Address Gadfly review on revision history

Six real bugs, three of which would have broken the feature's central promise.

The worst was that a failed operation threw away the history for changes that
had already committed. WithChangeSet buffers HISTORY, not data — the store
writes inside fn commit as they go — so discarding the buffer on error left real
mutations with no change set and no way to undo them. That is exactly the
situation undo exists for: an agent turn that did half a thing and then failed.
Now the buffer is written, the summary says the operation failed partway, and
the error is still returned. RevertChangeSet does the same for a revert that
fails mid-loop. The partial state is still partial, but it is visible and
undoable instead of orphaned.

versionGuard falsely conflicted whenever one change set held more than one
revision for the same entity — an agent turn that moves a bed and then renames
it. Each inverse bumps the row's version, so from the second one on the
snapshot's version no longer matched the live row and the revert flagged its own
work as somebody else's edit. RevertChangeSet now tracks what it has written and
the guard compares against that.

ListChangeSets found "was this reverted?" with a LEFT JOIN, which emits one
duplicate row per revert once a change set has been reverted more than once
(undo, redo, undo again). Now a scalar subquery.

Reverting an object creation cascade-deleted anything planted in that bed since,
quietly. The plops were snapshotted so it was recoverable, but deleting
someone's plants as a side effect of an unrelated undo should be reported. It
now conflicts and leaves the bed alone.

ClearObject cleared by predicate and snapshotted by a separate read, so a plop
created between the two was removed with no revision to undo it by. It now
clears exactly the ids it read. It also returned an error when only the
post-clear re-read failed, which told the caller a clear had failed after it had
already applied — inviting a retry of an applied operation. That path now logs
the history gap and reports success, matching how record() treats its own write
failures.

RestoreObject/RestorePlanting could lose the race between the existence check
and the insert and surface a raw constraint error. The revert now re-checks and
reports ConflictExists, which is what that condition means.

RevertChangeSet takes a source, so an agent undoing its own work is
distinguishable from a person clicking undo — the whole point of the badge.

Refactoring: the three revert bodies repeated a load/guard/unsnapshot/update
skeleton (flagged by 3 of 5 models). They are now one generic revertEntity over
a small per-type op table, so the ordering, guards and conflict reporting cannot
drift apart. The API's view structs duplicated domain types that already carried
every field, against the package's direct-JSON convention — dropped. intQuery
moved next to the other request helpers. planRevert's comment said three passes
where the code runs five. A revert where every revision is already a no-op now
answers 200 rather than 201 with a null change set.

Six new tests, one per bug.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01H3zbym8Doka2d7D48maSgZ

internal/api/errors.go

@@ -69,6 +69,20 @@ func writeVersionConflict(c *gin.Context, current any) {
 	})
 }
 
+// intQuery reads a non-negative integer query parameter, falling back to def on
+// an absent or malformed value.
+func intQuery(c *gin.Context, name string, def int) int {
+	raw := c.Query(name)
+	if raw == "" {
+		return def
+	}
+	v, err := strconv.Atoi(raw)
+	if err != nil || v < 0 {
+		return def
+	}
+	return v
+}
+
 // parseIDParam reads a positive int64 path parameter, writing a 400 and
 // returning ok=false on a malformed value.
 func parseIDParam(c *gin.Context, name string) (int64, bool) {

internal/api/history.go

@@ -2,7 +2,6 @@ package api
 
 import (
 	"net/http"
-	"strconv"
 
 	"github.com/gin-gonic/gin"
 
@@ -10,54 +9,26 @@ import (
 )
 
 // Change history and undo (#48). Two endpoints: read a garden's change sets, and
-// revert one.
+// revert one. Both encode domain types directly, like the rest of the package —
+// domain.ChangeSet already carries the actor name, revert linkage and per-op
+// counts the history list renders, and its Revisions field is omitempty so the
+// JSON snapshots never ride along on a list response.
 
 // historyResponse is the body of GET /gardens/:id/history. hasMore lets the
-// client page without a separate count query — it asks for one row more than it
-// shows and reports whether that row existed.
+// client page without a separate count query over a table that only grows.
 type historyResponse struct {
-	ChangeSets []changeSetView `json:"changeSets"`
-	HasMore    bool            `json:"hasMore"`
+	ChangeSets []domain.ChangeSet `json:"changeSets"`
+	HasMore    bool               `json:"hasMore"`
 }
 
-// changeSetView is one history entry. It deliberately omits the revisions
-// themselves: the list renders counts, and nothing in the UI needs the JSON
-// snapshots.
-type changeSetView struct {
-	ID           int64       `json:"id"`
-	GardenID     int64       `json:"gardenId"`
-	ActorID      int64       `json:"actorId"`
-	ActorName    string      `json:"actorName"`
-	Source       string      `json:"source"`
-	Summary      string      `json:"summary"`
-	AgentRunID   *string     `json:"agentRunId,omitempty"`
-	RevertsID    *int64      `json:"revertsId,omitempty"`
-	RevertedByID *int64      `json:"revertedById,omitempty"`
-	Counts       []countView `json:"counts"`
-	CreatedAt    string      `json:"createdAt"`
-}
-
-type countView struct {
-	EntityType string `json:"entityType"`
-	Op         string `json:"op"`
-	N          int    `json:"n"`
-}
-
-// revertResponse is the body of POST /change-sets/:id/revert, on both the clean
-// (201) and partial (409) paths. Carrying both fields either way is what lets the
-// UI say "2 of 3 changes undone; the north bed was edited since and was left
-// alone" instead of a generic failure — a partial revert really did change
-// things, and pretending otherwise would be a lie.
+// revertResponse is the body of POST /change-sets/:id/revert on every path.
+// Carrying both fields regardless is what lets the UI say "2 of 3 changes undone;
+// the north bed was edited since and was left alone" instead of a generic
+// failure — a partial revert really did change things, and pretending otherwise
+// would be a lie. ChangeSet is null when nothing needed reverting.
 type revertResponse struct {
-	ChangeSet *changeSetView `json:"changeSet"`
-	Conflicts []conflictView `json:"conflicts"`
-}
-
-type conflictView struct {
-	EntityType string `json:"entityType"`
-	EntityID   int64  `json:"entityId"`
-	Reason     string `json:"reason"`
-	Name       string `json:"name,omitempty"`
+	ChangeSet *domain.ChangeSet       `json:"changeSet"`
+	Conflicts []domain.RevertConflict `json:"conflicts"`
 }
 
 func (h *handlers) getGardenHistory(c *gin.Context) {
@@ -74,11 +45,7 @@ func (h *handlers) getGardenHistory(c *gin.Context) {
 		writeServiceError(c, err)
 		return
 	}
-	views := make([]changeSetView, 0, len(sets))
-	for i := range sets {
-		views = append(views, *toChangeSetView(&sets[i]))
-	}
-	c.JSON(http.StatusOK, historyResponse{ChangeSets: views, HasMore: hasMore})
+	c.JSON(http.StatusOK, historyResponse{ChangeSets: sets, HasMore: hasMore})
 }
 
 func (h *handlers) revertChangeSet(c *gin.Context) {
@@ -86,55 +53,28 @@ func (h *handlers) revertChangeSet(c *gin.Context) {
 	if !ok {
 		return
 	}
-	cs, conflicts, err := h.svc.RevertChangeSet(c.Request.Context(), mustActor(c).ID, id)
+	// A revert through the REST API is a person clicking undo. The agent reverts
+	// its own work through the service directly and stamps SourceAgent, so the
+	// history badge can tell the two apart.
+	cs, conflicts, err := h.svc.RevertChangeSet(c.Request.Context(), mustActor(c).ID, id, domain.SourceUI)
 	if err != nil {
 		writeServiceError(c, err)
 		return
 	}
-	body := revertResponse{ChangeSet: toChangeSetView(cs), Conflicts: toConflictViews(conflicts)}
-	if len(conflicts) > 0 {
+	if conflicts == nil {
+		conflicts = []domain.RevertConflict{}
+	}
+	body := revertResponse{ChangeSet: cs, Conflicts: conflicts}
+	switch {
+	case len(conflicts) > 0:
 		// 409 even when part of the revert applied: something the caller asked for
 		// did not happen, and the body says exactly what.
 		c.JSON(http.StatusConflict, body)
-		return
-	}
-	c.JSON(http.StatusCreated, body)
-}
-
-func toChangeSetView(cs *domain.ChangeSet) *changeSetView {
-	if cs == nil {
-		return nil
-	}
-	counts := make([]countView, 0, len(cs.Counts))
-	for _, c := range cs.Counts {
-		counts = append(counts, countView{EntityType: c.EntityType, Op: c.Op, N: c.N})
-	}
-	return &changeSetView{
-		ID: cs.ID, GardenID: cs.GardenID, ActorID: cs.ActorID, ActorName: cs.ActorName,
-		Source: cs.Source, Summary: cs.Summary, AgentRunID: cs.AgentRunID,
-		RevertsID: cs.RevertsID, RevertedByID: cs.RevertedByID,
-		Counts: counts, CreatedAt: cs.CreatedAt,
+	case cs == nil:
+		// Every revision resolved to a no-op (already undone by hand, say). Nothing
+		// was created, so 200 rather than a 201 pointing at nothing.
+		c.JSON(http.StatusOK, body)
+	default:
+		c.JSON(http.StatusCreated, body)
 	}
 }
-
-func toConflictViews(cs []domain.RevertConflict) []conflictView {
-	views := make([]conflictView, 0, len(cs))
-	for _, c := range cs {
-		views = append(views, conflictView{EntityType: c.EntityType, EntityID: c.EntityID, Reason: c.Reason, Name: c.Name})
-	}
-	return views
-}
-
-// intQuery reads a non-negative integer query parameter, falling back to def on
-// an absent or malformed value.
-func intQuery(c *gin.Context, name string, def int) int {
-	raw := c.Query(name)
-	if raw == "" {
-		return def
-	}
-	v, err := strconv.Atoi(raw)
-	if err != nil || v < 0 {
-		return def
-	}
-	return v
-}

internal/api/history_test.go

@@ -28,8 +28,6 @@ func TestHistoryAndRevertAPI(t *testing.T) {
 	if w.Code != http.StatusCreated {
 		t.Fatalf("create object: status %d, body %s", w.Code, w.Body.String())
 	}
-	objectID := int64(decodeMap(t, w.Body.Bytes())["id"].(float64))
-
 	// The create landed in history with no explicit change set anywhere.
 	w = doJSON(t, r, http.MethodGet, historyPath(gid), nil, cookie)
 	if w.Code != http.StatusOK {
@@ -76,7 +74,6 @@ func TestHistoryAndRevertAPI(t *testing.T) {
 	if objects, _ := full["objects"].([]any); len(objects) != 0 {
 		t.Errorf("%d objects survived the revert", len(objects))
 	}
-	_ = objectID
 }
 
 // TestRevertConflictAPI: a partial revert answers 409 and names what it skipped,

internal/service/ops.go

@@ -3,6 +3,7 @@ package service
 import (
 	"context"
 	"fmt"
+	"log/slog"
 	"math"
 	"strings"
 
@@ -233,20 +234,32 @@ func (s *Service) ClearObject(ctx context.Context, actorID, objectID int64) (int
 		return 0, err
 	}
 	// Snapshot the rows the bulk UPDATE is about to touch, since it reports only a
-	// count. Re-read afterwards for the after-images rather than synthesizing them,
-	// so the snapshot is what the database actually holds (version included).
+	// count — then clear exactly those ids. Clearing "every active plop" instead
+	// would let a plop created between this read and the UPDATE be removed with no
+	// revision recorded: cleared, with no way to undo it.
 	before, err := s.store.ListActivePlantingsForObject(ctx, objectID)
 	if err != nil {
 		return 0, err
 	}
+	ids := make([]int64, 0, len(before))
+	for i := range before {
+		ids = append(ids, before[i].ID)
+	}
 	today := s.now().UTC().Format(dateLayout)
-	n, err := s.store.ClearObjectPlantings(ctx, objectID, today)
+	n, err := s.store.ClearObjectPlantings(ctx, objectID, today, ids)
 	if err != nil || n == 0 {
 		return n, err
 	}
+
+	// From here the clear HAS happened. A failure to build the history entry must
+	// not be reported as a failed clear — the caller would retry an operation that
+	// already applied. Log the gap and report success, matching how record()
+	// treats its own write failures.
 	after, err := s.store.ListPlantingsForObject(ctx, objectID)
 	if err != nil {
-		return n, err
+		slog.Error("service: clear succeeded but history could not be recorded",
+			"error", err, "object", objectID, "cleared", n)
+		return n, nil
 	}
 	afterByID := make(map[int64]*domain.Planting, len(after))
 	for i := range after {
@@ -257,7 +270,7 @@ func (s *Service) ClearObject(ctx context.Context, actorID, objectID int64) (int
 		b := before[i]
 		a, ok := afterByID[b.ID]
 		if !ok {
-			continue // vanished between the two reads; nothing coherent to record
+			continue // deleted outright between the two reads; nothing coherent to record
 		}
 		changes = append(changes, changeUpdate(domain.EntityPlanting, b.ID, &b, a))
 	}

internal/service/revisions.go

@@ -122,11 +122,29 @@ func (s *Service) WithChangeSet(ctx context.Context, actorID, gardenID int64, op
 		source: opts.Source, summary: opts.Summary, agentRunID: opts.AgentRunID,
 	}
 	if err := fn(context.WithValue(ctx, changeSetKey{}, sc)); err != nil {
+		// fn failed, but the mutations it completed before failing are already
+		// committed — this scope buffers history, not data. Dropping the buffer
+		// would leave those changes with no history and no way to undo them,
+		// which is exactly the situation undo exists for. Record what happened,
+		// mark the summary, and still report the failure.
+		sc.summary = partialSummary(sc.summary)
+		if _, cerr := s.commitScope(ctx, sc, nil); cerr != nil {
+			slog.Error("service: partial turn could not be recorded", "error", cerr, "garden", gardenID)
+		}
 		return nil, err
 	}
 	return s.commitScope(ctx, sc, nil)
 }
 
+// partialSummary marks a change set whose operation failed partway, so the
+// history list can say so rather than presenting it as a completed action.
+func partialSummary(summary string) string {
+	if summary == "" {
+		return "Partly applied (the operation failed partway)"
+	}
+	return summary + " (failed partway)"
+}
+
 // commitScope writes a scope's buffered revisions as one change set. revertsID is
 // set only by RevertChangeSet. A scope with no revisions writes nothing — an
 // operation that changed nothing doesn't belong in history.
@@ -247,12 +265,20 @@ func (s *Service) GardenHistory(ctx context.Context, actorID, gardenID int64, li
 
 // RevertChangeSet undoes a change set by applying the inverse of each of its
 // revisions, inside one NEW change set that points back at the target — so the
-// undo is itself undoable. Requires editor role on the garden.
+// undo is itself undoable. Requires editor role on the garden. source says who
+// asked (the agent can undo its own work, and the history badge should show that).
 //
 // Entities that changed after the target change set are reported as conflicts and
 // left untouched; everything else still reverts. Returns the new change set (nil
-// when nothing could be reverted) alongside those conflicts.
-func (s *Service) RevertChangeSet(ctx context.Context, actorID, changeSetID int64) (*domain.ChangeSet, []domain.RevertConflict, error) {
+// when nothing needed reverting) alongside those conflicts.
+//
+// The inverses are applied one row at a time rather than in a single
+// transaction, because the store's version-guarded update path is per-row. That
+// means a failure partway leaves the garden partly reverted — so whatever DID
+// apply is recorded before the error is returned, and the partial revert is
+// itself a change set you can undo. Losing the history for changes that really
+// happened would be strictly worse than the partial state.
+func (s *Service) RevertChangeSet(ctx context.Context, actorID, changeSetID int64, source string) (*domain.ChangeSet, []domain.RevertConflict, error) {
 	target, err := s.store.GetChangeSet(ctx, changeSetID)
 	if err != nil {
 		return nil, nil, err
@@ -260,15 +286,30 @@ func (s *Service) RevertChangeSet(ctx context.Context, actorID, changeSetID int6
 	if _, err := s.requireGardenRole(ctx, actorID, target.GardenID, roleEditor); err != nil {
 		return nil, nil, err
 	}
+	if !validChangeSource(source) {
+		return nil, nil, domain.ErrInvalidInput
+	}
 
 	conflicts := []domain.RevertConflict{}
 	sc := &changeScope{
-		gardenID: target.GardenID, actorID: actorID, source: domain.SourceUI,
+		gardenID: target.GardenID, actorID: actorID, source: source,
 		summary: revertSummary(target),
 	}
+	// A change set may hold several revisions for the SAME entity (an agent turn
+	// that moves a bed and then renames it). Each inverse bumps that row's
+	// version, so from the second one on, the version in the snapshot no longer
+	// matches the live row — and a naive guard would call our own work a conflict.
+	// This tracks what we just wrote so the guard compares against reality.
+	applied := map[entityKey]int64{}
+
 	for _, r := range planRevert(target.Revisions) {
-		changes, conflict, err := s.applyInverse(ctx, r)
+		changes, conflict, err := s.applyInverse(ctx, r, applied)
 		if err != nil {
+			// Record what actually landed before surfacing the failure, so the
+			// partial revert is visible and undoable rather than orphaned.
+			if _, cerr := s.commitScope(ctx, sc, &target.ID); cerr != nil {
+				slog.Error("service: partial revert could not be recorded", "error", cerr, "changeSet", changeSetID)
+			}
 			return nil, nil, err
 		}
 		if conflict != nil {
@@ -289,15 +330,27 @@ func (s *Service) RevertChangeSet(ctx context.Context, actorID, changeSetID int6
 	return cs, conflicts, nil
 }
 
-// planRevert orders a change set's revisions for inverse application. Three
-// passes, because the inverses carry foreign-key dependencies the original
-// operations did not:
+// entityKey identifies a row across the entity types a revision can name.
+type entityKey struct {
+	entityType string
+	id         int64
+}
+
+func keyOf(r domain.Revision) entityKey {
+	return entityKey{entityType: r.EntityType, id: r.EntityID}
+}
+
+// planRevert orders a change set's revisions for inverse application, because the
+// inverses carry foreign-key dependencies the original operations did not. Five
+// passes, in this order:
 //
-//  1. restore deleted rows — parents (objects) BEFORE children (plantings), or a
-//     restored plop has no object to hang off and its FK rejects it;
+//  0. restore deleted OBJECTS — parents first, or a restored plop has no object
+//     to hang off and its FK rejects it;
+//  1. restore everything else deleted;
 //  2. undo updates;
-//  3. delete created rows — children before parents, so a delete never leans on
-//     the cascade to clean up rows this revert is responsible for.
+//  3. delete created non-objects (plantings) — children before parents;
+//  4. delete created OBJECTS last, so a delete never leans on the cascade to
+//     clean up rows this revert is itself responsible for.
 //
 // Reverse seq order within each pass: the last change made is the first undone.
 // The passes are explicit rather than relying on reverse seq happening to order
@@ -332,172 +385,192 @@ func planRevert(revs []domain.Revision) []domain.Revision {
 // in the revert's own change set), or a conflict describing why it declined. A
 // returned error is an infrastructure failure and aborts the revert; a conflict
 // is a normal outcome that skips just this entity.
-func (s *Service) applyInverse(ctx context.Context, r domain.Revision) ([]change, *domain.RevertConflict, error) {
+//
+// applied carries the versions this revert has already written, so a change set
+// holding several revisions for one entity doesn't mistake its own earlier work
+// for someone else's edit.
+func (s *Service) applyInverse(ctx context.Context, r domain.Revision, applied map[entityKey]int64) ([]change, *domain.RevertConflict, error) {
 	switch r.EntityType {
 	case domain.EntityObject:
-		return s.revertObject(ctx, r)
+		return revertEntity(ctx, s, r, applied, objectRevertOps(s))
 	case domain.EntityPlanting:
-		return s.revertPlanting(ctx, r)
+		return revertEntity(ctx, s, r, applied, plantingRevertOps(s))
 	case domain.EntityGarden:
-		return s.revertGarden(ctx, r)
+		return revertEntity(ctx, s, r, applied, gardenRevertOps(s))
 	default:
 		return nil, conflict(r, domain.ConflictUnsupported, ""), nil
 	}
 }
 
-func (s *Service) revertObject(ctx context.Context, r domain.Revision) ([]change, *domain.RevertConflict, error) {
-	switch r.Op {
-	case domain.OpCreate:
-		// Inverse of a create is a delete.
-		cur, err := s.store.GetObject(ctx, r.EntityID)
-		if errors.Is(err, domain.ErrNotFound) {
+// revertOps is everything reverting one entity type needs. The three
+// implementations differ only in which store methods they call and how a row
+// names itself; the ordering, guards and conflict reporting are shared below so
+// they cannot drift apart.
+type revertOps[T any] struct {
+	entityType string
+	get        func(ctx context.Context, id int64) (*T, error)
+	update     func(ctx context.Context, row *T) (*T, error)
+	// restore re-inserts a deleted row under its original id. nil means this
+	// entity type is never deleted (gardens), and a delete revision for it is
+	// reported as unsupported rather than silently skipped.
+	restore func(ctx context.Context, row *T) (*T, error)
+	// remove undoes a creation. It returns the changes it made, because deleting
+	// an object also deletes the plantings hanging off it.
+	remove func(ctx context.Context, row *T) ([]change, error)
+	// blockRemoval optionally refuses a removal, e.g. an object that has gained
+	// plantings since. Returns a conflict reason, or "" to allow it.
+	blockRemoval func(ctx context.Context, row *T) (string, error)
+	version      func(row *T) int64
+	setVersion   func(row *T, v int64)
+	label        func(row *T) string
+}
+
+// revertEntity applies the inverse of one revision for one entity type.
+func revertEntity[T any](
+	ctx context.Context, s *Service, r domain.Revision, applied map[entityKey]int64, ops revertOps[T],
+) ([]change, *domain.RevertConflict, error) {
+	key := keyOf(r)
+
+	// Inverse of a delete is a restore, under the original id.
+	if r.Op == domain.OpDelete {
+		if ops.restore == nil {
+			return nil, conflict(r, domain.ConflictUnsupported, ""), nil
+		}
+		if existing, err := ops.get(ctx, r.EntityID); err == nil {
+			return nil, conflict(r, domain.ConflictExists, ops.label(existing)), nil
+		} else if !errors.Is(err, domain.ErrNotFound) {
+			return nil, nil, err
+		}
+		var target T
+		if err := unsnapshot(r.Before, &target); err != nil {
+			return nil, nil, err
+		}
+		restored, err := ops.restore(ctx, &target)
+		if err != nil {
+			// The id may have been taken between the check above and this insert.
+			// Re-check rather than surfacing a driver-specific constraint error:
+			// "someone else has that id now" is a conflict, not a failure.
+			if existing, gerr := ops.get(ctx, r.EntityID); gerr == nil {
+				return nil, conflict(r, domain.ConflictExists, ops.label(existing)), nil
+			}
+			return nil, nil, err
+		}
+		applied[key] = ops.version(restored)
+		return []change{changeCreate(ops.entityType, r.EntityID, restored)}, nil, nil
+	}
+
+	cur, err := ops.get(ctx, r.EntityID)
+	if errors.Is(err, domain.ErrNotFound) {
+		if r.Op == domain.OpCreate {
 			return nil, nil, nil // already gone: the inverse is a no-op, not a conflict
 		}
-		if err != nil {
-			return nil, nil, err
-		}
-		if c := versionGuard(r, cur.Version, cur.Name); c != nil {
-			return nil, c, nil
-		}
-		changes, err := s.deleteObjectRecording(ctx, cur)
-		return changes, nil, err
-
-	case domain.OpUpdate:
-		cur, err := s.store.GetObject(ctx, r.EntityID)
-		if errors.Is(err, domain.ErrNotFound) {
-			return nil, conflict(r, domain.ConflictMissing, ""), nil
-		}
-		if err != nil {
-			return nil, nil, err
-		}
-		if c := versionGuard(r, cur.Version, cur.Name); c != nil {
-			return nil, c, nil
-		}
-		var target domain.GardenObject
-		if err := unsnapshot(r.Before, &target); err != nil {
-			return nil, nil, err
-		}
-		target.Version = cur.Version
-		updated, err := s.store.UpdateObject(ctx, &target)
-		if errors.Is(err, domain.ErrVersionConflict) {
-			return nil, conflict(r, domain.ConflictChanged, cur.Name), nil
-		}
-		if err != nil {
-			return nil, nil, err
-		}
-		return []change{changeUpdate(domain.EntityObject, updated.ID, cur, updated)}, nil, nil
-
-	case domain.OpDelete:
-		// Inverse of a delete is a restore, under the original id.
-		if existing, err := s.store.GetObject(ctx, r.EntityID); err == nil {
-			return nil, conflict(r, domain.ConflictExists, existing.Name), nil
-		} else if !errors.Is(err, domain.ErrNotFound) {
-			return nil, nil, err
-		}
-		var target domain.GardenObject
-		if err := unsnapshot(r.Before, &target); err != nil {
-			return nil, nil, err
-		}
-		restored, err := s.store.RestoreObject(ctx, &target)
-		if err != nil {
-			return nil, nil, err
-		}
-		return []change{changeCreate(domain.EntityObject, restored.ID, restored)}, nil, nil
-	}
-	return nil, conflict(r, domain.ConflictUnsupported, ""), nil
-}
-
-func (s *Service) revertPlanting(ctx context.Context, r domain.Revision) ([]change, *domain.RevertConflict, error) {
-	switch r.Op {
-	case domain.OpCreate:
-		cur, err := s.store.GetPlanting(ctx, r.EntityID)
-		if errors.Is(err, domain.ErrNotFound) {
-			return nil, nil, nil // already gone
-		}
-		if err != nil {
-			return nil, nil, err
-		}
-		if c := versionGuard(r, cur.Version, ""); c != nil {
-			return nil, c, nil
-		}
-		if err := s.store.DeletePlanting(ctx, cur.ID); err != nil {
-			return nil, nil, err
-		}
-		return []change{changeDelete(domain.EntityPlanting, cur.ID, cur)}, nil, nil
-
-	case domain.OpUpdate:
-		cur, err := s.store.GetPlanting(ctx, r.EntityID)
-		if errors.Is(err, domain.ErrNotFound) {
-			return nil, conflict(r, domain.ConflictMissing, ""), nil
-		}
-		if err != nil {
-			return nil, nil, err
-		}
-		if c := versionGuard(r, cur.Version, ""); c != nil {
-			return nil, c, nil
-		}
-		var target domain.Planting
-		if err := unsnapshot(r.Before, &target); err != nil {
-			return nil, nil, err
-		}
-		target.Version = cur.Version
-		updated, err := s.store.UpdatePlanting(ctx, &target)
-		if errors.Is(err, domain.ErrVersionConflict) {
-			return nil, conflict(r, domain.ConflictChanged, ""), nil
-		}
-		if err != nil {
-			return nil, nil, err
-		}
-		return []change{changeUpdate(domain.EntityPlanting, updated.ID, cur, updated)}, nil, nil
-
-	case domain.OpDelete:
-		if _, err := s.store.GetPlanting(ctx, r.EntityID); err == nil {
-			return nil, conflict(r, domain.ConflictExists, ""), nil
-		} else if !errors.Is(err, domain.ErrNotFound) {
-			return nil, nil, err
-		}
-		var target domain.Planting
-		if err := unsnapshot(r.Before, &target); err != nil {
-			return nil, nil, err
-		}
-		restored, err := s.store.RestorePlanting(ctx, &target)
-		if err != nil {
-			return nil, nil, err
-		}
-		return []change{changeCreate(domain.EntityPlanting, restored.ID, restored)}, nil, nil
-	}
-	return nil, conflict(r, domain.ConflictUnsupported, ""), nil
-}
-
-// revertGarden undoes a garden metadata edit. Garden creation and deletion are
-// never recorded (see the migration), so update is the only op reachable here.
-func (s *Service) revertGarden(ctx context.Context, r domain.Revision) ([]change, *domain.RevertConflict, error) {
-	if r.Op != domain.OpUpdate {
-		return nil, conflict(r, domain.ConflictUnsupported, ""), nil
-	}
-	cur, err := s.store.GetGarden(ctx, r.EntityID)
-	if errors.Is(err, domain.ErrNotFound) {
 		return nil, conflict(r, domain.ConflictMissing, ""), nil
 	}
 	if err != nil {
 		return nil, nil, err
 	}
-	if c := versionGuard(r, cur.Version, cur.Name); c != nil {
+	if c := versionGuard(r, ops.version(cur), ops.label(cur), applied[key]); c != nil {
 		return nil, c, nil
 	}
-	var target domain.Garden
+
+	// Inverse of a create is a removal.
+	if r.Op == domain.OpCreate {
+		if ops.remove == nil {
+			return nil, conflict(r, domain.ConflictUnsupported, ""), nil
+		}
+		if ops.blockRemoval != nil {
+			reason, err := ops.blockRemoval(ctx, cur)
+			if err != nil {
+				return nil, nil, err
+			}
+			if reason != "" {
+				return nil, conflict(r, reason, ops.label(cur)), nil
+			}
+		}
+		changes, err := ops.remove(ctx, cur)
+		if err != nil {
+			return nil, nil, err
+		}
+		delete(applied, key)
+		return changes, nil, nil
+	}
+
+	if r.Op != domain.OpUpdate {
+		return nil, conflict(r, domain.ConflictUnsupported, ""), nil
+	}
+	var target T
 	if err := unsnapshot(r.Before, &target); err != nil {
 		return nil, nil, err
 	}
-	target.Version = cur.Version
-	updated, err := s.store.UpdateGarden(ctx, &target)
+	ops.setVersion(&target, ops.version(cur))
+	updated, err := ops.update(ctx, &target)
 	if errors.Is(err, domain.ErrVersionConflict) {
-		return nil, conflict(r, domain.ConflictChanged, cur.Name), nil
+		return nil, conflict(r, domain.ConflictChanged, ops.label(cur)), nil
 	}
 	if err != nil {
 		return nil, nil, err
 	}
-	return []change{changeUpdate(domain.EntityGarden, updated.ID, cur, updated)}, nil, nil
+	applied[key] = ops.version(updated)
+	return []change{changeUpdate(ops.entityType, r.EntityID, cur, updated)}, nil, nil
+}
+
+func objectRevertOps(s *Service) revertOps[domain.GardenObject] {
+	return revertOps[domain.GardenObject]{
+		entityType: domain.EntityObject,
+		get:        s.store.GetObject,
+		update:     s.store.UpdateObject,
+		restore:    s.store.RestoreObject,
+		remove:     s.deleteObjectRecording,
+		// Undoing "added a bed" would cascade away anything planted in it since.
+		// Those plops are snapshotted, so it would be recoverable — but deleting
+		// someone's plants as a side effect of an unrelated undo should be
+		// reported, not performed quietly.
+		blockRemoval: func(ctx context.Context, o *domain.GardenObject) (string, error) {
+			plops, err := s.store.ListPlantingsForObject(ctx, o.ID)
+			if err != nil {
+				return "", err
+			}
+			if len(plops) > 0 {
+				return domain.ConflictChanged, nil
+			}
+			return "", nil
+		},
+		version:    func(o *domain.GardenObject) int64 { return o.Version },
+		setVersion: func(o *domain.GardenObject, v int64) { o.Version = v },
+		label:      func(o *domain.GardenObject) string { return o.Name },
+	}
+}
+
+func plantingRevertOps(s *Service) revertOps[domain.Planting] {
+	return revertOps[domain.Planting]{
+		entityType: domain.EntityPlanting,
+		get:        s.store.GetPlanting,
+		update:     s.store.UpdatePlanting,
+		restore:    s.store.RestorePlanting,
+		remove: func(ctx context.Context, p *domain.Planting) ([]change, error) {
+			if err := s.store.DeletePlanting(ctx, p.ID); err != nil {
+				return nil, err
+			}
+			return []change{changeDelete(domain.EntityPlanting, p.ID, p)}, nil
+		},
+		version:    func(p *domain.Planting) int64 { return p.Version },
+		setVersion: func(p *domain.Planting, v int64) { p.Version = v },
+		label:      func(p *domain.Planting) string { return "" },
+	}
+}
+
+// gardenRevertOps has no restore or remove: garden creation and deletion are
+// never recorded (see the migration), so metadata updates are all that can reach
+// here, and anything else is honestly reported as unsupported.
+func gardenRevertOps(s *Service) revertOps[domain.Garden] {
+	return revertOps[domain.Garden]{
+		entityType: domain.EntityGarden,
+		get:        s.store.GetGarden,
+		update:     s.store.UpdateGarden,
+		version:    func(g *domain.Garden) int64 { return g.Version },
+		setVersion: func(g *domain.Garden, v int64) { g.Version = v },
+		label:      func(g *domain.Garden) string { return g.Name },
+	}
 }
 
 // deleteObjectRecording deletes an object and returns every change to record.
@@ -526,17 +599,26 @@ func (s *Service) deleteObjectRecording(ctx context.Context, o *domain.GardenObj
 // one the change set left behind — i.e. something edited it since, and reverting
 // would silently discard that edit. A revision with no after-snapshot (a delete)
 // has nothing to compare and passes.
-func versionGuard(r domain.Revision, currentVersion int64, name string) *domain.RevertConflict {
-	var after struct {
-		Version int64 `json:"version"`
-	}
+//
+// appliedVersion is non-zero when THIS revert already wrote to this row, which
+// happens whenever a change set holds more than one revision for the same entity.
+// In that case the live version is our own doing and is the correct thing to
+// expect — comparing against the snapshot would flag our own work as a conflict.
+func versionGuard(r domain.Revision, currentVersion int64, name string, appliedVersion int64) *domain.RevertConflict {
 	if r.After == nil {
 		return nil
 	}
-	if err := json.Unmarshal([]byte(*r.After), &after); err != nil {
-		return conflict(r, domain.ConflictUnsupported, name)
+	expected := appliedVersion
+	if expected == 0 {
+		var after struct {
+			Version int64 `json:"version"`
+		}
+		if err := json.Unmarshal([]byte(*r.After), &after); err != nil {
+			return conflict(r, domain.ConflictUnsupported, name)
+		}
+		expected = after.Version
 	}
-	if after.Version != currentVersion {
+	if expected != currentVersion {
 		return conflict(r, domain.ConflictChanged, name)
 	}
 	return nil

internal/service/revisions_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"strings"
 	"testing"
 
 	"gitea.stevedudenhoeffer.com/steve/pansy/internal/domain"
@@ -96,7 +97,7 @@ func TestFillRegionIsOneChangeSet(t *testing.T) {
 	}
 
 	// Reverting removes all N and leaves the bed as it was.
-	_, conflicts, err := s.RevertChangeSet(ctx, owner, fill.ID)
+	_, conflicts, err := s.RevertChangeSet(ctx, owner, fill.ID, domain.SourceUI)
 	if err != nil {
 		t.Fatalf("RevertChangeSet: %v", err)
 	}
@@ -127,7 +128,7 @@ func TestRevertRestoresObjectGeometry(t *testing.T) {
 	}
 
 	sets := history(t, s, owner, g.ID)
-	if _, conflicts, err := s.RevertChangeSet(ctx, owner, sets[0].ID); err != nil || len(conflicts) != 0 {
+	if _, conflicts, err := s.RevertChangeSet(ctx, owner, sets[0].ID, domain.SourceUI); err != nil || len(conflicts) != 0 {
 		t.Fatalf("revert: err=%v conflicts=%+v", err, conflicts)
 	}
 
@@ -158,7 +159,7 @@ func TestRevertOfRevertRestoresTheChange(t *testing.T) {
 	}
 	move := history(t, s, owner, g.ID)[0]
 
-	undo, _, err := s.RevertChangeSet(ctx, owner, move.ID)
+	undo, _, err := s.RevertChangeSet(ctx, owner, move.ID, domain.SourceUI)
 	if err != nil {
 		t.Fatalf("revert: %v", err)
 	}
@@ -169,7 +170,7 @@ func TestRevertOfRevertRestoresTheChange(t *testing.T) {
 		t.Fatalf("undo didn't restore x: %v", o.XCM)
 	}
 
-	redo, conflicts, err := s.RevertChangeSet(ctx, owner, undo.ID)
+	redo, conflicts, err := s.RevertChangeSet(ctx, owner, undo.ID, domain.SourceUI)
 	if err != nil || len(conflicts) != 0 {
 		t.Fatalf("revert of revert: err=%v conflicts=%+v", err, conflicts)
 	}
@@ -236,7 +237,7 @@ func TestRevertConflictsOnLaterEdit(t *testing.T) {
 		t.Fatalf("later edit: %v", err)
 	}
 
-	_, conflicts, err := s.RevertChangeSet(ctx, owner, turn.ID)
+	_, conflicts, err := s.RevertChangeSet(ctx, owner, turn.ID, domain.SourceUI)
 	if err != nil {
 		t.Fatalf("RevertChangeSet: %v", err)
 	}
@@ -289,7 +290,7 @@ func TestRevertRestoresDeletedObjectWithItsPlantings(t *testing.T) {
 		t.Fatalf("delete recorded %d revisions, want 2 (the bed and its plop)", len(revs))
 	}
 
-	if _, conflicts, err := s.RevertChangeSet(ctx, owner, del.ID); err != nil || len(conflicts) != 0 {
+	if _, conflicts, err := s.RevertChangeSet(ctx, owner, del.ID, domain.SourceUI); err != nil || len(conflicts) != 0 {
 		t.Fatalf("revert: err=%v conflicts=%+v", err, conflicts)
 	}
 
@@ -336,7 +337,7 @@ func TestRevertClearObject(t *testing.T) {
 	}
 
 	clear := history(t, s, owner, g.ID)[0]
-	if _, conflicts, err := s.RevertChangeSet(ctx, owner, clear.ID); err != nil || len(conflicts) != 0 {
+	if _, conflicts, err := s.RevertChangeSet(ctx, owner, clear.ID, domain.SourceUI); err != nil || len(conflicts) != 0 {
 		t.Fatalf("revert: err=%v conflicts=%+v", err, conflicts)
 	}
 	after, _ := s.store.ListActivePlantingsForObject(ctx, bed.ID)
@@ -365,27 +366,29 @@ func TestRevertPermissions(t *testing.T) {
 	if _, _, err := s.GardenHistory(ctx, viewer, g.ID, 0, 0); err != nil {
 		t.Errorf("a viewer should be able to read history: %v", err)
 	}
-	if _, _, err := s.RevertChangeSet(ctx, viewer, cs.ID); !errors.Is(err, domain.ErrForbidden) {
+	if _, _, err := s.RevertChangeSet(ctx, viewer, cs.ID, domain.SourceUI); !errors.Is(err, domain.ErrForbidden) {
 		t.Errorf("viewer revert err = %v, want ErrForbidden", err)
 	}
 	if _, _, err := s.GardenHistory(ctx, stranger, g.ID, 0, 0); !errors.Is(err, domain.ErrNotFound) {
 		t.Errorf("stranger history err = %v, want ErrNotFound", err)
 	}
-	if _, _, err := s.RevertChangeSet(ctx, stranger, cs.ID); !errors.Is(err, domain.ErrNotFound) {
+	if _, _, err := s.RevertChangeSet(ctx, stranger, cs.ID, domain.SourceUI); !errors.Is(err, domain.ErrNotFound) {
 		t.Errorf("stranger revert err = %v, want ErrNotFound", err)
 	}
 }
 
-// TestWithChangeSetDiscardsOnFailure: history records operations that happened,
-// not operations that were attempted.
-func TestWithChangeSetDiscardsOnFailure(t *testing.T) {
+// TestWithChangeSetRecordsWhatCommittedOnFailure — a turn that fails partway has
+// still committed the mutations it got through, because this scope buffers
+// HISTORY, not data. Dropping the buffer would leave those changes with no
+// history and no way to undo them, which is exactly the situation undo exists
+// for. So they're recorded, marked as partial, and the failure is still reported.
+func TestWithChangeSetRecordsWhatCommittedOnFailure(t *testing.T) {
 	s := newTestService(t, openConfig())
 	owner := seedUser(t, s, "[email protected]")
 	g := seedGarden(t, s, owner)
 	bed := seedBed(t, s, owner, g.ID)
 	ctx := context.Background()
 
-	before := len(history(t, s, owner, g.ID))
 	sentinel := errors.New("boom")
 	_, err := s.WithChangeSet(ctx, owner, g.ID, ChangeSetOptions{Source: domain.SourceAgent, Summary: "Half a turn"},
 		func(ctx context.Context) error {
@@ -397,8 +400,24 @@ func TestWithChangeSetDiscardsOnFailure(t *testing.T) {
 	if !errors.Is(err, sentinel) {
 		t.Fatalf("err = %v, want the sentinel", err)
 	}
-	if got := len(history(t, s, owner, g.ID)); got != before {
-		t.Errorf("failed turn left %d change sets behind", got-before)
+
+	// The move really happened, so it must be in history and undoable.
+	if o, _ := s.store.GetObject(ctx, bed.ID); o.XCM != 600 {
+		t.Fatalf("the committed move was rolled back? x = %v", o.XCM)
+	}
+	sets := history(t, s, owner, g.ID)
+	partial := sets[0]
+	if !strings.Contains(partial.Summary, "failed partway") {
+		t.Errorf("summary = %q, want it to say the turn failed partway", partial.Summary)
+	}
+	if len(revisionsOf(t, s, partial.ID)) != 1 {
+		t.Errorf("expected the one committed mutation to be recorded")
+	}
+	if _, conflicts, err := s.RevertChangeSet(ctx, owner, partial.ID, domain.SourceUI); err != nil || len(conflicts) != 0 {
+		t.Fatalf("the partial turn should be undoable: err=%v conflicts=%+v", err, conflicts)
+	}
+	if o, _ := s.store.GetObject(ctx, bed.ID); o.XCM != bed.XCM {
+		t.Errorf("undo of the partial turn didn't restore x: %v", o.XCM)
 	}
 }
 
@@ -437,7 +456,7 @@ func TestGardenMetadataRevert(t *testing.T) {
 		t.Fatalf("UpdateGarden: %v", err)
 	}
 	cs := history(t, s, owner, g.ID)[0]
-	if _, conflicts, err := s.RevertChangeSet(ctx, owner, cs.ID); err != nil || len(conflicts) != 0 {
+	if _, conflicts, err := s.RevertChangeSet(ctx, owner, cs.ID, domain.SourceUI); err != nil || len(conflicts) != 0 {
 		t.Fatalf("revert: err=%v conflicts=%+v", err, conflicts)
 	}
 	back, _ := s.store.GetGarden(ctx, g.ID)
@@ -504,3 +523,184 @@ func TestSnapshotsCaptureVersion(t *testing.T) {
 }
 
 func f64Ptr(v float64) *float64 { return &v }
+
+// TestRevertChangeSetTouchingOneEntityTwice — an agent turn that moves a bed and
+// then renames it holds two revisions for the same object. Each inverse bumps
+// that row's version, so from the second one on the snapshot's version no longer
+// matches the live row. Without tracking what the revert itself just wrote, the
+// guard flags our own work as somebody else's edit and the undo half-fails.
+func TestRevertChangeSetTouchingOneEntityTwice(t *testing.T) {
+	s := newTestService(t, openConfig())
+	owner := seedUser(t, s, "[email protected]")
+	g := seedGarden(t, s, owner)
+	bed := seedBed(t, s, owner, g.ID)
+	ctx := context.Background()
+
+	_, err := s.WithChangeSet(ctx, owner, g.ID, ChangeSetOptions{Source: domain.SourceAgent, Summary: "Two edits"},
+		func(ctx context.Context) error {
+			moved, err := s.UpdateObject(ctx, owner, bed.ID, ObjectPatch{XCM: f64Ptr(600)}, bed.Version)
+			if err != nil {
+				return err
+			}
+			_, err = s.UpdateObject(ctx, owner, bed.ID, ObjectPatch{Name: strPtr("Renamed")}, moved.Version)
+			return err
+		})
+	if err != nil {
+		t.Fatalf("WithChangeSet: %v", err)
+	}
+	turn := history(t, s, owner, g.ID)[0]
+	if len(revisionsOf(t, s, turn.ID)) != 2 {
+		t.Fatalf("expected 2 revisions for the same object")
+	}
+
+	_, conflicts, err := s.RevertChangeSet(ctx, owner, turn.ID, domain.SourceUI)
+	if err != nil {
+		t.Fatalf("RevertChangeSet: %v", err)
+	}
+	if len(conflicts) != 0 {
+		t.Fatalf("the revert conflicted with its own work: %+v", conflicts)
+	}
+	back, _ := s.store.GetObject(ctx, bed.ID)
+	if back.XCM != bed.XCM || back.Name != bed.Name {
+		t.Errorf("both edits should have been undone, got x=%v name=%q", back.XCM, back.Name)
+	}
+}
+
+// TestRevertOfObjectCreateRefusesWhenPlanted — undoing "added a bed" would
+// cascade away anything planted in it since. Those plops would be snapshotted and
+// so recoverable, but deleting someone's plants as a side effect of an unrelated
+// undo should be reported, not performed quietly.
+func TestRevertOfObjectCreateRefusesWhenPlanted(t *testing.T) {
+	s := newTestService(t, openConfig())
+	owner := seedUser(t, s, "[email protected]")
+	g := seedGarden(t, s, owner)
+	ctx := context.Background()
+
+	bed := seedBed(t, s, owner, g.ID)
+	create := history(t, s, owner, g.ID)[0]
+
+	plant := seedOwnPlant(t, s, owner, 15)
+	if _, err := s.CreatePlanting(ctx, owner, bed.ID, PlantingInput{
+		PlantID: plant.ID, XCM: 0, YCM: 0, RadiusCM: 20,
+	}); err != nil {
+		t.Fatalf("CreatePlanting: %v", err)
+	}
+
+	cs, conflicts, err := s.RevertChangeSet(ctx, owner, create.ID, domain.SourceUI)
+	if err != nil {
+		t.Fatalf("RevertChangeSet: %v", err)
+	}
+	if len(conflicts) != 1 || conflicts[0].EntityID != bed.ID {
+		t.Fatalf("expected one conflict naming the bed, got %+v", conflicts)
+	}
+	if cs != nil {
+		t.Errorf("nothing should have been reverted, got change set %+v", cs)
+	}
+	if _, err := s.store.GetObject(ctx, bed.ID); err != nil {
+		t.Errorf("the planted bed was deleted anyway: %v", err)
+	}
+}
+
+// TestHistoryDoesNotDuplicateMultiplyRevertedEntries — more than one change set
+// can point at the same target (undo, redo, undo again). Looking that up with a
+// LEFT JOIN would emit one duplicate row per revert and silently corrupt the
+// page, so it is a scalar subquery instead. Written against the store because
+// getting a target legitimately reverted twice through the service is hard: the
+// second attempt conflicts, which is itself the correct behaviour.
+func TestHistoryDoesNotDuplicateMultiplyRevertedEntries(t *testing.T) {
+	s := newTestService(t, openConfig())
+	owner := seedUser(t, s, "[email protected]")
+	g := seedGarden(t, s, owner)
+	ctx := context.Background()
+
+	target := history(t, s, owner, g.ID) // garden create isn't recorded; start empty
+	if len(target) != 0 {
+		t.Fatalf("expected an empty history, got %+v", target)
+	}
+	base, err := s.store.WriteChangeSet(ctx, &domain.ChangeSet{
+		GardenID: g.ID, ActorID: owner, Source: domain.SourceUI, Summary: "Base",
+	}, []domain.Revision{{EntityType: domain.EntityGarden, EntityID: g.ID, Op: domain.OpUpdate}})
+	if err != nil {
+		t.Fatalf("WriteChangeSet: %v", err)
+	}
+	for i := 0; i < 2; i++ {
+		if _, err := s.store.WriteChangeSet(ctx, &domain.ChangeSet{
+			GardenID: g.ID, ActorID: owner, Source: domain.SourceUI, Summary: "Undo", RevertsID: &base.ID,
+		}, []domain.Revision{{EntityType: domain.EntityGarden, EntityID: g.ID, Op: domain.OpUpdate}}); err != nil {
+			t.Fatalf("WriteChangeSet revert %d: %v", i, err)
+		}
+	}
+
+	sets := history(t, s, owner, g.ID)
+	if len(sets) != 3 {
+		t.Fatalf("got %d change sets, want 3 — a join would have duplicated the base row: %+v", len(sets), sets)
+	}
+	seen := map[int64]int{}
+	for _, cs := range sets {
+		seen[cs.ID]++
+	}
+	for id, n := range seen {
+		if n != 1 {
+			t.Errorf("change set %d appears %d times", id, n)
+		}
+	}
+	for _, cs := range sets {
+		if cs.ID == base.ID && (cs.RevertedByID == nil || *cs.RevertedByID == 0) {
+			t.Error("the base change set should be marked as reverted")
+		}
+	}
+}
+
+// TestRevertSourceIsRecorded — an agent undoing its own work must be
+// distinguishable from a person clicking undo, or the history badge lies.
+func TestRevertSourceIsRecorded(t *testing.T) {
+	s := newTestService(t, openConfig())
+	owner := seedUser(t, s, "[email protected]")
+	g := seedGarden(t, s, owner)
+	bed := seedBed(t, s, owner, g.ID)
+	ctx := context.Background()
+
+	if _, err := s.UpdateObject(ctx, owner, bed.ID, ObjectPatch{XCM: f64Ptr(300)}, bed.Version); err != nil {
+		t.Fatalf("UpdateObject: %v", err)
+	}
+	move := history(t, s, owner, g.ID)[0]
+
+	undo, _, err := s.RevertChangeSet(ctx, owner, move.ID, domain.SourceAgent)
+	if err != nil {
+		t.Fatalf("revert: %v", err)
+	}
+	if undo.Source != domain.SourceAgent {
+		t.Errorf("source = %q, want agent", undo.Source)
+	}
+	if _, _, err := s.RevertChangeSet(ctx, owner, move.ID, "nonsense"); !errors.Is(err, domain.ErrInvalidInput) {
+		t.Errorf("an unknown source should be rejected, got %v", err)
+	}
+}
+
+// TestClearObjectOnlyClearsWhatItSnapshotted — the clear targets the exact ids it
+// read, so a plop created between the read and the UPDATE can't be removed
+// without a revision to undo it by.
+func TestClearObjectOnlyClearsWhatItSnapshotted(t *testing.T) {
+	s := newTestService(t, openConfig())
+	owner := seedUser(t, s, "[email protected]")
+	g := seedGarden(t, s, owner)
+	bed := seedBed(t, s, owner, g.ID)
+	plant := seedOwnPlant(t, s, owner, 15)
+	ctx := context.Background()
+
+	if _, err := s.FillNamedRegion(ctx, owner, bed.ID, "all", plant.ID, nil); err != nil {
+		t.Fatalf("fill: %v", err)
+	}
+	before, _ := s.store.ListActivePlantingsForObject(ctx, bed.ID)
+
+	n, err := s.ClearObject(ctx, owner, bed.ID)
+	if err != nil {
+		t.Fatalf("ClearObject: %v", err)
+	}
+	clear := history(t, s, owner, g.ID)[0]
+	revs := revisionsOf(t, s, clear.ID)
+	// Every row the clear touched has a revision; the count and the revisions agree.
+	if n != len(before) || len(revs) != n {
+		t.Errorf("cleared %d of %d with %d revisions — all three should match", n, len(before), len(revs))
+	}
+}

internal/store/plantings.go

@@ -102,15 +102,28 @@ func (d *DB) RestorePlanting(ctx context.Context, p *domain.Planting) (*domain.P
 	return restored, nil
 }
 
-// ClearObjectPlantings soft-removes every active plop in an object in one UPDATE
+// ClearObjectPlantings soft-removes the given plops of an object in one UPDATE
 // (sets removed_at=date, bumps version) and returns how many rows it affected.
-func (d *DB) ClearObjectPlantings(ctx context.Context, objectID int64, date string) (int, error) {
+//
+// It takes explicit ids rather than clearing "every active plop" so the caller
+// can snapshot exactly the rows it is about to change. Clearing by predicate
+// would let a plop created between the caller's read and this UPDATE be removed
+// without a revision — cleared, but with no way to undo it.
+func (d *DB) ClearObjectPlantings(ctx context.Context, objectID int64, date string, ids []int64) (int, error) {
+	if len(ids) == 0 {
+		return 0, nil
+	}
+	args := make([]any, 0, len(ids)+2)
+	args = append(args, date, objectID)
+	for _, id := range ids {
+		args = append(args, id)
+	}
 	res, err := d.sql.ExecContext(ctx,
 		`UPDATE plantings
 		    SET removed_at = ?, version = version + 1,
 		        updated_at = strftime('%Y-%m-%dT%H:%M:%SZ', 'now')
-		  WHERE object_id = ? AND removed_at IS NULL`,
-		date, objectID,
+		  WHERE object_id = ? AND removed_at IS NULL AND id IN (`+placeholders(len(ids))+`)`,
+		args...,
 	)
 	if err != nil {
 		return 0, fmt.Errorf("store: clear object plantings: %w", err)

internal/store/revisions.go

@@ -79,11 +79,15 @@ func (d *DB) WriteChangeSet(ctx context.Context, cs *domain.ChangeSet, revs []do
 // it (if any), and per-(entity,op) counts — everything the history list renders,
 // without a second round-trip per row. Always a non-nil slice.
 func (d *DB) ListChangeSets(ctx context.Context, gardenID int64, limit, offset int) ([]domain.ChangeSet, error) {
+	// The "was this reverted?" lookup is a scalar subquery, NOT a LEFT JOIN: a
+	// change set can be reverted more than once (undo, redo, undo again), and a
+	// join would then emit one duplicate row per revert and silently corrupt the
+	// page. MIN(id) names the first revert, which is the one worth showing.
 	rows, err := d.sql.QueryContext(ctx,
-		`SELECT `+qualifyColumns("cs", changeSetColumns)+`, u.display_name, rev.id
+		`SELECT `+qualifyColumns("cs", changeSetColumns)+`, u.display_name,
+		        (SELECT MIN(r.id) FROM change_sets r WHERE r.reverts_id = cs.id)
 		   FROM change_sets cs
 		   JOIN users u ON u.id = cs.actor_id
-		   LEFT JOIN change_sets rev ON rev.reverts_id = cs.id
 		  WHERE cs.garden_id = ?
 		  ORDER BY cs.id DESC
 		  LIMIT ? OFFSET ?`,