@openparachute/vault 0.7.9-rc.3 → 0.7.9-rc.5

package/core/src/link-count.test.ts

@@ -299,3 +299,32 @@ describe("query-notes MCP surface: include_link_count", () => {
     for (const n of ordered) expect(typeof n.linkCount).toBe("number");
   });
 });
+
+
+describe("vault#714 scoped link degree", () => {
+  async function seedScope() {
+    for (const id of ["a", "b", "hidden"]) await store.createNote(id, { id });
+    await store.createLink("a", "b", "visible");
+    await store.createLink("a", "hidden", "hidden-out");
+    await store.createLink("hidden", "a", "hidden-in");
+  }
+  for (const [direction, expected] of [["both", 1], ["outbound", 1], ["inbound", 0]] as const) {
+    it(`vault#714 scoped ${direction}`, async () => {
+      await seedScope();
+      expect(getLinkCounts(db, ["a"], direction, (id) => id !== "hidden").get("a")).toBe(expected);
+    });
+  }
+  it("vault#714 visible self-loop remains degree two", async () => {
+    await seedScope(); await store.createLink("b", "b", "self");
+    expect(getLinkCounts(db, ["b"], "both", (id) => id === "b").get("b")).toBe(2);
+  });
+  it("vault#714 absent predicate preserves global degree", async () => {
+    await seedScope();
+    expect(getLinkCounts(db, ["a"], "both")).toEqual(new Map([["a", 3]]));
+    expect(getLinkCounts(db, ["a"], "both", undefined)).toEqual(getLinkCounts(db, ["a"], "both"));
+  });
+  it("vault#714 repeated ids and typed rows retain row-count semantics", async () => {
+    await seedScope(); await store.createLink("a", "b", "second");
+    expect(getLinkCounts(db, ["a", "a"], "both", (id) => id !== "hidden").get("a")).toBe(2);
+  });
+});

package/core/src/links.ts

@@ -267,12 +267,16 @@ export function getLinksHydratedForNotes(
  * most two index scans regardless of page size. The IN-list is chunked to
  * stay under SQLite's bound-variable limit on very large pages.
  *
+ * With a visibility predicate, callers supply visible note ids and only rows
+ * whose other endpoint is visible count. The indexed selects return neighbour
+ * ids instead of grouped counts; absent the predicate, SQL is unchanged.
  * Returns 0 for ids with no links (every requested id is present in the map).
  */
 export function getLinkCounts(
   db: Database,
   noteIds: string[],
   direction: "both" | "outbound" | "inbound" = "both",
+  visible?: (noteId: string) => boolean,
 ): Map<string, number> {
   const counts = new Map<string, number>();
   if (noteIds.length === 0) return counts;
@@ -290,6 +294,28 @@ export function getLinkCounts(
   for (const chunk of chunkForInClause(ids)) {
     const placeholders = chunk.map(() => "?").join(", ");
 
+    // Scoped callers supply visible page-note ids. Count a row only when
+    // its other endpoint is visible too; a visible self-loop still adds 2.
+    if (visible) {
+      if (wantOutbound) {
+        const rows = db.prepare(
+          `SELECT source_id AS id, target_id AS other FROM links WHERE source_id IN (${placeholders})`,
+        ).all(...chunk) as { id: string; other: string }[];
+        for (const row of rows) {
+          if (visible(row.other)) counts.set(row.id, counts.get(row.id)! + 1);
+        }
+      }
+      if (wantInbound) {
+        const rows = db.prepare(
+          `SELECT target_id AS id, source_id AS other FROM links WHERE target_id IN (${placeholders})`,
+        ).all(...chunk) as { id: string; other: string }[];
+        for (const row of rows) {
+          if (visible(row.other)) counts.set(row.id, counts.get(row.id)! + 1);
+        }
+      }
+      continue;
+    }
+
     if (wantOutbound) {
       const rows = db.prepare(
         `SELECT source_id AS id, COUNT(*) AS c FROM links
@@ -314,6 +340,23 @@ export function getLinkCounts(
   return counts;
 }
 
+/** Lift both has_links polarities from SQL under scope (vault#714). */
+export function sqlHasLinks(wanted: boolean | undefined, scoped: boolean): boolean | undefined {
+  return scoped ? undefined : wanted;
+}
+
+/** Presence and degree share one oracle; narrowing can shorten a scoped page. */
+export function narrowByVisibleLinks<T extends { id: string }>(
+  db: Database,
+  notes: T[],
+  wanted: boolean | undefined,
+  visible: ((noteId: string) => boolean) | undefined,
+): T[] {
+  if (wanted === undefined || !visible || notes.length === 0) return notes;
+  const counts = getLinkCounts(db, notes.map((n) => n.id), "both", visible);
+  return notes.filter((n) => (counts.get(n.id)! > 0) === wanted);
+}
+
 // ---- Deeper Link Queries ----
 
 export interface TraversalNode {

package/core/src/mcp-manifest.ts

@@ -121,8 +121,8 @@ Response shape (vault#550 — three variants, pick by what you passed):
             description: "Alias for `exclude_tags` (singular). Same shape and semantics — accepts a single tag or an array.",
           },
           has_tags: { type: "boolean", description: "Presence filter: true = only notes with at least one tag; false = only untagged notes. Ignored when `tag` is set." },
-          has_links: { type: "boolean", description: "Presence filter: true = only notes with at least one inbound or outbound link; false = only orphaned notes (no links in either direction)." },
-          has_broken_links: { type: "boolean", description: "Presence filter (vault#555): true = only notes with at least one dangling outbound link — a [[wikilink]] or structured `links` target that never resolved to a note; false = only notes with none. Backed by the unresolved_wikilinks table (same data `doctor`/list-unresolved surfaces); safe on a vault where no link has ever gone unresolved (true matches nothing, false is a no-op). For a TAG-SCOPED session both polarities are answered on the notes the session can see (vault#239): a target whose candidates are ALL out of scope matches nothing in that session's sub-vault, so it counts as broken there even though the vault-wide record calls it ambiguous — otherwise the note would only become broken once the last invisible candidate was deleted. Decided after the page is drawn, so a scoped page may come back shorter than `limit` while more results remain." },
+          has_links: { type: "boolean", description: "Presence filter: true = only notes with at least one inbound or outbound link; false = only orphaned notes (no links in either direction). For a TAG-SCOPED session both endpoints must be visible. Both polarities are decided after the page is drawn, so a scoped page may be shorter than `limit` while more results remain; this filter does not participate in a scoped cursor query hash." },
+          has_broken_links: { type: "boolean", description: "Presence filter (vault#555): true = only notes with at least one dangling outbound link — a [[wikilink]] or structured `links` target that never resolved to a note; false = only notes with none. Backed by the unresolved_wikilinks table (same data `doctor`/list-unresolved surfaces); safe on a vault where no link has ever gone unresolved (true matches nothing, false is a no-op). For a TAG-SCOPED session both polarities are answered on the notes the session can see (vault#239): a target whose candidates are ALL out of scope matches nothing in that session's sub-vault, so it counts as broken there even though the vault-wide record calls it ambiguous or a content wikilink resolves to an invisible note. Resolved structured links cannot recover the original caller string and are not named as broken — otherwise the note would only become broken once the last invisible candidate was deleted. Decided after the page is drawn, so a scoped page may come back shorter than `limit` while more results remain." },
           has_ambiguous_links: { type: "boolean", description: "Presence filter (vault#581): true = only notes with at least one AMBIGUOUS outbound link — a [[wikilink]] or structured `links` target that matched TWO OR MORE notes, so no link was created and none was guessed at; false = only notes with none. Disjoint from `has_broken_links` (dangling = matched nothing; ambiguous = matched too much). Backed by the ambiguous_wikilinks table — the same source `create-note`/`update-note`'s `ambiguous_link` warning draws from; safe on a vault where no link has ever been ambiguous (true matches nothing, false is a no-op). For a TAG-SCOPED session both polarities are answered on the notes the session can see — a collision between a visible and an invisible note is neither reported by `true` nor excluded by `false` — so a scoped page may come back shorter than `limit` while more results remain." },
           path: { type: "string", description: "Exact path match (case-insensitive)" },
           path_prefix: { type: "string", description: "Path prefix match (e.g., 'Projects/')" },
@@ -176,7 +176,7 @@ Response shape (vault#550 — three variants, pick by what you passed):
           last_updated_by: { type: "string", description: "Write-attribution filter (vault#298): only notes whose MOST RECENT write was attributed to this principal. Exact match; indexed." },
           created_via: { type: "string", description: "Write-attribution filter (vault#298): only notes FIRST written through this interface/channel — e.g. `mcp`, `surface:<name>`, `agent:<id>`, `nostr:<64-hex-pubkey>`, `operator`, `api`. `nostr:<pubkey>` (vault#698) is the Nostr key that SIGNED the request, and is the axis that tells two agents apart when they share one hub user (`created_by`). Emitted by BOTH doors — self-hosted hub (parachute-hub#937) and cloud (parachute-cloud#277). Exact match; indexed." },
           last_updated_via: { type: "string", description: "Write-attribution filter (vault#298): only notes whose MOST RECENT write came through this interface/channel — same vocabulary as `created_via`, including `nostr:<64-hex-pubkey>` for the signing key. Exact match; indexed." },
-          order_by: { type: "string", description: "Sort by an indexed metadata field instead of `created_at`. Field must be declared `indexed: true`; errors otherwise. Two special values need no declaration: `link_count` sorts by link DEGREE (both-directions raw row count), matching the `include_link_count` field for every note; `updated_at` (vault#585) sorts on the integer `updated_at_ms` mirror column — correct on non-canonical/imported timestamps — with `id` as the tiebreaker. Direction is taken from `sort` (default 'asc'); for other fields `created_at` is appended as a stable tiebreaker." },
+          order_by: { type: "string", description: "Sort by an indexed metadata field instead of `created_at`. Field must be declared `indexed: true`; errors otherwise. Two special values need no declaration: `link_count` sorts by link DEGREE (both-directions raw row count), matching the `include_link_count` field for unscoped both-direction counts. Under tag scope ordering still uses GLOBAL degree and may disagree with `linkCount`; `updated_at` (vault#585) sorts on the integer `updated_at_ms` mirror column — correct on non-canonical/imported timestamps — with `id` as the tiebreaker. Direction is taken from `sort` (default 'asc'); for other fields `created_at` is appended as a stable tiebreaker." },
           date_from: { type: "string", description: "Start date (ISO, inclusive). Filters on `created_at` (vault ingestion time). Shorthand for `date_filter: { field: 'created_at', from }`." },
           date_to: { type: "string", description: "End date (ISO, exclusive). Filters on `created_at` (vault ingestion time). Shorthand for `date_filter: { field: 'created_at', to }`." },
           date_filter: {
@@ -208,6 +208,17 @@ Response shape (vault#550 — three variants, pick by what you passed):
             required: ["note_id"],
             description: "Scope results to notes within N hops of an anchor note",
           },
+          versions: {
+            type: "object",
+            properties: {
+              note_id: { type: "string", description: "Note ID or path" },
+              version_ix: { type: "integer", minimum: 0 },
+              limit: { type: "integer", minimum: 0, maximum: 200 },
+              offset: { type: "integer", minimum: 0 },
+            },
+            required: ["note_id"],
+            description: "Read note history; mutually exclusive with id, search, near, cursor, aggregate, and semantic. Tag-scoped sessions see the SAME visibility enforcement as every other read — a note outside the token's tag scope answers `not_found`, and a deleted note's history is not readable by a scoped session at all. Deleted-note history is also unavailable to unscoped MCP sessions; restore is REST-only.",
+          },
           sort: {
             type: "string",
             enum: ["asc", "desc"],
@@ -240,18 +251,18 @@ Response shape (vault#550 — three variants, pick by what you passed):
             description: "Control metadata in response: true (all, default), false (none), or array of field names to include",
           },
           include_links: { type: "boolean", description: "Include inbound + outbound links per note (default: false)" },
-          include_broken_links: { type: "boolean", description: "Include each note's dangling outbound links as `broken_links: [{target, relationship}]` (default: false; vault#555). `target` is the unresolved path/title the [[wikilink]] or structured `links` entry named; `relationship` is \"wikilink\" for content-parsed links or the caller's own relationship string for a structured link. Empty array when the note has none. One batched query per request regardless of page size — mirrors `has_broken_links` (same backing table) and `include_links`. For a TAG-SCOPED session this also lists a target whose candidates are all out of scope, which is broken in that session's sub-vault (vault#239)." },
+          include_broken_links: { type: "boolean", description: "Include each note's dangling outbound links as `broken_links: [{target, relationship}]` (default: false; vault#555). `target` is the unresolved path/title the [[wikilink]] or structured `links` entry named; `relationship` is \"wikilink\" for content-parsed links or the caller's own relationship string for a structured link. Empty array when the note has none. One batched query per request regardless of page size — mirrors `has_broken_links` (same backing table) and `include_links`. For a TAG-SCOPED session this also lists a target whose candidates are all out of scope, including a content wikilink resolved to an invisible note (vault#239, vault#714). Resolved structured links to invisible targets are suppressed but not named as broken: their original caller string is no longer stored, and the hidden target path must not be disclosed." },
           include_ambiguous_links: { type: "boolean", description: "Include each note's ambiguous outbound links as `ambiguous_links: [{target, relationship, candidate_count}]` (default: false; vault#581). `target` is the path/title the [[wikilink]] or structured `links` entry named; `relationship` is \"wikilink\" for content-parsed links or the caller's own relationship string; `candidate_count` is how many notes it matched. For a TAG-SCOPED session the candidates are re-counted within the session's scope, and a target with fewer than two visible candidates is omitted — a scoped reader gets exactly what an unscoped one would get on a vault holding only the notes it can see. Empty array when the note has none. One batched query per request regardless of page size — mirrors `has_ambiguous_links` (same backing table) and `include_broken_links`." },
           include_link_count: {
             type: "boolean",
             description:
-              "Include the note's link DEGREE as a `linkCount` field, without hauling the link objects (default: false). Degree is a raw row count: outbound (source) + inbound (target). A self-loop counts as 2. Cheap COUNT over indexes; batched once per request. For a tag-scoped token, `linkCount` is the raw degree and MAY include edges to notes the token can't see — only the number leaks, not the neighbor.",
+              "Include the note's link DEGREE as a `linkCount` field, without hauling the link objects (default: false). Degree is a raw row count: outbound (source) + inbound (target). A self-loop counts as 2. Cheap COUNT over indexes; batched once per request. For a tag-scoped token, only edges with BOTH endpoints visible count, in every direction; a visible self-loop still counts as 2. Scoped counts select neighbour ids over the same indexes; unscoped counts are unchanged.",
           },
           link_count_direction: {
             type: "string",
             enum: ["both", "outbound", "inbound"],
             description:
-              "Which edges `include_link_count` counts: both (default), outbound only (source_id), or inbound only (target_id). order_by=link_count always uses the both-directions degree.",
+              "Which edges `include_link_count` counts: both (default), outbound only (source_id), or inbound only (target_id). For tag-scoped tokens only edges with both endpoints visible count in all three directions. order_by=link_count always uses GLOBAL both-directions degree, even under scope, and may disagree with linkCount.",
           },
           include_attachments: { type: "boolean", description: "Include attachment records (default: false)" },
           expand_links: { type: "boolean", description: "Inline [[wikilinks]] in returned content (default: false). Has no effect if content is not included (e.g., default list mode with include_content=false); wikilinks inside fenced or inline code are not expanded." },

package/core/src/mcp.ts

@@ -184,7 +184,7 @@ function requireNoteReference(value: unknown): string {
  * match required. Same [[wikilink]] semantics as `resolveWikilink`; exact
  * id/path always wins first.
  */
-function resolveNote(db: Database, idOrPath: string): Note | null {
+export function resolveNote(db: Database, idOrPath: string): Note | null {
   // Try ID match first (fast, indexed)
   const byId = noteOps.getNote(db, idOrPath);
   if (byId) return byId;
@@ -659,6 +659,10 @@ export function generateMcpTools(store: Store, opts?: GenerateMcpToolsOpts): Mcp
         const requestedHasBroken = params.has_broken_links as boolean | undefined;
         const sqlHasBroken = sqlHasBrokenLinks(requestedHasBroken, Boolean(ambiguityVisible));
 
+        // vault#714: degree and presence use the same visible-edge count.
+        const requestedHasLinks = params.has_links as boolean | undefined;
+        const sqlLinks = linkOps.sqlHasLinks(requestedHasLinks, Boolean(ambiguityVisible));
+
         // --- Link expansion config (shared across single + list paths) ---
         const expandLinks = params.expand_links === true;
         const expandMode = (params.expand_mode as ExpandMode) ?? "full";
@@ -688,6 +692,24 @@ export function generateMcpTools(store: Store, opts?: GenerateMcpToolsOpts): Mcp
         // stays byte-identical to the no-pagination behavior.
         const contentRange = parseContentRange(params.content_offset, params.content_length);
 
+        if (params.versions) {
+          for (const key of ["search", "near", "cursor", "aggregate", "semantic", "id"] as const) {
+            if (params[key] !== undefined) throw new QueryError(`versions is incompatible with ${key}`, "INVALID_QUERY", {
+              error_type: "invalid_query", field: "versions", hint: `drop ${key} when using versions`,
+            });
+          }
+          const v = params.versions as { note_id: string; version_ix?: number; limit?: number; offset?: number };
+          const note = requireNote(db, requireNoteReference(v.note_id));
+          if (typeof v.version_ix === "number") {
+            const version = await store.getNoteVersion(note.id, v.version_ix);
+            if (!version) return { error: `Version not found: "${v.note_id}"@${v.version_ix}`, error_type: "not_found", id: v.note_id, version_ix: v.version_ix };
+            return version;
+          }
+          const versions = await store.listNoteVersions(note.id, { limit: Math.max(0, Math.min(v.limit ?? 50, 200)), offset: v.offset ?? 0 });
+          const total = await store.countNoteVersions(note.id);
+          return { versions, total };
+        }
+
         // --- Single note by ID/path ---
         if (params.id) {
           const note = resolveNote(db, params.id as string);
@@ -742,7 +764,7 @@ export function generateMcpTools(store: Store, opts?: GenerateMcpToolsOpts): Mcp
           // links/attachments above; filterMetadata only touches `metadata`.
           if (params.include_link_count) {
             const dir = normalizeLinkCountDirection(params.link_count_direction);
-            result.linkCount = linkOps.getLinkCounts(db, [note.id], dir).get(note.id) ?? 0;
+            result.linkCount = linkOps.getLinkCounts(db, [note.id], dir, ambiguityVisible).get(note.id) ?? 0;
           }
           return result;
         }
@@ -877,7 +899,7 @@ export function generateMcpTools(store: Store, opts?: GenerateMcpToolsOpts): Mcp
             expand,
             excludeTags: aggExcludeTags,
             hasTags: params.has_tags as boolean | undefined,
-            hasLinks: params.has_links as boolean | undefined,
+            hasLinks: sqlLinks,
             hasBrokenLinks: sqlHasBroken,
             hasAmbiguousLinks: sqlHasAmbiguous,
             path: params.path as string | undefined,
@@ -911,15 +933,20 @@ export function generateMcpTools(store: Store, opts?: GenerateMcpToolsOpts): Mcp
           // reader's own view of each row before aggregating.
           // vault#239: the `has_broken_links` rollup is the same oracle for
           // the same reason — re-decide brokenness on the sub-vault too.
-          const aggVisibleIds = narrowByVisibleBrokenness(
+          const aggVisibleIds = linkOps.narrowByVisibleLinks(
             db,
-            narrowByVisibleAmbiguity(
+            narrowByVisibleBrokenness(
               db,
-              aggAllMatches.filter(aggregateVisibility),
-              requestedHasAmbiguous,
+              narrowByVisibleAmbiguity(
+                db,
+                aggAllMatches.filter(aggregateVisibility),
+                requestedHasAmbiguous,
+                ambiguityVisible,
+              ),
+              requestedHasBroken,
               ambiguityVisible,
             ),
-            requestedHasBroken,
+            requestedHasLinks,
             ambiguityVisible,
           ).map((n) => n.id);
           // Always run the rollup, even on an empty visible set: ungrouped
@@ -1017,7 +1044,7 @@ export function generateMcpTools(store: Store, opts?: GenerateMcpToolsOpts): Mcp
             expand,
             excludeTags,
             hasTags: params.has_tags as boolean | undefined,
-            hasLinks: params.has_links as boolean | undefined,
+            hasLinks: sqlLinks,
             hasBrokenLinks: sqlHasBroken,
             hasAmbiguousLinks: sqlHasAmbiguous,
             path: params.path as string | undefined,
@@ -1101,7 +1128,7 @@ export function generateMcpTools(store: Store, opts?: GenerateMcpToolsOpts): Mcp
               expand,
               excludeTags,
               hasTags: params.has_tags as boolean | undefined,
-              hasLinks: params.has_links as boolean | undefined,
+              hasLinks: sqlLinks,
               hasBrokenLinks: sqlHasBroken,
               hasAmbiguousLinks: sqlHasAmbiguous,
               path: params.path as string | undefined,
@@ -1171,7 +1198,7 @@ export function generateMcpTools(store: Store, opts?: GenerateMcpToolsOpts): Mcp
             expand,
             excludeTags,
             hasTags: params.has_tags as boolean | undefined,
-            hasLinks: params.has_links as boolean | undefined,
+            hasLinks: sqlLinks,
             hasBrokenLinks: sqlHasBroken,
             hasAmbiguousLinks: sqlHasAmbiguous,
             path: params.path as string | undefined,
@@ -1240,6 +1267,7 @@ export function generateMcpTools(store: Store, opts?: GenerateMcpToolsOpts): Mcp
         // lifted for a scoped reader, so the real predicate is applied here
         // on that reader's own sub-vault. No-op unscoped.
         results = narrowByVisibleBrokenness(db, results, requestedHasBroken, ambiguityVisible);
+        results = linkOps.narrowByVisibleLinks(db, results, requestedHasLinks, ambiguityVisible);
 
         // --- Format output ---
         const includeContent = params.include_content === true; // default false for list
@@ -1307,7 +1335,7 @@ export function generateMcpTools(store: Store, opts?: GenerateMcpToolsOpts): Mcp
         // survives. Don't casually swap the order.
         if (params.include_link_count) {
           const dir = normalizeLinkCountDirection(params.link_count_direction);
-          const counts = linkOps.getLinkCounts(db, output.map((n: any) => n.id), dir);
+          const counts = linkOps.getLinkCounts(db, output.map((n: any) => n.id), dir, ambiguityVisible);
           for (const n of output) n.linkCount = counts.get(n.id) ?? 0;
         }
 
@@ -2270,7 +2298,7 @@ export function generateMcpTools(store: Store, opts?: GenerateMcpToolsOpts): Mcp
       name: "delete-note",
       execute: async (params) => {
         const note = requireNote(db, requireNoteReference(params.id));
-        await store.deleteNote(note.id);
+        await store.deleteNote(note.id, { actor: writeActor, via: writeVia });
         return { deleted: true, id: note.id };
       },
     },
@@ -2484,7 +2512,7 @@ export function generateMcpTools(store: Store, opts?: GenerateMcpToolsOpts): Mcp
             field: "new_name",
           });
         }
-        const result = await store.renameTag(oldName, newName);
+        const result = await store.renameTag(oldName, newName, { actor: writeActor ?? undefined, via: writeVia ?? undefined });
         if ("error" in result) {
           if (result.error === "not_found") {
             throw structuredError(`rename-tag: tag "${oldName}" not found`, {

package/core/src/notes.ts

@@ -31,6 +31,7 @@ import {
   type SearchMode,
 } from "./search-query.js";
 import { generateUlid } from "./ulid.js";
+import { captureVersion, readPriorNoteRow, DEFAULT_HISTORY_POLICY, type HistoryPolicy } from "./history.js";
 
 /**
  * Write-attribution context (vault#298) — the two axes of provenance threaded
@@ -2390,7 +2391,7 @@ export type RenameTagResult =
  * (the store wrapper) bust both `_tagHierarchy` and `_schemaConfig`
  * after the cascade returns.
  */
-export function renameTag(db: Database, oldName: string, newName: string): RenameTagResult {
+export function renameTag(db: Database, oldName: string, newName: string, attr?: { actor?: string | null; via?: string | null }, policy: HistoryPolicy = DEFAULT_HISTORY_POLICY): RenameTagResult {
   // Normalize the TARGET so a rename can never create a `#`-prefixed tag. The
   // SOURCE (`oldName`) is left LITERAL on purpose — it's the transitional escape
   // hatch that lets the `#legacy/*` → `legacy/*` data migration find the
@@ -2590,6 +2591,8 @@ export function renameTag(db: Database, oldName: string, newName: string): Renam
       for (const row of candidates) {
         const next = rewriteNoteBody(row.content, renames);
         if (next === row.content) continue;
+        const prior = readPriorNoteRow(db, row.id);
+        if (prior) captureVersion(db, prior, { actor: attr?.actor ?? null, via: attr?.via ?? null, op: "tag-rename", policy });
         updateStmt.run(next, now, nowMs, row.id);
         notesRewritten++;
       }
@@ -2612,6 +2615,8 @@ export function renameTag(db: Database, oldName: string, newName: string): Renam
       for (const row of candidates) {
         const next = rewriteTagConfigPath(row.path, renames);
         if (next === row.path) continue;
+        const prior = readPriorNoteRow(db, row.id);
+        if (prior) captureVersion(db, prior, { actor: attr?.actor ?? null, via: attr?.via ?? null, op: "tag-rename", policy });
         updateStmt.run(next, now, nowMs, row.id);
         pathsRenamed++;
       }

package/core/src/portable-md.ts

@@ -1961,7 +1961,7 @@ async function importVaultReplay(
       const batch = await store.queryNotes({ sort: "asc", limit: EXPORT_BATCH_SIZE });
       if (batch.length === 0) break;
       for (const note of batch) {
-        await store.deleteNote(note.id);
+        await store.deleteNote(note.id, { captureHistory: false });
         stats.notes_wiped++;
       }
     }

package/core/src/schema-v29-note-versions.test.ts

@@ -0,0 +1,63 @@
+import { it, expect, beforeEach, afterEach } from "bun:test";
+import { Database } from "bun:sqlite";
+import { initSchema } from "./schema.js";
+import { BunSqliteStore } from "./store.js";
+let db: Database;
+beforeEach(() => {
+  db = new Database(":memory:");
+  initSchema(db);
+});
+afterEach(() => db.close());
+function dropHistory() {
+  db.exec(
+    "DROP TABLE IF EXISTS note_versions; DROP TABLE IF EXISTS note_blobs;",
+  );
+}
+it("P14a v28 upgrade creates both tables and three indexes without backfill", () => {
+  dropHistory();
+  db.prepare("UPDATE schema_version SET version=28").run();
+  initSchema(db);
+  expect(
+    db.prepare("SELECT MAX(version) AS version FROM schema_version").get(),
+  ).toEqual({ version: 30 });
+  const tables = db
+    .prepare(
+      "SELECT name FROM sqlite_master WHERE type='table' AND name IN ('note_versions','note_blobs') ORDER BY name",
+    )
+    .all();
+  expect(tables).toEqual([{ name: "note_blobs" }, { name: "note_versions" }]);
+  expect(
+    db
+      .prepare(
+        "SELECT name FROM sqlite_master WHERE type='index' AND name IN ('idx_note_versions_note','idx_note_versions_hash','idx_note_versions_superseded')",
+      )
+      .all(),
+  ).toHaveLength(3);
+  expect(db.prepare("SELECT COUNT(*) AS n FROM note_versions").get()).toEqual({
+    n: 0,
+  });
+});
+it("P14b repeated init is idempotent", () => {
+  initSchema(db);
+  initSchema(db);
+  expect(db.prepare("SELECT COUNT(*) AS n FROM note_versions").get()).toEqual({
+    n: 0,
+  });
+});
+it("P14c rerunning the v29 migration preserves captured rows", async () => {
+  const store = new BunSqliteStore(db);
+  const n = await store.createNote("a");
+  await store.updateNote(n.id, { content: "b" });
+  db.prepare("UPDATE schema_version SET version=28").run();
+  initSchema(db);
+  expect((await store.getNoteVersion(n.id, 0))!.content).toBe("a");
+});
+it("P14d missing tables before the first capture degrade to no history", async () => {
+  const store = new BunSqliteStore(db);
+  const n = await store.createNote("a");
+  // Drop before this handle has probed true. A drop after capture is an
+  // accepted throw because historyTablesPresent memoises true per handle.
+  dropHistory();
+  await store.updateNote(n.id, { content: "b" });
+  expect((await store.getNote(n.id))!.content).toBe("b");
+});

package/core/src/schema-v30-note-deltas.test.ts

@@ -0,0 +1,51 @@
+import { test, expect } from "bun:test";
+import { Database } from "bun:sqlite";
+import { BunSqliteStore } from "./store.js";
+import { initSchema, SCHEMA_VERSION } from "./schema.js";
+test("P12 v29 opens losslessly, fresh and upgraded columns/indexes agree", async () => {
+  const db = new Database(":memory:"), fresh = new Database(":memory:");
+  try {
+    const store = new BunSqliteStore(db);
+    const a = await store.createNote("one"), b = await store.createNote("other");
+    await store.updateNote(a.id, { content: "two" });
+    await store.updateNote(a.id, { content: "three" });
+    await store.deleteNote(a.id);
+    await store.updateNote(b.id, { content: "changed" });
+    // Remove only v30 additions to recreate the actual v29 table shape.
+    db.exec("DROP INDEX IF EXISTS idx_note_blobs_delta_of");
+    const cols = (table: string) => db.prepare(`PRAGMA table_info(${table})`).all() as {
+      name: string;
+    }[];
+    if (cols("note_blobs").some(c => c.name === "delta_of"))
+      db.exec("ALTER TABLE note_blobs DROP COLUMN delta_of");
+    if (cols("note_blobs").some(c => c.name === "encoding"))
+      db.exec("ALTER TABLE note_blobs DROP COLUMN encoding");
+    if (cols("note_versions").some(c => c.name === "created_at"))
+      db.exec("ALTER TABLE note_versions DROP COLUMN created_at");
+    db.exec("UPDATE schema_version SET version=29");
+    const snap = () => ({ blobs: db.prepare("SELECT hash,content,byte_size FROM note_blobs ORDER BY hash").all(), versions: db.prepare("SELECT note_id,version_ix,content_hash,path,metadata,extension,superseded_at,actor,via,op,content_len,encoding FROM note_versions ORDER BY note_id,version_ix").all() });
+    const before = snap();
+    expect(() => initSchema(db)).not.toThrow();
+    expect(SCHEMA_VERSION).toBe(30);
+    expect(snap()).toEqual(before);
+    expect(db.prepare("SELECT hash FROM note_blobs WHERE delta_of IS NOT NULL OR encoding IS NOT NULL").all()).toEqual([]);
+    expect(db.prepare("SELECT note_id FROM note_versions WHERE created_at IS NOT NULL").all()).toEqual([]);
+    initSchema(fresh);
+    for (const table of ["note_blobs", "note_versions"]) {
+      expect(cols(table).map(c => c.name).sort()).toEqual((fresh.prepare(`PRAGMA table_info(${table})`).all() as {
+        name: string;
+      }[]).map(c => c.name).sort());
+    }
+    for (const handle of [db, fresh])
+      expect(handle.prepare("SELECT name FROM sqlite_master WHERE name='idx_note_blobs_delta_of'").get()).not.toBeNull();
+    expect(db.prepare("PRAGMA integrity_check").get()).toEqual({ integrity_check: "ok" });
+    expect(db.prepare("PRAGMA foreign_key_check").all()).toEqual([]);
+    initSchema(db);
+    expect(snap()).toEqual(before);
+    expect(() => db.exec("UPDATE note_blobs SET delta_of='nosuchhash'")).toThrow("FOREIGN KEY");
+  }
+  finally {
+    db.close();
+    fresh.close();
+  }
+});