@vielzeug/codex 2.2.9 → 2.3.1

package/data/llms-full.txt

@@ -1,6 +1,6 @@
 # Vielzeug — Full Documentation
 
-> Complete documentation for 36 packages. Version: 2.2.8
+> Complete documentation for 37 packages. Version: 2.3.0
 
 ---
 
@@ -977,7 +977,7 @@ actor.send({ type: 'INC' });
 | `Machine.transition()` | Resolve a pure next snapshot | Sync | Does not run effects, invokes, or timers |
 | `Machine.createActor()` | Create a runtime owner | Sync | Fresh and restored actors have different entry behavior |
 | `Actor.send()` | Dispatch an event | Sync | Returns `void`; re-entrant events queue internally |
-| `debugActor()` | Observe committed snapshots | Sync | Observes only; it does not trace sends or errors |
+| `Actor.subscribe()` | Observe committed snapshots | Sync | Observes only; it does not trace sends or errors |
 | `ClockworkError` | Report definition and snapshot validation failures | Sync | Use `code`, not message text |
 
 ## Package Entry Points
@@ -985,7 +985,6 @@ actor.send({ type: 'INC' });
 | Import | Purpose |
 | --- | --- |
 | `@vielzeug/clockwork` | Machine compiler, actor runtime, errors, and types |
-| `@vielzeug/clockwork/devtools` | Opt-in snapshot observation through `debugActor()` |
 
 ## Core Functions
 
@@ -1018,24 +1017,18 @@ Throws `ClockworkError` when a definition has an invalid context, initial state,
 
 ---
 
-### `debugActor()`
+### `Actor.subscribe()`
 
 ```ts
-function debugActor, Event extends MachineEvent>(
-  actor: Actor,
-  options?: DebugActorOptions,
-): () => void;
+subscribe(listener: (snapshot: ActorSnapshot) => void): () => void;
 ```
 
-Subscribes to committed actor snapshots and logs each one with `console.debug` by default. It does not modify actor behavior and does not observe dispatched events or runtime errors.
-
-**Returns:** An unsubscribe cleanup function.
+Subscribes to committed actor snapshots. Returns an unsubscribe function. The listener receives the current snapshot immediately on subscribe, then on every committed transition. It does not observe dispatched events or runtime errors.
 
 **Example:**
 
 ```ts
 import { defineMachine } from '@vielzeug/clockwork';
-import { debugActor } from '@vielzeug/clockwork/devtools';
 
 const machine = defineMachine, { type: 'NEXT' }>()({
   initial: 'idle',
@@ -1043,9 +1036,9 @@ const machine = defineMachine, { type: 'NEXT' }>()({
 });
 
 const actor = machine.createActor();
-const stopDebugging = debugActor(actor);
+const stop = actor.subscribe((snapshot) => console.debug(snapshot));
 actor.send({ type: 'NEXT' });
-stopDebugging();
+stop();
 actor.dispose();
 ```
 
@@ -1364,16 +1357,6 @@ type Machine, Event extends MachineEvent> = {
 
 A compiled, reusable machine. Its transition lookup is map-based, so unknown or poison event names such as `__proto__` are safely ignored when no transition exists.
 
-### `DebugActorOptions`
-
-```ts
-type DebugActorOptions> = {
-  readonly logger?: (snapshot: MachineSnapshot) => void;
-};
-```
-
-Optional logger for `debugActor()`. Logger failures are ignored so observation cannot affect the actor's error policy.
-
 ## Errors
 
 ### `ClockworkErrorCode`
@@ -1622,19 +1605,17 @@ Without `onError`, an actor disposes silently. Return `'dispose'` explicitly whe
 
 ## Debugging
 
-Use opt-in snapshot logging during development. `debugActor()` observes committed snapshots only; it does not trace dispatched events or runtime errors.
+Use `actor.subscribe()` to observe committed snapshots during development. It observes snapshots only; it does not trace dispatched events or runtime errors.
 
 ```ts
-import { debugActor } from '@vielzeug/clockwork/devtools';
-
 const actor = machine.createActor();
-const stopDebugging = debugActor(actor);
+const stop = actor.subscribe((snapshot) => console.debug(snapshot));
 actor.send({ type: 'NEXT' });
-stopDebugging();
+stop();
 actor.dispose();
 ```
 
-For richer inspection, subscribe to snapshots and record them in application devtools. Clockwork intentionally has no internal trace buffer.
+For richer inspection, route snapshots to application devtools. Clockwork intentionally has no internal trace buffer.
 
 ## Flat state maps
 
@@ -2804,7 +2785,7 @@ interface Container {
 
 ## Errors
 
-- `ConduitError` — base class; `ConduitError.is(error)` narrows package errors.
+- `ConduitError` — base class; use `instanceof ConduitError` to narrow package errors.
 - `ConduitProviderNotFoundError` — dependency has no registration.
 - `ConduitCircularDependencyError` — static factory tuple graph contains a cycle.
 - `ConduitDuplicateRegistrationError` — token registered twice in one container.
@@ -3035,6 +3016,7 @@ try {
 - **`queries.fetch()`** — key-based cached reads, subscriptions, invalidation with refetch, and automatic garbage collection.
 - **`mutate()`** — direct write operation with `invalidateKeys` for one-step cache refetch, without hidden retries or a second state store.
 - **`events()` / `read()`** — abortable SSE, text, and NDJSON iteration with normalized request errors.
+- **`tap()`** — runtime observability for request lifecycle events (start, success, error).
 - **`withBearerAuth()` / `withRequestId()` / `withLogging()`** — composable transport policies.
 
 ## Documentation
@@ -3195,6 +3177,42 @@ fields; it does not retain event IDs or reconnect.
 
 ---
 
+## Observability
+
+### `tap()`
+
+```ts
+tap(handler: (event: CourierEvent) => void, options?: { signal?: AbortSignal }): () => void;
+```
+
+Observe request lifecycle events without affecting courier behavior. Handler errors are swallowed. Returns an unsubscribe function.
+
+```ts
+type CourierEvent =
+  | { type: 'request-start'; method: string; url: string }
+  | { type: 'request-success'; method: string; url: string; status: number; duration: number }
+  | { type: 'request-error'; method: string; url: string; error: unknown }
+  | { type: 'dispose' };
+```
+
+**Example:**
+
+```ts
+const courier = createCourier({ baseUrl: '/api' });
+courier.tap((event) => {
+  if (event.type === 'request-error') console.error(event.method, event.url, event.error);
+  if (event.type === 'request-success') console.debug(event.method, event.url, event.duration);
+});
+```
+
+For structured logging, route tap events to rune:
+
+```ts
+import { createLogger } from '@vielzeug/rune';
+const log = createLogger({ name: 'courier' });
+courier.tap((event) => log.debug(event, `courier:${event.type}`));
+```
+
 ## Interceptors
 
 ### Interceptor helpers
@@ -3775,7 +3793,7 @@ using sortable = createSortable({
 | `DropZoneOptions.accept`   | Filter file types before processing          | Sync           | Mismatch between MIME and extension can reject files unexpectedly |
 | `DropZoneOptions.maxFiles` | Cap accepted files per drop                  | Sync           | Excess accepted files become rejected; `onDropRejected` is called |
 | `matchesAccept()`          | Test a single `File` against an accept list  | Sync           | Extension patterns are case-insensitive; empty list accepts all   |
-| `DndError`                 | Base class for Dnd errors                    | Sync           | Use `DndError.is()` to narrow unknown errors                      |
+| `DndError`                 | Base class for Dnd errors                    | Sync           | Use `instanceof DndError` to narrow unknown errors                |
 
 ## Package Entry Point
 
@@ -4250,7 +4268,7 @@ const next = applyReorder(items, orderedIds, (item) => item.id);
 
 | Error | Trigger | Notable property |
 | --- | --- | --- |
-| `DndError` | Base class for package errors | `DndError.is(error)` |
+| `DndError` | Base class for package errors | Use `instanceof DndError` to narrow |
 | `DndScopeError` | A sortable receives a scope not created by `createSortableScope()` | — |
 
 ### Usage Guide
@@ -5257,7 +5275,7 @@ type StreamHandler = (input: TInput) => AsyncIterable | Promise>;
 
 | Error | Trigger | Notable property |
 | --- | --- | --- |
-| `FamiliarError` | Base class for all Familiar errors | `FamiliarError.is(error)` |
+| `FamiliarError` | Base class for all Familiar errors | Use `instanceof FamiliarError` to narrow |
 | `FamiliarInvalidOptionsError` | Invalid factory or test options | — |
 | `FamiliarQueueFullError` | Queue limit reached with `onFull: 'reject'` | `maxQueue` |
 | `FamiliarTaskError` | Worker handler throws or payload cannot clone | `cause` |
@@ -7211,7 +7229,7 @@ type FormDraftCodec, S extends AnySchema, K extends keyof S & string> = Readonly
 
 | Error | Trigger | Notable properties |
 | --- | --- | --- |
-| `ForgeError` | Base Forge error | `ForgeError.is(error)` narrows unknown values. |
+| `ForgeError` | Base Forge error | Use `instanceof ForgeError` to narrow unknown values. |
 | `ForgeConfigError` | Unsafe key or unsupported form value | Extends `ForgeError`. |
 | `ForgeDisposedError` | Operation or subscription after disposal | Message names the attempted operation. |
 | `ForgeSubmitError` | Concurrent `submit()` call | Extends `ForgeError`. |
@@ -7832,7 +7850,7 @@ Gesture tracks a constrained pointer pan. Dnd owns draggable items, sortable lis
 
 ## Examples
 
-- [Carousel Swipe Navigation](./examples/carousel-swipe-navigation.md)
+- [Carousel Pan Navigation](./examples/carousel-swipe-navigation.md)
 - [Swipe-to-Dismiss Notifications](./examples/swipe-dismiss-notifications.md)
 
 ### REPL Examples
@@ -7920,12 +7938,12 @@ bus.dispose();
 
 - `on()` / `once()` — typed subscriptions with explicit teardown
 - `onAny()` — cross-cutting event observation
+- `tap()` — observe bus activity for logging and diagnostics
 - `wait()` / `waitAny()` — one-shot async coordination
 - `events()` — bounded async event streams
 - `pipeEvents()` — compatible cross-bus forwarding
 - `AbortSignal` — cancellation and disposal ownership
 - `createTestBus()` — emitted-payload recording for tests
-- `debugBus()` — development logging from `/devtools`
 
 ## Documentation
 
@@ -7950,7 +7968,6 @@ bus.dispose();
 | `pipeEvents()` | Forward compatible source events | Sync | Payloads must be assignable to target event |
 | `combineSignals()` | Abort when any input aborts | Sync | Public composition has no manual teardown |
 | `createTestBus()` | Record dispatched test events | Sync | Available from `/testing` only |
-| `debugBus()` | Create console-debug instrumented bus | Sync | Available from `/devtools` only |
 
 ## Package Entry Point
 
@@ -7958,7 +7975,6 @@ bus.dispose();
 | --- | --- |
 | `@vielzeug/herald` | Runtime bus, pipes, public types, and errors |
 | `@vielzeug/herald/testing` | `createTestBus()` and `TestBus` |
-| `@vielzeug/herald/devtools` | `debugBus()` |
 
 ## Core Functions
 
@@ -7974,7 +7990,7 @@ Creates a synchronous bus for future event delivery.
 
 | Parameter | Type | Description |
 | --- | --- | --- |
-| `options` | `BusOptions` | Optional middleware, validation, error handling, logging, and listener threshold configuration. |
+| `options` | `BusOptions` | Optional middleware, validation, error handling, and listener threshold configuration. |
 
 **Returns:** `Bus`.
 
@@ -8073,7 +8089,6 @@ type EventKey = Extract;
 
 ```ts
 type BusOptions = {
-  logger?: BusLogger;
   maxListeners?: number;
   middleware?: readonly Middleware[];
   name?: string;
@@ -8084,10 +8099,9 @@ type BusOptions = {
 
 | Field | Description |
 | --- | --- |
-| `logger` | Optional debug and warning output. |
 | `maxListeners` | Warn when one event exceeds this active-listener count. |
 | `middleware` | Synchronous dispatch middleware. |
-| `name` | Display name in debug logs and disposal errors. |
+| `name` | Display name in disposal errors. |
 | `onError` | Handles listener and validation errors instead of rethrowing. |
 | `validatePayload` | Runs before middleware and listeners. |
 
@@ -8108,6 +8122,7 @@ type Bus = {
   on>(event: K, listener: Listener, opts?: SubscribeOptions): Unsubscribe;
   onAny(listener: (event: EventKey, payload: unknown) => void, opts?: SubscribeOptions): Unsubscribe;
   once>(event: K, listener: Listener, opts?: { signal?: AbortSignal }): Unsubscribe;
+  tap(handler: (event: HeraldEvent) => void, options?: { signal?: AbortSignal }): Unsubscribe;
   wait>(event: K, opts?: { signal?: AbortSignal }): Promise;
   waitAny, EventKey, ...EventKey[]]>(
     events: K,
@@ -8119,16 +8134,20 @@ type Bus = {
 
 `emit()` returns listener count or `0` after disposal, blocked middleware, or handled validation rejection.
 
+`tap()` receives every `emit`, `subscribe`, `unsubscribe`, `listener-error`, and `dispose` event as a `HeraldEvent`. It is the supported way to observe bus activity for logging and diagnostics. The returned `Unsubscribe` stops the tap; pass `{ signal }` to bind its lifetime to an `AbortSignal`.
+
+```ts
+import { createBus } from '@vielzeug/herald';
+
+const bus = createBus();
+const stop = bus.tap((event) => console.debug(`herald:${event.type}`, event));
+```
+
 ---
 
-### `BusLogger`, `Listener`, `SubscribeOptions`, and `Unsubscribe`
+### `Listener`, `SubscribeOptions`, and `Unsubscribe`
 
 ```ts
-type BusLogger = {
-  debug?: (message: string) => void;
-  warn?: (message: string) => void;
-};
-
 type Listener = (payload: T) => void;
 type SubscribeOptions = { once?: boolean; signal?: AbortSignal };
 type Unsubscribe = () => void;
@@ -8136,6 +8155,21 @@ type Unsubscribe = () => void;
 
 ---
 
+### `HeraldEvent`
+
+```ts
+type HeraldEvent =
+  | { type: 'emit'; event: EventKey; payload: unknown; timestamp: number }
+  | { type: 'subscribe'; event: EventKey; timestamp: number }
+  | { type: 'unsubscribe'; event: EventKey; timestamp: number }
+  | { type: 'listener-error'; event: EventKey; err: unknown; timestamp: number }
+  | { type: 'dispose'; timestamp: number };
+```
+
+Discriminated union delivered to `tap()` handlers. Narrow on `event.type` to access type-specific fields.
+
+---
+
 ### `EmissionErrorContext` and `Middleware`
 
 ```ts
@@ -8187,7 +8221,7 @@ type PipeEntry =
   | RenamedPipeEntry;
 ```
 
-## Testing and Devtools
+## Testing
 
 ### `createTestBus()`
 
@@ -8212,16 +8246,6 @@ type TestBus = Bus & {
 };
 ```
 
-### `debugBus()`
-
-```ts
-function debugBus(
-  options?: Omit, 'logger'> & { logger?: { warn?: BusLogger['warn'] } },
-): Bus;
-```
-
-Creates a bus with `console.debug` logging. Import from `@vielzeug/herald/devtools`.
-
 ## Errors
 
 | Error | Trigger | Notable properties |
@@ -8285,10 +8309,22 @@ bus.dispose();
 
 ## Debugging
 
+`tap()` observes every bus activity as a `HeraldEvent` — use it for logging and diagnostics.
+
 ```ts
-import { debugBus } from '@vielzeug/herald/devtools';
+import { createBus } from '@vielzeug/herald';
+
+const bus = createBus();
+bus.tap((event) => console.debug(`herald:${event.type}`, event));
+```
+
+Integrate with the Rune logger:
+
+```ts
+import { createLogger } from '@vielzeug/rune';
 
-const bus = debugBus({ name: 'cart' });
+const log = createLogger({ name: 'herald' });
+bus.tap((event) => log.debug(event, `herald:${event.type}`));
 ```
 
 ## Working with Other Vielzeug Libraries
@@ -10042,7 +10078,7 @@ const map = createKeymap(
 
 | Error | Trigger | Notable properties |
 | --- | --- | --- |
-| `KeymapError` | Lifecycle operation after disposal | `KeymapError.is(error)` narrows Keymap errors. |
+| `KeymapError` | Lifecycle operation after disposal | Use `instanceof KeymapError` to narrow Keymap errors. |
 | `KeymapParseError` | Strict shortcut parser receives invalid input | Extends `KeymapError`. |
 
 ### Usage Guide
@@ -11084,7 +11120,7 @@ try {
 | `createFormatter()` | Format Intl values from `/format` | Sync | Import from subpath |
 | `validateCatalog()` | Check explicit plural forms from `/validate` | Sync | Import from subpath |
 | `compareCatalogs()` | Compare key parity across locales from `/validate` | Sync | First locale is the base; import from subpath |
-| `LinguaError` | Base class for Lingua errors | Sync | Use `LinguaError.is()` for broad narrowing |
+| `LinguaError` | Base class for Lingua errors | Sync | Use `instanceof LinguaError` for broad narrowing |
 
 ## Package Entry Point
 
@@ -11922,7 +11958,7 @@ Necromancer owns explicit WAAPI keyframes. It does not generate CSS keyframes, o
 | `animate()` | Animate one element | Sync | Defaults to a visible `180ms` duration |
 | `animateEach()` | Animate a unique element group | Sync | Non-zero `stagger` needs numeric `delay` |
 | `captureLayout()` | Capture positions and create a one-shot FLIP transition | Sync | Capture before changing layout |
-| `NecromancerError` | Base package error | Sync | Use `NecromancerError.is()` to narrow unknown errors |
+| `NecromancerError` | Base package error | Sync | Use `instanceof NecromancerError` to narrow unknown errors |
 
 ## Package Entry Point
 
@@ -13695,7 +13731,6 @@ type OreErrorPhase = 'each-reconcile' | 'form-reset' | 'mounted' | 'setup';
 ## Errors
 
 `OreError` is the base class for every Ore error class — `err instanceof OreError` catches all of them.
-`OreError.is(err)` is the equivalent static type-guard.
 
 - **`OreApiError`** — thrown when the `ore` API itself is misused: calling `define()` with a duplicate tag, calling a lifecycle hook (`inject`, `onMounted`, `onCleanup`, `onEvent`, …) outside of `setup()`, or passing an invalid prop definition to `define()`.
 - **`OreInternalError`** — thrown when an Ore invariant fails, indicating a package bug rather than invalid application code.
@@ -14192,7 +14227,1036 @@ function App() {
 import './x-toggle'; // wherever define('x-toggle', { ... }) is called
 import { ref } from 'vue';
 
-const open = ref(false);
+const open = ref(false);
+
+  
+
+```
+
+```svelte [Svelte]
+
+  import './x-toggle'; // wherever define('x-toggle', { ... }) is called
+
+  function handleClick() {
+    console.log('toggled');
+  }
+
+```
+
+## Working with Other Vielzeug Libraries
+
+### With Ripple
+
+Import ripple primitives directly from `@vielzeug/ripple` for standalone reactive state outside components.
+
+```ts
+import { signal, computed } from '@vielzeug/ripple';
+import { define, html } from '@vielzeug/ore';
+
+// Shared state created outside any component
+const theme = signal('light');
+const isDark = computed(() => theme.value === 'dark');
+
+define('theme-toggle', {
+  setup() {
+    return html`
+       (theme.value = isDark.value ? 'light' : 'dark')}>
+        ${() =>
+          isDark.value ? '' : ''}
+      
+    `;
+  },
+});
+```
+
+### With Forge
+
+Use `@vielzeug/forge` for typed form state. `useField()` remains intentionally narrow: it connects a form-associated
+custom element to native `ElementInternals` without imposing submission, validation, or dirty-state policy.
+
+```ts
+import { createForm } from '@vielzeug/forge';
+import { define, html } from '@vielzeug/ore';
+
+define('signup-form', {
+  setup(_props) {
+    const form = createForm({ initialValues: { email: '' } });
+
+    return html`
+       {
+          event.preventDefault();
+          void form.submit(async (values) => {
+            console.log(values);
+          });
+        }}>
+        
+      
+    `;
+  },
+});
+```
+
+## Best Practices
+
+- Setup returns `html\`...\`` directly — not a function wrapping the template.
+- Use `watchEffect()` for reactive subscriptions tied to component lifetime — it auto-registers cleanup on disconnect.
+- Use `onElement(ref, cb)` instead of `onMounted` when the work is tied to a single DOM node.
+- Bind host attributes and classes via `bind()` rather than mutating the element directly.
+- Provide context at the nearest ancestor — avoid global context singletons.
+- Call `onCleanup()` for every resource allocated in `setup()` (WebSockets, intervals, external subscriptions).
+- Use `live(signal)` for form inputs to prevent clobbering user-in-progress edits.
+- Extract composable helper functions freely — `onMounted`/`onCleanup`/`bind`/... resolve the active component through implicit context, so they work from any function called (transitively) during `setup()`, with no need to pass them in as parameters.
+- Test component mounting and lifecycle with `@vielzeug/ore/testing`; import generic DOM events, queries, and waits
+  from `@vielzeug/assay`.
+
+### Examples
+
+## Examples
+
+- [Counter Component](./examples/counter-component.md)
+- [Typed Props And Emits](./examples/typed-props-and-emits.md)
+- [Observers In onMounted()](./examples/observers-in-onmount.md)
+- [Search List With Directives](./examples/search-list-with-directives.md)
+- [Context Provider And Consumer](./examples/context-provider-and-consumer.md)
+- [Prop Helpers And Raw PropDef](./examples/propsof-builder-api.md)
+- [Form Associated Rating Input](./examples/form-associated-rating-input.md)
+- [Test Example With @vielzeug/ore/testing](./examples/test-example-at-vielzeug-ore-testing.md)
+
+---
+
+## @vielzeug/postmaster
+
+**Category:** Async
+
+### Overview
+
+## Why Postmaster?
+
+Application jobs that touch a remote service — posting a form, syncing state, sending analytics — must survive page reloads, resume later, retry according to an explicit policy, and retain terminal failures for recovery. Postmaster coordinates that delivery with typed job definitions, leased processing, and a dead-letter queue, all backed by IndexedDB.
+
+```ts
+// Before
+async function createTodo(payload: { id: string; title: string }) {
+  // Lost on reload. No retry. No recovery. Silent failure.
+  await fetch('/api/todos', { method: 'POST', body: JSON.stringify(payload) });
+}
+
+// After
+import { createPostmaster, defineJobs } from '@vielzeug/postmaster';
+import { createIndexedDbPostmasterStore } from '@vielzeug/postmaster/indexeddb';
+import { s } from '@vielzeug/spell';
+
+const jobs = defineJobs({
+  createTodo: {
+    version: 1,
+    validate: s.object({ id: s.string(), title: s.string() }),
+    key: (p) => p.id,
+    execute: async (payload, { key, signal }) => {
+      await fetch('/api/todos', {
+        method: 'POST',
+        body: JSON.stringify(payload),
+        headers: { 'Idempotency-Key': key },
+        signal,
+      });
+    },
+  },
+});
+
+const store = createIndexedDbPostmasterStore({ name: 'my-app-outbox' });
+const postmaster = createPostmaster({ jobs, store });
+
+await postmaster.enqueue('createTodo', { id: crypto.randomUUID(), title: 'Buy milk' });
+await postmaster.start();
+```
+
+| Feature | Postmaster | Ad hoc outbox | Familiar |
+| --- | --- | --- | --- |
+| Bundle size |  | Application-defined |  |
+| Zero dependencies |  |  |  |
+| Survives page reload |  |  |  |
+| Leased cross-tab processing |  |  |  |
+| Dead-letter recovery |  |  |  |
+| Typed job payloads |  |  |  |
+
+**Use Postmaster when** application jobs must survive reloads, retry explicitly, and remain recoverable after terminal failure.
+
+**Consider Familiar when** jobs are CPU-bound, in-memory only, and never need to survive a page reload.
+
+## Installation
+
+```sh [pnpm]
+pnpm add @vielzeug/postmaster
+```
+
+```sh [npm]
+npm install @vielzeug/postmaster
+```
+
+```sh [yarn]
+yarn add @vielzeug/postmaster
+```
+
+For browser persistence, also install `@vielzeug/vault` (a workspace peer of the IndexedDB adapter):
+
+```sh [pnpm]
+pnpm add @vielzeug/postmaster @vielzeug/vault
+```
+
+```sh [npm]
+npm install @vielzeug/postmaster @vielzeug/vault
+```
+
+```sh [yarn]
+yarn add @vielzeug/postmaster @vielzeug/vault
+```
+
+## Quick Start
+
+Define typed jobs, create a durable store, enqueue work, and start the processor. Dispose both the processor and the store when the page lifetime ends.
+
+```ts
+import { createPostmaster, defineJobs } from '@vielzeug/postmaster';
+import { createIndexedDbPostmasterStore } from '@vielzeug/postmaster/indexeddb';
+
+const jobs = defineJobs({
+  createTodo: {
+    version: 1,
+    validate: (v: unknown) => v as { id: string; title: string },
+    key: (p) => p.id,
+    execute: async (payload, { key, signal }) => {
+      await fetch('/api/todos', {
+        method: 'POST',
+        body: JSON.stringify(payload),
+        headers: { 'Idempotency-Key': key },
+        signal,
+      });
+    },
+    retry: { maxAttempts: 5, shouldRetry: () => true },
+  },
+});
+
+const store = createIndexedDbPostmasterStore({ name: 'my-app-outbox' });
+const postmaster = createPostmaster({ jobs, store });
+
+await postmaster.enqueue('createTodo', { id: crypto.randomUUID(), title: 'Buy milk' });
+await postmaster.start();
+
+// On page unload:
+await postmaster.dispose();
+await store.dispose();
+```
+
+## Features
+
+- `defineJobs()` — Typed job registry with payload inference and validation.
+- `createPostmaster()` — Processor with leased claims, heartbeat renewal, and crash recovery.
+- `enqueue()` — Persist a job and wake the processor, with optional delayed eligibility via `availableAt`.
+- `flush()` — Process every available job until the queue is empty.
+- `retry()` / `remove()` — Recover or discard dead-letter jobs.
+- `tap()` — Typed runtime events for enqueued, started, completed, retry-scheduled, dead-lettered, removed, lease-lost, and processor-error.
+- `createIndexedDbPostmasterStore()` — Durable browser store backed by Vault IndexedDB.
+- `createMemoryPostmasterStore()` — Deterministic in-memory store for tests.
+
+## Documentation
+
+- [**Usage Guide**](./usage.md)
+- [**API Reference**](./api.md)
+- [**Examples**](./examples.md)
+
+## See Also
+
+- [@vielzeug/courier](../courier/) — Perform the HTTP requests Postmaster jobs coordinate.
+- [@vielzeug/vault](../vault/) — IndexedDB storage primitive backing the durable store.
+- [@vielzeug/sentinel](../sentinel/) — Flush the outbox when the network returns.
+- [@vielzeug/familiar](../familiar/) — In-memory Web Worker pool for CPU-bound tasks.
+
+### API Reference
+
+## API Overview
+
+| Symbol | Purpose | Execution mode | Common gotcha |
+| --- | --- | --- | --- |
+| `defineJobs()` | Typed job registry with validation | Sync | Throws on invalid version, missing fields, or bad retry config |
+| `createPostmaster()` | Processor with leased claims and retry | Sync | Store is borrowed, not disposed with the processor |
+| `createIndexedDbPostmasterStore()` | Durable browser store | Sync | Requires `@vielzeug/vault` as a workspace peer |
+| `createMemoryPostmasterStore()` | Deterministic in-memory store | Sync | Use for tests only |
+| `PostmasterError` | Base class for package errors | Sync | Catch a subtype when recovery is specific |
+
+## Package Entry Point
+
+| Import | Purpose |
+| --- | --- |
+| `@vielzeug/postmaster` | Job definitions, processor, store contract, events, errors |
+| `@vielzeug/postmaster/indexeddb` | Durable browser store backed by Vault IndexedDB |
+| `@vielzeug/postmaster/testing` | Deterministic in-memory store and test helpers |
+
+## Factories
+
+### `defineJobs()`
+
+```ts
+function defineJobs(jobs: J): J;
+```
+
+Returns the job registry after validating each definition. Rejects invalid versions, missing `execute`/`key`, and retry configurations with non-positive `maxAttempts`.
+
+| Parameter | Type | Description |
+| --- | --- | --- |
+| `jobs` | `J extends JobDefinitions` | Map of job name to definition |
+
+**Returns:** `J` — the same registry, typed for payload inference.
+
+**Example**
+
+```ts
+import { defineJobs } from '@vielzeug/postmaster';
+
+const jobs = defineJobs({
+  createTodo: {
+    version: 1,
+    validate: (v) => v as { id: string; title: string },
+    key: (p) => p.id,
+    execute: async (payload, { key, signal }) => {
+      await fetch('/api/todos', {
+        method: 'POST',
+        body: JSON.stringify(payload),
+        headers: { 'Idempotency-Key': key },
+        signal,
+      });
+    },
+  },
+});
+```
+
+---
+
+### `createPostmaster()`
+
+```ts
+function createPostmaster(options: CreatePostmasterOptions): Postmaster;
+```
+
+Returns a Postmaster processor that claims, executes, retries, and dead-letters jobs from the borrowed store.
+
+| Parameter | Type | Description |
+| --- | --- | --- |
+| `options.jobs` | `J` | Job registry from `defineJobs()` |
+| `options.store` | `PostmasterStore` | Borrowed store; not disposed with the processor |
+| `options.leaseDuration` | `number` | Lease duration in ms (default 30000, minimum 1000) |
+| `options.clock` | `() => number` | Deterministic clock for tests (default `Date.now`) |
+| `options.signal` | `AbortSignal` | External signal that disposes the processor |
+
+**Returns:** `Postmaster`.
+
+**Example**
+
+```ts
+import { createPostmaster } from '@vielzeug/postmaster';
+import { createIndexedDbPostmasterStore } from '@vielzeug/postmaster/indexeddb';
+
+const store = createIndexedDbPostmasterStore({ name: 'outbox' });
+const postmaster = createPostmaster({ jobs, store });
+
+await postmaster.start();
+await postmaster.dispose();
+await store.dispose();
+```
+
+---
+
+### `createIndexedDbPostmasterStore()`
+
+```ts
+function createIndexedDbPostmasterStore(options: { name: string }): PostmasterStore;
+```
+
+Returns a durable Postmaster store backed by Vault IndexedDB. Uses one internal table indexed by `status`, `availableAt`, and `leaseExpiresAt`. All operations run inside Vault transactions.
+
+| Parameter | Type | Description |
+| --- | --- | --- |
+| `options.name` | `string` | IndexedDB database name |
+
+**Returns:** `PostmasterStore`.
+
+**Example**
+
+```ts
+import { createIndexedDbPostmasterStore } from '@vielzeug/postmaster/indexeddb';
+
+const store = createIndexedDbPostmasterStore({ name: 'my-app-outbox' });
+await store.dispose();
+```
+
+---
+
+### `createMemoryPostmasterStore()`
+
+```ts
+function createMemoryPostmasterStore(entries?: readonly StoredJob[]): PostmasterStore;
+```
+
+Returns a deterministic in-memory store for tests. Serializes all operations through a promise chain.
+
+| Parameter | Type | Description |
+| --- | --- | --- |
+| `entries` | `readonly StoredJob[]` | Initial records (default empty) |
+
+**Returns:** `PostmasterStore`.
+
+**Example**
+
+```ts
+import { createMemoryPostmasterStore } from '@vielzeug/postmaster/testing';
+
+const store = createMemoryPostmasterStore();
+await store.dispose();
+```
+
+## Postmaster Methods
+
+### `enqueue()`
+
+```ts
+enqueue(
+  name: K,
+  payload: InferJobPayload,
+  options?: EnqueueOptions,
+): Promise;
+```
+
+Validates the payload (if `validate` is defined), derives the key, persists the job, and wakes the processor. Throws `PostmasterError` for an empty key, non-JSON-serializable payload, or invalid `availableAt`.
+
+| Parameter | Type | Description |
+| --- | --- | --- |
+| `name` | `K` | Registered job name |
+| `payload` | `InferJobPayload` | Job payload (validated if `validate` is defined) |
+| `options.availableAt` | `number` | Earliest epoch timestamp (ms) the job may be claimed. Defaults to the Postmaster clock. Must be a finite non-negative safe integer. |
+
+**Delayed eligibility.** The job persists immediately but cannot be claimed before `availableAt`. Postmaster does not guarantee execution at that time — only that the job will not be claimed earlier. A live processor (`start()` or `flush()`) is required for execution. Past timestamps remain immediately eligible.
+
+**Example**
+
+```ts
+await postmaster.enqueue('sendDigest', { userId }, { availableAt: Date.now() + 60_000 });
+```
+
+---
+
+### `start()`
+
+```ts
+start(): Promise;
+```
+
+Begins background processing. Idempotent.
+
+---
+
+### `flush()`
+
+```ts
+flush(options?: { signal?: AbortSignal }): Promise;
+```
+
+Processes every available job until the queue is empty or the signal aborts. Concurrent `flush()` calls join the same drain. Returns counts of processed, completed, dead-lettered, and retry-scheduled jobs.
+
+---
+
+### `list()`
+
+```ts
+list(filter?: EntryFilter): Promise;
+```
+
+Returns entries ordered by `createdAt`. Filter by `status` optionally.
+
+---
+
+### `stats()`
+
+```ts
+stats(): Promise;
+```
+
+Returns counts of queued, running, and dead-letter jobs.
+
+---
+
+### `retry()`
+
+```ts
+retry(id: string): Promise;
+```
+
+Moves a dead-letter job back to queued. Returns a discriminated result: `retried`, `not-found`, `not-dead-letter`, or `running`.
+
+---
+
+### `remove()`
+
+```ts
+remove(id: string): Promise;
+```
+
+Deletes a queued or dead-letter job. Returns a discriminated result: `removed`, `not-found`, or `running`.
+
+---
+
+### `tap()`
+
+```ts
+tap(handler: (event: PostmasterEvent) => void, options?: { signal?: AbortSignal }): () => void;
+```
+
+Observe runtime events (enqueued, started, completed, retry-scheduled, dead-lettered, removed, lease-lost, processor-error, dispose). Handler errors are swallowed — observability never affects processing. Returns an unsubscribe function. Pass `{ signal }` to auto-detach on abort.
+
+---
+
+### `dispose()`
+
+```ts
+dispose(): Promise;
+[Symbol.asyncDispose](): Promise;
+```
+
+Aborts owned work, releases all active leases, and tears down subscriptions. Idempotent. Does not dispose the borrowed store.
+
+## Types
+
+### `EnqueueOptions`
+
+```ts
+interface EnqueueOptions {
+  readonly availableAt?: number;
+}
+```
+
+Options for `enqueue()`. `availableAt` is the earliest epoch timestamp (ms) at which the job may be claimed. Defaults to the Postmaster clock at enqueue time. Past timestamps remain immediately eligible. Postmaster does not guarantee execution at the requested time — only that the job will not be claimed before it. A live processor is required for execution.
+
+---
+
+### `JobDefinition`
+
+```ts
+interface JobDefinition {
+  readonly version: number;
+  readonly validate?: Validate;
+  readonly key: (payload: T) => string;
+  readonly execute: (payload: T, context: JobContext) => Promise;
+  readonly retry?: RetryPolicy;
+  readonly migrate?: (payload: unknown, fromVersion: number) => unknown;
+}
+```
+
+`validate` is optional. Accepts a function `(value: unknown) => T` or any structural parser with `parse(value: unknown): T` (Spell schemas, Zod schemas, etc). Called once at enqueue. If omitted, payload trusted as-is.
+
+---
+
+### `Validate`
+
+```ts
+type Validate = ((value: unknown) => T) | { parse(value: unknown): T };
+```
+
+Accepts either a plain validation function or any object with a `parse(value: unknown): T` method. Spell's `Schema` and `s.object(...)` satisfy this contract directly — no adapter needed.
+
+---
+
+### `JobContext`
+
+```ts
+interface JobContext {
+  readonly attempt: number;
+  readonly entryId: string;
+  readonly key: string;
+  readonly signal: AbortSignal;
+}
+```
+
+---
+
+### `RetryPolicy`
+
+```ts
+interface RetryPolicy {
+  readonly maxAttempts: number;
+  readonly shouldRetry: (error: unknown, attempt: number) => boolean;
+  readonly delay?: (attempt: number) => number;
+}
+```
+
+`maxAttempts` is total executions including the first. `shouldRetry` is required when retries are enabled. Default delay uses Arsenal's `backoff(attempt)`.
+
+---
+
+### `StoredJob`
+
+```ts
+interface StoredJob {
+  readonly id: string;
+  readonly name: string;
+  readonly version: number;
+  readonly payload: JsonValue;
+  readonly key: string;
+  readonly status: 'queued' | 'running' | 'dead-letter';
+  readonly attempts: number;
+  readonly createdAt: number;
+  readonly updatedAt: number;
+  readonly availableAt: number;
+  readonly ownerId?: string;
+  readonly leaseExpiresAt?: number;
+  readonly failure?: StoredFailure;
+}
+```
+
+---
+
+### `StoredFailure`
+
+```ts
+interface StoredFailure {
+  readonly name: string;
+  readonly message: string;
+  readonly occurredAt: number;
+}
+```
+
+Only a bounded error name/message/timestamp is persisted. Never persist arbitrary error objects, response bodies, headers, or stacks.
+
+---
+
+### `PostmasterEntry`
+
+```ts
+type PostmasterEntry = Pick;
+```
+
+The public entry view excludes `payload`, `ownerId`, and `leaseExpiresAt`.
+
+---
+
+### `PostmasterStore`
+
+```ts
+interface PostmasterStore {
+  transact(fn: (tx: StoreTx) => Promise): Promise;
+  list(filter?: EntryFilter): Promise;
+  subscribe(listener: () => void): () => void;
+  dispose(): Promise;
+  readonly disposed: boolean;
+  readonly disposalSignal: AbortSignal;
+  [Symbol.asyncDispose](): Promise;
+}
+
+interface StoreTx {
+  get(id: string): Promise;
+  put(entry: StoredJob): Promise;
+  delete(id: string): Promise;
+  findClaimable(now: number): Promise;
+  findNextWake(now: number): Promise;
+  countByStatus(): Promise;
+}
+```
+
+The store exposes transactional primitives. The processor owns all ownership and transition logic — stores implement storage, not the job state machine. `transact` wraps all operations in an atomic transaction. `findClaimable` returns the earliest eligible job (queued with `availableAt <= now`, or running with expired lease). `findNextWake` returns the earliest future wake time across queued and running jobs.
+
+---
+
+### `PostmasterEvent`
+
+```ts
+type PostmasterEvent =
+  | { readonly type: 'enqueued' | 'started' | 'completed' | 'retry-scheduled' | 'dead-lettered'; readonly entry: PostmasterEntry }
+  | { readonly type: 'removed' | 'lease-lost'; readonly id: string }
+  | { readonly type: 'processor-error'; readonly error: Error }
+  | { readonly type: 'dispose' };
+```
+
+---
+
+### `FlushResult`
+
+```ts
+interface FlushResult {
+  readonly processed: number;
+  readonly completed: number;
+  readonly deadLettered: number;
+  readonly retryScheduled: number;
+}
+```
+
+---
+
+### `RetryResult` / `RemoveResult`
+
+```ts
+type RetryResult =
+  | { readonly status: 'not-found' | 'not-dead-letter' | 'running' }
+  | { readonly status: 'retried'; readonly entry: PostmasterEntry };
+
+type RemoveResult =
+  | { readonly status: 'not-found' | 'running' }
+  | { readonly status: 'removed'; readonly id: string };
+```
+
+## Errors
+
+### `PostmasterError`
+
+```ts
+class PostmasterError extends Error {
+  constructor(message: string, options?: ErrorOptions);
+}
+```
+
+Base class for package-defined errors. Use `instanceof PostmasterError` to narrow to the hierarchy. Covers configuration errors, serialization errors, and store failures.
+
+---
+
+### `PostmasterDisposedError`
+
+```ts
+class PostmasterDisposedError extends PostmasterError {}
+```
+
+Thrown when a public method is called after disposal.
+
+---
+
+### `PostmasterJobError`
+
+```ts
+class PostmasterJobError extends PostmasterError {}
+```
+
+Thrown when a job definition is missing, a version is incompatible, or a migration fails. These errors move the job to dead-letter rather than rejecting the public call.
+
+### Usage Guide
+
+## Basic Usage
+
+Define typed jobs, create a durable store, enqueue work, and start the processor. Dispose both handles when the owner ends.
+
+```ts
+import { createPostmaster, defineJobs } from '@vielzeug/postmaster';
+import { createIndexedDbPostmasterStore } from '@vielzeug/postmaster/indexeddb';
+
+const jobs = defineJobs({
+  createTodo: {
+    version: 1,
+    validate: (v: unknown) => v as { id: string; title: string },
+    key: (p) => p.id,
+    execute: async (payload, { key, signal }) => {
+      await fetch('/api/todos', {
+        method: 'POST',
+        body: JSON.stringify(payload),
+        headers: { 'Idempotency-Key': key },
+        signal,
+      });
+    },
+  },
+});
+
+const store = createIndexedDbPostmasterStore({ name: 'my-app-outbox' });
+const postmaster = createPostmaster({ jobs, store });
+
+await postmaster.enqueue('createTodo', { id: crypto.randomUUID(), title: 'Buy milk' });
+await postmaster.start();
+
+// On page unload:
+await postmaster.dispose();
+await store.dispose();
+```
+
+The store is borrowed by `createPostmaster()` and is not disposed with the processor. Dispose both explicitly.
+
+## At-least-once delivery and idempotency
+
+Postmaster provides **at-least-once delivery**. A crash after the remote write but before local completion can repeat the job. Every job must derive a stable idempotency key, and handlers must send or otherwise enforce that key.
+
+```ts
+const jobs = defineJobs({
+  createTodo: {
+    version: 1,
+    validate: (v: unknown) => v as { id: string; title: string },
+    key: (p) => p.id,
+    execute: async (payload, { key, signal }) => {
+      await fetch('/api/todos', {
+        method: 'POST',
+        body: JSON.stringify(payload),
+        headers: { 'Idempotency-Key': key },
+        signal,
+      });
+    },
+  },
+});
+```
+
+Never assume exactly-once execution. Design handlers so a repeated delivery is safe.
+
+## Postmaster jobs vs Courier mutations
+
+Courier performs immediate HTTP requests and cache reconciliation. Postmaster coordinates durable delivery. Use Courier inside a Postmaster job when the write must survive reloads.
+
+```ts
+import { createCourier, CourierNetworkError } from '@vielzeug/courier';
+import { createPostmaster, defineJobs } from '@vielzeug/postmaster';
+
+const courier = createCourier({ baseUrl: 'https://api.example.com' });
+
+const jobs = defineJobs({
+  createTodo: {
+    version: 1,
+    validate: (v: unknown) => v as { id: string; title: string },
+    key: (p) => p.id,
+    execute: async (payload, { key, signal }) => {
+      await courier.mutate({
+        request: () =>
+          courier.post('/todos', {
+            body: payload,
+            headers: { 'Idempotency-Key': key },
+            signal,
+          }),
+        invalidateKeys: [['todos']],
+      });
+    },
+    retry: { maxAttempts: 5, shouldRetry: (error) => error instanceof CourierNetworkError },
+  },
+});
+```
+
+Postmaster does not import Courier. The integration happens in your job definitions.
+
+## Payload and version migration
+
+Each job declares a `version` and an optional `validate` function. When a stored job's version is older than the registered version, Postmaster calls `migrate()` before validating. `validate` is called once at enqueue; omit it to accept the payload as-is. `validate` accepts a plain function `(value: unknown) => T` or any structural parser with `parse(value: unknown): T` — Spell schemas work directly:
+
+```ts
+import { s } from '@vielzeug/spell';
+
+const jobs = defineJobs({
+  createTodo: {
+    version: 2,
+    validate: s.object({ id: s.string(), title: s.string(), priority: s.number().optional() }),
+    key: (p) => p.id,
+    migrate: (payload, fromVersion) => {
+      if (fromVersion === 1) return { ...(payload as { id: string; title: string }), priority: 0 };
+      return payload;
+    },
+    execute: async (payload, { key, signal }) => {
+      await fetch('/api/todos', {
+        method: 'POST',
+        body: JSON.stringify(payload),
+        headers: { 'Idempotency-Key': key },
+        signal,
+      });
+    },
+  },
+});
+```
+
+Unknown job names, incompatible versions, failed migrations, and invalid persisted payloads move to dead-letter rather than being executed.
+
+## Retry semantics
+
+Retries are opt-in and explicitly classified. No `retry` block means one attempt followed by dead-letter.
+
+```ts
+const jobs = defineJobs({
+  syncTodo: {
+    version: 1,
+    validate: (v: unknown) => v as { id: string },
+    key: (p) => p.id,
+    execute: async (payload, { signal }) => {
+      await fetch(`/api/todos/${payload.id}/sync`, { signal });
+    },
+    retry: {
+      maxAttempts: 5,
+      shouldRetry: (error) => error instanceof TypeError, // network errors only
+    },
+  },
+});
+```
+
+- `maxAttempts` means total executions, including the first.
+- `shouldRetry` is required when retries are enabled. Postmaster never guesses whether a write is safe to repeat.
+- Default delay uses Arsenal's deterministic `backoff(attempt)` helper. Override with `delay`.
+- Delay must be finite and non-negative.
+- Lifecycle aborts caused by disposal are not classified as job failures.
+
+## Delayed eligibility
+
+`enqueue()` accepts an optional `availableAt` timestamp. The job persists immediately but cannot be claimed before that time. Use this for scheduled writes, cooldowns, or any work that must survive a reload but should not run yet.
+
+```ts
+await postmaster.enqueue('sendDigest', { userId }, { availableAt: Date.now() + 60_000 });
+```
+
+Postmaster does not guarantee execution at `availableAt` — only that the job will not be claimed earlier. A live processor (`start()` or `flush()`) is required for execution. In a browser, a closed page or suspended service worker will run the job when the processor next becomes active. Past timestamps remain immediately eligible. The same mechanism already backs retry delays, so delayed eligibility reuses the existing claim, wake, and persistence paths.
+
+## Dead-letter recovery
+
+Jobs that exhaust retries or hit a terminal failure move to dead-letter. Inspect, retry, or remove them.
+
+```ts
+const deadLettered = await postmaster.list({ status: 'dead-letter' });
+
+for (const entry of deadLettered) {
+  console.log(entry.id, entry.name, entry.failure);
+}
+
+// Retry a dead-letter job back into the queue.
+await postmaster.retry(entry.id);
+
+// Or remove it permanently.
+await postmaster.remove(entry.id);
+```
+
+`retry()` and `remove()` return discriminated results so callers can distinguish `not-found`, `not-dead-letter`, `running`, and successful outcomes without exceptions.
+
+## Lifecycle and disposal
+
+`start()` begins background processing. `dispose()` stops claiming new work, aborts owned work, and is idempotent. `flush()` processes every available job synchronously.
+
+```ts
+await postmaster.start();
+// ...on unload
+await postmaster.dispose();
+await store.dispose();
+```
+
+Disposal aborts owned work, releases the active lease, and is idempotent. A controlled disposal abort does not consume the attempt — the job returns to queued.
+
+## Events
+
+Tap runtime events for observability. Handler errors are swallowed — observability never affects processing.
+
+```ts
+const unsubscribe = postmaster.tap((event) => {
+  switch (event.type) {
+    case 'enqueued':
+      console.log('enqueued', event.entry.id);
+      break;
+    case 'completed':
+      console.log('completed', event.entry.id);
+      break;
+    case 'dead-lettered':
+      console.error('dead-lettered', event.entry.id, event.entry.failure);
+      break;
+    case 'processor-error':
+      console.error('processor error', event.error);
+      break;
+  }
+});
+```
+
+Pass an `AbortSignal` to auto-detach:
+
+```ts
+const controller = new AbortController();
+postmaster.tap(handler, { signal: controller.signal });
+controller.abort(); // stops tapping
+```
+
+## Testing
+
+Use the in-memory store for deterministic tests.
+
+```ts
+import { createPostmaster, defineJobs } from '@vielzeug/postmaster';
+import { createMemoryPostmasterStore } from '@vielzeug/postmaster/testing';
+
+const store = createMemoryPostmasterStore();
+const postmaster = createPostmaster({
+  jobs: defineJobs({
+    send: {
+      version: 1,
+      validate: (v: unknown) => String(v),
+      key: (p) => p,
+      execute: async () => {},
+    },
+  }),
+  store,
+});
+
+await postmaster.enqueue('send', 'hello');
+await postmaster.flush();
+await postmaster.dispose();
+```
+
+Inject a deterministic clock to control retry scheduling.
+
+```ts
+let now = 0;
+const postmaster = createPostmaster({ clock: () => now, jobs, store });
+```
+
+## Framework Integration
+
+Create the Postmaster after the component mounts, start processing, and dispose on unmount.
+
+```tsx [React]
+import { createIndexedDbPostmasterStore } from '@vielzeug/postmaster/indexeddb';
+import { createPostmaster, defineJobs, type Postmaster } from '@vielzeug/postmaster';
+import { useEffect } from 'react';
+
+const jobs = defineJobs({
+  sync: {
+    version: 1,
+    validate: (v: unknown) => v as { id: string },
+    key: (p) => p.id,
+    execute: async (payload, { signal }) => {
+      await fetch(`/api/sync/${payload.id}`, { signal });
+    },
+  },
+});
+
+export function OutboxProvider() {
+  useEffect(() => {
+    const store = createIndexedDbPostmasterStore({ name: 'outbox' });
+    const postmaster = createPostmaster({ jobs, store });
+    void postmaster.start();
+
+    return () => {
+      void postmaster.dispose();
+      void store.dispose();
+    };
+  }, []);
+
+  return null;
+}
+```
+
+```vue [Vue 3]
+
+import { createIndexedDbPostmasterStore } from '@vielzeug/postmaster/indexeddb';
+import { createPostmaster, defineJobs } from '@vielzeug/postmaster';
+import { onMounted, onUnmounted } from 'vue';
+
+const jobs = defineJobs({
+  sync: {
+    version: 1,
+    validate: (v: unknown) => v as { id: string },
+    key: (p) => p.id,
+    execute: async (payload, { signal }) => {
+      await fetch(`/api/sync/${payload.id}`, { signal });
+    },
+  },
+});
+
+let postmaster: ReturnType | undefined;
+let store: ReturnType | undefined;
+
+onMounted(() => {
+  store = createIndexedDbPostmasterStore({ name: 'outbox' });
+  postmaster = createPostmaster({ jobs, store });
+  void postmaster.start();
+});
+
+onUnmounted(() => {
+  void postmaster?.dispose();
+  void store?.dispose();
+});
 
   
 
@@ -14200,92 +15264,117 @@ const open = ref(false);
 
 ```svelte [Svelte]
 
-  import './x-toggle'; // wherever define('x-toggle', { ... }) is called
+  import { createIndexedDbPostmasterStore } from '@vielzeug/postmaster/indexeddb';
+  import { createPostmaster, defineJobs } from '@vielzeug/postmaster';
+  import { onMount } from 'svelte';
 
-  function handleClick() {
-    console.log('toggled');
-  }
+  const jobs = defineJobs({
+    sync: {
+      version: 1,
+      validate: (v: unknown) => v as { id: string },
+      key: (p) => p.id,
+      execute: async (payload, { signal }) => {
+        await fetch(`/api/sync/${payload.id}`, { signal });
+      },
+    },
+  });
+
+  onMount(() => {
+    const store = createIndexedDbPostmasterStore({ name: 'outbox' });
+    const postmaster = createPostmaster({ jobs, store });
+    void postmaster.start();
+
+    return () => {
+      void postmaster.dispose();
+      void store.dispose();
+    };
+  });
 
 ```
 
 ## Working with Other Vielzeug Libraries
 
-### With Ripple
+### Postmaster + Courier
 
-Import ripple primitives directly from `@vielzeug/ripple` for standalone reactive state outside components.
+Use Courier inside job handlers for HTTP transport and cache invalidation. Postmaster coordinates delivery; Courier performs the request.
 
 ```ts
-import { signal, computed } from '@vielzeug/ripple';
-import { define, html } from '@vielzeug/ore';
+import { createCourier, CourierNetworkError } from '@vielzeug/courier';
+import { createPostmaster, defineJobs } from '@vielzeug/postmaster';
 
-// Shared state created outside any component
-const theme = signal('light');
-const isDark = computed(() => theme.value === 'dark');
+const courier = createCourier({ baseUrl: 'https://api.example.com' });
 
-define('theme-toggle', {
-  setup() {
-    return html`
-       (theme.value = isDark.value ? 'light' : 'dark')}>
-        ${() =>
-          isDark.value ? '' : ''}
-      
-    `;
+const jobs = defineJobs({
+  createTodo: {
+    version: 1,
+    validate: (v: unknown) => v as { id: string; title: string },
+    key: (p) => p.id,
+    execute: async (payload, { key, signal }) => {
+      await courier.mutate({
+        request: () =>
+          courier.post('/todos', {
+            body: payload,
+            headers: { 'Idempotency-Key': key },
+            signal,
+          }),
+        invalidateKeys: [['todos']],
+      });
+    },
+    retry: { maxAttempts: 5, shouldRetry: (e) => e instanceof CourierNetworkError },
   },
 });
 ```
 
-### With Forge
+### Postmaster + Sentinel
 
-Use `@vielzeug/forge` for typed form state. `useField()` remains intentionally narrow: it connects a form-associated
-custom element to native `ElementInternals` without imposing submission, validation, or dirty-state policy.
+Flush the outbox when the network returns. Sentinel reports online state; Postmaster does the rest.
 
 ```ts
-import { createForm } from '@vielzeug/forge';
-import { define, html } from '@vielzeug/ore';
+import { createNetwork } from '@vielzeug/sentinel';
+import { createPostmaster } from '@vielzeug/postmaster';
 
-define('signup-form', {
-  setup(_props) {
-    const form = createForm({ initialValues: { email: '' } });
+const network = createNetwork();
+const postmaster = createPostmaster({ jobs, store });
 
-    return html`
-       {
-          event.preventDefault();
-          void form.submit(async (values) => {
-            console.log(values);
-          });
-        }}>
-        
-      
-    `;
-  },
+const unsubscribe = network.subscribe(() => {
+  if (network.value.online) void postmaster.flush();
 });
+
+// On teardown:
+unsubscribe();
+network.dispose();
+await postmaster.dispose();
 ```
 
+### Postmaster + Vault
+
+The IndexedDB adapter is built on Vault. Use Vault directly for unrelated storage; the Postmaster store owns its own database name.
+
 ## Best Practices
 
-- Setup returns `html\`...\`` directly — not a function wrapping the template.
-- Use `watchEffect()` for reactive subscriptions tied to component lifetime — it auto-registers cleanup on disconnect.
-- Use `onElement(ref, cb)` instead of `onMounted` when the work is tied to a single DOM node.
-- Bind host attributes and classes via `bind()` rather than mutating the element directly.
-- Provide context at the nearest ancestor — avoid global context singletons.
-- Call `onCleanup()` for every resource allocated in `setup()` (WebSockets, intervals, external subscriptions).
-- Use `live(signal)` for form inputs to prevent clobbering user-in-progress edits.
-- Extract composable helper functions freely — `onMounted`/`onCleanup`/`bind`/... resolve the active component through implicit context, so they work from any function called (transitively) during `setup()`, with no need to pass them in as parameters.
-- Test component mounting and lifecycle with `@vielzeug/ore/testing`; import generic DOM events, queries, and waits
-  from `@vielzeug/assay`.
+- **Derive** a stable idempotency key from every job payload and send it with the remote write.
+- **Dispose** both the processor and the store explicitly; the processor does not own the store.
+- **Classify** retryable errors explicitly with `shouldRetry`; never let Postmaster guess.
+- **Migrate** persisted payloads when job versions change; test migrations against stored fixtures.
+- **Inspect** the dead-letter queue regularly and retry or remove terminal failures.
+- **Avoid** persisting sensitive data in payloads or failure messages; IndexedDB is per-origin but not encrypted.
+- **Flush** the outbox when Sentinel reports the network returns.
+- **Test** with the in-memory store and a deterministic clock for reproducible retry timing.
 
 ### Examples
 
 ## Examples
 
-- [Counter Component](./examples/counter-component.md)
-- [Typed Props And Emits](./examples/typed-props-and-emits.md)
-- [Observers In onMounted()](./examples/observers-in-onmount.md)
-- [Search List With Directives](./examples/search-list-with-directives.md)
-- [Context Provider And Consumer](./examples/context-provider-and-consumer.md)
-- [Prop Helpers And Raw PropDef](./examples/propsof-builder-api.md)
-- [Form Associated Rating Input](./examples/form-associated-rating-input.md)
-- [Test Example With @vielzeug/ore/testing](./examples/test-example-at-vielzeug-ore-testing.md)
+- [Queue Offline Courier Mutations](./examples/queue-offline-courier-mutations.md)
+- [Resume When Network Returns](./examples/resume-when-network-returns.md)
+- [Delayed Eligibility](./examples/delayed-eligibility.md)
+- [Recover Dead-Letter Jobs](./examples/recover-dead-letter-jobs.md)
+- [Service Worker Background Sync](./examples/service-worker-background-sync.md)
+
+### REPL Examples
+
+- defineJobs - Basic Outbox (id: `define-jobs`)
+- delayedEnqueue - Delayed Eligibility (id: `delayed-enqueue`)
 
 ---
 
@@ -17067,7 +18156,10 @@ type Schema = {
 
 const pulse = createPulse('wss://api.example.com/ws', {
   reconnect: true,
-  onError: (error) => console.error(error),
+});
+pulse.tap((event) => {
+  if (event.type === 'error') console.error(event.error);
+  if (event.type === 'status-change') console.log('status:', event.status);
 });
 const chat = pulse.channel('chat');
 const lobby = pulse.room('lobby');
@@ -17091,7 +18183,7 @@ pulse.dispose();
 - **`room()`** — named, schema-bound ref-counted room scopes with optional reactive presence. The first scope sends `join`; the last disposal sends `leave`.
 - **`reconnect`** — ordered restoration of channel subscriptions, room memberships, and local presence state.
 - **`transform`** — one synchronous transform or filter for application messages.
-- **`onError`** — typed connection and protocol errors.
+- **`tap()`** — subscribe to lifecycle events (status changes, errors, disposal) via a typed `PulseEvent` stream.
 - **`heartbeat`** — ping/pong liveness detection that uses the same reconnect controller.
 - **`status` and `rooms`** — ripple readables for transport and confirmed membership state.
 
@@ -17120,7 +18212,7 @@ pulse.dispose();
 | `PulseChannel` | Scoped channel namespace with independent disposal. | Sync methods, async `wait()` | Each call returns a new scope; ref-counted subscription. |
 | `RoomScope` | Ref-counted room membership with optional presence. | Sync methods, async `joined` | `joined` rejects on transport close or timeout. |
 | `PulseSchema` | Declares server/client events, channels, and rooms. | Type-only | Infer all named scope types from this schema. |
-| `PulseOptions` | Configuration: heartbeat, reconnect, transform, onError. | Type-only | `reconnect` and `heartbeat` default to `false`. |
+| `PulseOptions` | Configuration: heartbeat, reconnect, transform. | Type-only | `reconnect` and `heartbeat` default to `false`. |
 | `PulseError` | Base class for all Pulse errors. | Runtime | Check `instanceof` against subclasses. |
 
 ## Package Entry Point
@@ -17183,7 +18275,6 @@ Declare all protocol surfaces once at construction. Named scopes infer their typ
 ```ts
 type PulseOptions = {
   heartbeat?: boolean | HeartbeatOptions;
-  onError?: (error: PulseError) => void;
   protocols?: string | string[];
   reconnect?: boolean | ReconnectOptions;
   transform?: OutgoingTransform;
@@ -17193,7 +18284,6 @@ type PulseOptions = {
 | Option | Type | Default | Description |
 | --- | --- | --- | --- |
 | `heartbeat` | `boolean \| HeartbeatOptions` | `false` | Ping/pong keep-alive. |
-| `onError` | `(error: PulseError) => void` | — | Receives typed transport and protocol errors. |
 | `protocols` | `string \| string[]` | — | Sub-protocols passed to the WebSocket constructor. |
 | `reconnect` | `boolean \| ReconnectOptions` | `false` | Auto-reconnect on unexpected close. |
 | `transform` | `OutgoingTransform` | — | Transform or filter outgoing application messages. |
@@ -17283,6 +18373,9 @@ type Pulse = {
   // Status
   readonly status: Readable;
 
+  // Tap
+  tap(handler: (event: PulseEvent) => void, options?: { signal?: AbortSignal }): () => void;
+
   [Symbol.dispose](): void;
 };
 ```
@@ -17331,6 +18424,42 @@ Reactive set of rooms the client is currently a confirmed member of.
 
 Reactive connection status: `'connecting' | 'open' | 'reconnecting' | 'closed'`.
 
+### `tap(handler, options?)`
+
+Subscribes to lifecycle events emitted by the Pulse instance. The handler receives a discriminated-union `PulseEvent`. Returns an unsubscribe function.
+
+| Parameter | Type | Description |
+| --- | --- | --- |
+| `handler` | `(event: PulseEvent) => void` | Called for each lifecycle event. |
+| `options.signal` | `AbortSignal` | Optional signal to stop the subscription. |
+
+```ts
+const pulse = createPulse(url, { reconnect: true });
+pulse.tap((event) => {
+  if (event.type === 'error') console.error(event.error);
+  if (event.type === 'status-change') console.log('status:', event.status);
+});
+```
+
+---
+
+## `PulseEvent`
+
+```ts
+type PulseEvent =
+  | { type: 'status-change'; status: PulseStatus }
+  | { type: 'error'; error: PulseError }
+  | { type: 'dispose' };
+```
+
+A discriminated union of lifecycle events emitted by a `Pulse` instance. Inspect `event.type` to narrow the payload.
+
+| `type` | Payload | When |
+| --- | --- | --- |
+| `status-change` | `status: PulseStatus` | The connection status transitions. |
+| `error` | `error: PulseError` | A typed transport or protocol error occurs. |
+| `dispose` | — | The instance is disposed. |
+
 ---
 
 ## `PulseChannel`
@@ -17561,7 +18690,11 @@ type Schema = {
 const pulse = createPulse('wss://api.example.com/ws', {
   reconnect: { delay: 1_000, maxAttempts: 5 },
   heartbeat: { interval: 30_000, timeout: 5_000 },
-  onError: (error) => console.error(error),
+});
+
+pulse.tap((event) => {
+  if (event.type === 'error') console.error(event.error);
+  if (event.type === 'status-change') console.log('status:', event.status);
 });
 
 try {
@@ -17733,13 +18866,17 @@ Disposal is idempotent. It closes the connection, rejects pending room joins, cl
 
 ```ts
 const pulse = createPulse('wss://api.example.com/ws', {
-  onError: (error) => {
-    if (error instanceof PulseConnectionError) {
-      console.error('Connection error:', error);
-    } else if (error instanceof PulseProtocolError) {
-      console.error('Protocol error:', error);
+  reconnect: true,
+});
+
+pulse.tap((event) => {
+  if (event.type === 'error') {
+    if (event.error instanceof PulseConnectionError) {
+      console.error('Connection error:', event.error);
+    } else if (event.error instanceof PulseProtocolError) {
+      console.error('Protocol error:', event.error);
     }
-  },
+  }
 });
 ```
 
@@ -17758,7 +18895,7 @@ const pulse = createPulse('wss://api.example.com/ws', {
 - Define the full schema at `createPulse()` so named scopes are type-safe without per-call generics.
 - Use `using` declarations for channel and room scopes so disposal is automatic at block exit.
 - Always call `dispose()` when done — it closes the connection, rejects pending joins, and clears listeners.
-- Provide an `onError` handler; Pulse reports transport and protocol errors there rather than throwing asynchronously.
+- Call `tap()` to observe lifecycle events; Pulse reports transport and protocol errors there rather than throwing asynchronously.
 - Read `pulse.rooms` for post-reconnect membership; `joined` rejects on transport close.
 - Set a `timeout` on room scopes when the server may never confirm membership.
 - Keep `transform` synchronous; resolve async policy decisions before calling `send()`.
@@ -21258,7 +22395,7 @@ console.log(results[0]?.item.name); // Ada Lovelace
 - Incremental updates — `add()` / `remove()` / `reindex()` patch individual items in O(field_length)
 - `onMutate()` — Subscribe to index mutations; powers `createSearch()`'s reactivity and bulk reconciliation
 - `segmentWords()` — Split unsegmented-script text (CJK, Thai, ...) into words via native `Intl.Segmenter`
-- Debug logging via `debugSearch()` (`@vielzeug/scout/devtools`) — logs query/results transitions, tree-shaken from production bundles
+- Event subscription via `search.tap()` — observe `query`/`isSearching`/`results`/`dispose` transitions; returns an unsubscribe function
 
 ## Documentation
 
@@ -21294,14 +22431,13 @@ console.log(results[0]?.item.name); // Ada Lovelace
 | `toSearchMatcher()`            | Adapt `ScoutIndex` to Sourcerer's `match` callback    | Sync           | Recomputes cached query matches after index mutation          |
 | `toFilterPredicate()`     | Snapshot predicate from a one-time query              | Sync           | Re-call when query or corpus changes                          |
 | `segmentWords()`          | Split unsegmented-script text (CJK, Thai, ...) into words | Sync       | Uses native `Intl.Segmenter` — not applied inside `tokenize()` itself (see Pitfalls) |
-| `debugSearch()`           | Log a `SearchState`'s query/results transitions       | Sync           | Import from `@vielzeug/scout/devtools`, not the main entry point |
+| `SearchState.tap()`       | Subscribe to `query`/`isSearching`/`results`/`dispose` events | Sync     | Returns an unsubscribe function; pass `{ signal }` to tie to an external lifecycle |
 
 ## Package Entry Point
 
 | Import | Purpose |
 | --- | --- |
-| `@vielzeug/scout` | All exports — index/search/highlighting/adapters, `ScoutConfigurationError`, `ScoutDisposedError`, `ScoutError`, and all types |
-| `@vielzeug/scout/devtools` | `debugSearch` — reactive search state logger (dev only) |
+| `@vielzeug/scout` | All exports — index/search/highlighting/adapters, `ScoutConfigurationError`, `ScoutDisposedError`, `ScoutError`, `ScoutEvent`, and all types |
 
 ---
 
@@ -21454,6 +22590,7 @@ function createSearch(index: ScoutIndex, options?: CreateSearchOptions): SearchS
 | `disposed` | `boolean` | `true` after `dispose()` has been called. |
 | `clear()` | `() => void` | Resets query, cancels debounce, clears results synchronously. |
 | `dispose()` | `() => void` | Releases all reactive subscriptions. |
+| `tap()` | `(handler, options?) => () => void` | Subscribe to `ScoutEvent` transitions; returns an unsubscribe function. |
 | `[Symbol.dispose]()` | `() => void` | `using`-compatible disposal. |
 
 **Example**
@@ -21664,35 +22801,39 @@ const index = createIndex(documents, {
 
 ---
 
-## `debugSearch(search)` 
+## `search.tap(handler, options?)`
+
+Subscribes `handler` to `ScoutEvent` transitions emitted by a `SearchState` — `query` changes, `isSearching` transitions, `results` changes, and `dispose`. Returns an unsubscribe function; calling it removes the handler. Pass `{ signal }` to tie the subscription to an external `AbortSignal` — when the signal aborts (or `dispose()` is called, which aborts `disposalSignal`) the handler is removed automatically.
 
 ```ts
-debugSearch(search: SearchState): () => void
+tap(
+  handler: (event: ScoutEvent) => void,
+  options?: { signal?: AbortSignal },
+): () => void
 ```
 
-Logs `query` → `isSearching` → `results` transitions of a `SearchState` to `console.debug`. Returns a function that unsubscribes all listeners installed by this call. Import from the dedicated sub-path so it's tree-shaken from production bundles.
-
-Logs the full, literal search query string — if your queries may carry PII (names, emails, medical/financial terms typed by end users), don't enable this in production.
-
 **Example**
 
 ```ts
 import { createIndex, createSearch } from '@vielzeug/scout';
-import { debugSearch } from '@vielzeug/scout/devtools';
 
 const index = createIndex([{ name: 'Ada Lovelace' }], { fields: ['name'] });
 const search = createSearch(index);
-const stopDebugging = debugSearch(search);
+
+const unsubscribe = search.tap((event) => {
+  if (event.type === 'query-change') console.debug('query:', event.query);
+  if (event.type === 'results-change') console.debug('results:', event.results.length);
+});
 
 search.query.value = 'alice';
-// [scout:search] query -> "alice"
-// [scout:search] isSearching -> true
-// [scout:search] isSearching -> false
-// [scout:search] results -> 1 item(s)
+// query: alice
+// results: 1
 
-stopDebugging();
+unsubscribe();
 ```
 
+If your queries may carry PII (names, emails, medical/financial terms typed by end users), don't log `query-change` events in production.
+
 ---
 
 ## Types
@@ -21778,12 +22919,32 @@ type SearchState = {
   readonly disposed: boolean;
   clear(): void;
   dispose(): void;
+  tap(handler: (event: ScoutEvent) => void, options?: { signal?: AbortSignal }): () => void;
   [Symbol.dispose](): void;
 };
 ```
 
 See `createSearch()` above for member descriptions.
 
+### `ScoutEvent`
+
+Discriminated union of events emitted by `SearchState.tap()`. Each variant carries a `type` discriminant; narrow with a `switch` or `if` on `event.type`.
+
+```ts
+type ScoutEvent =
+  | { type: 'query-change'; query: string }
+  | { type: 'searching-change'; isSearching: boolean }
+  | { type: 'results-change'; results: readonly SearchResult[] }
+  | { type: 'dispose' };
+```
+
+| `type` | Payload | Emitted when |
+| --- | --- | --- |
+| `query-change` | `query: string` | The writable `query` signal's value changes. |
+| `searching-change` | `isSearching: boolean` | The debounce window opens (`true`) or closes (`false`). |
+| `results-change` | `results: readonly SearchResult[]` | Committed results change after debounce. |
+| `dispose` | — | `dispose()` is called on the `SearchState`. |
+
 ### `ReactiveSearch`
 
 ```ts
@@ -22126,25 +23287,29 @@ const parts = highlight(result.item.name, nameMatch?.ranges ?? []);
 
 ## Debug Logging
 
-Import `debugSearch` from the dedicated `/devtools` sub-path to log a `SearchState`'s `query` → `isSearching` → `results` transitions to `console.debug`. The sub-path is tree-shaken from production bundles when not imported.
-
-`debugSearch()` logs the full, literal search query string — if your queries may carry PII (names, emails, medical/financial terms typed by end users), don't enable this in production.
+`search.tap()` subscribes a handler to `ScoutEvent` transitions emitted by a `SearchState` — `query` changes, `isSearching` transitions, `results` changes, and `dispose`. It returns an unsubscribe function. Pass `{ signal }` to tie the subscription to an external `AbortSignal` (or to `search.disposalSignal`, which aborts when `dispose()` is called).
 
 ```ts
-import { debugSearch } from '@vielzeug/scout/devtools';
+import { createIndex, createSearch } from '@vielzeug/scout';
 
 const search = createSearch(index, { debounce: 150 });
-const stopDebugging = debugSearch(search);
+const unsubscribe = search.tap((event) => {
+  if (event.type === 'query-change') console.debug('query:', event.query);
+  if (event.type === 'searching-change') console.debug('isSearching:', event.isSearching);
+  if (event.type === 'results-change') console.debug('results:', event.results.length);
+});
 
 search.query.value = 'alice';
-// [scout:search] query -> "alice"
-// [scout:search] isSearching -> true
-// [scout:search] isSearching -> false
-// [scout:search] results -> 1 item(s)
+// query: alice
+// isSearching: true
+// isSearching: false
+// results: 1
 
-stopDebugging();
+unsubscribe();
 ```
 
+`query-change` events carry the full, literal search query string — if your queries may carry PII (names, emails, medical/financial terms typed by end users), don't log them in production.
+
 ## Framework Integration
 
 ```tsx [React]
@@ -23543,7 +24708,7 @@ interface GridVirtualizer {
 
 | Class | Thrown when | Notable properties |
 | --- | --- | --- |
-| `ScrollError` | Base class for every Scroll error. | `ScrollError.is(error)` narrows errors from this package. |
+| `ScrollError` | Base class for every Scroll error. | Use `instanceof ScrollError` to narrow unknown errors narrows errors from this package. |
 | `ScrollConfigurationError` | A constructor or `update()` receives invalid static configuration. | Extends `ScrollError`; malformed JavaScript values also use this class. |
 | `ScrollRangeError` | A DOM virtual-list render detects that a caller mutated its items array without calling `setItems()` again. | Extends `ScrollError`; message includes stale index and current item count. |
 
@@ -24577,9 +25742,9 @@ const stopObserving = observeViewport();
 
 ## Documentation
 
-- [**Usage Guide**](./usage.md) — Apply Sentinel lifecycles, framework bindings, and Ripple composition.
-- [**API Reference**](./api.md) — Review factory signatures, options, state types, and errors.
-- [**Examples**](./examples.md) — Follow focused browser observation examples.
+- [**Usage Guide**](./usage.md)
+- [**API Reference**](./api.md)
+- [**Examples**](./examples.md)
 
 ## See Also
 
@@ -26167,7 +27332,7 @@ if (!result.success) {
 
 ## Errors
 
-- `SpellError` — base class. Use `SpellError.is(error)` for cross-boundary narrowing.
+- `SpellError` — base class. Use `instanceof SpellError` for cross-boundary narrowing.
 - `SpellValidationError` — validation failure with `issues`, `bestMatch()`, `messagesAt()`, `flatten()`, and `flattenFirst()`.
 - `SpellDefinitionError` — schema cannot create portable definition.
 
@@ -27505,10 +28670,10 @@ try {
 - `/memory`, `/local-storage`, and `/session-storage` return portable `VaultStore` instances without loading other adapters.
 - `observe()` emits current and changed table snapshots.
 - `ttl` creates validated expiration durations.
-- `/indexeddb` returns `IndexedDbVaultStore` with `batch()` and `iterate()`.
+- `/indexeddb` returns `TransactionalVaultStore` with `batch()` and `iterate()`.
 - `createSQLite()` is an opt-in, driver-neutral subpath for Node, Bun, and Deno SQLite drivers.
 - `/indexeddb` also exports `defineMigration()` for schema upgrades.
-- `scheduleExpiredPrune()` removes stale TTL entries on an owned schedule.
+- `pruneExpired()` removes stale TTL entries on demand.
 
 ## Documentation
 
@@ -27533,9 +28698,10 @@ try {
 | `createLocalStorage()` / `createSessionStorage()` | Web Storage-backed portable stores | Async API | Available only where the corresponding Web API exists |
 | `createIndexedDB()` | Browser transactions and cursor iteration | Async API | Import from `/indexeddb` |
 | `createSQLite()` | Driver-neutral SQLite store | Async API over a synchronous driver | Import from `/sqlite` |
+| `defineMigration()` | Declarative IndexedDB schema upgrade | Sync | Import from `/indexeddb` |
 | `table()` | Typed record schema | Sync | The key field must be a string or finite number |
 | `ttl` | Valid expiration durations | Sync | Durations must be positive |
-| `scheduleExpiredPrune()` | Periodic TTL cleanup | Sync setup, async work | Pass `disposalSignal` to auto-cancel |
+| `isExpired()` | Check an expiration timestamp | Sync | Returns `false` when no expiry is set |
 
 ## Package Entry Points
 
@@ -27622,23 +28788,20 @@ if (isExpired(record.expiresAt)) console.log('expired');
 
 ## Factories
 
-All factory options accept `schema`, plus optional `validators`, `logger`, and `onMetrics`. The root entry does not export any factory.
+All factory options accept `schema` and optional `validators`. The root entry does not export any factory.
 
 ### `createMemory()`
 
 ```ts
-function createMemory(options: {
-  name?: string;
-  schema: S;
-} & BaseAdapterOptions): VaultStore;
+function createMemory(options: BaseAdapterOptions): VaultStore;
 ```
 
-Creates an in-memory portable store. A `name` enables same-origin `BroadcastChannel` observation between memory stores when the platform provides it.
+Creates an in-memory portable store.
 
 | Parameter | Description |
 | --- | --- |
 | `schema` | Tables created by `table()` |
-| `name` | Optional shared memory-store namespace |
+| `validators` | Optional per-table validators with a `parse(value): T` method |
 
 **Returns:** `VaultStore`.
 
@@ -27654,20 +28817,20 @@ const store = createMemory({ schema: { users: table('id') } });
 ### `createLocalStorage()`
 
 ```ts
-function createLocalStorage(options: {
+function createLocalStorage(options: BaseAdapterOptions & {
   name: string;
   onQuotaExceeded?: (table: keyof S, error: VaultQuotaError) => 'ignore' | 'throw';
-  schema: S;
-} & BaseAdapterOptions): VaultStore;
+}): VaultStore;
 ```
 
 Creates a namespaced `localStorage` store.
 
 | Parameter | Description |
 | --- | --- |
+| `schema` | Tables created by `table()` |
+| `validators` | Optional per-table validators |
 | `name` | Required storage namespace |
 | `onQuotaExceeded` | Handles a Web Storage quota error; returning `'ignore'` drops that write |
-| `schema` | Tables created by `table()` |
 
 **Returns:** `VaultStore`.
 
@@ -27683,11 +28846,10 @@ const store = createLocalStorage({ name: 'app', schema: { settings: table('id')
 ### `createSessionStorage()`
 
 ```ts
-function createSessionStorage(options: {
+function createSessionStorage(options: BaseAdapterOptions & {
   name: string;
   onQuotaExceeded?: (table: keyof S, error: VaultQuotaError) => 'ignore' | 'throw';
-  schema: S;
-} & BaseAdapterOptions): VaultStore;
+}): VaultStore;
 ```
 
 Creates a namespaced `sessionStorage` store. Its options and return type match `createLocalStorage()`.
@@ -27706,24 +28868,24 @@ const store = createSessionStorage({ name: 'checkout', schema: { cart: table('id
 ### `createIndexedDB()`
 
 ```ts
-function createIndexedDB(options: {
+function createIndexedDB(options: BaseAdapterOptions & {
   migrate?: MigrationFn;
   name: string;
-  schema: S;
   version?: number;
-} & BaseAdapterOptions): IndexedDbVaultStore;
+}): TransactionalVaultStore;
 ```
 
 Creates an IndexedDB store with atomic batches, lazy cursor iteration, and optional schema migrations.
 
 | Parameter | Description |
 | --- | --- |
-| `name` | Required database name |
 | `schema` | Tables and IndexedDB secondary indexes |
+| `validators` | Optional per-table validators |
+| `name` | Required database name |
 | `version` | Positive schema version; defaults to `1` |
 | `migrate` | Synchronous upgrade callback for version changes |
 
-**Returns:** `IndexedDbVaultStore`.
+**Returns:** `TransactionalVaultStore`.
 
 ```ts
 import { table } from '@vielzeug/vault';
@@ -27737,19 +28899,20 @@ const store = createIndexedDB({ name: 'app', schema: { users: table('id') } });
 ### `createSQLite()`
 
 ```ts
-function createSQLite(options: SQLiteVaultOptions): SQLiteVaultStore;
+function createSQLite(options: SQLiteVaultOptions): TransactionalVaultStore;
 ```
 
 Creates a namespaced SQLite store with atomic batches and keyset-paginated iteration. It accepts an application-provided positional-parameter driver and never opens or imports a runtime driver.
 
 | Parameter | Description |
 | --- | --- |
+| `schema` | Tables created by `table()` |
+| `validators` | Optional per-table validators |
 | `database` | Caller-provided `SQLiteDatabase` connection |
 | `name` | Namespace within the connection |
-| `schema`, `validators`, `logger`, `onMetrics` | Shared factory options |
 | `closeOnDispose` | Closes the connection during disposal; defaults to `false` |
 
-**Returns:** `SQLiteVaultStore`.
+**Returns:** `TransactionalVaultStore`.
 
 ```ts
 import { DatabaseSync } from 'node:sqlite';
@@ -27776,11 +28939,9 @@ interface VaultStore {
   count(table: K): Promise;
   delete(table: K, key: KeyOf): Promise;
   deleteMany(table: K, keys: KeyOf[]): Promise;
-  entries(table: K): Promise, RecordOf]>>;
   get(table: K, key: KeyOf): Promise | undefined>;
   getAll(table: K): Promise[]>;
   getMany(table: K, keys: KeyOf[]): Promise | undefined>>;
-  getOrDefault(table: K, key: KeyOf, defaultFn: () => RecordOf, ttl?: number): Promise>;
   has(table: K, key: KeyOf): Promise;
   isEmpty(table: K): Promise;
   keys(table: K, filter?: (record: RecordOf) => boolean): Promise[]>;
@@ -27790,7 +28951,6 @@ interface VaultStore {
   update(table: K, key: KeyOf, changes: Partial>, ttl?: number): Promise | undefined>;
   upsert(table: K, key: KeyOf, fn: (existing: RecordOf | undefined) => RecordOf, ttl?: number): Promise>;
   pruneExpired(): Promise>;
-  debug(): Promise>;
   observe(table: K, listener: Observer>, options?: { immediate?: boolean; signal?: AbortSignal }): Unsubscribe;
   dispose(): Promise;
   readonly disposed: boolean;
@@ -27803,7 +28963,7 @@ The portable store API is returned by every factory. `observe()` emits the curre
 
 ---
 
-### `batch()`
+### `batch()` and `iterate()`
 
 ```ts
 interface TransactionalVaultStore extends VaultStore {
@@ -27811,10 +28971,11 @@ interface TransactionalVaultStore extends VaultStore {
     tables: readonly K[],
     fn: (tx: TransactionContext) => Promise,
   ): Promise;
+  iterate(table: K): AsyncIterable>;
 }
 ```
 
-Runs a scoped atomic callback. `IndexedDbVaultStore` and `SQLiteVaultStore` provide it.
+`batch()` runs a scoped atomic callback. `iterate()` lazily yields table records — IndexedDB uses a cursor, SQLite uses keyset pagination. Both are provided by `createIndexedDB()` and `createSQLite()`.
 
 | Parameter | Description |
 | --- | --- |
@@ -27827,43 +28988,24 @@ Runs a scoped atomic callback. `IndexedDbVaultStore` and `SQLiteVaultStore` prov
 await store.batch(['users'], async (tx) => {
   await tx.put('users', { id: 1, name: 'Ada' });
 });
-```
-
----
-
-### `iterate()`
-
-```ts
-interface IterableVaultStore extends VaultStore {
-  iterate(table: K): AsyncIterable>;
-}
-```
-
-Lazily yields table records. `IndexedDbVaultStore` uses a cursor; `SQLiteVaultStore` uses keyset pagination.
 
-**Returns:** An `AsyncIterable` of records.
-
-```ts
 for await (const user of store.iterate('users')) console.log(user);
 ```
 
-## Queries, Pruning, and Migrations
+## Queries and Migrations
 
 ### `QueryBuilder`
 
 ```ts
 interface QueryBuilder {
-  between(field: string, lower: number | string, upper: number | string): QueryBuilder;
   count(): Promise;
   delete(): Promise;
-  equals(field: K, value: V): QueryBuilder>;
-  exists(): Promise;
-  filter(fn: (value: N, index: number, array: N[]) => boolean): QueryBuilder;
+  equals(field: K, value: V): QueryBuilder;
+  filter(fn: (value: T, index: number, array: T[]) => boolean): QueryBuilder;
   first(): Promise;
   limit(n: number): QueryBuilder;
   offset(n: number): QueryBuilder;
   orderBy(field: K, direction?: 'asc' | 'desc'): QueryBuilder;
-  startsWith(field: keyof T, prefix: string, options?: { ignoreCase?: boolean }): QueryBuilder;
   toArray(): Promise;
 }
 ```
@@ -27871,36 +29013,7 @@ interface QueryBuilder {
 Builds a lazy table query. `count()` ignores `limit()`, `offset()`, and `orderBy()` — it always returns the full filtered-set size.
 
 ```ts
-const page = await store.query('users').startsWith('name', 'A').orderBy('name').limit(20).toArray();
-```
-
----
-
-### `scheduleExpiredPrune()`
-
-```ts
-function scheduleExpiredPrune(
-  adapter: Pick, 'pruneExpired'>,
-  options: {
-    interval: number;
-    onError?: (error: unknown) => void;
-    signal?: AbortSignal;
-  },
-): () => void;
-```
-
-Schedules `pruneExpired()` at a finite, positive interval. Pass `signal: store.disposalSignal` to auto-cancel when the store is torn down.
-
-**Returns:** A stop function.
-
-```ts
-import { scheduleExpiredPrune, ttl } from '@vielzeug/vault';
-
-const stop = scheduleExpiredPrune(store, {
-  interval: ttl.hours(1),
-  signal: store.disposalSignal,
-});
-stop();
+const page = await store.query('users').equals('role', 'admin').orderBy('name').limit(20).toArray();
 ```
 
 ---
@@ -27942,16 +29055,10 @@ type KeyOf =
 
 ```ts
 type BaseAdapterOptions = {
-  logger?: VaultLogger;
-  onMetrics?: (event: MetricsEvent) => void;
   schema: S;
   validators?: TableValidators;
 };
 
-type VaultLogger = {
-  error(message: string, context?: Error | Record): void;
-};
-
 type RecordValidator = {
   parse(value: unknown): T;
 };
@@ -27959,23 +29066,9 @@ type RecordValidator = {
 type TableValidators = {
   [K in keyof S]?: RecordValidator>;
 };
-
-type MetricsEvent = {
-  duration: number;
-  operation: 'batch' | 'clear' | 'count' | 'delete' | 'deleteMany' | 'entries' | 'get' | 'getAll' |
-    'getMany' | 'getOrDefault' | 'has' | 'isEmpty' | 'keys' | 'put' | 'putAll' | 'query' |
-    'queryDelete' | 'update' | 'upsert';
-  table: string;
-};
-
-type DebugStats = { expiredCount: number; recordCount: number };
-type DebugInfo = { tables: Array };
 ```
 
 ```ts
-interface IndexedDbVaultStore
-  extends TransactionalVaultStore, IterableVaultStore {}
-
 type MigrationContext = {
   db: IDBDatabase;
   newVersion: number | null;
@@ -28015,20 +29108,57 @@ type SQLiteVaultOptions = BaseAdapterOptions & {
   database: SQLiteDatabase;
   name: string;
 };
+```
+
+```ts
+interface TransactionalVaultStore extends VaultStore {
+  batch(
+    tables: readonly K[],
+    fn: (tx: TransactionContext) => Promise,
+  ): Promise;
+  iterate(table: K): AsyncIterable>;
+}
+```
+
+Import `TransactionalVaultStore` from `@vielzeug/vault`.
 
-interface SQLiteVaultStore
-  extends TransactionalVaultStore, IterableVaultStore {}
+```ts
+interface TransactionContext {
+  clear(table: T): Promise;
+  count(table: T): Promise;
+  delete(table: T, key: KeyOf): Promise;
+  deleteMany(table: T, keys: KeyOf[]): Promise;
+  get(table: T, key: KeyOf): Promise | undefined>;
+  getAll(table: T): Promise[]>;
+  getMany(table: T, keys: KeyOf[]): Promise | undefined>>;
+  has(table: T, key: KeyOf): Promise;
+  isEmpty(table: T): Promise;
+  keys(table: T, filter?: (record: RecordOf) => boolean): Promise[]>;
+  put(table: T, value: RecordOf, ttl?: number): Promise;
+  putAll(table: T, values: RecordOf[], ttl?: number): Promise;
+  query(table: T): QueryBuilder>;
+  update(table: T, key: KeyOf, changes: Partial>, ttl?: number): Promise | undefined>;
+  upsert(table: T, key: KeyOf, fn: (existing: RecordOf | undefined) => RecordOf, ttl?: number): Promise>;
+}
 ```
 
 `TransactionContext` has the same CRUD, query, and TTL methods as `VaultStore`, narrowed to the tables declared in `batch()`. Import it from `@vielzeug/vault/indexeddb` or `@vielzeug/vault/sqlite`.
 
+```ts
+// Adapter-specific type aliases — both resolve to TransactionalVaultStore.
+type SQLiteVaultStore = TransactionalVaultStore;
+type IndexedDbVaultStore = TransactionalVaultStore;
+```
+
+`SQLiteVaultStore` is exported from `@vielzeug/vault/sqlite`. `IndexedDbVaultStore` is exported from `@vielzeug/vault/indexeddb`.
+
 ## Errors
 
 | Error | Trigger |
 | --- | --- |
 | `VaultError` | Any Vault-originated validation, serialization, storage, or query error |
 | `VaultDisposedError` | An operation after the store or observer hub is disposed |
-| `VaultScopeError` | An IndexedDB transaction accesses a table outside its declared batch scope |
+| `VaultScopeError` | A `batch()` callback accesses a table outside its declared scope |
 | `VaultQuotaError` | A LocalStorage or SessionStorage write exceeds the browser quota |
 | `VaultMigrationError` | An IndexedDB migration callback throws |
 
@@ -28095,29 +29225,27 @@ console.log(updated);
 Build a query from a table, then finish it with a terminal method. `count()` ignores pagination, which makes it suitable for page controls.
 
 ```ts
-const query = store.query('preferences').startsWith('id', 'theme');
+const query = store.query('preferences').filter((p) => p.id.startsWith('theme'));
 const preferences = await query.orderBy('id').limit(10).toArray();
 const total = await query.count();
 
 console.log({ preferences, total });
 ```
 
-Memory and Web Storage queries scan the table. IndexedDB can use declared secondary indexes, while SQLite pushes primary-key equality, range, and case-sensitive prefix filters to the database.
+Queries scan the table in memory. Use `equals()` for exact field matches and `filter()` for custom predicates. For large tables, prefer `iterate()` on IndexedDB or SQLite instead of materializing every record.
 
 ## Use TTL and Pruning
 
-Use `ttl.*` helpers for expiring rows. Schedule pruning when stale rows can accumulate without reads.
+Use `ttl.*` helpers for expiring rows. Call `pruneExpired()` to reclaim storage from stale rows that accumulate without reads.
 
 ```ts
-import { scheduleExpiredPrune, ttl } from '@vielzeug/vault';
+import { ttl } from '@vielzeug/vault';
 
 await store.put('preferences', { id: 'temporary', theme: 'dark' }, ttl.hours(1));
-const stopPrune = scheduleExpiredPrune(store, {
-  interval: ttl.hours(6),
-  signal: store.disposalSignal,
-});
 
-stopPrune();
+// Reclaim expired rows on a schedule owned by the application.
+const pruneInterval = setInterval(() => store.pruneExpired(), ttl.hours(6));
+store.disposalSignal.addEventListener('abort', () => clearInterval(pruneInterval));
 ```
 
 ## Observe a Table
@@ -28245,7 +29373,7 @@ Use Forge’s Vault helpers for explicit form-draft persistence. Keep Ripple sig
 - Use IndexedDB or SQLite for atomic work.
 - Keep external asynchronous work outside `batch()` callbacks.
 - Use `ttl.*` instead of raw durations.
-- Keep SQLite scans and writes off latency-sensitive event loops, and dispose stores with their owner.
+- Keep SQLite scans and writes off latency-sensitive event loops.
 - Dispose stores when their owner ends.
 
 ### Examples
@@ -28263,10 +29391,10 @@ Use Forge’s Vault helpers for explicit form-draft persistence. Keep Ripple sig
 
 - Basic Setup - Initialize Vault (id: `basic-setup`)
 - Bulk Operations (id: `bulk-operations`)
-- Cache-First with getOrDefault (id: `cache-first`)
+- Cache-First with get + put (id: `cache-first`)
 - CRUD Operations (id: `crud-operations`)
 - IndexedDB — Atomic Batch & iterate() (id: `indexed-db`)
-- TTL — scheduleExpiredPrune with disposalSignal (id: `prune-schedule`)
+- TTL — pruneExpired with disposalSignal (id: `prune-schedule`)
 - Query Builder — Filters, Pagination, count (id: `query-builder`)
 - Reactive — observe() (id: `reactive-observe`)
 - TTL & Expiration (id: `ttl-expiration`)
@@ -28352,6 +29480,7 @@ else console.log(decision.reason);
 - `WILDCARD` and `ANONYMOUS` model broad or unauthenticated access explicitly.
 - `owns()` and `predicate` constrain rules with synchronous request data.
 - `explain()`, `trace()`, and `detectConflicts()` make policy decisions diagnosable.
+- `tap()` subscribes to decision events for logging and diagnostics.
 - `forUser()` creates a principal-bound view for repeated checks.
 - `checkAll()` evaluates multiple resource/action pairs in one call.
 
@@ -28377,10 +29506,10 @@ else console.log(decision.reason);
 | `createWard` | Creates immutable policy | Sync | Rules cannot be mutated after creation |
 | `allow` / `deny` / `ruleFor` | Builds policy rules | Sync | Priority wins before specificity |
 | `Ward.explain` | Returns one decision | Sync | Pass resource data for predicate rules |
-| `Ward.trace` | Inspects decision candidates | Sync | Does not invoke the logger |
+| `Ward.trace` | Inspects decision candidates | Sync | Does not fire a `decision` event |
 | `Ward.forUser` | Binds a principal | Sync | Rebind when identity or roles change |
 | `Ward.checkAll` | Batch permission checks | Sync | Pass resource data for predicate rules |
-| `Ward.allowedActions` | Filters known actions to allowed set | Sync | Does not invoke the logger |
+| `Ward.allowedActions` | Filters known actions to allowed set | Sync | Does not fire a `decision` event |
 | `Ward.rulesInScope` | Lists rules matching a principal/resource | Sync | Pass data to evaluate predicates |
 | `Ward.detectConflicts` | Detects duplicate/shadowed rules | Sync | O(n²) — use `maxConflicts` for large policies |
 | `predicate.owns` / `owns` | Ownership predicate on resource data | Sync | Skipped for anonymous principals |
@@ -28392,7 +29521,6 @@ else console.log(decision.reason);
 | Import | Purpose |
 | --- | --- |
 | `@vielzeug/ward` | Rules, factory, predicates, pattern helpers, errors, and public types |
-| `@vielzeug/ward/devtools` | `debugWard()` diagnostic factory |
 
 ## Core Factory
 
@@ -28405,14 +29533,13 @@ createWard(
 ): Ward;
 ```
 
-Creates an immutable ward instance. `rules` accepts a flat mix of single rules and rule arrays — `allow()`/`deny()`/`ruleFor()` results can be passed directly without spread. Validates `logger`, `onConflict`, and `maxConflicts` options before compiling rules; invalid values throw `WardConfigError`.
+Creates an immutable ward instance. `rules` accepts a flat mix of single rules and rule arrays — `allow()`/`deny()`/`ruleFor()` results can be passed directly without spread. Validates `onConflict` and `maxConflicts` options before compiling rules; invalid values throw `WardConfigError`.
 
 **Parameters:**
 
 | Name | Type | Description |
 | --- | --- | --- |
 | `rules` | `readonly (WardRule \| readonly WardRule[])[]` | Rule list. Single rules and rule arrays can be mixed. |
-| `options.logger` | `(ctx: WardLoggerContext) => void` | Called for `explain()` and `checkAll()` decisions. |
 | `options.onConflict` | `(conflict: WardConflict) => void` | Called synchronously per conflict at creation time. |
 | `options.strict` | `boolean` | Throws `WardConfigError` on the first conflict. |
 | `options.maxConflicts` | `number` | Caps the number of conflicts returned by `detectConflicts()`. |
@@ -28498,7 +29625,7 @@ checkAll(
 ): WardDecisionResult[];
 ```
 
-Evaluates multiple resource/action pairs for one principal. Invokes the logger for each decision.
+Evaluates multiple resource/action pairs for one principal. Fires a `decision` event for each result via `tap()`.
 
 **Returns:** `WardDecisionResult[]` — each entry carries `action`, `resource`, and the decision.
 
@@ -28521,7 +29648,7 @@ explain(input: WardDecisionInput): WardDecision;
 }
 ```
 
-Returns one decision. Invokes the logger.
+Returns one decision. Fires a `decision` event via `tap()`.
 
 **Returns:** `WardDecision` — `{ allowed: true; rule }` or `{ allowed: false; reason: 'explicit-deny'; rule }` or `{ allowed: false; reason: 'no-matching-rule' }`.
 
@@ -28533,7 +29660,7 @@ Returns one decision. Invokes the logger.
 trace(input: WardDecisionInput): WardTrace;
 ```
 
-Same request shape as `explain()`. Returns winner + candidate list. Does not fire the logger.
+Same request shape as `explain()`. Returns winner + candidate list. Does not fire a `decision` event.
 
 **Returns:** `WardTrace` — `{ candidates: WardTraceCandidate[]; decision: WardDecision }`.
 
@@ -28556,7 +29683,7 @@ Input shape:
 }
 ```
 
-Filters the provided `knownActions` list to those the principal may perform. Does not invoke the logger.
+Filters the provided `knownActions` list to those the principal may perform. Does not fire a `decision` event.
 
 **Returns:** `TAction[]` — the subset of `knownActions` that `explain()` would allow.
 
@@ -28712,17 +29839,37 @@ Tests whether the `broad` pattern covers the `narrow` pattern. `'*'` covers ever
 
 ---
 
-## Devtools
+## Observability
+
+### `tap(handler, options?)`
+
+```ts
+tap(
+  handler: (event: WardEvent) => void,
+  options?: { signal?: AbortSignal },
+): () => void;
+```
+
+Subscribes a handler to ward events. Each `explain()` and `checkAll()` decision fires a `decision` event. `trace()` and `allowedActions()` do not fire events.
+
+Pass an `AbortSignal` to unsubscribe automatically; the returned function unsubscribes manually.
 
-### `debugWard(rules, options?)`
+**Returns:** `() => void` — call to unsubscribe the handler.
 
-Sub-path import: `@vielzeug/ward/devtools`.
+**Example:**
 
 ```ts
-import { debugWard } from '@vielzeug/ward/devtools';
+const ward = createWard(rules);
+ward.tap((event) => console.debug(`ward:${event.type}`, event.decision));
 ```
 
-Diagnostic factory for development inspection.
+With a logger from `@vielzeug/rune`:
+
+```ts
+import { createLogger } from '@vielzeug/rune';
+const log = createLogger({ name: 'ward' });
+ward.tap((event) => log.debug(event, 'ward:decision'));
+```
 
 ---
 
@@ -28847,6 +29994,7 @@ export type Ward = {
   explain(input: WardDecisionInput): WardDecision;
   forUser(principal: UserPrincipal): BoundWard;
   rulesInScope(input: WardRulesInScopeInput): ReadonlyArray>>;
+  tap(handler: (event: WardEvent) => void, options?: { signal?: AbortSignal }): () => void;
   trace(input: WardDecisionInput): WardTrace;
 };
 
@@ -28858,7 +30006,9 @@ export type BoundWard = {
   trace(input: BoundWardDecisionInput): WardTrace;
 };
 
-export type WardLoggerContext = WardDecision & {
+export type WardEvent = {
+  type: 'decision';
+  decision: WardDecision;
   action: TAction;
   data?: TData;
   principal: Principal;
@@ -28866,7 +30016,6 @@ export type WardLoggerContext = WardDecision & {
 };
 
 export type WardOptions = {
-  logger?: (context: WardLoggerContext) => void;
   maxConflicts?: number;
   onConflict?: (conflict: WardConflict) => void;
   strict?: boolean;
@@ -28877,12 +30026,12 @@ export type WardOptions = {
 
 `Ward`, `BoundWard`, `WardDecision`, `WardDecisionResult`, `WardTrace`, `WardTraceCandidate`, `WardConflict`,
 `NormalizedWardRule`, `WardOptions`, `WardCheck`, `WardAllowedActionsInput`, `WardRulesInScopeInput`, `RuleContext`,
-`WardLoggerContext`, `WardPredicate`, and `ConflictKind` are exported from the root entry point.
+`WardEvent`, `WardPredicate`, and `ConflictKind` are exported from the root entry point.
 
 ## Errors
 
-- `WardError` is the base error class; use `WardError.is(value)` for narrowing.
-- `WardConfigError` reports malformed rules, invalid `createWard` options (`logger`, `onConflict`, `maxConflicts`), invalid principals, and strict conflict initialization.
+- `WardError` is the base error class; use `instanceof WardError` for narrowing.
+- `WardConfigError` reports malformed rules, invalid `createWard` options (`onConflict`, `maxConflicts`), invalid principals, and strict conflict initialization.
 - `WardPredicateError` reports a throwing synchronous predicate and includes its `ruleIndex` and cause.
 
 ### Usage Guide
@@ -28952,7 +30101,7 @@ const actions = ward.allowedActions({
 });
 ```
 
-It does not fire the logger.
+It does not fire a `decision` event.
 
 ## Rule Introspection
 
@@ -28979,7 +30128,34 @@ trace.candidates.forEach((c) => {
 });
 ```
 
-`trace()` does not fire the logger.
+`trace()` does not fire a `decision` event.
+
+## Observing Decisions
+
+`tap()` subscribes a handler to ward events. Each `explain()` and `checkAll()` decision fires a `decision` event; `trace()` and `allowedActions()` do not.
+
+```ts
+const ward = createWard(rules);
+ward.tap((event) => console.debug(`ward:${event.type}`, event.decision));
+```
+
+Pass an `AbortSignal` to unsubscribe automatically, or call the returned function to unsubscribe manually:
+
+```ts
+const controller = new AbortController();
+const unsubscribe = ward.tap((event) => console.debug(event), { signal: controller.signal });
+
+// later
+unsubscribe(); // or controller.abort();
+```
+
+For structured logging, forward events to a `@vielzeug/rune` logger:
+
+```ts
+import { createLogger } from '@vielzeug/rune';
+const log = createLogger({ name: 'ward' });
+ward.tap((event) => log.debug(event, 'ward:decision'));
+```
 
 ## Predicate Helpers
 
@@ -29079,7 +30255,7 @@ container.register('ward', ward);
 - [Priority and Overrides](./examples/inheritance-and-overrides.md)
 - [Bound Guard in UI Layer](./examples/bound-guard-in-ui-layer.md)
 - [Rule Specificity](./examples/disabling-wildcard-fallback.md)
-- [Logger for Auditing](./examples/logger-for-auditing.md)
+- [Auditing Decisions](./examples/logger-for-auditing.md)
 - [Fresh Ward Per Test](./examples/snapshot-restore-for-test-isolation.md)
 - [Conflict Detection](./examples/conflict-detection.md)
 - [Trace a Decision](./examples/trace-decision.md)
@@ -29213,7 +30389,7 @@ router.dispose();
 - `match()` / `load()` — Inspect routes synchronously or load route data without navigation.
 - `preload()` — Warms route data for a later matching navigation.
 - `createMemoryHistory()` — Runs routers in tests and non-browser environments.
-- `debugRouter()` — Logs navigation state from `@vielzeug/wayfinder/devtools`.
+- `subscribe()` — Reactive subscription to navigation state changes.
 
 ## Documentation
 
@@ -29253,10 +30429,9 @@ router.dispose();
 
 ## Package Entry Points
 
-| Import                         | Purpose                                      |
-| ------------------------------ | -------------------------------------------- |
-| `@vielzeug/wayfinder`          | Main exports and types                       |
-| `@vielzeug/wayfinder/devtools` | `debugRouter` — navigation logger (dev only) |
+| Import                | Purpose                |
+| --------------------- | ---------------------- |
+| `@vielzeug/wayfinder` | Main exports and types |
 
 ## `createRouter(options)`
 
@@ -30062,44 +31237,6 @@ Thrown on middleware misuse — currently only when a middleware function calls
 | `/files/:rest*`                | `/files/a/b/c`      | Wildcard suffix captured as one named param |
 | `*`                            | anything            | Global catch-all                            |
 
-## `debugRouter(options)` 
-
-```ts
-import { debugRouter } from '@vielzeug/wayfinder/devtools';
-
-const router = debugRouter({ routes });
-// [wayfinder:nav] idle      /         [home]    ← logged when initial navigation settles
-// [wayfinder:nav] loading   /dashboard
-// [wayfinder:nav] idle      /dashboard [dashboard.index]
-```
-
-Wraps `createRouter()` and attaches a `subscribe` listener that logs every navigation state change to `console.debug`. Returns the same `Router` instance — all methods are identical to `createRouter()`. The first logged entry appears when the initial navigation completes (not synchronously at construction).
-
-Import from the dedicated sub-path so the `console.debug` reference is tree-shaken from production bundles when not imported.
-
-### `DebugRouterOptions`
-
-Extends `RouterOptions` with one additional field:
-
-| Option  | Type     | Default | Description                                                                                                      |
-| ------- | -------- | ------- | ---------------------------------------------------------------------------------------------------------------- |
-| `label` | `string` | `'nav'` | Label used in log prefixes. Produces `[wayfinder:]`. Useful when running multiple routers simultaneously. |
-
-```ts
-// Multi-router setup — distinguish logs by label:
-const main = debugRouter({ routes, label: 'main' });
-const modal = debugRouter({ routes: modalRoutes, label: 'modal' });
-// [wayfinder:main]  idle  /dashboard
-// [wayfinder:modal] loading  /confirm
-```
-
-| Log format                                              | When                                   |
-| ------------------------------------------------------- | -------------------------------------- |
-| `[wayfinder:nav] idle      /path  [routeName]`          | Navigation settled                     |
-| `[wayfinder:nav] loading   /path`                       | Data loaders in flight                 |
-| `[wayfinder:nav] streaming /path  [routeName]`          | Streaming loader emitting partial data |
-| `[wayfinder:nav] error     /path  [routeName]  ` | Navigation error                       |
-
 ## Design Notes
 
 - Wayfinder no longer exposes imperative registration methods like `on()`, `group()`, or `use()`.
@@ -30741,43 +31878,50 @@ export function useRouter() {
 
 For full RouterView and RouterLink patterns, see [React Integration](./examples/react-integration.md), [Vue Integration](./examples/vue-integration.md), and [Svelte Integration](./examples/svelte-integration.md).
 
-## Debug Mode
+## Debug Logging
 
-Import `debugRouter` from the dedicated sub-path to create a router with navigation logging pre-enabled. The sub-path is tree-shaken from production bundles when not imported.
+`router.subscribe()` is the reactive subscription API — it receives every state change, including `loading`, `streaming`, and `error` transitions. Attach a listener that logs to `console.debug` to inspect navigation without any dedicated debug tooling.
 
 ```ts
-import { debugRouter } from '@vielzeug/wayfinder/devtools';
+import { createRouter } from '@vielzeug/wayfinder';
 
-const router = debugRouter({
-  routes: {
-    home: { path: '/' },
-    dashboard: { path: '/dashboard', data: () => fetchDashboard() },
-  },
+const router = createRouter({ routes });
+const stop = router.subscribe((state) => {
+  console.debug(`[wayfinder] ${state.status} ${state.location.pathname}`);
 });
 
 // Logged once the initial navigation completes:
-// [wayfinder:nav] idle      /         [home]
+// [wayfinder] idle /
 
 // On navigate({ name: 'dashboard' }):
-// [wayfinder:nav] loading   /dashboard
-// [wayfinder:nav] idle      /dashboard [dashboard]
+// [wayfinder] loading /dashboard
+// [wayfinder] idle /dashboard
 ```
 
-The router returned is identical to `createRouter()` — all methods (`navigate`, `subscribe`, `waitFor`, etc.) work the same way.
+The returned function unsubscribes the listener — call it when the logger is no longer needed (e.g. on teardown):
 
-Errors are logged with the error object appended:
+```ts
+stop();
+```
+
+Errors are surfaced on the state object, so you can log them explicitly:
 
 ```ts
-// [wayfinder:nav] error     /dashboard [dashboard]  Error: fetch failed
+router.subscribe((state) => {
+  if (state.status === 'error') {
+    console.error(`[wayfinder] ${state.location.pathname}`, state.error);
+  }
+});
 ```
 
-Use the `label` option when running multiple routers to distinguish their log output:
+Use a label when running multiple routers to distinguish their log output:
 
 ```ts
-const main = debugRouter({ routes, label: 'main' });
-const modal = debugRouter({ routes: modalRoutes, label: 'modal' });
-// [wayfinder:main]  loading  /products
-// [wayfinder:modal] loading  /confirm
+const main = createRouter({ routes });
+main.subscribe((state) => console.debug(`[wayfinder:main] ${state.status} ${state.location.pathname}`));
+
+const modal = createRouter({ routes: modalRoutes });
+modal.subscribe((state) => console.debug(`[wayfinder:modal] ${state.status} ${state.location.pathname}`));
 ```
 
 Debug logging has no effect on behavior and should not be enabled in production.
@@ -30861,7 +32005,7 @@ router.subscribe((state) => {
 ### REPL Examples
 
 - Basic Routing — Route State and Navigation (id: `basic-routing`)
-- Debug Router — Navigation Logging (id: `debug-router`)
+- Navigation Logging (id: `debug-router`)
 - Guards and Redirects — Auth Flows (id: `middleware-auth`)
 - Middleware Chain — Execution Flow (id: `middleware-chain`)
 - Named Routes — Type-Safe Navigation (id: `named-routes`)