@openparachute/vault 0.7.9-rc.7 → 0.7.9-rc.9

package/core/src/compact-state-rebuild.test.ts

@@ -0,0 +1,46 @@
+import { test, expect } from "bun:test";
+import { Database } from "bun:sqlite";
+import { BunSqliteStore } from "./store.js";
+import { initSchema } from "./schema.js";
+import { runDoctorScan } from "./doctor.js";
+
+test("no ledger rows are not evidence of a downgrade", async () => {
+  const db = new Database(":memory:");
+  try {
+    const store = new BunSqliteStore(db);
+    const note = await store.createNote("before");
+    await store.updateNote(note.id, { content: "after" });
+    db.exec("DELETE FROM schema_version; UPDATE history_compact_state SET refused=1");
+    initSchema(db);
+    expect(db.prepare("SELECT refused FROM history_compact_state").get()).toEqual({ refused: 1 });
+    db.exec("DROP TABLE history_compact_state; DELETE FROM schema_version");
+    initSchema(db);
+    expect(db.prepare("SELECT versions,refused FROM history_compact_state").get()).toEqual({ versions: 1, refused: 0 });
+  } finally { db.close(); }
+});
+
+for (const tied of [false, true]) test(`a downgrade ledger entry rebuilds existing stale hints (tied=${tied})`, async () => {
+  const db = new Database(":memory:");
+  try {
+    const store = new BunSqliteStore(db, { history: { compact_min_versions: 2, compact_ratio: 1 } });
+    const note = await store.createNote("old".repeat(1000));
+    await store.updateNote(note.id, { append: "first" });
+    const stale = db.prepare("SELECT * FROM history_compact_state WHERE note_id=?").get(note.id) as any;
+    await store.updateNote(note.id, { append: "second" });
+    await store.updateNote(note.id, { content: "x" });
+    // Reproduce the older writer: history/live rows advance but hints do not,
+    // and that binary records its own version on open.
+    db.prepare("UPDATE history_compact_state SET versions=?,stored=?,live=?,refused=1 WHERE note_id=?").run(stale.versions, stale.stored, stale.live, note.id);
+    db.prepare("UPDATE schema_version SET applied_at='2026-01-01T00:00:00.000Z'").run();
+    db.prepare("INSERT OR REPLACE INTO schema_version VALUES(31,?)").run(tied ? "2026-01-01T00:00:00.000Z" : "2026-01-02T00:00:00.000Z");
+    expect(runDoctorScan(db).findings.some(f=>f.type==="history_compact_state_drift")).toBe(true);
+    const rows = db.prepare("SELECT * FROM note_versions").all();
+    initSchema(db);
+    expect(runDoctorScan(db).findings.some(f=>f.type==="history_compact_state_drift")).toBe(false);
+    expect(db.prepare("SELECT * FROM note_versions").all()).toEqual(rows);
+    expect(store.compactHistory({ budgetMs: null, maxNotes: null }).notes_scanned).toBe(1);
+    db.prepare("UPDATE history_compact_state SET refused=1").run();
+    initSchema(db);
+    expect(db.prepare("SELECT refused FROM history_compact_state WHERE note_id=?").get(note.id)).toEqual({ refused: 1 });
+  } finally { db.close(); }
+});

package/core/src/compact-state.test.ts

@@ -0,0 +1,129 @@
+import { test, expect, beforeEach, afterEach } from "bun:test";
+import { Database } from "bun:sqlite";
+import { BunSqliteStore } from "./store.js";
+import { initSchema } from "./schema.js";
+import { runDoctorScan } from "./doctor.js";
+import { pruneVersions, resolveHistoryPolicy, sweepDeletedHistory } from "./history.js";
+import { readCompactState } from "./history-compact-state.js";
+import { applyImportedNote, beginImportRun, importTargetDigest } from "./history-import.js";
+let db: Database, store: BunSqliteStore;
+beforeEach(() => { db = new Database(":memory:"); store = new BunSqliteStore(db, { history: { compact_min_versions: 2, compact_ratio: 1 } }); });
+afterEach(() => db.close());
+const state = (id: string) => db.query("SELECT versions,stored,live,refused FROM history_compact_state WHERE note_id=?").get(id) as { versions: number; stored: number; live: number; refused: number } | null;
+test("live bytes refresh after mutation, empty histories are excluded and nonempty edits re-arm", async () => {
+  const n = await store.createNote("large".repeat(1000));
+  await store.updateNote(n.id, { append: "changed" });
+  await store.updateNote(n.id, { content: "" });
+  expect(state(n.id)?.live).toBe(0);
+  expect(store.compactHistory({ budgetMs: null, maxNotes: null }).notes_scanned).toBe(0);
+  await store.updateNote(n.id, { content: "x" });
+  expect(state(n.id)?.live).toBe(1);
+  expect(store.compactHistory({ budgetMs: null, maxNotes: null }).notes_scanned).toBe(1);
+});
+test("incompressible refusal disappears on pass two and any metadata capture re-arms", async () => {
+  const n = await store.createNote("a");
+  await store.updateNote(n.id, { content: "b" });
+  await store.updateNote(n.id, { content: "c" });
+  expect(store.compactHistory({ budgetMs: null, maxNotes: null }).notes_scanned).toBe(1);
+  expect(state(n.id)?.refused).toBe(1);
+  expect(store.compactHistory({ budgetMs: null, maxNotes: null }).notes_scanned).toBe(0);
+  await store.updateNote(n.id, { metadata: { status: 1 } });
+  expect(state(n.id)?.refused).toBe(0);
+  expect(store.compactHistory({ budgetMs: null, maxNotes: null }).notes_scanned).toBe(1);
+});
+test("shared blob rewrites refresh other notes without re-arming refusal", async () => {
+  const body = "shared history\n".repeat(1000);
+  const a = await store.createNote(body), b = await store.createNote(body);
+  await store.updateNote(a.id, { append: "a" });
+  await store.updateNote(a.id, { content: "small" });
+  await store.updateNote(b.id, { content: "small" });
+  db.query("UPDATE history_compact_state SET refused=1 WHERE note_id=?").run(b.id);
+  const before = state(b.id)!;
+  expect(store.compactNote(a.id).blobs_deltified).toBeGreaterThan(0);
+  expect(state(b.id)!.stored).toBeLessThan(before.stored);
+  expect(state(b.id)!.refused).toBe(1);
+});
+test("v31 migration backfills deleted and live history once and preserves bodies", async () => {
+  const n = await store.createNote("old");
+  await store.updateNote(n.id, { content: "new" });
+  await store.deleteNote(n.id);
+  const before = db.query("SELECT * FROM note_versions").all();
+  db.exec("DROP TABLE history_compact_state; UPDATE schema_version SET version=31");
+  initSchema(db);
+  expect(state(n.id)).toEqual({ versions: 2, stored: 6, live: 3, refused: 0 });
+  expect(db.query("PRAGMA foreign_key_list(history_compact_state)").all()).toEqual([]);
+  expect(db.query("SELECT * FROM note_versions").all()).toEqual(before);
+  expect((await store.getNoteVersion(n.id, 0))?.content).toBe("old");
+  db.query("UPDATE history_compact_state SET refused=1").run();
+  initSchema(db);
+  expect(state(n.id)?.refused).toBe(1);
+  await store.eraseNoteHistory(n.id);
+  expect(state(n.id)).toBeNull();
+  expect(db.query("PRAGMA foreign_key_check").all()).toEqual([]);
+});
+test("doctor reports bounded hint drift without repairing history", async () => {
+  const n = await store.createNote("before");
+  await store.updateNote(n.id, { content: "after" });
+  db.query("UPDATE history_compact_state SET stored=999 WHERE note_id=?").run(n.id);
+  const result = runDoctorScan(db);
+  expect(result.findings.some(f => f.type === ("history_compact_state_drift" as any) && f.severity === "warning")).toBe(true);
+  expect(state(n.id)?.stored).toBe(999);
+  expect(runDoctorScan(db, { allowedTags: ["restricted"] }).findings.some(f => f.type === "history_compact_state_drift")).toBe(false);
+});
+test("prune, imported observations, deleted compaction and sweep maintain exact counters", async () => {
+  const n = await store.createNote("body".repeat(1000));
+  const exact = () => {
+    const actual = readCompactState(db, n.id)!;
+    expect(state(n.id)).toMatchObject({ versions: actual.versions, stored: actual.stored, live: actual.live });
+  };
+  for (let i=0;i<4;i++) { await store.updateNote(n.id, { append: String(i) }); exact(); }
+  const policy = resolveHistoryPolicy({ min_versions: 1, max_versions: 2, compact_min_versions: 2, compact_ratio: 1 });
+  db.transaction(() => pruneVersions(db, n.id, policy))(); exact();
+  const run = { run_id: "state-test", source_fingerprint: "source", tip: "tip", options_digest: "options" };
+  beginImportRun(db, run);
+  applyImportedNote(db, { run, noteId: n.id, targetDigest: importTargetDigest(db, n.id), policy: resolveHistoryPolicy({ enabled: false }), now: Date.now(), observations: [{ content: "import", path: null, metadata: {}, extension: "md", created_at: null, observed_at: new Date().toISOString(), commit: "commit", blob: "blob" }] });
+  exact(); expect(state(n.id)?.refused).toBe(0);
+  await store.deleteNote(n.id); exact();
+  expect(store.compactNote(n.id).blobs_deltified).toBeGreaterThan(0); exact();
+  const remaining = await store.listNoteVersions(n.id);
+  for (const v of remaining) expect((await store.getNoteVersion(n.id, v.version_ix))?.content).not.toBeNull();
+  expect(db.query("SELECT 1 FROM note_blobs b JOIN note_blobs base ON base.hash=b.delta_of WHERE base.encoding IS NOT NULL").all()).toEqual([]);
+  expect(db.query("PRAGMA foreign_key_check").all()).toEqual([]);
+  sweepDeletedHistory(db, resolveHistoryPolicy({ deleted_retention_days: 1 }), new Date(Date.now()+3*86400000));
+  expect(state(n.id)).toBeNull();
+});
+test("explicit-ID recreation refreshes live bytes and bounded remaining is a total", async () => {
+  for(let i=0;i<10;i++) {
+    const n = await store.createNote("abc", { id: `candidate-${i}` });
+    await store.updateNote(n.id, { content: "def" });
+    await store.updateNote(n.id, { content: "x" });
+  }
+  const first = store.compactHistory({ maxNotes: 1, budgetMs: null });
+  expect(first.remaining_candidates).toBe(9);
+  await store.deleteNote("candidate-0");
+  await store.createNoteRaw("", { id: "candidate-0" });
+  expect(state("candidate-0")?.live).toBe(0);
+});
+test("failed enclosing write rolls back history and scheduling state together", async () => {
+  const n = await store.createNote("before");
+  await store.updateNote(n.id, { content: "after" });
+  const before = state(n.id);
+  db.exec("CREATE TRIGGER reject_hint BEFORE UPDATE ON history_compact_state BEGIN SELECT RAISE(ABORT,'injected refresh failure'); END");
+  await expect(store.updateNote(n.id, { content: "must roll back" })).rejects.toThrow("injected refresh failure");
+  expect((await store.getNote(n.id))?.content).toBe("after");
+  expect(state(n.id)).toEqual(before);
+  expect(await store.countNoteVersions(n.id)).toBe(1);
+});
+test("empty live content still obeys the history byte ceiling", async () => {
+  store = new BunSqliteStore(db, { history: { min_versions: 1, max_bytes_per_note: 65536, compact_min_versions: 2 } });
+  const body = () => Buffer.from(crypto.getRandomValues(new Uint8Array(15000))).toString("hex");
+  const n = await store.createNote(body());
+  for(let i=0;i<5;i++) await store.updateNote(n.id, { content: body() });
+  await store.updateNote(n.id, { content: "" });
+  expect(state(n.id)?.stored).toBe(180000);
+  const pass = store.compactHistory({ budgetMs: null, maxNotes: null });
+  expect(pass.notes_scanned).toBe(1);
+  expect(pass.versions_dropped).toBe(4);
+  expect(state(n.id)).toMatchObject({ stored: 60000, live: 0, refused: 0 });
+  expect(store.compactHistory({ budgetMs: null, maxNotes: null }).notes_scanned).toBe(0);
+});

package/core/src/compact.test.ts

@@ -74,7 +74,7 @@ test("P6 triggers and off switch leave blobs unchanged; writes never compact", a
     const empty = await emptyStore.createNote("empty fixture".repeat(2000));
     await emptyStore.updateNote(empty.id, { append: "one" });
     await emptyStore.updateNote(empty.id, { content: "" });
-    expect(emptyStore.compactHistory({ budgetMs: null, maxNotes: null }).notes_compacted).toBe(1);
+    expect(emptyStore.compactHistory({ budgetMs: null, maxNotes: null }).notes_scanned).toBe(0);
   } finally { emptyDb.close(); }
 });
 test("P7 third encode failure rolls back all changes", async () => {
@@ -115,7 +115,7 @@ test("P8 bounded passes resume and converge; unbounded visits all", async () =>
   expect(all.stopped_by).toBe("complete");
   expect(all.remaining_candidates).toBe(0);
 });
-test("P16/P8 incompressible candidates are refused on every pass", async () => {
+test("P16/P8 explicit retries remain safe; automatic passes skip refused candidates", async () => {
   const bodies = Array.from({ length: 5 }, () => randomHex(20480));
   expect(codec).not.toBeNull();
   expect(codec!.encodeDelta(bodies[1]!, bodies[0]!).length).toBeGreaterThanOrEqual(20480 * .9);
@@ -129,7 +129,7 @@ test("P16/P8 incompressible candidates are refused on every pass", async () => {
     expect(result.blobs_deltified).toBe(0);
     expect(result.blobs_skipped_too_large).toBeGreaterThanOrEqual(1);
     expect(blobs()).toEqual(before);
-    expect(h.compactVault(db, p, { budgetMs: null, maxNotes: null })).toMatchObject({ notes_scanned: 1, stopped_by: "complete" });
+    expect(h.compactVault(db, p, { budgetMs: null, maxNotes: null })).toMatchObject({ notes_scanned: 0, stopped_by: "complete" });
   }
   const twin = await seed();
   expect(store.compactNote(twin.id)).toMatchObject({ blobs_skipped_too_large: 0 });

package/core/src/doctor.ts

@@ -48,11 +48,67 @@
  */
 
 import { historyTablesPresent, deletedHistoryStats, historyStorageStats, topNotesByHistoryBytes } from "./history.js";
+import { readCompactState, type CompactState } from "./history-compact-state.js";
 import { Database } from "bun:sqlite";
 import { loadTagHierarchy, findHierarchyCycles } from "./tag-hierarchy.js";
 import { listIndexedFields } from "./indexed-fields.js";
 import { pruneOrphanedIndexedFields } from "./indexed-fields.js";
 import { loadSchemaConfig } from "./schema-defaults.js";
+import { readBlobContent, hashContent, HistoryDeltaOrphanError } from "./history.js";
+
+function scanCompactStateDrift(db: Database): DoctorFinding[] {
+  if (!db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='history_compact_state'").get()) return [];
+  const sample = db.prepare("SELECT note_id,versions,stored,live FROM history_compact_state ORDER BY stored DESC LIMIT 200").all() as CompactState[];
+  const drift = sample.filter(row => {
+    const actual = readCompactState(db, row.note_id);
+    return !actual || actual.versions !== row.versions || actual.stored !== row.stored || actual.live !== row.live;
+  }).length;
+  return drift ? [{ type: "history_compact_state_drift", severity: "warning", subject: "history compaction scheduling hints",
+    detail: `${drift} of ${sample.length} sampled hint rows differ from history. Sample is bounded to the 200 largest hints; this is not a full audit.`,
+    remedy: "Investigate missed history-write refreshes. Self-hosted: history rebuild-state --vault <name>. Cloud: deploy a core-pin migration that rebuilds hints; no operator repair API. This scan does not repair them." }] : [];
+}
+
+export interface HistoryAuditPage {
+  checked: number;
+  corrupt: number;
+  examples: string[];
+  complete: boolean;
+  next_after: string | null;
+}
+
+/** Read-only keyset page. Budgets apply between blobs, not inside one decode.
+ * A sequence of pages is not a snapshot: use a consistent backup for a complete audit.
+ */
+export function auditHistoryBlobs(db: Database, after = "", maxBlobs = 100, budgetMs = 250): HistoryAuditPage {
+  if (after !== "" && !/^[a-f0-9]{64}$/.test(after)) throw new Error("history_after must be a SHA-256 hash");
+  if (!Number.isInteger(maxBlobs) || maxBlobs < 1 || maxBlobs > 500) throw new Error("history_max_blobs must be an integer from 1 to 500");
+  if (!Number.isInteger(budgetMs) || budgetMs < 1 || budgetMs > 1000) throw new Error("history_budget_ms must be an integer from 1 to 1000");
+  const page: HistoryAuditPage = { checked: 0, corrupt: 0, examples: [], complete: true, next_after: null };
+  if (!historyTablesPresent(db)) return page;
+  const start = performance.now();
+  const rows = db.prepare("SELECT hash FROM note_blobs WHERE hash > ? ORDER BY hash LIMIT ?").all(after, maxBlobs + 1) as { hash: string }[];
+  let cursor = after;
+  for (const row of rows) {
+    if (page.checked >= maxBlobs || (page.checked > 0 && performance.now() - start >= budgetMs)) {
+      page.complete = false;
+      page.next_after = cursor;
+      break;
+    }
+    let damaged = false;
+    try {
+      const body = readBlobContent(db, row.hash);
+      damaged = body === null || hashContent(body) !== row.hash;
+    } catch (error) {
+      // Operational database failures must abort, not masquerade as corruption.
+      if (!(error instanceof HistoryDeltaOrphanError)) throw error;
+      damaged = true;
+    }
+    page.checked++;
+    cursor = row.hash;
+    if (damaged) { page.corrupt++; if (page.examples.length < 5) page.examples.push(row.hash); }
+  }
+  return page;
+}
 
 export type DoctorFindingType =
   | "dangling_parent_name"
@@ -62,7 +118,9 @@ export type DoctorFindingType =
   | "dead_tag_metadata_reference"
   | "deleted_note_history"
   | "history_storage"
-  | "history_delta_orphan";
+  | "history_delta_orphan"
+  | "history_content_audit"
+  | "history_compact_state_drift";
 
 export type DoctorSeverity = "error" | "warning" | "info";
 
@@ -86,6 +144,7 @@ export interface DoctorReport {
   findings: DoctorFinding[];
   summary: string;
   scanned_at: string;
+  history_audit?: HistoryAuditPage;
 }
 
 export interface DoctorScanOpts {
@@ -95,6 +154,10 @@ export interface DoctorScanOpts {
    * each finding type is scoped.
    */
   allowedTags?: Set<string> | null;
+  deep?: boolean;
+  history_after?: string;
+  history_max_blobs?: number;
+  history_budget_ms?: number;
 }
 
 /** Cap on exemplar note IDs embedded in a finding's `detail` (vault#552 — keep report bodies bounded). */
@@ -124,6 +187,7 @@ function makeNoteInScope(db: Database, allowedTags: Set<string> | null): (id: st
 
 export function runDoctorScan(db: Database, opts?: DoctorScanOpts): DoctorReport {
   const allowedTags = opts?.allowedTags ?? null;
+  if (opts?.deep && allowedTags !== null) throw new Error("deep history audit requires an unrestricted session");
   const findings: DoctorFinding[] = [
     ...scanDanglingParentNames(db, allowedTags),
     ...scanParentNamesCycles(db, allowedTags),
@@ -133,8 +197,15 @@ export function runDoctorScan(db: Database, opts?: DoctorScanOpts): DoctorReport
     ...(allowedTags === null ? scanDeletedNoteHistory(db) : []),
     ...(allowedTags === null ? scanHistoryStorage(db) : []),
     ...(allowedTags === null ? scanDeltaOrphans(db) : []),
+    ...(allowedTags === null ? scanCompactStateDrift(db) : []),
   ];
 
+  const audit = opts?.deep ? auditHistoryBlobs(db, opts.history_after, opts.history_max_blobs, opts.history_budget_ms) : undefined;
+  if (audit) findings.push({ type: "history_content_audit", severity: audit.corrupt ? "error" : audit.complete ? "info" : "warning",
+    subject: "history content audit page",
+    detail: `Checked ${audit.checked} blob(s); ${audit.corrupt} corrupt. ${audit.complete ? "End of scan reached." : "Incomplete: continue with next_after."} Examples: ${audit.examples.join(", ") || "none"}.`,
+    remedy: "Continue incomplete scans with history_after=next_after. For snapshot-level assurance, audit a consistent backup. Preserve backups and investigate corruption; this audit never repairs or erases history." });
+
   const errors = findings.filter((f) => f.severity === "error").length;
   const warnings = findings.filter((f) => f.severity === "warning").length;
   const infos = findings.filter((f) => f.severity === "info").length;
@@ -143,7 +214,8 @@ export function runDoctorScan(db: Database, opts?: DoctorScanOpts): DoctorReport
       ? "clean — no integrity findings"
       : `${findings.length} finding(s): ${errors} error(s), ${warnings} warning(s), ${infos} info(s)`;
 
-  return { findings, summary, scanned_at: new Date().toISOString() };
+  return { findings, summary, scanned_at: new Date().toISOString(),
+    ...(audit ? { history_audit: audit } : {}) };
 }
 
 // ---------------------------------------------------------------------------

package/core/src/history-audit.test.ts

@@ -0,0 +1,51 @@
+import { test, expect } from "bun:test";
+import { Database } from "bun:sqlite";
+import { SqliteStore } from "./store.js";
+import { auditHistoryBlobs, runDoctorScan } from "./doctor.js";
+import { hashContent } from "./history.js";
+import { encodeDelta } from "./delta.js";
+
+test("deep audit pages whole/delta blobs, detects content damage without writes", () => {
+  const db = new Database(":memory:"); new SqliteStore(db);
+  try {
+    const insert = db.prepare("INSERT INTO note_blobs(hash,content,byte_size,encoding,delta_of) VALUES(?,?,?,?,?)");
+    const base = "base text ".repeat(100), changed = base + "new tail";
+    const a = hashContent(base), b = hashContent(changed), c = hashContent("original");
+    insert.run(a, base, base.length, null, null);
+    const delta = encodeDelta(base, changed);
+    insert.run(b, delta, delta.length, "fossil-delta", a);
+    insert.run(c, "tampered", 8, null, null);
+    const before = db.prepare("SELECT * FROM note_blobs ORDER BY hash").all();
+    let after = "", checked = 0, corrupt = 0;
+    do {
+      const p = auditHistoryBlobs(db, after, 1);
+      checked += p.checked; corrupt += p.corrupt;
+      if (p.complete) { expect(p.next_after).toBeNull(); break; }
+      expect(p.next_after! > after).toBe(true); after = p.next_after!;
+    } while (true);
+    expect(checked).toBe(3); expect(corrupt).toBe(1);
+    const report = runDoctorScan(db, { deep: true });
+    expect(report.history_audit?.examples).toEqual([c]);
+    expect(report.findings.find(f => f.type === "history_content_audit")?.severity).toBe("error");
+    expect(db.prepare("SELECT * FROM note_blobs ORDER BY hash").all()).toEqual(before);
+    db.prepare("UPDATE note_blobs SET content='invalid delta' WHERE hash=?").run(b);
+    expect(auditHistoryBlobs(db).corrupt).toBe(2);
+  } finally { db.close(); }
+});
+
+test("deep audit is explicit, bounded, scope-safe, and reports empty completion", () => {
+  const db = new Database(":memory:"); new SqliteStore(db);
+  try {
+    expect(runDoctorScan(db).history_audit).toBeUndefined();
+    expect(auditHistoryBlobs(db)).toEqual({ checked: 0, corrupt: 0, examples: [], complete: true, next_after: null });
+    expect(() => runDoctorScan(db, { deep: true, allowedTags: new Set() })).toThrow("unrestricted");
+    for (const n of [0, -1, 501, NaN, 1.5]) expect(() => auditHistoryBlobs(db, "", n)).toThrow();
+    expect(() => auditHistoryBlobs(db, "bad cursor")).toThrow();
+    expect(() => auditHistoryBlobs(db, "", 100, 1001)).toThrow();
+    for (let i=0;i<7;i++) db.prepare("INSERT INTO note_blobs(hash,content,byte_size) VALUES(?,?,?)").run(hashContent(String(i)), "broken", 6);
+    const p = auditHistoryBlobs(db, "", 2);
+    expect(p.checked).toBe(2); expect(p.complete).toBe(false); expect(p.next_after).not.toBeNull();
+    expect(auditHistoryBlobs(db).examples).toHaveLength(5);
+    expect(runDoctorScan(db, { deep: true, history_max_blobs: 2 }).summary).toContain("error");
+  } finally { db.close(); }
+});

package/core/src/history-capture.test.ts

@@ -86,9 +86,17 @@ it("P5 restore reads its source before a one-version prune", async () => {
   });
   const n = await store.createNote("one");
   await store.updateNote(n.id, { content: "two" });
-  expect((await store.restoreNoteVersion(n.id, 0, {})).content).toBe("one");
+  expect((await store.restoreNoteVersion(n.id, 0, { if_updated_at: (await store.getNote(n.id))!.updatedAt })).content).toBe("one");
   expect(await store.listNoteVersions(n.id)).toHaveLength(1);
 });
+it("live restore requires a precondition and leaves current note and history unchanged without one", async () => {
+  const n = await store.createNote("old");
+  await store.updateNote(n.id, { content: "new" });
+  const before = await store.getNote(n.id), versions = await store.listNoteVersions(n.id);
+  await expect(store.restoreNoteVersion(n.id, 0, {})).rejects.toMatchObject({ code: "PRECONDITION_REQUIRED" });
+  expect(await store.getNote(n.id)).toEqual(before);
+  expect(await store.listNoteVersions(n.id)).toEqual(versions);
+});
 it("P8a tag rename captures only rewritten notes", async () => {
   await store.upsertTagRecord("old", {});
   const a = await store.createNote("#old a"),

package/core/src/history-compact-state.ts

@@ -0,0 +1,52 @@
+import type { Database } from "bun:sqlite";
+import { transaction } from "./txn.js";
+
+/** Rebuild derived hints only, atomically; authoritative history is untouched. */
+export function rebuildCompactState(db: Database): number {
+  return transaction(db, () => {
+    if (db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='history_compact_state'").get()) {
+      db.exec("DROP TABLE history_compact_state");
+    }
+    db.exec(`CREATE TABLE history_compact_state (
+      note_id TEXT PRIMARY KEY, versions INTEGER NOT NULL, stored INTEGER NOT NULL,
+      live INTEGER NOT NULL, refused INTEGER NOT NULL DEFAULT 0, refreshed_at INTEGER NOT NULL
+    );
+    CREATE INDEX idx_history_compact_candidates ON history_compact_state(refused, stored DESC);
+    CREATE INDEX IF NOT EXISTS idx_note_versions_note_hash ON note_versions(note_id, content_hash);`);
+    db.prepare(`INSERT INTO history_compact_state(note_id,versions,stored,live,refused,refreshed_at)
+      SELECT note_id,versions,stored,live,0,? FROM (${COMPACT_STATE_AGGREGATE.replace("__FILTER__", "")})`).run(Date.now());
+    return (db.prepare("SELECT COUNT(*) AS n FROM history_compact_state").get() as { n: number }).n;
+  });
+}
+
+// Scheduling hints only. History remains authoritative, including for deleted notes.
+export const COMPACT_STATE_AGGREGATE = `SELECT v.note_id,
+  (SELECT COUNT(*) FROM note_versions n WHERE n.note_id=v.note_id AND n.content_hash IS NOT NULL) AS versions,
+  SUM(b.byte_size) AS stored,
+  COALESCE(LENGTH(CAST(live_note.content AS BLOB)),
+    (SELECT content_len FROM note_versions newest WHERE newest.note_id=v.note_id ORDER BY version_ix DESC LIMIT 1),0) AS live
+  FROM (SELECT DISTINCT note_id,content_hash FROM note_versions WHERE content_hash IS NOT NULL __FILTER__) v
+  JOIN note_blobs b ON b.hash=v.content_hash LEFT JOIN notes live_note ON live_note.id=v.note_id
+  GROUP BY v.note_id`;
+
+export interface CompactState { note_id: string; versions: number; stored: number; live: number }
+export function readCompactState(db: Database, noteId: string): CompactState | null {
+  return db.prepare(COMPACT_STATE_AGGREGATE.replace("__FILTER__", "AND note_id=?")).get(noteId) as CompactState | null;
+}
+
+/** Caller owns the enclosing write transaction; run after the live-row mutation. */
+export function refreshCompactState(db: Database, noteId: string, opts?: { refused?: boolean }): void {
+  // Keep the existing graceful behavior of writes before history tables exist.
+  const tables = db.prepare("SELECT COUNT(*) AS n FROM sqlite_master WHERE type='table' AND name IN ('note_versions','note_blobs','history_compact_state')").get() as { n: number };
+  if (tables.n !== 3) return;
+  const state = readCompactState(db, noteId);
+  if (!state) {
+    db.prepare("DELETE FROM history_compact_state WHERE note_id=?").run(noteId);
+    return;
+  }
+  db.prepare(`INSERT INTO history_compact_state(note_id,versions,stored,live,refused,refreshed_at)
+    VALUES(?,?,?,?,?,?) ON CONFLICT(note_id) DO UPDATE SET
+    versions=excluded.versions,stored=excluded.stored,live=excluded.live,
+    refused=excluded.refused,refreshed_at=excluded.refreshed_at`)
+    .run(noteId, state.versions, state.stored, state.live, opts?.refused ? 1 : 0, Date.now());
+}

package/core/src/history-import.ts

@@ -1,6 +1,7 @@
 /** Git-independent import primitives. Callers own source parsing and offline access. */
 import type { Database } from "bun:sqlite";
 import { transaction } from "./txn.js";
+import { refreshCompactState } from "./history-compact-state.js";
 import { HistoryUnrecoverableError, hashContent, byteLength, VERSION_MAX_BYTES, pruneVersions, compactNote, getVersion, type HistoryPolicy, type VersionRow } from "./history.js";
 
 export interface ImportedObservation {
@@ -112,7 +113,7 @@ export function applyImportedNote(db: Database, opts: {
         VALUES(?,?,?,?,?,?,?,NULL,'git-import','import',?,NULL,?)`).run(opts.noteId, storage, hash, row.path, canonicalJson(row.metadata), row.extension, row.observed_at, size, row.created_at);
       db.prepare("INSERT INTO history_import_refs VALUES(?,?,?,?)").run(opts.noteId, index, row.commit, row.blob);
     }
-    if (opts.policy.enabled) pruneVersions(db, opts.noteId, opts.policy, opts.now);
+    if (opts.policy.enabled) pruneVersions(db, opts.noteId, opts.policy, opts.now, false);
     compactNote(db, opts.noteId, opts.policy);
     const after = new Set((db.prepare("SELECT version_ix FROM note_versions WHERE note_id=?").all(opts.noteId) as { version_ix: number }[]).map(r => r.version_ix));
     for (let i = 0; i < opts.observations.length; i++) {
@@ -125,6 +126,7 @@ export function applyImportedNote(db: Database, opts: {
     receipt.pruned_imported = receipt.imported_count - receipt.retained_count;
     receipt.pruned_native = nativeDrops.length;
     db.prepare("UPDATE history_import_receipts SET retained_count=?,pruned_imported=?,pruned_native=? WHERE note_id=?").run(receipt.retained_count, receipt.pruned_imported, receipt.pruned_native, opts.noteId);
+    refreshCompactState(db, opts.noteId);
     return { receipt, nativeDrops, skipped: false };
   });
 }

package/core/src/history-visibility.test.ts

@@ -0,0 +1,11 @@
+import { test, expect } from "bun:test";
+import { projectHistoryProvenance } from "./history-visibility.ts";
+
+test("history redaction removes only transport provenance without mutating stored data", () => {
+  const row = Object.freeze({ actor: "editor", via: "api", content: "editor mentioned in text",
+    metadata: { actor: "user-authored value" }, origin: "git-import", import_ix: 0 });
+  expect(projectHistoryProvenance(row, false)).toBe(row);
+  expect(projectHistoryProvenance(row, true)).toEqual({ content: row.content, metadata: row.metadata,
+    origin: "git-import", import_ix: 0 });
+  expect(row.actor).toBe("editor");
+});

package/core/src/history-visibility.ts

@@ -0,0 +1,9 @@
+/** Response-only redaction; never remove stored provenance or rewrite note content.
+ * Tag-restricted sessions do not receive historical editor/interface identities.
+ * The transport must establish note visibility before applying this projection.
+ */
+export function projectHistoryProvenance<T extends object>(row: T, restricted: boolean): T | Omit<T, "actor" | "via"> {
+  if (!restricted) return row;
+  const { actor: _actor, via: _via, ...visible } = row as T & { actor?: unknown; via?: unknown };
+  return visible;
+}