8 Commits

Include renames

Author	SHA1	Message	Date
bvandeusen	982d24c83b	links: bind a [[link]] to a note, not to a string ... A wiki-link was stored only as normalized TEXT, so a note's NAME was the edge. Renaming it broke every inbound link — and the fix that shipped for that (task 1848, option b) was `_rename_inbound_links`: rewrite the `[[Old Name]]` text inside the body of every note that linked to the renamed one. That works while an explicit title exists to hold still. It stops being defensible the moment a note's name is just its first body line, which is where M13 is going: fixing a typo in your opening sentence would silently edit other notes' words, with nothing to opt out to. So this lands first, before the title comes out, and that window never ships. `note_links` gains `target_id`, bound when the link is written. `target_norm` stays and is what an UNRESOLVED link carries — linking to a note that doesn't exist yet is a supported way to create one, so a link has to be able to name a target that isn't there. Resolution reads the id, falling back to the name only where nothing was bound, which is what lets a forward link connect the moment its target appears. `_claim_unresolved_links` then binds it, so the fallback is a transitional state rather than a permanent one. `_rename_inbound_links` and `rewrite_link_title` are gone. What replaced them touches link rows only: a note's text is never modified by something happening to a different note. The client can no longer resolve links for itself, and that is the point. It used to look `[[text]]` up in a client-side name index, which only held together BECAUSE renaming rewrote the text everywhere. Now the written text can name something the target is no longer called, and only the server holds the binding — so each note serializes its resolved links (`norm`, `id`, and the target's name as it stands NOW). A renamed note reads correctly everywhere it is linked from, without a single body having been edited. Unresolved links are simply absent and fall through to the create-on-click affordance that already existed; so does the offline desktop store, which derives links at query time and has no binding to send. The name-fallback join is owner-scoped everywhere it appears. Bound ids were resolved owner-scoped when written, but matching on display_title alone would have let two users who each have a note called "Groceries" see the other's id and name through an unresolved link (rule 47). The new behaviour is all SQL and this suite runs without a database, so the dead helpers' tests are removed rather than replaced. This repo has no integration lane to hold that ground — noted, not papered over.	2026-08-22 11:02:39 -04:00
bvandeusenandClaude Opus 5	e64d67e904	Expire trash after 30 days, and make the deadline something you can see ... Trash had no end. A note sat in /trash until someone emptied it by hand, and its attachment BYTES sat on disk the whole time — the pile-up the operator asked about. Nothing purged; there was no scheduler at all. Retention is server-owned: `trash_retention_days` (default 30, 0 = keep forever) in the settings registry, so it lands in admin Settings with no migration and takes effect without a restart. A background sweep started in before_serving does the work. Clients learn about a purge the way they learn about any deletion — as a tombstone on the delta feed. An auto-purge nobody can see coming is data loss on a timer, so the window is now visible: /api/config publishes it, notes carry `deleted_at`, Trash leads with the policy, and each card counts down. The countdown rounds DOWN — saying "1 day left" for a note with ten minutes on the clock is the one error here that actually costs someone a note. Three things this turned up on the way: - `DELETE /api/notes/<id>` hard-deleted the row, leaving no tombstone at all. A permanent delete in the web UI never reached a linked device, which would keep its copy forever and push it back on the next edit. It now purges through the same path as everything else. - The purge left `note_revisions` and `note_link_previews` behind. A revision holds the full body, so the text of a "permanently deleted" note was still sitting in the database. - `deleted_at` now SURVIVES a purge instead of being cleared. It's still true, and it means every query that says "not trashed" excludes tombstones for free — without it a content-less row reads as a perfectly normal active note and shows up on the board as a blank card. Desktop keeps its own clock only when there's nobody else to keep one: the sweep runs at startup on an UNLINKED device and refuses otherwise. A linked client that expired notes on its own schedule could destroy something the server was deliberately keeping, then push that delete upstream. Local policy must never outrank the server's — so it also adopts the server's window for the countdown rather than showing its offline default. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SreJkbxB4gx8pPsu8QbLPi	2026-07-26 16:20:13 -04:00
bvandeusenandClaude Opus 5	fbbe877c46	M10.6: client↔server sync protocol handshake (task 1995) ... Version the sync WIRE PROTOCOL separately from either program's release version, so a self-hosted server and the desktop app can sit on different releases and still work out whether they can talk. Each side declares two numbers — what it speaks, and the oldest counterpart it accepts. Either side can therefore mark a change breaking without the other shipping in step, which is the whole point: no app↔server lockstep. Server advertises on the existing public /api/config (a client must be able to ask "can I talk to you?" before it holds a device token, or even has an account): sync_protocol_version, min_client_protocol_version, sync_features. sync_features exists because a version number can only say newer/older. An ADDITIVE change earns a capability name instead of a minimum bump, so a newer client meeting an older server drops that one feature and syncs the rest, rather than refusing. Raising a minimum is reserved for genuinely breaking changes — it's the switch that hard-blocks the other side. Client half is pure decision logic (sync/compat.rs), no I/O, so every branch is unit-testable — there's no live-server lane in CI. Three outcomes: ok / degraded{unavailable} / incompatible{reason, client_must_update}. The last names which side can fix it, so the message is actionable. A server that predates the handshake sends no protocol fields at all; that reads as "update the server", deliberately not as a parse error, which would look to the user like they mistyped the URL. normalize_base_url defaults a bare host to https://, never http:// — silently downgrading would put a long-lived device token on the wire in cleartext because someone omitted five characters. Plain HTTP on a trusted LAN stays supported; the user types http:// and thereby chooses it. Transport (the actual fetch) lands next, separately: it needs an HTTP/TLS stack, and that's a real risk to the Windows cross-compile lane, so it gets its own CI run to bisect against rather than riding along with this. No UI here by design — the link/settings surface it feeds is M10.7's, per this task's own sequencing. Policy documented in docs/sync.md. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SreJkbxB4gx8pPsu8QbLPi	2026-07-25 22:40:25 -04:00
bvandeusenandClaude Opus 4.8	be34fe8619	M9 S4: sync adopts serialization/parse_dt toolkit + normalizes push oracle ... DRY: - serialize.py: serialize_label_sync(label) = base serialize_label + the delta-only fields (sync_revision/purged_at/created_at via iso()). sync's changes() adopts it; the local _serialize_label_row near-dup is gone. - sync adopts common.parse_dt (drops the byte-identical _parse_client_dt; 4 call sites) and common.iso for the note delta augmentation. (Manual-label reconciliation was already shared in S3.) Fully folding the note re-augmentation into the serializer waits on the notes.py split. - test_sync: drops the now-redundant _parse_client_dt test (parse_dt is covered in test_notes) + its dead import. Security (issue — push existence-oracle): a foreign-owned id on push was rejected with "not yours", distinguishing "another user's note" from a free id. A legit client only pushes ids of notes it created, so that branch is only hit by a probe (or ~0-prob UUID collision) — now a GENERIC "cannot apply" rejection that doesn't confirm the id exists. The residual create-vs-reject status difference is inherent to client-chosen ids over a global PK and is practically unexploitable (a shared note already exposes its id to recipients). Sync behavior operator-verified on deploy (no Postgres CI lane). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm	2026-07-23 21:45:36 -04:00
bvandeusenandClaude Opus 4.8	f1033da75e	M9 S3 (backend): organize routes adopt toolkit + shared label reconciliation ... DRY across the "organize/recall" backend surface: - serialize.py (new): serialize_label(label) — the base {id,name,color} shape. labels.py builds on it (adds count); sync deltas will (S4). - labeling.py (new): resolve_owned_label_ids() + reconcile_manual_labels() — the "set a note's MANUAL (picker) labels, leave the via_tag rows alone" logic was duplicated line-for-line between notes.set_note_labels and sync._apply_note_manual_labels. Now one home; both adopt it (removes the redundant `chosen`==owned recompute in notes). Behavior-preserving. - labels.py: json_error/not_found/parse_uuid, colors.normalize_color, and serialize_label; dropped local LABEL_COLORS + _normalize_label_color (NOTE_COLORS is the single palette) and `import uuid` (rule 22). - saved_filters.py: json_error/not_found/parse_uuid for its 2 uuid parses + error shapes. - graph.py: no change — no error/uuid/palette-normalize duplication to fold. Test: DB-free test_serialize_label_shape guards the base shape. sync.py's reconciliation swap is behavior-identical; operator-verified on deploy (no Postgres CI lane). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm	2026-07-23 21:26:59 -04:00
bvandeusenandClaude Opus 4.8	882d4206aa	M6 1908a: recurring reminders + complete/snooze (backend, no web-push) ... Per operator: skip Web Push; build the rest of reminder delivery. This is the client-agnostic half — the model + logic that foreground/native delivery drives. - notes.recurrence (migration 0022): daily/weekly/monthly/yearly or null. update_note accepts it (cleared when the reminder is cleared); rides export/import + sync push. Serialized on the note. - Pure next_occurrence(remind_at, recurrence, after): the next fire strictly after `after`, rolling past missed occurrences; _add_months clamps the day to the target month (Jan 31 → Feb 28). - POST /api/notes/<id>/reminder/complete — a recurring reminder advances to its next occurrence; a one-off clears. POST .../reminder/snooze {minutes} → remind_at = now + minutes (1 min .. 30 days). No VAPID / push-subscription / service-worker — foreground + native delivery land in the UI commit and the native clients. Tests (DB-free): normalize_recurrence; next_occurrence (daily/weekly/ monthly-clamp/skip-missed/yearly/none); complete + snooze auth-guards. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm	2026-07-23 11:53:07 -04:00
bvandeusenandClaude Opus 4.8	68abaa0f3f	Sync 4: push endpoint POST /api/sync/push (LWW + history snapshot) ... The core conflict-resolution step. Applies a batch of client changes, additive + owner-scoped, with last-write-wins by client edit-time — and a version-history snapshot on every overwrite so nothing is ever lost. client_wins(client_edited_at, server_edited_at): apply iff client >= server; a missing client time never overwrites a real server edit; a missing server time (new row) yields. Notes compare against updated_at; labels gain an updated_at (migration 0017, backfilled from created_at) as their LWW field. Notes: - upsert with a client-supplied id: create if absent, else LWW-apply the full note state (title/body/color/kind/pins/trash/remind/position/items/ manual label_ids) with the same ripple as a web edit — derive_display_title, _rewrite_links, _reconcile_tags (#tags), _rename_inbound_links. Overwriting an existing title/body snapshots the old version into note_revisions first. A resurrected tombstone clears purged_at. - delete: purge tombstone (drop children + attachment files, clear content, set purged_at), LWW-guarded so a newer server edit survives a stale delete. Labels: upsert (create/rename/recolor) + delete (detach from notes, tombstone), LWW-guarded; per-owner name-uniqueness clash on a different id is rejected rather than raising. Response: per-item {status: created|applied|kept|noop|rejected, sync_revision}; the client pulls afterward to converge. Whole-note semantics (client sends the full state, not a partial patch). Tests (DB-free): client_wins across all edit-time combinations; _parse_client_dt; push auth-guard. Apply behavior + triggers operator-verified on deploy. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm	2026-07-22 23:09:23 -04:00
bvandeusenandClaude Opus 4.8	8e40ea1188	Sync 3: pull endpoint GET /api/sync/changes (M8) ... Delta pull for native clients: returns every note + label the caller owns whose sync_revision advanced past ?since=<cursor>, ascending by revision, paginated (?limit, default 500 / max 1000), with the next cursor + has_more. since=0 is a full initial sync. Web app unaffected (new blueprint). Notes and labels share one revision sequence, so the cursor is a single watermark. _page_cursor() handles the two-stream paging: when either stream fills its page, it advances only to the SMALLER of the two page boundaries so nothing between the cursor and the next pull is skipped. Notes reuse _serialize_notes (items/labels/attachments inline) + sync_revision + purged_at (tombstone); labels carry name/color/purged_at/sync_revision. Returns ALL of the owner's notes regardless of state (active/archived/ trash/purged) — a client mirrors everything. Registered sync blueprint. Tests (DB-free): changes auth-guard; _parse_since / _clamp_limit validation; _page_cursor across empty / drained / one-full / both-full. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm	2026-07-22 23:03:06 -04:00