Upgrade generic graph navigation

docs/CONTRACT.md

@@ -23,7 +23,7 @@ approved contract and measured cross-project evidence; it is not an unimplemente
 - Result envelope: `schemas/result.schema.json`, version 1.
 - Changeset schema: `schemas/changeset.schema.json`, version 1.
 - Index schema: version 1, disposable and reproducible.
-- Core, CLI, and MCP server: version 0.7.3.
+- Core, CLI, and MCP server: version 0.8.0.
 
 Schema files describe the generic interchange contract. Runtime validation remains responsible for
 path confinement, source hashing, relationship resolution, dependency cycles, project limits, stale
@@ -86,7 +86,7 @@ deployment, or publication.
 
 ## Project-bound graph visualization
 
-The fixed `docforge_visualize` MCP tool starts one ephemeral read-only graph browser for the
+The fixed `docforge_visualize` MCP tool starts one leased read-only graph browser for the
 server's already-configured project. It accepts only an optional stable node ID, an optional lexical
 query, and a bounded traversal depth. It does not accept a project root, database path, SQL,
 template path, bind address, command, or renderer.
@@ -101,11 +101,11 @@ The HTTP listener binds to `127.0.0.1` on an operating-system-selected port. A c
 random token is part of every accepted URL path. Only `GET` and `HEAD` are supported. Responses use
 no-store caching, a restrictive content-security policy, frame denial, MIME sniffing protection,
 and no-referrer policy. The built-in template uses only same-origin JSON endpoints for graph
-overview, bounded search, exact node content, and bounded incoming-and-outgoing neighborhoods.
-There is no write endpoint, arbitrary query endpoint, static filesystem handler, external asset,
-or project-selection control.
+overview, bounded search, exact node content, bounded incoming-and-outgoing neighborhoods, and one
+lease heartbeat. The heartbeat changes no project or index state. There is no write endpoint,
+arbitrary query endpoint, static filesystem handler, external asset, or project-selection control.
 
-The `graph-browser@4` template provides mouse-wheel zoom centered on the pointer, left-button drag
+The `graph-browser@5` template provides mouse-wheel zoom centered on the pointer, left-button drag
 pan, explicit zoom-in and zoom-out buttons, a reset-view button, and a live zoom percentage. A
 four-pixel drag threshold defers pointer capture and preserves node activation for ordinary clicks.
 Loading another root node resets the viewport so the new neighborhood begins centered and fully
@@ -114,12 +114,25 @@ framed. Empty-canvas guidance is hidden whenever a neighborhood is rendered.
 Activating a graph node opens a modal inspector containing that node's complete validated metadata
 and content. Inspection does not replace the current neighborhood or reset the viewport. The modal
 supports keyboard activation, Escape, explicit close controls, and backdrop dismissal. Loading the
-inspected node as the new root requires the separate Explore neighborhood action.
+inspected node as the new root requires the separate Explore neighborhood action. Both side panels
+support pointer and keyboard resizing. The unblurred modal supports native resizing and constrained
+title-bar dragging.
+
+The browser derives presentation roles only from the returned bounded graph. The current root is
+the primary focus. Nodes reachable through outgoing edges are children. Remaining incoming and
+cross-boundary nodes are edge/context nodes. These roles receive distinct palettes and navigation
+sections. An undirected shortest-hop calculation places nodes on distance rings and darkens each
+role palette progressively, capped at fifty percent. This presentation does not reinterpret,
+replace, or add project relationships.
 
 One MCP process owns at most one listener. Repeated invocations reuse it and may replace its
-validated snapshot only after a fresh index check. The listener stops with the MCP process.
-Project-specific integrations receive the same tool because it operates on the supplied
-`ProjectService` and `ProjectIndex`, not the generic source loader.
+validated snapshot only after a fresh index check. The HTTP worker is non-daemon so standard-input
+transaction completion does not strand an open browser. The page renews a 180-second lease every
+15 seconds and when it becomes visible; a link never opened receives a 120-second startup grace.
+Explicit process termination closes the listener immediately. An abandoned page stops renewing and
+the listener closes after the bounded lease. Project-specific integrations receive the same tool
+because it operates on the supplied `ProjectService` and `ProjectIndex`, not the generic source
+loader.
 
 ## Project adapter boundary