@openparachute/vault 0.7.1 → 0.7.2-rc.4

package/core/src/txn.test.ts

@@ -89,9 +89,12 @@ describe("transaction (sync)", () => {
     expect(calls).toEqual(["BEGIN IMMEDIATE", "COMMIT", "ROLLBACK"]);
   });
 
-  it("preserves the callback error even when ROLLBACK also fails", () => {
+  it("preserves the callback error when ROLLBACK fails for the expected 'already-resolved' reason", () => {
     const callbackErr = new Error("callback boom");
-    const rollbackErr = new Error("rollback boom");
+    // The one swallowed case: the txn was already resolved, so ROLLBACK is a
+    // no-op that reports "no transaction is active". The ORIGINAL callback
+    // error is the root cause and must still propagate.
+    const rollbackErr = new Error("cannot rollback - no transaction is active");
     const { db } = fakeDb({ rollbackThrows: rollbackErr });
     let thrown: unknown;
     try {
@@ -101,6 +104,22 @@ describe("transaction (sync)", () => {
     }
     expect(thrown).toBe(callbackErr);
   });
+
+  it("re-throws an UNEXPECTED ROLLBACK failure instead of silently masking it (vault#589 NIT 2)", () => {
+    const callbackErr = new Error("callback boom");
+    // A rollback failure that is NOT the benign "already-resolved" case (a
+    // corrupt connection / lost write lock) means the transaction may NOT have
+    // rolled back — surfacing it beats a false "clean rollback".
+    const rollbackErr = new Error("database disk image is malformed");
+    const { db } = fakeDb({ rollbackThrows: rollbackErr });
+    let thrown: unknown;
+    try {
+      transaction(db, () => { throw callbackErr; });
+    } catch (e) {
+      thrown = e;
+    }
+    expect(thrown).toBe(rollbackErr);
+  });
 });
 
 describe("transaction — native transactionSync preference (DO backend)", () => {
@@ -214,9 +233,9 @@ describe("transactionAsync", () => {
     expect(calls).toEqual(["BEGIN IMMEDIATE", "COMMIT", "ROLLBACK"]);
   });
 
-  it("preserves the callback error even when ROLLBACK also fails", async () => {
+  it("preserves the callback error when ROLLBACK fails for the expected 'already-resolved' reason", async () => {
     const callbackErr = new Error("callback boom");
-    const rollbackErr = new Error("rollback boom");
+    const rollbackErr = new Error("cannot rollback - no transaction is active");
     const { db } = fakeDb({ rollbackThrows: rollbackErr });
     let thrown: unknown;
     try {
@@ -226,4 +245,81 @@ describe("transactionAsync", () => {
     }
     expect(thrown).toBe(callbackErr);
   });
+
+  it("re-throws an UNEXPECTED ROLLBACK failure instead of silently masking it (vault#589 NIT 2)", async () => {
+    const callbackErr = new Error("callback boom");
+    const rollbackErr = new Error("database disk image is malformed");
+    const { db } = fakeDb({ rollbackThrows: rollbackErr });
+    let thrown: unknown;
+    try {
+      await transactionAsync(db, async () => { throw callbackErr; });
+    } catch (e) {
+      thrown = e;
+    }
+    expect(thrown).toBe(rollbackErr);
+  });
+});
+
+describe("transaction — re-entrancy via SAVEPOINTs (vault#589)", () => {
+  it("a nested sync transaction uses SAVEPOINT/RELEASE, not a second BEGIN", () => {
+    const { db, calls } = fakeDb();
+    const out = transaction(db, () => {
+      const inner = transaction(db, () => "inner");
+      expect(inner).toBe("inner");
+      return "outer";
+    });
+    expect(out).toBe("outer");
+    expect(calls).toEqual([
+      "BEGIN IMMEDIATE",
+      "SAVEPOINT parachute_sp_1",
+      "RELEASE parachute_sp_1",
+      "COMMIT",
+    ]);
+  });
+
+  it("an inner throw rolls back to the savepoint; the outer can still commit", () => {
+    const db = freshDb();
+    transaction(db, () => {
+      db.exec("INSERT INTO t (id, v) VALUES (1, 'keep')");
+      try {
+        transaction(db, () => {
+          db.exec("INSERT INTO t (id, v) VALUES (2, 'drop')");
+          throw new Error("inner boom");
+        });
+      } catch {
+        // Outer decides to continue past the failed nested block.
+      }
+      db.exec("INSERT INTO t (id, v) VALUES (3, 'keep2')");
+    });
+    // Only the savepoint'd insert (2) was undone; 1 and 3 committed.
+    const ids = (db.prepare("SELECT id FROM t ORDER BY id").all() as { id: number }[]).map((r) => r.id);
+    expect(ids).toEqual([1, 3]);
+  });
+
+  it("an UNCAUGHT inner throw rolls back the WHOLE outer transaction", () => {
+    const db = freshDb();
+    expect(() =>
+      transaction(db, () => {
+        db.exec("INSERT INTO t (id, v) VALUES (1, 'a')");
+        transaction(db, () => {
+          db.exec("INSERT INTO t (id, v) VALUES (2, 'b')");
+          throw new Error("boom");
+        });
+      }),
+    ).toThrow("boom");
+    expect((db.prepare("SELECT COUNT(*) AS c FROM t").get() as { c: number }).c).toBe(0);
+  });
+
+  it("transactionAsync composes a nested sync transaction via SAVEPOINT (the atomic blow-away shape)", async () => {
+    const { db, calls } = fakeDb();
+    await transactionAsync(db, async () => {
+      transaction(db, () => "nested-sync-write");
+    });
+    expect(calls).toEqual([
+      "BEGIN IMMEDIATE",
+      "SAVEPOINT parachute_sp_1",
+      "RELEASE parachute_sp_1",
+      "COMMIT",
+    ]);
+  });
 });

package/core/src/txn.ts

@@ -14,12 +14,40 @@
  * one of them only ever wrote, so acquiring the write lock eagerly is a
  * strict improvement (no lazy busy-upgrade) and never a semantic change.
  *
- * **Nesting is unsupported**, matching the pre-seam code exactly: SQLite
- * throws "cannot start a transaction within a transaction" on a nested
- * `BEGIN`, and none of the migrated call sites nest (a batch wraps individual
- * `createNote`s, none of which open their own transaction). If a nested
- * caller ever appears, the fix is SAVEPOINT-based re-entrancy *in the bun
- * implementation here* — the call sites stay untouched.
+ * **Nesting via SAVEPOINTs** (vault#589): the outermost `transaction` /
+ * `transactionAsync` on a connection opens a real `BEGIN IMMEDIATE`; a nested
+ * call (one whose connection is already inside a transaction) opens a
+ * `SAVEPOINT` instead, so composing an atomic block out of primitives that
+ * each open their own transaction never hits SQLite's "cannot start a
+ * transaction within a transaction". This is the re-entrancy the original
+ * seam anticipated ("the fix is SAVEPOINT-based re-entrancy in the bun
+ * implementation here — the call sites stay untouched"). The nesting depth is
+ * tracked per connection in {@link txnDepth}; a non-nested caller (depth 0 →
+ * 1) is byte-for-byte the old `BEGIN … COMMIT` / `ROLLBACK` path, so existing
+ * single-level callers are unaffected. The motivating nested caller is the
+ * atomic blow-away import (`importVault` wrapping schema/note/link writes,
+ * several of which open their own `transaction`).
+ *
+ * The `transactionSync` (Durable-Object) delegate path is unchanged — a DO
+ * backend supplies its own natively re-entrant primitive, so the SAVEPOINT
+ * bookkeeping here only governs the bun `BEGIN` path.
+ *
+ * **Shared-connection invariant (load-bearing for {@link transactionAsync}).**
+ * The bun backend is a single synchronous connection. A `transactionAsync`
+ * body — AND anything it calls — must not `await` genuine, slow I/O while the
+ * transaction is open: every `await` yields the event loop, and any work that
+ * runs during that yield and touches the store (a concurrent request, a
+ * mutation hook that writes before its first real await) will `SAVEPOINT`-JOIN
+ * this open transaction on the shared connection — committing/rolling back
+ * with it, its writes cross-wiped by a `ROLLBACK TO`. The blow-away import
+ * (the sole `transactionAsync` wrapping non-batch work) is safe by
+ * construction: its replay awaits only already-resolved promises over the
+ * synchronous bun store, so it never actually yields to unrelated work
+ * mid-transaction, and the mutation hooks it fires do no synchronous store
+ * writes (they defer via `queueMicrotask` and arm debounces / kick idempotent
+ * workers — see hooks.ts). Any NEW `transactionAsync` caller must preserve
+ * this: keep the body's awaits confined to the same synchronous connection,
+ * never awaiting network/disk/subprocess I/O with the transaction open.
  */
 
 /** The minimal DB surface the transaction seam needs — kept structural (no
@@ -38,6 +66,79 @@ export interface TxnCapableDb {
   transactionSync?<T>(fn: () => T): T;
 }
 
+/**
+ * Per-connection nesting depth for the bun `BEGIN` path. Keyed on the db
+ * handle so two connections track independently; a `WeakMap` so a dropped
+ * connection's entry is collected. Depth 0 = no open transaction; the first
+ * `transaction`/`transactionAsync` opens `BEGIN IMMEDIATE` and sets depth 1;
+ * each further nested call opens a `SAVEPOINT` and bumps the depth. See the
+ * file header (vault#589).
+ */
+const txnDepth = new WeakMap<TxnCapableDb, number>();
+
+/** One entry on the nesting stack: whether this frame owns the outer
+ *  `BEGIN … COMMIT`/`ROLLBACK` (outermost) or a `SAVEPOINT` (nested), plus the
+ *  depth to restore on exit. */
+interface TxnFrame {
+  outermost: boolean;
+  savepoint: string | null;
+  priorDepth: number;
+}
+
+/** Open a transaction frame: `BEGIN IMMEDIATE` at depth 0, else a uniquely
+ *  named `SAVEPOINT`. Bumps {@link txnDepth} only after the SQL succeeds. */
+function enterTxn(db: TxnCapableDb): TxnFrame {
+  const priorDepth = txnDepth.get(db) ?? 0;
+  if (priorDepth === 0) {
+    db.exec("BEGIN IMMEDIATE");
+    txnDepth.set(db, 1);
+    return { outermost: true, savepoint: null, priorDepth };
+  }
+  const savepoint = `parachute_sp_${priorDepth}`;
+  db.exec(`SAVEPOINT ${savepoint}`);
+  txnDepth.set(db, priorDepth + 1);
+  return { outermost: false, savepoint, priorDepth };
+}
+
+/** Commit a frame: `COMMIT` for the outermost, `RELEASE` for a savepoint
+ *  (which merges its writes into the enclosing transaction). */
+function commitTxn(db: TxnCapableDb, frame: TxnFrame): void {
+  if (frame.outermost) db.exec("COMMIT");
+  else db.exec(`RELEASE ${frame.savepoint}`);
+  txnDepth.set(db, frame.priorDepth);
+}
+
+/** Roll a frame back: `ROLLBACK` for the outermost (whole transaction),
+ *  `ROLLBACK TO` + `RELEASE` for a savepoint (unwind just this frame; the
+ *  error still propagates so an enclosing frame decides its own fate).
+ *  Best-effort — if the COMMIT itself threw, the transaction is already
+ *  resolved and these throw "no transaction"/"no such savepoint"; swallow so
+ *  the original error propagates. */
+function rollbackTxn(db: TxnCapableDb, frame: TxnFrame): void {
+  try {
+    if (frame.outermost) {
+      db.exec("ROLLBACK");
+    } else {
+      db.exec(`ROLLBACK TO ${frame.savepoint}`);
+      db.exec(`RELEASE ${frame.savepoint}`);
+    }
+  } catch (rollbackErr) {
+    // Only swallow the ONE expected case: the COMMIT/RELEASE itself already
+    // resolved the transaction, so there's nothing left to unwind — SQLite
+    // reports "cannot rollback - no transaction is active" / "no such
+    // savepoint". Any OTHER rollback failure is a real problem (a corrupt
+    // connection, a lost write lock) and must not be masked — re-throw it so
+    // the caller sees a failed rollback rather than a false success. Depth is
+    // restored first so the connection's bookkeeping stays consistent even on
+    // the re-throw path.
+    txnDepth.set(db, frame.priorDepth);
+    const msg = String((rollbackErr as Error)?.message ?? rollbackErr);
+    if (/no transaction is active|no such savepoint/i.test(msg)) return;
+    throw rollbackErr;
+  }
+  txnDepth.set(db, frame.priorDepth);
+}
+
 /**
  * Run `fn` inside a single write transaction, committing its result or
  * rolling back on throw. Synchronous — the callback must not await (see
@@ -55,20 +156,13 @@ export function transaction<T>(db: TxnCapableDb, fn: () => T): T {
   if (typeof db.transactionSync === "function") {
     return db.transactionSync(fn);
   }
-  db.exec("BEGIN IMMEDIATE");
+  const frame = enterTxn(db);
   try {
     const result = fn();
-    db.exec("COMMIT");
+    commitTxn(db, frame);
     return result;
   } catch (err) {
-    // Best-effort rollback — if the COMMIT itself threw the transaction is
-    // already resolved and ROLLBACK would throw "no transaction is active";
-    // swallow that so the original error is the one that propagates.
-    try {
-      db.exec("ROLLBACK");
-    } catch {
-      // no active transaction to roll back
-    }
+    rollbackTxn(db, frame);
     throw err;
   }
 }
@@ -86,20 +180,21 @@ export function transaction<T>(db: TxnCapableDb, fn: () => T): T {
  * so it cannot wrap an `async` body that awaits the Store facade between writes.
  * A DO backend that needs an atomic async batch has to reshape the batch as a
  * synchronous unit (or use an async DO transaction primitive) — out of scope
- * for this seam; the raw `BEGIN IMMEDIATE` path stays the single implementation.
+ * for this seam; the bun `BEGIN IMMEDIATE` path stays the single implementation.
+ *
+ * Re-entrant (vault#589): if the connection is already inside a transaction —
+ * e.g. the atomic blow-away import wraps this around store writes that
+ * themselves call {@link transaction} — a nested call opens a SAVEPOINT rather
+ * than a second `BEGIN`. See the file header.
  */
 export async function transactionAsync<T>(db: TxnCapableDb, fn: () => Promise<T>): Promise<T> {
-  db.exec("BEGIN IMMEDIATE");
+  const frame = enterTxn(db);
   try {
     const result = await fn();
-    db.exec("COMMIT");
+    commitTxn(db, frame);
     return result;
   } catch (err) {
-    try {
-      db.exec("ROLLBACK");
-    } catch {
-      // no active transaction to roll back
-    }
+    rollbackTxn(db, frame);
     throw err;
   }
 }

package/core/src/wikilinks.test.ts

@@ -10,7 +10,10 @@ import {
   listUnresolvedWikilinks,
   getContentWikilinkWarnings,
   resolveOrQueueLink,
+  requeueInboundWikilinksForDelete,
+  getUnresolvedLinksForNote,
 } from "./wikilinks.js";
+import { findPath } from "./links.js";
 
 let store: SqliteStore;
 let db: Database;
@@ -480,6 +483,178 @@ describe("path-based resolution", async () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// requeueInboundWikilinksForDelete (LB6) — a deleted note's inbound wikilink
+// edges must re-queue so recreating a note at the same path/title heals
+// them, instead of staying dead until the SOURCE note is individually
+// re-saved.
+// ---------------------------------------------------------------------------
+
+describe("delete → recreate re-resolves inbound wikilinks (LB6)", () => {
+  it("A [[Foo]] survives Foo's delete-then-recreate without touching A", async () => {
+    const a = await store.createNote("Link to [[Foo]]", { path: "A" });
+
+    // Foo doesn't exist yet — the link is queued, not yet live.
+    expect(await store.getLinks(a.id, { direction: "outbound" })).toHaveLength(0);
+    const pendingBefore = db.prepare(
+      "SELECT target_path FROM unresolved_wikilinks WHERE source_id = ?",
+    ).all(a.id) as { target_path: string }[];
+    expect(pendingBefore.map((r) => r.target_path)).toEqual(["Foo"]);
+
+    // Create Foo — the wikilink resolves and the edge + backlink exist.
+    const foo1 = await store.createNote("First Foo", { path: "Foo" });
+    let links = await store.getLinks(a.id, { direction: "outbound" });
+    expect(links).toHaveLength(1);
+    expect(links[0]!.targetId).toBe(foo1.id);
+    expect(findPath(db, a.id, foo1.id)).not.toBeNull();
+    const backlinks = await store.getLinks(foo1.id, { direction: "inbound" });
+    expect(backlinks.some((l) => l.sourceId === a.id)).toBe(true);
+
+    // Delete Foo. Without the LB6 fix, `unresolved_wikilinks` stays empty —
+    // nothing pending — even though A's `[[Foo]]` text is untouched.
+    await store.deleteNote(foo1.id);
+    expect(await store.getLinks(a.id, { direction: "outbound" })).toHaveLength(0);
+    const pendingAfterDelete = db.prepare(
+      "SELECT target_path, relationship FROM unresolved_wikilinks WHERE source_id = ?",
+    ).all(a.id) as { target_path: string; relationship: string }[];
+    expect(pendingAfterDelete).toEqual([{ target_path: "Foo", relationship: "wikilink" }]);
+
+    // Recreate Foo (new note, new id — same path). A was never re-saved.
+    const foo2 = await store.createNote("Second Foo", { path: "Foo" });
+
+    // The A -> Foo edge is back, pointed at the NEW Foo, and find-path sees it.
+    links = await store.getLinks(a.id, { direction: "outbound" });
+    expect(links).toHaveLength(1);
+    expect(links[0]!.targetId).toBe(foo2.id);
+    expect(links[0]!.relationship).toBe("wikilink");
+    expect(findPath(db, a.id, foo2.id)).not.toBeNull();
+
+    // A's content was never touched.
+    const reread = await store.getNote(a.id);
+    expect(reread!.content).toBe("Link to [[Foo]]");
+
+    // The pending row is consumed on resolution.
+    const pendingAfterRecreate = db.prepare(
+      "SELECT * FROM unresolved_wikilinks WHERE source_id = ?",
+    ).all(a.id);
+    expect(pendingAfterRecreate).toHaveLength(0);
+  });
+
+  it("only re-queues wikilink-relationship inbound edges, not explicit typed links", async () => {
+    const source = await store.createNote("A", { id: "src", path: "Src" });
+    const target = await store.createNote("B", { id: "tgt", path: "Tgt" });
+    await store.createLink("src", "tgt", "related-to"); // hand-authored typed link, not a wikilink
+
+    requeueInboundWikilinksForDelete(db, target.id);
+
+    // getUnresolvedLinksForNote tolerates the table not existing at all
+    // (no wikilink was ever parsed in this test) — a raw SELECT would throw.
+    expect(getUnresolvedLinksForNote(db, source.id)).toHaveLength(0);
+  });
+
+  it("re-queues via basename resolution, not just exact path, and recovers on recreate at the same path", async () => {
+    // Target lives at a nested path; source links via the bare basename —
+    // resolved through resolveWikilink's basename fallback (rule #3), not
+    // an exact path match.
+    const target = await store.createNote("# Weekly Review\n\nBody.", { path: "Projects/Weekly Review" });
+    const source = await store.createNote("See [[Weekly Review]]", { path: "A" });
+    expect(await store.getLinks(source.id, { direction: "outbound" })).toHaveLength(1);
+
+    await store.deleteNote(target.id);
+
+    const pending = db.prepare(
+      "SELECT target_path FROM unresolved_wikilinks WHERE source_id = ?",
+    ).all(source.id) as { target_path: string }[];
+    // The re-queued key is the RAW bracket text ("Weekly Review"), not the
+    // deleted note's full path — that's what the basename-fallback lazy
+    // resolver (`resolveUnresolvedWikilinks`'s `? LIKE '%/' || target_path`
+    // suffix match) actually matches on.
+    expect(pending.map((r) => r.target_path)).toEqual(["Weekly Review"]);
+
+    // Recreate at the SAME nested path — the suffix match backfills it.
+    const target2 = await store.createNote("# Weekly Review v2\n\nBody.", { path: "Projects/Weekly Review" });
+    const links = await store.getLinks(source.id, { direction: "outbound" });
+    expect(links).toHaveLength(1);
+    expect(links[0]!.targetId).toBe(target2.id);
+  });
+
+  // BLOCKER (Fable review) — the delete→recreate re-heal must cover links
+  // that resolved via the H1-TITLE fallback and the explicit-EXTENSION form,
+  // not just path/basename. The re-queued row's target string is the raw
+  // bracket text (e.g. "John Doe" / "budget.csv"), which the OLD sweep
+  // matched against the new note by PATH TEXT ONLY — so a title- or
+  // extension-resolved link stayed queued (0 links rebuilt) forever. The
+  // sweep now runs each candidate through the SAME resolver write-time uses,
+  // so deferred resolution finally matches write-time on all four legs.
+  it("re-heals a TITLE-fallback link AND an EXTENSION-form link on delete→recreate at the same path+H1", async () => {
+    // A resolves to `people/jdoe` only via its H1 title "John Doe".
+    // B resolves to `budget` (ext csv) only via the explicit [[budget.csv]]
+    // form (the extension leg is exact-path, so `budget` lives at path
+    // "budget", disambiguating it from a same-named `.md` note).
+    const person = await store.createNote("# John Doe\n\nBio.", { path: "people/jdoe" });
+    const budget = await store.createNote("month,total\n2026-01,9000", { path: "budget", extension: "csv" });
+    const a = await store.createNote("met [[John Doe]] today", { path: "A" });
+    const b = await store.createNote("see [[budget.csv]]", { path: "B" });
+
+    // Both links live at write time (title fallback + extension form).
+    expect((await store.getLinks(a.id, { direction: "outbound" }))[0]?.targetId).toBe(person.id);
+    expect((await store.getLinks(b.id, { direction: "outbound" }))[0]?.targetId).toBe(budget.id);
+
+    await store.deleteNote(person.id);
+    await store.deleteNote(budget.id);
+
+    // Both re-queued with their raw bracket text — NOT the deleted notes' paths.
+    const pendingA = db.prepare("SELECT target_path FROM unresolved_wikilinks WHERE source_id = ?").all(a.id) as { target_path: string }[];
+    const pendingB = db.prepare("SELECT target_path FROM unresolved_wikilinks WHERE source_id = ?").all(b.id) as { target_path: string }[];
+    expect(pendingA.map((r) => r.target_path)).toEqual(["John Doe"]);
+    expect(pendingB.map((r) => r.target_path)).toEqual(["budget.csv"]);
+    expect(await store.getLinks(a.id, { direction: "outbound" })).toHaveLength(0);
+    expect(await store.getLinks(b.id, { direction: "outbound" })).toHaveLength(0);
+
+    // Recreate each at the SAME path + H1 (new note, new id). Neither A nor B
+    // is re-saved — only the deferred sweep can rebuild these edges.
+    const person2 = await store.createNote("# John Doe\n\nBio v2.", { path: "people/jdoe" });
+    const budget2 = await store.createNote("month,total\n2026-02,9500", { path: "budget", extension: "csv" });
+
+    // BOTH re-heal (RED before the sweep completion — title/ext legs missing).
+    const aLinks = await store.getLinks(a.id, { direction: "outbound" });
+    const bLinks = await store.getLinks(b.id, { direction: "outbound" });
+    expect(aLinks).toHaveLength(1);
+    expect(aLinks[0]!.targetId).toBe(person2.id);
+    expect(findPath(db, a.id, person2.id)).not.toBeNull();
+    expect(bLinks).toHaveLength(1);
+    expect(bLinks[0]!.targetId).toBe(budget2.id);
+
+    // Pending rows consumed on resolution.
+    expect(getUnresolvedLinksForNote(db, a.id)).toHaveLength(0);
+    expect(getUnresolvedLinksForNote(db, b.id)).toHaveLength(0);
+  });
+
+  // The completed sweep must NOT mis-resolve an AMBIGUOUS target — matching
+  // write-time's "don't guess" contract. A pending [[John Doe]] is swept when
+  // a same-titled note is created; if TWO notes already share that H1 by the
+  // time the sweep verifies, the resolver returns ambiguous and the row stays
+  // queued rather than the old path-only sweep's "link to whoever showed up."
+  // (Reached via a pathless first note — the sweep is path-gated, so it never
+  // fired to consume the row when only ONE John Doe existed.)
+  it("does not re-heal a title link when the target is ambiguous (two notes share the H1)", async () => {
+    const a = await store.createNote("met [[John Doe]]", { path: "A" });
+    expect(getUnresolvedLinksForNote(db, a.id).map((l) => l.target)).toEqual(["John Doe"]); // queued, no John Doe yet
+
+    // A PATHLESS note carrying the H1 — createNote's sweep is path-gated, so
+    // it does NOT fire here; A's pending row survives with one John Doe extant.
+    await store.createNote("# John Doe\n\nfirst.");
+    expect(getUnresolvedLinksForNote(db, a.id).map((l) => l.target)).toEqual(["John Doe"]); // still queued
+
+    // A SECOND note with the same H1, WITH a path → the sweep fires. Now two
+    // notes carry "John Doe" → resolveWikilinkDetailed is ambiguous → the row
+    // is left queued, nothing linked.
+    await store.createNote("# John Doe\n\nsecond.", { path: "people/jd" });
+    expect(await store.getLinks(a.id, { direction: "outbound" })).toHaveLength(0);
+    expect(getUnresolvedLinksForNote(db, a.id).map((l) => l.target)).toEqual(["John Doe"]);
+  });
+});
+
 // ---------------------------------------------------------------------------
 // unresolved_wikilinks relationship-column migration — atomicity (vault#555
 // wire+generalist must-fix; W7's migrateToV25-interruption lesson applied).