@noy-db/hub 0.8.0 → 0.9.0-pre.1

package/dist/{chunk-MXOQ5JCG.js → chunk-MRCR7ZMC.js}

@@ -7,25 +7,28 @@ import {
   isLinkCollectionName,
   linkCollectionName,
   linkRowKey
-} from "./chunk-Q4UHJ5SN.js";
+} from "./chunk-O2VQ3K36.js";
 import {
   hashFields,
   validateSatelliteDeclaration
-} from "./chunk-XQRFSKYM.js";
+} from "./chunk-MCNNZBG7.js";
 import {
   resolveStaleOnRead
-} from "./chunk-JOSPH3E5.js";
+} from "./chunk-SBAR5JQ6.js";
 import {
   loadFence
-} from "./chunk-VAORSCSU.js";
+} from "./chunk-TLIFNRU5.js";
+import {
+  DELEGATIONS_COLLECTION
+} from "./chunk-UNL6YGL5.js";
 import {
   buildPersistedIndexCallbacks,
   syncTierSearch
-} from "./chunk-Y3LPTBG7.js";
+} from "./chunk-E2C6FFSI.js";
 import {
   isBaseLive,
   liveBaseIdSet
-} from "./chunk-2MG3SW7Q.js";
+} from "./chunk-X6Z2SIRF.js";
 import {
   SchemaUpdateGate
 } from "./chunk-6LJY7X5A.js";
@@ -33,26 +36,29 @@ import {
   NO_TIERS,
   classifySealedShred,
   syncDerivedOutputs
-} from "./chunk-DHHGL42E.js";
+} from "./chunk-IKS2CPAG.js";
 import {
   NO_PORTABILITY
-} from "./chunk-AUKKUPVB.js";
+} from "./chunk-IVLRPRXM.js";
 import {
   NO_CARGO
-} from "./chunk-52MGURXO.js";
+} from "./chunk-WBUHHMLN.js";
 import {
   saveSealedSecret
-} from "./chunk-3XJQBBZD.js";
+} from "./chunk-NTVKHQ3L.js";
 import {
   runDrainBarrier
-} from "./chunk-DIZLQVAA.js";
+} from "./chunk-4CHM2TRS.js";
+import {
+  NO_FORMATS
+} from "./chunk-RWFQVNXR.js";
 import {
   fallbackDerivationName
 } from "./chunk-RXLYKVTF.js";
 import {
   CustodyApi,
   NO_CUSTODY
-} from "./chunk-V3RWOOSO.js";
+} from "./chunk-GYZICGRU.js";
 import {
   DEFAULT_POSTURE,
   ViaGraph,
@@ -66,21 +72,21 @@ import {
   resolveComputedEdges,
   resolveDescribeFieldIds,
   resolveVirtualMoneyFields
-} from "./chunk-IUT3GWP3.js";
+} from "./chunk-IUD7WU67.js";
 import {
   findMatchingIdsByPairs
 } from "./chunk-TFMM5DBB.js";
 import {
   encodeVecId
-} from "./chunk-M5B2W6YY.js";
+} from "./chunk-TDJVQTXD.js";
 import {
   NO_CLASSIFIED,
   guardClassifiedCompat,
   resolveClassifiedFields
-} from "./chunk-GUZET4SG.js";
+} from "./chunk-JAQHWHUN.js";
 import {
   derivePersistedSchema
-} from "./chunk-747G6CT3.js";
+} from "./chunk-UORWAG7K.js";
 import {
   findRollupSpecForIntent,
   forgetDerivedFanout,
@@ -90,7 +96,7 @@ import {
   runGraphDispatchWave,
   selfWriteFieldEqual,
   touchFor
-} from "./chunk-MILI22XQ.js";
+} from "./chunk-ZZZ4VCY2.js";
 import {
   buildLookupAltIndex,
   buildLookupSnapshotRows,
@@ -105,20 +111,22 @@ import {
   resolveDictSource,
   resolveLabelFromMap,
   updateReferencingRecords
-} from "./chunk-244QBK7Z.js";
+} from "./chunk-C4XV3PSJ.js";
 import {
   OverlayedCollection
-} from "./chunk-HS554XAF.js";
+} from "./chunk-5HQFROZS.js";
 import {
   INDEXED_STORE_POLICY,
-  NO_SYNC
-} from "./chunk-T7IR4N2S.js";
+  NO_SYNC,
+  openRejection,
+  sealRejection
+} from "./chunk-7UHLO4ZN.js";
 import {
   NO_ATTESTATION
-} from "./chunk-PD64727P.js";
+} from "./chunk-FMINS2B6.js";
 import {
   NO_COVERAGE
-} from "./chunk-RHVMZSUU.js";
+} from "./chunk-NV4OESHC.js";
 import {
   NO_PERIODS,
   isEffectivelyReopened,
@@ -128,7 +136,7 @@ import {
   resolvePeriodKey,
   resolveReopenState,
   samePartition
-} from "./chunk-3A5DUZ56.js";
+} from "./chunk-IMIQAGR7.js";
 import {
   PERIODS_COLLECTION,
   PERIOD_ARCHIVES_COLLECTION,
@@ -136,7 +144,7 @@ import {
   PERIOD_REOPENS_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION,
   periodExclusiveUpperBound
-} from "./chunk-QBLT6POL.js";
+} from "./chunk-FPF5HRBE.js";
 import {
   NO_SHADOW
 } from "./chunk-SMY5X46Z.js";
@@ -147,7 +155,7 @@ import {
   TxContext,
   bestEffortRevert,
   trackKeyedWrite
-} from "./chunk-UA372JHH.js";
+} from "./chunk-FZVCZEVI.js";
 import {
   lazy
 } from "./chunk-5D2ALSM5.js";
@@ -156,26 +164,26 @@ import {
   InvertedIndex,
   MemoryIndexStore,
   NO_SEARCH
-} from "./chunk-RB4DOPGZ.js";
+} from "./chunk-AKIEBFIJ.js";
 import {
   NO_SEQUENCE,
   SEQUENCE_COLLECTION,
   compileSequenceFormat,
   resolveSequenceKey
-} from "./chunk-VFHCKG5M.js";
+} from "./chunk-BVRJYMFZ.js";
 import {
   EXPORT_AUDIT_COLLECTION,
   NO_BLOBS,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-JSMTXZR3.js";
+} from "./chunk-ZWMOHANW.js";
 import {
   LazyQuery,
   NO_INDEXING,
   compositeKey,
   decodeIdxId,
   encodeIdxId
-} from "./chunk-V7ADQF5O.js";
+} from "./chunk-4CUJLEOA.js";
 import {
   IMPLICIT_LAZY
 } from "./chunk-66TQOPFM.js";
@@ -193,41 +201,41 @@ import {
 } from "./chunk-GSAK56VF.js";
 import {
   NO_SEALED_RECORD
-} from "./chunk-UEFOQH74.js";
+} from "./chunk-ADCXTW7L.js";
 import {
   normalizeIndexDefs,
   parseFieldIndexSnapshot
-} from "./chunk-2AFX33YA.js";
+} from "./chunk-Z3STG43F.js";
 import {
   EXPORT_REDACTION_MARKER,
   ViaPipeline,
   exportRedact
-} from "./chunk-3EWS67C7.js";
+} from "./chunk-4TG2ITRW.js";
 import {
   ScanBuilder
-} from "./chunk-JQYKPKG6.js";
+} from "./chunk-7K42TSCY.js";
 import {
   Query
-} from "./chunk-AL6ML4LA.js";
+} from "./chunk-DWCFGF2K.js";
 import {
   NO_REDUCE
 } from "./chunk-3TDUWVWB.js";
 import {
   readPath
-} from "./chunk-5WWDGFOS.js";
+} from "./chunk-GIQJGXV7.js";
 import {
   dictCollectionName
-} from "./chunk-23D6M6VM.js";
+} from "./chunk-KZA3DITX.js";
 import {
   NO_I18N,
   getAtPath,
   isDictCollectionName,
   isStaticDictDescriptor
-} from "./chunk-OKSTSITU.js";
+} from "./chunk-PR7ILCIH.js";
 import {
   isViaInstalled,
   viaBinder
-} from "./chunk-SYNY3VB5.js";
+} from "./chunk-NCTN2FW4.js";
 import {
   NO_TEAM,
   describeAllUsersAuth,
@@ -250,7 +258,7 @@ import {
   saveShamirRecoveryEntries,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-DQESF6RP.js";
+} from "./chunk-3G3GOGZZ.js";
 import {
   assertKeyringOpenAllowed,
   buildRecipientKeyringFile,
@@ -265,15 +273,15 @@ import {
   listUsers,
   loadKeyring,
   updateKeyringIdentity
-} from "./chunk-XSPFDUDG.js";
+} from "./chunk-V7AKGAXY.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
-} from "./chunk-LIOVX5TJ.js";
+} from "./chunk-QT5ITL25.js";
 import {
   NO_BROKER,
   buildCredentialBrokerHandle
-} from "./chunk-GZT3NQRA.js";
+} from "./chunk-25FXU6WS.js";
 import {
   NO_SESSION
 } from "./chunk-VKQCVU2Z.js";
@@ -282,19 +290,19 @@ import {
 } from "./chunk-4AOERLTV.js";
 import {
   NO_HISTORY
-} from "./chunk-LNSVGRHO.js";
+} from "./chunk-L4UL4IAR.js";
 import {
   sha256Hex
-} from "./chunk-6QVKPHBF.js";
+} from "./chunk-QHG7GQKM.js";
 import {
   assertCutoverTierSafe,
   assertTierWritable,
   dekKey,
   liveRecordIsElevated
-} from "./chunk-FLPCETP6.js";
+} from "./chunk-2LBS62AC.js";
 import {
   NO_VAULT_HEAD
-} from "./chunk-HW7CMKUG.js";
+} from "./chunk-OFD2HD6F.js";
 import {
   NO_FORGET,
   addSubjectRef,
@@ -303,7 +311,7 @@ import {
   readDottedPath,
   rebuildSubjectIndex,
   removeSubjectRef
-} from "./chunk-JDEYF3PJ.js";
+} from "./chunk-P6FATPXQ.js";
 import {
   RecordCodec,
   SEALED_CEK_NS,
@@ -324,13 +332,13 @@ import {
   resolveStableCek,
   rewrapBodyToDek,
   verifyRecordIdentity
-} from "./chunk-EZGV6F47.js";
+} from "./chunk-WRLWEYHY.js";
 import {
   validateSchemaInput
-} from "./chunk-42ALPZ2B.js";
+} from "./chunk-ZF6JECDT.js";
 import {
   SealedHandle
-} from "./chunk-SV2PM2OY.js";
+} from "./chunk-XX4R7TUB.js";
 import {
   AlreadyElevatedError,
   AttestationError,
@@ -370,19 +378,19 @@ import {
   UniqueConstraintError,
   ValidationError,
   isConflictError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-IKPQ2GGB.js";
 
 // src/kernel/merge-authority.ts
 function buildMergeAuthority(keyring) {
   return {
     verify: async (collection, id, envelope) => {
-      const dek = keyring.deks.get(dekKey(collection, envelope._tier ?? 0));
+      const dek = keyring().deks.get(dekKey(collection, envelope._tier ?? 0));
       if (dek === void 0) return true;
       return verifyRecordIdentity({ collection, id }, envelope, dek);
     },
     advance: async (collection, id, envelope, toVersion) => {
       if (!hasSealedBody(envelope)) return { ...envelope, _v: toVersion };
-      const dek = keyring.deks.get(dekKey(collection, envelope._tier ?? 0));
+      const dek = keyring().deks.get(dekKey(collection, envelope._tier ?? 0));
       if (dek === void 0) {
         throw new ValidationError(
           `sync: cannot advance "${collection}/${id}" past the remote \u2014 no key for it, so its body cannot be re-sealed at the new version. The local copy is unchanged.`
@@ -401,24 +409,23 @@ function buildMergeAuthority(keyring) {
   };
 }
 
-// src/port/with/formats-strategy.ts
-var FormatsNotEnabledError = class extends Error {
-  constructor(op) {
-    super(
-      `vault.${op}() requires the formats service. Import { withFormats } from "@noy-db/hub/as" and pass formatsStrategy: withFormats() to createNoydb().`
-    );
-    this.name = "FormatsNotEnabledError";
-  }
-};
-var NO_FORMATS = {
-  enabled: false,
-  exportWith() {
-    throw new FormatsNotEnabledError("export");
-  },
-  importWith() {
-    throw new FormatsNotEnabledError("import");
-  }
-};
+// src/kernel/sync-wiring.ts
+function wireEngine(host, name, comp, engine) {
+  engine.setCacheInvalidator((collection, id, action) => comp._invalidateSyncApplied(collection, id, action));
+  engine.setGraphBatchController({ begin: () => comp._beginGraphBatch(), flush: () => comp._flushGraphBatch() });
+  engine.setReservedLookupSource({ collections: () => comp._reservedLookupCollectionNames() });
+  engine.setReservedDictExpander((names) => comp._reservedDictDepsOf(names));
+  engine.setPeriodPullSource({ periods: () => comp.listPeriods() });
+  engine.setRosterReload({ userId: host.user, reload: () => comp._reloadKeyringAfterSync() });
+  engine.setAdmission({ admit: (collection, id, envelope, origin) => comp._admitRemote(collection, id, envelope, origin) });
+  engine.setRejectionCourier({
+    // core#107
+    seal: (collection, id, rejection, version) => comp._sealRejection(collection, id, rejection, version),
+    open: (collection, id, envelope) => comp._openRejection(collection, id, envelope)
+  });
+  engine.setCollectionNames(() => [...host.keyringCache.get(name)?.deks.keys() ?? []].filter((n) => !n.startsWith("_")));
+  for (const [resolverName, resolver] of host.conflictResolvers.get(name) ?? []) engine.registerConflictResolver(resolverName, resolver);
+}
 
 // src/with-commit/tx/strategy.ts
 var NOT_ENABLED = new Error(
@@ -551,7 +558,7 @@ function validateSecretModeOptions(options) {
 }
 async function resolveEffectiveSecret(options, store, vault) {
   if (options.secretMode === "managed") {
-    const { resolveManagedSecret } = await import("./managed-secret-MFTFT22X.js");
+    const { resolveManagedSecret } = await import("./managed-secret-SQWO2EUR.js");
     return resolveManagedSecret(store, vault, options.sealingKey);
   }
   return options.secret;
@@ -569,7 +576,7 @@ function ownerKeyringOptions(options, secret) {
 
 // src/port/by/default-provider.ts
 async function createDefaultMesh(store) {
-  const { StoreMesh } = await import("./store-coordination-provider-C4BPT5XF.js");
+  const { StoreMesh } = await import("./store-coordination-provider-2KSHCOPU.js");
   return new StoreMesh(store);
 }
 
@@ -624,6 +631,28 @@ function populateCollectionRegistries(r, collectionName, options, effectiveViaFi
   }
 }
 
+// src/kernel/export-scope.ts
+async function resolveExportSource(adapter, vault, opts) {
+  const scope = opts.collections ? [...new Set(opts.collections)].filter((n) => !n.startsWith("_")).sort() : null;
+  if (scope) {
+    return {
+      collections: scope,
+      scoped: true,
+      // One `list` per requested collection. Calling `loadAll` here would pull
+      // every collection's envelopes out of the store before declining to
+      // decrypt most of them — the fetch would already have happened, which is
+      // precisely the half that makes "scoping" a word rather than a property.
+      ids: async (collection) => await adapter.list(vault, collection)
+    };
+  }
+  const snapshot = await adapter.loadAll(vault);
+  return {
+    collections: Object.keys(snapshot).sort(),
+    scoped: false,
+    ids: async (collection) => Object.keys(snapshot[collection] ?? {})
+  };
+}
+
 // src/kernel/generation-map.ts
 var tick = 0;
 var GenerationMap = class extends Map {
@@ -1723,7 +1752,7 @@ async function commitSequentially(ctx, entries, priors) {
 }
 
 // src/with-formula/computed/lazy.ts
-var loadComputed = lazy(() => import("./computed-FAD7SED4.js"));
+var loadComputed = lazy(() => import("./computed-WN6V53ZV.js"));
 async function loadEvalComputedFields() {
   return (await loadComputed()).evalComputedFields;
 }
@@ -2532,7 +2561,7 @@ var Collection = class {
     }
     await this.onAccess?.("find", "*");
     if (hits.length === 0) return [];
-    const { verifyDigestField } = await import("./verify-UKALW7C2.js");
+    const { verifyDigestField } = await import("./verify-PCFS4PNS.js");
     const policy = {
       normalize: spec.verifyNormalize ?? "password",
       notLastN: spec.notLastN ?? 0,
@@ -2744,7 +2773,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-6GCFMOOR.js");
+      const { resolveStaleMVOnRead } = await import("./stale-PIJPAL5T.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     let record;
@@ -2943,6 +2972,85 @@ var Collection = class {
   #hooksActive() {
     return this.writeHooks !== void 0 && this.writeHooks.hasHandlers && !this.writeHooks.suppressed;
   }
+  /**
+   * core#74 — ADMISSION of a record arriving by sync. Runs the same
+   * `beforePut` gate bus (guards, periods) and `db.onBeforeWrite` hooks a
+   * local `put` runs, on the DECRYPTED incoming record against this device's
+   * current state, with `origin: 'sync-apply'`. A throw is a refusal; the
+   * engine parks the envelope and leaves the local copy untouched.
+   *
+   * Not gated, deliberately: tombstones and delete markers (erasure wins, as
+   * on every other path), elevated envelopes (#707 — invisible to gate
+   * handlers), and a record this session holds no key for (it cannot judge;
+   * the merge authority's stated residue, #1042). Schema validation does not
+   * run — the writer validated. Zero cost when nothing is registered.
+   * @internal
+   */
+  /**
+   * @internal core#74 — judge a record against THIS device's gates and hooks.
+   *
+   * ⚠️ core#108: under `'push-recheck'` the record is already in the local
+   * store, so `resolveGatePrior` returns the record itself and `existing`
+   * equals `incoming` — the state it was written over is gone and cannot be
+   * reconstructed. That makes the re-check sound for rules that read AMBIENT
+   * state (a closed period, a revoked clearance) and degenerate for rules
+   * that compare against a prior, which see a no-op diff and pass. Widening
+   * it would need the pre-write snapshot kept in the dirty log, which is a
+   * different feature; do not "fix" it by synthesising a prior here.
+   */
+  async _admitRemote(id, envelope, origin = "sync-apply") {
+    const gates = this.subsystemBus?.hasGateHandlers("beforePut") ?? false;
+    const hooks = this.#hooksActive();
+    if (!gates && !hooks) return { admitted: true };
+    if ((envelope._tier ?? 0) > 0) return { admitted: true };
+    let incoming;
+    try {
+      incoming = await this.codec.decryptRecord({ collection: this.name, id }, envelope, { skipValidation: true });
+    } catch {
+      return { admitted: true };
+    }
+    try {
+      const selfIsPrior = origin === "push-recheck" && envelope._v === 1;
+      if (gates) {
+        const { env: existingEnv, record: existingRecord } = await this.resolveGatePrior("beforePut", id);
+        const gateEvent = {
+          op: existingEnv && !selfIsPrior ? "update" : "create",
+          vault: this.vault,
+          collection: this.name,
+          docId: id,
+          incoming,
+          existing: selfIsPrior ? null : this.via ? this.via.canonicalizeStored(existingRecord) : existingRecord,
+          existingVersion: selfIsPrior ? 0 : existingEnv?._v ?? 0,
+          existingTs: selfIsPrior ? void 0 : existingEnv?._ts,
+          origin,
+          userId: envelope._by ?? this.keyring.userId,
+          role: this.keyring.role,
+          ...this.computed !== void 0 ? { computedFieldNames: new Set(Object.keys(this.computed)) } : {}
+        };
+        await this.subsystemBus.dispatchGate("beforePut", gateEvent);
+      }
+      if (hooks) {
+        const prior = await this.#priorForHook(id);
+        await this.writeHooks.runBefore({
+          op: prior.record === null || selfIsPrior ? "create" : "update",
+          vault: this.vault,
+          collection: this.name,
+          docId: id,
+          before: selfIsPrior ? null : prior.record,
+          after: incoming,
+          userId: envelope._by ?? this.keyring.userId,
+          timestamp: Date.now(),
+          txId: generateULID(),
+          baseVersion: prior.version,
+          version: envelope._v,
+          origin
+        });
+      }
+    } catch (err) {
+      return { admitted: false, reason: err instanceof Error ? err.message : String(err) };
+    }
+    return { admitted: true };
+  }
   /**
    * @internal — resolve the prior record for a hook's `before` and
    * its version. Critically, this uses the SAME basis `_putInternal` writes from
@@ -3284,9 +3392,9 @@ var Collection = class {
    * @internal `wave` (#638 Task 4): when present (the sync/cutover/restore dispatch wave),
    * an eager MV already refreshed this wave is skipped (per-target dedup, keyed on spec name).
    */
-  async dispatchMaterializedViews(id, record, wave) {
+  async _dispatchMaterializedViews(id, record, wave) {
     if (this.materializedViewSource === void 0) return;
-    const { dispatchMaterializedViews } = await import("./dispatch-H4HV32AM.js");
+    const { dispatchMaterializedViews } = await import("./dispatch-SHKTG57L.js");
     return dispatchMaterializedViews(this.#mvDispatchCtx(this.materializedViewSource), id, record, wave);
   }
   /**
@@ -3429,7 +3537,7 @@ var Collection = class {
    * and from `forgetDerivedFanout` (#638 Task 6), which needs the per-target outcome to fill
    * `ForgetResult.derivedAggregatesRecomputed`/`derivedResidueFrozen`). `wave` (#640): per-target dedup for the sync-apply path; `undefined` on local-delete (byte-identical).
    */
-  async dispatchRollupsOnDelete(id, deleted, wave) {
+  async _dispatchRollupsOnDelete(id, deleted, wave) {
     const results = [];
     for (const intent of this._rollupDeleteIntents(deleted)) {
       const spec = findRollupSpecForIntent(this.derivationSource?.registry(), this.name, intent);
@@ -3450,20 +3558,21 @@ var Collection = class {
   }
   /** @internal `wave` (#638 Task 4) — threaded to `recomputeRollup` for the sync/cutover/restore
    *  dispatch wave's per-target dedup; `undefined` on the local-write path (byte-identical). */
-  async dispatchDerivations(id, record, version, wave, prior) {
+  async _dispatchDerivations(id, record, version, wave, prior) {
     if (this.derivationSource === void 0) return;
-    const { dispatchDerivations } = await import("./dispatch-JDZNGEB3.js");
+    const { dispatchDerivations } = await import("./dispatch-LOQQD5JK.js");
     return dispatchDerivations(this.#derivationDispatchCtx(), id, record, version, wave, prior);
   }
   /** @internal — trigger fan-out for a deleted parent (#1249); see dispatch.ts. */
-  async dispatchTriggerDerivationsOnDelete(id, deleted) {
+  async _dispatchTriggerDerivationsOnDelete(id, deleted) {
     if (this.derivationSource === void 0) return;
-    const { dispatchTriggerDerivationsOnDelete } = await import("./dispatch-JDZNGEB3.js");
+    const { dispatchTriggerDerivationsOnDelete } = await import("./dispatch-LOQQD5JK.js");
     return dispatchTriggerDerivationsOnDelete(this.#derivationDispatchCtx(), id, deleted);
   }
   /**
    * Delete a record by ID. Runs inside the hub's write-queue tracker
    * so `hub.writeQueue.pending` reflects this write.
+   * ⚠️ Blobs are released (#1451) but a legacy collection defers the erase — a `null` blob read is NOT proof the bytes are gone; see {@link BlobSet.releaseAll} (noy-db/core#28).
    */
   async delete(id) {
     return trackKeyedWrite(this.adapter, this.vault, this.name, id, () => this.#deleteGated(id));
@@ -3705,11 +3814,11 @@ var Collection = class {
     }
     await this._onRecordMutated(id, "delete", "local-delete", { version: marker?._v ?? (existing?.version ?? 0) + 1 });
     if (!internal) {
-      await this.dispatchMaterializedViewsOnDelete(id);
-      await this.dispatchArrayDerivationsOnDelete(id);
+      await this._dispatchMaterializedViewsOnDelete(id);
+      await this._dispatchArrayDerivationsOnDelete(id);
       if (existing) {
-        await this.dispatchRollupsOnDelete(id, existing.record);
-        await this.dispatchTriggerDerivationsOnDelete(id, existing.record);
+        await this._dispatchRollupsOnDelete(id, existing.record);
+        await this._dispatchTriggerDerivationsOnDelete(id, existing.record);
       }
     }
     return true;
@@ -3778,9 +3887,9 @@ var Collection = class {
    * erasure too — forget()'s fanout, GDPR residue. A delete-of-absent contributes 0 either way.
    * @internal
    */
-  async dispatchArrayDerivationsOnDelete(id, eraseRecordShapeToo = false) {
+  async _dispatchArrayDerivationsOnDelete(id, eraseRecordShapeToo = false) {
     if (this.derivationSource === void 0) return 0;
-    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-JDZNGEB3.js");
+    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-LOQQD5JK.js");
     return dispatchArrayDerivationsOnDelete(this.#derivationDeleteCtx(this.derivationSource), id, eraseRecordShapeToo);
   }
   /**
@@ -3792,9 +3901,9 @@ var Collection = class {
    * manual serves empty until `refreshView()`. `residueUndecodable`/`residueDeclined` (#776/#785) carry `outputCollection:id` entries whose ownership stamp `invalidateMVAtRest` could not decode, resp. decoded+stamp-matched but declined erasure — surfaced, not erased.
    * @internal
    */
-  async dispatchMaterializedViewsOnDelete(id) {
+  async _dispatchMaterializedViewsOnDelete(id) {
     if (this.materializedViewSource === void 0) return { deleted: 0, residueUndecodable: [], residueDeclined: [] };
-    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-H4HV32AM.js");
+    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-SHKTG57L.js");
     return dispatchMaterializedViewsOnDelete(this.#mvDispatchCtx(this.materializedViewSource), id);
   }
   /**
@@ -3814,7 +3923,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-6GCFMOOR.js");
+      const { resolveStaleMVOnRead } = await import("./stale-PIJPAL5T.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     await this.ensureHydrated();
@@ -3822,6 +3931,53 @@ var Collection = class {
     if (!this.via) return records;
     return Promise.all(records.map((r) => this.applyLocaleToRecord(r, locale)));
   }
+  /**
+   * @internal core#122 — forget everything read from the store, so the next
+   * read re-hydrates.
+   *
+   * ⭐ Why this is needed even though the vault drops its collection cache on
+   * restore: `vault.collection(name)` hands back the instance FROM that cache,
+   * so a handle the caller is already holding IS one of the objects in it.
+   * Dropping the map makes the NEXT `vault.collection()` build a fresh
+   * instance and leaves the caller's handle answering from its own pre-restore
+   * cache — correct for the next caller, invisible to the current one, and the
+   * natural shape of restore code holds the handle across the load.
+   *
+   * ⛔ Not a general "refresh": it deliberately does NOT re-read here. The
+   * next read pays for it, so a restore that touches fifty collections does
+   * not hydrate fifty times for a caller who will look at one.
+   */
+  _invalidateAfterRestore() {
+    this.cache.clear();
+    this.markerIds.clear();
+    this.hydrated = false;
+  }
+  /**
+   * core#103 — `list()` with the hub-assigned id alongside each record.
+   *
+   * ⭐ The id is not derivable from a record, so a caller keyed on it
+   * previously had to `get()` per row after `list()`. Tuple order mirrors
+   * `putMany`: `[id, record]` reads the same going in and coming out.
+   *
+   * Same eager-mode requirement and the same locale/Via pipeline as `list()`
+   * — deliberately, so the two cannot drift into answering differently about
+   * the same collection. `list()` is unchanged.
+   */
+  async listEntries(locale) {
+    if (this.lazy) {
+      throw new Error(
+        `Collection "${this.name}": listEntries() is not available in lazy mode (prefetch: false). Use collection.listPageEntries({ limit }) to page through the collection.`
+      );
+    }
+    if (this.materializedViewSource !== void 0) {
+      const { resolveStaleMVOnRead } = await import("./stale-PIJPAL5T.js");
+      await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
+    }
+    await this.ensureHydrated();
+    const entries = [...this.cache.entries()].map(([id, e]) => [id, e.record]);
+    if (!this.via) return entries;
+    return Promise.all(entries.map(async ([id, r]) => [id, await this.applyLocaleToRecord(r, locale)]));
+  }
   /**
    * Scan-mode full-text search over a plain-text `field`. Decrypts the
    * collection in memory and ranks records by BM25 against the tokenized query.
@@ -4273,6 +4429,21 @@ var Collection = class {
    * developers can spot adapters that should opt into the fast path.
    */
   async listPage(opts = {}) {
+    const page = await this.listPageEntries(opts);
+    return { items: page.items.map(([, record]) => record), nextCursor: page.nextCursor };
+  }
+  /**
+   * core#103 — `listPage()` with the hub-assigned id alongside each record.
+   *
+   * ⭐ The id is not derivable from the record. An app that stores its own key
+   * in a field is fine; one that relies on the id hub assigned had no bulk
+   * read that returned it and had to `get()` per row to find out — which is
+   * the shape pilot-1 hit writing a rule keyed on the record id.
+   *
+   * Tuple order mirrors `putMany`, so `[id, record]` reads the same way going
+   * in and coming out. `listPage()` is unchanged and delegates here.
+   */
+  async listPageEntries(opts = {}) {
     const limit = opts.limit ?? 100;
     if (this.adapter.listPage) {
       const result = await this.adapter.listPage(this.vault, this.name, opts.cursor, limit);
@@ -4281,7 +4452,7 @@ var Collection = class {
         if (!this.lazy && !this.cache.has(id)) {
           this.cache.set(id, { record, version });
         }
-        decrypted.push(record);
+        decrypted.push([id, record]);
       }
       return { items: decrypted, nextCursor: result.nextCursor };
     }
@@ -4296,7 +4467,7 @@ var Collection = class {
       if (envelope && (envelope._tier ?? 0) === 0) {
         const record = await this.codec.decryptRecord({ collection: this.name, id }, envelope, { sealedAsHandles: true });
         if (record === null) continue;
-        items.push(record);
+        items.push([id, record]);
         if (!this.lazy && !this.cache.has(id)) {
           this.cache.set(id, { record, version: envelope._v });
         }
@@ -4499,8 +4670,8 @@ var Collection = class {
         this.searchIndexStore?.markDirty();
         this.fieldIndexStore?.markDirty();
         await this.onAccess?.("put", id);
-        await this.dispatchDerivations(id, record, version, void 0, ctx.prior);
-        await this.dispatchMaterializedViews(id, record);
+        await this._dispatchDerivations(id, record, version, void 0, ctx.prior);
+        await this._dispatchMaterializedViews(id, record);
         return;
       }
       case "local-delete": {
@@ -4979,14 +5150,14 @@ var Collection = class {
   /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
   async _ensureClassifiedMarker() {
     if (this._markerPersisted || this.vdigFields === null) return;
-    const { persistClassifiedMarkerForFields } = await import("./classified-marker-SIYKUU5L.js");
+    const { persistClassifiedMarkerForFields } = await import("./classified-marker-WKP33U2R.js");
     await persistClassifiedMarkerForFields(this.adapter, this.vault, this.name, this.vdigFields, await this.getDEK(this.name));
     this._markerPersisted = true;
   }
   /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
   async _classifiedMarkerDigestOnly() {
     if (this._markerDigestOnlyCache !== void 0) return this._markerDigestOnlyCache;
-    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-SIYKUU5L.js");
+    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-WKP33U2R.js");
     this._markerDigestOnlyCache = await readClassifiedMarkerDigestOnly(this.adapter, this.vault, this.name, await this.getDEK(this.name));
     return this._markerDigestOnlyCache;
   }
@@ -6654,7 +6825,7 @@ var VaultLinks = class {
 // src/with-shape/links/lazy-handle.ts
 function makeLazyLinkSetHandle(d) {
   let engine = null;
-  const load = () => engine ??= import("./link-set-MFXC24VK.js").then(
+  const load = () => engine ??= import("./link-set-4FRRAVTH.js").then(
     ({ LinkSet }) => new LinkSet(d.adapter, d.vault, d.name, d.spec, d.encrypted, d.getDEK, d.actor, d.emitter, d.endpointExists)
   );
   return {
@@ -7037,6 +7208,8 @@ function reconcileCollectionReadState(coll, vaultCtx, plan, hadI18n, hadLookup)
   });
 }
 function reconcileViaAttach(coll, graph, name, vaultCtx, plan) {
+  const allComputed = { ...plan.computed ?? {}, ...plan.effectiveViaFields.computedFields ?? {} };
+  const hasComputed = Object.keys(allComputed).length > 0;
   guardReconcileCollisions(coll._via, {
     moneyFields: plan.effectiveViaFields.moneyFields,
     i18nFields: plan.effectiveViaFields.i18nFields,
@@ -7044,12 +7217,12 @@ function reconcileViaAttach(coll, graph, name, vaultCtx, plan) {
     lookupFields: plan.effectiveViaFields.lookupFields,
     classifiedFields: plan.classifiedFields !== void 0 ? resolveClassifiedFields(name, plan.classifiedFields).byField : void 0,
     blobFields: plan.blobFields,
-    computed: { ...plan.computed ?? {}, ...plan.effectiveViaFields.computedFields ?? {} }
+    computed: allComputed
   });
   if (plan.effectiveViaFields.lookupFields !== void 0 && !hasLookupBinding(coll)) {
     refuseUnattachableMatrixLookupFields(vaultCtx, plan.effectiveViaFields.lookupFields);
   }
-  const reconcilePlan = plan.computed || plan.classifiedFields ? validateReconcileGraphEdges(graph, name, {
+  const reconcilePlan = hasComputed || plan.classifiedFields ? validateReconcileGraphEdges(graph, name, {
     // `moneyFields` here is the MERGED view (`plan.effectiveViaFields.moneyFields`), not the
     // raw incoming `moneyFields` option — intentional (controller ruling, #664a review): a
     // via()-spelled money field must count in this call's `knownFields` for computed `deps`
@@ -7058,14 +7231,14 @@ function reconcileViaAttach(coll, graph, name, vaultCtx, plan) {
     // silently read the RAW option instead — never intentional, just uncovered before now.
     moneyFields: plan.effectiveViaFields.moneyFields,
     classifiedFields: plan.classifiedFields,
-    computed: plan.computed
+    computed: allComputed
   }) : void 0;
   if (plan.refs !== void 0) {
     vaultCtx.refRegistry.register(name, plan.refs);
     coll._attachDeclaredRefs(vaultCtx.refRegistry.getOutbound(name));
   }
   if (plan.effectiveViaFields.moneyFields) coll._applyMoneyFields(plan.effectiveViaFields.moneyFields);
-  if (plan.computed) coll._applyComputed(plan.computed);
+  if (hasComputed) coll._applyComputed(allComputed);
   if (plan.fieldMeta) coll._applyFieldMeta(plan.fieldMeta);
   if (plan.meta) coll._applyMeta(plan.meta);
   if (plan.classifiedFields) coll._applyClassifiedFields(plan.classifiedFields);
@@ -7305,7 +7478,7 @@ function declareSatellite(ctx, collectionName, options, existingRegistry) {
   ctx.forEachSyncEngine((e) => e.remirrorPairResolvers([spec.base, spec.satellite]));
   const registry = reg;
   const baseSchema = ctx.getBaseSchema(spec.base);
-  void import("./post-register-7ND27CF2.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
+  void import("./post-register-GRVQHBOH.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
   });
   return reg;
 }
@@ -7946,6 +8119,7 @@ var Vault = class {
    *  `load()` after the on-disk keyring file has been replaced. Provided by Noydb at openVault()
    *  time; `undefined` in tests that construct Vault directly (load() then skips the refresh). */
   reloadKeyring;
+  onRestore;
   collectionCache = /* @__PURE__ */ new Map();
   satelliteRegistry = null;
   // spec #591, archetype-③
@@ -8051,7 +8225,7 @@ var Vault = class {
   /** — currently-active elevation, or null. One per vault. */
   activeElevation = null;
   /**
-   * Optional translator callback threaded from `Noydb.invokeTranslator`.
+   * Optional translator callback threaded from `Noydb._invokeTranslator`.
    * Present only when `plaintextTranslator` was configured on `createNoydb()`.
    */
   translateText;
@@ -8108,6 +8282,7 @@ var Vault = class {
     void opts.guardStrategies;
     this.historyConfig = opts.historyConfig ?? { enabled: true };
     this.reloadKeyring = opts.reloadKeyring;
+    this.onRestore = opts.onRestore;
     this.locale = opts.locale;
     this.vaultMeta = opts.meta;
     this.translateText = opts.plaintextTranslator;
@@ -8135,7 +8310,7 @@ var Vault = class {
     this.custody = new CustodyApi(
       (options, factors) => this.noydb.grantCustodian(this.name, options, factors),
       (options, factors) => this.noydb.revokeCustodian(this.name, options, factors),
-      (opts2) => this.noydb.custodyStrategy.liberate(this, opts2)
+      (opts2) => this.noydb._custodyStrategy.liberate(this, opts2)
     );
   }
   /**
@@ -8282,7 +8457,7 @@ var Vault = class {
         const strategies = options.schemaUpdate ?? [];
         const work = (async () => {
           const dek = await this.getDEK(collectionName);
-          const { persistSchemaIfNeeded } = await import("./register-DT5HZ2LZ.js");
+          const { persistSchemaIfNeeded } = await import("./register-YJ5YLQ36.js");
           const result = await persistSchemaIfNeeded({
             store: this.adapter,
             vault: this.name,
@@ -8432,7 +8607,7 @@ var Vault = class {
         const work = (async () => {
           try {
             const dek = await this.getDEK(collectionName);
-            await (await import("./register-DT5HZ2LZ.js")).persistSchemaIfNeeded({
+            await (await import("./register-YJ5YLQ36.js")).persistSchemaIfNeeded({
               store: this.adapter,
               vault: this.name,
               collectionName,
@@ -8478,7 +8653,7 @@ var Vault = class {
    * writes (unfenced walk — see `with-shape/satellites/migrate-cek.ts`); resumable.
    */
   async migrateSatellitePerRecordKeys(satelliteName) {
-    const { migrateSatelliteCek } = await import("./migrate-cek-DZRFFOHW.js");
+    const { migrateSatelliteCek } = await import("./migrate-cek-JWEM4RP6.js");
     return migrateSatelliteCek(satelliteName, this.collection(satelliteName, { perRecordKeys: true }));
   }
   /**
@@ -8530,6 +8705,21 @@ var Vault = class {
    *  its already-warmed `LookupHandle._syncCache` (membership/altIndex/snapshot reads never see a
    *  stale verdict for a pulled vocabulary edit) and collect the touch into any open graph batch
    *  (the sync-apply wave-reachability seam Task 5's ref edges will use). No-op if never warmed. */
+  /** core#74 — admission of a sync-applied record: the collection's own gates and hooks judge it. Reserved names are never gated. @internal */
+  async _admitRemote(collection, id, envelope, origin = "sync-apply") {
+    if (collection.startsWith("_")) return { admitted: true };
+    return this.collection(collection)._admitRemote(id, envelope, origin);
+  }
+  /** @internal core#107 — seal a refusal under the refused record's own collection DEK. `null`: no DEK here. */
+  async _sealRejection(collection, id, rejection, version) {
+    const dek = this.keyring.deks.get(collection);
+    return dek ? sealRejection(collection, id, rejection, dek, version) : null;
+  }
+  /** @internal core#107 — open a replicated refusal. `null` when this device holds no DEK for it. */
+  async _openRejection(collection, id, envelope) {
+    const dek = this.keyring.deks.get(collection);
+    return dek ? openRejection(collection, id, envelope, dek) : null;
+  }
   async _invalidateSyncApplied(collection, id, action) {
     const coll = this.collectionCache.get(collection);
     if (coll) {
@@ -9113,7 +9303,7 @@ var Vault = class {
    */
   // eslint-disable-next-line @typescript-eslint/consistent-type-imports
   async _loadPodSigner() {
-    const { loadSigner } = await import("./signer-MHGW3OIL.js");
+    const { loadSigner } = await import("./signer-NYR4I3FO.js");
     return loadSigner(this.adapter, this.name, this.getDEK);
   }
   async writeExportAudit(entry) {
@@ -9329,6 +9519,8 @@ var Vault = class {
     const collections = /* @__PURE__ */ new Set();
     const unmigratedRecords = [];
     const blobResidueCollections = /* @__PURE__ */ new Set();
+    const blobResidueRecords = /* @__PURE__ */ new Set();
+    const blobResidueETags = /* @__PURE__ */ new Set();
     let blobsShredded = 0;
     let blobsRetainedShared = 0;
     let indexPostingsPurged = 0;
@@ -9391,6 +9583,7 @@ var Vault = class {
           await coll.blob(ref2.id).mintShredIntent(live?._tier ?? 0);
         } catch {
           blobResidueCollections.add(ref2.collection);
+          blobResidueRecords.add(`${ref2.collection}:${ref2.id}`);
         }
       }
       let shred;
@@ -9436,11 +9629,18 @@ var Vault = class {
         const r = await this.collection(ref2.collection).blob(ref2.id).shredAllForRecord(live?._tier ?? 0);
         blobsShredded += r.shredded.length;
         blobsRetainedShared += r.retainedShared.length;
-        if (r.residue.length > 0) blobResidueCollections.add(ref2.collection);
+        if (r.residue.length > 0) {
+          blobResidueCollections.add(ref2.collection);
+          blobResidueRecords.add(`${ref2.collection}:${ref2.id}`);
+          for (const e of r.residueETags) blobResidueETags.add(e);
+        }
       } else {
         try {
           const [slotIds, verKeys] = await Promise.all([this.adapter.list(this.name, `_blob_slots_${ref2.collection}`), this.adapter.list(this.name, `_blob_versions_${ref2.collection}`)]);
-          if (slotIds.includes(ref2.id) || verKeys.some((k) => k.startsWith(`${ref2.id}::`))) blobResidueCollections.add(ref2.collection);
+          if (slotIds.includes(ref2.id) || verKeys.some((k) => k.startsWith(`${ref2.id}::`))) {
+            blobResidueCollections.add(ref2.collection);
+            blobResidueRecords.add(`${ref2.collection}:${ref2.id}`);
+          }
         } catch {
         }
       }
@@ -9489,6 +9689,8 @@ var Vault = class {
       blobsShredded,
       blobsRetainedShared,
       blobResidueCollections: [...blobResidueCollections],
+      blobResidueRecords: [...blobResidueRecords],
+      blobResidueETags: [...blobResidueETags],
       indexPostingsPurged,
       indexResidue,
       sealedFieldsShredded,
@@ -9603,7 +9805,7 @@ var Vault = class {
   async _initGuards(handles) {
     if (handles.length === 0) return;
     const [{ GuardRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-BHRZGZHF.js"),
+      import("./registry-XP744FAP.js"),
       import("./read-only-facade-BIGO37U3.js")
     ]);
     const registry = new GuardRegistry();
@@ -9631,7 +9833,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-ET6ZFFWA.js"),
+      import("./registry-MJ7MWCSW.js"),
       import("./read-only-facade-BIGO37U3.js")
     ]);
     const registry = new DerivationRegistry();
@@ -9663,7 +9865,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-THCPDEOD.js");
+    const { MaterializedViewRegistry } = await import("./registry-MVEKKGWL.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -9688,7 +9890,7 @@ var Vault = class {
    */
   async _initOverlayedViews(handles) {
     if (handles.length === 0) return;
-    const { OverlayedViewRegistry } = await import("./registry-HXFGLGTG.js");
+    const { OverlayedViewRegistry } = await import("./registry-ICOHBQFD.js");
     const registry = new OverlayedViewRegistry();
     const mvRegistry = this.materializedViewRegistry;
     const overlayNames = /* @__PURE__ */ new Set();
@@ -9751,14 +9953,14 @@ var Vault = class {
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-FMPVN6DT.js");
+    const { MaterializedViewExecutor } = await import("./executor-6PQ7WAGV.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this,
       dispatchCtx: this._dispatchCtx({ collection: name, id: "refreshView" })
     });
-    const { clearMVStaleFully } = await import("./stale-6GCFMOOR.js");
+    const { clearMVStaleFully } = await import("./stale-PIJPAL5T.js");
     await clearMVStaleFully(this.adapter, this.name, registry, name);
     return result;
   }
@@ -9771,7 +9973,7 @@ var Vault = class {
     if (registry === null) return { derived: 0, failed: 0, skippedFrozen: 0 };
     const strategies = registry.strategiesForSource(sourceCollection);
     if (strategies.length === 0) return { derived: 0, failed: 0, skippedFrozen: 0 };
-    const { DerivationExecutor } = await import("./executor-OSRZST2U.js");
+    const { DerivationExecutor } = await import("./executor-6ZPQA6HS.js");
     const sourceColl = this.collection(sourceCollection);
     const records = await sourceColl.list();
     const ctx = { vault: this.derivationFacade ?? new (await import("./read-only-facade-BIGO37U3.js")).ReadOnlyVaultFacade(this, "derivation") };
@@ -9798,7 +10000,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-L7NHPIOC.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-NEB6IYV7.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key, this.getDEK, this.encrypted);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -10025,31 +10227,27 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-NANZDG4N.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION: DELEGATIONS_COLLECTION2 } = await import("./delegation-5UWT4JGT.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
         "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (secret) first."
       );
     }
-    const targetKek = this.keyring.kek;
-    const delegationsDek = await this.getDEK(DELEGATIONS_COLLECTION);
-    return issueDelegation(
-      this.adapter,
-      this.name,
-      this.keyring,
-      targetKek,
-      delegationsDek,
-      opts
-    );
+    const delegationsDek = await this.getDEK(DELEGATIONS_COLLECTION2);
+    return issueDelegation(this.adapter, this.name, this.keyring, delegationsDek, opts);
+  }
+  /** Merge live delegations addressed to this user into the keyring — core#56's read half, cross-user since core#65. Explicit, never automatic: `with-party/team/delegation.ts` says why. */
+  async refreshDelegations(now) {
+    return this.strategies.tiers.refreshDelegations({ vault: this.name, adapter: this.adapter, keyring: this.keyring }, now);
   }
   /**
    * revoke an issued delegation by id. Safe to call even
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-NANZDG4N.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION: DELEGATIONS_COLLECTION2 } = await import("./delegation-5UWT4JGT.js");
     await revokeDelegation(this.adapter, this.name, id);
-    void DELEGATIONS_COLLECTION;
+    await this.onDirty?.(DELEGATIONS_COLLECTION2, id, "delete", 1);
   }
   // ─── Scoped tier elevation ───────────────────────────
   /**
@@ -10304,7 +10502,7 @@ var Vault = class {
    * @see design-history/2026-05-22-schema-dump-design.md
    */
   async dumpSchema(opts = {}) {
-    const { dumpVaultSchema } = await import("./walk-4VPK7AS4.js");
+    const { dumpVaultSchema } = await import("./walk-OZCN6LJS.js");
     return dumpVaultSchema(this, opts);
   }
   /**
@@ -10400,7 +10598,7 @@ var Vault = class {
    * separate vault instances now.
    */
   async getPodHandle() {
-    const { buildPodHandle } = await import("./pod-handle-A3LET7NO.js");
+    const { buildPodHandle } = await import("./pod-handle-R6Y4MILX.js");
     return buildPodHandle(this.adapter, this.name);
   }
   /**
@@ -10432,7 +10630,7 @@ var Vault = class {
    * both modes round-trip cleanly.
    */
   async dump() {
-    const { dumpVault } = await import("./backup-YE2VQ26S.js");
+    const { dumpVault } = await import("./backup-RJBFQSHE.js");
     return dumpVault(this.backupContext());
   }
   /**
@@ -10441,6 +10639,16 @@ var Vault = class {
    * collection-cache clear, ledger-store reset) that `load()` performs on this
    * Vault's private state.
    */
+  /** core#90 — the first `attachSyncTarget()` on a vault opened without one: from here every write is dirty-tracked. Cached collection handles are rebuilt (as after `load()`); re-acquire handles obtained before the attach. */
+  _enableSync(onDirty) {
+    this.onDirty = onDirty;
+    this.collectionCache.clear();
+  }
+  /** core#82 — sync pulled a newer copy of THIS user's keyring file: reload it in place, rebuild the DEK resolver, drop cached collections. */
+  async _reloadKeyringAfterSync() {
+    await this.backupContext().reloadKeyringAndRebuildDEK();
+    this.collectionCache.clear();
+  }
   backupContext() {
     return {
       adapter: this.adapter,
@@ -10454,10 +10662,18 @@ var Vault = class {
           this.getDEK = this.makeGetDEK();
         }
       },
-      clearCollectionCache: () => this.collectionCache.clear(),
+      // core#122 — invalidate the instances BEFORE dropping the map. A handle
+      // the caller already holds is one of these objects, so clearing the map
+      // alone fixes the next `vault.collection()` and leaves the caller reading
+      // pre-restore data from the handle they were told to use.
+      clearCollectionCache: () => {
+        for (const c of this.collectionCache.values()) c._invalidateAfterRestore();
+        this.collectionCache.clear();
+      },
       resetLedgerStore: () => {
         this.ledgerStore = null;
       },
+      ...this.onRestore !== void 0 ? { resetSync: this.onRestore } : {},
       exportStream: (opts) => this.exportStream(opts)
     };
   }
@@ -10483,9 +10699,38 @@ var Vault = class {
    * with a console warning and skip the integrity check entirely
    * — there's no chain to verify against.
    */
-  async load(backupJson) {
-    const { loadVault } = await import("./backup-YE2VQ26S.js");
-    return loadVault(this.backupContext(), backupJson);
+  /**
+   * core#76 — restore this vault to its state at `timestamp`, as FORWARD
+   * WRITES. Every record whose state at T differs from its state now is put
+   * back at T's value; every record that exists now and did not exist at T is
+   * deleted.
+   *
+   * ⭐ The writes go through `Collection.put`/`.delete`, so guards, periods,
+   * history and the ledger all see them. The restore is therefore an audited,
+   * reversible event that replicates through ordinary sync — no pod, and none
+   * of the state-replacement machinery core#71/#72 exists to make safe.
+   *
+   * `{ dryRun: true }` returns the same report having written nothing.
+   *
+   * ⚠️ Bounded by history retention, and ⛔ blobs are not restored — see the
+   * module header on `with-commit/history/restore-to.ts`, which states both
+   * limits and why the blob one is not reported rather than reported empty.
+   */
+  async restoreTo(timestamp, options) {
+    const iso = timestamp instanceof Date ? timestamp.toISOString() : timestamp;
+    const { restoreTo } = await import("./restore-to-DVBHAQAA.js");
+    const instant = this.at(iso);
+    return restoreTo({
+      adapter: this.adapter,
+      vault: this.name,
+      instantCollection: (name) => instant.collection(name),
+      liveCollection: (name) => this.collection(name),
+      liveCollectionNames: async () => Object.keys(await this.adapter.loadAll(this.name))
+    }, iso, options);
+  }
+  async load(backupJson, options) {
+    const { loadVault } = await import("./backup-RJBFQSHE.js");
+    return loadVault(this.backupContext(), backupJson, options);
   }
   /**
    * End-to-end backup integrity check. Runs both:
@@ -10516,7 +10761,7 @@ var Vault = class {
    * way to detect tampering of an in-place vault.
    */
   async verifyBackupIntegrity() {
-    const { verifyBackupIntegrity } = await import("./backup-YE2VQ26S.js");
+    const { verifyBackupIntegrity } = await import("./backup-RJBFQSHE.js");
     return verifyBackupIntegrity(this.backupContext());
   }
   /**
@@ -10597,8 +10842,7 @@ var Vault = class {
     const granularity = opts.granularity ?? "collection";
     const exportLocale = opts.resolveLabels;
     const localeOpts = exportLocale !== void 0 ? { locale: exportLocale, _layer: "export" } : void 0;
-    const snapshot = await this.adapter.loadAll(this.name);
-    const collectionNames = Object.keys(snapshot).sort();
+    const source = await resolveExportSource(this.adapter, this.name, opts);
     const ledgerHead = opts.withLedgerHead ? await (async () => {
       const ledger = this.getLedgerOrNull();
       if (!ledger) return void 0;
@@ -10607,7 +10851,7 @@ var Vault = class {
     })() : void 0;
     const dictSnapshotCache = /* @__PURE__ */ new Map();
     if (exportLocale === void 0) {
-      for (const collectionName of collectionNames) {
+      for (const collectionName of source.collections) {
         const dictFields = this.dictKeyFieldRegistry.get(collectionName);
         if (dictFields && Object.keys(dictFields).length > 0) {
           const snap = {};
@@ -10623,12 +10867,13 @@ var Vault = class {
         }
       }
     }
-    for (const collectionName of collectionNames) {
+    for (const collectionName of source.collections) {
       if (!hasAccess(this.keyring, collectionName)) continue;
       const coll = this.collection(collectionName);
       const schema = coll.getSchema() ?? null;
       const refs = this.refRegistry.getOutbound(collectionName);
-      const ids = Object.keys(snapshot[collectionName] ?? {});
+      const ids = await source.ids(collectionName);
+      if (source.scoped && ids.length === 0) continue;
       const dictionaries = dictSnapshotCache.get(collectionName);
       if (granularity === "collection") {
         const records = [];
@@ -10746,7 +10991,7 @@ var Vault = class {
    * is the live validator object, not a serialization of it).
    */
   async exportJSON(opts = {}) {
-    const { exportVaultJSON } = await import("./backup-YE2VQ26S.js");
+    const { exportVaultJSON } = await import("./backup-RJBFQSHE.js");
     return exportVaultJSON(this.backupContext(), opts);
   }
 };
@@ -11760,6 +12005,9 @@ var TeamFacade = class {
     if (this.deps.options.periodsStrategy !== void 0) {
       await (await ensureCollectionDEK(this.deps.options.store, vault, keyring))(PERIODS_COLLECTION);
     }
+    if (this.deps.options.tiersStrategy !== void 0) {
+      await (await ensureCollectionDEK(this.deps.options.store, vault, keyring))(DELEGATIONS_COLLECTION);
+    }
     await engine(this.deps.options.store, vault, keyring, options);
   }
   /** Gate + run a `revoke` engine. See `Noydb.revoke` for the public contract. */
@@ -11767,7 +12015,7 @@ var TeamFacade = class {
     this.deps.checkPolicyOperation(vault, "revoke");
     await this.deps.checkGate(vault, "revoke-user", factors);
     const keyring = await this.deps.getKeyringInternal(vault);
-    await engine(this.deps.options.store, vault, keyring, options);
+    return engine(this.deps.options.store, vault, keyring, options);
   }
   /** Gate + run a `rotateKeys` engine. See `Noydb.rotate` for the public contract. */
   async runRotate(engine, vault, collections) {
@@ -11898,6 +12146,7 @@ var TeamFacade = class {
    *     meta: {
    *       credentialId: e.credentialId,
    *       wrapIv: e.wrapIv,
+   *       rpId: e.rpId,
    *       prfUsed: e.prfUsed,
    *       beFlag: e.beFlag,
    *       requireSingleDevice: e.requireSingleDevice,
@@ -11906,6 +12155,15 @@ var TeamFacade = class {
    * })
    * ```
    *
+   * `meta` is a free-form blob — hub validates `credentialId` and nothing
+   * else, so this example IS the contract for what a slot carries. Record
+   * `rpId` (core#140): the slot rewrap / rotation ceremony falls back to
+   * `meta.rpId` when the caller passes no `options.rpId` and the enrollment
+   * record predates `WebAuthnEnrollment.rpId`. Omitting it does not break
+   * single-hostname deployments — absence correctly reads as "send no RP ID"
+   * — but on a shared registrable domain rotation then works only if every
+   * caller remembers to pass the RP ID by hand.
+   *
    * Returns the WebAuthn `credentialId` (extracted from `meta.credentialId`)
    * for the caller's lookup index (a bootstrap vault, a Cover,
    * a server-side allowlist).
@@ -12347,8 +12605,10 @@ var TeamFacade = class {
    */
   async recoverUser(vault, options, factors) {
     await this.deps.checkGate(vault, "peer-recover-user", factors);
+    await this.deps.refreshRoster(vault, options.userId);
     const callerKeyring = await this.deps.getKeyringInternal(vault);
     await recoverUser(this.deps.options.store, vault, callerKeyring, options);
+    await this.deps.enrolBrokerMember(vault, { userId: options.userId, secret: options.secret });
     if (options.userId === this.deps.options.user) {
       this.deps.keyringCache.delete(vault);
     }
@@ -12557,6 +12817,8 @@ var Noydb = class {
   vaultOpening = /* @__PURE__ */ new Map();
   keyringCache = /* @__PURE__ */ new Map();
   syncEngines = /* @__PURE__ */ new Map();
+  /** core#90 — conflict resolvers registered per vault, replayed onto a target attached after open. */
+  conflictResolvers = /* @__PURE__ */ new Map();
   /**
    * Per-vault active session tier — defaults to `1` after a secret
    * unlock; tier-2 / tier-3 unlocks downgrade it. Used by
@@ -12596,10 +12858,10 @@ var Noydb = class {
   /**
    * Opt-in sovereign-custody (FR-6) strategy — `NO_CUSTODY` (throwing) unless
    * `withCustody()` was passed. Kept as a public accessor because `Vault`
-   * routes `vault.custody.liberate` through `this.noydb.custodyStrategy`.
+   * routes `vault.custody.liberate` through `this.noydb._custodyStrategy`.
    * @internal
    */
-  get custodyStrategy() {
+  get _custodyStrategy() {
     return this.strategies.custody;
   }
   snapshots;
@@ -12693,6 +12955,8 @@ var Noydb = class {
       checkGate: (vault, gate, factors) => this.checkGate(vault, gate, factors),
       checkPolicyOperation: (vault, op) => this.checkPolicyOperation(vault, op),
       getKeyringInternal: (vault, opts) => this._getKeyringInternal(vault, opts),
+      enrolBrokerMember: (vault, member) => this.#enrolBrokerMember(vault, member),
+      refreshRoster: (vault, userId) => this.#refreshRoster(vault, userId),
       assertRecoveryEnrolled: (vault, policy, opts) => this.assertRecoveryEnrolled(vault, policy, opts),
       openVault: (vault, opts) => this.openVault(vault, opts),
       setSkipNextManagedRecoveryCheck: (value) => {
@@ -12801,9 +13065,9 @@ var Noydb = class {
       }
       const facade = v._getReadOnlyFacade();
       if (!facade) return;
-      const ctx = { existing, vault: facade, userId: e.userId, role: e.role };
+      const ctx = { existing, vault: facade, userId: e.userId, role: e.role, ...e.origin !== void 0 ? { origin: e.origin } : {} };
       await registry.runChecks(e.collection, incoming, ctx);
-      const { GuardExecutor } = await import("./executor-LBBBRTN5.js");
+      const { GuardExecutor } = await import("./executor-OXRA64TY.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, e.docId, existing, incoming, e.computedFieldNames);
       }
@@ -12827,7 +13091,7 @@ var Noydb = class {
       if (e.internal) return;
       const facade = v._getReadOnlyFacade();
       if (!facade) return;
-      const ctx = { existing, vault: facade, userId: e.userId, role: e.role };
+      const ctx = { existing, vault: facade, userId: e.userId, role: e.role, ...e.origin !== void 0 ? { origin: e.origin } : {} };
       await registry.runOnDelete(e.collection, existing ?? {}, ctx);
     });
   }
@@ -12931,11 +13195,13 @@ var Noydb = class {
     if (this.options.encrypt !== false && !this.policyCache.has(name)) {
       await this.bootstrapPolicy(name);
     }
-    const mergeAuthority = buildMergeAuthority(keyring);
+    const mergeAuthority = buildMergeAuthority(() => this.keyringCache.get(name) ?? keyring);
     let syncEngine;
     const targets = normalizeSyncTargets(this.options.sync);
+    const primaryTarget = targets.find((t) => t.role === "sync-peer") ?? targets[0];
+    const primaryStore = primaryTarget?.store;
     if (targets.length > 0) {
-      const primary = targets.find((t) => t.role === "sync-peer") ?? targets[0];
+      const primary = primaryTarget;
       const declaredPolicy = this.options.syncPolicy ?? primary.policy;
       const effectivePolicy = declaredPolicy ?? INDEXED_STORE_POLICY;
       syncEngine = this.strategies.sync.buildSyncEngine({
@@ -12976,16 +13242,26 @@ var Noydb = class {
       keyring,
       encrypted: this.options.encrypt !== false,
       emitter: this.emitter,
-      onDirty: targets.length > 0 ? async (coll, id, action, version) => {
-        for (const [key, engine] of this.syncEngines) {
-          if (key === name || key.startsWith(`${name}::`)) {
-            if (action === "revert") void engine.removeDirty(coll, id);
-            else void engine.trackChange(coll, id, action, version);
-          }
+      // `onDirty` PRESENCE is Collection's sync-mode flag (delete markers instead of
+      // physical deletes, #1439's memo gate), so it stays gated on a target existing;
+      // the first `attachSyncTarget()` on a target-less vault switches it on (core#90).
+      onDirty: targets.length > 0 ? this.#dirtyFanout(name) : void 0,
+      // Recorded per vault so a target attached later (core#90) is registered too.
+      onRegisterConflictResolver: (resolverName, resolver) => {
+        let m = this.conflictResolvers.get(name);
+        if (!m) {
+          m = /* @__PURE__ */ new Map();
+          this.conflictResolvers.set(name, m);
         }
-      } : void 0,
-      onRegisterConflictResolver: syncEngine ? (resolverName, resolver) => syncEngine.registerConflictResolver(resolverName, resolver) : void 0,
-      syncAdapter: targets.length > 0 ? targets[0].store : void 0,
+        m.set(resolverName, resolver);
+        this._forEachSyncEngine(name, (e) => e.registerConflictResolver(resolverName, resolver));
+      },
+      // core#139 — the SAME selector the record-sync engine uses, not `targets[0]`.
+      // Presence is published to this store and polled back from it, so on
+      // `[{backup}, {sync-peer}]` the positional read sent presence to a
+      // push-only archive target — quietly, since a presence write that nobody
+      // reads back degrades instead of throwing.
+      syncAdapter: primaryStore,
       getPurgeableTargets: () => targets.filter((t) => t.role === "backup" || t.role === "archive").map((t) => ({ store: t.store, role: t.role, ...t.label !== void 0 ? { label: t.label } : {} })),
       historyConfig: this.options.history,
       // #838 — the 21 conditional strategy spreads that used to live here are
@@ -12999,28 +13275,45 @@ var Noydb = class {
       locale: opts?.locale,
       ...opts?.meta !== void 0 ? { meta: opts.meta } : {},
       // Thread the translator hook so Collection.put() can invoke it
-      plaintextTranslator: this.options.plaintextTranslator ? (text, from, to, field, collection) => this.invokeTranslator(text, from, to, field, collection) : void 0,
+      plaintextTranslator: this.options.plaintextTranslator ? (text, from, to, field, collection) => this._invokeTranslator(text, from, to, field, collection) : void 0,
       // Refresh callback used by Vault.load() to re-derive
       // the in-memory keyring from a freshly-loaded keyring file.
       // Encrypted compartments need this so post-load decrypts work
       // against the loaded session's wrapped DEKs; plaintext
       // compartments leave it null and load() skips the refresh.
-      reloadKeyring: this.options.encrypt !== false && this.options.secret ? async () => {
-        this.keyringCache.delete(name);
-        const refreshed = await loadKeyring(this.options.store, name, {
-          userId: this.options.user,
-          secret: this.options.secret
+      // core#71 — a restore resets every engine attached to this vault.
+      onRestore: async () => {
+        const engines = [];
+        this._forEachSyncEngine(name, (e) => {
+          engines.push(e);
         });
+        for (const e of engines) await e.resetAfterRestore();
+      },
+      reloadKeyring: this.options.encrypt !== false ? async () => {
+        const held = this.keyringCache.get(name)?.kek ?? null;
+        const secret = this.options.secret;
+        if (!held && !secret) {
+          throw new ValidationError(
+            `reloadKeyring: vault "${name}" holds no KEK (tier-2 or session open) \u2014 reopen the vault to adopt the roster change.`
+          );
+        }
+        this.keyringCache.delete(name);
+        let refreshed;
+        try {
+          refreshed = await loadKeyring(this.options.store, name, {
+            userId: this.options.user,
+            ...held ? { kek: held } : { secret }
+          });
+        } catch (err) {
+          if (!(err instanceof InvalidKeyError) || !held || !secret) throw err;
+          refreshed = await loadKeyring(this.options.store, name, { userId: this.options.user, secret });
+        }
         this.keyringCache.set(name, refreshed);
         return refreshed;
       } : void 0
     });
     this._forEachSyncEngine(name, (engine) => {
-      engine.setCacheInvalidator((collection, id, action) => comp._invalidateSyncApplied(collection, id, action));
-      engine.setGraphBatchController({ begin: () => comp._beginGraphBatch(), flush: () => comp._flushGraphBatch() });
-      engine.setReservedLookupSource({ collections: () => comp._reservedLookupCollectionNames() });
-      engine.setReservedDictExpander((names) => comp._reservedDictDepsOf(names));
-      engine.setPeriodPullSource({ periods: () => comp.listPeriods() });
+      wireEngine(this.#wiring, name, comp, engine);
     });
     await comp._initGuards(this.options.guardStrategies ?? []);
     await comp._initDerivations(this.options.derivationStrategies ?? []);
@@ -13053,6 +13346,13 @@ var Noydb = class {
   /**
    * Grant access to a user for a vault.
    *
+   * ⚠️ On an EXISTING user this RE-KEYS them: a new KEK from `secret`,
+   * authenticator slots dropped, the file overwritten. So it needs the
+   * member's CURRENT secret — after `acceptInvite` or `rotateSecret` an
+   * owner never holds it, and a re-grant with a stale one locks the member
+   * out. To change what an existing member may do, use `updateUser`
+   * (core#96); re-grant only to re-key, with a fresh temporary secret.
+   *
    * Gated by `enroll-user`. `STRICT_POLICY` requires a TOTP / email-OTP
    * factor proof so the operator affirmatively re-asserts identity at
    * the moment of grant; `PERSONAL_POLICY` accepts a tier-1 unlock alone.
@@ -13062,7 +13362,29 @@ var Noydb = class {
    * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
    */
   async grant(vault, options, factors) {
-    return this.strategies.team.grant(this.team, vault, options, factors);
+    await this.#refreshRoster(vault, options.userId);
+    await this.strategies.team.grant(this.team, vault, options, factors);
+    await this.#enrolBrokerMember(vault, { userId: options.userId, secret: options.secret });
+  }
+  /**
+   * core#96 (pilot-1, finding B) — before an AUTHORITY edit of a member's
+   * keyring, bring that file down from every sync target that supersedes
+   * ours. The roster replicates by epoch ("higher wins"), so an edit made on a
+   * stale local copy would push as the loser and be discarded; refreshing
+   * first makes the edit land on the current file. One GET per target; a
+   * target that cannot be reached fails the edit (fail-closed — the edit
+   * would otherwise be a silent no-op on that target).
+   */
+  async #refreshRoster(vault, userId) {
+    const engines = [];
+    this._forEachSyncEngine(vault, (e) => {
+      engines.push(e);
+    });
+    for (const e of engines) await e.refreshKeyring(userId);
+  }
+  /** core#73 — register a (re-)granted or recovered sub-admin member with the broker host; a no-op without a broker. */
+  async #enrolBrokerMember(vault, member) {
+    await this.strategies.broker.enrolMember({ store: this.options.store, vault, keyring: await this._getKeyringInternal(vault) }, member);
   }
   /**
    * Revoke a user's access to a vault.
@@ -13075,7 +13397,14 @@ var Noydb = class {
    * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
    */
   async revoke(vault, options, factors) {
-    return this.strategies.team.revoke(this.team, vault, options, factors);
+    await this.#refreshRoster(vault, options.userId);
+    const { rewritten } = await this.strategies.team.revoke(this.team, vault, options, factors);
+    await this.#trackRewrites(vault, rewritten);
+    await this.options.store.delete(vault, "_users", options.userId);
+    await this.strategies.broker.revokeMember({ store: this.options.store, vault, keyring: await this._getKeyringInternal(vault) }, options.userId);
+    for (const coll of ["_keyring", "_users", "_broker_member"]) {
+      await Promise.all([...this.syncEngines].filter(([k]) => k === vault || k.startsWith(`${vault}::`)).map(([, e]) => e.trackChange(coll, options.userId, "delete", 1)));
+    }
   }
   /**
    * Grant the FR-6 `custodian` role to a user (owner-only custody API).
@@ -13116,24 +13445,39 @@ var Noydb = class {
     await this.checkGate(vault, "revoke-user", factors);
     const keyring = await this._getKeyringInternal(vault);
     if (keyring.role !== "owner") throw new PermissionDeniedError("only the Deed owner can revoke a custodian");
-    await engine(this.options.store, vault, keyring, options);
-  }
-  /**
-   * Mutate post-grant identity fields on an existing keyring — `role`,
-   * `displayName`, and/or `permissions`. Pure plaintext-header rewrite:
-   * no DEK rewrap, no KEK required, no authenticator slots touched.
-   * Tier-2 enrollments and recovery codes survive.
+    const { rewritten } = await engine(this.options.store, vault, keyring, options);
+    await this.#trackRewrites(vault, rewritten);
+  }
+  /**
+   * Change what an EXISTING member may do — `role`, `displayName`, and/or
+   * `permissions` — without holding their secret. The member's KEK, salt
+   * and authenticator slots are untouched; tier-2 enrollments and recovery
+   * codes survive.
+   *
+   * core#96 — the keys follow the header. A change that widens access
+   * delivers the DEKs the member lacks through their keyring INBOX
+   * (sealed to a per-member key pair only their KEK opens; drained at
+   * their next tier-1 unlock, or at the next pull of an open session). A
+   * change that narrows access drops the DEKs and rotates those
+   * collections, as a narrowing `grant` does (#1097). A role change
+   * re-registers the member with a configured broker host under a fresh
+   * `_broker_member` key. This is the widening path: `db.grant` on an
+   * existing user RE-KEYS them from `secret`, so it needs their CURRENT
+   * secret — after `acceptInvite` or `rotateSecret` an owner never holds it.
    *
    * Different from `db.revoke + db.grant`:
    *
-   *   - Same `userId`, same DEK wrappings, same `granted_by`, same
-   *     `_users/<keyringId>` envelope. Only the specified header
-   *     fields move. Last-write-wins via the standard keyring put.
+   *   - Same `userId`, same KEK, same `granted_by`, same
+   *     `_users/<keyringId>` envelope. Last-write-wins via the standard
+   *     keyring put.
    *   - No cascade on role demotion (admins demoted to operator keep
    *     the keyrings they previously granted; the cascade rules are
    *     a `db.revoke` concern, not `db.updateUser`).
    *   - Tier-2 slots NOT dropped — the wrapping is unaffected.
    *
+   * @throws `MemberInboxMissingError` when a DEK must be delivered to a
+   *   member whose keyring predates inboxes — re-grant them once.
+   *
    * Role-elevation guard: BOTH the old and new role must satisfy
    * `db.grant`'s hierarchy. Owner can do anything; admin manages
    * admin/operator/viewer/client laterally; admin cannot promote to
@@ -13154,14 +13498,60 @@ var Noydb = class {
    * }, { factors: [{ kind: 'totp' }] })
    * ```
    *
+   * ## ⚠️ A NARROWING DOES NOT REACH A SESSION THAT IS ALREADY OPEN
+   *
+   * This writes the target's keyring. It cannot reach into a `Noydb` the
+   * target already has open: an eager collection holds the records it
+   * hydrated, and nothing polls the keyring, so that session keeps serving
+   * rows it read while it still had the key. A FRESH open throws
+   * `NoAccessError` correctly (core#101), and so does that session for any
+   * collection it had not already hydrated.
+   *
+   * ⭐ A long-lived admin console — one holding a vault open while changing
+   * somebody's permissions — must RE-OPEN the affected session rather than
+   * expect its next read to start failing.
+   *
+   * ## What the window is, MEASURED — it is narrower than it sounds
+   *
+   * The consumer building that console asked the two questions a security
+   * reviewer asks, and reasoning would have got both wrong in the cautious
+   * direction. Measured on a synced vault, after `updateUser` narrowed the
+   * member away and `rotate()` re-keyed:
+   *
+   * 1. **Records arriving AFTER the narrowing are not readable.** A `pull()`
+   *    into the open session brings the new roster, the session reloads its
+   *    keyring, and reads then throw `NoAccessError` — including for rows it
+   *    had already cached. ⭐ So with sync on, the window CLOSES at the next
+   *    pull; it is not open until re-open.
+   * 2. **Writes are refused locally.** `put()` throws `ReadOnlyError` on the
+   *    narrowed collection — the record is never encrypted, never queued, and
+   *    `push()` carries nothing. Nothing reaches the remote to be judged, so
+   *    this does not even rest on the admission gate (core#74).
+   *
+   * ⛔ So it is not a confidentiality hole and not a write hole: no access is
+   * gained, nothing new becomes readable, and nothing can be written. What
+   * survives is a read of rows the session ALREADY HELD, on a device with no
+   * sync or one that has not pulled since.
+   *
+   * ⚠️ Which is still the window that matters when a narrowing is
+   * security-motivated rather than administrative — a departing member, a
+   * suspected device. `rotate()` is the answer there and a console should
+   * REQUIRE it for that case rather than offer it.
+   *
    * @throws `NoAccessError` when no keyring exists for the target.
    * @throws `PermissionDeniedError` when the role hierarchy rejects.
    * @throws `ValidationError` when no field is provided.
    */
   async updateUser(vault, options, factors) {
     await this.checkGate(vault, "update-user", factors);
+    await this.#refreshRoster(vault, options.userId);
     const keyring = await this._getKeyringInternal(vault);
-    await updateKeyringIdentity(this.options.store, vault, keyring, options);
+    const { roleChanged, brokerMemberDek } = await updateKeyringIdentity(this.options.store, vault, keyring, options);
+    if (roleChanged) {
+      const ctx = { store: this.options.store, vault, keyring };
+      if (brokerMemberDek) await this.strategies.broker.enrolMember(ctx, { userId: options.userId, dek: brokerMemberDek });
+      else if (await this.options.store.get(vault, "_broker_member", options.userId)) await this.strategies.broker.revokeMember(ctx, options.userId);
+    }
     if (options.userId === this.options.user) {
       this.keyringCache.delete(vault);
     }
@@ -13195,8 +13585,36 @@ var Noydb = class {
    * reaching into internals. See `noy-db rotate` for the CLI wrapper.
    * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
    */
+  /**
+   * core#74 — the records this device's admission gate refused on pull
+   * (`PullResult.rejected`, `sync:rejected`), parked under `_sync_rejected`
+   * with the envelope intact. `list()` them; `readmit()` applies one after all
+   * (bypassing the gate); `discard()` drops the parking record. Per device:
+   * a refusal is local to the device that judged it.
+   */
+  rejected(vault) {
+    const engine = this.syncEngines.get(vault);
+    if (!engine) throw new ValidationError(`rejected: vault "${vault}" has no sync target.`);
+    return engine.rejected();
+  }
   async rotate(vault, collections) {
-    return this.strategies.team.rotate(this.team, vault, collections);
+    const result = await this.strategies.team.rotate(this.team, vault, collections);
+    await this.#trackRewrites(vault, result.rewritten);
+    return result;
+  }
+  /**
+   * core#100 — a rotation re-encrypts records through the raw store, which the
+   * sync dirty log cannot see; without this a replica kept the OLD ciphertext
+   * until each record was edited again — a revoked member with store access
+   * read on, and a survivor handed the new DEK read `TamperedError`.
+   */
+  async #trackRewrites(vault, rewritten) {
+    if (rewritten.length === 0) return;
+    const engines = [];
+    this._forEachSyncEngine(vault, (e) => {
+      engines.push(e);
+    });
+    for (const e of engines) for (const r of rewritten) await e.trackChange(r.collection, r.id, "rekey", r.version);
   }
   /**
    * Verify every `_keyring` file in the vault. Read-only (#1121).
@@ -13421,9 +13839,13 @@ var Noydb = class {
     return results;
   }
   /**
-   * @internal True once `close()` has been called. Read by outward
-   * orchestration frameworks whose entry points can't see the private
-   * `closed` field.
+   * True once `close()` has been called.
+   *
+   * ⭐ NOT `@internal`, and core#128 removed that tag rather than `_`-prefixing
+   * this: the doc's own reason — "read by outward orchestration frameworks
+   * whose entry points can't see the private `closed` field" — IS a public
+   * contract. Prefixing it would have broken the readers it exists for. The
+   * tag was the defect, not the name.
    */
   get isClosed() {
     return this.closed;
@@ -13477,6 +13899,24 @@ var Noydb = class {
     if (engine.role !== "sync-peer") return emptyPullResult();
     return engine.pull(options);
   }
+  /** core#82 — replace every local envelope that fails to authenticate with the primary target's healthy copy; see `SyncEngine.realign`. */
+  async realign(vault) {
+    return this.getSyncEngine(vault).realign();
+  }
+  /**
+   * core#72 — make THIS device's vault authoritative on its primary target:
+   * every local record is written unconditionally (re-versioned above the
+   * target's copy where the target moved on), every id the target holds that
+   * the local vault does not gets a delete marker, the reserved collections
+   * are mirrored, and a new restore EPOCH is written on the target. Every
+   * other device's next pull crosses that epoch: its unpushed edits are parked
+   * (`db.rejected(vault)`, reason `restore-epoch`), its dirty log dropped, the
+   * target adopted wholesale. The act of a restore (`vault.load` then this), or
+   * of declaring one replica the truth. Owner/admin, ledgered by the pushes.
+   */
+  async replaceRemote(vault) {
+    return this.getSyncEngine(vault).replaceRemote();
+  }
   /**
    * Bidirectional sync: pull then push for all targets.
    * `sync-peer` targets do pull+push; `backup`/`archive` targets do push-only.
@@ -13553,7 +13993,7 @@ var Noydb = class {
   }
   /**
    * Currently-running multi-record transaction, or `null` outside
-   * Phase 2. `Collection.dispatchDerivations` consults this so a
+   * Phase 2. `Collection._dispatchDerivations` consults this so a
    * recursive derived-output write inside `Collection.put` can register
    * its envelope onto `ctx._executed` and roll back with the main
    * staged ops on mid-batch failure.
@@ -13621,9 +14061,9 @@ var Noydb = class {
     const targets = [];
     for (const [key, engine] of this.syncEngines) {
       if (key !== vault && !key.startsWith(`${vault}::`)) continue;
-      const { dirty, lastPush, lastPull } = engine.status();
+      const { dirty, lastPush, lastPull, inFlight, epoch } = engine.status();
       const { label, role } = engine;
-      targets.push({ label, role, dirty, lastPush, lastPull, caughtUp: dirty === 0 });
+      targets.push({ label, role, dirty, lastPush, lastPull, caughtUp: dirty === 0, ...inFlight ? { inFlight } : {}, ...epoch !== void 0 ? { epoch } : {} });
     }
     return targets;
   }
@@ -13660,6 +14100,43 @@ var Noydb = class {
     }
     return engine;
   }
+  /** Dirty tracking fans out to every engine of the vault; 'revert' (satellite fan-out compensation, spec #591) un-dirties instead. */
+  #dirtyFanout(name) {
+    return async (coll, id, action, version) => {
+      for (const [key, engine] of this.syncEngines) {
+        if (key === name || key.startsWith(`${name}::`)) {
+          if (action === "revert") void engine.removeDirty(coll, id);
+          else void engine.trackChange(coll, id, action, version);
+        }
+      }
+    };
+  }
+  /** core#90 — attach a sync target to an OPEN vault (primary when it had none, else keyed by position); records written before it are sent by `push({ full: true })`. Rationale in `kernel/sync-wiring.ts`. */
+  async attachSyncTarget(vault, target) {
+    const comp = this.vault(vault);
+    const t = normalizeSyncTargets(target)[0];
+    const declared = t.policy ?? this.options.syncPolicy;
+    const keyring = await this._getKeyringInternal(vault);
+    const engine = this.strategies.sync.buildSyncEngine({
+      local: this.options.store,
+      remote: t.store,
+      vault,
+      strategy: this.options.conflict ?? "version",
+      emitter: this.emitter,
+      syncPolicy: declared ?? INDEXED_STORE_POLICY,
+      role: t.role,
+      mergeAuthority: buildMergeAuthority(() => this.keyringCache.get(vault) ?? keyring),
+      ...t.label !== void 0 ? { label: t.label } : {}
+    });
+    const existing = [...this.syncEngines.keys()].filter((k) => k === vault || k.startsWith(`${vault}::`)).length;
+    this.syncEngines.set(existing === 0 ? vault : `${vault}::${existing}`, engine);
+    if (existing === 0) comp._enableSync(this.#dirtyFanout(vault));
+    wireEngine(this.#wiring, vault, comp, engine);
+    if (declared) engine.startScheduler();
+  }
+  get #wiring() {
+    return { user: this.options.user, keyringCache: this.keyringCache, conflictResolvers: this.conflictResolvers };
+  }
   _forEachSyncEngine(vault, fn) {
     for (const [key, engine] of this.syncEngines) if (key === vault || key.startsWith(`${vault}::`)) fn(engine);
   }
@@ -13815,9 +14292,15 @@ var Noydb = class {
     return this.sessionId;
   }
   /**
-   * @internal Drain-barrier coordination transport for the schema fence.
-   * The default store-backed provider reproduces today's fence behavior; a
-   * `by-*` real-time transport is injected via `mesh`.
+   * Drain-barrier coordination transport for the schema fence. The default
+   * store-backed provider reproduces today's fence behavior; a `by-*`
+   * real-time transport is injected via the `mesh` option.
+   *
+   * ⭐ NOT `@internal`, and core#128 removed that tag rather than
+   * `_`-prefixing this. `db.mesh` is documented as a public handle in
+   * `port/by/index.ts` — "a `Noydb` handle (`db.mesh`) without ever naming a
+   * `by-*` pack" — and `createNoydb({ mesh })` is a public option. The tag
+   * contradicted both; prefixing would have broken the documented handle.
    */
   get mesh() {
     return this.meshPort;
@@ -13909,7 +14392,7 @@ var Noydb = class {
    *
    * @internal — not part of the public API surface
    */
-  async invokeTranslator(text, from, to, field, collection) {
+  async _invokeTranslator(text, from, to, field, collection) {
     const cacheKey = `${field}\0${collection}\0${from}\0${to}\0${text}`;
     const translatorName = this.options.plaintextTranslatorName ?? "anonymous";
     const cached = this.translatorCache.get(cacheKey);
@@ -14141,6 +14624,7 @@ var Noydb = class {
       this.keyringCache.set(vault, keyring2);
       return keyring2;
     }
+    await this.strategies.sync.bootstrapKeyrings(this.options.store, normalizeSyncTargets(this.options.sync).find((t) => t.role === "sync-peer")?.store, vault);
     await assertKeyringOpenAllowed(this.options.store, vault, this.options.user, opts.create);
     const effectiveSecret = await resolveEffectiveSecret(this.options, this.options.store, vault);
     if (!effectiveSecret) {
@@ -14191,7 +14675,7 @@ async function createNoydb(options) {
   if (!options.store) options = { ...options, store: memoryStore() };
   validateSecretModeOptions(options);
   if (!options.mesh) options = { ...options, mesh: await createDefaultMesh(options.store) };
-  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-OS747DS4.js")).createUserApi };
+  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-6EFD43KN.js")).createUserApi };
   if (!options.policyFactory) {
     const policyModule = await import("./policy/index.js");
     options = { ...options, policyFactory: policyModule.createNoydbPolicy, policyCheckGateFn: policyModule.checkGate };
@@ -14224,4 +14708,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-MXOQ5JCG.js.map
+//# sourceMappingURL=chunk-MRCR7ZMC.js.map