notes: color leaves the model, the wire and all three surfaces

Step 3 of M315, and the destructive half. Steps 1 and 2 stopped every read of
this field: a card is one neutral surface per theme, and the only coloured
thing on a board is a tag. What was left was a column written by a picker and
read by nothing.

Rule 22 — the old path comes out completely. No flag, no fallback, no
"override if set".

Server: the column, the `?color=` facet, the create/update/serialise paths,
the sync assignment, the front-matter line, and Keep's colour map. Alembic
0029 drops it and sweeps `"color"` out of stored saved-filter params — a view
that silently filtered on a field the app no longer has would return nothing
and never say why. That sweep is Python, not `params::jsonb - 'color'`,
because Postgres has no try-cast and one malformed blob would abort a
migration that is running over somebody's saved views.

`NOTE_COLORS` moves from `models/note.py` to `colors.py`. A palette defined on
the model that lost one is an invitation to put the column back; labels still
name a colour, so the vocabulary belongs where the normalizer already is.

Core: the field, the facet, the `NoteCreateInput`, and every read and write in
store/push/pull. Local schema v9 drops the column and does the same
saved-filter sweep, guarded on `json_valid` so a corrupt blob loses a key
rather than becoming NULL. The uniffi layer drops `NoteEdit::Color` and
`NoteDraft.color` with it.

Web: `ColorPicker.vue`, the per-card swatch popover and its stylesheet rule,
the FilterBar colour row, the facet in the query round-trip, and the colour
half of the editor's baseline-and-save. Android: the `ColorSheet`, the
`Picker.COLOR` case, the toolbar's swatch dot, `EditorAction.SetColor`.

## The protocol: v4, and the floor deliberately stays at 3

Checked against `compat.rs` and the push handler rather than trusting the
`#[serde(default)]` annotation, because the v2 precedent points the other way:
v2 dropped `kind` and `title` and DID raise both floors, on the rule that
dropping a field a client sends and expects back is breaking.

`color` fails the second half of that test. A v3 client reading a v4 note gets
`"default"` from its own serde default and draws the colour it derives
locally — the board it drew yesterday. A v3 client pushing `color` has the key
ignored, since `_assign_note_fields` reads its payload key by key and never
validates the shape. Neither direction errors and neither shows anything
wrong. `title` was the note's NAME; this is a field that no longer renders.

So `SYNC_PROTOCOL_VERSION` and `CLIENT_PROTOCOL_VERSION` go to 4, and both
floors stay at 3. `docs/sync.md` carries the reasoning and the per-version
history, and its push example is brought back in line — it still listed
`title`, `kind` and `items`, all gone before this.

Import stays tolerant: a pre-M315 export or a Keep takeout carrying `color:`
imports fine, the key simply read past. Old exports must still import.

#3041

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

core/src/local/models.rs

@@ -13,7 +13,6 @@ pub struct Note {
     /// never stored.
     pub display_title: String,
     pub body: String,
-    pub color: String,
     pub position: i64,
     pub pinned: bool,
     pub archived: bool,
@@ -121,16 +120,10 @@ pub struct User {
     pub is_admin: bool,
 }
 
-fn default_color() -> String {
-    "default".to_string()
-}
-
 #[derive(Deserialize)]
 pub struct NoteCreateInput {
     #[serde(default)]
     pub body: String,
-    #[serde(default = "default_color")]
-    pub color: String,
     #[serde(default)]
     pub items: Option<Vec<String>>,
 }
@@ -154,8 +147,6 @@ pub struct Facets {
     #[serde(default)]
     pub q: Option<String>,
     #[serde(default)]
-    pub color: Option<String>,
-    #[serde(default)]
     pub label: Option<Vec<String>>,
     #[serde(default)]
     pub has_reminder: Option<bool>,

core/src/local/schema.rs

@@ -15,7 +15,7 @@ CREATE TABLE notes (
     id           TEXT PRIMARY KEY,
     title        TEXT,
     body         TEXT NOT NULL DEFAULT '',
-    color        TEXT NOT NULL DEFAULT 'default',
+    color        TEXT NOT NULL DEFAULT 'default', -- dropped in v9; kept so DROP COLUMN has something to drop
     kind         TEXT NOT NULL DEFAULT 'text',   -- dropped in v6; kept so DROP COLUMN has something to drop
     position     INTEGER NOT NULL DEFAULT 0,
     pinned       INTEGER NOT NULL DEFAULT 0,
@@ -250,6 +250,24 @@ fn migrate_v8(conn: &Connection) -> rusqlite::Result<()> {
 }
 
 /// Bring the database up to the latest schema. Idempotent.
+// v9 (M315): `notes.color` is gone. A card is one neutral surface now and colour lives
+// only on a tag, so the column was written by a picker nothing read and read by nothing
+// at all. `labels.color` is untouched — that is the colour that survived.
+//
+// The saved-filter sweep is the second half and not optional. `params` is opaque JSON
+// and a stored view could carry `"color": "teal"`; with the facet gone that key would
+// sit there forever, and a view that silently filters on a field the app no longer has
+// is worse than one that lost a criterion. Guarded on `json_valid` because a corrupt
+// blob must lose a key, not become NULL.
+const SCHEMA_V9: &str = r#"
+ALTER TABLE notes DROP COLUMN color;
+
+UPDATE saved_filters
+   SET params = json_remove(params, '$.color')
+ WHERE json_valid(params)
+   AND json_extract(params, '$.color') IS NOT NULL;
+"#;
+
 pub fn migrate(conn: &Connection) -> rusqlite::Result<()> {
     conn.execute_batch("PRAGMA foreign_keys = ON;")?;
     let version: i64 = conn.query_row("PRAGMA user_version", [], |r| r.get(0))?;
@@ -285,6 +303,10 @@ pub fn migrate(conn: &Connection) -> rusqlite::Result<()> {
         migrate_v8(conn)?;
         conn.execute_batch("PRAGMA user_version = 8;")?;
     }
+    if version < 9 {
+        conn.execute_batch(SCHEMA_V9)?;
+        conn.execute_batch("PRAGMA user_version = 9;")?;
+    }
     Ok(())
 }
 

core/src/local/store.rs

@@ -141,7 +141,7 @@ fn load_previews(conn: &Connection, note_id: &str) -> rusqlite::Result<Vec<LinkP
 
 fn load_note(conn: &Connection, id: &str) -> rusqlite::Result<Note> {
     let mut note = conn.query_row(
-        "SELECT id, body, color, position, pinned, archived, trashed, remind_at, recurrence, created_at, updated_at, trashed_at
+        "SELECT id, body, position, pinned, archived, trashed, remind_at, recurrence, created_at, updated_at, trashed_at
          FROM notes WHERE id = ?1",
         [id],
         |r| {
@@ -150,14 +150,13 @@ fn load_note(conn: &Connection, id: &str) -> rusqlite::Result<Note> {
                 id: r.get(0)?,
                 display_title: String::new(), // filled below — it may need a query
                 body,
-                color: r.get(2)?,
-                position: r.get(3)?,
-                pinned: r.get(4)?,
-                archived: r.get(5)?,
-                trashed: r.get(6)?,
-                deleted_at: r.get(11)?,
-                remind_at: r.get(7)?,
-                recurrence: r.get(8)?,
+                position: r.get(2)?,
+                pinned: r.get(3)?,
+                archived: r.get(4)?,
+                trashed: r.get(5)?,
+                deleted_at: r.get(10)?,
+                remind_at: r.get(6)?,
+                recurrence: r.get(7)?,
                 labels: Vec::new(),
                 items: Vec::new(),
                 attachments: Vec::new(),
@@ -327,10 +326,6 @@ pub fn list_notes(conn: &Connection, q: &ListQuery) -> rusqlite::Result<Vec<Note
             binds.push(pat.clone());
             binds.push(pat);
         }
-        if let Some(c) = f.color.as_deref().filter(|s| !s.is_empty()) {
-            sql.push_str(" AND color = ?");
-            binds.push(c.to_string());
-        }
         if f.has_reminder == Some(true) {
             sql.push_str(" AND remind_at IS NOT NULL");
         }
@@ -428,9 +423,9 @@ pub fn create_note(conn: &Connection, input: &NoteCreateInput) -> rusqlite::Resu
         }
     }
     conn.execute(
-        "INSERT INTO notes (id, body, color, position, created_at, updated_at, dirty)
-         VALUES (?1, ?2, ?3, ?4, ?5, ?5, 1)",
-        params![id, body, input.color, position, ts],
+        "INSERT INTO notes (id, body, position, created_at, updated_at, dirty)
+         VALUES (?1, ?2, ?3, ?4, ?4, 1)",
+        params![id, body, position, ts],
     )?;
     // The FOLDED body, not the input one: an item can carry a #tag too.
     lift_and_sync_tags(conn, &id, &body)?;
@@ -508,11 +503,6 @@ pub fn update_note(conn: &Connection, id: &str, changes: &Value) -> rusqlite::Re
                 )?;
                 lift_and_sync_tags(conn, id, body)?;
             }
-            "color" => {
-                if let Some(s) = v.as_str() {
-                    conn.execute("UPDATE notes SET color = ?1 WHERE id = ?2", params![s, id])?;
-                }
-            }
             "pinned" => {
                 if let Some(b) = v.as_bool() {
                     conn.execute("UPDATE notes SET pinned = ?1 WHERE id = ?2", params![b, id])?;