evidence, not a guess: producing a body that decrypts
-     * under this DEK requires the DEK, which an untrusted store does not hold.
+     * - `'unbound-legacy-format'` — the body opens under an EMPTY AAD, so it was
+     *   sealed before identity binding (#1041): a format transition, not an
+     *   attack. Positive evidence: producing a body that decrypts under this DEK
+     *   requires the DEK, which an untrusted store does not hold. (#1103)
+     * - `'key-absent'` — this keyring holds no DEK for a collection that already
+     *   has records, and the DEK cannot be back-filled (wrapping needs the
+     *   grantee's secret, which the vault never stores). Thrown by the DEK
+     *   resolver instead of minting a key that would decrypt nothing and
+     *   resurface as a bare AEAD failure — the #1288 misdiagnosis. Reserved
+     *   collections (`_periods`, …) take this path; user collections throw
+     *   `NoAccessError` (#1004/#1010).
+     * - `'generation-mismatch'` — reserved for "the artefact was sealed at a
+     *   generation this reader cannot compute". **Not emitted by this build**:
+     *   hub reads no generation stamp off any envelope — `NOYDB_ENVELOPE_GENERATION`
+     *   is an exported constant, and the stamp a bundle carries is manifest data
+     *   a reader never branches on (ADR 0003). The one generation fact hub can
+     *   establish from the bytes — "opens under an empty AAD" — is already
+     *   `'unbound-legacy-format'`. Absence of a stamp never reads as
+     *   generation 1 (`docs/ENVELOPE-GENERATION.md`).
+     * - `'foreign-stamp'` — reserved for "this vault's DEK was asked to open a
+     *   body identity-bound to ANOTHER vault". **Not emitted by this build**:
+     *   nothing in hub can tell that apart from another vault's compartment
+     *   merely being present, which in a multi-vault bundle is normal
+     *   (klum `extractCrossVaultPartition`).
      *
-     * Absent — no benign explanation was found. Treat as the security alert this
-     * error has always been.
+     * Both reserved values are declared so consumers can type against them; a
+     * build that starts emitting either will say so in its CHANGELOG.
      *
-     * The field is additive and the throw is unchanged, so
-     * `catch (e) { if (e instanceof TamperedError) … }` keeps working; callers
-     * that want to tell a migration from a breach can now read this.
+     * Absent — no evidence; the security alert.
+     *
+     * ⚠️ `reason` is hub's IN-PROCESS report and may be branched on. A
+     * generation or origin stamp read out of an untrusted manifest may NOT — it
+     * is store-supplied data, not evidence (klum ADR 0003). If you are holding
+     * a stamp and not this error, you are holding a claim.
      */
-    readonly reason?: 'unbound-legacy-format';
-    constructor(message?: string, reason?: 'unbound-legacy-format');
+    readonly reason?: TamperedReason;
+    constructor(message?: string, reason?: TamperedReason);
 }
 /**
  * Thrown when key unwrapping fails, typically because the secret is wrong
@@ -589,7 +660,36 @@ export declare class PeriodClosedError extends NoydbError {
     readonly periodName: string;
     readonly endDate: string;
     readonly recordTs: string;
-    constructor(periodName: string, endDate: string, recordTs: string);
+    /**
+     * #1455 — the business-date field the guard compared, when the period
+     * declares one. Absent on the envelope-`_ts` (no `dateField`) path.
+     * Structured so a consumer can render the refusal without parsing
+     * `recordTs`'s composed `"incoming[cycle]=2026-06"` form.
+     */
+    readonly dateField: string | undefined;
+    /** #1455 — which side of the write tripped the seal. */
+    readonly side: 'existing' | 'incoming' | undefined;
+    constructor(periodName: string, endDate: string, recordTs: string, detail?: {
+        dateField?: string;
+        side?: 'existing' | 'incoming';
+    });
+}
+/**
+ * Thrown when the `_periods` hash chain does not verify on load (#1454): a
+ * period record's `priorPeriodHash` / `priorPeriodName` no longer resolve to
+ * the stored predecessor in its timeline — an interior close was rewritten or
+ * deleted under the engine. The write guard refuses to evaluate against a set
+ * it cannot trust, so every period-governed write fails with this until the
+ * store is repaired from a trusted copy.
+ *
+ * The chain cannot see a rewrite of the NEWEST record in a timeline (nothing
+ * hashes it yet); the public-API refusal in `vault.collection()` is what closes
+ * that path.
+ */
+export declare class PeriodChainError extends NoydbError {
+    readonly periodName: string;
+    readonly partition: readonly (string | number)[] | undefined;
+    constructor(periodName: string, why: string, partition?: readonly (string | number)[]);
 }
 /**
  * Thrown when a `put()` or `delete()` is rejected by a guard's `check`
@@ -658,7 +758,7 @@ export declare class AmendmentForbiddenError extends NoydbError {
  * envelope ciphertext is still in the store, the keyring file is
  * still listed at `_keyring/*`, and anyone with direct store read
  * access can count keyrings without going through the hub. See
- * `https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/user-envelope.md` → "Directory visibility".
+ * `https://github.com/noy-db/docs/blob/main/content/docs/services/user-envelope.md` → "Directory visibility".
  */
 export declare class DirectoryDisabledError extends NoydbError {
     readonly vault: string;
@@ -933,6 +1033,22 @@ export declare class NotFoundError extends NoydbError {
 export declare class ValidationError extends NoydbError {
     constructor(message?: string);
 }
+/**
+ * Thrown when a `where(field, 'matches', …)` operand is refused (#1357).
+ *
+ * Three distinct refusals, all loud and all at the `where()` call site:
+ *   - the operand is neither a `RegExp` nor a LIKE string,
+ *   - the pattern trips the ReDoS budget (source length, group nesting,
+ *     quantifier count, or a quantified group that itself quantifies),
+ *   - the RegExp carries a `g`/`y` flag, which makes `test()` stateful
+ *     across records and would silently drop rows.
+ *
+ * Deliberately a REFUSAL, never a rewrite: a sanitiser that "fixes" a
+ * user pattern changes which rows come back without saying so.
+ */
+export declare class UnsafePatternError extends NoydbError {
+    constructor(message: string);
+}
 /**
  * Thrown when a Standard Schema v1 validator rejects a record on
  * `put()` (input validation) or on read (output validation). Carries
@@ -1011,7 +1127,41 @@ export declare class GroupCardinalityError extends NoydbError {
     readonly cardinality: number;
     /** The cap that was exceeded. */
     readonly maxGroups: number;
-    constructor(field: string, cardinality: number, maxGroups: number);
+    constructor(field: string, cardinality: number, maxGroups: number, 
+    /**
+     * Which surface refused (#1340). `'query'` — the eager `.groupBy()`, whose
+     * ceiling is a fixed constant. `'scan'` — the streaming
+     * `scan().groupBy(key, { maxGroups })`, whose ceiling is a DECLARED budget,
+     * so its message names the option that raises it. The two differ only in
+     * the advice; the code, the fields and the class are one.
+     */
+    surface?: 'query' | 'scan');
+}
+/**
+ * Thrown by `.traverse()` / `ancestorsOf()` / `descendantsOf()` when a cycle
+ * is reached AND the caller opted into `{ onCycle: 'throw' }` (#1352).
+ *
+ * The default is `'stop'` — the walk simply does not re-enter a node already
+ * on the current path, which is what keeps a circular parent chain from
+ * hanging the tab. `'throw'` exists for the other legitimate reading: a
+ * self-referencing hierarchy that is SUPPOSED to be acyclic, where a cycle is
+ * a data-integrity finding the consumer wants surfaced rather than silently
+ * pruned.
+ *
+ * `cycle` is the offending walk closed back on itself — the path from the
+ * seed to the node that would have been re-entered, with that node repeated
+ * as the final element, so `cycle[0]` and `cycle.at(-1)` name the same
+ * record only for a cycle that reaches all the way back to the seed.
+ */
+export declare class TraversalCycleError extends NoydbError {
+    /** The declared self-ref field being traversed. */
+    readonly field: string;
+    /** The path that closed on itself, with the re-entered id repeated last. */
+    readonly cycle: readonly string[];
+    constructor(opts: {
+        field: string;
+        cycle: readonly string[];
+    });
 }
 /**
  * Thrown in lazy mode when a `.query()` / `.where()` / `.orderBy()` clause
@@ -1030,10 +1180,24 @@ export declare class IndexRequiredError extends NoydbError {
     readonly collection: string;
     readonly touchedFields: readonly string[];
     readonly missingFields: readonly string[];
+    /**
+     * Why the index could not serve the query, when it is NOT "a field is
+     * unindexed" (#1407).
+     *
+     * ⚠️ The default message names missing fields, and that sentence is FALSE
+     * for a refusal on an indexed field — a `where(f,'==',null)` in lazy mode is
+     * refused because the persisted index never holds nullish values, not
+     * because `f` lacks an index. Telling that caller to "declare an index on
+     * each field" sends them to fix something that is already correct, which is
+     * the same defect #1430 fixed in `WeakSecretError`: advice describing rules
+     * that do not apply here.
+     */
+    readonly reason: string | undefined;
     constructor(args: {
         collection: string;
         touchedFields: readonly string[];
         missingFields: readonly string[];
+        reason?: string;
     });
 }
 /**
@@ -1062,16 +1226,17 @@ export declare class UniqueConstraintError extends NoydbError {
  * Thrown at collection registration when an index option is declared that
  * is incompatible with the collection's operating mode.
  *
- * Currently covers two cases:
- * - `unique: true` on a lazy-mode (`prefetch: false`) collection — lazy mode
- *   does not pre-load all records, so an in-memory uniqueness map cannot be
- *   maintained reliably.
- * - `unique: true` on a CRDT collection (`crdt: 'lww-map' | 'rga' | 'yjs'`) —
- *   CRDT put() short-circuits the unique-constraint check, so enforcement would
- *   silently not fire.
- *
- * Both cases are caught eagerly at `vault.collection()` time so the developer
- * sees the incompatibility immediately rather than shipping silently-ignored
+ * ⚠️ **Nothing throws this today (#1358).** It used to cover three cases —
+ * `unique: true` on a lazy-mode (`prefetch: false`), CRDT, or tiered
+ * collection — because those write paths bypassed enforcement. Lazy and
+ * tiered now enforce for real, and CRDT reports detected duplicates on the
+ * `unique:violation` event instead of refusing the declaration (see
+ * `with-lookup/indexing/unique-constraints.ts`). The class is retained: it is
+ * part of the published surface, and it is the right shape for the next index
+ * option that a mode genuinely cannot honour.
+ *
+ * Any future case belongs at `vault.collection()` time so the developer sees
+ * the incompatibility immediately rather than shipping silently-ignored
  * constraints.
  *
  * The `option` field names the incompatible option (`'unique'`) so catch blocks
@@ -1138,10 +1303,58 @@ export declare class PersistedIndexCompensationError extends NoydbError {
  * Payload:
  * - `field` — the refused field name
  */
+/**
+ * #1458 — a query-tier extension method was called without its subpath.
+ *
+ * The DSL ships in four groups. `@noy-db/hub/query` carries **Find** and is
+ * always present; **Live**, **Reduce** and **Relate** arrive by side-effect
+ * import (`import '@noy-db/hub/query/relate'`), which patches the missing
+ * methods onto `Query.prototype` and — through the `declare module` block
+ * that ships with each subpath — onto the `Query` TYPE.
+ *
+ * ⭐ **The compile error is the primary signal; this is the backstop.** With
+ * the types wired that way, calling `.join()` without the import does not
+ * typecheck, which is where a TypeScript consumer meets the problem. This
+ * error is what a JavaScript consumer, or a call that reached the method
+ * through a cast, gets instead of `TypeError: q.join is not a function` —
+ * a message that names neither what is missing nor how to get it.
+ *
+ * ⚠️ It is deliberately NOT a lazy loader. Fetching the chunk here would
+ * defer the cost rather than remove it, and a first `.join()` offline would
+ * fail on a network fetch — the opposite of what an offline-first store
+ * promises. The one line of import is the price of the byte saving.
+ */
+export declare class QueryExtensionMissingError extends NoydbError {
+    /** The method that was called, e.g. `'join'`. */
+    readonly method: string;
+    /** The subpath whose import supplies it, e.g. `'@noy-db/hub/query/relate'`. */
+    readonly subpath: string;
+    constructor(method: string, subpath: string);
+}
 export declare class FieldNotQueryableError extends NoydbError {
     readonly field: string;
     constructor(field: string);
 }
+/**
+ * #1414 — thrown when a synchronous query terminal is USED on a collection
+ * that has never been loaded. The collection's eager cache is empty because
+ * nothing has read it yet, not because the collection is empty: those are
+ * different facts, and only one of them is safe to act on.
+ *
+ * The terminal itself does not throw — it returns a pending result so that the
+ * AWAITED form (`await collection.query().toArray()`, which is what every
+ * async guard `check` does) transparently hydrates and answers correctly. The
+ * error is raised the moment that value is used synchronously: indexed,
+ * iterated, compared, coerced, or read for a property.
+ *
+ * Fix a caller by awaiting the terminal, or by `await collection.list()` /
+ * `await collection.get(id)` before the synchronous read.
+ */
+export declare class CollectionNotHydratedError extends NoydbError {
+    readonly collection: string;
+    readonly terminal: string;
+    constructor(collection: string, terminal: string, label?: string);
+}
 /**
  * Thrown by `readPod()` when the body bytes don't match
  * the integrity hash declared in the bundle header — i.e. someone
@@ -1677,12 +1890,18 @@ export declare class JoinTooLargeError extends NoydbError {
     readonly leftRows: number;
     readonly rightRows: number;
     readonly maxRows: number;
-    readonly side: 'left' | 'right';
+    /**
+     * Which count tripped the ceiling. `'output'` is #1339's addition: a
+     * declared non-equi `.joinOn()` is many-to-many, so it can exceed the
+     * ceiling with both SIDES comfortably under it — the produced row count is
+     * the only thing standing between a theta join and a hang.
+     */
+    readonly side: 'left' | 'right' | 'output';
     constructor(opts: {
         leftRows: number;
         rightRows: number;
         maxRows: number;
-        side: 'left' | 'right';
+        side: 'left' | 'right' | 'output';
         message: string;
     });
 }
@@ -2177,7 +2396,7 @@ export declare class RecoveryProfileNotImplementedError extends NoydbError {
     constructor(profile: string, tracking: string);
 }
 /**
- * Thrown by a `kernel/enclave` fork's **optional groups** — sealing,
+ * Thrown by a `capsule/enclave-aes` fork's **optional groups** — sealing,
  * deterministic, per-record-key lifecycle — when that fork's crypto
  * engine does not implement the requested behavior.
  *
@@ -2200,7 +2419,7 @@ export declare class EnclaveNotSupportedError extends NoydbError {
  * Raised when a collection's `classifiedFields` configuration is invalid
  * (e.g. a claimed field name collides with a rider companion or another
  * classified field). Homed in `kernel/errors.ts` (rather than the classified
- * feature module) so `kernel/enclave/classify/*` can throw it without
+ * feature module) so `capsule/enclave-aes/classify/*` can throw it without
  * importing with-*; the classified feature module re-exports it under the
  * same name for backward-compatible import paths.
  */

package/dist/kernel/generation-map.d.ts

@@ -0,0 +1,48 @@
+/**
+ * A `Map` that stamps every mutation with a globally unique, monotonic tick
+ * (#1417).
+ *
+ * The eager collection cache is written at ELEVEN sites — `put`, `delete`,
+ * hydration, sync cut-over, the lookup write-through, and more. Anything that
+ * memoizes a derived view of that cache (a sorted keyset page order; a
+ * decorated row set) needs to know when the cache moved, and hand-bumping a
+ * counter at eleven call sites is a stale-read waiting to happen: miss one and
+ * a reader serves rows from before a write, which is strictly worse than the
+ * cost the memo was there to avoid.
+ *
+ * ⛔ So the counter lives in the container, not at the call sites. Every
+ * mutation route into a `Map` is `set` / `delete` / `clear`; overriding those
+ * three makes the invariant STRUCTURAL — a new write site cannot forget,
+ * because there is nothing for it to remember.
+ *
+ * ⭐ THE TICK IS GLOBAL, NOT PER-INSTANCE, and that is load-bearing. A memo
+ * keyed on `<vault>/<collection>` + a per-instance count collides across two
+ * collections that share a name — a second vault, a torn-down and rebuilt
+ * instance, a test suite reusing `V/rows` — because both count from zero. A
+ * process-wide tick makes every stamp unique, so identity + generation is a
+ * sound memo key without the memo having to know about instance lifetimes.
+ * (Measured, by a test that reused a collection name and got another
+ * collection's page order back.)
+ *
+ * `set` bumps even when the value is identical: a redundant invalidation costs
+ * one recompute, a missed one costs correctness.
+ *
+ * @module
+ */
+export declare class GenerationMap<K, V> extends Map<K, V> {
+    /**
+     * ⚠️ NOT a `#private` field, and not readonly-initialised, deliberately.
+     * `Map`'s constructor calls `this.set()` for each entry of an iterable
+     * argument — which runs BEFORE this class's fields are installed. A
+     * `#private` field throws `TypeError` on touch at that point; a declared
+     * property is merely `undefined`, and assigning to it is safe. The
+     * initializer below then runs and resets it to 0, which is the correct
+     * resting state for a freshly built map.
+     */
+    private gen;
+    /** Mutation stamp. Equal across two reads means nothing changed between them. */
+    get generation(): number;
+    set(key: K, value: V): this;
+    delete(key: K): boolean;
+    clear(): void;
+}

package/dist/kernel/merge-authority.d.ts

@@ -1,5 +1,5 @@
 import type { MergeAuthority } from '../port/with/merge-authority.js';
-import type { EnclaveKey } from './enclave/index.js';
+import type { EnclaveKey } from '../capsule/index.js';
 /**
  * ⚠️ **A client cannot verify what it cannot decrypt** — and that boundary is
  * stated here rather than hidden.

package/dist/kernel/noydb.d.ts

@@ -620,6 +620,11 @@ export declare class Noydb {
     enableTabCoordination(opts?: TabCoordinationOptions): {
         dispose: () => void;
     };
+    /** @internal #1362 — `ChangeBroadcastHost`: re-read one broadcast address through THIS
+     *  instance's own keyring. No-op for a vault this instance has not opened. */
+    _applyRemoteSignal(vaultName: string, collectionName: string, id: string): Promise<void>;
+    /** @internal #1362 — `ChangeBroadcastHost`: store backend name, for the default channel name. */
+    get _storeName(): string | undefined;
     private disableTabCoordination;
     get tabRole(): TabRole;
     activeTabs(): TabPresence[];
@@ -713,7 +718,7 @@ export declare class Noydb {
      * keyring file at `_keyring/<userId>` and the envelope ciphertext at
      * `_users/<keyringId>` remain observable to anyone with direct store
      * read access — only the hub-level enumeration is gated. See
-     * `https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/user-envelope.md` → "Directory visibility".
+     * `https://github.com/noy-db/docs/blob/main/content/docs/services/user-envelope.md` → "Directory visibility".
      */
     setDirectoryEnabled(vault: string, enabled: boolean): Promise<void>;
     /**

package/dist/kernel/paths.d.ts

@@ -1,11 +1,35 @@
 /**
- * Generic dotted-path / `[]`-wildcard record helpers. Kernel-owned:
- * these carry zero i18n logic — they were extracted out of
- * `via/i18n/core.ts` (Task 7, #623) so kernel call-sites (put-time
- * validation, densify) can import them without a spine→service edge.
+ * Refuse a malformed field path AT DECLARATION TIME.
  *
- * @internal
+ * ⛔ WHY THIS EXISTS. {@link getAtPath} performs no validation by design — it
+ * answers "what is at this path", and "nothing" is a legitimate answer for an
+ * optional field or an empty array. The consequence is that a MALFORMED path
+ * is indistinguishable from an absent value: `'contacts[.name'` contains no
+ * `[].` and no `.`, so it falls through to `obj['contacts[.name']`, resolves
+ * to `undefined`, and the declaration does nothing. Forever. Silently.
+ *
+ * Measured 2026-09-13: an `i18nFields` declaration with `required: 'all'` and
+ * a malformed path accepted a record missing every required language, while
+ * the same spec on a well-formed path refused it. The guarantee was not
+ * weakened — it was never installed.
+ *
+ * ⭐ SAME CLASS AS core#19 AND `moneyFields`. `via/money/paths.ts` already
+ * guards its own grammar and says why in its header ("a declared-but-
+ * unreachable path that was silently ignored ... a latent 100× bug");
+ * `classifiedFields` did not, and a consumer found the leak. This is the third
+ * instance, which is why the check lives HERE, beside the resolver every
+ * path-taking family shares, rather than being written a third time.
+ *
+ * ⚠️ SYNTAX ONLY. A well-formed path naming a field that does not exist
+ * (`titel` for `title`) is NOT caught here and cannot be — that needs the
+ * collection's schema, which is not always declared. It is a real and separate
+ * gap; see the issue filed alongside this guard.
+ *
+ * Trailing `[]` is refused because `getAtPath` cannot consume it: the wildcard
+ * is recognised as the three-character marker `[].`, so `'contacts[]'` with
+ * nothing after it is read as an ordinary key and resolves to nothing.
  */
+export declare function assertFieldPath(path: string, context: string): void;
 /**
  * Return all leaf values at `path`, expanding `[].` array wildcards.
  *

package/dist/kernel/prepared-write.d.ts

@@ -11,7 +11,7 @@
  * kernel-surface line budget.
  */
 import type { EncryptedEnvelope } from './types.js';
-import type { EnclaveKey } from './enclave/index.js';
+import type { EnclaveKey } from '../capsule/index.js';
 /** @internal Everything `_commitPut` needs after `_preparePut` produced the envelope. */
 export interface PreparedPut<T> {
     readonly id: string;