notes: color leaves the model, the wire and all three surfaces

Step 3 of M315, and the destructive half. Steps 1 and 2 stopped every read of
this field: a card is one neutral surface per theme, and the only coloured
thing on a board is a tag. What was left was a column written by a picker and
read by nothing.

Rule 22 — the old path comes out completely. No flag, no fallback, no
"override if set".

Server: the column, the `?color=` facet, the create/update/serialise paths,
the sync assignment, the front-matter line, and Keep's colour map. Alembic
0029 drops it and sweeps `"color"` out of stored saved-filter params — a view
that silently filtered on a field the app no longer has would return nothing
and never say why. That sweep is Python, not `params::jsonb - 'color'`,
because Postgres has no try-cast and one malformed blob would abort a
migration that is running over somebody's saved views.

`NOTE_COLORS` moves from `models/note.py` to `colors.py`. A palette defined on
the model that lost one is an invitation to put the column back; labels still
name a colour, so the vocabulary belongs where the normalizer already is.

Core: the field, the facet, the `NoteCreateInput`, and every read and write in
store/push/pull. Local schema v9 drops the column and does the same
saved-filter sweep, guarded on `json_valid` so a corrupt blob loses a key
rather than becoming NULL. The uniffi layer drops `NoteEdit::Color` and
`NoteDraft.color` with it.

Web: `ColorPicker.vue`, the per-card swatch popover and its stylesheet rule,
the FilterBar colour row, the facet in the query round-trip, and the colour
half of the editor's baseline-and-save. Android: the `ColorSheet`, the
`Picker.COLOR` case, the toolbar's swatch dot, `EditorAction.SetColor`.

## The protocol: v4, and the floor deliberately stays at 3

Checked against `compat.rs` and the push handler rather than trusting the
`#[serde(default)]` annotation, because the v2 precedent points the other way:
v2 dropped `kind` and `title` and DID raise both floors, on the rule that
dropping a field a client sends and expects back is breaking.

`color` fails the second half of that test. A v3 client reading a v4 note gets
`"default"` from its own serde default and draws the colour it derives
locally — the board it drew yesterday. A v3 client pushing `color` has the key
ignored, since `_assign_note_fields` reads its payload key by key and never
validates the shape. Neither direction errors and neither shows anything
wrong. `title` was the note's NAME; this is a field that no longer renders.

So `SYNC_PROTOCOL_VERSION` and `CLIENT_PROTOCOL_VERSION` go to 4, and both
floors stay at 3. `docs/sync.md` carries the reasoning and the per-version
history, and its push example is brought back in line — it still listed
`title`, `kind` and `items`, all gone before this.

Import stays tolerant: a pre-M315 export or a Keep takeout carrying `color:`
imports fine, the key simply read past. Old exports must still import.

#3041

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

core/src/sync/compat.rs

@@ -19,10 +19,24 @@
 use serde::{Deserialize, Serialize};
 
 /// The sync wire protocol this client speaks.
-pub const CLIENT_PROTOCOL_VERSION: u32 = 3;
+///
+/// v4 (M315): `color` left the note. NOT a floor raise on either side — see the note
+/// on [`MIN_SERVER_PROTOCOL_VERSION`].
+pub const CLIENT_PROTOCOL_VERSION: u32 = 4;
 
 /// The oldest server protocol this client can drive — the symmetric half of the
 /// server's `min_client_protocol_version`.
+///
+/// STAYS AT 3 ACROSS v4, and the v2 precedent is the reason to say why rather than
+/// leave it looking like an oversight. v2 dropped `kind` and `title` and DID move both
+/// floors, on the rule that "dropping a field a client sends and expects back is
+/// breaking". `color` fails that test on the second half: a v3 client reading a v4
+/// server gets `"default"` from serde's default and draws the colour it derives
+/// locally, which is a board that looks exactly like the one it drew yesterday. A v3
+/// client PUSHING `color` to a v4 server has the key ignored — the server reads its
+/// payload key by key and never validates the shape. Neither direction errors, and
+/// neither loses anything a person can see; `title` was the note's NAME, and this is a
+/// field that no longer renders anywhere.
 pub const MIN_SERVER_PROTOCOL_VERSION: u32 = 3;
 
 /// Capabilities without which syncing is meaningless, so their absence BLOCKS the

core/src/sync/pull.rs

@@ -240,13 +240,12 @@ fn upsert_note(conn: &Connection, note: &wire::Note) -> rusqlite::Result<()> {
     // `created_at` is deliberately absent from the UPDATE clause: a note's birth time
     // never changes, and the server's copy is the same value anyway.
     conn.execute(
-        "INSERT INTO notes (id, body, color, position, pinned, archived,
+        "INSERT INTO notes (id, body, position, pinned, archived,
                             trashed, remind_at, recurrence, created_at, updated_at,
                             sync_revision, trashed_at, dirty)
-              VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, 0)
+              VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, 0)
          ON CONFLICT(id) DO UPDATE SET
               body          = excluded.body,
-              color         = excluded.color,
               position      = excluded.position,
               pinned        = excluded.pinned,
               archived      = excluded.archived,
@@ -260,7 +259,6 @@ fn upsert_note(conn: &Connection, note: &wire::Note) -> rusqlite::Result<()> {
         params![
             note.id,
             note.body,
-            note.color,
             note.position,
             note.pinned,
             note.archived,
@@ -463,7 +461,6 @@ mod tests {
         wire::Note {
             id: id.to_string(),
             body: "Body".into(),
-            color: "default".into(),
             position: 0,
             pinned: false,
             archived: false,

core/src/sync/push.rs

@@ -64,6 +64,8 @@ pub struct Change {
 
     #[serde(skip_serializing_if = "Option::is_none")]
     pub body: Option<String>,
+    /// A LABEL's colour. A note has none since M315, so a note change leaves this
+    /// `None` and the key never reaches the wire.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub color: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -220,7 +222,6 @@ fn collect_notes(conn: &Connection, out: &mut Vec<Change>, limit: usize) -> rusq
 /// field-to-column mapping stays readable at the call site.
 struct NoteRow {
     body: String,
-    color: String,
     position: i64,
     pinned: bool,
     archived: bool,
@@ -233,22 +234,21 @@ struct NoteRow {
 
 fn note_row(conn: &Connection, id: &str) -> rusqlite::Result<NoteRow> {
     conn.query_row(
-        "SELECT body, color, position, pinned, archived, trashed,
+        "SELECT body, position, pinned, archived, trashed,
                 remind_at, recurrence, created_at, updated_at
            FROM notes WHERE id = ?1",
         params![id],
         |r| {
             Ok(NoteRow {
                 body: r.get(0)?,
-                color: r.get(1)?,
-                position: r.get(2)?,
-                pinned: r.get::<_, i64>(3)? != 0,
-                archived: r.get::<_, i64>(4)? != 0,
-                trashed: r.get::<_, i64>(5)? != 0,
-                remind_at: r.get(6)?,
-                recurrence: r.get(7)?,
-                created_at: r.get(8)?,
-                updated_at: r.get(9)?,
+                position: r.get(1)?,
+                pinned: r.get::<_, i64>(2)? != 0,
+                archived: r.get::<_, i64>(3)? != 0,
+                trashed: r.get::<_, i64>(4)? != 0,
+                remind_at: r.get(5)?,
+                recurrence: r.get(6)?,
+                created_at: r.get(7)?,
+                updated_at: r.get(8)?,
             })
         },
     )
@@ -275,7 +275,8 @@ fn note_change(conn: &Connection, id: &str) -> rusqlite::Result<Change> {
         // server's last-write-wins comparison runs against.
         edited_at: row.updated_at,
         body: Some(row.body),
-        color: Some(row.color),
+        // A note has no colour to send. See the field on `Change`.
+        color: None,
         pinned: Some(row.pinned),
         archived: Some(row.archived),
         trashed: Some(row.trashed),
@@ -497,9 +498,9 @@ mod tests {
 
     fn seed_note(conn: &Connection, id: &str, dirty: i64) {
         conn.execute(
-            "INSERT INTO notes (id, body, color, position, pinned, archived,
+            "INSERT INTO notes (id, body, position, pinned, archived,
                                 trashed, created_at, updated_at, sync_revision, dirty)
-                  VALUES (?1, 'B', 'default', 0, 0, 0, 0,
+                  VALUES (?1, 'B', 0, 0, 0, 0,
                           '2026-07-26T00:00:00.000Z', '2026-07-26T00:00:00.000Z', 3, ?2)",
             params![id, dirty],
         )

core/src/sync/wire.rs

@@ -25,8 +25,6 @@ pub struct Note {
     pub id: String,
     #[serde(default)]
     pub body: String,
-    #[serde(default = "default_color")]
-    pub color: String,
     #[serde(default)]
     pub position: i64,
     #[serde(default)]