@noy-db/hub 0.9.0-pre.0 → 0.9.0-pre.2

package/dist/{chunk-JA25QG5M.js → chunk-N6EWQ5VB.js}

@@ -1,34 +1,38 @@
 import {
-  SyncScheduler
-} from "./chunk-JBMMWYOH.js";
+  REJECTIONS_COLLECTION,
+  SyncScheduler,
+  rejectionKey
+} from "./chunk-7UHLO4ZN.js";
 import {
   PERIODS_COLLECTION,
   PERIOD_ARCHIVES_COLLECTION,
   PERIOD_FREEZES_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION,
   periodExclusiveUpperBound
-} from "./chunk-6WS35E6X.js";
+} from "./chunk-A52BK5AY.js";
 import {
   parseKeyringEnvelope
-} from "./chunk-45VHWE4C.js";
+} from "./chunk-QVUMKG3Z.js";
 import {
+  buildDeleteMarker,
   buildRecordEnvelope,
   decrypt,
   derivePresenceKey,
   derivePresenceTagKey,
   encrypt,
+  envelopeBodyForHash,
   envelopeBodySize,
   hmacSignHex,
   isDeleteMarker,
   isTombstoneShape
-} from "./chunk-4J3MNVVX.js";
+} from "./chunk-WRLWEYHY.js";
 import {
   NOYDB_SYNC_VERSION
-} from "./chunk-2ELOCEXE.js";
+} from "./chunk-URGHKZPL.js";
 import {
   ValidationError,
   isConflictError
-} from "./chunk-VSUQI5Q6.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/with-sync/presence.ts
 var PresenceHandle = class {
@@ -287,6 +291,10 @@ function keyringEpoch(envelope) {
     return void 0;
   }
 }
+function keyringIdentity(envelope) {
+  const file = parseKeyringEnvelope(envelope);
+  return `${file.roster_epoch ?? ""}:${file.roster_tag.data}:${file.display_name}`;
+}
 function keyringSupersedes(candidate, current) {
   if (!current) return true;
   const c = keyringEpoch(candidate);
@@ -301,9 +309,26 @@ function versionSupersedes(candidate, current) {
 }
 var RESERVED_REPLICATION = [
   { collection: KEYRING_COLLECTION, supersedes: keyringSupersedes, propagateDeletes: true },
+  // core#91 — the broker seeds. `_broker/<brokerId>` is sealed under the
+  // admin `_broker` DEK (owner/admin only hold it), `_broker_member/<userId>`
+  // under that grantee's own DEK: both are ciphertext to the mover and to every
+  // other device, and both are exactly what a fresh device needs to mint its
+  // first credential. Revocation is a delete that rides the dirty log.
+  // core#97 — SECOND, right behind the roster: on a fresh device every target
+  // request before the seed has landed cannot be served by the device's own
+  // mint, so the seed travels before anything else a first pull carries.
+  { collection: "_broker_member", supersedes: versionSupersedes, propagateDeletes: true },
+  { collection: "_broker", supersedes: versionSupersedes, propagateDeletes: true },
   { collection: "_meta", idPrefix: "invite-audit-", supersedes: versionSupersedes, propagateDeletes: false },
   { collection: "_users", supersedes: versionSupersedes, propagateDeletes: true },
-  { collection: "_delegations", supersedes: versionSupersedes, propagateDeletes: true }
+  { collection: "_delegations", supersedes: versionSupersedes, propagateDeletes: true },
+  // core#107 — the arbiter's admission refusals, so the WRITER learns its
+  // offline record was rejected instead of the verdict staying on the device
+  // that made it. Sealed under the refused record's OWN collection DEK, so
+  // this mover still reads nothing (`_v` is on the envelope) and a member
+  // without that collection receives ciphertext they quietly skip.
+  // `propagateDeletes: true` — clearing a refusal is how it stops being shown.
+  { collection: REJECTIONS_COLLECTION, supersedes: versionSupersedes, propagateDeletes: true }
 ];
 function inScope(rule, id) {
   return rule.idPrefix === void 0 || id.startsWith(rule.idPrefix);
@@ -324,12 +349,25 @@ async function mirrorRule(rule, from, to, vault, fromIds) {
 async function pushReserved(local, remote, vault) {
   let copied = 0;
   let keyringsCopied = [];
+  const staleKeyrings = [];
   for (const rule of RESERVED_REPLICATION) {
     const ids = await mirrorRule(rule, local, remote, vault);
     copied += ids.length;
-    if (rule.collection === KEYRING_COLLECTION) keyringsCopied = ids;
+    if (rule.collection === KEYRING_COLLECTION) {
+      keyringsCopied = ids;
+      for (const id of await local.list(vault, KEYRING_COLLECTION)) {
+        if (ids.includes(id)) continue;
+        const [mine, theirs] = await Promise.all([local.get(vault, KEYRING_COLLECTION, id), remote.get(vault, KEYRING_COLLECTION, id)]);
+        if (mine && theirs && keyringIdentity(mine) !== keyringIdentity(theirs)) staleKeyrings.push({ id, local: mine, remote: theirs });
+      }
+    }
   }
-  return { copied, deleted: 0, keyringsCopied };
+  return { copied, deleted: 0, keyringsCopied, ...staleKeyrings.length > 0 && { staleKeyrings } };
+}
+async function pullKeyringFile(remote, local, vault, userId) {
+  const rule = RESERVED_REPLICATION[0];
+  const ids = await mirrorRule(rule, remote, local, vault, [userId]);
+  return ids.length > 0;
 }
 async function pullReserved(remote, local, vault, protectedIds) {
   const localKeyrings = await local.list(vault, KEYRING_COLLECTION);
@@ -337,12 +375,14 @@ async function pullReserved(remote, local, vault, protectedIds) {
   let copied = 0;
   let deleted = 0;
   let keyringsCopied = [];
+  let remoteInitialised = false;
   for (const rule of RESERVED_REPLICATION) {
     const remoteIds = (await remote.list(vault, rule.collection)).filter((id) => inScope(rule, id));
+    if (rule.collection === KEYRING_COLLECTION) remoteInitialised = remoteIds.length > 0;
     const ids = await mirrorRule(rule, remote, local, vault, remoteIds);
     copied += ids.length;
     if (rule.collection === KEYRING_COLLECTION) keyringsCopied = ids;
-    if (!rule.propagateDeletes || remoteIds.length === 0) continue;
+    if (!rule.propagateDeletes || !remoteInitialised) continue;
     const remoteSet = new Set(remoteIds);
     const protectedSet = protectedIds.get(rule.collection);
     const localIds = rule.collection === KEYRING_COLLECTION ? localKeyrings : await local.list(vault, rule.collection);
@@ -406,8 +446,22 @@ function buildPeriodScope(option, records) {
 }
 
 // src/with-sync/engine.ts
+var REJECTED_COLLECTION = "_sync_rejected";
+function parseParked(env) {
+  return JSON.parse(envelopeBodyForHash(env));
+}
 var SyncEngine = class {
   mergeAuthority;
+  /** core#74 — the vault's admission gate for incoming records; wired at open like the other vault seams. */
+  admission;
+  #applied = [];
+  #rejected = [];
+  /** core#108 — this device's own records, refused by its own gates on the way OUT. */
+  #pushRejected = [];
+  /** core#107 — the vault's sealing capability for replicated refusals; wired at open like `admission`. */
+  courier;
+  /** core#107 — this device's refusals replicate. Configuration, not an authority proof — see `withSync`. */
+  arbiter;
   local;
   remote;
   strategy;
@@ -423,6 +477,8 @@ var SyncEngine = class {
   /** #1036 — last SUCCESSFUL push/pull. Never advanced by a failed attempt. */
   lastPush = null;
   lastPull = null;
+  /** core#72 — the target's restore epoch this device adopted; null before any. */
+  epoch = null;
   /**
    * #1036 — the failure that ended the most recent attempt, cleared by the next
    * success. Live state only: deliberately NOT persisted in `_sync/meta`, since a
@@ -490,9 +546,188 @@ var SyncEngine = class {
   setPeriodPullSource(source) {
     this.periodPullSource = source;
   }
+  /** core#81 — the collections this keyring names; the walk set for a paged pull. Wired by the vault at open. */
+  collectionNames;
+  /** Wire the paged-pull walk set (core#81). Same injection pattern as `setCacheInvalidator`. */
+  setCollectionNames(fn) {
+    this.collectionNames = fn;
+  }
+  /**
+   * core#81 — one chunk per page of one collection, for `pull({ paged: true })`.
+   * `listPage` when the store offers it (200 per page), else `list` + `get` in
+   * batches of the same size. Never more than one page in memory.
+   */
+  async *pagedChunks(names) {
+    const PAGE = 200;
+    const remote = this.remote;
+    for (const coll of names) {
+      if (typeof remote.listPage === "function") {
+        let cursor;
+        do {
+          const page = await remote.listPage(this.vault, coll, cursor, PAGE);
+          const records = {};
+          for (const { id, envelope } of page.items) records[id] = envelope;
+          if (page.items.length > 0) yield [coll, records];
+          cursor = page.nextCursor ?? void 0;
+        } while (cursor !== void 0);
+      } else {
+        const ids = await remote.list(this.vault, coll);
+        for (let i = 0; i < ids.length; i += PAGE) {
+          const records = {};
+          for (const id of ids.slice(i, i + PAGE)) {
+            const env = await remote.get(this.vault, coll, id);
+            if (env) records[id] = env;
+          }
+          if (Object.keys(records).length > 0) yield [coll, records];
+        }
+      }
+    }
+  }
   /** core#82 — when a pull replaces the caller's OWN keyring file, the vault reloads it in place. */
   rosterReload;
   /** Wire the roster-reload seam (core#82). Same injection pattern as `setCacheInvalidator`. */
+  /** core#107 — wire the vault's rejection sealing capability. */
+  setRejectionCourier(c) {
+    this.courier = c;
+  }
+  /** core#74 — wire the vault's admission gate. */
+  setAdmission(a) {
+    this.admission = a;
+  }
+  /** core#71 — after `vault.load()`: a new base. Drops the dirty log, the watermarks and the adopted epoch. */
+  async resetAfterRestore() {
+    await this.ensureLoaded();
+    this.dirty = [];
+    this.lastPush = null;
+    this.lastPull = null;
+    this.epoch = null;
+    await this.persistMeta();
+  }
+  /** core#72 — the target's epoch record, or null when the target was never replaced. */
+  async #remoteEpoch() {
+    const env = await this.remote.get(this.vault, "_sync", "epoch");
+    return env ? JSON.parse(envelopeBodyForHash(env)) : null;
+  }
+  /**
+   * core#72 — make the LOCAL vault authoritative on this target. Every local
+   * record goes up unconditionally, re-sealed above the target's version where
+   * the target moved on (so every peer's copy is superseded); every id the
+   * target holds that the local vault lacks gets a delete marker at
+   * `remote._v + 1` (so every peer removes it); the reserved collections are
+   * mirrored; then a new epoch is written at `_sync/epoch`. The dirty log is
+   * cleared: the target IS the local state now.
+   */
+  async replaceRemote() {
+    await this.ensureLoaded();
+    const actor = this.rosterReload?.userId ?? "sync";
+    const [localSnapshot, remoteSnapshot] = await Promise.all([this.local.loadAll(this.vault), this.remote.loadAll(this.vault)]);
+    let replaced = 0;
+    let tombstoned = 0;
+    for (const [collection, records] of Object.entries(localSnapshot)) {
+      if (collection === REJECTED_COLLECTION) continue;
+      for (const [id, envelope] of Object.entries(records)) {
+        const current = remoteSnapshot[collection]?.[id];
+        let out = envelope;
+        if (current && current._v >= envelope._v) {
+          out = this.mergeAuthority ? await this.mergeAuthority.advance(collection, id, envelope, current._v + 1) : { ...envelope, _v: current._v + 1 };
+          await this.local.put(this.vault, collection, id, out);
+        }
+        await this.remote.put(this.vault, collection, id, out);
+        replaced++;
+      }
+    }
+    for (const [collection, records] of Object.entries(remoteSnapshot)) {
+      if (collection === REJECTED_COLLECTION) continue;
+      for (const [id, envelope] of Object.entries(records)) {
+        if (localSnapshot[collection]?.[id] !== void 0) continue;
+        if (isTombstoneShape(envelope) || isDeleteMarker(envelope)) continue;
+        const marker = buildDeleteMarker({ collection, id }, envelope._v + 1, actor);
+        await this.remote.put(this.vault, collection, id, marker);
+        await this.local.put(this.vault, collection, id, marker);
+        tombstoned++;
+      }
+    }
+    const mirrored = await pushReserved(this.local, this.remote, this.vault);
+    const previous = await this.#remoteEpoch();
+    const epoch = (previous?.epoch ?? 0) + 1;
+    const record = { epoch, at: (/* @__PURE__ */ new Date()).toISOString(), by: actor, replaced, tombstoned };
+    await this.remote.put(this.vault, "_sync", "epoch", buildRecordEnvelope({ collection: "_sync", id: "epoch", version: epoch }, { iv: "", data: JSON.stringify(record) }));
+    this.dirty = [];
+    this.epoch = epoch;
+    this.lastPush = (/* @__PURE__ */ new Date()).toISOString();
+    await this.persistMeta();
+    const result = { epoch, replaced, tombstoned, reserved: mirrored.copied };
+    this.emitter.emit("sync:replace", { vault: this.vault, ...result });
+    return result;
+  }
+  /**
+   * core#72 — at the start of a pull: has the target been replaced since this
+   * device last synced? If so, park every unpushed local edit (same fate as an
+   * admission refusal, reason `restore-epoch`), drop the dirty log, adopt the
+   * epoch. The pull that follows then adopts the target: the restorer lifted
+   * its records above every peer's version and tombstoned what it removed.
+   */
+  async #crossEpoch() {
+    const remote = await this.#remoteEpoch();
+    if (!remote || remote.epoch === this.epoch) return { epoch: remote?.epoch ?? 0, resynced: false, parked: 0 };
+    const from = this.epoch;
+    let parked = 0;
+    for (const entry of this.dirty) {
+      if (entry.action === "delete") continue;
+      const env = await this.local.get(this.vault, entry.collection, entry.id);
+      if (!env) continue;
+      const rejection = {
+        vault: this.vault,
+        collection: entry.collection,
+        id: entry.id,
+        version: env._v,
+        reason: `restore-epoch: the target was replaced (epoch ${remote.epoch}) after this edit; readmit to keep it locally, then put again to push`,
+        ...env._by !== void 0 ? { by: env._by } : {},
+        at: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      const parkedRecord = { rejection, envelope: env };
+      await this.local.put(
+        this.vault,
+        REJECTED_COLLECTION,
+        `${entry.collection}::${entry.id}`,
+        buildRecordEnvelope({ collection: REJECTED_COLLECTION, id: `${entry.collection}::${entry.id}`, version: 1 }, { iv: "", data: JSON.stringify(parkedRecord) })
+      );
+      this.#rejected.push(rejection);
+      this.emitter.emit("sync:rejected", rejection);
+      await this.local.delete(this.vault, entry.collection, entry.id);
+      await this.cacheInvalidator?.(entry.collection, entry.id, "delete");
+      parked++;
+    }
+    this.dirty = [];
+    this.epoch = remote.epoch;
+    this.emitter.emit("sync:epoch", { vault: this.vault, from, to: remote.epoch, parked });
+    return { epoch: remote.epoch, resynced: true, parked };
+  }
+  /** core#74 — the parked refusals on this device, and their two fates. */
+  rejected() {
+    const key = (collection, id) => `${collection}::${id}`;
+    return {
+      list: async () => {
+        const out = [];
+        for (const id of await this.local.list(this.vault, REJECTED_COLLECTION)) {
+          const env = await this.local.get(this.vault, REJECTED_COLLECTION, id);
+          if (!env) continue;
+          out.push(parseParked(env).rejection);
+        }
+        return out;
+      },
+      readmit: async (collection, id) => {
+        const env = await this.local.get(this.vault, REJECTED_COLLECTION, key(collection, id));
+        if (!env) throw new ValidationError(`sync: no rejected record parked for "${collection}/${id}".`);
+        await this.local.put(this.vault, collection, id, parseParked(env).envelope);
+        await this.local.delete(this.vault, REJECTED_COLLECTION, key(collection, id));
+        await this.cacheInvalidator?.(collection, id, "put");
+      },
+      discard: async (collection, id) => {
+        await this.local.delete(this.vault, REJECTED_COLLECTION, key(collection, id));
+      }
+    };
+  }
   setRosterReload(seam) {
     this.rosterReload = seam;
   }
@@ -531,6 +766,7 @@ var SyncEngine = class {
     this.label = opts.label;
     this.policy = opts.syncPolicy;
     this.mergeAuthority = opts.mergeAuthority;
+    this.arbiter = opts.arbiter === true;
     const policy = opts.syncPolicy;
     if (policy && (policy.push.mode !== "manual" || policy.pull.mode !== "manual")) {
       this.scheduler = new SyncScheduler(policy, {
@@ -623,11 +859,250 @@ var SyncEngine = class {
     this.dirty = this.dirty.filter((d) => !(d.collection === collection && d.id === id));
     if (this.dirty.length !== before) await this.persistMeta();
   }
+  /**
+   * core#74/#108 — park a refused envelope under `_sync_rejected` and announce
+   * it. One helper for both fates: a record that ARRIVED and was turned away,
+   * and (core#108) this device's own record refused on the way out. The
+   * parking key is `collection::id`, so re-refusing the same record overwrites
+   * rather than accumulating.
+   */
+  async #park(collection, id, envelope, reason, origin) {
+    const rejection = {
+      vault: this.vault,
+      collection,
+      id,
+      reason,
+      version: envelope._v,
+      ...envelope._by !== void 0 ? { by: envelope._by } : {},
+      at: (/* @__PURE__ */ new Date()).toISOString(),
+      ...envelope._ts !== void 0 ? { recordAt: envelope._ts } : {},
+      origin
+    };
+    await this.#parkBuilt(collection, id, envelope, rejection);
+    if (origin === "sync-apply") await this.#publishRejection(collection, id, rejection);
+    return rejection;
+  }
+  /** Store half of `#park`, also used for a refusal that arrived already made (core#107). */
+  async #parkBuilt(collection, id, envelope, rejection) {
+    const parked = { rejection, envelope };
+    await this.local.put(
+      this.vault,
+      REJECTED_COLLECTION,
+      `${collection}::${id}`,
+      buildRecordEnvelope({ collection: REJECTED_COLLECTION, id: `${collection}::${id}`, version: 1 }, { iv: "", data: JSON.stringify(parked) })
+    );
+    this.emitter.emit("sync:rejected", rejection);
+  }
+  /**
+   * core#107 — turn the arbiter's replicated refusals into THIS device's
+   * notification. Runs after the reserved phase has brought `_sync_rejections`.
+   *
+   * Three filters, each load-bearing:
+   *  - `courier.open` returns `null` for a member who holds no DEK for that
+   *    collection. They received the ciphertext like everyone else and skip it.
+   *  - a refusal names a VERSION. If this device's copy has moved on, the
+   *    refusal is about a record that no longer exists here and is ignored —
+   *    otherwise a stale verdict would re-fire against an edit that may well
+   *    pass now.
+   *  - an existing parking at the same version means this was already
+   *    reported; the parking record IS the dedupe, so no extra state is kept
+   *    and it survives a restart.
+   *
+   * ⛔ REPORT ONLY (ruled): the local record is never deleted, tombstoned or
+   * hidden. The refusal is information; what to do about it is the writer's.
+   */
+  async #scanReplicatedRejections() {
+    if (!this.courier) return 0;
+    let keys;
+    try {
+      keys = await this.local.list(this.vault, REJECTIONS_COLLECTION);
+    } catch {
+      return 0;
+    }
+    let seen = 0;
+    for (const parkKey of keys) {
+      const sep = parkKey.indexOf("::");
+      if (sep < 0) continue;
+      const collection = parkKey.slice(0, sep), id = parkKey.slice(sep + 2);
+      const env = await this.local.get(this.vault, REJECTIONS_COLLECTION, parkKey);
+      if (!env) continue;
+      const rejection = await this.courier.open(collection, id, env);
+      if (!rejection) continue;
+      const mine = await this.local.get(this.vault, collection, id);
+      if (!mine || mine._v !== rejection.version) continue;
+      const existing = await this.local.get(this.vault, REJECTED_COLLECTION, parkKey);
+      if (existing && parseParked(existing).rejection.version === rejection.version) continue;
+      const replicated = { ...rejection, origin: "arbiter" };
+      await this.#parkBuilt(collection, id, mine, replicated);
+      this.#rejected.push(replicated);
+      seen++;
+    }
+    return seen;
+  }
+  /**
+   * core#107 — the ARBITER's refusals replicate, so the writer finds out.
+   *
+   * Only `sync-apply` refusals: a `push-recheck` refusal (core#108) never left
+   * this device, so there is no other device to tell, and a `restore-epoch`
+   * parking is this device adopting a new base rather than a judgement about
+   * the record.
+   *
+   * ⛔ Best-effort by construction: a failure to publish must not fail the
+   * pull that produced it. The local parking, the `PullResult.rejected` row
+   * and the event have already happened and are this device's real answer;
+   * replication is the courtesy on top. So a courier that cannot seal (no DEK
+   * for that collection) or a store that refuses the write leaves the refusal
+   * exactly as it was before core#107.
+   */
+  async #publishRejection(collection, id, rejection) {
+    if (!this.arbiter || !this.courier) return;
+    try {
+      const key = rejectionKey(collection, id);
+      const current = await this.local.get(this.vault, REJECTIONS_COLLECTION, key);
+      const envelope = await this.courier.seal(collection, id, rejection, (current?._v ?? 0) + 1);
+      if (envelope) await this.local.put(this.vault, REJECTIONS_COLLECTION, key, envelope);
+    } catch {
+    }
+  }
+  /**
+   * core#108 — re-run this device's OWN gates against a dirty record before it
+   * is pushed. A record written offline may no longer pass the rules this
+   * device now holds (a period closed while it was away); today it pushes and
+   * every OTHER device refuses it at admission, so the writer is the last to
+   * know. Judging it here means the writer's own device catches it the moment
+   * it reconnects, before anyone else sees the record.
+   *
+   * Returns `true` when the entry was WITHHELD. The entry stays dirty and the
+   * local copy is untouched, so nothing is lost and a later push carries it
+   * unchanged once the rule passes again — which is why a refusal here needs
+   * no `readmit()` and no dirty-log surgery.
+   *
+   * ⛔ `rekey` is never re-checked: core#100 rewrites the SAME content under a
+   * new key, so judging it would refuse a record for its content having been
+   * legal at write time — the same wrong answer core#74 fixed with
+   * `admit: false` for a device's own re-versioned records.
+   */
+  async #withheldByRecheck(entry, envelope) {
+    if (!this.admission || entry.action === "rekey") return false;
+    if (isTombstoneShape(envelope) || isDeleteMarker(envelope)) return false;
+    const verdict = await this.admission.admit(entry.collection, entry.id, envelope, "push-recheck");
+    if (verdict.admitted) return false;
+    this.#pushRejected.push(await this.#park(entry.collection, entry.id, envelope, verdict.reason, "push-recheck"));
+    return true;
+  }
+  /** One dirty entry of `push()`: the CAS put, the tombstone assertion, the delete, and every conflict branch. Extracted so `push({ concurrency })` can run entries in a bounded pool (core#93). */
+  async #pushOne(i, entry, acc) {
+    try {
+      if (entry.action === "delete") {
+        await this.remote.delete(this.vault, entry.collection, entry.id);
+        acc.completed.push(i);
+        acc.pushed++;
+      } else {
+        const envelope = await this.local.get(this.vault, entry.collection, entry.id);
+        if (!envelope) {
+          acc.completed.push(i);
+          return;
+        }
+        if (isTombstoneShape(envelope)) {
+          await this.remote.put(this.vault, entry.collection, entry.id, envelope);
+          acc.completed.push(i);
+          acc.pushed++;
+          return;
+        }
+        if (await this.#withheldByRecheck(entry, envelope)) return;
+        try {
+          await this.remote.put(
+            this.vault,
+            entry.collection,
+            entry.id,
+            envelope,
+            // core#100 — a `rekey` re-encrypted the record in place: same `_v`,
+            // new bytes; the target still at that version takes it.
+            entry.action === "rekey" ? entry.version : entry.version - 1
+          );
+          acc.completed.push(i);
+          acc.pushed++;
+          acc.bytes += envelopeBodySize(envelope);
+        } catch (err) {
+          if (isConflictError(err)) {
+            const remoteEnvelope = await this.remote.get(this.vault, entry.collection, entry.id);
+            if (remoteEnvelope) {
+              if (remoteEnvelope._v === envelope._v && envelopeBodyForHash(remoteEnvelope) === envelopeBodyForHash(envelope)) {
+                acc.completed.push(i);
+              } else if (isTombstoneShape(remoteEnvelope)) {
+                await this.applyRemote(entry.collection, entry.id, remoteEnvelope);
+                acc.erasures.push(this.reportErasure(entry.collection, entry.id, remoteEnvelope, envelope, "push"));
+                acc.completed.push(i);
+              } else if (remoteEnvelope._v === envelope._v && isDeleteMarker(remoteEnvelope) !== isDeleteMarker(envelope) && !this.conflictResolvers.get(entry.collection)) {
+                if (isDeleteMarker(remoteEnvelope)) {
+                  await this.applyRemote(entry.collection, entry.id, remoteEnvelope);
+                  acc.completed.push(i);
+                } else {
+                  await this.remote.put(this.vault, entry.collection, entry.id, envelope);
+                  acc.completed.push(i);
+                  acc.pushed++;
+                }
+              } else {
+                const { handled, conflict } = await this.handleConflict(
+                  entry.collection,
+                  entry.id,
+                  envelope,
+                  remoteEnvelope,
+                  "push"
+                );
+                acc.conflicts.push(conflict);
+                if (handled === "local") {
+                  const winner = await this.advancePastRemote(conflict.local, entry.collection, entry.id, remoteEnvelope);
+                  await this.remote.put(this.vault, entry.collection, entry.id, winner);
+                  if (winner !== conflict.local) await this.applyRemote(entry.collection, entry.id, winner, { admit: false });
+                  acc.completed.push(i);
+                  acc.pushed++;
+                } else if (handled === "remote") {
+                  await this.applyRemote(entry.collection, entry.id, conflict.remote);
+                  acc.completed.push(i);
+                } else if (handled === "merged" && conflict.local !== envelope) {
+                  const merged = conflict.local;
+                  await this.remote.put(this.vault, entry.collection, entry.id, merged);
+                  await this.applyRemote(entry.collection, entry.id, merged);
+                  acc.completed.push(i);
+                  acc.pushed++;
+                }
+              }
+            }
+          } else {
+            throw err;
+          }
+        }
+      }
+    } catch (err) {
+      acc.errors.push(err instanceof Error ? err : new Error(String(err)));
+    }
+  }
+  /**
+   * core#92 — mark every user-collection record in the local store dirty at its
+   * current version, so the next push sends it (CAS against `_v - 1`, so a
+   * remote that already holds a newer copy resolves through the conflict path
+   * instead of being overwritten). Records already dirty keep their entry.
+   */
+  async markAllDirty() {
+    await this.ensureLoaded();
+    const snapshot = await this.local.loadAll(this.vault);
+    for (const [collection, records] of Object.entries(snapshot)) {
+      if (collection === REJECTED_COLLECTION) continue;
+      for (const [id, envelope] of Object.entries(records)) {
+        if (this.dirty.some((d) => d.collection === collection && d.id === id)) continue;
+        this.dirty.push({ vault: this.vault, collection, id, action: "put", version: envelope._v, timestamp: (/* @__PURE__ */ new Date()).toISOString() });
+      }
+    }
+    await this.persistMeta();
+  }
   /** Push dirty records to remote adapter. Accepts optional `PushOptions` for partial sync. */
   async push(options) {
     await this.ensureLoaded();
+    if (options?.full) await this.markAllDirty();
     this.graphBatchController?.begin();
-    let pushed = 0;
+    let reserved = 0;
+    this.#pushRejected = [];
     const conflicts = [];
     const erasures = [];
     const errors = [];
@@ -635,101 +1110,39 @@ var SyncEngine = class {
     const expanded = options?.collections ? this.pairExpander?.(options.collections) ?? options.collections : null;
     const filter = expanded ? /* @__PURE__ */ new Set([...expanded, ...this.reservedDictExpander?.(expanded) ?? []]) : null;
     const pushTotal = filter ? this.dirty.filter((d) => filter.has(d.collection)).length : this.dirty.length;
-    let pushBytes = 0;
-    for (let i = 0; i < this.dirty.length; i++) {
-      const entry = this.dirty[i];
-      if (filter && !filter.has(entry.collection)) {
-        continue;
-      }
-      this.progress({ direction: "push", phase: "records", records: pushed, bytes: pushBytes, total: { records: pushTotal } });
-      try {
-        if (entry.action === "delete") {
-          await this.remote.delete(this.vault, entry.collection, entry.id);
-          completed.push(i);
-          pushed++;
-        } else {
-          const envelope = await this.local.get(this.vault, entry.collection, entry.id);
-          if (!envelope) {
-            completed.push(i);
-            continue;
-          }
-          if (isTombstoneShape(envelope)) {
-            await this.remote.put(this.vault, entry.collection, entry.id, envelope);
-            completed.push(i);
-            pushed++;
-            continue;
-          }
-          try {
-            await this.remote.put(
-              this.vault,
-              entry.collection,
-              entry.id,
-              envelope,
-              entry.version - 1
-            );
-            completed.push(i);
-            pushed++;
-            pushBytes += envelopeBodySize(envelope);
-          } catch (err) {
-            if (isConflictError(err)) {
-              const remoteEnvelope = await this.remote.get(this.vault, entry.collection, entry.id);
-              if (remoteEnvelope) {
-                if (isTombstoneShape(remoteEnvelope)) {
-                  await this.applyRemote(entry.collection, entry.id, remoteEnvelope);
-                  erasures.push(this.reportErasure(entry.collection, entry.id, remoteEnvelope, envelope, "push"));
-                  completed.push(i);
-                } else if (remoteEnvelope._v === envelope._v && isDeleteMarker(remoteEnvelope) !== isDeleteMarker(envelope) && !this.conflictResolvers.get(entry.collection)) {
-                  if (isDeleteMarker(remoteEnvelope)) {
-                    await this.applyRemote(entry.collection, entry.id, remoteEnvelope);
-                    completed.push(i);
-                  } else {
-                    await this.remote.put(this.vault, entry.collection, entry.id, envelope);
-                    completed.push(i);
-                    pushed++;
-                  }
-                } else {
-                  const { handled, conflict } = await this.handleConflict(
-                    entry.collection,
-                    entry.id,
-                    envelope,
-                    remoteEnvelope,
-                    "push"
-                  );
-                  conflicts.push(conflict);
-                  if (handled === "local") {
-                    const winner = await this.advancePastRemote(conflict.local, entry.collection, entry.id, remoteEnvelope);
-                    await this.remote.put(this.vault, entry.collection, entry.id, winner);
-                    if (winner !== conflict.local) await this.applyRemote(entry.collection, entry.id, winner);
-                    completed.push(i);
-                    pushed++;
-                  } else if (handled === "remote") {
-                    await this.applyRemote(entry.collection, entry.id, conflict.remote);
-                    completed.push(i);
-                  } else if (handled === "merged" && conflict.local !== envelope) {
-                    const merged = conflict.local;
-                    await this.remote.put(this.vault, entry.collection, entry.id, merged);
-                    await this.applyRemote(entry.collection, entry.id, merged);
-                    completed.push(i);
-                    pushed++;
-                  }
-                }
-              }
-            } else {
-              throw err;
-            }
-          }
-        }
-      } catch (err) {
-        errors.push(err instanceof Error ? err : new Error(String(err)));
+    const acc = { pushed: 0, bytes: 0, completed, conflicts, erasures, errors };
+    const eligible = [...this.dirty.keys()].filter((i) => !filter || filter.has(this.dirty[i].collection));
+    const width = Math.max(1, Math.floor(options?.concurrency ?? 1));
+    let next = 0;
+    const worker = async () => {
+      while (next < eligible.length) {
+        const i = eligible[next++];
+        this.progress({ direction: "push", phase: "records", records: acc.pushed, bytes: acc.bytes, total: { records: pushTotal } });
+        await this.#pushOne(i, this.dirty[i], acc);
       }
-    }
+    };
+    await Promise.all(Array.from({ length: Math.min(width, eligible.length) }, () => worker()));
+    const pushed = acc.pushed;
+    const pushBytes = acc.bytes;
     for (const i of completed.sort((a, b) => b - a)) {
       this.dirty.splice(i, 1);
     }
     if (!filter) {
       this.progress({ direction: "push", phase: "reserved", records: pushed, bytes: pushBytes, total: { records: pushTotal } });
       try {
-        await pushReserved(this.local, this.remote, this.vault);
+        const mirrored = await pushReserved(this.local, this.remote, this.vault);
+        reserved = mirrored.copied;
+        for (const stale of mirrored.staleKeyrings ?? []) {
+          conflicts.push({
+            vault: this.vault,
+            collection: "_keyring",
+            id: stale.id,
+            local: stale.local,
+            remote: stale.remote,
+            localVersion: stale.local._v,
+            remoteVersion: stale.remote._v
+          });
+        }
       } catch (err) {
         errors.push(err instanceof Error ? err : new Error(String(err)));
       }
@@ -742,7 +1155,9 @@ var SyncEngine = class {
     } finally {
       await this.graphBatchController?.flush();
     }
-    const result = { pushed, conflicts, errors, erasures };
+    const pushRejected = this.#pushRejected;
+    this.#pushRejected = [];
+    const result = { pushed, conflicts, errors, erasures, ...reserved > 0 && { reserved }, ...pushRejected.length > 0 && { rejected: pushRejected } };
     this.emitter.emit("sync:push", result);
     return result;
   }
@@ -750,15 +1165,19 @@ var SyncEngine = class {
   async pull(options) {
     await this.ensureLoaded();
     let pulled = 0;
+    let reserved = 0;
+    this.#applied = [];
+    this.#rejected = [];
     const conflicts = [];
-    const erasures = [];
     const errors = [];
+    let crossed = { epoch: 0, resynced: false, parked: 0 };
+    const erasures = [];
     if (!options?.collections) {
       this.progress({ direction: "pull", phase: "reserved", records: 0, bytes: 0 });
       try {
         const protectedIds = /* @__PURE__ */ new Map();
         for (const d of this.dirty) {
-          if (d.action !== "put") continue;
+          if (d.action === "delete") continue;
           let set = protectedIds.get(d.collection);
           if (!set) {
             set = /* @__PURE__ */ new Set();
@@ -766,12 +1185,23 @@ var SyncEngine = class {
           }
           set.add(d.id);
         }
-        const { keyringsCopied } = await pullReserved(this.remote, this.local, this.vault, protectedIds);
-        if (this.rosterReload && keyringsCopied.includes(this.rosterReload.userId)) await this.rosterReload.reload();
+        const mirrored = await pullReserved(this.remote, this.local, this.vault, protectedIds);
+        reserved = mirrored.copied + mirrored.deleted;
+        if (this.rosterReload && mirrored.keyringsCopied.includes(this.rosterReload.userId)) await this.rosterReload.reload();
+      } catch (err) {
+        errors.push(err instanceof Error ? err : new Error(String(err)));
+      }
+      try {
+        await this.#scanReplicatedRejections();
       } catch (err) {
         errors.push(err instanceof Error ? err : new Error(String(err)));
       }
     }
+    try {
+      crossed = await this.#crossEpoch();
+    } catch (err) {
+      errors.push(err instanceof Error ? err : new Error(String(err)));
+    }
     let periodScope = null;
     let phases = null;
     if (options?.periods !== void 0) {
@@ -792,7 +1222,7 @@ var SyncEngine = class {
               const remoteEnvelope = await this.remote.get(this.vault, collName, id);
               if (!remoteEnvelope) continue;
               const localEnvelope = await this.local.get(this.vault, collName, id);
-              if (!localEnvelope || remoteEnvelope._v > localEnvelope._v) {
+              if (!localEnvelope || this.#remoteSupersedes(collName, id, remoteEnvelope, localEnvelope)) {
                 await this.applyRemote(collName, id, remoteEnvelope);
                 pulled++;
               }
@@ -817,11 +1247,21 @@ var SyncEngine = class {
     const expanded = options?.collections ? this.pairExpander?.(options.collections) ?? options.collections : null;
     const filter = expanded ? /* @__PURE__ */ new Set([...expanded, ...this.reservedDictExpander?.(expanded) ?? []]) : null;
     try {
-      const remoteSnapshot = await this.remote.loadAll(this.vault);
       let pullTotal = 0;
-      for (const [collName, records] of Object.entries(remoteSnapshot)) {
-        if (filter && !filter.has(collName)) continue;
-        pullTotal += Object.keys(records).length;
+      let chunks;
+      if (options?.paged) {
+        const known = new Set(this.collectionNames?.() ?? []);
+        for (const name of filter ?? []) if (!name.startsWith("_")) known.add(name);
+        const names = [...known].filter((n) => !n.startsWith("_") && (!filter || filter.has(n)));
+        for (const name of names) pullTotal += (await this.remote.list(this.vault, name)).length;
+        chunks = this.pagedChunks(names);
+      } else {
+        const remoteSnapshot = await this.remote.loadAll(this.vault);
+        for (const [collName, records] of Object.entries(remoteSnapshot)) {
+          if (filter && !filter.has(collName)) continue;
+          pullTotal += Object.keys(records).length;
+        }
+        chunks = Object.entries(remoteSnapshot);
       }
       const pullSample = () => ({
         direction: "pull",
@@ -830,7 +1270,7 @@ var SyncEngine = class {
         bytes: this.pullBytes,
         total: { records: pullTotal }
       });
-      for (const [collName, records] of Object.entries(remoteSnapshot)) {
+      for await (const [collName, records] of chunks) {
         if (filter && !filter.has(collName)) {
           continue;
         }
@@ -877,7 +1317,7 @@ var SyncEngine = class {
                 this.dirty = this.dirty.filter((d) => !(d.collection === collName && d.id === id));
                 pulled++;
               }
-            } else if (remoteEnvelope._v > localEnvelope._v) {
+            } else if (this.#remoteSupersedes(collName, id, remoteEnvelope, localEnvelope)) {
               const isDirty = this.dirty.some((d) => d.collection === collName && d.id === id);
               if (isDirty) {
                 const { handled, conflict } = await this.handleConflict(
@@ -927,7 +1367,7 @@ var SyncEngine = class {
                 this.dirty = this.dirty.filter((d) => !(d.collection === collName && d.id === id));
                 pulled++;
               }
-            } else if (remoteEnvelope._v > localEnvelope._v) {
+            } else if (this.#remoteSupersedes(collName, id, remoteEnvelope, localEnvelope)) {
               await this.applyRemote(collName, id, remoteEnvelope);
               this.dirty = this.dirty.filter((d) => !(d.collection === collName && d.id === id));
               pulled++;
@@ -950,7 +1390,22 @@ var SyncEngine = class {
       this.pullByteSink = null;
       await this.graphBatchController?.flush();
     }
-    const result = { pulled, conflicts, errors, erasures, ...phases !== null ? { phases } : {} };
+    pulled = Math.max(0, pulled - this.#rejected.length);
+    const applied = this.#applied, rejected = this.#rejected;
+    this.#applied = [];
+    this.#rejected = [];
+    const result = {
+      pulled,
+      conflicts,
+      errors,
+      erasures,
+      ...reserved > 0 && { reserved },
+      ...phases !== null ? { phases } : {},
+      ...applied.length > 0 && { applied },
+      ...rejected.length > 0 && { rejected },
+      ...crossed.epoch > 0 && { epoch: crossed.epoch },
+      ...crossed.resynced && { resynced: true }
+    };
     this.emitter.emit("sync:pull", result);
     return result;
   }
@@ -968,6 +1423,7 @@ var SyncEngine = class {
   async pushFiltered(predicate) {
     await this.ensureLoaded();
     let pushed = 0;
+    this.#pushRejected = [];
     const conflicts = [];
     const erasures = [];
     const errors = [];
@@ -992,6 +1448,7 @@ var SyncEngine = class {
             pushed++;
             continue;
           }
+          if (await this.#withheldByRecheck(entry, envelope)) continue;
           try {
             await this.remote.put(
               this.vault,
@@ -1031,7 +1488,7 @@ var SyncEngine = class {
                   if (handled === "local") {
                     const winner = await this.advancePastRemote(conflict.local, entry.collection, entry.id, remoteEnvelope);
                     await this.remote.put(this.vault, entry.collection, entry.id, winner);
-                    if (winner !== conflict.local) await this.applyRemote(entry.collection, entry.id, winner);
+                    if (winner !== conflict.local) await this.applyRemote(entry.collection, entry.id, winner, { admit: false });
                     completed.push(i);
                     pushed++;
                   } else if (handled === "remote") {
@@ -1060,7 +1517,9 @@ var SyncEngine = class {
     }
     this.recordOutcome("push", errors);
     await this.persistMeta();
-    const result = { pushed, conflicts, errors, erasures };
+    const pushRejected = this.#pushRejected;
+    this.#pushRejected = [];
+    const result = { pushed, conflicts, errors, erasures, ...pushRejected.length > 0 && { rejected: pushRejected } };
     this.emitter.emit("sync:push", result);
     return result;
   }
@@ -1098,6 +1557,18 @@ var SyncEngine = class {
    * what the caller can read. Requires a `MergeAuthority` (a vault-attached
    * engine on an encrypted vault).
    */
+  /**
+   * core#96 (pilot-1, finding B) — bring one member's keyring file down from
+   * this target if the target's copy supersedes ours. Called by the kernel
+   * before an authority edit; reloads the caller's own keyring in place when
+   * it is the one refreshed (core#82).
+   */
+  async refreshKeyring(userId) {
+    await this.ensureLoaded();
+    const copied = await pullKeyringFile(this.remote, this.local, this.vault, userId);
+    if (copied && this.rosterReload && userId === this.rosterReload.userId) await this.rosterReload.reload();
+    return copied;
+  }
   async realign() {
     await this.ensureLoaded();
     if (!this.mergeAuthority) throw new ValidationError("realign: requires a vault-attached engine on an encrypted vault (no MergeAuthority).");
@@ -1132,6 +1603,8 @@ var SyncEngine = class {
       dirty: this.dirty.length,
       lastPush: this.lastPush,
       lastPull: this.lastPull,
+      ...this.epoch !== null ? { epoch: this.epoch } : {},
+      // core#72
       ...this.inFlight ? { inFlight: this.inFlight } : {},
       online: this.isOnline,
       ...this.lastError ? { lastError: this.lastError } : {},
@@ -1215,13 +1688,41 @@ var SyncEngine = class {
     if (!this.mergeAuthority) return { ...winner, _v: toVersion };
     return this.mergeAuthority.advance(collection, id, winner, toVersion);
   }
-  async applyRemote(collection, id, envelope) {
+  /**
+   * core#100 — does the remote copy supersede ours? A higher `_v`, as always;
+   * or the SAME `_v` with different bytes while we hold no pending write for
+   * it: a DEK rotation re-encrypts records in place, and a replica that kept
+   * the old ciphertext would read `TamperedError` under the delivered key.
+   * `applyRemote` still authenticates it (`MergeAuthority`) before it lands.
+   */
+  #remoteSupersedes(collection, id, remote, local) {
+    if (remote._v > local._v) return true;
+    if (remote._v !== local._v) return false;
+    if (this.dirty.some((d) => d.collection === collection && d.id === id)) return false;
+    return envelopeBodyForHash(remote) !== envelopeBodyForHash(local);
+  }
+  async applyRemote(collection, id, envelope, opts) {
     if (this.mergeAuthority && !await this.mergeAuthority.verify(collection, id, envelope)) {
       throw new ValidationError(
         `sync: refusing remote envelope for "${collection}/${id}" \u2014 it does not authenticate at the identity and version it claims. The local copy is unchanged.`
       );
     }
+    const isErasure = isTombstoneShape(envelope) || isDeleteMarker(envelope);
+    if (this.admission && !isErasure && opts?.admit !== false) {
+      const verdict = await this.admission.admit(collection, id, envelope);
+      if (!verdict.admitted) {
+        this.#rejected.push(await this.#park(collection, id, envelope, verdict.reason, "sync-apply"));
+        return;
+      }
+    }
+    const prior = await this.local.get(this.vault, collection, id);
     await this.local.put(this.vault, collection, id, envelope);
+    this.#applied.push({
+      collection,
+      id,
+      action: isErasure ? "delete" : "put",
+      ...prior && prior._v < envelope._v ? { replaced: { version: prior._v, ...prior._by !== void 0 ? { by: prior._by } : {} } } : {}
+    });
     this.pullBytes += envelopeBodySize(envelope);
     if (this.pullByteSink !== null) {
       this.pullByteSink.records++;
@@ -1321,6 +1822,7 @@ var SyncEngine = class {
       this.dirty = [...meta.dirty];
       this.lastPush = meta.last_push;
       this.lastPull = meta.last_pull;
+      this.epoch = meta.epoch ?? null;
     }
     this.loaded = true;
   }
@@ -1329,7 +1831,8 @@ var SyncEngine = class {
       _noydb_sync: NOYDB_SYNC_VERSION,
       last_push: this.lastPush,
       last_pull: this.lastPull,
-      dirty: this.dirty
+      dirty: this.dirty,
+      ...this.epoch !== null ? { epoch: this.epoch } : {}
     };
     const envelope = buildRecordEnvelope(
       { collection: "_sync", id: "meta", version: 1 },
@@ -1403,4 +1906,4 @@ export {
   SyncEngine,
   SyncTransaction
 };
-//# sourceMappingURL=chunk-JA25QG5M.js.map
+//# sourceMappingURL=chunk-N6EWQ5VB.js.map