feat: add absorb command — merge source entity into target

DB: Absorb() merges body (newline-separated), unions tags, demotes
crystallized sources, soft-deletes source. Rejects crystallized targets.

API: POST /api/entities/:id/absorb { source_id }

CLI: nib absorb <target> <source> with prefix ID resolution

Web: absorb button on fluid entities, 'a' keyboard shortcut,
source picker modal

internal/api/api_test.go

@@ -421,6 +421,92 @@ func TestCORS_ProdMode(t *testing.T) {
 	}
 }
 
+func TestAbsorbEntity_Success(t *testing.T) {
+	srv, _ := testServer(t)
+	target := createTestEntity(t, srv, "target body", []string{"ops"})
+	source := createTestEntity(t, srv, "source body", []string{"ops", "infra"})
+
+	resp := postJSON(srv, "/api/entities/"+target.ID+"/absorb", map[string]any{
+		"source_id": source.ID,
+	})
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("expected 200, got %d", resp.StatusCode)
+	}
+
+	var e EntityResponse
+	json.NewDecoder(resp.Body).Decode(&e)
+	if e.Body != "target body\nsource body" {
+		t.Errorf("merged body: %q", e.Body)
+	}
+	if len(e.Tags) != 2 {
+		t.Errorf("expected 2 tags, got %v", e.Tags)
+	}
+
+	// Source should be soft-deleted (not in default list)
+	listResp, _ := http.Get(srv.URL + "/api/entities")
+	var entities []EntityResponse
+	json.NewDecoder(listResp.Body).Decode(&entities)
+	listResp.Body.Close()
+	for _, ent := range entities {
+		if ent.ID == source.ID {
+			t.Error("source should be soft-deleted and hidden from default list")
+		}
+	}
+}
+
+func TestAbsorbEntity_TargetCrystallized(t *testing.T) {
+	srv, _ := testServer(t)
+	target := createTestEntity(t, srv, "target", nil)
+	source := createTestEntity(t, srv, "source", nil)
+
+	postJSON(srv, "/api/entities/"+target.ID+"/promote", map[string]any{
+		"card_type": "snippet",
+	}).Body.Close()
+
+	resp := postJSON(srv, "/api/entities/"+target.ID+"/absorb", map[string]any{
+		"source_id": source.ID,
+	})
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d", resp.StatusCode)
+	}
+
+	var errResp ErrorResponse
+	json.NewDecoder(resp.Body).Decode(&errResp)
+	if errResp.Error != "invalid_absorb" {
+		t.Errorf("error: %q", errResp.Error)
+	}
+}
+
+func TestAbsorbEntity_SameEntity(t *testing.T) {
+	srv, _ := testServer(t)
+	e := createTestEntity(t, srv, "self", nil)
+
+	resp := postJSON(srv, "/api/entities/"+e.ID+"/absorb", map[string]any{
+		"source_id": e.ID,
+	})
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d", resp.StatusCode)
+	}
+}
+
+func TestAbsorbEntity_MissingSourceID(t *testing.T) {
+	srv, _ := testServer(t)
+	e := createTestEntity(t, srv, "target", nil)
+
+	resp := postJSON(srv, "/api/entities/"+e.ID+"/absorb", map[string]any{})
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d", resp.StatusCode)
+	}
+}
+
 func mustJSON(v any) []byte {
 	b, _ := json.Marshal(v)
 	return b

internal/api/entities.go

@@ -304,6 +304,50 @@ func demoteEntity(store *db.Store) http.HandlerFunc {
 	}
 }
 
+type AbsorbRequest struct {
+	SourceID string `json:"source_id"`
+}
+
+func absorbEntity(store *db.Store) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		id := chi.URLParam(r, "id")
+
+		var req AbsorbRequest
+		if !decodeJSON(w, r, &req) {
+			return
+		}
+
+		if req.SourceID == "" {
+			writeError(w, http.StatusBadRequest, "invalid_input", "source_id is required")
+			return
+		}
+		if req.SourceID == id {
+			writeError(w, http.StatusBadRequest, "invalid_input", "target and source must be different entities")
+			return
+		}
+
+		if err := store.Absorb(id, req.SourceID); err != nil {
+			if err == db.ErrNotFound {
+				writeError(w, http.StatusNotFound, "not_found", "target or source entity not found")
+				return
+			}
+			if err == db.ErrTargetCrystallized {
+				writeError(w, http.StatusBadRequest, "invalid_absorb", "target is crystallized — demote first")
+				return
+			}
+			writeError(w, http.StatusInternalServerError, "internal", err.Error())
+			return
+		}
+
+		e, err := store.Get(id)
+		if err != nil {
+			writeError(w, http.StatusInternalServerError, "internal", err.Error())
+			return
+		}
+		writeJSON(w, http.StatusOK, entityToResponse(e))
+	}
+}
+
 func useEntity(store *db.Store) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		id := chi.URLParam(r, "id")

internal/api/router.go

@@ -31,6 +31,7 @@ func NewRouter(store *db.Store, devMode bool, webFS ...fs.FS) chi.Router {
 		r.Post("/entities/{id}/promote", promoteEntity(store))
 		r.Post("/entities/{id}/demote", demoteEntity(store))
 		r.Post("/entities/{id}/use", useEntity(store))
+		r.Post("/entities/{id}/absorb", absorbEntity(store))
 		r.Get("/tags", listTags(store))
 	})
 

internal/db/db.go

@@ -10,9 +10,10 @@ import (
 )
 
 var (
-	ErrNotFound        = errors.New("not_found")
-	ErrAlreadyPromoted = errors.New("invalid_promote")
-	ErrAlreadyFluid    = errors.New("invalid_demote")
+	ErrNotFound           = errors.New("not_found")
+	ErrAlreadyPromoted    = errors.New("invalid_promote")
+	ErrAlreadyFluid       = errors.New("invalid_demote")
+	ErrTargetCrystallized = errors.New("invalid_absorb")
 )
 
 type Store struct {

internal/db/entities.go

@@ -405,6 +405,63 @@ func (s *Store) SoftDelete(id string) (DeleteResult, error) {
 	return DeletedSoft, err
 }
 
+func (s *Store) Absorb(targetID, sourceID string) error {
+	target, err := s.Get(targetID)
+	if err != nil {
+		return err
+	}
+	source, err := s.Get(sourceID)
+	if err != nil {
+		return err
+	}
+
+	if target.CardType != nil {
+		return ErrTargetCrystallized
+	}
+
+	tx, err := s.db.Begin()
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback()
+
+	now := time.Now().UTC().Format(time.RFC3339)
+	merged := target.Body + "\n" + source.Body
+
+	if _, err := tx.Exec("UPDATE entities SET body = ?, modified_at = ? WHERE id = ?",
+		merged, now, targetID); err != nil {
+		return err
+	}
+
+	seen := map[string]bool{}
+	for _, t := range target.Tags {
+		seen[t] = true
+	}
+	for _, t := range source.Tags {
+		if !seen[t] {
+			if _, err := tx.Exec("INSERT OR IGNORE INTO entity_tags (entity_id, tag) VALUES (?, ?)",
+				targetID, t); err != nil {
+				return err
+			}
+		}
+	}
+
+	if source.CardType != nil {
+		if _, err := tx.Exec(`UPDATE entities SET card_type = NULL, card_data = NULL,
+			use_count = 0, last_used_at = NULL, modified_at = ? WHERE id = ?`,
+			now, sourceID); err != nil {
+			return err
+		}
+	}
+
+	if _, err := tx.Exec("UPDATE entities SET deleted_at = ? WHERE id = ?",
+		now, sourceID); err != nil {
+		return err
+	}
+
+	return tx.Commit()
+}
+
 func (s *Store) IncrementUse(id string) error {
 	res, err := s.db.Exec(`
 		UPDATE entities SET use_count = use_count + 1, last_used_at = ?