feat(snippets): un-merge — reverse one source out of a merged survivor

Closes the last of milestone #232. The task said to settle the design
before coding; here is what was settled and why.

THE HAZARD. Restoring a merged-in source from the trash brought the record
back but never stripped its locations off the survivor, so both claimed
the same call sites and the reverse lookup read the duplicate claims as
real. Subtracting blindly is not a fix: a location can arrive from a
source AND genuinely be the survivor's own, and _normalize_locations dedups
them into one, so blind subtraction would strip a call site the survivor
owns. Same problem defeated partial un-merge — `merged_from` recorded ids,
not which locations came from which source.

THE ANSWER. Record per-source attribution AT MERGE TIME, where it is known
exactly: each entry keeps only what that source ADDED, computed
incrementally as sources fold in. Anything the survivor already had, or an
earlier source already brought, is attributed to nobody. Both open
questions fall out of that one change — partial un-merge is exact, and a
survivor-owned location can never be stripped, because it was never
attributed in the first place.

The shape moved from [id] to [{id, locations, tags}]. Free to do: the
corpus holds one snippet and zero merges, so there is no legacy data (rule
#22). A bare int still normalizes to {"id": n} — not legacy tolerance, but
because snippet_fields falls back to PARSING THE BODY when a row has no
`data`, and the body's provenance line can only carry ids. Such an entry
shows history and refuses un-merge with a reason rather than guessing.

WHICH SURFACE. Neither option in the task, quite. Making trash-restore
notice the merge would teach the generic trash path snippet semantics for
one record type. Instead un-merge OWNS the restore: one operation, one
authorization check, trash stays ignorant. Restoring by hand is still
allowed and still leaves both records claiming the same places — so
un-merge treats an already-alive source as the normal case and goes
straight to the subtraction that repairs it. That is the state that
motivated the feature, not an error.

Adds trash.restore_entity(user_id, type, id) — the missing inverse of
delete(), which returns a batch id callers don't keep. Restores the whole
batch, since the batch is the entity plus its cascade.

Refs #2165

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UaYUaouG9jjhATyuxCKrQs

tests/test_snippet_unmerge.py

@@ -0,0 +1,183 @@
+"""Tests for un-merge (#2165) — reversing one source out of a merged survivor.
+
+The design question this task said to settle first was how to subtract without
+stripping call sites the survivor legitimately owns. The answer is per-source
+attribution recorded AT MERGE TIME: each `merged_from` entry holds only what
+that source actually added. These tests pin that rule, and the refusal that
+guards the case where the attribution isn't there.
+"""
+from types import SimpleNamespace
+from unittest.mock import AsyncMock, MagicMock, patch
+
+import pytest
+
+from scribe.services import snippets as s
+
+
+def _loc(path, repo="r", symbol=""):
+    return {"repo": repo, "path": path, "symbol": symbol}
+
+
+def _survivor(locations, merged_from, tags=None, owner=7):
+    """A survivor note whose `data` carries locations + merge provenance."""
+    return SimpleNamespace(
+        id=1, user_id=owner, note_type="snippet", deleted_at=None,
+        title="f — does a thing", tags=tags or ["python", "snippet"],
+        body=s.compose_body(code="x = 1", language="python", locations=locations,
+                            merged_from=merged_from),
+        data=s.compose_data(name="f", when_to_use="does a thing", language="python",
+                            code="x = 1", locations=locations,
+                            merged_from=merged_from),
+    )
+
+
+async def _run_unmerge(survivor, *, source_alive=None, restore=1):
+    """Drive unmerge_snippet with the DB stubbed; return update_note's kwargs."""
+    async def fake_get(_uid, sid):
+        if sid == survivor.id:
+            return survivor
+        return source_alive
+
+    with (
+        patch.object(s, "get_snippet", AsyncMock(side_effect=fake_get)),
+        patch("scribe.services.access.can_write_note", AsyncMock(return_value=True)),
+        patch("scribe.services.trash.restore_entity", AsyncMock(return_value=restore)),
+        patch.object(s.notes_svc, "update_note",
+                     AsyncMock(return_value=survivor)) as upd,
+        patch.object(s, "_embed_snippet", MagicMock()),
+    ):
+        await s.unmerge_snippet(7, 1, 2)
+    return upd.await_args.kwargs
+
+
+# --- the subtraction ------------------------------------------------------
+
+
+async def test_unmerge_strips_only_what_the_source_contributed():
+    """The survivor's own location survives; the source's is removed."""
+    mine, theirs = _loc("mine.py"), _loc("theirs.py")
+    survivor = _survivor(
+        [mine, theirs],
+        [{"id": 2, "locations": [theirs], "tags": ["helper"]}],
+        tags=["python", "snippet", "helper", "core"],
+    )
+    kwargs = await _run_unmerge(survivor)
+    assert kwargs["data"]["locations"] == [mine]
+    assert "helper" not in kwargs["tags"]
+    assert "core" in kwargs["tags"]
+
+
+async def test_a_location_the_survivor_also_owned_is_never_stripped():
+    """The central hazard the task named. If a source brought a location the
+    survivor ALREADY had, merge attributes nothing to it — so reversing must
+    leave that call site in place."""
+    shared = _loc("shared.py")
+    survivor = _survivor([shared], [{"id": 2, "locations": [], "tags": ["t"]}])
+    kwargs = await _run_unmerge(survivor)
+    assert kwargs["data"]["locations"] == [shared]
+
+
+async def test_the_reversed_entry_leaves_the_provenance_list():
+    survivor = _survivor(
+        [_loc("a.py"), _loc("b.py")],
+        [{"id": 2, "locations": [_loc("b.py")]}, {"id": 3, "locations": []}],
+    )
+    kwargs = await _run_unmerge(survivor)
+    assert s.merged_from_ids(kwargs["data"]["merged_from"]) == [3]
+    assert "#2" not in kwargs["body"]
+    # The other source's history is untouched — un-merge reverses one thing.
+    assert "**Merged from:** #3" in kwargs["body"]
+
+
+async def test_unmerging_the_last_source_clears_the_provenance_line():
+    survivor = _survivor([_loc("a.py")], [{"id": 2, "locations": [], "tags": ["t"]}])
+    kwargs = await _run_unmerge(survivor)
+    assert "Merged from" not in kwargs["body"]
+
+
+# --- restoring the source -------------------------------------------------
+
+
+async def test_an_already_restored_source_is_repaired_not_refused():
+    """The scenario that motivated the feature: the operator restored the source
+    from the trash by hand, so both records claim its call sites and nothing ever
+    stripped the survivor's copy. Un-merge must fix that, not reject it."""
+    theirs = _loc("theirs.py")
+    survivor = _survivor([_loc("mine.py"), theirs],
+                         [{"id": 2, "locations": [theirs]}])
+    alive = SimpleNamespace(id=2, user_id=7, note_type="snippet", deleted_at=None,
+                            title="g — x", tags=["snippet"], body="", data=None)
+    with patch("scribe.services.trash.restore_entity", AsyncMock()) as revive:
+        kwargs = await _run_unmerge(survivor, source_alive=alive)
+    # Nothing to revive — it's already alive — but the subtraction still happens.
+    revive.assert_not_called()
+    assert kwargs["data"]["locations"] == [_loc("mine.py")]
+
+
+async def test_a_purged_source_is_refused_and_the_survivor_is_untouched():
+    """If the source can't come back, stripping the survivor would lose the
+    locations entirely — no record would claim them."""
+    survivor = _survivor([_loc("a.py")], [{"id": 2, "locations": [_loc("a.py")]}])
+
+    async def fake_get(_uid, sid):
+        return survivor if sid == 1 else None
+
+    with (
+        patch.object(s, "get_snippet", AsyncMock(side_effect=fake_get)),
+        patch("scribe.services.access.can_write_note", AsyncMock(return_value=True)),
+        patch("scribe.services.trash.restore_entity", AsyncMock(return_value=None)),
+        patch.object(s.notes_svc, "update_note", AsyncMock()) as upd,
+        patch.object(s, "_embed_snippet", MagicMock()),
+    ):
+        with pytest.raises(s.UnmergeError, match="purged"):
+            await s.unmerge_snippet(7, 1, 2)
+    upd.assert_not_called()
+
+
+# --- refusals -------------------------------------------------------------
+
+
+async def test_an_entry_without_attribution_is_refused_not_guessed():
+    """Bare-id provenance comes from parsing the body, which can only hold ids.
+    Subtracting a guess could strip call sites the survivor owns — so refuse and
+    say what to do instead."""
+    survivor = _survivor([_loc("a.py")], [2])
+
+    async def fake_get(_uid, sid):
+        return survivor if sid == 1 else None
+
+    with (
+        patch.object(s, "get_snippet", AsyncMock(side_effect=fake_get)),
+        patch("scribe.services.access.can_write_note", AsyncMock(return_value=True)),
+        patch.object(s.notes_svc, "update_note", AsyncMock()) as upd,
+        patch.object(s, "_embed_snippet", MagicMock()),
+    ):
+        with pytest.raises(s.UnmergeError, match="provenance"):
+            await s.unmerge_snippet(7, 1, 2)
+    upd.assert_not_called()
+
+
+async def test_unmerging_something_never_absorbed_is_refused():
+    survivor = _survivor([_loc("a.py")], [{"id": 99, "locations": []}])
+    with (
+        patch.object(s, "get_snippet", AsyncMock(return_value=survivor)),
+        patch("scribe.services.access.can_write_note", AsyncMock(return_value=True)),
+    ):
+        with pytest.raises(s.UnmergeError, match="no record of absorbing"):
+            await s.unmerge_snippet(7, 1, 2)
+
+
+async def test_unmerge_requires_write_access():
+    """Same rule as merge: a read-only share can see the record, not rearrange it."""
+    survivor = _survivor([_loc("a.py")], [{"id": 2, "locations": []}])
+    with (
+        patch.object(s, "get_snippet", AsyncMock(return_value=survivor)),
+        patch("scribe.services.access.can_write_note", AsyncMock(return_value=False)),
+    ):
+        with pytest.raises(PermissionError):
+            await s.unmerge_snippet(7, 1, 2)
+
+
+async def test_unmerge_on_a_missing_survivor_returns_none():
+    with patch.object(s, "get_snippet", AsyncMock(return_value=None)):
+        assert await s.unmerge_snippet(7, 1, 2) is None