@anchrd/intel-api 0.34.0 → 0.35.0

package/dist/adapters/cloudflare/cloudflare.js

@@ -192,6 +192,10 @@ export default {
             id: ulid,
             now,
             folderAccess: async (actor, folderId) => await nodes.folderAccess(actor, folderId),
+            // ⚠️ Straight to the repository, past the node service: this one question is asked WITHOUT the
+            // visibility predicate on purpose (#733), and a service method taking an actor would invite
+            // somebody to hand one in.
+            parentArchivedAt: async (folderId) => await nodeRepository.parentArchivedAt(folderId),
             nodeChildren: async (actor, folderId, limit) => await nodes.childrenBounded(actor, { parentId: folderId, limit }),
             // The tree's own visibility lookup, unchanged on the way through: the relation graph, the
             // requirements list and every tree link of every run read this one answer, so none of

package/dist/adapters/db/db-flows.js

@@ -739,8 +739,19 @@ export function createFlowRepository(deps) {
         async archiveFlow(input) {
             try {
                 await deps.db.batch([
+                    /**
+                     * ⚠️ **`archived_with` is CLEARED here, in both directions** (D71, #733, found in review
+                     * of #738). A flow that travels through this door travels alone, so it belongs to no
+                     * group: archiving it on its own must not leave it looking like part of one, and a row
+                     * that still pointed at a group it no longer belongs to would come back with that group's
+                     * next restore.
+                     *
+                     * The group itself is written by ONE place, the cascade in `archiveNode`. Minting an
+                     * operation here as well would be a second writer for one column, and it would have no
+                     * reader: for a restore, "no group" and "somebody else's group" are the same answer.
+                     */
                     deps.db
-                        .prepare(`UPDATE flows SET archived_at = ?, updated_at = ?
+                        .prepare(`UPDATE flows SET archived_at = ?, archived_with = NULL, updated_at = ?
               WHERE id = ? AND updated_at = ?`)
                         .bind(input.archivedAt, input.updatedAt, input.flowId, input.baseUpdatedAt),
                     deps.db

package/dist/adapters/db/db.js

@@ -176,22 +176,6 @@ export function createNodeRepository(deps) {
                 withChildren: rows.filter((row) => row.has_children === 1).map((row) => row.id),
             };
         },
-        /**
-         * ⚠️ Deliberately NOT `visibleChildren`: that builder cuts tasks out of every level, so it
-         * answers `0` for a task with any number of subtasks. This one asks the question the guard
-         * actually has — "is anything still hanging under this node".
-         */
-        async countLiveChildren(nodeId) {
-            // ⚠️ No `allowed` join, deliberately: a grant can sit on a single node, so a child may be
-            // invisible to whoever archives its parent. Filtered by visibility this answers `0`, the
-            // refusal does not fire, and the child is later purged without being named. A count leaks a
-            // number and nothing else; the alternative leaks the child itself, permanently.
-            const result = await deps.db
-                .prepare("SELECT COUNT(*) AS total FROM nodes WHERE parent_id = ? AND archived_at IS NULL")
-                .bind(nodeId)
-                .first();
-            return result?.total ?? 0;
-        },
         async listVisibleBounded(actor, input) {
             const result = await deps.db
                 .prepare(visibleChildren(true))
@@ -580,13 +564,114 @@ export function createNodeRepository(deps) {
             return "conflict";
         },
         async archiveNode(input) {
+            const archiving = input.archivedAt !== null;
+            /**
+             * ⚠️ **The operation a node falls with, read BEFORE anything moves** (D71, #733).
+             *
+             * Archiving takes the whole subtree, so a restore needs to know which nodes fell TOGETHER —
+             * anything already archived before keeps its own older operation and stays archived. On the
+             * way in that is the new id; on the way back it is the one the root already carries, and it
+             * has to be read here because the first statement below clears it.
+             *
+             * ⚠️ `NULL` is not a group. A node archived before this migration carries `NULL`, and
+             * restoring it must bring back that node alone — matching on `NULL` would revive every node
+             * ever archived before the migration ran.
+             */
+            const group = archiving
+                ? input.operationId
+                : ((await deps.db
+                    .prepare("SELECT archived_with FROM nodes WHERE id = ?")
+                    .bind(input.nodeId)
+                    .first())?.archived_with ?? null);
+            const subtree = `WITH RECURSIVE tree(id) AS (
+        SELECT id FROM nodes WHERE id = ?
+        UNION SELECT child.id FROM nodes child JOIN tree parent ON child.parent_id = parent.id
+      )`;
+            /**
+             * ⚠️ **Every cascading statement carries the same guard, not just the first** (#457). A
+             * `D1.batch` is one transaction, but a statement matching zero rows is not an error — so
+             * without `EXISTS` on the root the children would fall while the root stayed put, taken out
+             * by the `updated_at` guard on statement one, and the caller would be told about a conflict
+             * that had already half happened.
+             */
+            const rootMoved = archiving
+                ? "EXISTS (SELECT 1 FROM nodes WHERE id = ? AND archived_at = ? AND archived_with = ?)"
+                : "EXISTS (SELECT 1 FROM nodes WHERE id = ? AND archived_at IS NULL)";
+            const cascade = archiving
+                ? [
+                    // The subtree, minus what was already archived: those keep their own operation.
+                    deps.db
+                        .prepare(`${subtree}
+                UPDATE nodes SET archived_at = ?, archived_with = ?, updated_at = ?
+                WHERE id IN (SELECT id FROM tree) AND id != ? AND archived_at IS NULL
+                  AND ${rootMoved}`)
+                        .bind(input.nodeId, input.archivedAt, input.operationId, input.updatedAt, input.nodeId, input.nodeId, input.archivedAt, input.operationId),
+                    // Flows hang in the same tree by `parent_id` and carry their own `archived_at`.
+                    deps.db
+                        .prepare(`${subtree}
+                UPDATE flows SET archived_at = ?, archived_with = ?, updated_at = ?
+                WHERE parent_id IN (SELECT id FROM tree) AND archived_at IS NULL
+                  AND ${rootMoved}`)
+                        .bind(input.nodeId, input.archivedAt, input.operationId, input.updatedAt, input.nodeId, input.archivedAt, input.operationId),
+                ]
+                : group === null
+                    ? []
+                    : [
+                        /**
+                         * ⚠️ **The group AND the subtree, not the group alone** (found in review of #738).
+                         * Matching on the operation by itself made restoring a leaf bring back its former
+                         * parent and every sibling that fell with it: one card pulled out of a board's
+                         * archive column put the whole card tree back. The walk starts at the node being
+                         * restored, so a leaf restores itself and a folder restores what hangs under it.
+                         */
+                        deps.db
+                            .prepare(`${subtree}
+                  UPDATE nodes SET archived_at = NULL, archived_with = NULL, updated_at = ?
+                  WHERE id IN (SELECT id FROM tree) AND id != ? AND archived_with = ?
+                    AND ${rootMoved}`)
+                            .bind(input.nodeId, input.updatedAt, input.nodeId, group, input.nodeId),
+                        deps.db
+                            .prepare(`${subtree}
+                  UPDATE flows SET archived_at = NULL, archived_with = NULL, updated_at = ?
+                  WHERE parent_id IN (SELECT id FROM tree) AND archived_with = ?
+                    AND ${rootMoved}`)
+                            .bind(input.nodeId, input.updatedAt, group, input.nodeId),
+                    ];
+            // How many rows this operation moves besides the root, read before it moves them: the journal
+            // line is written inside the same batch and cannot count what it is doing.
+            const cascadeSize = archiving
+                ? ((await deps.db
+                    .prepare(`WITH RECURSIVE tree(id) AS (
+                SELECT id FROM nodes WHERE id = ?
+                UNION SELECT child.id FROM nodes child JOIN tree parent ON child.parent_id = parent.id
+              )
+              SELECT (SELECT COUNT(*) FROM nodes WHERE id IN (SELECT id FROM tree) AND id != ?
+                        AND archived_at IS NULL)
+                   + (SELECT COUNT(*) FROM flows WHERE parent_id IN (SELECT id FROM tree)
+                        AND archived_at IS NULL) AS total`)
+                    .bind(input.nodeId, input.nodeId)
+                    .first())?.total ?? 0)
+                : group === null
+                    ? 0
+                    : ((await deps.db
+                        .prepare(`WITH RECURSIVE tree(id) AS (
+                  SELECT id FROM nodes WHERE id = ?
+                  UNION SELECT child.id FROM nodes child JOIN tree parent ON child.parent_id = parent.id
+                )
+                SELECT (SELECT COUNT(*) FROM nodes WHERE id IN (SELECT id FROM tree) AND id != ?
+                          AND archived_with = ?)
+                     + (SELECT COUNT(*) FROM flows WHERE parent_id IN (SELECT id FROM tree)
+                          AND archived_with = ?) AS total`)
+                        .bind(input.nodeId, input.nodeId, group, group)
+                        .first())?.total ?? 0);
             try {
                 await deps.db.batch([
                     deps.db
                         .prepare(`UPDATE nodes
-              SET archived_at = ?, updated_at = ?
+              SET archived_at = ?, archived_with = ?, updated_at = ?
               WHERE id = ? AND updated_at = ?`)
-                        .bind(input.archivedAt, input.updatedAt, input.nodeId, input.baseUpdatedAt),
+                        .bind(input.archivedAt, archiving ? input.operationId : null, input.updatedAt, input.nodeId, input.baseUpdatedAt),
+                    ...cascade,
                     deps.db
                         .prepare(`INSERT INTO idempotency_keys (
               actor_id, operation, idempotency_key, resource_id, created_at
@@ -605,7 +690,22 @@ export function createNodeRepository(deps) {
               WHERE actor_id = ? AND operation = 'node.archive'
                 AND idempotency_key = ? AND resource_id = ?
             )`)
-                        .bind(input.auditId, input.actorId, input.nodeId, JSON.stringify({ archived: input.archivedAt !== null }), input.updatedAt, input.actorId, input.idempotencyKey, input.nodeId),
+                        .bind(input.auditId, input.actorId, input.nodeId, 
+                    /**
+                     * ⚠️ **The operation and the SIZE of what moved** (D71, #733). One `node.archive` now
+                     * moves a whole subtree, and the change journal (#747) reads this table: without the
+                     * count, archiving a folder makes N documents disappear from every list behind a
+                     * single line that names only the folder.
+                     *
+                     * ⚠️ What this row does NOT carry is WHICH nodes fell. After a restore the column is
+                     * cleared, so that list is gone; if it is ever needed, it needs its own row per node
+                     * and that is a decision, not a detail.
+                     */
+                    JSON.stringify({
+                        archived: input.archivedAt !== null,
+                        operation: group,
+                        cascaded: cascadeSize,
+                    }), input.updatedAt, input.actorId, input.idempotencyKey, input.nodeId),
                 ]);
             }
             catch (error) {
@@ -630,6 +730,38 @@ export function createNodeRepository(deps) {
                 .first();
             return row ? mapNode(row) : "conflict";
         },
+        async parentArchivedAt(nodeId) {
+            // ⚠️ **No visibility predicate, and that is the whole point of this query** (found in review
+            // of #738). A grant can sit on a single node (ADR-0004 §2), so whoever may restore a child may
+            // well not see the folder above it. Asked through `getVisible`, that folder answers `null`,
+            // the guard reads "not archived", and a live node ends up under an archived one — where the
+            // purge takes it unnamed. It is the same lesson `countLiveChildren` carried before D71
+            // replaced it, and the same mistake was made again in its place.
+            //
+            // It leaks one timestamp about a node the caller cannot open. The alternative leaks the node
+            // itself, permanently.
+            const row = await deps.db
+                .prepare("SELECT archived_at, kind FROM nodes WHERE id = ?")
+                .bind(nodeId)
+                .first();
+            return row ? { archivedAt: row.archived_at, kind: row.kind } : null;
+        },
+        async versionIdsInSubtree(nodeId) {
+            // ⚠️ No visibility predicate and no archived filter, for the reason `hasAnyChild` gives: this
+            // answers what the INDEX has to be told about, not what somebody may look at. A node whose
+            // vectors stay behind pays for itself out of everybody else's search results (#348).
+            const rows = await deps.db
+                .prepare(`WITH RECURSIVE tree(id) AS (
+          SELECT id FROM nodes WHERE id = ?
+          UNION SELECT child.id FROM nodes child JOIN tree parent ON child.parent_id = parent.id
+        )
+        SELECT n.current_version_id AS version_id FROM nodes n
+        JOIN tree ON tree.id = n.id
+        WHERE n.current_version_id IS NOT NULL`)
+                .bind(nodeId)
+                .all();
+            return (rows.results ?? []).map((row) => row.version_id);
+        },
         async hasAnyChild(nodeId) {
             // ⚠️ Without a visibility predicate and without an archived filter, both on purpose: this
             // answers whether the row can be deleted at all, not what somebody may look at (#457).
@@ -675,12 +807,12 @@ export function createNodeRepository(deps) {
         UNION ALL SELECT child.id FROM nodes child JOIN tree parent ON child.parent_id = parent.id
       )`;
             const nodes = await deps.db
-                .prepare(`${tree} SELECT n.id, n.kind FROM nodes n JOIN tree ON tree.id = n.id`)
+                .prepare(`${tree} SELECT n.id, n.kind, n.title FROM nodes n JOIN tree ON tree.id = n.id`)
                 .bind(nodeId)
                 .all();
             const nodeIds = (nodes.results ?? []).map((row) => row.id);
             const flows = await deps.db
-                .prepare(`${tree} SELECT f.id FROM flows f WHERE f.parent_id IN (SELECT id FROM tree)`)
+                .prepare(`${tree} SELECT f.id, f.title FROM flows f WHERE f.parent_id IN (SELECT id FROM tree)`)
                 .bind(nodeId)
                 .all();
             const keys = await deps.db
@@ -702,6 +834,26 @@ export function createNodeRepository(deps) {
                 counts[row.kind] = (counts[row.kind] ?? 0) + 1;
             return {
                 nodeIds,
+                // The names the preview shows, capped there rather than here: a caller that wants the whole
+                // tree has `nodeIds`, and the cap belongs where the sentence is written (#733).
+                /**
+                 * ⚠️ **Flows FIRST, and the order is the finding rather than a preference** (second review
+                 * of #738). The preview names the first fifty, so with flows appended a folder holding
+                 * fifty documents and one flow named every document and hid the flow — the one thing the
+                 * cascade had to be widened for, and the one a reader is least likely to expect in there.
+                 */
+                named: [
+                    ...(flows.results ?? []).map((row) => ({
+                        id: row.id,
+                        kind: "flow",
+                        title: row.title,
+                    })),
+                    ...(nodes.results ?? []).map((row) => ({
+                        id: row.id,
+                        kind: row.kind,
+                        title: row.title,
+                    })),
+                ],
                 flowIds: (flows.results ?? []).map((row) => row.id),
                 contentKeys: [...new Set((keys.results ?? []).map((row) => row.content_key))],
                 vectorKeys: nodeIds.map((id) => ({ nodeId: id, keys: grouped.get(id) ?? [] })),

package/dist/boards/boards.js

@@ -216,7 +216,10 @@ export function createBoards(deps) {
              * design exists against.
              *
              * `nodes.archive` is the same door `node_archive` uses — one path, one audit row, one set of
-             * refusals (a card with live subtasks is still refused, #669).
+             * refusals. ⚠️ Since D71 (#733) that door CASCADES: dropping a card with subtasks on the
+             * archive column takes them with it, where #669 used to refuse the drop. Pulling the card back
+             * out brings exactly those back, and pulling a SUBTASK out while its parent card is archived
+             * is refused instead — a live card under an archived one is what the purge reaches.
              */
             const intoArchive = input.status === ARCHIVE_COLUMN_ID;
             const outOfArchive = input.status !== undefined && !intoArchive && row.archivedAt !== null;

package/dist/flows/flows.js

@@ -1446,6 +1446,23 @@ export function createFlows(deps) {
                     throw new IntelError(404, "flow_not_found", "Flow was not found");
                 return flow;
             }
+            /**
+             * ⚠️ **A flow cannot be restored on its own into an archived folder** (D71, #733, found in
+             * review of #738). The same refusal `nodes.archive` carries, and for the same reason: a live
+             * flow under an archived folder is reached by a purge of that folder, which checks
+             * `archived_at` on its root alone and walks the whole subtree.
+             */
+            if (!input.archived && current.parentId !== null) {
+                // ⚠️ Asked WITHOUT the visibility predicate, and that is the difference between a guard and
+                // a decoration: a flow is reachable through `flow_grants` on its own, so its grantee may not
+                // see the folder it is filed in. `folderAccess` answers `missing` for such a folder, the
+                // guard would not fire, and a live flow would hang under an archived one — where the purge
+                // of that folder takes it through `parent_id IN tree`.
+                const folder = await deps.parentArchivedAt(current.parentId);
+                if (folder?.archivedAt) {
+                    throw new IntelError(409, "parent_archived", "The folder this flow is filed in is archived, so it cannot be restored on its own. Restore the folder first, and this comes back with it.");
+                }
+            }
             const updatedAt = deps.now().toISOString();
             const updated = await deps.repository.archiveFlow({
                 flowId: current.id,

package/dist/flows/flows.types.d.ts

@@ -224,6 +224,10 @@ export interface FlowDeps {
     id(): string;
     now(): Date;
     folderAccess(actor: FlowActor, folderId: string): Promise<FolderAccess>;
+    parentArchivedAt(folderId: string): Promise<{
+        archivedAt: string | null;
+        kind: string;
+    } | null>;
     /**
      * The children of one folder of the shared tree as this actor may see them, without their bodies.
      * `null` is the root. The node service answers, for the same reason `folderAccess` does.

package/dist/mcp/mcp.js

@@ -640,7 +640,7 @@ export async function handleMcp(request, deps) {
          */
         server.registerTool("node_purge_preview", {
             title: "Preview a permanent deletion",
-            description: "Count what deleting one ARCHIVED node for good would take with it: every item in its subtree, documents and flows alike, and how many documents elsewhere link to it. It changes nothing. Ask before node_purge — afterwards there is no row left to count, and the links that break are not refused, only reported.",
+            description: "Ask before node_purge, afterwards there is no row left to count. Names and counts what deleting one ARCHIVED node for good would take with it: the nodes and flows in its subtree with their titles, capped at fifty with the total beside it, plus how many documents link to it from outside. Changes nothing.",
             inputSchema: PurgeNodePreviewInput,
             annotations: {
                 title: "Preview a permanent deletion",

package/dist/nodes/nodes.js

@@ -87,14 +87,14 @@ function decodeBase64(value) {
  * ⚠️ **Nothing may be filed under an ARCHIVED node**, and this is not tidiness — it is what keeps
  * the purge honest.
  *
- * A parent may be archived while it is empty; `task_has_subtasks` only refuses one that still has
- * live children. Without this rule it could then GAIN a live child afterwards, and `purge` — which
- * asks only whether the node itself is archived — walks the whole subtree and takes that child
- * with it. It would disappear for good without ever being named in the confirmation.
+ * Archiving takes the whole subtree since D71 (#733), so an archived node holds nothing live at the
+ * moment it is archived. Without this rule it could GAIN one afterwards, and `purge` — which asks
+ * only whether the node itself is archived — walks the whole subtree and takes that child with it.
+ * It would disappear for good without ever being named in the confirmation.
  *
  * Found in review of #669, against my own sentence claiming purge needed no rule of its own. That
- * sentence was true only as long as an archived node could never gain a live child, and nothing
- * made it true.
+ * sentence was true only as long as an archived node could never gain a live child, and until #679
+ * and D71 nothing made it true: the guard covered tasks alone, and archiving covered one row.
  */
 /**
  * The board a node would be filed on: the board itself, or the board of the task it hangs under
@@ -120,17 +120,19 @@ async function boardFor(deps, actor, parent) {
         return null;
     return (await deps.boardOfTask?.(actor, parent.id)) ?? null;
 }
+// How many of the nodes a purge would take are named in the preview. High enough that an ordinary
+// folder is listed in full, low enough that a tree nobody can render is not built (#733).
+const PURGE_PREVIEW_NAMES = 50;
 function refuseArchivedParent(parent) {
     // ⚠️ EVERY kind, not just tasks (#679). It was narrowed to tasks in #677 because widening it out
     // of a board ticket would have changed the whole tree with no test outside `boards.int.ts`; the
     // hole it left is older than that ticket and is what this one closes.
     //
-    // ⚠️ **This asks the DIRECT parent only, and the hole one level up stays open** (#733). Archiving a
-    // folder that still holds something live is allowed for every kind but `task`, so `Aussen`
-    // archived over a live `Innen` still takes anything filed under `Innen` when it is purged:
-    // `inspectPurgeTree` walks the whole subtree and `purge` checks `archived_at` on the root alone.
-    // Closing that needs a decision (refuse the archive, cascade it, refuse the purge, or name the
-    // live nodes in the preview) and #733 carries it with the count of what already exists.
+    // ⚠️ **The DIRECT parent is enough since D71 (#733), and only since then.** Archiving cascades, so
+    // an archived node holds nothing live at the moment it is archived, and a restore under an
+    // archived parent is refused: there is no live node under an archived one for something to be
+    // filed beneath. Before that, this guard closed one level while `Aussen` archived over a live
+    // `Innen` still handed anything filed under `Innen` to the purge.
     if (parent === null || parent.archivedAt === null)
         return;
     throw new IntelError(409, "parent_archived", `This ${parent.kind} is archived, so nothing new can be filed under it. Restore it first.`);
@@ -516,6 +518,19 @@ export function createNodes(deps) {
             return {
                 inboundLinks: await deps.repository.countInboundLinks(node.id),
                 totalItems: tree.nodeIds.length + tree.flowIds.length,
+                /**
+                 * ⚠️ **Named, not just counted** (D71, #733), and the cap is stated rather than silent:
+                 * `totalItems` keeps counting past it, so a surface can always say "and 40 more". Whoever
+                 * confirms a purge is deciding about things, and "82 items" is not a thing.
+                 *
+                 * The node itself is in here too. It is the one the caller named, so it is the one they can
+                 * check the list against.
+                 */
+                items: tree.named.slice(0, PURGE_PREVIEW_NAMES).map((entry) => ({
+                    id: entry.id,
+                    kind: entry.kind,
+                    title: entry.title,
+                })),
             };
         },
         /**
@@ -552,6 +567,10 @@ export function createNodes(deps) {
         // its ACLs, rather than being reimplemented on the flow side.
         async folderAccess(actor, folderId) {
             const folder = await deps.repository.getVisible(actor, folderId);
+            // ⚠️ An archived folder answers `missing` rather than a state of its own: filing into one is
+            // refused exactly like filing into one that is not there. The question "is the folder above
+            // archived" is asked by `parentArchivedAt` instead, because it must not run through the
+            // visibility predicate at all (#733).
             if (!folder || folder.archivedAt)
                 return "missing";
             if (folder.kind !== "folder")
@@ -1033,24 +1052,50 @@ export function createNodes(deps) {
             if (replayedId)
                 return await requireVisible(actor, replayedId);
             /**
-             * ⚠️ **A task with live subtasks is refused, not archived with them** (#669).
-             * `destructive.md`: *verweigern schlägt kaskadieren* — a cascade turns one confirmed click
-             * into an unknown number of disappearances, and the question that was asked ("archive this
-             * card") cannot then name what actually vanishes.
+             * ⚠️ **Archiving takes the whole subtree, flows included** (D71, #733), and the refusal that
+             * used to stand here is gone with it. `task_has_subtasks` (#669) refused a card with live
+             * subtasks, on the reasoning that a cascade turns one confirmed click into an unknown number
+             * of disappearances.
+             *
+             * That reasoning holds for `purge` and not for this call. The two steps are not symmetric:
+             * archiving is REVERSIBLE, so cascading it costs nothing that cannot be undone, while `purge`
+             * has cascaded over the subtree since #492 and cannot be undone at all. With the cascade on
+             * this side, nothing live sits under an archived node any more — which is precisely what
+             * makes the purge honest, and what `refuseArchivedParent` below keeps true afterwards.
+             *
+             * ⚠️ The counterpart is the restore, and it is the part that can quietly do too much or too
+             * little. It brings back what fell with THIS operation **and hangs under the node being
+             * restored** — a child archived earlier keeps its own operation and stays archived, and
+             * restoring a leaf does not drag its whole former tree back with it.
+             */
+            /**
+             * ⚠️ **Archiving something that is already archived changes nothing, deliberately** (found in
+             * review of #738). Without this it mints a NEW operation on the root while the cascade skips
+             * every child (`archived_at IS NULL`), so the children keep the old one — and a later restore
+             * hands back an empty folder while its contents stay archived, with nothing saying so.
              *
-             * ⚠️ It is refused only ON THE WAY IN. Restoring a parent must stay possible, or a card
-             * archived together with its children by an older path could never come back.
+             * The likeliest way there is not misuse but a retry after a timeout with a fresh idempotency
+             * key: the key does not catch it, and the operation is re-minted.
+             */
+            if (input.archived && current.archivedAt !== null)
+                return current;
+            /**
+             * ⚠️ **A restore under an archived parent is refused, and this is the other half of
+             * `refuseArchivedParent`** (found in review of #738). Without it the cascade closes nothing:
+             * archive a child alone, archive the folder over it, restore the child, and a LIVE node hangs
+             * under an archived one again — where `purge` reaches it, because it checks `archived_at` on
+             * the root alone and walks the whole subtree.
              *
-             * The other half — `purge` — needs no rule of its own, but ONLY together with
-             * `refuseArchivedParent` below: only an archived node may be purged, a parent cannot reach
-             * that state while a child is live, and nothing new may be filed under it afterwards. Take
-             * any one of the three away and a live card can be deleted for good without being named —
-             * which is what the review of #669 found in the first version of this sentence.
+             * The refusal names the way out rather than the rule: whoever wants this child back wants the
+             * folder back first, and then the child comes with it.
              */
-            if (input.archived && current.kind === "task") {
-                const children = await deps.repository.countLiveChildren(current.id);
-                if (children > 0) {
-                    throw new IntelError(409, "task_has_subtasks", `This card still has ${children} subtask(s). Archive them first, or move them somewhere else — archiving a card does not archive what hangs under it.`);
+            if (!input.archived && current.parentId !== null) {
+                // ⚠️ Read WITHOUT the visibility predicate, see `parentArchivedAt`: asked through
+                // `getVisible` this guard misses exactly the actor it exists for, the one holding a grant on
+                // the child alone.
+                const parent = await deps.repository.parentArchivedAt(current.parentId);
+                if (parent?.archivedAt) {
+                    throw new IntelError(409, "parent_archived", `This ${parent.kind} is archived, so nothing under it can be restored on its own. Restore it first, and this comes back with it.`);
                 }
             }
             const updatedAt = deps.now().toISOString();
@@ -1058,6 +1103,7 @@ export function createNodes(deps) {
                 nodeId: current.id,
                 baseUpdatedAt: input.baseUpdatedAt,
                 archivedAt: input.archived ? updatedAt : null,
+                operationId: deps.id(),
                 updatedAt,
                 actorId: actor.id,
                 idempotencyKey: input.idempotencyKey,
@@ -1083,9 +1129,21 @@ export function createNodes(deps) {
              *
              * A replayed archive never reaches this line — it returned above, on the idempotency key — so
              * repeating the same call does not ask the index to forget the same names twice.
+             *
+             * ⚠️ **The whole subtree, not the root** (D71, #733, found in review of #738). Since archiving
+             * cascades, a folder with fifty documents takes fifty nodes out of sight — and every one of
+             * them would keep its place in the candidate list if only the root were enqueued. The pass
+             * reads each node's state, so a node that was already archived costs one no-op rather than a
+             * wrong answer.
+             *
+             * ⚠️ It is one enqueue per versioned node in the subtree, sequentially, and each one is a
+             * subrequest. A tree large enough runs into the Workers limit AFTER the batch has committed:
+             * archived tree, error to the caller, index half followed. That is #754, and it needs
+             * `sendBatch` or a sweeper rather than a cap here — a cap would be the silent kind.
              */
-            if (updated.currentVersionId)
-                await deps.indexing.enqueue(updated.currentVersionId);
+            for (const versionId of await deps.repository.versionIdsInSubtree(updated.id)) {
+                await deps.indexing.enqueue(versionId);
+            }
             return updated;
         },
         /**

package/dist/nodes/nodes.types.d.ts

@@ -55,23 +55,6 @@ export interface NodeRepository {
         limit: number;
     }): Promise<BoundedChildren>;
     getVisible(actor: Actor, nodeId: string): Promise<Node | null>;
-    /**
-     * How many live children this node has — **every kind, tasks included** (#669).
-     *
-     * ⚠️ **`listVisibleBounded` cannot answer this**, and the difference is invisible at the call
-     * site: that query runs through `visibleChildren`, which cuts `kind = 'task'` out of every level
-     * so a board shows no cards in the tree (D66). Asked about a task, it therefore answers `0` for
-     * every task that ever existed — a guard built on it would never fire once, and nothing would
-     * report that. Two queries with similar names are two different questions
-     * (`destructive.md`, `anchrd/intel#457`).
-     *
-     * ⚠️ **It takes no actor, and that is the second half of the same lesson.** A grant can sit on a
-     * single node (ADR-0004 §2), so a child may be invisible to whoever archives its parent. Counted
-     * through the visibility predicate, such a child reads as `0`, the refusal does not fire, the
-     * parent becomes purgeable — and the child is deleted for good without ever being named. The
-     * question here is "is anything still hanging under this node", not "what may this actor see".
-     */
-    countLiveChildren(nodeId: string): Promise<number>;
     listVisibleSubtree(actor: Actor, rootId: string | null): Promise<SubtreeNode[]>;
     can(actor: Actor, nodeId: string, verb: ResourceVerb): Promise<boolean>;
     findIdempotentNode(actorId: string, operation: "node.create" | "node.save" | "node.append" | "node.update" | "node.archive" | "node.share" | "node.revoke" | SnapshotOperation, idempotencyKey: string): Promise<string | null>;
@@ -96,16 +79,27 @@ export interface NodeRepository {
         nodeId: string;
         baseUpdatedAt: string;
         archivedAt: string | null;
+        operationId: string;
         updatedAt: string;
         actorId: string;
         idempotencyKey: string;
         auditId: string;
     }): Promise<"conflict" | Node>;
+    versionIdsInSubtree(nodeId: string): Promise<string[]>;
+    parentArchivedAt(nodeId: string): Promise<{
+        archivedAt: string | null;
+        kind: string;
+    } | null>;
     hasAnyChild(nodeId: string): Promise<boolean>;
     listVectorKeys(nodeId: string): Promise<string[]>;
     countInboundLinks(nodeId: string): Promise<number>;
     inspectPurgeTree(nodeId: string): Promise<{
         nodeIds: string[];
+        named: Array<{
+            id: string;
+            kind: string;
+            title: string;
+        }>;
         flowIds: string[];
         contentKeys: string[];
         vectorKeys: Array<{
@@ -356,6 +350,11 @@ export interface NodeService {
     }): Promise<{
         inboundLinks: number;
         totalItems: number;
+        items: Array<{
+            id: string;
+            kind: NodeKind;
+            title: string;
+        }>;
     }>;
     listGrants(actor: Actor, resourceId: string): Promise<ResourceGrantList>;
     listEffectiveAccess(actor: Actor, resourceId: string): Promise<import("@anchrd/intel-contract/share").ResourceAccessList>;

package/migrations/0025_archiving_takes_the_subtree.sql

@@ -0,0 +1,29 @@
+-- Archiving takes the whole subtree, and this column is what lets it come back (D71, #733).
+--
+-- ⚠️ **The two steps were the wrong way round.** `purge` cascaded over the subtree since #492 while
+-- `archive` touched a single row, so a folder archived over live children handed those children to
+-- the one step that cannot be undone. Cascading the REVERSIBLE step instead closes the whole chain:
+-- nothing live sits under an archived node any more, so the purge can keep cascading without ever
+-- reaching something alive.
+--
+-- What this column holds is the OPERATION a node fell with, not a flag. A restore brings back
+-- exactly the nodes that fell together, and a child that was already archived before keeps its own
+-- older operation id — and stays archived.
+--
+-- ⚠️ **Existing data keeps `NULL` here**, and that is not the same as "fell alone": it means
+-- "archived before this migration, and nobody recorded what it fell with". A restore therefore
+-- treats `NULL` as itself only, never as a group — otherwise restoring one old node would revive
+-- every node ever archived before today.
+ALTER TABLE nodes ADD COLUMN archived_with TEXT;
+
+-- The restore reads this column for one node and then finds its siblings by it. Without the index
+-- that is a scan of the whole table on every restore of a large folder.
+CREATE INDEX IF NOT EXISTS nodes_archived_with ON nodes (archived_with) WHERE archived_with IS NOT NULL;
+
+-- ⚠️ **Flows fall with the tree, so they need the same column.** They hang in the folder tree by
+-- `parent_id` and carry their own `archived_at`, and `inspectPurgeTree` collects them by that same
+-- parent. A cascade that took only `nodes` would leave exactly one kind of live thing under an
+-- archived folder — the kind this repository's own flows are filed as.
+ALTER TABLE flows ADD COLUMN archived_with TEXT;
+
+CREATE INDEX IF NOT EXISTS flows_archived_with ON flows (archived_with) WHERE archived_with IS NOT NULL;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anchrd/intel-api",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "type": "module",
   "license": "UNLICENSED",
   "repository": {
@@ -43,7 +43,7 @@
   },
   "dependencies": {
     "@anchrd/gate-sdk": "^0.25.0",
-    "@anchrd/intel-contract": "^0.26.0",
+    "@anchrd/intel-contract": "^0.27.0",
     "@cfworker/json-schema": "^4.1.1",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "fflate": "^0.8.3",