@openparachute/vault 0.7.9-rc.3 → 0.7.9-rc.5

package/src/release-plan.test.ts

@@ -11,8 +11,10 @@
 import { describe, expect, test } from "bun:test";
 import {
   compareVersions,
+  coreVersion,
   decidePublish,
   distTagFor,
+  matchingRcVersions,
   readRegistry,
   unpublishedDrift,
 } from "../scripts/release-plan.ts";
@@ -193,13 +195,81 @@ describe("decidePublish", () => {
       {
         versionExists: false,
         currentDistTagVersion: "0.7.8",
-        publishedVersions: ["0.7.8"],
+        publishedVersions: ["0.7.8", "0.7.9-rc.1"],
       },
       { branch: "main" },
     );
     expect(d).toMatchObject({ publish: true });
   });
 
+  test("a stable without a matching rc is refused — vault#697", () => {
+    // Hub 0.7.13–0.7.16 shipped @latest with no rc of the same X.Y.Z.
+    // Vault's previous plan (and the inline shell it replaced) did the same.
+    const d = decidePublish(
+      "0.7.9",
+      {
+        versionExists: false,
+        currentDistTagVersion: "0.7.8",
+        publishedVersions: ["0.7.8", "0.7.8-rc.2"],
+      },
+      { branch: "main" },
+    );
+    expect(d).toMatchObject({ refuse: true });
+    expect("refuse" in d && d.reason).toMatch(/0\.7\.9-rc/);
+    expect("refuse" in d && d.reason).toMatch(/suffix-drop|Cut an rc first/i);
+  });
+
+  test("a stable whose only published rcs are a different X.Y.Z is still refused", () => {
+    const d = decidePublish(
+      "0.7.9",
+      {
+        versionExists: false,
+        currentDistTagVersion: "0.7.8",
+        publishedVersions: ["0.7.8", "0.7.8-rc.1"],
+      },
+      { branch: "main" },
+    );
+    expect(d).toMatchObject({ refuse: true });
+  });
+
+  test("a stable with a matching rc publishes from main", () => {
+    const d = decidePublish(
+      "0.7.9",
+      {
+        versionExists: false,
+        currentDistTagVersion: "0.7.8",
+        publishedVersions: ["0.7.8", "0.7.9-rc.1"],
+      },
+      { branch: "main" },
+    );
+    expect(d).toMatchObject({ publish: true });
+  });
+
+  test("omitted publishedVersions still refuses a stable when latest already exists", () => {
+    const d = decidePublish(
+      "0.7.9",
+      {
+        versionExists: false,
+        currentDistTagVersion: "0.7.8",
+      },
+      { branch: "main" },
+    );
+    expect(d).toMatchObject({ refuse: true });
+  });
+
+  test("an rc publishes even with no prior rc of the same core", () => {
+    const d = decidePublish(
+      "0.7.9-rc.1",
+      {
+        versionExists: false,
+        currentDistTagVersion: "0.7.8-rc.5",
+        publishedVersions: ["0.7.8", "0.7.8-rc.5"],
+      },
+      { branch: "next" },
+    );
+    expect(d).toMatchObject({ publish: true });
+  });
+
   test("a tag push of a stable does NOT override the main-only gate", () => {
     const d = decidePublish(
       "0.7.9",
@@ -281,6 +351,25 @@ describe("readRegistry", () => {
   });
 });
 
+describe("matchingRcVersions", () => {
+  test("matches only the same X.Y.Z rc chain", () => {
+    expect(
+      matchingRcVersions("0.7.9", ["0.7.8", "0.7.8-rc.1", "0.7.9-rc.1", "0.7.9-rc.2"]),
+    ).toEqual(["0.7.9-rc.1", "0.7.9-rc.2"]);
+  });
+
+  test("a prerelease still matches siblings of its core", () => {
+    expect(matchingRcVersions("0.7.9-rc.3", ["0.7.9-rc.1", "0.7.8-rc.1"])).toEqual(["0.7.9-rc.1"]);
+  });
+});
+
+describe("coreVersion", () => {
+  test("strips the rc suffix and leaves a stable alone", () => {
+    expect(coreVersion("0.7.9-rc.1")).toBe("0.7.9");
+    expect(coreVersion("0.7.9")).toBe("0.7.9");
+  });
+});
+
 describe("unpublishedDrift", () => {
   test("no commits → not drifted", () => {
     expect(unpublishedDrift([]).drifted).toBe(false);

package/src/routes.ts

@@ -11,6 +11,8 @@
  * and the Request, and returns a Response.
  */
 
+import { HistoryNotFoundError, latestTombstone } from "../core/src/history.js";
+import { ULID_REGEX } from "../core/src/ulid.js";
 import type { Database } from "bun:sqlite";
 import type { Store, Note, QueryOpts, AggregateSpec } from "../core/src/types.ts";
 import { TAG_EXPAND_MODES, stripTagHash, suggestSimilarTag, type TagExpandMode } from "../core/src/tag-hierarchy.ts";
@@ -32,6 +34,7 @@ import {
   getUnresolvedLinksForNote,
   getUnresolvedLinksForNotes,
   listZeroVisibleAmbiguousAsUnresolved,
+  listResolvedToInvisibleAsUnresolved,
   narrowByVisibleBrokenness,
   sqlHasBrokenLinks,
   getAmbiguousLinksForNote,
@@ -179,6 +182,103 @@ export { assetsDir };
 // Helpers
 // ---------------------------------------------------------------------------
 
+function conflictResponse(e: any): Response | null {
+  if (e instanceof NotFoundError) return json({ error: e.message, error_type: "not_found" }, 404);
+  // Duck-type on `code` rather than `instanceof ConflictError`: this
+  // error originates in the core package and survives any future
+  // bundling / module-boundary split more robustly than a prototype check.
+  if (e && e.code === "CONFLICT") {
+    return json(
+      {
+        // New structured shape — what agents should key on.
+        error_type: "conflict",
+        current_updated_at: e.current_updated_at ?? null,
+        your_updated_at: e.expected_updated_at,
+        path: e.note_path ?? null,
+        note_id: e.note_id,
+        message: e.message,
+        hint: "re-read the note (GET) and re-apply your change against its current `updated_at`, or pass `force: true` to overwrite",
+        // Legacy fields — kept for the lens VaultConflictError shim and
+        // any other pre-launch callers. Safe to drop post-launch.
+        error: "conflict",
+        expected_updated_at: e.expected_updated_at,
+      },
+      409,
+    );
+  }
+  // State-transition compare-and-set conflict (vault#299 Part B). A
+  // DISTINCT error vocabulary from `conflict` (settled lead #3): the
+  // field VALUE didn't match `from`, not the updated_at token. 409.
+  if (e && e.code === "TRANSITION_CONFLICT") {
+    return json(
+      {
+        error_type: "transition_conflict",
+        error: "transition_conflict",
+        note_id: e.note_id,
+        path: e.note_path ?? null,
+        field: e.field,
+        expected_from: e.expected_from,
+        to: e.to,
+        current: e.current ?? null,
+        message: e.message,
+        hint: "re-read the note's current value for this field and retry the transition from its actual current state",
+      },
+      409,
+    );
+  }
+  // Strict-schema rejection (vault#299 Part A). One error carrying ALL
+  // per-field violations (settled lead #1). 422 Unprocessable Entity —
+  // the note exists / request is well-formed but violates the contract.
+  if (e && e.code === "SCHEMA_VALIDATION") {
+    return json(
+      {
+        error_type: "schema_validation",
+        error: "schema_validation",
+        violations: e.violations ?? [],
+        message: e.message,
+        hint: "fix every field listed in `violations` and retry — none of this write was applied",
+      },
+      422,
+    );
+  }
+  // Path-rename collision — schema's UNIQUE(path) tripped. Issue #126.
+  if (e && e.code === "PATH_CONFLICT") {
+    return json(
+      {
+        error_type: "path_conflict",
+        error: "path_conflict",
+        path: e.path,
+        message: e.message,
+        hint: "pass a different `path`, or omit it to leave the existing path unchanged",
+      },
+      409,
+    );
+  }
+  if (e && e.code === "INVALID_EXTENSION") {
+    return json(
+      { error_type: "invalid_extension", error: "invalid_extension", extension: e.extension, reason: e.reason, message: e.message },
+      400,
+    );
+  }
+  // Bad `path` value (vault#589 / FIX 2) — NUL byte or `..` segment.
+  if (e && e.code === "INVALID_PATH") {
+    return json(
+      { error_type: "invalid_path", error: "invalid_path", path: e.path, reason: e.reason, message: e.message },
+      400,
+    );
+  }
+  if (e && e.code === "HISTORY_NOT_FOUND") return json({ error: e.message, error_type: "not_found" }, 404);
+  if (e && e.code === "HISTORY_OVERFLOW") return json({
+    error_type: "history_overflow", note_id: e.note_id, byte_size: e.byte_size, limit: e.limit, message: e.message,
+    hint: "this note exceeds the 2 MB version-history ceiling, so it cannot be updated while history is enabled; delete it, or shrink it out-of-band, or disable history for this vault",
+  }, 413);
+  if (e && e.code === "HISTORY_UNRECOVERABLE") return json({
+    error_type: "history_unrecoverable", note_id: e.note_id, version_ix: e.version_ix, message: e.message,
+    hint: e.reason === "delta_orphan" ? "this version's stored delta cannot be rebuilt — its base blob is missing or corrupt; run GET /api/doctor for the `history_delta_orphan` finding" : "this version is an overflow tombstone — the note's size and deletion were recorded but its content never was",
+  }, 409);
+  return null;
+}
+
 function json(data: unknown, status = 200): Response {
   return Response.json(data, { status });
 }
@@ -1026,7 +1126,7 @@ export function parseNotesQueryOpts(url: URL, tagScope: TagScopeCtx = NO_TAG_SCO
     expand,
     excludeTags: parseQueryList(url, "exclude_tag"),
     hasTags: parseBoolOrUndef(parseQuery(url, "has_tags")),
-    hasLinks: parseBoolOrUndef(parseQuery(url, "has_links")),
+    hasLinks: linkOps.sqlHasLinks(parseBoolOrUndef(parseQuery(url, "has_links")), tagScope.raw !== null),
     // Presence filter on dangling outbound wikilinks/structured links
     // (vault#555) — see core/src/types.ts QueryOpts.hasBrokenLinks.
     // vault#239: for a TAG-SCOPED reader NEITHER polarity is safe to push
@@ -1376,7 +1476,7 @@ async function handleNotesInner(
         // linkCount injected after filterMetadata on purpose — same as
         // links/attachments above; filterMetadata only touches `metadata`.
         if (parseBool(parseQuery(url, "include_link_count"), false)) {
-          result.linkCount = linkOps.getLinkCounts(db, [note.id], parseLinkCountDirection(url)).get(note.id) ?? 0;
+          result.linkCount = linkOps.getLinkCounts(db, [note.id], parseLinkCountDirection(url), ambiguityVisibilityFor(db, tagScope)).get(note.id) ?? 0;
         }
         return json(result);
       }
@@ -1451,7 +1551,26 @@ async function handleNotesInner(
               embeddingsPendingWarning(semanticResult.pendingCount, semanticResult.totalCandidates),
             );
           }
-          const filtered = filterNotesByTagScope(semanticResult.notes, tagScope.allowed, tagScope.raw);
+          let filtered = filterNotesByTagScope(semanticResult.notes, tagScope.allowed, tagScope.raw);
+          // Apply the same scoped presence filters as the structured list.
+          filtered = narrowByVisibleAmbiguity(
+            db,
+            filtered,
+            parseBoolOrUndef(parseQuery(url, "has_ambiguous_links")),
+            ambiguityVisibilityFor(db, tagScope),
+          );
+          filtered = narrowByVisibleBrokenness(
+            db,
+            filtered,
+            parseBoolOrUndef(parseQuery(url, "has_broken_links")),
+            ambiguityVisibilityFor(db, tagScope),
+          );
+          filtered = linkOps.narrowByVisibleLinks(
+            db,
+            filtered,
+            parseBoolOrUndef(parseQuery(url, "has_links")),
+            ambiguityVisibilityFor(db, tagScope),
+          );
           const includeContent = parseBool(parseQuery(url, "include_content"), false);
           const contentRange = parseContentRangeQuery(url, includeContent);
           if (contentRange.error) return contentRange.error;
@@ -1477,7 +1596,7 @@ async function handleNotesInner(
             output = output.map((n: any) => filterMetadata(n, inclMeta));
           }
           if (parseBool(parseQuery(url, "include_link_count"), false)) {
-            const counts = linkOps.getLinkCounts(db, output.map((n: any) => n.id), parseLinkCountDirection(url));
+            const counts = linkOps.getLinkCounts(db, output.map((n: any) => n.id), parseLinkCountDirection(url), ambiguityVisibilityFor(db, tagScope));
             for (const n of output) n.linkCount = counts.get(n.id) ?? 0;
           }
           return jsonWithWarnings(output, semanticWarnings);
@@ -1646,7 +1765,26 @@ async function handleNotesInner(
         // Tag-scope: drop any result the token isn't permitted to see. Filter
         // happens after the store query so an empty post-filter list still
         // returns 200 [] (consistent with "no matches"), not 403.
-        const results = filterNotesByTagScope(rawResults, tagScope.allowed, tagScope.raw);
+        let results = filterNotesByTagScope(rawResults, tagScope.allowed, tagScope.raw);
+        // Apply the same scoped presence filters as the structured list.
+        results = narrowByVisibleAmbiguity(
+          db,
+          results,
+          parseBoolOrUndef(parseQuery(url, "has_ambiguous_links")),
+          ambiguityVisibilityFor(db, tagScope),
+        );
+        results = narrowByVisibleBrokenness(
+          db,
+          results,
+          parseBoolOrUndef(parseQuery(url, "has_broken_links")),
+          ambiguityVisibilityFor(db, tagScope),
+        );
+        results = linkOps.narrowByVisibleLinks(
+          db,
+          results,
+          parseBoolOrUndef(parseQuery(url, "has_links")),
+          ambiguityVisibilityFor(db, tagScope),
+        );
         const includeContent = parseBool(parseQuery(url, "include_content"), false);
         const contentRange = parseContentRangeQuery(url, includeContent);
         if (contentRange.error) return contentRange.error;
@@ -1680,6 +1818,7 @@ async function handleNotesInner(
             db,
             output.map((n: any) => n.id),
             parseLinkCountDirection(url),
+            ambiguityVisibilityFor(db, tagScope),
           );
           for (const n of output) n.linkCount = counts.get(n.id) ?? 0;
         }
@@ -1807,6 +1946,12 @@ async function handleNotesInner(
               parseBoolOrUndef(parseQuery(url, "has_broken_links")),
               ambiguityVisibilityFor(db, tagScope),
             );
+            visible = linkOps.narrowByVisibleLinks(
+              db,
+              visible,
+              parseBoolOrUndef(parseQuery(url, "has_links")),
+              ambiguityVisibilityFor(db, tagScope),
+            );
             // Always run the rollup, even on an empty visible set: ungrouped
             // count (vault#626) must return `[{group:null,value:0}]`, not `[]`.
             rows = await store.aggregateNotes({ ids: visible.map((n) => n.id), aggregate: aggregateParsed.aggregate });
@@ -1980,6 +2125,12 @@ async function handleNotesInner(
         parseBoolOrUndef(parseQuery(url, "has_broken_links")),
         ambiguityVisibilityFor(db, tagScope),
       );
+      results = linkOps.narrowByVisibleLinks(
+        db,
+        results,
+        parseBoolOrUndef(parseQuery(url, "has_links")),
+        ambiguityVisibilityFor(db, tagScope),
+      );
 
       const includeContent = parseBool(parseQuery(url, "include_content"), false);
       const contentRange = parseContentRangeQuery(url, includeContent);
@@ -2059,6 +2210,7 @@ async function handleNotesInner(
           db,
           output.map((n: any) => n.id),
           parseLinkCountDirection(url),
+          ambiguityVisibilityFor(db, tagScope),
         );
         for (const n of output) n.linkCount = counts.get(n.id) ?? 0;
       }
@@ -2770,6 +2922,75 @@ async function handleNotesInner(
     return handleRetryTranscription(store, note, vault);
   }
 
+  const verMatch = sub.match(/^\/versions\/([^/]+)$/);
+  if (sub === "/versions" || verMatch || sub === "/restore") {
+    const note = await resolveNote(store, idOrPath);
+    if (note && !noteWithinTagScope(note, tagScope.allowed, tagScope.raw)) {
+      return json({ error: "Not found", error_type: "not_found" }, 404);
+    }
+    if (!note && (tagScope.raw !== null || !ULID_REGEX.test(idOrPath) ||
+      !(await store.listNoteVersions(idOrPath, { limit: 1 })).length)) {
+      return json({ error: "Not found", error_type: "not_found" }, 404);
+    }
+    const id = note?.id ?? idOrPath;
+    if (sub === "/versions") {
+      if (method === "GET") {
+        const parsedLimit = Number.parseInt(url.searchParams.get("limit") ?? "50", 10);
+        const limit = Number.isNaN(parsedLimit) ? 50 : Math.min(200, Math.max(0, parsedLimit));
+        const offset = Math.max(0, Number.parseInt(url.searchParams.get("offset") ?? "0", 10) || 0);
+        const versions = await store.listNoteVersions(id, { limit, offset });
+        const total = await store.countNoteVersions(id);
+        return json({ versions, total });
+      }
+      if (method === "DELETE") {
+        const result = await store.eraseNoteHistory(id);
+        return json({ erased: true, id, versions_deleted: result.versionsDeleted, blobs_deleted: result.blobsDeleted });
+      }
+    } else if (verMatch && method === "GET") {
+      const ix = Number(verMatch[1]);
+      if (!/^\d+$/.test(verMatch[1]!) || !Number.isInteger(ix) || ix < 0) return json({ error: "Invalid version_ix", error_type: "invalid_request" }, 400);
+      try {
+        const version = await store.getNoteVersion(id, ix);
+        return version ? json(version) : json({ error: "Not found", error_type: "not_found" }, 404);
+      } catch (e) {
+        const response = conflictResponse(e);
+        if (response) return response;
+        throw e;
+      }
+    } else if (sub === "/restore" && method === "POST") {
+      const parsed = await parseJsonBody(req);
+      if (!parsed.ok) return parsed.response;
+      const body = parsed.body;
+      if (body.version_ix === undefined) return json({ error: "version_ix is required", error_type: "missing_required_field" }, 400);
+      if (!Number.isInteger(body.version_ix) || (body.version_ix as number) < 0) return json({ error: "Invalid version_ix", error_type: "invalid_request" }, 400);
+      try {
+        const version = await store.getNoteVersion(id, body.version_ix as number);
+        if (!version) throw new HistoryNotFoundError(id, body.version_ix as number);
+        gateStrictWrite(store, writeCtx, {
+          path: note ? note.path : latestTombstone(db, id)?.path,
+          tags: note?.tags ?? [], metadata: version.metadata,
+        });
+        const restored = await store.restoreNoteVersion(id, body.version_ix as number, {
+          actor: writeCtx.actor, via: writeCtx.via,
+          ...(body.if_updated_at !== undefined ? { if_updated_at: body.if_updated_at as string } : {}),
+        });
+        let validated: any = attachValidationStatus(store, db, restored);
+        validated = scrubNoteTagsByScope(validated, tagScope.allowed, tagScope.raw);
+        if (validated.validation_status) {
+          const vs = scrubValidationStatusByScope(validated.validation_status, tagScope.allowed, tagScope.raw);
+          if (vs === undefined) { const { validation_status: _d, ...rest } = validated; validated = rest; }
+          else validated = { ...validated, validation_status: vs };
+        }
+        return json({ ...validated, restored_from: body.version_ix, recreated: !note });
+      } catch (e: any) {
+        const r = conflictResponse(e);
+        if (r) return r;
+        throw e;
+      }
+    }
+    return json({ error: "Method not allowed", error_type: "method_not_allowed" }, 405);
+  }
+
   if (sub !== "") return json({ error: "Not found", error_type: "not_found" }, 404);
 
   // GET /notes/:idOrPath — single note
@@ -2826,7 +3047,7 @@ async function handleNotesInner(
       result.attachments = await store.getAttachments(note.id);
     }
     if (parseBool(parseQuery(url, "include_link_count"), false)) {
-      result.linkCount = linkOps.getLinkCounts(db, [note.id], parseLinkCountDirection(url)).get(note.id) ?? 0;
+      result.linkCount = linkOps.getLinkCounts(db, [note.id], parseLinkCountDirection(url), ambiguityVisibilityFor(db, tagScope)).get(note.id) ?? 0;
     }
     return json(result);
   }
@@ -3304,90 +3525,8 @@ async function handleNotesInner(
       lean.created = false;
       return json(lean);
     } catch (e: any) {
-      if (e instanceof NotFoundError) return json({ error: e.message, error_type: "not_found" }, 404);
-      // Duck-type on `code` rather than `instanceof ConflictError`: this
-      // error originates in the core package and survives any future
-      // bundling / module-boundary split more robustly than a prototype check.
-      if (e && e.code === "CONFLICT") {
-        return json(
-          {
-            // New structured shape — what agents should key on.
-            error_type: "conflict",
-            current_updated_at: e.current_updated_at ?? null,
-            your_updated_at: e.expected_updated_at,
-            path: e.note_path ?? null,
-            note_id: e.note_id,
-            message: e.message,
-            hint: "re-read the note (GET) and re-apply your change against its current `updated_at`, or pass `force: true` to overwrite",
-            // Legacy fields — kept for the lens VaultConflictError shim and
-            // any other pre-launch callers. Safe to drop post-launch.
-            error: "conflict",
-            expected_updated_at: e.expected_updated_at,
-          },
-          409,
-        );
-      }
-      // State-transition compare-and-set conflict (vault#299 Part B). A
-      // DISTINCT error vocabulary from `conflict` (settled lead #3): the
-      // field VALUE didn't match `from`, not the updated_at token. 409.
-      if (e && e.code === "TRANSITION_CONFLICT") {
-        return json(
-          {
-            error_type: "transition_conflict",
-            error: "transition_conflict",
-            note_id: e.note_id,
-            path: e.note_path ?? null,
-            field: e.field,
-            expected_from: e.expected_from,
-            to: e.to,
-            current: e.current ?? null,
-            message: e.message,
-            hint: "re-read the note's current value for this field and retry the transition from its actual current state",
-          },
-          409,
-        );
-      }
-      // Strict-schema rejection (vault#299 Part A). One error carrying ALL
-      // per-field violations (settled lead #1). 422 Unprocessable Entity —
-      // the note exists / request is well-formed but violates the contract.
-      if (e && e.code === "SCHEMA_VALIDATION") {
-        return json(
-          {
-            error_type: "schema_validation",
-            error: "schema_validation",
-            violations: e.violations ?? [],
-            message: e.message,
-            hint: "fix every field listed in `violations` and retry — none of this write was applied",
-          },
-          422,
-        );
-      }
-      // Path-rename collision — schema's UNIQUE(path) tripped. Issue #126.
-      if (e && e.code === "PATH_CONFLICT") {
-        return json(
-          {
-            error_type: "path_conflict",
-            error: "path_conflict",
-            path: e.path,
-            message: e.message,
-            hint: "pass a different `path`, or omit it to leave the existing path unchanged",
-          },
-          409,
-        );
-      }
-      if (e && e.code === "INVALID_EXTENSION") {
-        return json(
-          { error_type: "invalid_extension", error: "invalid_extension", extension: e.extension, reason: e.reason, message: e.message },
-          400,
-        );
-      }
-      // Bad `path` value (vault#589 / FIX 2) — NUL byte or `..` segment.
-      if (e && e.code === "INVALID_PATH") {
-        return json(
-          { error_type: "invalid_path", error: "invalid_path", path: e.path, reason: e.reason, message: e.message },
-          400,
-        );
-      }
+      const r = conflictResponse(e);
+      if (r) return r;
       throw e;
     }
   }
@@ -3401,7 +3540,7 @@ async function handleNotesInner(
     if (!noteWithinTagScope(note, tagScope.allowed, tagScope.raw)) {
       return json({ error: "Not found", error_type: "not_found" }, 404);
     }
-    await store.deleteNote(note.id);
+    await store.deleteNote(note.id, { actor: writeCtx.actor, via: writeCtx.via });
     return json({ deleted: true, id: note.id });
   }
 
@@ -3418,6 +3557,7 @@ export async function handleTags(
   store: Store,
   subpath = "",
   tagScope: TagScopeCtx = NO_TAG_SCOPE,
+  writeCtx: WriteCtx = NO_WRITE_CTX,
 ): Promise<Response> {
   const url = new URL(req.url);
 
@@ -3566,7 +3706,7 @@ export async function handleTags(
     // other surface). The old fail-closed token-reference check has been
     // removed; the cascade rewrites the JSON allowlist atomically. See
     // notes.ts:renameTag for the surfaces touched.
-    const result = await store.renameTag(oldName, newName);
+    const result = await store.renameTag(oldName, newName, { actor: writeCtx.actor ?? undefined, via: writeCtx.via ?? undefined });
     if ("error" in result) {
       if (result.error === "not_found") {
         return json({ error: "not_found", error_type: "tag_not_found", tag: oldName }, 404);
@@ -4264,9 +4404,16 @@ export function handleUnresolvedWikilinks(
   // target); the two tables are disjoint by construction, so this only
   // guards against a stale row.
   const seen = new Set(filtered.map((r) => `${r.source_id}\u0000${r.relationship}\u0000${r.target_path.toLowerCase()}`));
-  const collapsed = listZeroVisibleAmbiguousAsUnresolved(db, ambiguityVisibilityFor(db, tagScope)!, limit)
-    .filter((row) => inScope(row)
-      && !seen.has(`${row.source_id}\u0000${row.relationship}\u0000${row.target_path.toLowerCase()}`));
+  const visible = ambiguityVisibilityFor(db, tagScope)!;
+  const collapsed = [
+    ...listZeroVisibleAmbiguousAsUnresolved(db, visible, limit),
+    ...listResolvedToInvisibleAsUnresolved(db, visible, limit),
+  ].filter((row) => {
+    const key = `${row.source_id}\u0000${row.relationship}\u0000${row.target_path.toLowerCase()}`;
+    if (!inScope(row) || seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
 
   const merged = [...filtered, ...collapsed].slice(0, limit);
   return Response.json({ unresolved: merged, count: merged.length });
@@ -5082,3 +5229,37 @@ function removeWikilinkBrackets(content: string, targetPath: string): string {
   content = content.replace(new RegExp(`\\[\\[${escaped}(#[^\\]]+)?\\]\\]`, "gi"), `${targetPath}$1`);
   return content;
 }
+
+/** POST /api/history/compact — unscoped administrators; absent bounds are unbounded. */
+export async function handleHistoryCompact(req: Request, store: Store, tagScope: TagScopeCtx = NO_TAG_SCOPE): Promise<Response> {
+  if (tagScope.raw !== null)
+    return json({ error: "Not found", error_type: "not_found" }, 404);
+  const declared = Number(req.headers.get("content-length"));
+  if (declared > MAX_JSON_BODY_BYTES)
+    return payloadTooLargeResponse(declared);
+  let body: Record<string, unknown>;
+  try {
+    const raw = await req.text();
+    if (new TextEncoder().encode(raw).length > MAX_JSON_BODY_BYTES)
+      return payloadTooLargeResponse(new TextEncoder().encode(raw).length);
+    const parsed = raw.trim() ? JSON.parse(raw) : {};
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+      throw new Error("object required");
+    body = parsed;
+  }
+  catch {
+    return json({ error: "Invalid compaction request", error_type: "invalid_request" }, 400);
+  }
+  if ((body.note_id !== undefined && (typeof body.note_id !== "string" || body.note_id.length === 0)) ||
+    [body.budget_ms, body.max_notes].some(v => v !== undefined && (typeof v !== "number" || !Number.isInteger(v) || v < 1)))
+    return json({ error: "Invalid compaction request", error_type: "invalid_request" }, 400);
+  try {
+    return json(store.compactHistory({ noteId: body.note_id as string | undefined, budgetMs: body.budget_ms as number | undefined ?? null, maxNotes: body.max_notes as number | undefined ?? null }));
+  }
+  catch (err) {
+    const conflict = conflictResponse(err);
+    if (conflict)
+      return conflict;
+    return json({ error: "Compaction failed", error_type: "compaction_failed", message: err instanceof Error ? err.message : String(err) }, 500);
+  }
+}

package/src/routing.ts

@@ -85,6 +85,7 @@ import {
   handleStorage,
   handleViewNote,
   handleDoctor,
+  handleHistoryCompact,
   type TagScopeCtx,
   type WriteCtx,
 } from "./routes.ts";
@@ -1101,11 +1102,14 @@ export async function route(
     ((req.method === "PUT" || req.method === "DELETE") && /^\/tags\/[^/]+$/.test(apiSubpath)) ||
     (req.method === "POST" &&
       (apiSubpath === "/tags/merge" || /^\/tags\/[^/]+\/rename$/.test(apiSubpath)));
-  const requiredVerb = isReadOnlyPost ? "read" : isTagSchemaMutation ? "admin" : verbForMethod(req.method);
+  // Erasing note history is irreversible and requires admin (vault#524).
+  const isNoteHistoryErase = req.method === "DELETE" && /^\/notes\/[^/]+\/versions$/.test(apiSubpath);
+  const isHistoryCompact = req.method === "POST" && apiSubpath === "/history/compact";
+  const requiredVerb = isReadOnlyPost ? "read" : (isTagSchemaMutation || isNoteHistoryErase || isHistoryCompact) ? "admin" : verbForMethod(req.method);
   if (!hasScopeForVault(auth.scopes, vaultName, requiredVerb)) {
     const requiredApiScope = isReadOnlyPost
       ? SCOPE_READ
-      : isTagSchemaMutation
+      : (isTagSchemaMutation || isNoteHistoryErase || isHistoryCompact)
         ? SCOPE_ADMIN
         : scopeForMethod(req.method);
     return Response.json(
@@ -1173,7 +1177,8 @@ export async function route(
       { status: 410 },
     );
   }
-  if (apiPath.startsWith("/tags")) return handleTags(req, store, apiPath.slice(5), tagScope);
+  if (apiPath.startsWith("/tags")) return handleTags(req, store, apiPath.slice(5), tagScope, writeCtx);
+  if (isHistoryCompact) return handleHistoryCompact(req, store, tagScope);
   if (apiPath === "/find-path") return handleFindPath(req, store, tagScope);
   if (apiPath === "/vault") {
     return handleVault(