steps 4-6 + doc overhaul: files, notes, GUI, plugins docs

DOCUMENTATION (shift from personal to universal product):
- README.md: rewritten with 'one product, different doors' framing,
  universal entities table, audience segments
- 01_Product_Spec.md: removed personal references (sshkeeper, Godot,
  DokuWiki, servers), added audience segments (freelancer, repairmaster,
  developer, maker, consultant), universal scenarios
- 02_Architecture.md: added 'Plugins (Extensibility)' section with
  calendar/kanban/importer/template examples
- 03_Data_Model_Storage.md: added section 6 on plugin extensibility
  (node_meta, type registry, SQL migrations per plugin)
- 09_Extensibility.md (NEW): full plugin architecture — Lua runtime,
  plugin.json, hooks, sandbox, templates, registry
- PLAN.md: added step 16 (plugins), updated status table
- 00_README.md: rewritten product index with plugin principle

CODE — STEP 4 (Files):
- migration 002: files table (id, node_id, filename, path,
  storage_mode, size, sha256, mime, ...)
- FileService: AddExternal, CopyIntoVault, Get, ListByNode,
  MarkMissing, DeleteToTrash, Open (xdg-open)
- file_test.go: 5 tests (external, copy-vault, list-node,
  delete-trash, MIME guess)

CODE — STEP 5 (Notes):
- migration 003: notes table (node_id PK, file_id, format,
  original_format, encrypted)
- NoteService: Create (node+file+link), Read, Save (with backup to
  .verstak/history/), Delete, Load
- note_test.go: 3 tests (create-read, save-backup, delete)

CODE — STEP 6 (GUI):
- cmd/verstak-gui/main.go: launches GUI server, opens browser
- internal/gui/server.go: HTTP API for nodes/notes/files/search
- internal/gui/index.html.go: full inline SPA frontend (dark theme,
  sidebar tree, cards grid, note editor, search, create modals)
- Navigation: sidebar tree → click node → detail view with
  children + files cards → tab switch (overview/notes/files)
  → create node/note via modal → edit note in fullscreen
  textarea → save (with history backup)

Acceptance: go build ./... pass, go build -tags gui ./cmd/verstak-gui pass,
  go test ./... pass (20+ tests). GUI serves on random port, opens browser.
  API returns JSON for all resource types.

internal/core/files/file.go

@@ -0,0 +1,294 @@
+package files
+
+import (
+	"crypto/sha256"
+	"database/sql"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"time"
+
+	"verstak/internal/core/storage"
+	"verstak/internal/core/util"
+)
+
+// Record represents a file entry linked to a node.
+type Record struct {
+	ID          string     `json:"id"`
+	NodeID      string     `json:"node_id"`
+	Filename    string     `json:"filename"`
+	Path        string     `json:"path"` // relative to vault root
+	StorageMode string     `json:"storage_mode"` // "vault" | "external"
+	Size        int64      `json:"size"`
+	SHA256      string     `json:"sha256,omitempty"`
+	MIME        string     `json:"mime,omitempty"`
+	CreatedAt   time.Time  `json:"created_at"`
+	UpdatedAt   time.Time  `json:"updated_at"`
+	LastSeenAt  *time.Time `json:"last_seen_at,omitempty"`
+	Missing     bool       `json:"missing"`
+}
+
+// Service provides file operations inside a vault.
+type Service struct {
+	db        *storage.DB
+	vaultRoot string
+}
+
+// NewService creates a file service bound to a vault.
+func NewService(db *storage.DB, vaultRoot string) *Service {
+	return &Service{db: db, vaultRoot: vaultRoot}
+}
+
+// DB returns the underlying storage.
+func (s *Service) DB() *storage.DB {
+	return s.db
+}
+
+// --- public operations ---
+
+// AddExternal registers an external file (absolute path) without copying.
+func (s *Service) AddExternal(nodeID, absPath string) (*Record, error) {
+	info, err := os.Stat(absPath)
+	if err != nil {
+		return nil, fmt.Errorf("stat: %w", err)
+	}
+	absPath, _ = filepath.Abs(absPath)
+	return s.insertRecord(nodeID, filepath.Base(absPath), absPath, "external", info.Size(), "")
+}
+
+// CopyIntoVault copies an external file into the vault.
+// The file lands at <vaultRoot>/spaces/<nodeSlug>/<filename>.
+func (s *Service) CopyIntoVault(nodeID, absPath, nodeSlug string) (*Record, error) {
+	info, err := os.Stat(absPath)
+	if err != nil {
+		return nil, fmt.Errorf("stat: %w", err)
+	}
+	if nodeSlug == "" {
+		nodeSlug = nodeID[:8]
+	}
+
+	destDir := filepath.Join(s.vaultRoot, "spaces", nodeSlug)
+	if err := os.MkdirAll(destDir, 0o750); err != nil {
+		return nil, fmt.Errorf("mkdir: %w", err)
+	}
+
+	filename := filepath.Base(absPath)
+	dest := filepath.Join(destDir, filename)
+
+	// If destination exists, add a numeric suffix.
+	if _, err := os.Stat(dest); err == nil {
+		ext := filepath.Ext(filename)
+		name := strings.TrimSuffix(filename, ext)
+		dest = filepath.Join(destDir, fmt.Sprintf("%s_%d%s", name, time.Now().Unix(), ext))
+		filename = filepath.Base(dest)
+	}
+
+	hash, err := copyAndHash(absPath, dest)
+	if err != nil {
+		return nil, fmt.Errorf("copy: %w", err)
+	}
+
+	relPath, _ := filepath.Rel(s.vaultRoot, dest)
+	return s.insertRecord(nodeID, filename, relPath, "vault", info.Size(), hash)
+}
+
+// Get returns a file record by ID.
+func (s *Service) Get(id string) (*Record, error) {
+	row := s.db.QueryRow(
+		`SELECT id,node_id,filename,path,storage_mode,size,sha256,mime,
+			created_at,updated_at,last_seen_at,missing
+		 FROM files WHERE id = ?`, id)
+	return scanRecord(row)
+}
+
+// ListByNode returns all files linked to a node.
+func (s *Service) ListByNode(nodeID string) ([]Record, error) {
+	rows, err := s.db.Query(
+		`SELECT id,node_id,filename,path,storage_mode,size,sha256,mime,
+			created_at,updated_at,last_seen_at,missing
+		 FROM files WHERE node_id = ? ORDER BY created_at`, nodeID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	return scanRecords(rows)
+}
+
+// MarkMissing flags a file as missing.
+func (s *Service) MarkMissing(id string, missing bool) error {
+	m := 0
+	if missing {
+		m = 1
+	}
+	_, err := s.db.Exec(
+		`UPDATE files SET missing=?, updated_at=? WHERE id=?`,
+		m, time.Now().UTC().Format(time.RFC3339), id)
+	return err
+}
+
+// DeleteToTrash moves a vault file to .verstak/trash/ and removes the record.
+func (s *Service) DeleteToTrash(id string) error {
+	rec, err := s.Get(id)
+	if err != nil {
+		return err
+	}
+	if rec.StorageMode == "vault" {
+		src := filepath.Join(s.vaultRoot, rec.Path)
+		trashDir := filepath.Join(s.vaultRoot, ".verstak", "trash")
+		if err := os.MkdirAll(trashDir, 0o750); err != nil {
+			return err
+		}
+		dest := filepath.Join(trashDir, rec.ID+"_"+rec.Filename)
+		if err := os.Rename(src, dest); err != nil {
+			return fmt.Errorf("move to trash: %w", err)
+		}
+	}
+	_, err = s.db.Exec("DELETE FROM files WHERE id=?", id)
+	return err
+}
+
+// Open launches the file with the system default application.
+func (s *Service) Open(id string) error {
+	rec, err := s.Get(id)
+	if err != nil {
+		return err
+	}
+	var abs string
+	if rec.StorageMode == "vault" {
+		abs = filepath.Join(s.vaultRoot, rec.Path)
+	} else {
+		abs = rec.Path
+	}
+	return openWithSystem(abs)
+}
+
+// --- implementation details ---
+
+func (s *Service) insertRecord(nodeID, filename, path, mode string, size int64, sha string) (*Record, error) {
+	rec := &Record{
+		ID:          util.UUID7(),
+		NodeID:      nodeID,
+		Filename:    filename,
+		Path:        path,
+		StorageMode: mode,
+		Size:        size,
+		SHA256:      sha,
+		MIME:        guessMIME(filename),
+		CreatedAt:   time.Now().UTC(),
+		UpdatedAt:   time.Now().UTC(),
+	}
+	_, err := s.db.Exec(
+		`INSERT INTO files (id,node_id,filename,path,storage_mode,size,sha256,mime,
+			created_at,updated_at,missing)
+		 VALUES (?,?,?,?,?,?,?,?,?,?,0)`,
+		rec.ID, rec.NodeID, rec.Filename, rec.Path, rec.StorageMode,
+		rec.Size, rec.SHA256, rec.MIME,
+		rec.CreatedAt.Format(time.RFC3339), rec.UpdatedAt.Format(time.RFC3339))
+	if err != nil {
+		return nil, err
+	}
+	return rec, nil
+}
+
+func copyAndHash(src, dest string) (string, error) {
+	in, err := os.Open(src)
+	if err != nil {
+		return "", err
+	}
+	defer in.Close()
+	out, err := os.Create(dest)
+	if err != nil {
+		return "", err
+	}
+	defer out.Close()
+	h := sha256.New()
+	if _, err := io.Copy(io.MultiWriter(out, h), in); err != nil {
+		return "", err
+	}
+	return fmt.Sprintf("%x", h.Sum(nil)), nil
+}
+
+func guessMIME(filename string) string {
+	ext := strings.ToLower(filepath.Ext(filename))
+	switch ext {
+	case ".md", ".txt", ".go", ".py", ".js", ".ts", ".sh", ".sql", ".yml", ".yaml", ".json", ".toml", ".xml", ".html", ".css", ".csv", ".rst":
+		return "text/plain"
+	case ".png":
+		return "image/png"
+	case ".jpg", ".jpeg":
+		return "image/jpeg"
+	case ".gif":
+		return "image/gif"
+	case ".pdf":
+		return "application/pdf"
+	case ".docx":
+		return "application/vnd.openxmlformats-officedocument.wordprocessingml.document"
+	case ".xlsx":
+		return "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
+	case ".odt":
+		return "application/vnd.oasis.opendocument.text"
+	case ".zip":
+		return "application/zip"
+	}
+	return "application/octet-stream"
+}
+
+func openWithSystem(path string) error {
+	var cmd *exec.Cmd
+	switch runtime.GOOS {
+	case "linux":
+		cmd = exec.Command("xdg-open", path)
+	case "darwin":
+		cmd = exec.Command("open", path)
+	case "windows":
+		cmd = exec.Command("cmd", "/c", "start", "", path)
+	default:
+		return fmt.Errorf("unsupported platform")
+	}
+	return cmd.Start()
+}
+
+// --- scanning helpers ---
+
+type scanFace interface {
+	Scan(dest ...interface{}) error
+}
+
+func scanRecord(s scanFace) (*Record, error) {
+	var r Record
+	var lastSeen sql.NullString
+	var createdStr, updatedStr string
+	err := s.Scan(
+		&r.ID, &r.NodeID, &r.Filename, &r.Path, &r.StorageMode,
+		&r.Size, &r.SHA256, &r.MIME,
+		&createdStr, &updatedStr, &lastSeen, &r.Missing)
+	if err == sql.ErrNoRows {
+		return nil, fmt.Errorf("file not found")
+	}
+	if err != nil {
+		return nil, err
+	}
+	r.CreatedAt, _ = time.Parse(time.RFC3339, createdStr)
+	r.UpdatedAt, _ = time.Parse(time.RFC3339, updatedStr)
+	if lastSeen.Valid {
+		t, _ := time.Parse(time.RFC3339, lastSeen.String)
+		r.LastSeenAt = &t
+	}
+	return &r, nil
+}
+
+func scanRecords(rows *sql.Rows) ([]Record, error) {
+	var out []Record
+	for rows.Next() {
+		r, err := scanRecord(rows)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, *r)
+	}
+	return out, rows.Err()
+}

internal/core/files/file_test.go

@@ -0,0 +1,158 @@
+package files
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"verstak/internal/core/storage"
+)
+
+func openTestDB(t *testing.T) *storage.DB {
+	t.Helper()
+	dir := t.TempDir()
+	db, err := storage.Open(filepath.Join(dir, "test.db"))
+	if err != nil {
+		t.Fatalf("open db: %v", err)
+	}
+	t.Cleanup(func() { db.Close() })
+	return db
+}
+
+func TestAddExternal(t *testing.T) {
+	db := openTestDB(t)
+	// Run migration 002 manually since storage.Open already applied it.
+	// We can verify the table exists by inserting.
+	filesSvc := NewService(db, t.TempDir())
+
+	// Create a real temp file to register.
+	tmpDir := t.TempDir()
+	tmpFile := filepath.Join(tmpDir, "test.txt")
+	if err := os.WriteFile(tmpFile, []byte("hello world"), 0o640); err != nil {
+		t.Fatal(err)
+	}
+
+	rec, err := filesSvc.AddExternal("node-1", tmpFile)
+	if err != nil {
+		t.Fatalf("AddExternal: %v", err)
+	}
+	if rec.ID == "" {
+		t.Fatal("empty id")
+	}
+	if rec.Filename != "test.txt" {
+		t.Errorf("filename = %q", rec.Filename)
+	}
+	if rec.StorageMode != "external" {
+		t.Errorf("mode = %q", rec.StorageMode)
+	}
+	if rec.Size != 11 {
+		t.Errorf("size = %d, want 11", rec.Size)
+	}
+
+	// Verify stored.
+	got, err := filesSvc.Get(rec.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Filename != "test.txt" {
+		t.Errorf("got filename = %q", got.Filename)
+	}
+}
+
+func TestCopyIntoVault(t *testing.T) {
+	db := openTestDB(t)
+	vaultRoot := t.TempDir()
+	svc := NewService(db, vaultRoot)
+
+	// Source file.
+	srcDir := t.TempDir()
+	srcFile := filepath.Join(srcDir, "doc.pdf")
+	os.WriteFile(srcFile, []byte("PDF content here"), 0o640)
+
+	rec, err := svc.CopyIntoVault("node-1", srcFile, "my-node")
+	if err != nil {
+		t.Fatalf("CopyIntoVault: %v", err)
+	}
+	if rec.SHA256 == "" {
+		t.Error("expected sha256")
+	}
+	if rec.StorageMode != "vault" {
+		t.Errorf("mode = %q", rec.StorageMode)
+	}
+
+	// Verify file on disk.
+	if _, err := os.Stat(filepath.Join(vaultRoot, rec.Path)); err != nil {
+		t.Errorf("file on disk: %v", err)
+	}
+}
+
+func TestListByNode(t *testing.T) {
+	db := openTestDB(t)
+	svc := NewService(db, t.TempDir())
+
+	os.WriteFile(filepath.Join(t.TempDir(), "a.txt"), []byte("a"), 0o640)
+	f1 := filepath.Join(t.TempDir(), "a1.txt")
+	f2 := filepath.Join(t.TempDir(), "a2.txt")
+	os.WriteFile(f1, []byte("a"), 0o640)
+	os.WriteFile(f2, []byte("bb"), 0o640)
+
+	svc.AddExternal("node-a", f1)
+	svc.AddExternal("node-a", f2)
+
+	list, err := svc.ListByNode("node-a")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(list) != 2 {
+		t.Errorf("list len = %d, want 2", len(list))
+	}
+}
+
+func TestDeleteToTrash(t *testing.T) {
+	db := openTestDB(t)
+	vaultRoot := t.TempDir()
+	svc := NewService(db, vaultRoot)
+
+	src := filepath.Join(t.TempDir(), "important.pdf")
+	os.WriteFile(src, []byte("important data"), 0o640)
+
+	rec, _ := svc.CopyIntoVault("node-x", src, "node-x")
+
+	if err := svc.DeleteToTrash(rec.ID); err != nil {
+		t.Fatalf("DeleteToTrash: %v", err)
+	}
+
+	// File record should be gone.
+	if _, err := svc.Get(rec.ID); err == nil {
+		t.Error("expected error after trash")
+	}
+
+	// Original file should not exist anymore (moved to trash).
+	if _, err := os.Stat(filepath.Join(vaultRoot, rec.Path)); !os.IsNotExist(err) {
+		t.Error("expected file to be moved from original location")
+	}
+
+	// Trash dir should have it.
+	trashDir := filepath.Join(vaultRoot, ".verstak", "trash")
+	entries, _ := os.ReadDir(trashDir)
+	if len(entries) != 1 {
+		t.Errorf("trash entries = %d, want 1", len(entries))
+	}
+}
+
+func TestGuessMIME(t *testing.T) {
+	cases := map[string]string{
+		"a.md":    "text/plain",
+		"a.png":   "image/png",
+		"a.pdf":   "application/pdf",
+		"a.docx":  "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+		"a.go":    "text/plain",
+		"a.unknown": "application/octet-stream",
+	}
+	for name, want := range cases {
+		got := guessMIME(name)
+		if got != want {
+			t.Errorf("guessMIME(%q) = %q, want %q", name, got, want)
+		}
+	}
+}

internal/core/notes/note.go

@@ -0,0 +1,203 @@
+package notes
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"time"
+
+	"verstak/internal/core/files"
+	"verstak/internal/core/nodes"
+	"verstak/internal/core/storage"
+	"verstak/internal/core/util"
+)
+
+// Record represents a note entry (links a node to a file).
+type Record struct {
+	NodeID    string `json:"node_id"`
+	FileID    string `json:"file_id"`
+	Format    string `json:"format"`
+	Encrypted bool   `json:"encrypted"`
+}
+
+// Service handles markdown notes.
+type Service struct {
+	db        *storage.DB
+	vaultRoot string
+	nodes     *nodes.Repository
+	files     *files.Service
+}
+
+// NewService creates a note service.
+func NewService(db *storage.DB, vaultRoot string, nodeRepo *nodes.Repository, fileSvc *files.Service) *Service {
+	return &Service{db: db, vaultRoot: vaultRoot, nodes: nodeRepo, files: fileSvc}
+}
+
+// Create makes a new note node, an empty .md file, and links them.
+func (s *Service) Create(parentID, title string) (*nodes.Node, *files.Record, error) {
+	node, err := s.nodes.Create(parentID, nodes.TypeNote, title)
+	if err != nil {
+		return nil, nil, fmt.Errorf("create node: %w", err)
+	}
+
+	slug := node.Slug
+	if slug == "" {
+		slug = "note"
+	}
+	filename := slug + ".md"
+	destDir := filepath.Join(s.vaultRoot, "spaces")
+	os.MkdirAll(destDir, 0o750)
+
+	dest := filepath.Join(destDir, filename)
+	if _, err := os.Stat(dest); err == nil {
+		filename = fmt.Sprintf("%s_%s.md", slug, node.ID[:8])
+		dest = filepath.Join(destDir, filename)
+	}
+
+	// Write initial content.
+	if err := os.WriteFile(dest, []byte("# "+title+"\n\n"), 0o640); err != nil {
+		return nil, nil, fmt.Errorf("write: %w", err)
+	}
+
+	// Register file record.
+	relPath, _ := filepath.Rel(s.vaultRoot, dest)
+	fileRec, err := insertFileRecord(s.db, node.ID, filename, relPath, "vault", 0)
+	if err != nil {
+		return nil, nil, fmt.Errorf("insert file: %w", err)
+	}
+
+	// Link.
+	_, err = s.db.Exec(
+		`INSERT INTO notes (node_id, file_id, format) VALUES (?,?,?)`,
+		node.ID, fileRec.ID, "markdown")
+	if err != nil {
+		return nil, nil, fmt.Errorf("link note: %w", err)
+	}
+	return node, fileRec, nil
+}
+
+// Read returns the content of a note.
+func (s *Service) Read(nodeID string) (string, error) {
+	var filePath, storageMode string
+	err := s.db.QueryRow(
+		`SELECT f.path, f.storage_mode
+		 FROM notes n JOIN files f ON n.file_id = f.id
+		 WHERE n.node_id = ?`, nodeID).Scan(&filePath, &storageMode)
+	if err != nil {
+		return "", fmt.Errorf("query note: %w", err)
+	}
+
+	var abs string
+	if storageMode == "vault" {
+		abs = filepath.Join(s.vaultRoot, filePath)
+	} else {
+		abs = filePath
+	}
+	data, err := os.ReadFile(abs)
+	if err != nil {
+		return "", fmt.Errorf("read: %w", err)
+	}
+	return string(data), nil
+}
+
+// Save writes new content, backing up the old version.
+func (s *Service) Save(nodeID, content string) error {
+	var filePath, storageMode string
+	err := s.db.QueryRow(
+		`SELECT f.path, f.storage_mode
+		 FROM notes n JOIN files f ON n.file_id = f.id
+		 WHERE n.node_id = ?`, nodeID).Scan(&filePath, &storageMode)
+	if err != nil {
+		return fmt.Errorf("query: %w", err)
+	}
+
+	var abs string
+	if storageMode == "vault" {
+		abs = filepath.Join(s.vaultRoot, filePath)
+	} else {
+		abs = filePath
+	}
+
+	// Backup old version.
+	if info, err := os.Stat(abs); err == nil && info.Size() > 0 {
+		histDir := filepath.Join(s.vaultRoot, ".verstak", "history")
+		os.MkdirAll(histDir, 0o750)
+		name := filepath.Base(abs)
+		backup := filepath.Join(histDir,
+			fmt.Sprintf("%s_%d.bak", name, time.Now().Unix()))
+		os.WriteFile(backup, mustRead(abs), 0o640)
+	}
+
+	if err := os.WriteFile(abs, []byte(content), 0o640); err != nil {
+		return fmt.Errorf("write: %w", err)
+	}
+
+	// Update file size.
+	info, _ := os.Stat(abs)
+	size := int64(0)
+	if info != nil {
+		size = info.Size()
+	}
+	_, err = s.db.Exec(
+		`UPDATE files SET size=?, updated_at=? WHERE path=? AND storage_mode=?`,
+		size, utcNow(), filePath, storageMode)
+	return err
+}
+
+// Delete soft-deletes the note node.
+func (s *Service) Delete(nodeID string) error {
+	return s.nodes.SoftDelete(nodeID)
+}
+
+// Load looks up the note record for a node.
+func (s *Service) Load(nodeID string) (*Record, error) {
+	var rec Record
+	var enc int
+	err := s.db.QueryRow(
+		`SELECT node_id, file_id, format, encrypted FROM notes WHERE node_id=?`, nodeID,
+	).Scan(&rec.NodeID, &rec.FileID, &rec.Format, &enc)
+	if err != nil {
+		return nil, err
+	}
+	rec.Encrypted = enc == 1
+	return &rec, nil
+}
+
+// --- helpers ---
+
+func insertFileRecord(db *storage.DB, nodeID, filename, relPath, mode string, size int64) (*files.Record, error) {
+	rec := &files.Record{
+		ID:          util.UUID7(),
+		NodeID:      nodeID,
+		Filename:    filename,
+		Path:        relPath,
+		StorageMode: mode,
+		Size:        size,
+		MIME:        "text/plain",
+		CreatedAt:   time.Now().UTC(),
+		UpdatedAt:   time.Now().UTC(),
+	}
+	_, err := db.Exec(
+		`INSERT INTO files (id,node_id,filename,path,storage_mode,size,mime,
+			created_at,updated_at,missing)
+		 VALUES (?,?,?,?,?,?,?,?,?,0)`,
+		rec.ID, rec.NodeID, rec.Filename, rec.Path, rec.StorageMode,
+		rec.Size, rec.MIME,
+		rec.CreatedAt.Format(time.RFC3339), rec.UpdatedAt.Format(time.RFC3339))
+	if err != nil {
+		return nil, err
+	}
+	return rec, nil
+}
+
+func mustRead(path string) []byte {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil
+	}
+	return data
+}
+
+func utcNow() string {
+	return time.Now().UTC().Format(time.RFC3339)
+}

internal/core/notes/note_test.go

@@ -0,0 +1,99 @@
+package notes
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"verstak/internal/core/files"
+	"verstak/internal/core/nodes"
+	"verstak/internal/core/storage"
+)
+
+func setupService(t *testing.T) (*Service, *nodes.Repository, string) {
+	t.Helper()
+	dir := t.TempDir()
+	db, err := storage.Open(filepath.Join(dir, "test.db"))
+	if err != nil {
+		t.Fatalf("open db: %v", err)
+	}
+	t.Cleanup(func() { db.Close() })
+
+	nodeRepo := nodes.NewRepository(db)
+	fileSvc := files.NewService(db, dir)
+	svc := NewService(db, dir, nodeRepo, fileSvc)
+	return svc, nodeRepo, dir
+}
+
+func TestCreateAndRead(t *testing.T) {
+	svc, _, vaultRoot := setupService(t)
+
+	node, fileRec, err := svc.Create("", "My Note")
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	if node.Title != "My Note" {
+		t.Errorf("title = %q", node.Title)
+	}
+	if fileRec == nil || fileRec.ID == "" {
+		t.Fatal("file record missing")
+	}
+
+	// Read initial content.
+	content, err := svc.Read(node.ID)
+	if err != nil {
+		t.Fatalf("Read: %v", err)
+	}
+	if !strings.Contains(content, "My Note") {
+		t.Errorf("content = %q", content)
+	}
+
+	// Verify file on disk.
+	spacesDir := filepath.Join(vaultRoot, "spaces")
+	entries, _ := os.ReadDir(spacesDir)
+	if len(entries) == 0 {
+		t.Error("expected file in spaces/")
+	}
+}
+
+func TestSaveAndBackup(t *testing.T) {
+	svc, _, vaultRoot := setupService(t)
+
+	node, _, _ := svc.Create("", "Backup Test")
+
+	// Save new content.
+	newContent := "# Updated\n\nThis is the new content."
+	if err := svc.Save(node.ID, newContent); err != nil {
+		t.Fatalf("Save: %v", err)
+	}
+
+	// Read back.
+	got, err := svc.Read(node.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != newContent {
+		t.Errorf("content = %q, want %q", got, newContent)
+	}
+
+	// Check backup exists.
+	histDir := filepath.Join(vaultRoot, ".verstak", "history")
+	entries, _ := os.ReadDir(histDir)
+	if len(entries) != 1 {
+		t.Errorf("backup count = %d, want 1", len(entries))
+	}
+}
+
+func TestDeleteNote(t *testing.T) {
+	svc, nodeRepo, _ := setupService(t)
+
+	node, _, _ := svc.Create("", "To Delete")
+	if err := svc.Delete(node.ID); err != nil {
+		t.Fatal(err)
+	}
+
+	if _, err := nodeRepo.GetActive(node.ID); err == nil {
+		t.Error("expected deleted node to be inactive")
+	}
+}

internal/core/storage/migrations_002.sql.go

@@ -0,0 +1,21 @@
+package storage
+
+// migration002 — files table for vault file tracking.
+const migration002 = `
+CREATE TABLE IF NOT EXISTS files (
+    id TEXT PRIMARY KEY,
+    node_id TEXT NOT NULL REFERENCES nodes(id),
+    filename TEXT NOT NULL,
+    path TEXT NOT NULL,
+    storage_mode TEXT NOT NULL DEFAULT 'vault',
+    size INTEGER NOT NULL DEFAULT 0,
+    sha256 TEXT NULL,
+    mime TEXT NULL,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    last_seen_at TEXT NULL,
+    missing INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE INDEX IF NOT EXISTS idx_files_node ON files(node_id);
+`

internal/core/storage/migrations_003.sql.go

@@ -0,0 +1,12 @@
+package storage
+
+// migration003 — notes table.
+const migration003 = `
+CREATE TABLE IF NOT EXISTS notes (
+    node_id TEXT PRIMARY KEY REFERENCES nodes(id),
+    file_id TEXT NOT NULL REFERENCES files(id),
+    format TEXT NOT NULL DEFAULT 'markdown',
+    original_format TEXT NULL,
+    encrypted INTEGER NOT NULL DEFAULT 0
+);
+`

internal/core/storage/storage.go

@@ -58,7 +58,9 @@ CREATE TABLE IF NOT EXISTS _schema_ver (
 
 var migrationFiles = map[int]string{
 	1: migration001,
-	// 2: migration002, etc.
+	2: migration002,
+	3: migration003,
+	// 4: migration004, etc.
 }
 
 func (db *DB) runInitialSchema() error {

internal/gui/index.html.go

@@ -0,0 +1,179 @@
+package gui
+
+// indexHTML is the GUI frontend served inline.
+const indexHTML = `<!DOCTYPE html>
+<html lang="ru">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Верстак</title>
+<style>
+*{box-sizing:border-box;margin:0;padding:0}
+body{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;background:#1a1a2e;color:#ccc;height:100vh;display:flex;overflow:hidden}
+#sb{width:260px;min-width:200px;background:#16213e;border-right:1px solid #0f3460;display:flex;flex-direction:column;overflow:hidden}
+#sb-hdr{padding:14px 16px;font-size:16px;font-weight:700;color:#e94560;border-bottom:1px solid #0f3460;display:flex;justify-content:space-between;align-items:center}
+#sb-hdr button{background:#0f3460;color:#ccc;border:1px solid #1a4080;border-radius:4px;padding:4px 10px;cursor:pointer;font-size:11px}
+#sb-hdr button:hover{background:#1a4080;color:#fff}
+#tree{flex:1;overflow-y:auto;padding:6px 0}
+.ti{padding:5px 14px;cursor:pointer;display:flex;align-items:center;gap:6px;font-size:13px;border-radius:3px;margin:0 4px}
+.ti:hover{background:#0f3460}
+.ti.sel{background:#1a4080;color:#fff}
+.ti .ic{width:14px;color:#e94560;text-align:center;font-size:13px}
+.empty{padding:40px 14px;color:#555;font-size:13px;text-align:center}
+#main{flex:1;display:flex;flex-direction:column;overflow:hidden;min-width:0}
+#mh{padding:10px 20px;border-bottom:1px solid #0f3460;display:flex;justify-content:space-between;align-items:center;gap:10px}
+#mh h1{font-size:17px;font-weight:600;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}
+#mh .acts{display:flex;gap:5px;flex-shrink:0}
+#mh button{background:#0f3460;color:#ccc;border:1px solid #1a4080;border-radius:4px;padding:5px 11px;cursor:pointer;font-size:12px}
+#mh button:hover{background:#1a4080;color:#fff}
+#mh button.p{background:#e94560;border-color:#e94560}
+#mh button.p:hover{background:#c73652}
+#srch{padding:6px 20px;border-bottom:1px solid #0f3460}
+#srch input{width:100%;padding:7px 12px;background:#0f0f23;color:#ccc;border:1px solid #0f3460;border-radius:5px;font-size:13px;outline:none}
+#srch input:focus{border-color:#e94560}
+#tabs{display:flex;padding:0 20px;border-bottom:1px solid #0f3460;gap:0;flex-shrink:0}
+#tabs .t{padding:9px 16px;cursor:pointer;font-size:13px;color:#666;border-bottom:2px solid transparent}
+#tabs .t:hover{color:#ddd}
+#tabs .t.a{color:#e94560;border-bottom-color:#e94560}
+#cnt{flex:1;overflow-y:auto;padding:20px}
+.cg{display:grid;grid-template-columns:repeat(auto-fill,minmax(200px,1fr));gap:12px}
+.card{background:#16213e;border:1px solid #0f3460;border-radius:7px;padding:14px;cursor:pointer;transition:border-color .15s}
+.card:hover{border-color:#e94560}
+.card .ct{font-weight:600;margin-bottom:4px}
+.card .cy{font-size:11px;color:#777;text-transform:uppercase}
+.card .cm{font-size:11px;color:#555;margin-top:6px}
+.bc{font-size:12px;color:#555;margin-bottom:10px}
+#ed{display:none;position:fixed;inset:0;background:#1a1a2e;z-index:90;flex-direction:column}
+#ed-hdr{padding:10px 20px;border-bottom:1px solid #0f3460;display:flex;justify-content:space-between;align-items:center}
+#ed-hdr span{font-size:15px;font-weight:600}
+#ed button{background:#0f3460;color:#ccc;border:1px solid #1a4080;border-radius:4px;padding:5px 12px;cursor:pointer;font-size:12px;margin-left:6px}
+#ed button.p{background:#e94560;border-color:#e94560}
+#ed-ta{flex:1;background:#0f0f23;color:#ccc;border:none;padding:20px;font-family:Consolas,monospace;font-size:13px;line-height:1.7;resize:none;outline:none}
+.mo{display:none;position:fixed;inset:0;background:rgba(0,0,0,.7);z-index:100;align-items:center;justify-content:center}
+.mo.on{display:flex}
+.md{background:#16213e;border:1px solid #0f3460;border-radius:10px;padding:22px;width:400px;max-width:90vw}
+.md h3{margin-bottom:14px;font-size:15px}
+.md label{display:block;font-size:11px;color:#777;margin-bottom:3px;margin-top:10px}
+.md input,.md select{width:100%;padding:7px 10px;background:#0f0f23;color:#ccc;border:1px solid #1a4080;border-radius:4px;font-size:13px;outline:none}
+.md input:focus{border-color:#e94560}
+.md .ma{display:flex;gap:8px;justify-content:flex-end;margin-top:18px}
+.md button{padding:7px 14px;border-radius:4px;border:1px solid #1a4080;background:#0f3460;color:#ccc;cursor:pointer}
+.md button.p{background:#e94560;border-color:#e94560}
+#sr-res{display:none;position:absolute;background:#16213e;border:1px solid #0f3460;border-radius:6px;width:350px;max-height:300px;overflow-y:auto;z-index:50;box-shadow:0 4px 20px rgba(0,0,0,.4)}
+#sr-res .sri{padding:8px 12px;cursor:pointer;font-size:13px;border-bottom:1px solid #0f3460}
+#sr-res .sri:last-child{border-bottom:none}
+#sr-res .sri:hover{background:#0f3460}
+#sr-res .sri .srt{font-size:10px;color:#e94560;text-transform:uppercase}
+ul{list-style:none}
+</style>
+</head>
+<body>
+<div id="sb">
+  <div id="sb-hdr"><span>&#9874; ВЕРСТАК</span><button onclick="showCM()">+</button></div>
+  <div id="tree"><div class="empty">Загрузка...</div></div>
+</div>
+<div id="main">
+  <div id="mh">
+    <h1 id="pt">Верстак</h1>
+    <div class="acts">
+      <button onclick="showCNM()">+ Заметка</button>
+      <button class="p" onclick="showCM()">+ Дело</button>
+    </div>
+  </div>
+  <div id="srch" style="position:relative">
+    <input id="si" placeholder="Поиск по делам..." autocomplete="off" oninput="handleSR(this.value)">
+    <div id="sr-res" style="top:38px;left:0"></div>
+  </div>
+  <div id="tabs">
+    <div class="t a" data-t="ov" onclick="switchTab(this)">Обзор</div>
+    <div class="t" data-t="nt" onclick="switchTab(this)">Заметки</div>
+    <div class="t" data-t="fl" onclick="switchTab(this)">Файлы</div>
+  </div>
+  <div id="cnt"><div class="empty">Выберите дело или создайте новое</div></div>
+</div>
+<div id="ed">
+  <div id="ed-hdr"><span id="et">Редактор</span><div><button onclick="closeED()">Закрыть</button><button class="p" onclick="saveNT()">Сохранить</button></div></div>
+  <textarea id="ed-ta" placeholder="Пишите в Markdown..."></textarea>
+</div>
+<div class="mo" id="cm">
+  <div class="md"><h3>Новое дело</h3>
+  <label>Тип</label><select id="ct"><option value="case">Дело</option><option value="folder">Папка</option><option value="space">Пространство</option><option value="recipe">Рецепт</option></select>
+  <label>Название</label><input id="cn" placeholder="Название...">
+  <div class="ma"><button onclick="closeCM()">Отмена</button><button class="p" onclick="submitCM()">Создать</button></div></div>
+</div>
+<div class="mo" id="cnm">
+  <div class="md"><h3>Новая заметка</h3>
+  <label>Название</label><input id="cnn" placeholder="Название...">
+  <div class="ma"><button onclick="closeCNM()">Отмена</button><button class="p" onclick="submitCNM()">Создать</button></div></div>
+</div>
+<script>
+const A='';let cur='',editId='';
+async function api(p,o){const r=await fetch(A+p,{headers:{'Content-Type':'application/json'},...o});if(!r.ok)throw Error(r.status);return r.json()}
+function esc(s){let d=document.createElement('div');d.textContent=s;return d.innerHTML}
+const ni={case:'&#9670;',folder:'&#9656;',space:'&#9678;',note:'&#9997;',recipe:'&#9672;',document:'&#128196;',file:'&#128206;',action:'&#9889;',secret:'&#128274;',worklog:'&#9201;',link:'&#128279;'};
+async function loadTree(){
+  try{const items=await api('/api/nodes');const t=document.getElementById('tree');
+  if(!items.length){t.innerHTML='<div class="empty">Создайте первое дело</div>';return}
+  let h='<ul>';for(const n of items){h+='<li><div class="ti'+(cur===n.id?' sel':'')+'" onclick="selN(\''+n.id+'\')"><span class="ic">'+(ni[n.type]||'&#9670;')+'</span><span style="overflow:hidden;text-overflow:ellipsis;white-space:nowrap">'+esc(n.title)+'</span></div></li>'}
+  h+='</ul>';t.innerHTML=h}
+  catch(e){document.getElementById('tree').innerHTML='<div class="empty">Ошибка</div>'}
+}
+async function selN(id){
+  cur=id;document.querySelectorAll('.ti').forEach(e=>e.classList.remove('sel'));
+  const d=event.currentTarget;if(d)d.classList.add('sel');
+  try{const d=await api('/api/nodes/'+id);document.getElementById('pt').textContent=d.node.title;renderOV(d)}
+  catch(e){document.getElementById('cnt').innerHTML='<div class="empty">Ошибка</div>'}
+}
+function renderOV(d){const ch=d.children||[],fl=d.files||[];
+  let h='<div class="bc">'+d.node.type+'</div>';
+  if(ch.length||fl.length){h+='<div class="cg">';
+  for(const c of ch){h+='<div class="card" onclick="selN(\''+c.id+'\')"><div class="ct">'+esc(c.title)+'</div><div class="cy">'+c.type+'</div></div>'}
+  for(const f of fl){h+='<div class="card"><div class="ct">'+esc(f.filename)+'</div><div class="cy">'+(f.mime||'file')+'</div><div class="cm">'+fsz(f.size)+'</div></div>'}
+  h+='</div>'}else{h+='<div class="empty" style="margin-top:60px">Пусто. Добавьте заметку или файл.</div>'}
+  document.getElementById('cnt').innerHTML=h
+}
+function fsz(b){if(b<1024)return b+' Б';if(b<1048576)return(b/1024).toFixed(1)+' КБ';return(b/1048576).toFixed(1)+' МБ'}
+function switchTab(el){
+  document.querySelectorAll('#tabs .t').forEach(e=>e.classList.remove('a'));el.classList.add('a');
+  const t=el.dataset.t;if(t==='nt')loadNT();else if(t==='fl')loadFL();else if(cur)selN(cur);
+}
+async function loadNT(){
+  if(!cur){document.getElementById('cnt').innerHTML='<div class="empty">Выберите дело</div>';return}
+  const d=await api('/api/nodes/'+cur);const ns=(d.children||[]).filter(c=>c.type==='note');
+  if(!ns.length){document.getElementById('cnt').innerHTML='<div class="empty">Нет заметок</div>';return}
+  let h='<div class="cg">';for(const n of ns){h+='<div class="card" onclick="openNT(\''+n.id+'\')"><div class="ct">'+esc(n.title)+'</div><div class="cy">заметка</div></div>'}h+='</div>';
+  document.getElementById('cnt').innerHTML=h
+}
+async function loadFL(){
+  if(!cur){document.getElementById('cnt').innerHTML='<div class="empty">Выберите дело</div>';return}
+  const d=(await api('/api/nodes/'+cur)).files||[];
+  if(!d.length){document.getElementById('cnt').innerHTML='<div class="empty">Нет файлов</div>';return}
+  let h='<div class="cg">';for(const f of d){h+='<div class="card"><div class="ct">'+esc(f.filename)+'</div><div class="cy">'+(f.mime||'file')+'</div><div class="cm">'+fsz(f.size)+'</div></div>'}h+='</div>';
+  document.getElementById('cnt').innerHTML=h
+}
+async function openNT(id){editId=id;
+  try{const d=await api('/api/notes/'+id);document.getElementById('et').textContent='Заметка';document.getElementById('ed-ta').value=d.content||'';document.getElementById('ed').style.display='flex';document.getElementById('ed-ta').focus()}
+  catch(e){alert('Ошибка: '+e.message)}
+}
+function closeED(){document.getElementById('ed').style.display='none';editId=''}
+async function saveNT(){if(!editId)return;try{await api('/api/notes/'+editId,{method:'PUT',body:JSON.stringify({content:document.getElementById('ed-ta').value})});closeED();if(cur)selN(cur)}catch(e){alert('Ошибка: '+e.message)}}
+function showCM(){document.getElementById('cm').classList.add('on');setTimeout(()=>document.getElementById('cn').focus(),50)}
+function closeCM(){document.getElementById('cm').classList.remove('on');document.getElementById('cn').value=''}
+async function submitCM(){const t=document.getElementById('ct').value,title=document.getElementById('cn').value.trim();if(!title)return;try{await api('/api/nodes',{method:'POST',body:JSON.stringify({parent_id:cur,type:t,title})});closeCM();loadTree();if(cur)selN(cur)}catch(e){alert('Ошибка: '+e.message)}}
+function showCNM(){document.getElementById('cnm').classList.add('on');setTimeout(()=>document.getElementById('cnn').focus(),50)}
+function closeCNM(){document.getElementById('cnm').classList.remove('on');document.getElementById('cnn').value=''}
+async function submitCNM(){const title=document.getElementById('cnn').value.trim();if(!title)return;try{const n=await api('/api/notes/'+(cur||''),{method:'POST',body:JSON.stringify({parent_id:cur,title})});closeCNM();loadTree();selN(n.id)}catch(e){alert('Ошибка: '+e.message)}}
+let sT=null;
+async function handleSR(q){clearTimeout(sT);const b=document.getElementById('sr-res');
+  if(!q||q.length<2){b.style.display='none';return}
+  sT=setTimeout(async()=>{try{const items=await api('/api/nodes');
+    const hits=items.filter(n=>n.title.toLowerCase().includes(q.toLowerCase()));
+    if(!hits.length){b.style.display='none';return}
+    let h='';for(const r of hits){h+='<div class="sri" onclick="b.style.display=\'none\';selN(\''+r.id+'\')"><div class="srt">'+r.type+'</div><div>'+esc(r.title)+'</div></div>'}
+    b.innerHTML=h;b.style.display='block'
+  }catch(e){b.style.display='none'}},200)}
+document.addEventListener('keydown',e=>{if(e.key==='Escape'){closeED();closeCM();closeCNM();document.getElementById('sr-res').style.display='none'}});
+loadTree();
+</script>
+</body>
+</html>`

internal/gui/server.go

@@ -0,0 +1,249 @@
+package gui
+
+import (
+	"encoding/json"
+	"fmt"
+	"html/template"
+	"log"
+	"net"
+	"net/http"
+	"strings"
+
+	"verstak/internal/core/files"
+	"verstak/internal/core/notes"
+	"verstak/internal/core/nodes"
+	"verstak/internal/core/storage"
+)
+
+// Server is the GUI HTTP server bound to a vault.
+type Server struct {
+	db        *storage.DB
+	vaultRoot string
+	nodes     *nodes.Repository
+	files     *files.Service
+	notes     *notes.Service
+	srv       *http.Server
+	listener  net.Listener
+	port      int
+}
+
+// NewServer creates a GUI server for the given vault.
+func NewServer(db *storage.DB, vaultRoot string) *Server {
+	nodeRepo := nodes.NewRepository(db)
+	fileSvc := files.NewService(db, vaultRoot)
+	noteSvc := notes.NewService(db, vaultRoot, nodeRepo, fileSvc)
+	return &Server{
+		db: db, vaultRoot: vaultRoot,
+		nodes: nodeRepo, files: fileSvc, notes: noteSvc,
+	}
+}
+
+// Start binds on a free port and returns the base URL.
+func (s *Server) Start() (string, error) {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/api/nodes", s.handleNodes)
+	mux.HandleFunc("/api/nodes/", s.handleNodeDetail)
+	mux.HandleFunc("/api/notes/", s.handleNotes)
+	mux.HandleFunc("/api/files/", s.handleFiles)
+	mux.HandleFunc("/api/search", s.handleSearch)
+	mux.HandleFunc("/", s.handleStatic)
+
+	s.srv = &http.Server{Handler: mux}
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		return "", err
+	}
+	s.listener = ln
+	s.port = ln.Addr().(*net.TCPAddr).Port
+	go func() {
+		if e := s.srv.Serve(ln); e != nil && e != http.ErrServerClosed {
+			log.Printf("GUI: %v", e)
+		}
+	}()
+	return fmt.Sprintf("http://127.0.0.1:%d", s.port), nil
+}
+
+// Stop shuts down the server.
+func (s *Server) Stop() error {
+	if s.srv != nil {
+		return s.srv.Close()
+	}
+	return nil
+}
+
+// Addr returns the base URL.
+func (s *Server) Addr() string {
+	return fmt.Sprintf("http://127.0.0.1:%d", s.port)
+}
+
+// --- handlers ---
+
+func (s *Server) handleStatic(w http.ResponseWriter, r *http.Request) {
+	if r.URL.Path != "/" && r.URL.Path != "/index.html" {
+		http.NotFound(w, r)
+		return
+	}
+	t := template.Must(template.New("idx").Parse(indexHTML))
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	t.Execute(w, nil)
+}
+
+func jsonOK(w http.ResponseWriter, v interface{}) {
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(v)
+}
+
+func jsonErr(w http.ResponseWriter, code int, msg string) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(code)
+	json.NewEncoder(w).Encode(map[string]string{"error": msg})
+}
+
+// GET /api/nodes[?parent=ID]  POST /api/nodes
+func (s *Server) handleNodes(w http.ResponseWriter, r *http.Request) {
+	switch r.Method {
+	case "GET":
+		parent := r.URL.Query().Get("parent")
+		var list interface{}
+		var err error
+		if parent == "" {
+			list, err = s.nodes.ListRoots(false)
+		} else {
+			list, err = s.nodes.ListChildren(parent, false)
+		}
+		if err != nil {
+			jsonErr(w, 500, err.Error())
+			return
+		}
+		jsonOK(w, list)
+	case "POST":
+		var req struct {
+			ParentID string `json:"parent_id"`
+			Type     string `json:"type"`
+			Title    string `json:"title"`
+		}
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			jsonErr(w, 400, "bad json")
+			return
+		}
+		n, err := s.nodes.Create(req.ParentID, req.Type, req.Title)
+		if err != nil {
+			jsonErr(w, 500, err.Error())
+			return
+		}
+		jsonOK(w, n)
+	default:
+		jsonErr(w, 405, "method not allowed")
+	}
+}
+
+// GET/PUT/DELETE /api/nodes/{id}
+func (s *Server) handleNodeDetail(w http.ResponseWriter, r *http.Request) {
+	id := strings.TrimPrefix(r.URL.Path, "/api/nodes/")
+	switch r.Method {
+	case "GET":
+		n, err := s.nodes.GetActive(id)
+		if err != nil {
+			jsonErr(w, 404, "not found")
+			return
+		}
+		children, _ := s.nodes.ListChildren(id, false)
+		fl, _ := s.files.ListByNode(id)
+		meta, _ := s.nodes.MetaList(id)
+		jsonOK(w, map[string]interface{}{
+			"node": n, "children": children, "files": fl, "meta": meta,
+		})
+	case "PUT":
+		var req struct {
+			Title    string `json:"title"`
+			ParentID string `json:"parent_id"`
+			Sort     int    `json:"sort_order"`
+		}
+		json.NewDecoder(r.Body).Decode(&req)
+		if req.Title != "" {
+			s.nodes.UpdateTitle(id, req.Title)
+		}
+		if req.ParentID != "" {
+			s.nodes.Move(id, req.ParentID, req.Sort)
+		}
+		jsonOK(w, map[string]string{"status": "ok"})
+	case "DELETE":
+		s.nodes.SoftDelete(id)
+		jsonOK(w, map[string]string{"status": "deleted"})
+	default:
+		jsonErr(w, 405, "method not allowed")
+	}
+}
+
+// POST /api/notes/{parentID}  PUT/GET /api/notes/{nodeID}
+func (s *Server) handleNotes(w http.ResponseWriter, r *http.Request) {
+	path := strings.TrimPrefix(r.URL.Path, "/api/notes/")
+	switch r.Method {
+	case "GET":
+		rec, err := s.notes.Load(path)
+		if err != nil {
+			jsonErr(w, 404, "not found")
+			return
+		}
+		content, _ := s.notes.Read(path)
+		jsonOK(w, map[string]interface{}{"record": rec, "content": content})
+	case "POST":
+		var req struct{ Title string `json:"title"` }
+		json.NewDecoder(r.Body).Decode(&req)
+		n, _, err := s.notes.Create(path, req.Title)
+		if err != nil {
+			jsonErr(w, 500, err.Error())
+			return
+		}
+		jsonOK(w, n)
+	case "PUT":
+		var req struct{ Content string `json:"content"` }
+		json.NewDecoder(r.Body).Decode(&req)
+		if err := s.notes.Save(path, req.Content); err != nil {
+			jsonErr(w, 500, err.Error())
+			return
+		}
+		jsonOK(w, map[string]string{"status": "saved"})
+	default:
+		jsonErr(w, 405, "method not allowed")
+	}
+}
+
+// GET/DELETE /api/files/{id}
+func (s *Server) handleFiles(w http.ResponseWriter, r *http.Request) {
+	id := strings.TrimPrefix(r.URL.Path, "/api/files/")
+	switch r.Method {
+	case "GET":
+		rec, err := s.files.Get(id)
+		if err != nil {
+			jsonErr(w, 404, err.Error())
+			return
+		}
+		jsonOK(w, rec)
+	case "DELETE":
+		if err := s.files.DeleteToTrash(id); err != nil {
+			jsonErr(w, 500, err.Error())
+			return
+		}
+		jsonOK(w, map[string]string{"status": "trashed"})
+	default:
+		jsonErr(w, 405, "method not allowed")
+	}
+}
+
+// GET /api/search?q=...
+func (s *Server) handleSearch(w http.ResponseWriter, r *http.Request) {
+	q := strings.ToLower(r.URL.Query().Get("q"))
+	if len(q) < 2 {
+		jsonOK(w, []interface{}{})
+		return
+	}
+	roots, _ := s.nodes.ListRoots(false)
+	var hits []map[string]interface{}
+	for _, n := range roots {
+		if strings.Contains(strings.ToLower(n.Title), q) {
+			hits = append(hits, map[string]interface{}{"id": n.ID, "title": n.Title, "type": n.Type})
+		}
+	}
+	jsonOK(w, hits)
+}

internal/gui/static/index.html

@@ -0,0 +1,259 @@
+<!DOCTYPE html>
+<html lang="ru">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Верстак</title>
+<style>
+*{box-sizing:border-box;margin:0;padding:0}
+body{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;background:#1a1a2e;color:#e0e0e0;height:100vh;display:flex;overflow:hidden}
+#sb{width:280px;background:#16213e;border-right:1px solid #0f3460;display:flex;flex-direction:column;overflow:hidden;flex-shrink:0}
+#sb-hdr{padding:16px;font-size:18px;font-weight:700;color:#e94560;border-bottom:1px solid #0f3460;display:flex;justify-content:space-between;align-items:center}
+#sb-hdr button{background:#0f3460;color:#e0e0e0;border:1px solid #1a4080;border-radius:4px;padding:4px 10px;cursor:pointer;font-size:12px}
+#sb-hdr button:hover{background:#1a4080}
+#tree{flex:1;overflow-y:auto;padding:8px 0}
+#tree ul{list-style:none}
+#tree li{user-select:none}
+.ti{padding:6px 16px;cursor:pointer;display:flex;align-items:center;gap:8px;font-size:13px;border-radius:4px;margin:1px 6px}
+.ti:hover{background:#0f3460}
+.ti.sel{background:#1a4080;color:#fff}
+.ti .ic{width:16px;text-align:center;color:#e94560;font-size:14px}
+.ti .ar{width:12px;font-size:10px;color:#555}
+.tc{margin-left:18px;border-left:1px dashed #0f3460}
+#main{flex:1;display:flex;flex-direction:column;overflow:hidden;min-width:0}
+#mh{padding:14px 24px;border-bottom:1px solid #0f3460;display:flex;justify-content:space-between;align-items:center;gap:12px}
+#mh h1{font-size:18px;font-weight:600;white-space:overflow:hidden;text-overflow:ellipsis}
+#mh .acts{display:flex;gap:6px;flex-shrink:0}
+#mh button{background:#0f3460;color:#e0e0e0;border:1px solid #1a4080;border-radius:4px;padding:6px 12px;cursor:pointer;font-size:12px}
+#mh button:hover{background:#1a4080}
+#mh button.p{background:#e94560;border-color:#e94560;color:#fff}
+#mh button.p:hover{background:#c73652}
+#tabs{display:flex;padding:0 24px;border-bottom:1px solid #0f3460;flex-shrink:0}
+#tabs .t{padding:10px 18px;cursor:pointer;font-size:13px;color:#888;border-bottom:2px solid transparent;white-space:nowrap}
+#tabs .t:hover{color:#e0e0e0}
+#tabs .t.a{color:#e94560;border-bottom-color:#e94560}
+#srch{padding:8px 24px}
+#srch input{width:100%;padding:8px 12px;background:#0f0f23;color:#e0e0e0;border:1px solid #0f3460;border-radius:6px;font-size:13px;outline:none}
+#srch input:focus{border-color:#e94560}
+#sr-res{display:none;position:absolute;top:100px;left:50%;transform:translateX(-50%);width:400px;max-width:90vw;background:#16213e;border:1px solid #0f3460;border-radius:8px;max-height:350px;overflow-y:auto;z-index:60}
+#sr-res .sri{padding:10px 14px;cursor:pointer;border-bottom:1px solid #0f3460;font-size:13px}
+#sr-res .sri:hover{background:#0f3460}
+#sr-res .sri .srt{font-size:10px;color:#e94560;text-transform:uppercase}
+#cnt{flex:1;overflow-y:auto;padding:24px}
+.bc{font-size:12px;color:#666;margin-bottom:12px}
+.empty{display:flex;align-items:center;justify-content:center;height:100%;color:#555;font-size:15px}
+.cg{display:grid;grid-template-columns:repeat(auto-fill,minmax(200px,1fr));gap:14px}
+.card{background:#16213e;border:1px solid #0f3460;border-radius:8px;padding:14px;cursor:pointer;transition:border-color .15s}
+.card:hover{border-color:#e94560}
+.card .ct{font-weight:600;margin-bottom:4px;font-size:14px}
+.card .cy{font-size:11px;color:#888;text-transform:uppercase}
+.card .cm{font-size:11px;color:#555;margin-top:6px}
+#ed{display:none;position:fixed;inset:0;background:#1a1a2e;z-index:90;flex-direction:column}
+#ed-hdr{padding:12px 24px;border-bottom:1px solid #0f3460;display:flex;justify-content:space-between;align-items:center}
+#ed-hdr span{font-size:16px;font-weight:600}
+#ed button{background:#0f3460;color:#e0e0e0;border:1px solid #1a4080;border-radius:4px;padding:6px 14px;cursor:pointer;font-size:12px}
+#ed button.p{background:#e94560;border-color:#e94560}
+#ed-ta{flex:1;background:#0f0f23;color:#e0e0e0;border:none;padding:24px;font-family:"Fira Code",Consolas,monospace;font-size:14px;line-height:1.7;resize:none;outline:none}
+#ed-ftr{padding:10px 24px;border-top:1px solid #0f3460;display:flex;gap:8px}
+.mo{display:none;position:fixed;inset:0;background:rgba(0,0,0,.7);z-index:100;align-items:center;justify-content:center}
+.mo.on{display:flex}
+.md{background:#16213e;border:1px solid #0f3460;border-radius:12px;padding:24px;width:420px;max-width:90vw}
+.md h3{margin-bottom:16px;font-size:16px}
+.md label{display:block;font-size:12px;color:#888;margin-bottom:4px;margin-top:12px}
+.md input,.md select{width:100%;padding:8px 12px;background:#0f0f23;color:#e0e0e0;border:1px solid #1a4080;border-radius:4px;font-size:14px;outline:none}
+.md input:focus{border-color:#e94560}
+.md .ma{display:flex;gap:8px;justify-content:flex-end;margin-top:20px}
+.md button{padding:8px 16px;border-radius:4px;border:1px solid #1a4080;background:#0f3460;color:#e0e0e0;cursor:pointer}
+.md button.p{background:#e94560;border-color:#e94560;color:#fff}
+</style>
+</head>
+<body>
+
+<div id="sb">
+  <div id="sb-hdr"><span>⚒ ВЕРСТАК</span><button onclick="showCM()">+</button></div>
+  <div id="tree"><div class="empty" style="padding:30px 14px;font-size:13px">Пусто. Создайте первое дело.</div></div>
+</div>
+
+<div id="main">
+  <div id="mh"><h1 id="pt">Верстак</h1><div class="acts">
+    <button onclick="showCNM()">+ Заметка</button>
+    <button onclick="showCM()">+ Дело</button>
+    <button onclick="document.getElementById('fi').click()">+ Файл</button>
+    <input type="file" id="fi" style="display:none" onchange="handleFA(event)">
+  </div></div>
+  <div id="tabs"><div class="t a" onclick="switchTab(this,'ov')">Обзор</div><div class="t" onclick="switchTab(this,'nt')">Заметки</div><div class="t" onclick="switchTab(this,'fl')">Файлы</div></div>
+  <div id="srch"><input id="si" placeholder="Поиск по делам и заметкам..." autocomplete="off" oninput="handleSR(this.value)"></div>
+  <div id="sr-res"></div>
+  <div id="cnt"><div class="empty">Выберите дело или создайте новое</div></div>
+</div>
+
+<div id="ed">
+  <div id="ed-hdr"><span id="et">Редактор</span><div><button onclick="closeED()">✕</button> <button class="p" onclick="saveNT()">💾 Сохранить</button></div></div>
+  <textarea id="ed-ta" placeholder="Пишите в Markdown..."></textarea>
+  <div id="ed-ftr"></div>
+</div>
+
+<div class="mo" id="cm">
+  <div class="md"><h3>Новое дело</h3>
+  <label>Тип</label><select id="ct"><option value="case">◇ Дело</option><option value="folder">▸ Папка</option><option value="space">◎ Пространство</option><option value="recipe">◈ Рецепт</option></select>
+  <label>Название</label><input id="cn" placeholder="Название..." autofocus>
+  <div class="ma"><button onclick="closeCM()">Отмена</button><button class="p" onclick="submitCM()">Создать</button></div></div>
+</div>
+
+<div class="mo" id="cnm">
+  <div class="md"><h3>Новая заметка</h3>
+  <label>Название</label><input id="cnn" placeholder="Название заметки..." autofocus>
+  <div class="ma"><button onclick="closeCNM()">Отмена</button><button class="p" onclick="submitCNM()">Создать</button></div></div>
+</div>
+
+<script>
+const API='';
+let cur='',editId='',tab='ov';
+
+async function api(p,opt){
+  const r=await fetch(API+p,{headers:{'Content-Type':'application/json'},...opt});
+  if(!r.ok)throw new Error(r.status);
+  return r.json();
+}
+
+// tree
+async function loadTree(){
+  try{
+    const items=await api('/api/nodes');
+    const t=document.getElementById('tree');
+    if(!items.length){t.innerHTML='<div class="empty" style="padding:30px 14px;font-size:13px">Пусто. Создайте первое дело.</div>';return}
+    t.innerHTML=renderL(items,'');
+  }catch(e){document.getElementById('tree').innerHTML='<div class="empty" style="padding:30px 14px">Ошибка загрузки</div>'}
+}
+
+function renderL(items,pid){
+  let h='<ul'+(pid?' class="tc"':'')+'>';
+  for(const n of items){
+    h+='<li><div class="ti'+(cur===n.id?' sel':'')+'" data-id="'+n.id+'" onclick="selN(\''+n.id+'\')">';
+    h+='<span class="ar">'+('▸')+'</span><span class="ic">'+nic(n.type)+'</span>';
+    h+='<span style="overflow:hidden;text-overflow:ellipsis;white-space:nowrap">'+esc(n.title)+'</span></div></li>';
+  }
+  h+='</ul>';return h;
+}
+
+function nic(t){const i={case:'◇',folder:'▸',space:'◎',note:'📝',document:'📄',file:'📎',recipe:'◈',action:'⚡',secret:'🔒',worklog:'⏱',link:'🔗'};return i[t]||'◇'}
+function esc(s){const d=document.createElement('div');d.textContent=s;return d.innerHTML}
+
+async function selN(id){
+  cur=id;
+  document.querySelectorAll('.ti').forEach(e=>e.classList.toggle('sel',e.dataset.id===id));
+  try{
+    const d=await api('/api/nodes/'+id);
+    document.getElementById('pt').textContent=d.node.title;
+    renderOV(d);
+  }catch(e){document.getElementById('cnt').innerHTML='<div class="empty">Ошибка</div>'}
+}
+
+function renderOV(d){
+  const ch=d.children||[],fl=d.files||[];
+  let h='<div class="bc">'+(d.node.type||'Дело')+'</div>';
+  if(ch.length||fl.length){
+    h+='<div class="cg">';
+    for(const c of ch){
+      h+='<div class="card" onclick="selN(\''+c.id+'\')"><div class="ct">'+esc(c.title)+'</div><div class="cy">'+c.type+'</div></div>';
+    }
+    for(const f of fl){
+      h+='<div class="card"><div class="ct">📎 '+esc(f.filename)+'</div><div class="cy">'+(f.mime||'file')+'</div><div class="cm">'+fsz(f.size)+'</div></div>';
+    }
+    h+='</div>';
+  } else {
+    h+='<div class="empty" style="margin-top:40px">Пусто. Добавьте заметку или файл.</div>';
+  }
+  document.getElementById('cnt').innerHTML=h;
+}
+
+function fsz(b){if(b<1024)return b+' B';if(b<1048576)return(b/1024).toFixed(1)+' KB';return(b/1048576).toFixed(1)+' MB'}
+
+function switchTab(el,t){
+  document.querySelectorAll('#tabs .t').forEach(e=>e.classList.remove('a'));
+  el.classList.add('a');tab=t;
+  if(t==='ov'&&cur)selN(cur);else if(t==='nt')loadNT();else if(t==='fl')loadFL();
+}
+
+async function loadNT(){
+  if(!cur){document.getElementById('cnt').innerHTML='<div class="empty">Выберите делó</div>';return}
+  const d=await api('/api/nodes/'+cur);
+  const ns=(d.children||[]).filter(c=>c.type==='note');
+  if(!ns.length){document.getElementById('cnt').innerHTML='<div class="empty">Нет заметок. Создайте первую.</div>';return}
+  let h='<div class="cg">';
+  for(const n of ns)h+='<div class="card" onclick="openNT(\''+n.id+'\')"><div class="ct">📝 '+esc(n.title)+'</div><div class="cy">заметка</div></div>';
+  h+='</div>';document.getElementById('cnt').innerHTML=h;
+}
+
+async function loadFL(){
+  if(!cur){document.getElementById('cnt').innerHTML='<div class="empty">Выберите дело</div>';return}
+  const d=await api('/api/nodes/'+cur);
+  const fl=d.files||[];
+  if(!fl.length){document.getElementById('cnt').innerHTML='<div class="empty">Нет файлов</div>';return}
+  let h='<div class="cg">';
+  for(const f of fl)h+='<div class="card"><div class="ct">📎 '+esc(f.filename)+'</div><div class="cy">'+(f.mime||'file')+'</div><div class="cm">'+fsz(f.size)+'</div></div>';
+  h+='</div>';document.getElementById('cnt').innerHTML=h;
+}
+
+// editor
+async function openNT(id){
+  editId=id;
+  try{const d=await api('/api/notes/'+id);document.getElementById('et').textContent='Заметка';document.getElementById('ed-ta').value=d.content||'';document.getElementById('ed').style.display='flex'}
+  catch(e){alert('Ошибка: '+e.message)}
+}
+function closeED(){document.getElementById('ed').style.display='none';editId=''}
+async function saveNT(){
+  if(!editId)return;
+  try{await api('/api/notes/'+editId,{method:'PUT',body:JSON.stringify({content:document.getElementById('ed-ta').value})});closeED();if(cur)selN(cur)}
+  catch(e){alert('Ошибка: '+e.message)}
+}
+
+// modals
+function showCM(){document.getElementById('cm').classList.add('on');document.getElementById('cn').focus()}
+function closeCM(){document.getElementById('cm').classList.remove('on');document.getElementById('cn').value=''}
+async function submitCM(){
+  const type=document.getElementById('ct').value,title=document.getElementById('cn').value.trim();
+  if(!title)return;
+  try{await api('/api/nodes',{method:'POST',body:JSON.stringify({parent_id:cur,type,title})});closeCM();loadTree();if(cur)selN(cur)}
+  catch(e){alert('Ошибка: '+e.message)}
+}
+
+function showCNM(){document.getElementById('cnm').classList.add('on');document.getElementById('cnn').focus()}
+function closeCNM(){document.getElementById('cnm').classList.remove('on');document.getElementById('cnn').value=''}
+async function submitCNM(){
+  const title=document.getElementById('cnn').value.trim();
+  if(!title)return;
+  try{const n=await api('/api/notes/'+(cur||''),{method:'POST',body:JSON.stringify({parent_id:cur,title})});closeCNM();loadTree();selN(n.id);switchTab(document.querySelectorAll('#tabs .t')[1],'nt')}
+  catch(e){alert('Ошибка: '+e.message)}
+}
+
+function handleFA(ev){const f=ev.target.files[0];if(!f)return;alert('MVP: загрузка файлов будет в следующей версии. Файл: '+f.name);ev.target.value=''}
+
+// search
+let sT=null;
+async function handleSR(q){
+  clearTimeout(sT);
+  const b=document.getElementById('sr-res');
+  if(!q||q.length<2){b.style.display='none';return}
+  sT=setTimeout(async()=>{
+    try{
+      // For MVP, fetch all roots and filter locally
+      const items=await api('/api/nodes');
+      const hits=items.filter(n=>n.title.toLowerCase().includes(q.toLowerCase()));
+      if(!hits.length){b.style.display='none';return}
+      let h='';for(const r of hits){h+='<div class="sri" onclick="selN(\''+r.id+'\');b.style.display=\'none\'"><div class="srt">'+r.type+'</div><div>'+esc(r.title)+'</div></div>'}
+      b.innerHTML=h;b.style.display='block';
+    }catch(e){b.style.display='none'}
+  },200);
+}
+
+// keyboard shortcuts
+document.addEventListener('keydown',e=>{
+  if(e.key==='Escape'){closeED();closeCM();closeCNM();document.getElementById('sr-res').style.display='none'}
+  if(e.key==='n'&&(e.ctrlKey||e.metaKey)){e.preventDefault();showCM()}
+});
+
+loadTree();
+</script>
+</body>
+</html>