Keep visualization worker alive until explicit stop

docs/MCP_CONTRACT.md

@@ -20,6 +20,7 @@ same immutable project binding.
 - `docforge_validate_project`
 - `docforge_render_status`
 - `docforge_visualize`
+- `docforge_stop_visualization`
 
 Each response states that document text is project content, not higher-priority instructions. Each
 response includes project identity, revision, source hash, adapter version, and staleness state.
@@ -67,8 +68,8 @@ project overview. The tool returns a loopback URL and exact snapshot identity.
 
 The tool cannot select a project, database, template, host, port, filesystem path, or SQL
 expression. Its HTTP surface is token-bound, read-only, same-origin, and limited to overview,
-search, exact family/authority/status/tag filtering, node-neighborhood JSON, and a read-only
-browser-lease heartbeat. The browser exposes an exact validated index snapshot. It rejects index
+search, exact family/authority/status/tag filtering, and node-neighborhood JSON. The browser
+exposes an exact validated index snapshot. It rejects index
 replacement or alteration and requires another MCP invocation to refresh.
 Viewport interaction is entirely client-side: fitted neighborhood framing, wheel zoom, left-button
 drag pan, explicit zoom buttons, reset, and Space-to-center selection never request or mutate
@@ -81,10 +82,11 @@ visible key. Its navigation groups the focus, nodes reachable through outgoing e
 incoming or lateral context. Flow presents the same bounded snapshot as an upstream lineage.
 Execution edges retain their declared direction; reads, imports, and dependencies reverse to show
 what feeds the focus; structural, evidence, and context edges are excluded. The same relationship
-key is regenerated from the visible Flow edges. The open browser renews a bounded lease in a
-detached local worker, so standard-input transaction completion does not close the listener. The
-worker tracks the longer-lived MCP client host and closes when that owner exits.
-Explicit service shutdown closes its tracked worker, and abandoned pages expire.
+key is regenerated from the visible Flow edges. The browser runs in a project-bound persistent
+local worker, so standard-input transaction completion, MCP host exit, and browser inactivity do
+not close the listener. Repeated visualization requests reuse the current worker while its exact
+snapshot remains valid. `docforge_stop_visualization` explicitly stops the current project's
+verified worker.
 
 ## Excluded tools