One refresh-after-write declaration: after a successful create or update, re-run read (with arguments taken from the written record) so the fresh value is cached before anyone asks for it.

Refreshing re-executes the real read action, so it flows through the same key derivation, authorization, and caching as any other read — there is no separate write-side key reconstruction to drift out of sync.

It runs synchronously inside the write's after_transaction hook, so every declaration costs the writing caller one extra read. A refresh that fails is logged and swallowed: the write has already committed, and the cache version bump has already made the stale entry unreachable.