M10.7b: pull the change feed into the local store (task 2105)

Server -> local. sync/wire.rs mirrors the delta-feed JSON exactly as
notes/serialize.py sends it; sync/pull.rs applies it.

ATOMICITY IS THE POINT. The cursor is written in the SAME transaction as the
page it describes. A cursor committed ahead of its data would skip those rows
forever while reporting a clean sync — the worst kind of failure, because
nothing looks wrong. A test forces a mid-page failure and asserts the cursor
stayed put.

Every degradation leans toward re-downloading rather than skipping: an
unparseable cursor means full sync, wire fields are all defaulted so a newer
server adding a field (or an older one omitting one) yields a partial note
instead of a rejected page, and a page that fails rolls back whole.

Labels are applied before notes so a membership never references a row that
doesn't exist. A note also carries enough of its labels to materialize them,
because notes and labels page from ONE shared sequence and a note can arrive
referencing a label whose own delta landed in an earlier page.

via_tag is applied verbatim rather than re-deriving #tags from the body. The
server already reconciled them on save, and re-deriving would go through the
local find-or-create path, which marks new labels dirty — pushing them
straight back. Sync churn manufactured out of nothing.

Duplicate-label merge, the subtle one: a label created offline can collide by
name with one the server already had under a different id. Both sides enforce
one label per name, so the server's row has to win — but simply deleting the
local duplicate would CASCADE its note_labels away, stripping the label off
notes this pull never mentions, with no later page to repair it. So we free
the name, insert the server's row, re-point the memberships, then drop the
husk. Tested.

Children (items/attachments/previews/labels) are replaced wholesale rather
than diffed: a delta carries the note's FULL state, so what arrived IS the
complete set, and diffing could strand a row the server no longer has.

The loop trusts the data over the flag — a server claiming has_more without
advancing its cursor stops with an error instead of spinning forever.

Pull can overwrite a row with unpushed local edits. The documented cycle is
push-then-pull (M10.7c), so that should never happen; when it does it's
counted as clobbered_dirty and logged rather than hidden.

17 tests, all against an in-memory database.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SreJkbxB4gx8pPsu8QbLPi

desktop/src-tauri/src/sync/commands.rs

@@ -9,6 +9,7 @@ use tauri::State;
 use crate::local::Db;
 use crate::sync::client::{self, Identity, ProbeResult};
 use crate::sync::compat::Compatibility;
+use crate::sync::pull;
 use crate::sync::state;
 
 /// Ask a server who it is, without committing to anything. The UI calls this as the
@@ -122,3 +123,26 @@ pub fn sync_status(db: State<'_, Db>) -> Result<state::Status, String> {
     let conn = db.0.lock().map_err(|e| e.to_string())?;
     state::status(&conn).map_err(|e| e.to_string())
 }
+
+/// The server URL + token, or a plain "not linked" error. Every networked sync
+/// command needs exactly this, and none of them may hold the lock past it.
+fn credentials(db: &State<'_, Db>) -> Result<(String, String), String> {
+    let conn = db.0.lock().map_err(|e| e.to_string())?;
+    let current = state::read(&conn).map_err(|e| e.to_string())?;
+    match (current.server_url, current.device_token) {
+        (Some(url), Some(token)) => Ok((url, token)),
+        _ => Err("This app isn't linked to a server yet.".to_string()),
+    }
+}
+
+/// Pull the server's changes into the local store.
+///
+/// Standalone for now; M10.7c wraps push-then-pull into a single `sync_now`, which
+/// is the ordering the protocol assumes. Run alone against unpushed local edits, the
+/// server's version lands on top of them — the returned `clobbered_dirty` count
+/// reports that rather than hiding it.
+#[tauri::command]
+pub async fn sync_pull(db: State<'_, Db>) -> Result<pull::PullSummary, String> {
+    let (base_url, token) = credentials(&db)?;
+    pull::run(db.inner(), &base_url, &token).await
+}