Add gated changeset application and graph controls

docs/MCP_CONTRACT.md

@@ -6,6 +6,10 @@ configured `--proposal-writer`. It opens no network listener at startup. The exp
 `docforge_visualize` read tool may start one token-protected loopback-only HTTP listener for the
 same immutable project binding.
 
+Canonical application is a second independent startup gate. The generic server accepts
+`--canonical-applier WRITER_ID`. A project adapter must also supply a compatible project-owned
+canonical applier implementation.
+
 ## Read tools
 
 - `docforge_project_info`
@@ -33,8 +37,9 @@ partitioning, and custom context policy remain outside the DocForge core.
 
 An explicit project integration may construct the full fixed surface only after supplying a
 confined proposal policy and startup-bound writer. Adapter proposal validators may narrow the
-writer's declared operations further. They cannot add tools, weaken core changeset validation, or
-enable canonical application.
+writer's declared operations further. They cannot add arbitrary tools or weaken core changeset
+validation. The fixed application tool is registered only through the separate canonical applier
+gate.
 
 ## Isolated proposal tools
 
@@ -54,6 +59,20 @@ change canonical files or declared project output. Without `--proposal-writer`,
 tools return `proposal_access_disabled`. Validation, diff retrieval, and preview remain available
 for existing changesets. A preview accepts a declared view ID, not a renderer name or command.
 
+## Canonical application tool
+
+- `docforge_apply_changeset`
+
+The tool is absent unless canonical application was explicitly enabled at startup. It accepts one
+changeset ID and the exact final changeset SHA-256. It revalidates the current canonical base,
+proposal ownership, node hashes, conflicts, graph, permissions, and paths before invoking the
+configured serializer.
+
+The generic serializer confines staged Markdown/TOML writes to declared content roots and verifies
+that the applied files reproduce the approved graph projection. A mismatch rolls canonical files
+back. A successful apply rebuilds and checks the derived index and regenerates all declared render
+views. It does not run project commands, shell, Git, builds, deployment, or publication.
+
 ## Render boundary
 
 `docforge_render_status` recomputes expected hashes without writing. `docforge_preview_changeset`
@@ -63,13 +82,14 @@ only through the explicit local CLI integration command.
 
 ## Visualization boundary
 
-`docforge_visualize` starts the fixed built-in `graph-browser@11` template against the currently
+`docforge_visualize` starts the fixed built-in `graph-browser@12` template against the currently
 validated derived index. It may focus one stable node, run one bounded lexical query, or open the
 project overview. The tool returns a loopback URL and exact snapshot identity.
 
 The tool cannot select a project, database, template, host, port, filesystem path, or SQL
 expression. Its HTTP surface is token-bound, read-only, same-origin, and limited to overview,
-search, exact family/authority/status/tag filtering, and node-neighborhood JSON. The browser
+search, exact family/authority/status/tag filtering, node-neighborhood JSON, and a bounded
+project-confined source read for one indexed node. The browser
 exposes an exact validated index snapshot. It rejects index
 replacement or alteration and requires another MCP invocation to refresh.
 Viewport interaction is entirely client-side: fitted neighborhood framing, wheel zoom, left-button
@@ -77,7 +97,9 @@ drag pan, explicit zoom buttons, reset, and Space-to-center selection never requ
 project data. Left activation visibly selects the node and opens a compact descriptor card.
 Right-click opens the full inspector. Descriptor-pill activation fills the fixed left panel with an
 exact bounded category result set. The fixed right panel contains neighborhood navigation.
-Replacing the current root requires an explicit Explore neighborhood action. Nodes presents the
+Replacing the current root requires an explicit Explore neighborhood action. Users may hide
+non-focus nodes and restore them entirely client-side. Source actions open the indexed source path
+and navigate to recognized anchors. Nodes presents the
 bounded neighborhood with relation-specific colors, line patterns, directional symbols, and a
 visible key. Its navigation groups the focus, nodes reachable through outgoing edges, and remaining
 incoming or lateral context. Flow presents the same bounded snapshot as an upstream lineage.
@@ -92,14 +114,10 @@ worker only after one hour with no browser activity.
 
 ## Excluded tools
 
-The normal server never exposes shell execution, arbitrary reads or writes, canonical changeset
-application, declared project-output rendering, arbitrary renderer execution, Git mutation, project
-builds, deployment, publication, external HTTP binding, global project selection, or cross-project
-retrieval.
-
-DFG-9 permanently retained manual canonical integration for DocForge 0.x. No application tool is
-planned for MCP. A future local developer workflow may be considered only through a new approved
-contract, and it must not make canonical application reachable from an MCP writer.
+The normal server never exposes shell execution, arbitrary reads or writes, arbitrary renderer
+execution, Git mutation, project builds, deployment, publication, external HTTP binding, global
+project selection, or cross-project retrieval. Without the explicit canonical applier gate, it also
+does not expose canonical application.
 
 DocForge pins the official stable Python MCP SDK to the compatible `mcp>=1.28,<2` release line.
 Migration to a later major release requires a separate contract and protocol compatibility review.