@noy-db/hub 0.8.0-pre.0 → 0.9.0-pre.0

package/dist/{chunk-T2LBQ5DV.js → chunk-FSQNGPHH.js}

@@ -1,31 +1,31 @@
+import {
+  isManifestReservedCollection
+} from "./chunk-EPFF7LOX.js";
 import {
   LinkIntegrityError,
   declareLink,
   isLinkCollectionName,
   linkCollectionName,
   linkRowKey
-} from "./chunk-AOWGXU6D.js";
+} from "./chunk-UAKY6E4N.js";
 import {
   hashFields,
   validateSatelliteDeclaration
-} from "./chunk-6K7DPM7D.js";
+} from "./chunk-WFWFXDNS.js";
 import {
   resolveStaleOnRead
-} from "./chunk-TROR3ALR.js";
-import {
-  isManifestReservedCollection
-} from "./chunk-EPFF7LOX.js";
+} from "./chunk-SFCD6OU7.js";
 import {
   loadFence
-} from "./chunk-L7DOS3TE.js";
+} from "./chunk-BMHQHH7Q.js";
 import {
   buildPersistedIndexCallbacks,
   syncTierSearch
-} from "./chunk-6LNL42F5.js";
+} from "./chunk-5HNW4ZTA.js";
 import {
   isBaseLive,
   liveBaseIdSet
-} from "./chunk-GYGLAVCX.js";
+} from "./chunk-PFCTSXHU.js";
 import {
   SchemaUpdateGate
 } from "./chunk-6LJY7X5A.js";
@@ -33,22 +33,57 @@ import {
   NO_TIERS,
   classifySealedShred,
   syncDerivedOutputs
-} from "./chunk-UPD5NWI5.js";
+} from "./chunk-Z3ZXVB2Y.js";
 import {
   NO_PORTABILITY
-} from "./chunk-ZUVBC32X.js";
+} from "./chunk-OK57EATL.js";
 import {
   NO_CARGO
-} from "./chunk-A6IJU4TK.js";
+} from "./chunk-QGSNJD3B.js";
+import {
+  saveSealedSecret
+} from "./chunk-XKBTJGFP.js";
+import {
+  runDrainBarrier
+} from "./chunk-UNSQZSZP.js";
+import {
+  NO_FORMATS
+} from "./chunk-RWFQVNXR.js";
 import {
   fallbackDerivationName
 } from "./chunk-RXLYKVTF.js";
 import {
-  saveSealedSecret
-} from "./chunk-ENAG3IY7.js";
+  CustodyApi,
+  NO_CUSTODY
+} from "./chunk-GOJQ5DZA.js";
 import {
-  runDrainBarrier
-} from "./chunk-3JWHAR6E.js";
+  DEFAULT_POSTURE,
+  ViaGraph,
+  buildDescription,
+  collectKnownFieldNames,
+  computedEntryParts,
+  deriveZodFields,
+  guardReconcileCollisions,
+  mergeViaFields,
+  resolveCollectionConfig,
+  resolveComputedEdges,
+  resolveDescribeFieldIds,
+  resolveVirtualMoneyFields
+} from "./chunk-ZMVSKYTJ.js";
+import {
+  findMatchingIdsByPairs
+} from "./chunk-TFMM5DBB.js";
+import {
+  encodeVecId
+} from "./chunk-YKGJ44Z7.js";
+import {
+  NO_CLASSIFIED,
+  guardClassifiedCompat,
+  resolveClassifiedFields
+} from "./chunk-K673OO6B.js";
+import {
+  derivePersistedSchema
+} from "./chunk-J4KAPKBJ.js";
 import {
   findRollupSpecForIntent,
   forgetDerivedFanout,
@@ -58,17 +93,53 @@ import {
   runGraphDispatchWave,
   selfWriteFieldEqual,
   touchFor
-} from "./chunk-K6W7BVZ6.js";
+} from "./chunk-CAD7N6HQ.js";
+import {
+  buildLookupAltIndex,
+  buildLookupSnapshotRows,
+  buildPresentForJoin,
+  checkLookupMembership,
+  coerceLookupKey,
+  collectLookupDictCompat,
+  enforceStaticDictOnPut,
+  matchesReferencingValue,
+  registerLookupRefEdges,
+  reservedDictDepsOf,
+  resolveDictSource,
+  resolveLabelFromMap,
+  updateReferencingRecords
+} from "./chunk-GETUTTZU.js";
 import {
   OverlayedCollection
-} from "./chunk-MLPHLJIQ.js";
+} from "./chunk-ZHQJAV6D.js";
 import {
   INDEXED_STORE_POLICY,
   NO_SYNC
-} from "./chunk-T7IR4N2S.js";
+} from "./chunk-JBMMWYOH.js";
 import {
   NO_ATTESTATION
-} from "./chunk-X4773RBR.js";
+} from "./chunk-6QLCS7ET.js";
+import {
+  NO_COVERAGE
+} from "./chunk-NV4OESHC.js";
+import {
+  NO_PERIODS,
+  isEffectivelyReopened,
+  isOrderableBusinessDate,
+  malformedBusinessDate,
+  purgeMarkersOn,
+  resolvePeriodKey,
+  resolveReopenState,
+  samePartition
+} from "./chunk-IVMFIKNA.js";
+import {
+  PERIODS_COLLECTION,
+  PERIOD_ARCHIVES_COLLECTION,
+  PERIOD_FREEZES_COLLECTION,
+  PERIOD_REOPENS_COLLECTION,
+  PERIOD_TARGET_PURGES_COLLECTION,
+  periodExclusiveUpperBound
+} from "./chunk-6WS35E6X.js";
 import {
   NO_SHADOW
 } from "./chunk-SMY5X46Z.js";
@@ -79,7 +150,7 @@ import {
   TxContext,
   bestEffortRevert,
   trackKeyedWrite
-} from "./chunk-5FDLC6G7.js";
+} from "./chunk-7CT6SX4M.js";
 import {
   lazy
 } from "./chunk-5D2ALSM5.js";
@@ -88,67 +159,26 @@ import {
   InvertedIndex,
   MemoryIndexStore,
   NO_SEARCH
-} from "./chunk-I3JDRCMW.js";
+} from "./chunk-TZYTMZZY.js";
 import {
   NO_SEQUENCE,
   SEQUENCE_COLLECTION,
   compileSequenceFormat,
   resolveSequenceKey
-} from "./chunk-M522UYZ2.js";
-import {
-  CustodyApi,
-  NO_CUSTODY
-} from "./chunk-B6SJIBQK.js";
-import {
-  DEFAULT_POSTURE,
-  ViaGraph,
-  buildDescription,
-  collectKnownFieldNames,
-  computedEntryParts,
-  deriveZodFields,
-  guardReconcileCollisions,
-  mergeViaFields,
-  resolveCollectionConfig,
-  resolveComputedEdges,
-  resolveDescribeFieldIds,
-  resolveVirtualMoneyFields
-} from "./chunk-UD5EVGZ7.js";
-import {
-  findMatchingIdsByPairs
-} from "./chunk-TFMM5DBB.js";
-import {
-  encodeVecId
-} from "./chunk-MDWKM2XC.js";
+} from "./chunk-BYHCKX73.js";
 import {
-  derivePersistedSchema
-} from "./chunk-PSIV7CJV.js";
-import {
-  buildLookupAltIndex,
-  buildLookupSnapshotRows,
-  buildPresentForJoin,
-  checkLookupMembership,
-  coerceLookupKey,
-  collectLookupDictCompat,
-  enforceStaticDictOnPut,
-  matchesReferencingValue,
-  registerLookupRefEdges,
-  reservedDictDepsOf,
-  resolveDictSource,
-  resolveLabelFromMap,
-  updateReferencingRecords
-} from "./chunk-FH2L2E34.js";
-import {
-  NO_CLASSIFIED,
-  guardClassifiedCompat,
-  resolveClassifiedFields
-} from "./chunk-QOOUUR4A.js";
+  EXPORT_AUDIT_COLLECTION,
+  NO_BLOBS,
+  createExportBlobsHandle,
+  runCompaction
+} from "./chunk-G5EDYVSE.js";
 import {
   LazyQuery,
   NO_INDEXING,
   compositeKey,
   decodeIdxId,
   encodeIdxId
-} from "./chunk-HBRLNOHL.js";
+} from "./chunk-NYJBYVBG.js";
 import {
   IMPLICIT_LAZY
 } from "./chunk-66TQOPFM.js";
@@ -163,71 +193,44 @@ import {
 } from "./chunk-PVEWA2DU.js";
 import {
   NO_CONSENT
-} from "./chunk-PEOZ34EM.js";
-import {
-  NO_COVERAGE
-} from "./chunk-RHVMZSUU.js";
-import {
-  NO_PERIODS,
-  isEffectivelyReopened,
-  isOrderableBusinessDate,
-  malformedBusinessDate,
-  purgeMarkersOn,
-  resolvePeriodKey,
-  resolveReopenState,
-  samePartition
-} from "./chunk-NRT6QZQB.js";
-import {
-  PERIODS_COLLECTION,
-  PERIOD_ARCHIVES_COLLECTION,
-  PERIOD_FREEZES_COLLECTION,
-  PERIOD_REOPENS_COLLECTION,
-  PERIOD_TARGET_PURGES_COLLECTION,
-  periodExclusiveUpperBound
-} from "./chunk-FW22ZCXT.js";
+} from "./chunk-GSAK56VF.js";
 import {
   NO_SEALED_RECORD
-} from "./chunk-PDCG6PR5.js";
+} from "./chunk-GRS2HIV6.js";
 import {
   normalizeIndexDefs,
   parseFieldIndexSnapshot
-} from "./chunk-YSK2CU2Q.js";
+} from "./chunk-3V6LZHUO.js";
 import {
   EXPORT_REDACTION_MARKER,
   ViaPipeline,
   exportRedact
-} from "./chunk-ORDURZBU.js";
+} from "./chunk-YFFMPZPY.js";
 import {
   ScanBuilder
-} from "./chunk-F24ZZTHQ.js";
+} from "./chunk-QGFEBNHO.js";
 import {
   Query
-} from "./chunk-7JE7BDYJ.js";
+} from "./chunk-ZVSKSUGI.js";
 import {
   NO_REDUCE
 } from "./chunk-3TDUWVWB.js";
 import {
   readPath
-} from "./chunk-HLEK5VAN.js";
-import {
-  EXPORT_AUDIT_COLLECTION,
-  NO_BLOBS,
-  createExportBlobsHandle,
-  runCompaction
-} from "./chunk-GF5BZ7D4.js";
+} from "./chunk-BUE7R3B5.js";
 import {
   dictCollectionName
-} from "./chunk-DF73H4UN.js";
+} from "./chunk-NZULV7LK.js";
 import {
   NO_I18N,
   getAtPath,
   isDictCollectionName,
   isStaticDictDescriptor
-} from "./chunk-GHLTDZRS.js";
+} from "./chunk-V55JASXO.js";
 import {
   isViaInstalled,
   viaBinder
-} from "./chunk-Z5HTYMMQ.js";
+} from "./chunk-PTJY5R3O.js";
 import {
   NO_TEAM,
   describeAllUsersAuth,
@@ -250,7 +253,7 @@ import {
   saveShamirRecoveryEntries,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-ZE4CHIED.js";
+} from "./chunk-APFFJN5T.js";
 import {
   assertKeyringOpenAllowed,
   buildRecipientKeyringFile,
@@ -265,15 +268,15 @@ import {
   listUsers,
   loadKeyring,
   updateKeyringIdentity
-} from "./chunk-M7NI3IWE.js";
+} from "./chunk-45VHWE4C.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
-} from "./chunk-7VCXZDA4.js";
+} from "./chunk-FZXRLNJO.js";
 import {
   NO_BROKER,
   buildCredentialBrokerHandle
-} from "./chunk-4AF3TUMP.js";
+} from "./chunk-72XBVN4J.js";
 import {
   NO_SESSION
 } from "./chunk-VKQCVU2Z.js";
@@ -282,19 +285,19 @@ import {
 } from "./chunk-4AOERLTV.js";
 import {
   NO_HISTORY
-} from "./chunk-QWGU66MP.js";
+} from "./chunk-2A56DSRI.js";
 import {
   sha256Hex
-} from "./chunk-CKNGS5MH.js";
+} from "./chunk-2WJKJZSO.js";
 import {
   assertCutoverTierSafe,
   assertTierWritable,
   dekKey,
   liveRecordIsElevated
-} from "./chunk-JCN44NCY.js";
+} from "./chunk-RIZTZJX6.js";
 import {
   NO_VAULT_HEAD
-} from "./chunk-HK67PX4J.js";
+} from "./chunk-OFD2HD6F.js";
 import {
   NO_FORGET,
   addSubjectRef,
@@ -303,36 +306,34 @@ import {
   readDottedPath,
   rebuildSubjectIndex,
   removeSubjectRef
-} from "./chunk-J6UOHJY5.js";
+} from "./chunk-ZWF3EWZA.js";
 import {
   RecordCodec,
   SEALED_CEK_NS,
   applyRewrappedBody,
+  buildDeleteMarker,
   buildRecordAad,
+  buildRecordEnvelope,
+  buildTombstone,
+  encrypt,
   findByDet,
   hasPerRecordKey,
   hasSealedBody,
+  isDeleteMarker,
+  isTombstone,
   makeReservedEnvelopes,
   openEnvelopeJson,
   queryByDet,
   resolveStableCek,
   rewrapBodyToDek,
-  validateSchemaInput,
   verifyRecordIdentity
-} from "./chunk-KJFW62P4.js";
-import {
-  buildDeleteMarker,
-  buildRecordEnvelope,
-  buildTombstone,
-  isDeleteMarker,
-  isTombstone
-} from "./chunk-SEE332EV.js";
+} from "./chunk-4J3MNVVX.js";
 import {
-  encrypt
-} from "./chunk-UYB234ZR.js";
+  validateSchemaInput
+} from "./chunk-OM3SEDI4.js";
 import {
   SealedHandle
-} from "./chunk-ODVPTDPK.js";
+} from "./chunk-2ELOCEXE.js";
 import {
   AlreadyElevatedError,
   AttestationError,
@@ -372,7 +373,7 @@ import {
   UniqueConstraintError,
   ValidationError,
   isConflictError
-} from "./chunk-244VXYPG.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/kernel/merge-authority.ts
 function buildMergeAuthority(keyring) {
@@ -403,25 +404,6 @@ function buildMergeAuthority(keyring) {
   };
 }
 
-// src/port/with/formats-strategy.ts
-var FormatsNotEnabledError = class extends Error {
-  constructor(op) {
-    super(
-      `vault.${op}() requires the formats service. Import { withFormats } from "@noy-db/hub/as" and pass formatsStrategy: withFormats() to createNoydb().`
-    );
-    this.name = "FormatsNotEnabledError";
-  }
-};
-var NO_FORMATS = {
-  enabled: false,
-  exportWith() {
-    throw new FormatsNotEnabledError("export");
-  },
-  importWith() {
-    throw new FormatsNotEnabledError("import");
-  }
-};
-
 // src/with-commit/tx/strategy.ts
 var NOT_ENABLED = new Error(
   'Multi-record transactions require the tx strategy. Import `{ withTransactions }` from "@noy-db/hub/transactions" and pass it to `createNoydb({ transactionsStrategy: withTransactions() })`.'
@@ -553,7 +535,7 @@ function validateSecretModeOptions(options) {
 }
 async function resolveEffectiveSecret(options, store, vault) {
   if (options.secretMode === "managed") {
-    const { resolveManagedSecret } = await import("./managed-secret-S3MQ6SH6.js");
+    const { resolveManagedSecret } = await import("./managed-secret-VSK7ANQI.js");
     return resolveManagedSecret(store, vault, options.sealingKey);
   }
   return options.secret;
@@ -571,7 +553,7 @@ function ownerKeyringOptions(options, secret) {
 
 // src/port/by/default-provider.ts
 async function createDefaultMesh(store) {
-  const { StoreMesh } = await import("./store-coordination-provider-2O2VUHKW.js");
+  const { StoreMesh } = await import("./store-coordination-provider-Z6HKPOGM.js");
   return new StoreMesh(store);
 }
 
@@ -626,6 +608,28 @@ function populateCollectionRegistries(r, collectionName, options, effectiveViaFi
   }
 }
 
+// src/kernel/export-scope.ts
+async function resolveExportSource(adapter, vault, opts) {
+  const scope = opts.collections ? [...new Set(opts.collections)].filter((n) => !n.startsWith("_")).sort() : null;
+  if (scope) {
+    return {
+      collections: scope,
+      scoped: true,
+      // One `list` per requested collection. Calling `loadAll` here would pull
+      // every collection's envelopes out of the store before declining to
+      // decrypt most of them — the fetch would already have happened, which is
+      // precisely the half that makes "scoping" a word rather than a property.
+      ids: async (collection) => await adapter.list(vault, collection)
+    };
+  }
+  const snapshot = await adapter.loadAll(vault);
+  return {
+    collections: Object.keys(snapshot).sort(),
+    scoped: false,
+    ids: async (collection) => Object.keys(snapshot[collection] ?? {})
+  };
+}
+
 // src/kernel/generation-map.ts
 var tick = 0;
 var GenerationMap = class extends Map {
@@ -1725,7 +1729,7 @@ async function commitSequentially(ctx, entries, priors) {
 }
 
 // src/with-formula/computed/lazy.ts
-var loadComputed = lazy(() => import("./computed-TPFBX7U4.js"));
+var loadComputed = lazy(() => import("./computed-XMFTHAXV.js"));
 async function loadEvalComputedFields() {
   return (await loadComputed()).evalComputedFields;
 }
@@ -2534,7 +2538,7 @@ var Collection = class {
     }
     await this.onAccess?.("find", "*");
     if (hits.length === 0) return [];
-    const { verifyDigestField } = await import("./verify-RVT67IMH.js");
+    const { verifyDigestField } = await import("./verify-KWQIWLGH.js");
     const policy = {
       normalize: spec.verifyNormalize ?? "password",
       notLastN: spec.notLastN ?? 0,
@@ -2746,7 +2750,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-TJ3DYZMQ.js");
+      const { resolveStaleMVOnRead } = await import("./stale-SKV33PBU.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     let record;
@@ -2867,30 +2871,35 @@ var Collection = class {
   }
   /** @internal The body of {@link put}; see the #1420 note there for why it is split. */
   async #putGated(id, record, options) {
-    await this.schemaUpdateGate?.assertWritable();
-    await this.schemaFence?.assertWritable(this.name);
     const hooksActive = this.#hooksActive();
     const busAfterPut = (this.subsystemBus?.hasHandlers("afterPut") ?? false) && !(this.subsystemBus?.dispatching ?? false);
     let event;
-    if (hooksActive || busAfterPut) {
-      const prior = await this.#priorForHook(id);
-      event = {
-        op: prior.record === null ? "create" : "update",
-        vault: this.vault,
-        collection: this.name,
-        docId: id,
-        before: prior.record,
-        after: record,
-        userId: this.keyring.userId,
-        timestamp: Date.now(),
-        txId: this.#txIdForHook(),
-        baseVersion: prior.version,
-        version: prior.version + 1
-      };
-      if (hooksActive) await this.writeHooks.runBefore(event);
-    }
-    if (this.writeQueue) await this.writeQueue.track(() => this._putInternal(id, record, options));
-    else await this._putInternal(id, record, options);
+    const gated = async (committed) => {
+      await this.schemaUpdateGate?.assertWritable();
+      await this.schemaFence?.assertWritable(this.name);
+      if (hooksActive || busAfterPut) {
+        const prior = await this.#priorForHook(id);
+        event = {
+          op: prior.record === null ? "create" : "update",
+          vault: this.vault,
+          collection: this.name,
+          docId: id,
+          before: prior.record,
+          after: record,
+          userId: this.keyring.userId,
+          timestamp: Date.now(),
+          txId: this.#txIdForHook(),
+          baseVersion: prior.version,
+          version: prior.version + 1
+        };
+        if (hooksActive) await this.writeHooks.runBefore(event);
+      }
+      committed();
+      await this._putInternal(id, record, options);
+    };
+    if (this.writeQueue) await this.writeQueue.trackGated(gated);
+    else await gated(() => {
+    });
     if (event) {
       if (hooksActive) await this.writeHooks.runAfter(event);
       if (busAfterPut) await this.subsystemBus.dispatch("afterPut", event);
@@ -3283,7 +3292,7 @@ var Collection = class {
    */
   async dispatchMaterializedViews(id, record, wave) {
     if (this.materializedViewSource === void 0) return;
-    const { dispatchMaterializedViews } = await import("./dispatch-3CQDJV5Q.js");
+    const { dispatchMaterializedViews } = await import("./dispatch-OFDA4WQV.js");
     return dispatchMaterializedViews(this.#mvDispatchCtx(this.materializedViewSource), id, record, wave);
   }
   /**
@@ -3449,48 +3458,54 @@ var Collection = class {
    *  dispatch wave's per-target dedup; `undefined` on the local-write path (byte-identical). */
   async dispatchDerivations(id, record, version, wave, prior) {
     if (this.derivationSource === void 0) return;
-    const { dispatchDerivations } = await import("./dispatch-RH4LHKBH.js");
+    const { dispatchDerivations } = await import("./dispatch-2MQFMEGY.js");
     return dispatchDerivations(this.#derivationDispatchCtx(), id, record, version, wave, prior);
   }
   /** @internal — trigger fan-out for a deleted parent (#1249); see dispatch.ts. */
   async dispatchTriggerDerivationsOnDelete(id, deleted) {
     if (this.derivationSource === void 0) return;
-    const { dispatchTriggerDerivationsOnDelete } = await import("./dispatch-RH4LHKBH.js");
+    const { dispatchTriggerDerivationsOnDelete } = await import("./dispatch-2MQFMEGY.js");
     return dispatchTriggerDerivationsOnDelete(this.#derivationDispatchCtx(), id, deleted);
   }
   /**
    * Delete a record by ID. Runs inside the hub's write-queue tracker
    * so `hub.writeQueue.pending` reflects this write.
+   * ⚠️ Blobs are released (#1451) but a legacy collection defers the erase — a `null` blob read is NOT proof the bytes are gone; see {@link BlobSet.releaseAll} (noy-db/core#28).
    */
   async delete(id) {
     return trackKeyedWrite(this.adapter, this.vault, this.name, id, () => this.#deleteGated(id));
   }
   /** @internal The body of {@link delete}; see the #1420 note on {@link put}. */
   async #deleteGated(id) {
-    await this.schemaUpdateGate?.assertWritable();
-    await this.schemaFence?.assertWritable(this.name);
     const hooksActive = this.#hooksActive();
     const busAfterDelete = (this.subsystemBus?.hasHandlers("afterDelete") ?? false) && !(this.subsystemBus?.dispatching ?? false);
     let event;
-    if (hooksActive || busAfterDelete) {
-      const prior = await this.#priorForHook(id);
-      event = {
-        op: "delete",
-        vault: this.vault,
-        collection: this.name,
-        docId: id,
-        before: prior.record,
-        after: null,
-        userId: this.keyring.userId,
-        timestamp: Date.now(),
-        txId: this.#txIdForHook(),
-        baseVersion: prior.version,
-        version: prior.version + 1
-      };
-      if (hooksActive) await this.writeHooks.runBefore(event);
-    }
-    if (this.writeQueue) await this.writeQueue.track(() => this._deleteInternal(id));
-    else await this._deleteInternal(id);
+    const gated = async (committed) => {
+      await this.schemaUpdateGate?.assertWritable();
+      await this.schemaFence?.assertWritable(this.name);
+      if (hooksActive || busAfterDelete) {
+        const prior = await this.#priorForHook(id);
+        event = {
+          op: "delete",
+          vault: this.vault,
+          collection: this.name,
+          docId: id,
+          before: prior.record,
+          after: null,
+          userId: this.keyring.userId,
+          timestamp: Date.now(),
+          txId: this.#txIdForHook(),
+          baseVersion: prior.version,
+          version: prior.version + 1
+        };
+        if (hooksActive) await this.writeHooks.runBefore(event);
+      }
+      committed();
+      await this._deleteInternal(id);
+    };
+    if (this.writeQueue) await this.writeQueue.trackGated(gated);
+    else await gated(() => {
+    });
     if (event) {
       if (hooksActive) await this.writeHooks.runAfter(event);
       if (busAfterDelete) await this.subsystemBus.dispatch("afterDelete", event);
@@ -3772,7 +3787,7 @@ var Collection = class {
    */
   async dispatchArrayDerivationsOnDelete(id, eraseRecordShapeToo = false) {
     if (this.derivationSource === void 0) return 0;
-    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-RH4LHKBH.js");
+    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-2MQFMEGY.js");
     return dispatchArrayDerivationsOnDelete(this.#derivationDeleteCtx(this.derivationSource), id, eraseRecordShapeToo);
   }
   /**
@@ -3786,7 +3801,7 @@ var Collection = class {
    */
   async dispatchMaterializedViewsOnDelete(id) {
     if (this.materializedViewSource === void 0) return { deleted: 0, residueUndecodable: [], residueDeclined: [] };
-    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-3CQDJV5Q.js");
+    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-OFDA4WQV.js");
     return dispatchMaterializedViewsOnDelete(this.#mvDispatchCtx(this.materializedViewSource), id);
   }
   /**
@@ -3806,7 +3821,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-TJ3DYZMQ.js");
+      const { resolveStaleMVOnRead } = await import("./stale-SKV33PBU.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     await this.ensureHydrated();
@@ -4971,14 +4986,14 @@ var Collection = class {
   /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
   async _ensureClassifiedMarker() {
     if (this._markerPersisted || this.vdigFields === null) return;
-    const { persistClassifiedMarkerForFields } = await import("./classified-marker-W3USLL5M.js");
+    const { persistClassifiedMarkerForFields } = await import("./classified-marker-KHDOYIJB.js");
     await persistClassifiedMarkerForFields(this.adapter, this.vault, this.name, this.vdigFields, await this.getDEK(this.name));
     this._markerPersisted = true;
   }
   /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
   async _classifiedMarkerDigestOnly() {
     if (this._markerDigestOnlyCache !== void 0) return this._markerDigestOnlyCache;
-    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-W3USLL5M.js");
+    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-KHDOYIJB.js");
     this._markerDigestOnlyCache = await readClassifiedMarkerDigestOnly(this.adapter, this.vault, this.name, await this.getDEK(this.name));
     return this._markerDigestOnlyCache;
   }
@@ -5432,7 +5447,7 @@ var DeferredNumberingStore = class {
   async readJson(collection, id) {
     const env = await this.adapter.get(this.vault, collection, id);
     if (!env) return { env: null, value: null };
-    const json = this.encrypted ? await openEnvelopeJson({ collection, id }, env, await this.dek(collection)) : env._data;
+    const json = this.encrypted ? await openEnvelopeJson({ collection, id }, env, await this.dek(collection)) : env._data ?? "";
     return { env, value: JSON.parse(json) };
   }
   async writeJson(collection, id, value, expectedVersion) {
@@ -6064,7 +6079,7 @@ var VaultPeriods = class {
   async readReserved(collection, key) {
     const env = await this.deps.adapter.get(this.deps.vault, collection, key);
     if (!env) return null;
-    const json = this.deps.encrypted ? await openEnvelopeJson({ collection, id: key }, env, await this.deps.getDEK(collection)) : env._data;
+    const json = this.deps.encrypted ? await openEnvelopeJson({ collection, id: key }, env, await this.deps.getDEK(collection)) : env._data ?? "";
     return JSON.parse(json);
   }
   async decryptPeriodRecord(periodId, envelope) {
@@ -6073,7 +6088,7 @@ var VaultPeriods = class {
       const dek = await this.deps.getDEK(PERIODS_COLLECTION);
       json = await openEnvelopeJson({ collection: PERIODS_COLLECTION, id: periodId }, envelope, dek);
     } else {
-      json = envelope._data;
+      json = envelope._data ?? "";
     }
     return JSON.parse(json);
   }
@@ -6646,7 +6661,7 @@ var VaultLinks = class {
 // src/with-shape/links/lazy-handle.ts
 function makeLazyLinkSetHandle(d) {
   let engine = null;
-  const load = () => engine ??= import("./link-set-JCMJ7ULP.js").then(
+  const load = () => engine ??= import("./link-set-QXXSPPHL.js").then(
     ({ LinkSet }) => new LinkSet(d.adapter, d.vault, d.name, d.spec, d.encrypted, d.getDEK, d.actor, d.emitter, d.endpointExists)
   );
   return {
@@ -7029,6 +7044,8 @@ function reconcileCollectionReadState(coll, vaultCtx, plan, hadI18n, hadLookup)
   });
 }
 function reconcileViaAttach(coll, graph, name, vaultCtx, plan) {
+  const allComputed = { ...plan.computed ?? {}, ...plan.effectiveViaFields.computedFields ?? {} };
+  const hasComputed = Object.keys(allComputed).length > 0;
   guardReconcileCollisions(coll._via, {
     moneyFields: plan.effectiveViaFields.moneyFields,
     i18nFields: plan.effectiveViaFields.i18nFields,
@@ -7036,12 +7053,12 @@ function reconcileViaAttach(coll, graph, name, vaultCtx, plan) {
     lookupFields: plan.effectiveViaFields.lookupFields,
     classifiedFields: plan.classifiedFields !== void 0 ? resolveClassifiedFields(name, plan.classifiedFields).byField : void 0,
     blobFields: plan.blobFields,
-    computed: { ...plan.computed ?? {}, ...plan.effectiveViaFields.computedFields ?? {} }
+    computed: allComputed
   });
   if (plan.effectiveViaFields.lookupFields !== void 0 && !hasLookupBinding(coll)) {
     refuseUnattachableMatrixLookupFields(vaultCtx, plan.effectiveViaFields.lookupFields);
   }
-  const reconcilePlan = plan.computed || plan.classifiedFields ? validateReconcileGraphEdges(graph, name, {
+  const reconcilePlan = hasComputed || plan.classifiedFields ? validateReconcileGraphEdges(graph, name, {
     // `moneyFields` here is the MERGED view (`plan.effectiveViaFields.moneyFields`), not the
     // raw incoming `moneyFields` option — intentional (controller ruling, #664a review): a
     // via()-spelled money field must count in this call's `knownFields` for computed `deps`
@@ -7050,14 +7067,14 @@ function reconcileViaAttach(coll, graph, name, vaultCtx, plan) {
     // silently read the RAW option instead — never intentional, just uncovered before now.
     moneyFields: plan.effectiveViaFields.moneyFields,
     classifiedFields: plan.classifiedFields,
-    computed: plan.computed
+    computed: allComputed
   }) : void 0;
   if (plan.refs !== void 0) {
     vaultCtx.refRegistry.register(name, plan.refs);
     coll._attachDeclaredRefs(vaultCtx.refRegistry.getOutbound(name));
   }
   if (plan.effectiveViaFields.moneyFields) coll._applyMoneyFields(plan.effectiveViaFields.moneyFields);
-  if (plan.computed) coll._applyComputed(plan.computed);
+  if (hasComputed) coll._applyComputed(allComputed);
   if (plan.fieldMeta) coll._applyFieldMeta(plan.fieldMeta);
   if (plan.meta) coll._applyMeta(plan.meta);
   if (plan.classifiedFields) coll._applyClassifiedFields(plan.classifiedFields);
@@ -7297,7 +7314,7 @@ function declareSatellite(ctx, collectionName, options, existingRegistry) {
   ctx.forEachSyncEngine((e) => e.remirrorPairResolvers([spec.base, spec.satellite]));
   const registry = reg;
   const baseSchema = ctx.getBaseSchema(spec.base);
-  void import("./post-register-SLSXIPBV.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
+  void import("./post-register-QC5TEAW3.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
   });
   return reg;
 }
@@ -7487,7 +7504,7 @@ function makeSatelliteProxy(target, spec, registry) {
       return filterLiveHits(hits, adapter, vaultName, spec.base);
     },
     // #591 Task 9 review fix: findByDet/queryByDet scan envelopes straight
-    // off the adapter (kernel/enclave/record-keys/deterministic.ts) and
+    // off the adapter (capsule/plumbing/deterministic.ts) and
     // return BARE records (no id), so a post-filter can't correlate a match
     // back to its base row. Instead the scan itself is scoped: re-run the
     // same det functions over the collection's own DeterministicContext
@@ -8274,7 +8291,7 @@ var Vault = class {
         const strategies = options.schemaUpdate ?? [];
         const work = (async () => {
           const dek = await this.getDEK(collectionName);
-          const { persistSchemaIfNeeded } = await import("./register-F3OYE7MJ.js");
+          const { persistSchemaIfNeeded } = await import("./register-SN72QALV.js");
           const result = await persistSchemaIfNeeded({
             store: this.adapter,
             vault: this.name,
@@ -8424,7 +8441,7 @@ var Vault = class {
         const work = (async () => {
           try {
             const dek = await this.getDEK(collectionName);
-            await (await import("./register-F3OYE7MJ.js")).persistSchemaIfNeeded({
+            await (await import("./register-SN72QALV.js")).persistSchemaIfNeeded({
               store: this.adapter,
               vault: this.name,
               collectionName,
@@ -8470,7 +8487,7 @@ var Vault = class {
    * writes (unfenced walk — see `with-shape/satellites/migrate-cek.ts`); resumable.
    */
   async migrateSatellitePerRecordKeys(satelliteName) {
-    const { migrateSatelliteCek } = await import("./migrate-cek-V7GKJZ7O.js");
+    const { migrateSatelliteCek } = await import("./migrate-cek-GEBFYBDC.js");
     return migrateSatelliteCek(satelliteName, this.collection(satelliteName, { perRecordKeys: true }));
   }
   /**
@@ -8773,7 +8790,7 @@ var Vault = class {
         },
         emitter: this.emitter,
         buildDeleteMarker,
-        // #647 fix wave 1 — real kernel/enclave builder; LookupHandle can't import it directly
+        // #647 fix wave 1 — real capsule/enclave-aes builder; LookupHandle can't import it directly
         // #650 Task 4 (#647) — choke-point participation for LOCAL writes: dirty-log tracking + a
         // one-shot graph-dispatch wave (local-write's `graphDispatch.collect`-equivalent; Task 5's ref edges give it dependents).
         onDirty: this.onDirty,
@@ -9105,7 +9122,7 @@ var Vault = class {
    */
   // eslint-disable-next-line @typescript-eslint/consistent-type-imports
   async _loadPodSigner() {
-    const { loadSigner } = await import("./signer-MBZZMXTC.js");
+    const { loadSigner } = await import("./signer-IUIYR3CX.js");
     return loadSigner(this.adapter, this.name, this.getDEK);
   }
   async writeExportAudit(entry) {
@@ -9137,7 +9154,7 @@ var Vault = class {
    */
   async _decryptEnvelopeForBundleFilter(env, collectionName, recordId) {
     if (!this.encrypted) {
-      return JSON.parse(env._data);
+      return JSON.parse(env._data ?? "");
     }
     const dek = await this.getDEK(collectionName);
     const json = await openEnvelopeJson({ collection: collectionName, id: recordId }, env, dek);
@@ -9321,6 +9338,8 @@ var Vault = class {
     const collections = /* @__PURE__ */ new Set();
     const unmigratedRecords = [];
     const blobResidueCollections = /* @__PURE__ */ new Set();
+    const blobResidueRecords = /* @__PURE__ */ new Set();
+    const blobResidueETags = /* @__PURE__ */ new Set();
     let blobsShredded = 0;
     let blobsRetainedShared = 0;
     let indexPostingsPurged = 0;
@@ -9383,6 +9402,7 @@ var Vault = class {
           await coll.blob(ref2.id).mintShredIntent(live?._tier ?? 0);
         } catch {
           blobResidueCollections.add(ref2.collection);
+          blobResidueRecords.add(`${ref2.collection}:${ref2.id}`);
         }
       }
       let shred;
@@ -9428,11 +9448,18 @@ var Vault = class {
         const r = await this.collection(ref2.collection).blob(ref2.id).shredAllForRecord(live?._tier ?? 0);
         blobsShredded += r.shredded.length;
         blobsRetainedShared += r.retainedShared.length;
-        if (r.residue.length > 0) blobResidueCollections.add(ref2.collection);
+        if (r.residue.length > 0) {
+          blobResidueCollections.add(ref2.collection);
+          blobResidueRecords.add(`${ref2.collection}:${ref2.id}`);
+          for (const e of r.residueETags) blobResidueETags.add(e);
+        }
       } else {
         try {
           const [slotIds, verKeys] = await Promise.all([this.adapter.list(this.name, `_blob_slots_${ref2.collection}`), this.adapter.list(this.name, `_blob_versions_${ref2.collection}`)]);
-          if (slotIds.includes(ref2.id) || verKeys.some((k) => k.startsWith(`${ref2.id}::`))) blobResidueCollections.add(ref2.collection);
+          if (slotIds.includes(ref2.id) || verKeys.some((k) => k.startsWith(`${ref2.id}::`))) {
+            blobResidueCollections.add(ref2.collection);
+            blobResidueRecords.add(`${ref2.collection}:${ref2.id}`);
+          }
         } catch {
         }
       }
@@ -9481,6 +9508,8 @@ var Vault = class {
       blobsShredded,
       blobsRetainedShared,
       blobResidueCollections: [...blobResidueCollections],
+      blobResidueRecords: [...blobResidueRecords],
+      blobResidueETags: [...blobResidueETags],
       indexPostingsPurged,
       indexResidue,
       sealedFieldsShredded,
@@ -9595,7 +9624,7 @@ var Vault = class {
   async _initGuards(handles) {
     if (handles.length === 0) return;
     const [{ GuardRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-CILQFXFK.js"),
+      import("./registry-IVJ67NFQ.js"),
       import("./read-only-facade-BIGO37U3.js")
     ]);
     const registry = new GuardRegistry();
@@ -9623,7 +9652,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-YCDZV3VW.js"),
+      import("./registry-253FF7C6.js"),
       import("./read-only-facade-BIGO37U3.js")
     ]);
     const registry = new DerivationRegistry();
@@ -9655,7 +9684,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-ZGYS33TE.js");
+    const { MaterializedViewRegistry } = await import("./registry-3AZWQTDT.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -9680,7 +9709,7 @@ var Vault = class {
    */
   async _initOverlayedViews(handles) {
     if (handles.length === 0) return;
-    const { OverlayedViewRegistry } = await import("./registry-XNNYQVKV.js");
+    const { OverlayedViewRegistry } = await import("./registry-7UEBTHWG.js");
     const registry = new OverlayedViewRegistry();
     const mvRegistry = this.materializedViewRegistry;
     const overlayNames = /* @__PURE__ */ new Set();
@@ -9743,14 +9772,14 @@ var Vault = class {
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-B6SRO2QS.js");
+    const { MaterializedViewExecutor } = await import("./executor-NJX3YQQ4.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this,
       dispatchCtx: this._dispatchCtx({ collection: name, id: "refreshView" })
     });
-    const { clearMVStaleFully } = await import("./stale-TJ3DYZMQ.js");
+    const { clearMVStaleFully } = await import("./stale-SKV33PBU.js");
     await clearMVStaleFully(this.adapter, this.name, registry, name);
     return result;
   }
@@ -9763,7 +9792,7 @@ var Vault = class {
     if (registry === null) return { derived: 0, failed: 0, skippedFrozen: 0 };
     const strategies = registry.strategiesForSource(sourceCollection);
     if (strategies.length === 0) return { derived: 0, failed: 0, skippedFrozen: 0 };
-    const { DerivationExecutor } = await import("./executor-RBKM5W5K.js");
+    const { DerivationExecutor } = await import("./executor-E6YDJ7YA.js");
     const sourceColl = this.collection(sourceCollection);
     const records = await sourceColl.list();
     const ctx = { vault: this.derivationFacade ?? new (await import("./read-only-facade-BIGO37U3.js")).ReadOnlyVaultFacade(this, "derivation") };
@@ -9790,7 +9819,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-OT6RYLOL.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-BO67PCPO.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key, this.getDEK, this.encrypted);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -10017,7 +10046,7 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-S3AEPW2T.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-ONLM4JFI.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
         "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (secret) first."
@@ -10034,14 +10063,18 @@ var Vault = class {
       opts
     );
   }
+  /** Merge live delegations into the keyring — core#56's read half. Explicit, not automatic; cross-user delegation does not work yet. Both reasons: `with-party/team/delegation.ts`. */
+  async refreshDelegations(now) {
+    return this.strategies.tiers.refreshDelegations({ vault: this.name, adapter: this.adapter, keyring: this.keyring }, now);
+  }
   /**
    * revoke an issued delegation by id. Safe to call even
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-S3AEPW2T.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-ONLM4JFI.js");
     await revokeDelegation(this.adapter, this.name, id);
-    void DELEGATIONS_COLLECTION;
+    await this.onDirty?.(DELEGATIONS_COLLECTION, id, "delete", 1);
   }
   // ─── Scoped tier elevation ───────────────────────────
   /**
@@ -10296,7 +10329,7 @@ var Vault = class {
    * @see design-history/2026-05-22-schema-dump-design.md
    */
   async dumpSchema(opts = {}) {
-    const { dumpVaultSchema } = await import("./walk-HJ42EISE.js");
+    const { dumpVaultSchema } = await import("./walk-F4OLXI5H.js");
     return dumpVaultSchema(this, opts);
   }
   /**
@@ -10392,7 +10425,7 @@ var Vault = class {
    * separate vault instances now.
    */
   async getPodHandle() {
-    const { buildPodHandle } = await import("./pod-handle-WGDFB4C2.js");
+    const { buildPodHandle } = await import("./pod-handle-YE7CT66T.js");
     return buildPodHandle(this.adapter, this.name);
   }
   /**
@@ -10424,7 +10457,7 @@ var Vault = class {
    * both modes round-trip cleanly.
    */
   async dump() {
-    const { dumpVault } = await import("./backup-7TFRVFLH.js");
+    const { dumpVault } = await import("./backup-7RKNZMQO.js");
     return dumpVault(this.backupContext());
   }
   /**
@@ -10433,6 +10466,11 @@ var Vault = class {
    * collection-cache clear, ledger-store reset) that `load()` performs on this
    * Vault's private state.
    */
+  /** core#82 — sync pulled a newer copy of THIS user's keyring file: reload it in place, rebuild the DEK resolver, drop cached collections. */
+  async _reloadKeyringAfterSync() {
+    await this.backupContext().reloadKeyringAndRebuildDEK();
+    this.collectionCache.clear();
+  }
   backupContext() {
     return {
       adapter: this.adapter,
@@ -10476,7 +10514,7 @@ var Vault = class {
    * — there's no chain to verify against.
    */
   async load(backupJson) {
-    const { loadVault } = await import("./backup-7TFRVFLH.js");
+    const { loadVault } = await import("./backup-7RKNZMQO.js");
     return loadVault(this.backupContext(), backupJson);
   }
   /**
@@ -10508,7 +10546,7 @@ var Vault = class {
    * way to detect tampering of an in-place vault.
    */
   async verifyBackupIntegrity() {
-    const { verifyBackupIntegrity } = await import("./backup-7TFRVFLH.js");
+    const { verifyBackupIntegrity } = await import("./backup-7RKNZMQO.js");
     return verifyBackupIntegrity(this.backupContext());
   }
   /**
@@ -10589,8 +10627,7 @@ var Vault = class {
     const granularity = opts.granularity ?? "collection";
     const exportLocale = opts.resolveLabels;
     const localeOpts = exportLocale !== void 0 ? { locale: exportLocale, _layer: "export" } : void 0;
-    const snapshot = await this.adapter.loadAll(this.name);
-    const collectionNames = Object.keys(snapshot).sort();
+    const source = await resolveExportSource(this.adapter, this.name, opts);
     const ledgerHead = opts.withLedgerHead ? await (async () => {
       const ledger = this.getLedgerOrNull();
       if (!ledger) return void 0;
@@ -10599,7 +10636,7 @@ var Vault = class {
     })() : void 0;
     const dictSnapshotCache = /* @__PURE__ */ new Map();
     if (exportLocale === void 0) {
-      for (const collectionName of collectionNames) {
+      for (const collectionName of source.collections) {
         const dictFields = this.dictKeyFieldRegistry.get(collectionName);
         if (dictFields && Object.keys(dictFields).length > 0) {
           const snap = {};
@@ -10615,12 +10652,13 @@ var Vault = class {
         }
       }
     }
-    for (const collectionName of collectionNames) {
+    for (const collectionName of source.collections) {
       if (!hasAccess(this.keyring, collectionName)) continue;
       const coll = this.collection(collectionName);
       const schema = coll.getSchema() ?? null;
       const refs = this.refRegistry.getOutbound(collectionName);
-      const ids = Object.keys(snapshot[collectionName] ?? {});
+      const ids = await source.ids(collectionName);
+      if (source.scoped && ids.length === 0) continue;
       const dictionaries = dictSnapshotCache.get(collectionName);
       if (granularity === "collection") {
         const records = [];
@@ -10738,7 +10776,7 @@ var Vault = class {
    * is the live validator object, not a serialization of it).
    */
   async exportJSON(opts = {}) {
-    const { exportVaultJSON } = await import("./backup-7TFRVFLH.js");
+    const { exportVaultJSON } = await import("./backup-7RKNZMQO.js");
     return exportVaultJSON(this.backupContext(), opts);
   }
 };
@@ -10826,6 +10864,36 @@ var WriteQueueTracker = class {
       throw error;
     }
   }
+  /**
+   * Run a write whose PRE-COMMIT phase may legitimately REFUSE — the schema
+   * gates, and a user `beforeWrite` hook that throws to abort. `fn` calls
+   * `committed()` at the point the store write itself begins.
+   *
+   * Before that point a rejection releases the depth it took but records NO
+   * queue error; after it, a rejection settles as a failure like `track`.
+   *
+   * #11 — why the phase is inside `depth` at all: `pending` is the documented
+   * shutdown guard (see the `writeQueue` getter's `beforeunload` example) and
+   * the schema fence does a fresh store read per write, so leaving the gates
+   * outside made `pending` read `false` during a real round-trip on every
+   * write. The refusal carve-out is what the old outside-the-queue placement
+   * was protecting ("a rejected write never counts toward depth") — it is kept
+   * deliberately, so a refused write cannot reject a concurrent `onFlush()`.
+   */
+  async trackGated(fn) {
+    this.begin();
+    let refusable = true;
+    try {
+      const value = await fn(() => {
+        refusable = false;
+      });
+      this.settle();
+      return value;
+    } catch (error) {
+      this.settle(refusable ? void 0 : error);
+      throw error;
+    }
+  }
   #emitChange() {
     for (const handler of this.#changeHandlers) handler();
   }
@@ -12311,6 +12379,7 @@ var TeamFacade = class {
     await this.deps.checkGate(vault, "peer-recover-user", factors);
     const callerKeyring = await this.deps.getKeyringInternal(vault);
     await recoverUser(this.deps.options.store, vault, callerKeyring, options);
+    await this.deps.enrolBrokerMember(vault, { userId: options.userId, secret: options.secret });
     if (options.userId === this.deps.options.user) {
       this.deps.keyringCache.delete(vault);
     }
@@ -12655,6 +12724,7 @@ var Noydb = class {
       checkGate: (vault, gate, factors) => this.checkGate(vault, gate, factors),
       checkPolicyOperation: (vault, op) => this.checkPolicyOperation(vault, op),
       getKeyringInternal: (vault, opts) => this._getKeyringInternal(vault, opts),
+      enrolBrokerMember: (vault, member) => this.#enrolBrokerMember(vault, member),
       assertRecoveryEnrolled: (vault, policy, opts) => this.assertRecoveryEnrolled(vault, policy, opts),
       openVault: (vault, opts) => this.openVault(vault, opts),
       setSkipNextManagedRecoveryCheck: (value) => {
@@ -12765,7 +12835,7 @@ var Noydb = class {
       if (!facade) return;
       const ctx = { existing, vault: facade, userId: e.userId, role: e.role };
       await registry.runChecks(e.collection, incoming, ctx);
-      const { GuardExecutor } = await import("./executor-BI5CHWRY.js");
+      const { GuardExecutor } = await import("./executor-WWM3DD4P.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, e.docId, existing, incoming, e.computedFieldNames);
       }
@@ -12983,6 +13053,7 @@ var Noydb = class {
       engine.setReservedLookupSource({ collections: () => comp._reservedLookupCollectionNames() });
       engine.setReservedDictExpander((names) => comp._reservedDictDepsOf(names));
       engine.setPeriodPullSource({ periods: () => comp.listPeriods() });
+      engine.setRosterReload({ userId: this.options.user, reload: () => comp._reloadKeyringAfterSync() });
     });
     await comp._initGuards(this.options.guardStrategies ?? []);
     await comp._initDerivations(this.options.derivationStrategies ?? []);
@@ -13024,7 +13095,12 @@ var Noydb = class {
    * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
    */
   async grant(vault, options, factors) {
-    return this.strategies.team.grant(this.team, vault, options, factors);
+    await this.strategies.team.grant(this.team, vault, options, factors);
+    await this.#enrolBrokerMember(vault, { userId: options.userId, secret: options.secret });
+  }
+  /** core#73 — register a (re-)granted or recovered sub-admin member with the broker host; a no-op without a broker. */
+  async #enrolBrokerMember(vault, member) {
+    await this.strategies.broker.enrolMember({ store: this.options.store, vault, keyring: await this._getKeyringInternal(vault) }, member);
   }
   /**
    * Revoke a user's access to a vault.
@@ -13037,7 +13113,11 @@ var Noydb = class {
    * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
    */
   async revoke(vault, options, factors) {
-    return this.strategies.team.revoke(this.team, vault, options, factors);
+    await this.strategies.team.revoke(this.team, vault, options, factors);
+    for (const [key, engine] of this.syncEngines) {
+      if (key === vault || key.startsWith(`${vault}::`)) await engine.trackChange("_keyring", options.userId, "delete", 1);
+    }
+    await this.strategies.broker.revokeMember({ store: this.options.store, vault, keyring: await this._getKeyringInternal(vault) }, options.userId);
   }
   /**
    * Grant the FR-6 `custodian` role to a user (owner-only custody API).
@@ -13439,6 +13519,10 @@ var Noydb = class {
     if (engine.role !== "sync-peer") return emptyPullResult();
     return engine.pull(options);
   }
+  /** core#82 — replace every local envelope that fails to authenticate with the primary target's healthy copy; see `SyncEngine.realign`. */
+  async realign(vault) {
+    return this.getSyncEngine(vault).realign();
+  }
   /**
    * Bidirectional sync: pull then push for all targets.
    * `sync-peer` targets do pull+push; `backup`/`archive` targets do push-only.
@@ -13583,9 +13667,9 @@ var Noydb = class {
     const targets = [];
     for (const [key, engine] of this.syncEngines) {
       if (key !== vault && !key.startsWith(`${vault}::`)) continue;
-      const { dirty, lastPush, lastPull } = engine.status();
+      const { dirty, lastPush, lastPull, inFlight } = engine.status();
       const { label, role } = engine;
-      targets.push({ label, role, dirty, lastPush, lastPull, caughtUp: dirty === 0 });
+      targets.push({ label, role, dirty, lastPush, lastPull, caughtUp: dirty === 0, ...inFlight ? { inFlight } : {} });
     }
     return targets;
   }
@@ -14103,6 +14187,7 @@ var Noydb = class {
       this.keyringCache.set(vault, keyring2);
       return keyring2;
     }
+    await this.strategies.sync.bootstrapKeyrings(this.options.store, normalizeSyncTargets(this.options.sync).find((t) => t.role === "sync-peer")?.store, vault);
     await assertKeyringOpenAllowed(this.options.store, vault, this.options.user, opts.create);
     const effectiveSecret = await resolveEffectiveSecret(this.options, this.options.store, vault);
     if (!effectiveSecret) {
@@ -14153,7 +14238,7 @@ async function createNoydb(options) {
   if (!options.store) options = { ...options, store: memoryStore() };
   validateSecretModeOptions(options);
   if (!options.mesh) options = { ...options, mesh: await createDefaultMesh(options.store) };
-  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-GVYEKSJE.js")).createUserApi };
+  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-MSJXVYQG.js")).createUserApi };
   if (!options.policyFactory) {
     const policyModule = await import("./policy/index.js");
     options = { ...options, policyFactory: policyModule.createNoydbPolicy, policyCheckGateFn: policyModule.checkGate };
@@ -14186,4 +14271,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-T2LBQ5DV.js.map
+//# sourceMappingURL=chunk-FSQNGPHH.js.map