Upgrade generic graph navigation

docs/CONTRACT.md

@@ -23,7 +23,7 @@ approved contract and measured cross-project evidence; it is not an unimplemente
 - Result envelope: `schemas/result.schema.json`, version 1.
 - Changeset schema: `schemas/changeset.schema.json`, version 1.
 - Index schema: version 1, disposable and reproducible.
-- Core, CLI, and MCP server: version 0.7.3.
+- Core, CLI, and MCP server: version 0.8.0.
 
 Schema files describe the generic interchange contract. Runtime validation remains responsible for
 path confinement, source hashing, relationship resolution, dependency cycles, project limits, stale
@@ -86,7 +86,7 @@ deployment, or publication.
 
 ## Project-bound graph visualization
 
-The fixed `docforge_visualize` MCP tool starts one ephemeral read-only graph browser for the
+The fixed `docforge_visualize` MCP tool starts one leased read-only graph browser for the
 server's already-configured project. It accepts only an optional stable node ID, an optional lexical
 query, and a bounded traversal depth. It does not accept a project root, database path, SQL,
 template path, bind address, command, or renderer.
@@ -101,11 +101,11 @@ The HTTP listener binds to `127.0.0.1` on an operating-system-selected port. A c
 random token is part of every accepted URL path. Only `GET` and `HEAD` are supported. Responses use
 no-store caching, a restrictive content-security policy, frame denial, MIME sniffing protection,
 and no-referrer policy. The built-in template uses only same-origin JSON endpoints for graph
-overview, bounded search, exact node content, and bounded incoming-and-outgoing neighborhoods.
-There is no write endpoint, arbitrary query endpoint, static filesystem handler, external asset,
-or project-selection control.
+overview, bounded search, exact node content, bounded incoming-and-outgoing neighborhoods, and one
+lease heartbeat. The heartbeat changes no project or index state. There is no write endpoint,
+arbitrary query endpoint, static filesystem handler, external asset, or project-selection control.
 
-The `graph-browser@4` template provides mouse-wheel zoom centered on the pointer, left-button drag
+The `graph-browser@5` template provides mouse-wheel zoom centered on the pointer, left-button drag
 pan, explicit zoom-in and zoom-out buttons, a reset-view button, and a live zoom percentage. A
 four-pixel drag threshold defers pointer capture and preserves node activation for ordinary clicks.
 Loading another root node resets the viewport so the new neighborhood begins centered and fully
@@ -114,12 +114,25 @@ framed. Empty-canvas guidance is hidden whenever a neighborhood is rendered.
 Activating a graph node opens a modal inspector containing that node's complete validated metadata
 and content. Inspection does not replace the current neighborhood or reset the viewport. The modal
 supports keyboard activation, Escape, explicit close controls, and backdrop dismissal. Loading the
-inspected node as the new root requires the separate Explore neighborhood action.
+inspected node as the new root requires the separate Explore neighborhood action. Both side panels
+support pointer and keyboard resizing. The unblurred modal supports native resizing and constrained
+title-bar dragging.
+
+The browser derives presentation roles only from the returned bounded graph. The current root is
+the primary focus. Nodes reachable through outgoing edges are children. Remaining incoming and
+cross-boundary nodes are edge/context nodes. These roles receive distinct palettes and navigation
+sections. An undirected shortest-hop calculation places nodes on distance rings and darkens each
+role palette progressively, capped at fifty percent. This presentation does not reinterpret,
+replace, or add project relationships.
 
 One MCP process owns at most one listener. Repeated invocations reuse it and may replace its
-validated snapshot only after a fresh index check. The listener stops with the MCP process.
-Project-specific integrations receive the same tool because it operates on the supplied
-`ProjectService` and `ProjectIndex`, not the generic source loader.
+validated snapshot only after a fresh index check. The HTTP worker is non-daemon so standard-input
+transaction completion does not strand an open browser. The page renews a 180-second lease every
+15 seconds and when it becomes visible; a link never opened receives a 120-second startup grace.
+Explicit process termination closes the listener immediately. An abandoned page stops renewing and
+the listener closes after the bounded lease. Project-specific integrations receive the same tool
+because it operates on the supplied `ProjectService` and `ProjectIndex`, not the generic source
+loader.
 
 ## Project adapter boundary
 

docs/MCP_CONTRACT.md

@@ -61,18 +61,21 @@ only through the explicit local CLI integration command.
 
 ## Visualization boundary
 
-`docforge_visualize` starts the fixed built-in `graph-browser@4` template against the currently
+`docforge_visualize` starts the fixed built-in `graph-browser@5` template against the currently
 validated derived index. It may focus one stable node, run one bounded lexical query, or open the
 project overview. The tool returns a loopback URL and exact snapshot identity.
 
 The tool cannot select a project, database, template, host, port, filesystem path, or SQL
 expression. Its HTTP surface is token-bound, read-only, same-origin, and limited to overview,
-search/filter, and node-neighborhood JSON. The browser exposes an exact validated index snapshot.
-It rejects index replacement or alteration and requires another MCP invocation to refresh.
+search/filter, node-neighborhood JSON, and a read-only browser-lease heartbeat. The browser exposes
+an exact validated index snapshot. It rejects index replacement or alteration and requires another
+MCP invocation to refresh.
 Viewport interaction is entirely client-side: wheel zoom, left-button drag pan, explicit zoom
 buttons, and reset never request or mutate project data. Graph-node activation fetches exact node
 data from the same bounded read endpoint and opens a client-side modal inspector. Replacing the
-current root requires the modal's explicit Explore neighborhood action.
+current root requires the modal's explicit Explore neighborhood action. The open browser renews a
+bounded lease so standard-input transaction completion does not close the listener; explicit
+process termination still closes it, and abandoned pages expire.
 
 ## Excluded tools
 

docs/NEW_PROJECT_QUICKSTART.md

@@ -16,7 +16,7 @@ The DocForge repository contains the complete generic CLI and stdio MCP server.
 
 - Project identity, validation, exact-node retrieval, lexical search, and filtering.
 - Backlinks, dependency traversal, impact traversal, and bounded context profiles.
-- `docforge_visualize`, which starts the token-protected, loopback-only `graph-browser@4` viewer.
+- `docforge_visualize`, which starts the token-protected, loopback-only `graph-browser@5` viewer.
   The viewer supports search, family filtering, exact-node inspection, bounded neighborhoods,
   modal inspection without losing the current neighborhood, explicit neighborhood exploration,
   mouse-wheel zoom, left-button drag panning, zoom controls, and viewport reset.
@@ -334,7 +334,8 @@ Place this policy in the project's `AGENTS.md` and adjust the manual path and pr
 - If DocForge reports stale state, missing nodes, invalid edges, or an index mismatch, stop and
   repair or rebuild the graph before claiming the work complete.
 - When asked to “visualize” the project or a node, call `docforge_visualize`. The viewer is
-  loopback-only, read-only, and lives only while the MCP process runs.
+  loopback-only and read-only. An open page renews its bounded lease across short MCP transactions;
+  explicit process termination closes it, and an abandoned page expires automatically.
 ```
 
 The policy is what makes DocForge part of normal development rather than an optional lookup tool.