@promptowl/contextnest-community 1.0.0 → 1.0.1

package/dist/index.js

@@ -7,24 +7,17 @@ import {
   parseBearerToken,
   verifyPassword
 } from "./chunk-7K2LLJXK.js";
-import {
-  checkConflict,
-  createVersion,
-  getApprovedVersion,
-  getCurrentVersion,
-  getDisplayStatus,
-  getVersions,
-  setApprovedVersion
-} from "./chunk-BLOPZDPL.js";
 import {
   approve,
   cancelReview,
+  engineCache,
   getPendingReview,
   getReviewHistory,
   getReviewQueue,
   reject,
+  safePublishDocument,
   submitForReview
-} from "./chunk-XDCW4HTW.js";
+} from "./chunk-5VHKEIAW.js";
 import {
   assignSteward,
   canUserAccess,
@@ -39,11 +32,22 @@ import {
   resolveStewardsForNode,
   resolveStewardsWithFallback,
   syncFromConfig
-} from "./chunk-2FXVMVZJ.js";
+} from "./chunk-K22GWPT4.js";
+import {
+  checkConflict,
+  createVersion,
+  getApprovedVersion,
+  getCurrentVersion,
+  getDisplayStatus,
+  getVersions,
+  setApprovedVersion
+} from "./chunk-JMZ75ZCD.js";
 import {
+  ANON_EMAIL,
+  ANON_USER_ID,
   config,
   getDb
-} from "./chunk-2TW25QEA.js";
+} from "./chunk-KQCWNHDM.js";
 
 // src/index.ts
 import { serve } from "@hono/node-server";
@@ -183,6 +187,12 @@ var NotFoundError = class extends AppError {
     this.name = "NotFoundError";
   }
 };
+var ForbiddenError = class extends AppError {
+  constructor(message = "Forbidden") {
+    super(403, message);
+    this.name = "ForbiddenError";
+  }
+};
 var ValidationError = class extends AppError {
   constructor(message) {
     super(400, message);
@@ -333,6 +343,8 @@ async function runLicenseWatcher() {
     try {
       watcherAbort = new AbortController();
       const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
+      const fetchTimeout = AbortSignal.timeout(30 * 1e3);
+      const signal = typeof AbortSignal.any === "function" ? AbortSignal.any([watcherAbort.signal, fetchTimeout]) : watcherAbort.signal;
       const res = await fetch(`${promptowlUrl}/api/license/listen`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
@@ -340,9 +352,13 @@ async function runLicenseWatcher() {
           key,
           since_updated_at: currentLicense ? (/* @__PURE__ */ new Date()).toISOString() : void 0
         }),
-        signal: watcherAbort.signal
+        signal
       });
       if (!res.ok) {
+        if (res.status === 504 || res.status === 408 || res.status === 502) {
+          backoff = WATCHER_BACKOFF_MIN_MS;
+          continue;
+        }
         throw new Error(`listen returned ${res.status}`);
       }
       const data = await res.json();
@@ -375,6 +391,30 @@ async function runLicenseWatcher() {
 function sleep(ms) {
   return new Promise((r) => setTimeout(r, ms));
 }
+var safetyPollHandle = null;
+var SAFETY_POLL_INTERVAL_MS = 60 * 1e3;
+function startLicenseSafetyPoll() {
+  if (safetyPollHandle) return;
+  safetyPollHandle = setInterval(async () => {
+    if (!config.PROMPTOWL_KEY) return;
+    try {
+      const wasValid = !!currentLicense?.valid;
+      await validateLicense({ forceFresh: true });
+      const isValid = !!currentLicense?.valid;
+      if (wasValid && !isValid) {
+        console.log("[license] safety poll detected revocation");
+        handleLicenseRevoked();
+      }
+    } catch (err) {
+      console.warn(
+        `[license] safety poll error: ${err.message}`
+      );
+    }
+  }, SAFETY_POLL_INTERVAL_MS);
+  if (typeof safetyPollHandle.unref === "function") {
+    safetyPollHandle.unref();
+  }
+}
 function handleLicenseRevoked() {
   try {
     const db = getDb();
@@ -1030,9 +1070,9 @@ authRoutes.get("/teammates", async (c) => {
          (SELECT COUNT(*) FROM api_keys WHERE user_id = u.id) as key_count,
          (SELECT MAX(last_used_at) FROM api_keys WHERE user_id = u.id) as last_active
        FROM users u
-       WHERE u.id != '00000000-0000-0000-0000-000000000000'
+       WHERE u.id != ?
        ORDER BY u.created_at DESC`
-  ).all();
+  ).all(ANON_USER_ID);
   const pendingStewards = db.prepare(
     `SELECT DISTINCT s.user_email AS email
          FROM stewards s
@@ -1067,6 +1107,9 @@ function resolveNestPermission(nestId, userId) {
   const nest = db.prepare("SELECT user_id, visibility FROM nests WHERE id = ?").get(nestId);
   if (!nest) return "none";
   if (nest.user_id === userId) return "owner";
+  if (nest.user_id === ANON_USER_ID && isLicenseAdminUserId(userId)) {
+    return "owner";
+  }
   const directGrant = db.prepare(
     "SELECT permission FROM nest_collaborators WHERE nest_id = ? AND user_id = ?"
   ).get(nestId, userId);
@@ -1105,9 +1148,10 @@ async function createNest(userId, name, description) {
   const id = uuid2();
   const slug = toSlug(name);
   const db = getDb();
+  const visibility = userId === ANON_USER_ID ? "public" : "private";
   db.prepare(
-    "INSERT INTO nests (id, user_id, name, slug, description) VALUES (?, ?, ?, ?, ?)"
-  ).run(id, userId, name, slug, description || null);
+    "INSERT INTO nests (id, user_id, name, slug, description, visibility) VALUES (?, ?, ?, ?, ?, ?)"
+  ).run(id, userId, name, slug, description || null, visibility);
   const path = nestPath(id);
   mkdirSync(path, { recursive: true });
   const storage = new NestStorage(path);
@@ -1115,14 +1159,17 @@ async function createNest(userId, name, description) {
   trackEvent("nest.create", { nestId: id, userId });
   return db.prepare("SELECT * FROM nests WHERE id = ?").get(id);
 }
-var ANON_USER_ID = "00000000-0000-0000-0000-000000000000";
 function listNests(userId) {
   const db = getDb();
   if (userId === ANON_USER_ID) {
     return db.prepare("SELECT * FROM nests WHERE user_id = ? ORDER BY created_at DESC").all(ANON_USER_ID);
   }
+  const includeAnon = config.AUTH_MODE === "open" || isLicenseAdminUserId(userId);
+  if (!includeAnon) {
+    return db.prepare("SELECT * FROM nests WHERE user_id = ? ORDER BY created_at DESC").all(userId);
+  }
   return db.prepare(
-    "SELECT * FROM nests WHERE user_id = ? OR user_id = ? ORDER BY created_at DESC"
+    "SELECT * FROM nests WHERE user_id = ? OR (user_id = ? AND visibility = 'public') ORDER BY created_at DESC"
   ).all(userId, ANON_USER_ID);
 }
 function listSharedNests(userId) {
@@ -1140,23 +1187,35 @@ function getNest(nestId) {
 }
 async function deleteNest(nestId) {
   const db = getDb();
-  db.prepare("DELETE FROM api_keys WHERE nest_id = ?").run(nestId);
-  db.prepare("DELETE FROM nests WHERE id = ?").run(nestId);
+  const wipe = db.transaction((id) => {
+    db.prepare("DELETE FROM approved_versions WHERE nest_id = ?").run(id);
+    db.prepare("DELETE FROM node_versions WHERE nest_id = ?").run(id);
+    db.prepare("DELETE FROM review_requests WHERE nest_id = ?").run(id);
+    db.prepare("DELETE FROM stewards WHERE nest_id = ?").run(id);
+    db.prepare("DELETE FROM nest_collaborators WHERE nest_id = ?").run(id);
+    try {
+      db.prepare("DELETE FROM node_tag_index WHERE nest_id = ?").run(id);
+    } catch {
+    }
+    db.prepare("DELETE FROM api_keys WHERE nest_id = ?").run(id);
+    db.prepare("DELETE FROM nests WHERE id = ?").run(id);
+  });
+  wipe(nestId);
   const path = nestPath(nestId);
   try {
     rmSync(path, { recursive: true, force: true });
-  } catch {
+  } catch (err) {
+    console.warn(`[nests] failed to remove nest directory ${path}:`, err);
   }
   trackEvent("nest.delete", { nestId });
 }
 
 // src/nests/routes.ts
-var ANON_USER_ID2 = "00000000-0000-0000-0000-000000000000";
 function effectivePermission(nestId, userId) {
   if (config.AUTH_MODE === "open") {
     const db = getDb();
     const nest = db.prepare("SELECT user_id FROM nests WHERE id = ?").get(nestId);
-    if (nest && nest.user_id === ANON_USER_ID2) return "owner";
+    if (nest && nest.user_id === ANON_USER_ID) return "owner";
   }
   return resolveNestPermission(nestId, userId);
 }
@@ -1165,7 +1224,23 @@ nestRoutes.get("/", async (c) => {
   const userId = c.get("userId");
   const owned = listNests(userId);
   const shared = listSharedNests(userId);
-  return c.json({ nests: [...owned, ...shared] });
+  const db = getDb();
+  const ownerEmailStmt = db.prepare(
+    "SELECT email FROM users WHERE id = ?"
+  );
+  const annotate = (n) => {
+    const permission = effectivePermission(n.id, userId);
+    const is_owner = permission === "owner";
+    let owner_email = null;
+    if (!is_owner && n.user_id !== ANON_USER_ID) {
+      const row = ownerEmailStmt.get(n.user_id);
+      owner_email = row?.email ?? null;
+    }
+    return { ...n, permission, is_owner, owner_email };
+  };
+  return c.json({
+    nests: [...owned.map(annotate), ...shared.map(annotate)]
+  });
 });
 nestRoutes.post("/", async (c) => {
   const body = await c.req.json();
@@ -1186,10 +1261,19 @@ nestRoutes.get("/:nestId", async (c) => {
 });
 nestRoutes.delete("/:nestId", async (c) => {
   const nestId = c.req.param("nestId");
-  const permission = effectivePermission(nestId, c.get("userId"));
-  if (permission !== "owner") {
+  const userId = c.get("userId");
+  const nest = getNest(nestId);
+  if (!nest) {
     throw new NotFoundError("Nest not found");
   }
+  const permission = effectivePermission(nestId, userId);
+  const isAnonOwned = nest.user_id === ANON_USER_ID;
+  const adminCaretaker = config.AUTH_MODE !== "open" && isAnonOwned && isLicenseAdminUserId(userId);
+  if (permission !== "owner" && !adminCaretaker) {
+    throw new ForbiddenError(
+      "You don't have permission to delete this nest. Only the nest owner can delete it."
+    );
+  }
   await deleteNest(nestId);
   return c.json({ deleted: true });
 });
@@ -1306,37 +1390,26 @@ sharingRoutes.patch("/visibility", async (c) => {
   return c.json({ visibility: body.visibility });
 });
 
+// src/governance/access-guard.ts
+function resolveCallerEmail(userId) {
+  if (!userId) return "admin@localhost";
+  const db = getDb();
+  const row = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
+  return row?.email || "admin@localhost";
+}
+function canReadNode(nestId, nodeId, userEmail) {
+  if (!isStewardshipEnabled(nestId)) return true;
+  return canUserAccess(nestId, nodeId, userEmail).allowed;
+}
+function filterAccessible(nestId, userEmail, nodes) {
+  if (!isStewardshipEnabled(nestId)) return nodes;
+  return nodes.filter((n) => canUserAccess(nestId, n.id, userEmail).allowed);
+}
+
 // src/nodes/routes.ts
 import { Hono as Hono4 } from "hono";
 import { serializeDocument } from "@promptowl/contextnest-engine";
 
-// src/nodes/engine.ts
-import { join as join2 } from "path";
-import {
-  NestStorage as NestStorage2,
-  GraphQueryEngine,
-  VersionManager
-} from "@promptowl/contextnest-engine";
-var NestEngineCache = class {
-  cache = /* @__PURE__ */ new Map();
-  get(nestId) {
-    let engine = this.cache.get(nestId);
-    if (!engine) {
-      const nestPath2 = join2(config.DATA_ROOT, "nests", nestId);
-      const storage = new NestStorage2(nestPath2);
-      const query = new GraphQueryEngine(storage);
-      const versions = new VersionManager(storage);
-      engine = { storage, query, versions };
-      this.cache.set(nestId, engine);
-    }
-    return engine;
-  }
-  evict(nestId) {
-    this.cache.delete(nestId);
-  }
-};
-var engineCache = new NestEngineCache();
-
 // src/governance/tag-index-service.ts
 function normalizeTag(raw) {
   return raw.trim().replace(/^#+/, "").toLowerCase();
@@ -1367,20 +1440,220 @@ function removeNodeFromTagIndex(nestId, nodeId) {
   ).run(nestId, nodeId);
 }
 
-// src/governance/access-guard.ts
-function resolveCallerEmail(userId) {
-  if (!userId) return "admin@localhost";
-  const db = getDb();
-  const row = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
-  return row?.email || "admin@localhost";
+// src/governance/external-edit-service.ts
+import { readFile } from "fs/promises";
+import { join as join2 } from "path";
+import {
+  detectDrift,
+  stageSuggestion,
+  approveSuggestion,
+  rejectSuggestion,
+  listSuggestions,
+  readSuggestion,
+  VersionManager
+} from "@promptowl/contextnest-engine";
+var communityRbac = {
+  isCzar: () => false,
+  canIngest: () => true,
+  isDocOwner: () => true
+};
+function docPath(nestId, documentId) {
+  return join2(config.DATA_ROOT, "nests", nestId, `${documentId}.md`);
 }
-function canReadNode(nestId, nodeId, userEmail) {
-  if (!isStewardshipEnabled(nestId)) return true;
-  return canUserAccess(nestId, nodeId, userEmail).allowed;
+async function readRaw(nestId, documentId) {
+  try {
+    return await readFile(docPath(nestId, documentId), "utf-8");
+  } catch {
+    return null;
+  }
 }
-function filterAccessible(nestId, userEmail, nodes) {
-  if (!isStewardshipEnabled(nestId)) return nodes;
-  return nodes.filter((n) => canUserAccess(nestId, n.id, userEmail).allowed);
+async function loadChainHead(storage, documentId) {
+  const history = await storage.readHistory(documentId);
+  if (!history || history.versions.length === 0) return null;
+  const latest = history.versions[history.versions.length - 1];
+  try {
+    const content = await new VersionManager(storage).reconstructVersion(
+      documentId,
+      latest.version
+    );
+    return { version: latest.version, content };
+  } catch {
+    return null;
+  }
+}
+async function scanDocumentForDrift(nestId, documentId, actor = "system:scanner") {
+  const res = await scanDocumentForDriftInternal(nestId, documentId, actor);
+  return res?.meta ?? null;
+}
+async function scanDocumentForDriftInternal(nestId, documentId, actor) {
+  const { storage } = engineCache.get(nestId);
+  const node = await storage.readDocument(documentId).catch(() => null);
+  if (!node) return null;
+  const raw = await readRaw(nestId, documentId);
+  if (raw == null) return null;
+  const drift = detectDrift(raw, node.frontmatter.checksum);
+  if (!drift.drifted) return null;
+  const approved = await loadChainHead(storage, documentId);
+  if (!approved) return null;
+  const existing = await listSuggestions(storage, documentId);
+  const dup = existing.find((s) => s.proposed_hash === drift.actualHash);
+  if (dup) return { meta: dup, created: false };
+  const result = await stageSuggestion({
+    storage,
+    documentId,
+    approvedRawContent: approved.content,
+    proposedRawContent: raw,
+    source: "out-of-band-edit",
+    actor,
+    docTier: "standard"
+  });
+  return { meta: result.meta, created: true };
+}
+async function scanNestForDrift(nestId, actor = "system:scanner") {
+  const { storage } = engineCache.get(nestId);
+  const docs = await storage.discoverDocuments();
+  const results = await Promise.all(
+    docs.map((doc) => scanDocumentForDriftInternal(nestId, doc.id, actor))
+  );
+  const staged = results.filter((r) => r?.created).length;
+  return { scanned: docs.length, staged };
+}
+async function getPendingChange(nestId, documentId) {
+  const { storage } = engineCache.get(nestId);
+  const list = await listSuggestions(storage, documentId);
+  if (list.length === 0) return null;
+  const latest = list[list.length - 1];
+  return {
+    suggestion_id: latest.suggestion_id,
+    detected_at: latest.detected_at,
+    source: latest.source,
+    proposed_hash: latest.proposed_hash
+  };
+}
+async function listNestExternalEdits(nestId) {
+  const { storage } = engineCache.get(nestId);
+  const docs = await storage.discoverDocuments();
+  const lists = await Promise.all(
+    docs.map((doc) => listSuggestions(storage, doc.id))
+  );
+  const entries = lists.flat().map((meta) => ({
+    suggestion_id: meta.suggestion_id,
+    nest_id: nestId,
+    document_id: meta.document_id,
+    source: meta.source,
+    detected_at: meta.detected_at,
+    actor: meta.actor,
+    target_hash: meta.target_hash,
+    proposed_hash: meta.proposed_hash,
+    note: meta.note
+  }));
+  return entries.sort((a, b) => b.detected_at.localeCompare(a.detected_at));
+}
+async function getExternalEditDetail(nestId, documentId, suggestionId) {
+  const { storage } = engineCache.get(nestId);
+  const found = await readSuggestion(storage, documentId, suggestionId);
+  if (!found) return null;
+  return {
+    suggestion_id: found.meta.suggestion_id,
+    nest_id: nestId,
+    document_id: found.meta.document_id,
+    source: found.meta.source,
+    detected_at: found.meta.detected_at,
+    actor: found.meta.actor,
+    target_hash: found.meta.target_hash,
+    proposed_hash: found.meta.proposed_hash,
+    note: found.meta.note,
+    patch: found.patch
+  };
+}
+async function approveExternalEdit(input) {
+  const { storage } = engineCache.get(input.nestId);
+  let result;
+  try {
+    result = await approveSuggestion({
+      storage,
+      rbac: communityRbac,
+      documentId: input.documentId,
+      suggestionId: input.suggestionId,
+      actor: input.actor,
+      zone: "default",
+      comment: input.comment
+    });
+  } catch (err) {
+    console.error(
+      `[external-edit] approveSuggestion failed for ${input.nestId}/${input.documentId} suggestion=${input.suggestionId}:`,
+      err
+    );
+    throw err;
+  }
+  try {
+    const node = await storage.readDocument(input.documentId);
+    const versionNum = result.versionEntry.version;
+    const tags = node.frontmatter.tags || [];
+    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-TFEYNPH7.js");
+    createVersion2({
+      nestId: input.nestId,
+      nodeId: input.documentId,
+      version: versionNum,
+      content: node.body || "",
+      author: input.actor,
+      status: "published",
+      tags,
+      changeNote: input.comment || "External edit approved"
+    });
+    setApprovedVersion2(input.nestId, input.documentId, versionNum, input.actor);
+  } catch (err) {
+    console.error(
+      `[external-edit] failed to mirror approved version into node_versions for ${input.nestId}/${input.documentId}:`,
+      err
+    );
+  }
+  return result;
+}
+async function rejectExternalEdit(input) {
+  const { storage } = engineCache.get(input.nestId);
+  const result = await rejectSuggestion({
+    storage,
+    rbac: communityRbac,
+    documentId: input.documentId,
+    suggestionId: input.suggestionId,
+    actor: input.actor,
+    zone: "default",
+    reason: input.reason
+  });
+  try {
+    const approved = await loadChainHead(storage, input.documentId);
+    if (approved) {
+      await storage.writeDocument(input.documentId, approved.content);
+    }
+  } catch (err) {
+    console.error(
+      `[external-edit] revert-on-reject failed for ${input.nestId}/${input.documentId}:`,
+      err
+    );
+  }
+  return result;
+}
+var scannerTimer = null;
+async function scanAllNests() {
+  const db = getDb();
+  const rows = db.prepare("SELECT id FROM nests").all();
+  await Promise.all(
+    rows.map(
+      ({ id }) => scanNestForDrift(id).catch(
+        (err) => console.error(`[external-edit] scan failed for nest ${id}:`, err)
+      )
+    )
+  );
+}
+function startDriftScanner(intervalMs = 3e4) {
+  if (scannerTimer) return;
+  scannerTimer = setInterval(() => {
+    scanAllNests().catch(
+      (err) => console.error("[external-edit] scanner tick failed:", err)
+    );
+  }, intervalMs);
+  scannerTimer.unref?.();
 }
 
 // src/nodes/routes.ts
@@ -1400,7 +1673,8 @@ function toNodeResponse(node) {
     description: node.frontmatter.description,
     created_at: node.frontmatter.created_at,
     updated_at: node.frontmatter.updated_at,
-    content: node.body
+    content: node.body,
+    pendingChange: node.pendingChange ?? void 0
   };
 }
 nodeRoutes.get("/", async (c) => {
@@ -1409,11 +1683,27 @@ nodeRoutes.get("/", async (c) => {
   const documents = await storage.discoverDocuments();
   const userEmail = resolveCallerEmail(c.get("userId"));
   const accessible = filterAccessible(nestId, userEmail, documents);
+  const pendingByDoc = /* @__PURE__ */ new Map();
+  await Promise.all(
+    accessible.map(async (doc) => {
+      try {
+        pendingByDoc.set(doc.id, await getPendingChange(nestId, doc.id));
+      } catch {
+        pendingByDoc.set(doc.id, null);
+      }
+    })
+  );
   return c.json({
     count: accessible.length,
     nodes: accessible.map((doc) => {
       const r = toNodeResponse(doc);
-      r.status = getDisplayStatus(nestId, r.id);
+      const pending = pendingByDoc.get(doc.id);
+      if (pending) {
+        r.pendingChange = pending;
+        r.status = "external_edit_pending";
+      } else {
+        r.status = getDisplayStatus(nestId, r.id);
+      }
       return r;
     })
   });
@@ -1431,7 +1721,8 @@ nodeRoutes.post("/", async (c) => {
   const tags = body.tags?.map((t) => t.startsWith("#") ? t : `#${t}`) || [];
   const hasStewards = isStewardshipEnabled(nestId);
   const initialStatus = hasStewards ? "draft" : "approved";
-  const node = {
+  const initialVersion = hasStewards ? 1 : 0;
+  let node = {
     id,
     filePath: "",
     frontmatter: {
@@ -1439,7 +1730,7 @@ nodeRoutes.post("/", async (c) => {
       type: body.type || "document",
       tags,
       status: body.status || initialStatus,
-      version: 1,
+      version: initialVersion,
       created_at: now,
       updated_at: now,
       metadata: {
@@ -1454,22 +1745,51 @@ nodeRoutes.post("/", async (c) => {
   await storage.writeDocument(id, serialized);
   syncNodeTags(nestId, id, tags);
   const authorEmail = getUserEmail(c);
-  try {
-    await versionManager.createVersion(node, authorEmail);
-  } catch (err) {
-    console.error("VersionManager.createVersion failed (node create)", err);
-  }
-  createVersion({
-    nestId,
-    nodeId: id,
-    version: 1,
-    content: body.content,
-    author: authorEmail,
-    status: initialStatus,
-    tags
-  });
-  if (initialStatus === "approved") {
-    setApprovedVersion(nestId, id, 1, authorEmail);
+  if (hasStewards) {
+    try {
+      await versionManager.createVersion(node, authorEmail);
+    } catch (err) {
+      console.error("VersionManager.createVersion failed (node create)", err);
+    }
+    createVersion({
+      nestId,
+      nodeId: id,
+      version: 1,
+      content: body.content,
+      author: authorEmail,
+      status: "draft",
+      tags
+    });
+  } else {
+    try {
+      const result = await safePublishDocument(storage, id, {
+        editedBy: authorEmail,
+        note: "Auto-published on create (no stewards configured)"
+      });
+      const publishedVersion = result.node.frontmatter.version || 2;
+      createVersion({
+        nestId,
+        nodeId: id,
+        version: publishedVersion,
+        content: result.node.body || "",
+        author: authorEmail,
+        status: "published",
+        tags
+      });
+      setApprovedVersion(nestId, id, publishedVersion, authorEmail);
+      node = result.node;
+    } catch (err) {
+      console.error("publishDocument failed (node create auto-publish)", err);
+      createVersion({
+        nestId,
+        nodeId: id,
+        version: 1,
+        content: body.content,
+        author: authorEmail,
+        status: "draft",
+        tags
+      });
+    }
   }
   trackEvent("node.create", { nestId, nodeId: id });
   const resolved = resolveStewardsForNode(nestId, id);
@@ -1485,7 +1805,7 @@ nodeRoutes.post("/", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-ZJATH6OM.js");
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-C5D2O7ZE.js");
   const { stewards, fallbackToOwner, ownerEmail } = resolveStewardsWithFallback2(
     nestId,
     nodeId
@@ -1497,8 +1817,7 @@ nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
       role: r.steward.role,
       scope: r.steward.scope,
       source: r.source,
-      priority: r.priority,
-      canApprove: r.steward.canApprove
+      priority: r.priority
     })),
     fallbackToOwner,
     ownerEmail
@@ -1507,7 +1826,7 @@ nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/versions", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-2MZJGE3H.js");
+  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-TFEYNPH7.js");
   const allVersions = getVersions2(nestId, nodeId);
   const approved = getApprovedVersion2(nestId, nodeId);
   const db = getDb();
@@ -1538,7 +1857,7 @@ nodeRoutes.get("/:nodeId{.+?}/versions", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/reviews", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-2JHZHZWJ.js");
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-4WS3XL6K.js");
   const history = getReviewHistory2(nestId, nodeId);
   return c.json({ reviews: history });
 });
@@ -1555,12 +1874,21 @@ nodeRoutes.get("/:nodeId{.+}", async (c) => {
   }
   let node;
   try {
-    node = await storage.readDocument(nodeId);
+    node = await storage.readDocument(nodeId, { verifyChecksum: true });
   } catch {
     throw new NotFoundError(`Node not found: ${nodeId}`);
   }
+  if (node.pendingChange) {
+    try {
+      await scanDocumentForDrift(nestId, nodeId, userEmail || "system:read");
+      const refreshed = await getPendingChange(nestId, nodeId);
+      if (refreshed) node.pendingChange = refreshed;
+    } catch (err) {
+      console.error("[external-edit] stage-on-read failed:", err);
+    }
+  }
   const response = toNodeResponse(node);
-  response.status = getDisplayStatus(nestId, nodeId);
+  response.status = node.pendingChange ? "external_edit_pending" : getDisplayStatus(nestId, nodeId);
   return c.json({ node: response });
 });
 nodeRoutes.patch("/:nodeId{.+}", async (c) => {
@@ -1615,51 +1943,99 @@ nodeRoutes.patch("/:nodeId{.+}", async (c) => {
       frontmatter: { ...node.frontmatter, title: body.title }
     };
   }
-  const currentVersion = getCurrentVersion(nestId, nodeId);
-  const newVersion = currentVersion + 1;
-  node = {
-    ...node,
-    frontmatter: {
-      ...node.frontmatter,
-      version: newVersion,
-      updated_at: (/* @__PURE__ */ new Date()).toISOString()
-    }
-  };
-  const fm = Object.fromEntries(
-    Object.entries(node.frontmatter).filter(([, v]) => v !== void 0)
-  );
-  node = { ...node, frontmatter: fm };
-  const serialized = serializeDocument(node);
-  await storage.writeDocument(nodeId, serialized);
   const authorEmail = getUserEmail(c);
   const hasStewards = isStewardshipEnabled(nestId);
   const currentTags = node.frontmatter.tags || [];
-  syncNodeTags(nestId, nodeId, currentTags);
-  try {
-    await versionManager.createVersion(node, authorEmail, {
-      note: body.changeNote
-    });
-  } catch (err) {
-    console.error("VersionManager.createVersion failed (node patch)", err);
-  }
-  createVersion({
-    nestId,
-    nodeId,
-    version: newVersion,
-    content: node.body || "",
-    author: authorEmail,
-    status: hasStewards ? "draft" : "approved",
-    tags: currentTags,
-    changeNote: body.changeNote
-  });
-  const { cancelReview: cancelReview2, getPendingReview: getPendingReview2 } = await import("./review-service-2JHZHZWJ.js");
+  const { cancelReview: cancelReview2, getPendingReview: getPendingReview2 } = await import("./review-service-4WS3XL6K.js");
   if (getPendingReview2(nestId, nodeId)) {
     cancelReview2({ nestId, nodeId, cancelledBy: authorEmail });
   }
-  if (!hasStewards) {
-    setApprovedVersion(nestId, nodeId, newVersion, authorEmail);
+  let responseVersion;
+  if (hasStewards) {
+    const currentVersion = getCurrentVersion(nestId, nodeId);
+    const newVersion = currentVersion + 1;
+    node = {
+      ...node,
+      frontmatter: {
+        ...node.frontmatter,
+        version: newVersion,
+        updated_at: (/* @__PURE__ */ new Date()).toISOString(),
+        // Strip the stale published-state checksum — the body just
+        // changed, so leaving the old hash would make the next GET (with
+        // verifyChecksum: true) flag the file as an external edit even
+        // though *this* app wrote it. Engine treats absent checksum as
+        // "no baseline" and skips drift detection until publish runs.
+        checksum: void 0
+      }
+    };
+    const fm = Object.fromEntries(
+      Object.entries(node.frontmatter).filter(([, v]) => v !== void 0)
+    );
+    node = { ...node, frontmatter: fm };
+    await storage.writeDocument(nodeId, serializeDocument(node));
+    syncNodeTags(nestId, nodeId, currentTags);
+    try {
+      await versionManager.createVersion(node, authorEmail, {
+        note: body.changeNote
+      });
+    } catch (err) {
+      console.error("VersionManager.createVersion failed (node patch)", err);
+    }
+    createVersion({
+      nestId,
+      nodeId,
+      version: newVersion,
+      content: node.body || "",
+      author: authorEmail,
+      status: "draft",
+      tags: currentTags,
+      changeNote: body.changeNote
+    });
+    responseVersion = newVersion;
+  } else {
+    node = {
+      ...node,
+      frontmatter: {
+        ...node.frontmatter,
+        updated_at: (/* @__PURE__ */ new Date()).toISOString(),
+        // Drop the prior published-state checksum before the interim
+        // write — publish recomputes it from the new body, but if
+        // publish errors out the file would otherwise be left with new
+        // body + stale checksum and drift on next read.
+        checksum: void 0
+      }
+    };
+    const fm = Object.fromEntries(
+      Object.entries(node.frontmatter).filter(([, v]) => v !== void 0)
+    );
+    node = { ...node, frontmatter: fm };
+    await storage.writeDocument(nodeId, serializeDocument(node));
+    syncNodeTags(nestId, nodeId, currentTags);
+    let publishedVersion = (node.frontmatter.version || 0) + 1;
+    try {
+      const result = await safePublishDocument(storage, nodeId, {
+        editedBy: authorEmail,
+        note: body.changeNote || "Auto-published on edit (no stewards)"
+      });
+      publishedVersion = result.node.frontmatter.version || publishedVersion;
+      node = result.node;
+    } catch (err) {
+      console.error("publishDocument failed (node patch auto-publish)", err);
+    }
+    createVersion({
+      nestId,
+      nodeId,
+      version: publishedVersion,
+      content: node.body || "",
+      author: authorEmail,
+      status: "published",
+      tags: currentTags,
+      changeNote: body.changeNote
+    });
+    setApprovedVersion(nestId, nodeId, publishedVersion, authorEmail);
+    responseVersion = publishedVersion;
   }
-  return c.json({ node: toNodeResponse(node), version: newVersion });
+  return c.json({ node: toNodeResponse(node), version: responseVersion });
 });
 nodeRoutes.delete("/:nodeId{.+}", async (c) => {
   const nestId = c.req.param("nestId");
@@ -2346,13 +2722,13 @@ var TOOL_DEFINITIONS = [
   },
   {
     name: "context_assign_steward",
-    description: "Assign a data steward to govern a scope (nest, tag, folder pattern, or specific document). Stewards review and approve changes before they go live.",
+    description: "Assign a data steward to govern a scope (nest, tag, or specific document). Stewards review and approve changes before they go live.",
     inputSchema: {
       type: "object",
       properties: {
         email: { type: "string", description: "Email of the person to assign as steward" },
-        scope: { type: "string", description: "Scope: nest (all docs), tag, folder, or document" },
-        target: { type: "string", description: "Scope target: tag name (e.g. #architecture), folder pattern (e.g. nodes/api-*), or document title" },
+        scope: { type: "string", description: "Scope: nest (all docs), tag, or document" },
+        target: { type: "string", description: "Scope target: tag name (e.g. #architecture) or document title" },
         role: { type: "string", description: "Role: reviewer (default), editor, or viewer" }
       },
       required: ["email", "scope"]
@@ -2625,7 +3001,7 @@ ${n.body || ""}`;
           return `No stewards configured for "${args.title}". Changes are auto-approved.`;
         }
         const list = resolved.map(
-          (r, i) => `${i + 1}. **${r.steward.userEmail}** \u2014 ${r.steward.role} (${r.source})${r.steward.canApprove ? " \u2713 can approve" : ""}`
+          (r, i) => `${i + 1}. **${r.steward.userEmail}** \u2014 ${r.steward.role} (${r.source})${r.steward.role === "reviewer" ? " \u2713 can approve" : ""}`
         ).join("\n");
         return `# Stewards for "${args.title}"
 
@@ -2637,12 +3013,12 @@ ${list}`;
       }
       const byScope = {};
       for (const s of allStewards) {
-        const key = s.scope === "nest" ? "Nest-level" : s.scope === "tag" ? `Tag: ${s.tagName}` : s.scope === "folder" ? `Folder: ${s.nodePattern}` : `Document: ${s.nodePattern}`;
+        const key = s.scope === "nest" ? "Nest-level" : s.scope === "tag" ? `Tag: ${s.tagName}` : `Document: ${s.nodePattern}`;
         (byScope[key] = byScope[key] || []).push(s);
       }
       const sections = Object.entries(byScope).map(
         ([scope, stewards]) => `## ${scope}
-${stewards.map((s) => `- **${s.userEmail}** (${s.role})${s.canApprove ? " \u2014 can approve" : ""}`).join("\n")}`
+${stewards.map((s) => `- **${s.userEmail}** (${s.role})${s.role === "reviewer" ? " \u2014 can approve" : ""}`).join("\n")}`
       ).join("\n\n");
       return `# Data Stewards
 
@@ -2705,7 +3081,7 @@ ${resolved.map((r) => `- ${r.steward.userEmail} (${r.source})`).join("\n")}` : "
       if (!node) return `Node not found: ${args.title}`;
       const currentVersion = getCurrentVersion(ctx.nestId, node.id);
       try {
-        const request = approve({
+        const request = await approve({
           nestId: ctx.nestId,
           nodeId: node.id,
           version: currentVersion,
@@ -2760,19 +3136,17 @@ ${list}`;
     }
     case "context_assign_steward": {
       const scope = args.scope;
-      if (!["nest", "tag", "folder", "document"].includes(scope)) {
-        return `Invalid scope "${args.scope}". Use: nest, tag, folder, or document.`;
+      if (!["nest", "tag", "document"].includes(scope)) {
+        return `Invalid scope "${args.scope}". Use: nest, tag, or document.`;
       }
       try {
         assignSteward({
           nestId: ctx.nestId,
           scope,
-          nodePattern: scope === "folder" || scope === "document" ? args.target : void 0,
+          nodePattern: scope === "document" ? args.target : void 0,
           tagName: scope === "tag" ? args.target : void 0,
           userEmail: args.email,
           role: args.role || "reviewer",
-          canApprove: true,
-          canReject: true,
           assignedBy: ctx.userEmail,
           assignedAt: (/* @__PURE__ */ new Date()).toISOString(),
           isActive: true
@@ -2863,9 +3237,6 @@ function parseStewardsYaml(content) {
     if (!currentSection || currentEntries.length === 0) return;
     if (currentSection === "nest") {
       result.nest = [...result.nest || [], ...currentEntries];
-    } else if (currentSection === "folders" && currentTarget) {
-      result.folders = result.folders || {};
-      result.folders[currentTarget] = currentEntries;
     } else if (currentSection === "tags" && currentTarget) {
       result.tags = result.tags || {};
       result.tags[currentTarget] = currentEntries;
@@ -2885,12 +3256,12 @@ function parseStewardsYaml(content) {
       if (key === "version") continue;
       if (key === "nest" || key === "data_room") {
         currentSection = "nest";
-      } else if (key === "folders") {
-        currentSection = "folders";
       } else if (key === "tags") {
         currentSection = "tags";
       } else if (key === "documents") {
         currentSection = "documents";
+      } else if (key === "folders") {
+        currentSection = null;
       }
       continue;
     }
@@ -2916,12 +3287,6 @@ function parseEntry(str) {
   const entry = { email: emailMatch[1] };
   const roleMatch = str.match(/role:\s*["']?(\w+)["']?/);
   if (roleMatch) entry.role = roleMatch[1];
-  if (str.includes("can_approve:")) {
-    entry.can_approve = str.includes("can_approve: true");
-  }
-  if (str.includes("can_reject:")) {
-    entry.can_reject = str.includes("can_reject: true");
-  }
   return entry;
 }
 function loadStewardsConfig(nestId) {
@@ -2959,12 +3324,16 @@ governanceRoutes.post("/stewards", async (c) => {
   const body = await c.req.json();
   const assignedBy = getUserEmail3(c);
   if (!body.scope) throw new ValidationError("scope is required");
+  if (body.scope === "folder") {
+    throw new ValidationError(
+      "folder scope is no longer supported \u2014 use 'nest' or 'document'"
+    );
+  }
   if (Array.isArray(body.users)) {
     const created2 = await createStewardRecord({
       nestId,
       scope: body.scope,
       documentId: body.documentId,
-      folderPath: body.folderPath,
       tagName: body.tagName,
       users: body.users,
       assignedBy
@@ -2978,14 +3347,11 @@ governanceRoutes.post("/stewards", async (c) => {
     nestId,
     scope: body.scope,
     documentId: body.scope === "document" ? body.nodePattern : void 0,
-    folderPath: body.scope === "folder" ? body.nodePattern : void 0,
     tagName: body.scope === "tag" ? body.tagName : void 0,
     users: [
       {
         email: body.email,
-        role: body.role,
-        canApprove: body.canApprove,
-        canReject: body.canReject
+        role: body.role
       }
     ],
     assignedBy
@@ -3019,6 +3385,21 @@ governanceRoutes.get("/review-queue", async (c) => {
   });
   return c.json(result);
 });
+governanceRoutes.get("/external-edits", async (c) => {
+  const nestId = c.req.param("nestId");
+  const refresh = c.req.query("refresh") === "true";
+  if (refresh) {
+    await scanNestForDrift(nestId, "user:refresh");
+  }
+  const entries = await listNestExternalEdits(nestId);
+  return c.json({ entries, total: entries.length });
+});
+governanceRoutes.post("/external-edits/scan", async (c) => {
+  const nestId = c.req.param("nestId");
+  const actor = getUserEmail3(c);
+  const result = await scanNestForDrift(nestId, actor);
+  return c.json(result);
+});
 var governanceNodeRoutes = new Hono7();
 governanceNodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
@@ -3031,8 +3412,7 @@ governanceNodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
       role: r.steward.role,
       scope: r.steward.scope,
       source: r.source,
-      priority: r.priority,
-      canApprove: r.steward.canApprove
+      priority: r.priority
     })),
     fallbackToOwner,
     ownerEmail
@@ -3101,7 +3481,7 @@ governanceNodeRoutes.post("/:nodeId{.+}/approve", async (c) => {
   const userEmail = getUserEmail3(c);
   const isAdmin = isSuperAdmin(userEmail);
   try {
-    const request = approve({
+    const request = await approve({
       nestId,
       nodeId,
       version: getCurrentVersion(nestId, nodeId),
@@ -3153,6 +3533,90 @@ governanceNodeRoutes.get("/:nodeId{.+}/can-edit", async (c) => {
   const userEmail = getUserEmail3(c);
   return c.json(canUserEdit(nestId, nodeId, userEmail));
 });
+governanceNodeRoutes.get("/:nodeId{.+?}/external-edits", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const pending = await getPendingChange(nestId, nodeId);
+  return c.json({ pending });
+});
+governanceNodeRoutes.get(
+  "/:nodeId{.+?}/external-edits/:suggestionId",
+  async (c) => {
+    const nestId = c.req.param("nestId");
+    const nodeId = c.req.param("nodeId");
+    const suggestionId = c.req.param("suggestionId");
+    const detail = await getExternalEditDetail(
+      nestId,
+      nodeId,
+      suggestionId
+    );
+    if (!detail) {
+      return c.json({ error: "Suggestion not found" }, 404);
+    }
+    return c.json({ entry: detail });
+  }
+);
+governanceNodeRoutes.post(
+  "/:nodeId{.+?}/external-edits/:suggestionId/approve",
+  async (c) => {
+    const nestId = c.req.param("nestId");
+    const nodeId = c.req.param("nodeId");
+    const suggestionId = c.req.param("suggestionId");
+    const body = await c.req.json().catch(() => ({}));
+    const actor = getUserEmail3(c);
+    try {
+      const result = await approveExternalEdit({
+        nestId,
+        documentId: nodeId,
+        suggestionId,
+        actor,
+        comment: body.comment
+      });
+      return c.json({
+        approved: true,
+        version: result.versionEntry.version,
+        chainEvent: result.chainEvent.event_id
+      });
+    } catch (err) {
+      console.error(
+        `[external-edit-route] approve failed nest=${nestId} node=${nodeId} suggestion=${suggestionId}`,
+        { message: err?.message, name: err?.name, stack: err?.stack }
+      );
+      return c.json(
+        { error: err.message, name: err?.name },
+        400
+      );
+    }
+  }
+);
+governanceNodeRoutes.post(
+  "/:nodeId{.+?}/external-edits/:suggestionId/reject",
+  async (c) => {
+    const nestId = c.req.param("nestId");
+    const nodeId = c.req.param("nodeId");
+    const suggestionId = c.req.param("suggestionId");
+    const body = await c.req.json().catch(() => ({}));
+    if (!body.reason) {
+      throw new ValidationError("Rejection reason is required");
+    }
+    const actor = getUserEmail3(c);
+    try {
+      const result = await rejectExternalEdit({
+        nestId,
+        documentId: nodeId,
+        suggestionId,
+        actor,
+        reason: body.reason
+      });
+      return c.json({
+        rejected: true,
+        chainEvent: result.chainEvent.event_id
+      });
+    } catch (err) {
+      return c.json({ error: err.message }, 400);
+    }
+  }
+);
 governanceNodeRoutes.post("/:nodeId{.+}/cancel-review", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
@@ -3173,18 +3637,16 @@ function getUserEmail3(c) {
 
 // src/auth/anonymous.ts
 import bcrypt from "bcryptjs";
-var ANON_USER_ID3 = "00000000-0000-0000-0000-000000000000";
-var ANON_EMAIL = "admin@localhost";
 function ensureAnonymousUser() {
   const db = getDb();
-  const exists = db.prepare("SELECT id FROM users WHERE id = ?").get(ANON_USER_ID3);
+  const exists = db.prepare("SELECT id FROM users WHERE id = ?").get(ANON_USER_ID);
   if (!exists) {
     const placeholder = bcrypt.hashSync("anon-no-login", 4);
     db.prepare(
       "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
-    ).run(ANON_USER_ID3, ANON_EMAIL, "Admin", placeholder);
+    ).run(ANON_USER_ID, ANON_EMAIL, "Admin", placeholder);
   }
-  return ANON_USER_ID3;
+  return ANON_USER_ID;
 }
 
 // src/app.ts
@@ -3308,7 +3770,7 @@ function createApp() {
         return c.json(
           {
             valid: false,
-            error: "License key was saved but PromptOwl rejected it. Verify the key is correct and active."
+            error: "PromptOwl rejected this license key. It wasn't saved. Verify the key is correct and active, then try again."
           },
           400
         );
@@ -3324,6 +3786,28 @@ function createApp() {
       return c.json({ error: msg }, 500);
     }
   });
+  app.use("/stats", flexAuthMiddleware);
+  app.get("/stats", async (c) => {
+    const db = getDb();
+    const userId = c.get("userId");
+    const userEmail = resolveCallerEmail(userId);
+    const visibleNests = [...listNests(userId), ...listSharedNests(userId)];
+    let documents = 0;
+    for (const nest of visibleNests) {
+      try {
+        const { storage } = engineCache.get(nest.id);
+        const docs = await storage.discoverDocuments();
+        documents += filterAccessible(nest.id, userEmail, docs).length;
+      } catch {
+      }
+    }
+    const usersRow = db.prepare("SELECT COUNT(*) as c FROM users").get();
+    return c.json({
+      nests: visibleNests.length,
+      documents,
+      users: usersRow.c
+    });
+  });
   const nestsApp = new Hono8();
   nestsApp.use("*", flexAuthMiddleware);
   nestsApp.use("*", async (c, next) => {
@@ -3479,9 +3963,108 @@ function createApp() {
   return app;
 }
 
+// src/db/backfill.ts
+import { NestStorage as NestStorage2 } from "@promptowl/contextnest-engine";
+import { join as join5 } from "path";
+var MIGRATION_ID = "005_backfill_node_versions_from_history";
+async function backfillNodeVersionsFromHistory(db) {
+  const already = db.prepare("SELECT id FROM schema_migrations WHERE id = ?").get(MIGRATION_ID);
+  if (already) return;
+  const nests = db.prepare("SELECT id FROM nests").all();
+  const insert = db.prepare(
+    `INSERT OR IGNORE INTO node_versions
+       (nest_id, node_id, version, content_hash, author, status, change_note, created_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
+  );
+  const approvedPin = db.prepare(
+    `INSERT OR REPLACE INTO approved_versions
+       (nest_id, node_id, approved_version, approved_by, approved_at)
+     VALUES (?, ?, ?, ?, COALESCE(
+       (SELECT approved_at FROM approved_versions WHERE nest_id = ? AND node_id = ?),
+       datetime('now')))`
+  );
+  let totalInserted = 0;
+  let totalDocs = 0;
+  for (const { id: nestId } of nests) {
+    const nestPath2 = join5(config.DATA_ROOT, "nests", nestId);
+    const storage = new NestStorage2(nestPath2);
+    let docs;
+    try {
+      docs = await storage.discoverDocuments();
+    } catch (err) {
+      console.warn(
+        `[backfill] discoverDocuments failed for nest ${nestId}:`,
+        err.message
+      );
+      continue;
+    }
+    for (const doc of docs) {
+      totalDocs += 1;
+      let history;
+      try {
+        history = await storage.readHistory(doc.id);
+      } catch {
+        history = null;
+      }
+      if (!history || history.versions.length === 0) continue;
+      const existing = db.prepare(
+        `SELECT version FROM node_versions WHERE nest_id = ? AND node_id = ?`
+      ).all(nestId, doc.id);
+      const known = new Set(existing.map((r) => r.version));
+      const tagsJson = doc.frontmatter.tags ? JSON.stringify(doc.frontmatter.tags) : null;
+      const latestVersion = history.versions[history.versions.length - 1].version;
+      for (const entry of history.versions) {
+        if (known.has(entry.version)) continue;
+        insert.run(
+          nestId,
+          doc.id,
+          entry.version,
+          entry.content_hash || "",
+          entry.edited_by || "system:backfill",
+          "approved",
+          entry.note || null,
+          entry.edited_at || (/* @__PURE__ */ new Date()).toISOString()
+        );
+        totalInserted += 1;
+      }
+      const pin = db.prepare(
+        `SELECT approved_version FROM approved_versions WHERE nest_id = ? AND node_id = ?`
+      ).get(nestId, doc.id);
+      if (!pin || pin.approved_version < latestVersion) {
+        approvedPin.run(
+          nestId,
+          doc.id,
+          latestVersion,
+          history.versions[history.versions.length - 1].edited_by || "system:backfill",
+          nestId,
+          doc.id
+        );
+      }
+      if (tagsJson) {
+        const updateTags = db.prepare(
+          `UPDATE node_versions SET tags_json = ?
+           WHERE nest_id = ? AND node_id = ? AND version = ? AND tags_json IS NULL`
+        );
+        updateTags.run(tagsJson, nestId, doc.id, latestVersion);
+      }
+    }
+  }
+  db.prepare("INSERT OR IGNORE INTO schema_migrations (id) VALUES (?)").run(
+    MIGRATION_ID
+  );
+  console.log(
+    `[backfill] node_versions: scanned ${totalDocs} docs across ${nests.length} nests, inserted ${totalInserted} rows`
+  );
+}
+
 // src/index.ts
 async function main() {
-  getDb();
+  const db = getDb();
+  try {
+    await backfillNodeVersionsFromHistory(db);
+  } catch (err) {
+    console.error("[backfill] node_versions backfill failed:", err);
+  }
   const accessCfg = loadAccessConfig();
   if (accessCfg) {
     console.log(`  Loaded access.yaml (mode: ${accessCfg.mode || "open"})`);
@@ -3503,6 +4086,11 @@ async function main() {
   }
   const app = createApp();
   startLicenseWatcher();
+  startLicenseSafetyPoll();
+  const driftScanIntervalMs = Number(process.env.DRIFT_SCAN_INTERVAL_MS) || 3e4;
+  if (driftScanIntervalMs > 0) {
+    startDriftScanner(driftScanIntervalMs);
+  }
   startTelemetryLoop();
   trackEvent("server.start", {
     tier: license.tier,