POST/GET /v1/vaults/{v}/activity and POST .../activity/read: per-member events with unread counts, viewers cannot post, removed members get 403, comment bodies never stored or logged, purge triggers on vault delete (comments spec task 7). Built by MiniMax M3.1 Flash (OpenCode Zen free route); verified from a clean checkout of the staged files: notescraft-sync-server tests 128 pass, clippy -D warnings clean.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Marcos Paulo