@rubytech/create-maxy-code 0.1.316 → 0.1.318

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:4c25ba31f010fd3042621f035682a6df66d7ec88011a11984ef197f056a61b60
+content-hash: sha256:cf1810647052f471dbe16bc2ab5b2704ff25b43d06fc4246471c3b963302965c
 brand: maxy-code
 product-name: Maxy
 ---
@@ -2320,10 +2320,12 @@ either is a regression.
 
 **`/chat` empty-state greeting panel.** While the admin webchat has no conversation JSONL yet (`GET /api/webchat/session` → `projectDir:null`), `app/chat/page.tsx` renders a "What's up next, {givenName}?" greeting (given name = first whitespace token of the admin session's `userName`) above two read-only lists from `GET /api/webchat/greeting` (`server/routes/webchat-greeting.ts`, `requireAdminSession`-gated, `accountId`-scoped): the next 5 upcoming `:Event` rows (`eventStatus IN ['scheduled','due']`, future `COALESCE(nextRun, startDate)`, soonest first) and the outstanding `:Task` rows (`status IN ['pending','active','running']`, 5 shown + `+N more`). Read failure returns HTTP 200 `{ ok: false }` and the page shows the headline alone — the panel never blocks the composer. A third section, **Your specialists**, shows the account's installed roster — every `*.md` under `data/accounts/<accountId>/specialists/agents/`, core and `--`-prefixed premium files alike — shown by frontmatter `name` + `summary` (fallback `description`), empty dir → "No specialists installed". The roster read (`app/lib/claude-agent/specialist-roster.ts`) is isolated from the graph fallback: malformed files are skipped (`op=specialist-skipped file=<name> reason=<…>`), a whole-roster failure degrades to `specialists: []` inside the `ok: true` payload (`op=specialists-read-failed`). Logs: `[webchat:greeting] op=read account=<id8> events=<n> tasks=<n> specialists=<n> ms=<n>` / `op=read-failed reason=…`; client warns `[admin-ui] greeting-unavailable …`. The full webchat architecture lives in `.docs/admin-webchat-native-channel.md`.
 
-**`/chat` Claude-desktop transcript presentation.** The admin webchat keeps the shared `Transcript` shell (stream, follow-tail) but injects a /chat-only item renderer via the component's optional `renderItems` prop: `renderChatTimeline` in `app/chat/transcript-render.tsx`. Presentation: operator turns render as a right-aligned grey bubble showing the message text and, beneath it, a subtle always-visible time-of-day stamp (no label); delivered agent replies render as plain prose with the same time-of-day stamp beneath (the reply-document filename line stays, as prose); the stamp is HH:MM from the turn's `ts` (locale-formatted, right-aligned inside the operator bubble, left-aligned under agent prose), and a turn whose `ts` is null/unparseable shows no stamp, never an empty line — so only delivered operator and agent-reply turns are stamped, while tool runs, the collapsed "Thinking" block, and the agent-error banner stay time-free; a maximal consecutive run of `tool-call`/`tool-result` turns renders as one collapsed grey one-liner ("Used N tools ›") whose expansion shows every call and result payload — a lone call still gets the one-liner, and prose or a directive row ends a run. The WhatsApp reader (`/whatsapp`) omits the prop and keeps the default `renderTimeline`, so its rendering is unchanged; both presentations are test-pinned (`app/whatsapp/__tests__/Transcript-*.test.tsx` unmodified, `app/chat/__tests__/transcript-render.test.tsx` new).
+**`/chat` Claude-desktop transcript presentation.** The admin webchat keeps the shared `Transcript` shell (stream, follow-tail) but injects a /chat-only item renderer via the component's optional `renderItems` prop: `renderChatTimeline` in `app/chat/transcript-render.tsx`. Presentation: operator turns render as a right-aligned grey bubble showing the message text and, beneath it, a subtle always-visible time-of-day stamp (no label); delivered agent replies render as plain prose with the same time-of-day stamp beneath (the reply-document filename line stays, as prose); the stamp is HH:MM from the turn's `ts` (locale-formatted, right-aligned inside the operator bubble, left-aligned under agent prose), and a turn whose `ts` is null/unparseable shows no stamp, never an empty line — so only delivered operator and agent-reply turns are stamped, while tool runs, the collapsed "Thinking" block, and the agent-error banner stay time-free; a maximal consecutive run of `tool-call`/`tool-result` turns renders as one collapsed grey one-liner ("Used N tools ›") whose expansion shows every call and result payload — a lone call still gets the one-liner, and prose or a directive row ends a run. The WhatsApp reader (`/whatsapp`) omits the prop and keeps the default `renderTimeline`, so its rendering is unchanged; both presentations are test-pinned (`app/whatsapp/__tests__/Transcript-*.test.tsx`, `app/chat/__tests__/transcript-render.test.tsx`). **Day-divider:** both renderers insert a centered `.day-divider` row between two consecutive timeline items on different local calendar days (label `Today`/`Yesterday`, else `Sat 14 Jun 2026`), so a thread spanning midnight is never an ambiguous run of HH:MM; the first dated item gets a leading divider, a null/unparseable `ts` marks no boundary, dividers are computed over the filtered `visibleItems`, and in `/chat` a day crossover flushes any open tool/think run first so a collapsed run never spans it. Per-bubble HH:MM stamps are unchanged. Shared helpers `dayKey`/`dayLabel`/`itemTs`/`DayDivider` live in `app/whatsapp/Transcript.tsx`.
 
 **maxy title for public sessions.** A `role=public` webchat spawn never produces a useful Claude Code `ai-title` (an anonymous one-line visitor turn), so every public row would otherwise read identically. The webchat route (`chat.ts`) composes a deterministic title — `Web · <senderId[:8]>[ · <personId>] · <UTC YYYY-MM-DD HH:mm>` (personId present only for gated visitors) — and threads it through the native webchat gateway's public spawn (`handleInbound` → `buildPublicWebchatSpawnRequest` → `managerSpawn`) to the manager `POST /public-spawn` body as `name`. `/spawn` validates it with `validateUserTitle` and, for `role=public` only, writes it into `UserTitleStore` so it occupies the operator-rename tier and wins over `ai-title`. Admin (`/rc-spawn`) and WhatsApp titling are unchanged. Observability: every public spawn logs `[spawn] role=public … title="…"` (or `title=missing`); the manager's row builder emits `[public-title] sessionId=… unexpected titleSource=<ai|null>` on the next list read for any public row that did not resolve from the user tier.
 
+**Public visitor surface.** The public-host root (`GET /`), the `/:slug` agent routes, and the admin-host `/public` / `/public-chat` previews all serve one shell, `public.html` → [`app/public-entry.tsx`](../../../ui/app/public-entry.tsx) → `PublicChat`. `PublicChat` reuses `useSession` purely as the magic-link gatekeeper — it drives `AccessGate`, resolves the agent slug from the path, and handles `?token=` verification; once the grant is satisfied it mounts `ChatSurface variant="public"`, whose transcript reads the visitor-scoped, **delivered-only** stream `GET /api/public-reader/stream` ([`server/routes/public-reader.ts`](../../../ui/server/routes/public-reader.ts)) — the visitor sees the agent's delivered prose, never the tool/tool-result/directive bytes the legacy `/api/chat` SSE render exposed. Branding is resolved client-side by `useSession`, so the server hands back the bare shell with no per-agent HTML injection. There is exactly one public client surface and it is 1:1 visitor↔agent: the earlier `?surface=next` A/B handle is retired, group messaging is retired (not a supported product surface), and a former `/g/<slug>` group URL now serves the same 1:1 shell — a stale bookmark gets the 1:1 chat, never a broken render.
+
 ### Graph
 
 | Mount | Purpose |
@@ -2569,7 +2571,7 @@ authoritative. This section names the surfaces and what backs each.
 | Nav rows (Chat / People / Agents / Projects / Tasks / Artefacts) | People, Agents, Tasks open the artefact-pane Graph filtered to the matching label. Chat selects the active conversation. Artefacts swaps the list to editable documents. | `graph-search.ts`, `graph-subgraph.ts`, `sidebar-artefacts.ts` |
 | Sessions list (Active / Archived / All) | Live row store driven by SSE; manual reconcile button on the segmented control re-fetches the full id set. Every listed row carries two launch actions: the claude.ai/code resume (`ExternalLink`) and a chat-launch (`MessageSquare`) that opens `/chat?session=<full sessionId>` — the admin webchat pointed at that exact session; sending there resumes a stopped session with the webchat channel bound to that id (see `admin-webchat-native-channel.md`, "Session-targeted mode"). At the ≤720 px drawer breakpoint each row stacks into two lines — dot + title + id/stamp, then the action icons — with a divider between rows and actions at full opacity (the desktop hover-gated 0.5 opacity never resolves on touch). Below a 400 px list width each row's action icons collapse to a single `MoreHorizontal` ellipsis trigger; its popover menu lists the same actions as the inline icons but labels them with concise verbs (`Resume in claude.ai/code`, `Open in webchat`, `Stop`, `Archive` / `Unarchive`, `Rename`, `Delete`, `Re-seat`) rather than the inline icon buttons' verbose per-session aria-labels — the inline buttons keep those verbose labels because an icon-only control needs the full descriptive accessible name. **Re-seat:** Re-seat is a member action of the one `SessionRowActions` cluster, not a separate sibling control — wide it is the sliders icon inline with the other icons (sharing the cluster geometry and alignment); collapsed it is the `Re-seat` menu item, which expands the model/mode/effort form inline inside the overflow menu. The form (`SessionReseatControl`) forks the session via `/api/admin/session-reseat` and navigates to the fork (the same fork mechanism `/chat`'s pickers drive); its model picker defaults to the row's current model (a `model` field on each row, read from the JSONL tail), and mode and effort each carry a "Keep" option that omits the field. The overflow menu and the Re-seat form render through a `document.body` portal, fixed-positioned from the trigger's rect (right-aligned, flipped above the trigger when there is no room below), so neither is clipped by `.side-list`'s `overflow-y:auto`; Escape, a pointerdown outside the trigger/popover, and any scroll or resize dismiss them. | `/claude-sessions/events`, `/claude-sessions`, `/session-reseat` |
 | Channel reader nav rows (WhatsApp / Telegram) | One conditional nav row **per interactive channel that has ≥1 admin session**. Each row carries its brand glyph (WhatsApp `#25D366`, Telegram `#229ED9`); a channel with no admin session shows no row, and no install ever shows an always-empty "No conversations" row. The channel list loads **once on sidebar mount** (the per-channel counts must be known before the nav renders), so a failed load shows one muted, non-clickable line instead of channel rows. Clicking a channel row lists that channel's admin conversations; each conversation row shows a **display name** resolved by precedence `operatorName ?? whatsappName ?? senderId ?? title`: the bound `Person givenName familyName` when a `senderId`→`userId` binding exists, else the persisted WhatsApp display name (`pushName`, read from the latest `:Message:WhatsAppMessage.senderName`), else the raw `senderId`, else the agent title; the agent session title is the hover tooltip only. Under the name each row shows a **last-message-time breadcrumb** (`conv-timestamp`, same markup as the Sessions rows) formatted from the row's `lastMessageAt` (the last parseable turn's `ts`); a session with no parseable turn shows no time, never "Invalid Date". **Re-seat:** each channel conversation row carries a `SessionRowActions` cluster whose sole action is Re-seat (the row is a `conv-with-actions` shell whose open click moved onto an inner button so the cluster can sit beside it), so a WhatsApp/Telegram session's model/mode/effort is re-seatable from the dashboard exactly like a webchat row — wide it is the inline sliders icon, and below the 400 px width it folds into the `…` overflow menu identically to the Sessions rows; the channel reader row carries the same `model` field for the picker default. A click on a conversation **opens its transcript on the home surface**: on `/` it selects in place, and from any other route (`/graph`, `/data`, `/browser`) it navigates to `/?wa=<sessionId>&projectDir=<dir>`, which the root shell hydrates on mount (then strips the query so a later refresh does not re-pin a closed conversation). Server logs `[wa-reader] op=operator-name-fallback senderId=… source=whatsapp-pushname` when the pushName fallback fires and `[wa-reader] op=conversations count=<n> withTimestamp=<m>` per list build; the client logs `[admin-ui] wa-open route=… via=<in-place\|navigate> …` and `[admin-ui] wa-hydrate route=/ …`. | `/whatsapp-reader/conversations` |
-| Channel transcript (`<Transcript>`) | Reads one session's JSONL over SSE (`/whatsapp-reader/stream`) and renders both sides plus tool calls — the turns claude.ai/code hides because channel inbound is stamped `isMeta`. Every turn shows its time-of-day (HH:MM from the turn's `ts`; a null/unparseable `ts` shows no time, never "Invalid Date"). `tool-call`/`tool-result` turns render as **collapsed cards** (chevron + label + time, default collapsed, expandable per card; one card's state never affects another) so the human↔agent text is not buried in JSON; the three conversation kinds always render in full. The thread **follows the tail**: it opens at the newest turn and pins to the bottom on each live append **only while the operator is already within 32 px of the bottom** — a scroll up suppresses the jump so reading history is never yanked. While the operator is scrolled up a **jump-to-bottom control** (`.wa-jump`, bottom-right of the viewport) appears; clicking it scrolls to the newest turn and re-arms follow-tail, and it hides again at the bottom. The thread scrolls inside its grid cell (header/sidebar/footer fixed). The stream sends a 20 s heartbeat so an idle Cloudflare tunnel does not idle-drop, tags each frame with a byte-offset `id:`, and resumes from the client's `Last-Event-ID` on reconnect (no duplicate backlog); the client clears the "Stream disconnected" banner on reopen and latches it only on a terminal CLOSED state. The thread also interleaves a collapsed `⚙ directive injected (N B)` row per turn, sorted by timestamp just before the turn it informed; expanding one fetches the exact stored `prompt-optimiser-directive` bytes for that turn. The entries are listed by `GET /whatsapp-reader/directives?sessionId=` and the bytes served by `GET /whatsapp-reader/directive?sessionId=&name=`, both admin-gated and account-scoped; a missing store degrades to no rows. | `/whatsapp-reader/stream`, `/whatsapp-reader/directives`, `/whatsapp-reader/directive` |
+| Channel transcript (`<Transcript>`) | Reads one session's JSONL over SSE (`/whatsapp-reader/stream`) and renders both sides plus tool calls — the turns claude.ai/code hides because channel inbound is stamped `isMeta`. Every turn shows its time-of-day (HH:MM from the turn's `ts`; a null/unparseable `ts` shows no time, never "Invalid Date"). `tool-call`/`tool-result` turns render as **collapsed cards** (chevron + label + time, default collapsed, expandable per card; one card's state never affects another) so the human↔agent text is not buried in JSON; the three conversation kinds always render in full. The thread **follows the tail**: it opens at the newest turn and pins to the bottom on each live append **only while the operator is already within 32 px of the bottom** — a scroll up suppresses the jump so reading history is never yanked. While the operator is scrolled up a **jump-to-bottom control** (`.wa-jump`, bottom-right of the viewport) appears; clicking it scrolls to the newest turn and re-arms follow-tail, and it hides again at the bottom. The thread scrolls inside its grid cell (header/sidebar/footer fixed). The stream sends a 20 s heartbeat so an idle Cloudflare tunnel does not idle-drop, tags each frame with a byte-offset `id:`, and resumes from the client's `Last-Event-ID` on reconnect (no duplicate backlog); the client clears the "Stream disconnected" banner on reopen and latches it only on a terminal CLOSED state. The thread also interleaves a collapsed `⚙ directive injected (N B)` row per turn, sorted by timestamp just before the turn it informed; expanding one fetches the exact stored `prompt-optimiser-directive` bytes for that turn. The entries are listed by `GET /whatsapp-reader/directives?sessionId=` and the bytes served by `GET /whatsapp-reader/directive?sessionId=&name=`, both admin-gated and account-scoped; a missing store degrades to no rows. A centered day-divider row (`.day-divider`) marks each local calendar-day crossover between consecutive turns so a thread spanning midnight is unambiguous. | `/whatsapp-reader/stream`, `/whatsapp-reader/directives`, `/whatsapp-reader/directive` |
 | Conversations row hover actions | Inline rename, archive, delete, JSONL view / download per row. The historical `.conversations-modal` CSS block exists in `globals.css` but is no longer mounted from any TSX — Sidebar.tsx now owns every per-row affordance directly. | `claude-sessions.ts` |
 | Artefacts list | Lists every `:FileArtifact` under this account's tree (`relativePath STARTS WITH 'accounts/'`, all file types, excluding the `uploads/<id>/` subtree) plus this account's IDENTITY / SOUL / KNOWLEDGE / specialist templates. Click downloads the row's backing file (`downloadPath` → `GET /api/admin/files/download`) so the operator opens it in their local app; rows whose file is outside `DATA_ROOT` (bundled-fallback templates) show a "can't be downloaded" pill. The in-app artefact pane is dead pending removal. | `sidebar-artefacts.ts`, `files.ts` |
 | System-stats widget | CPU / RAM widget at the foot of the sidebar. | `system-stats.ts` (see above) |
@@ -3241,15 +3243,22 @@ The admin agent runs via Claude Code CLI, which manages its own system prompt as
 
 This is assembled as a `<previous-context>` block in the system prompt on each admin turn.
 
-### Public-agent memory context (retired)
+### Public-agent memory context
 
 Public agents historically had their memory context injected by a server-side bridge
 (`fetchMemoryContext`) that spawned the memory MCP server with `ALLOWED_SCOPES=public,shared`
-and ran a `memory-search` on the agent's behalf. That bridge has been removed: public agents
-are now toolless (`buildPublicDeny` denies `mcp__memory__*`), so neither the agent nor a
-server-side proxy runs a public-scope memory read. The public-scope fulltext index that this
-path ranked against was retired alongside it. Restoring read-back for gated visitors is
-tracked separately — see the gated-public-agents doc.
+and ran a `memory-search` on the agent's behalf. That bridge was removed: public agents
+are toolless (`buildPublicDeny` denies `mcp__memory__*`), so neither the agent nor a
+server-side proxy runs a public-scope memory search, and the public-scope fulltext index that
+path ranked against was retired alongside it.
+
+A gated visitor's per-visitor memory still reaches their next conversation, without any tool
+and without reopening the ringfence. The session-end reviewer writes per-visitor slice nodes
+(`{sliceToken, scope:'user'}`); at the next gated spawn the UI process fetches that visitor's
+own `scope:'user'` slice nodes (a slice-pinned read, not a public-scope search), renders them
+to a `<previous-context>` block, and threads it through the public spawn body so the manager
+appends it to the agent's system prompt. Only the visitor's own slice is read; open-mode
+visitors, admins, and first visits inject nothing.
 
 ---
 
@@ -3317,7 +3326,7 @@ The Claude Code SDK marks every MCP tool as **deferred** by default. The model c
 
 The SDK's per-tool override is `_meta["anthropic/alwaysLoad"]: true` on each MCP tool's `tools/list` entry. Two surfaces apply it:
 
-1. **In-process plugins.** Every admin-eager tool is registered via `eagerTool(server, name, description, inputSchema, handler)` from `platform/lib/mcp-eager/` instead of `server.tool(...)`. The helper calls `server.registerTool` with the `_meta` flag set.
+1. **In-process plugins.** Every admin-eager tool is registered via `eagerTool(server, name, description, inputSchema, handler)` from `platform/lib/mcp-eager/` instead of `server.tool(...)`. The helper calls `server.registerTool` with the `_meta` flag set. Both `eagerTool` and the non-eager `lifelineTool` (from `platform/lib/mcp-lifeline/`) wrap the handler with `wrapWithLifeline`, which emits a structured `op=request`/`op=result` log pair per call including a holdings census — see `.docs/mcp-helper-observability.md` "Tool-call lifeline".
 2. **Upstream graph proxy.** The upstream Python `mcp-neo4j-cypher` server has no `_meta` channel, so `platform/lib/graph-mcp/src/index.ts` intercepts every `tools/list` response on the wire and injects `_meta["anthropic/alwaysLoad"]: true` into each tool entry. The `[graph-mcp] tools/list eager-flagged count=<N>` stderr line confirms the injection fired.
 
 **Curation rule.** Every MCP tool the admin agent calls routinely should be eager — registered via `eagerTool` (or arriving through the graph-mcp interceptor). Whether a tool is eager is decided at its registration site in the plugin's MCP `index.ts` (`eagerTool` vs `server.tool`); there is no separate allow-list constant. Admin-skill / specialist / public-agent tools that stay on `server.tool()` pay the ToolSearch tax only when their caller invokes them. The admin tool surface (`toolSurface.admin`, the `adminAllowlist: true` set) is the intended eager set; a routinely-called admin tool left on `server.tool()` is a gap to fix at the registration site.

package/payload/platform/plugins/docs/references/admin-ui.md

@@ -55,10 +55,12 @@ either is a regression.
 
 **`/chat` empty-state greeting panel.** While the admin webchat has no conversation JSONL yet (`GET /api/webchat/session` → `projectDir:null`), `app/chat/page.tsx` renders a "What's up next, {givenName}?" greeting (given name = first whitespace token of the admin session's `userName`) above two read-only lists from `GET /api/webchat/greeting` (`server/routes/webchat-greeting.ts`, `requireAdminSession`-gated, `accountId`-scoped): the next 5 upcoming `:Event` rows (`eventStatus IN ['scheduled','due']`, future `COALESCE(nextRun, startDate)`, soonest first) and the outstanding `:Task` rows (`status IN ['pending','active','running']`, 5 shown + `+N more`). Read failure returns HTTP 200 `{ ok: false }` and the page shows the headline alone — the panel never blocks the composer. A third section, **Your specialists**, shows the account's installed roster — every `*.md` under `data/accounts/<accountId>/specialists/agents/`, core and `--`-prefixed premium files alike — shown by frontmatter `name` + `summary` (fallback `description`), empty dir → "No specialists installed". The roster read (`app/lib/claude-agent/specialist-roster.ts`) is isolated from the graph fallback: malformed files are skipped (`op=specialist-skipped file=<name> reason=<…>`), a whole-roster failure degrades to `specialists: []` inside the `ok: true` payload (`op=specialists-read-failed`). Logs: `[webchat:greeting] op=read account=<id8> events=<n> tasks=<n> specialists=<n> ms=<n>` / `op=read-failed reason=…`; client warns `[admin-ui] greeting-unavailable …`. The full webchat architecture lives in `.docs/admin-webchat-native-channel.md`.
 
-**`/chat` Claude-desktop transcript presentation.** The admin webchat keeps the shared `Transcript` shell (stream, follow-tail) but injects a /chat-only item renderer via the component's optional `renderItems` prop: `renderChatTimeline` in `app/chat/transcript-render.tsx`. Presentation: operator turns render as a right-aligned grey bubble showing the message text and, beneath it, a subtle always-visible time-of-day stamp (no label); delivered agent replies render as plain prose with the same time-of-day stamp beneath (the reply-document filename line stays, as prose); the stamp is HH:MM from the turn's `ts` (locale-formatted, right-aligned inside the operator bubble, left-aligned under agent prose), and a turn whose `ts` is null/unparseable shows no stamp, never an empty line — so only delivered operator and agent-reply turns are stamped, while tool runs, the collapsed "Thinking" block, and the agent-error banner stay time-free; a maximal consecutive run of `tool-call`/`tool-result` turns renders as one collapsed grey one-liner ("Used N tools ›") whose expansion shows every call and result payload — a lone call still gets the one-liner, and prose or a directive row ends a run. The WhatsApp reader (`/whatsapp`) omits the prop and keeps the default `renderTimeline`, so its rendering is unchanged; both presentations are test-pinned (`app/whatsapp/__tests__/Transcript-*.test.tsx` unmodified, `app/chat/__tests__/transcript-render.test.tsx` new).
+**`/chat` Claude-desktop transcript presentation.** The admin webchat keeps the shared `Transcript` shell (stream, follow-tail) but injects a /chat-only item renderer via the component's optional `renderItems` prop: `renderChatTimeline` in `app/chat/transcript-render.tsx`. Presentation: operator turns render as a right-aligned grey bubble showing the message text and, beneath it, a subtle always-visible time-of-day stamp (no label); delivered agent replies render as plain prose with the same time-of-day stamp beneath (the reply-document filename line stays, as prose); the stamp is HH:MM from the turn's `ts` (locale-formatted, right-aligned inside the operator bubble, left-aligned under agent prose), and a turn whose `ts` is null/unparseable shows no stamp, never an empty line — so only delivered operator and agent-reply turns are stamped, while tool runs, the collapsed "Thinking" block, and the agent-error banner stay time-free; a maximal consecutive run of `tool-call`/`tool-result` turns renders as one collapsed grey one-liner ("Used N tools ›") whose expansion shows every call and result payload — a lone call still gets the one-liner, and prose or a directive row ends a run. The WhatsApp reader (`/whatsapp`) omits the prop and keeps the default `renderTimeline`, so its rendering is unchanged; both presentations are test-pinned (`app/whatsapp/__tests__/Transcript-*.test.tsx`, `app/chat/__tests__/transcript-render.test.tsx`). **Day-divider:** both renderers insert a centered `.day-divider` row between two consecutive timeline items on different local calendar days (label `Today`/`Yesterday`, else `Sat 14 Jun 2026`), so a thread spanning midnight is never an ambiguous run of HH:MM; the first dated item gets a leading divider, a null/unparseable `ts` marks no boundary, dividers are computed over the filtered `visibleItems`, and in `/chat` a day crossover flushes any open tool/think run first so a collapsed run never spans it. Per-bubble HH:MM stamps are unchanged. Shared helpers `dayKey`/`dayLabel`/`itemTs`/`DayDivider` live in `app/whatsapp/Transcript.tsx`.
 
 **maxy title for public sessions.** A `role=public` webchat spawn never produces a useful Claude Code `ai-title` (an anonymous one-line visitor turn), so every public row would otherwise read identically. The webchat route (`chat.ts`) composes a deterministic title — `Web · <senderId[:8]>[ · <personId>] · <UTC YYYY-MM-DD HH:mm>` (personId present only for gated visitors) — and threads it through the native webchat gateway's public spawn (`handleInbound` → `buildPublicWebchatSpawnRequest` → `managerSpawn`) to the manager `POST /public-spawn` body as `name`. `/spawn` validates it with `validateUserTitle` and, for `role=public` only, writes it into `UserTitleStore` so it occupies the operator-rename tier and wins over `ai-title`. Admin (`/rc-spawn`) and WhatsApp titling are unchanged. Observability: every public spawn logs `[spawn] role=public … title="…"` (or `title=missing`); the manager's row builder emits `[public-title] sessionId=… unexpected titleSource=<ai|null>` on the next list read for any public row that did not resolve from the user tier.
 
+**Public visitor surface.** The public-host root (`GET /`), the `/:slug` agent routes, and the admin-host `/public` / `/public-chat` previews all serve one shell, `public.html` → [`app/public-entry.tsx`](../../../ui/app/public-entry.tsx) → `PublicChat`. `PublicChat` reuses `useSession` purely as the magic-link gatekeeper — it drives `AccessGate`, resolves the agent slug from the path, and handles `?token=` verification; once the grant is satisfied it mounts `ChatSurface variant="public"`, whose transcript reads the visitor-scoped, **delivered-only** stream `GET /api/public-reader/stream` ([`server/routes/public-reader.ts`](../../../ui/server/routes/public-reader.ts)) — the visitor sees the agent's delivered prose, never the tool/tool-result/directive bytes the legacy `/api/chat` SSE render exposed. Branding is resolved client-side by `useSession`, so the server hands back the bare shell with no per-agent HTML injection. There is exactly one public client surface and it is 1:1 visitor↔agent: the earlier `?surface=next` A/B handle is retired, group messaging is retired (not a supported product surface), and a former `/g/<slug>` group URL now serves the same 1:1 shell — a stale bookmark gets the 1:1 chat, never a broken render.
+
 ### Graph
 
 | Mount | Purpose |
@@ -304,7 +306,7 @@ authoritative. This section names the surfaces and what backs each.
 | Nav rows (Chat / People / Agents / Projects / Tasks / Artefacts) | People, Agents, Tasks open the artefact-pane Graph filtered to the matching label. Chat selects the active conversation. Artefacts swaps the list to editable documents. | `graph-search.ts`, `graph-subgraph.ts`, `sidebar-artefacts.ts` |
 | Sessions list (Active / Archived / All) | Live row store driven by SSE; manual reconcile button on the segmented control re-fetches the full id set. Every listed row carries two launch actions: the claude.ai/code resume (`ExternalLink`) and a chat-launch (`MessageSquare`) that opens `/chat?session=<full sessionId>` — the admin webchat pointed at that exact session; sending there resumes a stopped session with the webchat channel bound to that id (see `admin-webchat-native-channel.md`, "Session-targeted mode"). At the ≤720 px drawer breakpoint each row stacks into two lines — dot + title + id/stamp, then the action icons — with a divider between rows and actions at full opacity (the desktop hover-gated 0.5 opacity never resolves on touch). Below a 400 px list width each row's action icons collapse to a single `MoreHorizontal` ellipsis trigger; its popover menu lists the same actions as the inline icons but labels them with concise verbs (`Resume in claude.ai/code`, `Open in webchat`, `Stop`, `Archive` / `Unarchive`, `Rename`, `Delete`, `Re-seat`) rather than the inline icon buttons' verbose per-session aria-labels — the inline buttons keep those verbose labels because an icon-only control needs the full descriptive accessible name. **Re-seat:** Re-seat is a member action of the one `SessionRowActions` cluster, not a separate sibling control — wide it is the sliders icon inline with the other icons (sharing the cluster geometry and alignment); collapsed it is the `Re-seat` menu item, which expands the model/mode/effort form inline inside the overflow menu. The form (`SessionReseatControl`) forks the session via `/api/admin/session-reseat` and navigates to the fork (the same fork mechanism `/chat`'s pickers drive); its model picker defaults to the row's current model (a `model` field on each row, read from the JSONL tail), and mode and effort each carry a "Keep" option that omits the field. The overflow menu and the Re-seat form render through a `document.body` portal, fixed-positioned from the trigger's rect (right-aligned, flipped above the trigger when there is no room below), so neither is clipped by `.side-list`'s `overflow-y:auto`; Escape, a pointerdown outside the trigger/popover, and any scroll or resize dismiss them. | `/claude-sessions/events`, `/claude-sessions`, `/session-reseat` |
 | Channel reader nav rows (WhatsApp / Telegram) | One conditional nav row **per interactive channel that has ≥1 admin session**. Each row carries its brand glyph (WhatsApp `#25D366`, Telegram `#229ED9`); a channel with no admin session shows no row, and no install ever shows an always-empty "No conversations" row. The channel list loads **once on sidebar mount** (the per-channel counts must be known before the nav renders), so a failed load shows one muted, non-clickable line instead of channel rows. Clicking a channel row lists that channel's admin conversations; each conversation row shows a **display name** resolved by precedence `operatorName ?? whatsappName ?? senderId ?? title`: the bound `Person givenName familyName` when a `senderId`→`userId` binding exists, else the persisted WhatsApp display name (`pushName`, read from the latest `:Message:WhatsAppMessage.senderName`), else the raw `senderId`, else the agent title; the agent session title is the hover tooltip only. Under the name each row shows a **last-message-time breadcrumb** (`conv-timestamp`, same markup as the Sessions rows) formatted from the row's `lastMessageAt` (the last parseable turn's `ts`); a session with no parseable turn shows no time, never "Invalid Date". **Re-seat:** each channel conversation row carries a `SessionRowActions` cluster whose sole action is Re-seat (the row is a `conv-with-actions` shell whose open click moved onto an inner button so the cluster can sit beside it), so a WhatsApp/Telegram session's model/mode/effort is re-seatable from the dashboard exactly like a webchat row — wide it is the inline sliders icon, and below the 400 px width it folds into the `…` overflow menu identically to the Sessions rows; the channel reader row carries the same `model` field for the picker default. A click on a conversation **opens its transcript on the home surface**: on `/` it selects in place, and from any other route (`/graph`, `/data`, `/browser`) it navigates to `/?wa=<sessionId>&projectDir=<dir>`, which the root shell hydrates on mount (then strips the query so a later refresh does not re-pin a closed conversation). Server logs `[wa-reader] op=operator-name-fallback senderId=… source=whatsapp-pushname` when the pushName fallback fires and `[wa-reader] op=conversations count=<n> withTimestamp=<m>` per list build; the client logs `[admin-ui] wa-open route=… via=<in-place\|navigate> …` and `[admin-ui] wa-hydrate route=/ …`. | `/whatsapp-reader/conversations` |
-| Channel transcript (`<Transcript>`) | Reads one session's JSONL over SSE (`/whatsapp-reader/stream`) and renders both sides plus tool calls — the turns claude.ai/code hides because channel inbound is stamped `isMeta`. Every turn shows its time-of-day (HH:MM from the turn's `ts`; a null/unparseable `ts` shows no time, never "Invalid Date"). `tool-call`/`tool-result` turns render as **collapsed cards** (chevron + label + time, default collapsed, expandable per card; one card's state never affects another) so the human↔agent text is not buried in JSON; the three conversation kinds always render in full. The thread **follows the tail**: it opens at the newest turn and pins to the bottom on each live append **only while the operator is already within 32 px of the bottom** — a scroll up suppresses the jump so reading history is never yanked. While the operator is scrolled up a **jump-to-bottom control** (`.wa-jump`, bottom-right of the viewport) appears; clicking it scrolls to the newest turn and re-arms follow-tail, and it hides again at the bottom. The thread scrolls inside its grid cell (header/sidebar/footer fixed). The stream sends a 20 s heartbeat so an idle Cloudflare tunnel does not idle-drop, tags each frame with a byte-offset `id:`, and resumes from the client's `Last-Event-ID` on reconnect (no duplicate backlog); the client clears the "Stream disconnected" banner on reopen and latches it only on a terminal CLOSED state. The thread also interleaves a collapsed `⚙ directive injected (N B)` row per turn, sorted by timestamp just before the turn it informed; expanding one fetches the exact stored `prompt-optimiser-directive` bytes for that turn. The entries are listed by `GET /whatsapp-reader/directives?sessionId=` and the bytes served by `GET /whatsapp-reader/directive?sessionId=&name=`, both admin-gated and account-scoped; a missing store degrades to no rows. | `/whatsapp-reader/stream`, `/whatsapp-reader/directives`, `/whatsapp-reader/directive` |
+| Channel transcript (`<Transcript>`) | Reads one session's JSONL over SSE (`/whatsapp-reader/stream`) and renders both sides plus tool calls — the turns claude.ai/code hides because channel inbound is stamped `isMeta`. Every turn shows its time-of-day (HH:MM from the turn's `ts`; a null/unparseable `ts` shows no time, never "Invalid Date"). `tool-call`/`tool-result` turns render as **collapsed cards** (chevron + label + time, default collapsed, expandable per card; one card's state never affects another) so the human↔agent text is not buried in JSON; the three conversation kinds always render in full. The thread **follows the tail**: it opens at the newest turn and pins to the bottom on each live append **only while the operator is already within 32 px of the bottom** — a scroll up suppresses the jump so reading history is never yanked. While the operator is scrolled up a **jump-to-bottom control** (`.wa-jump`, bottom-right of the viewport) appears; clicking it scrolls to the newest turn and re-arms follow-tail, and it hides again at the bottom. The thread scrolls inside its grid cell (header/sidebar/footer fixed). The stream sends a 20 s heartbeat so an idle Cloudflare tunnel does not idle-drop, tags each frame with a byte-offset `id:`, and resumes from the client's `Last-Event-ID` on reconnect (no duplicate backlog); the client clears the "Stream disconnected" banner on reopen and latches it only on a terminal CLOSED state. The thread also interleaves a collapsed `⚙ directive injected (N B)` row per turn, sorted by timestamp just before the turn it informed; expanding one fetches the exact stored `prompt-optimiser-directive` bytes for that turn. The entries are listed by `GET /whatsapp-reader/directives?sessionId=` and the bytes served by `GET /whatsapp-reader/directive?sessionId=&name=`, both admin-gated and account-scoped; a missing store degrades to no rows. A centered day-divider row (`.day-divider`) marks each local calendar-day crossover between consecutive turns so a thread spanning midnight is unambiguous. | `/whatsapp-reader/stream`, `/whatsapp-reader/directives`, `/whatsapp-reader/directive` |
 | Conversations row hover actions | Inline rename, archive, delete, JSONL view / download per row. The historical `.conversations-modal` CSS block exists in `globals.css` but is no longer mounted from any TSX — Sidebar.tsx now owns every per-row affordance directly. | `claude-sessions.ts` |
 | Artefacts list | Lists every `:FileArtifact` under this account's tree (`relativePath STARTS WITH 'accounts/'`, all file types, excluding the `uploads/<id>/` subtree) plus this account's IDENTITY / SOUL / KNOWLEDGE / specialist templates. Click downloads the row's backing file (`downloadPath` → `GET /api/admin/files/download`) so the operator opens it in their local app; rows whose file is outside `DATA_ROOT` (bundled-fallback templates) show a "can't be downloaded" pill. The in-app artefact pane is dead pending removal. | `sidebar-artefacts.ts`, `files.ts` |
 | System-stats widget | CPU / RAM widget at the foot of the sidebar. | `system-stats.ts` (see above) |

package/payload/platform/plugins/docs/references/internals.md

@@ -373,15 +373,22 @@ The admin agent runs via Claude Code CLI, which manages its own system prompt as
 
 This is assembled as a `<previous-context>` block in the system prompt on each admin turn.
 
-### Public-agent memory context (retired)
+### Public-agent memory context
 
 Public agents historically had their memory context injected by a server-side bridge
 (`fetchMemoryContext`) that spawned the memory MCP server with `ALLOWED_SCOPES=public,shared`
-and ran a `memory-search` on the agent's behalf. That bridge has been removed: public agents
-are now toolless (`buildPublicDeny` denies `mcp__memory__*`), so neither the agent nor a
-server-side proxy runs a public-scope memory read. The public-scope fulltext index that this
-path ranked against was retired alongside it. Restoring read-back for gated visitors is
-tracked separately — see the gated-public-agents doc.
+and ran a `memory-search` on the agent's behalf. That bridge was removed: public agents
+are toolless (`buildPublicDeny` denies `mcp__memory__*`), so neither the agent nor a
+server-side proxy runs a public-scope memory search, and the public-scope fulltext index that
+path ranked against was retired alongside it.
+
+A gated visitor's per-visitor memory still reaches their next conversation, without any tool
+and without reopening the ringfence. The session-end reviewer writes per-visitor slice nodes
+(`{sliceToken, scope:'user'}`); at the next gated spawn the UI process fetches that visitor's
+own `scope:'user'` slice nodes (a slice-pinned read, not a public-scope search), renders them
+to a `<previous-context>` block, and threads it through the public spawn body so the manager
+appends it to the agent's system prompt. Only the visitor's own slice is read; open-mode
+visitors, admins, and first visits inject nothing.
 
 ---
 
@@ -449,7 +456,7 @@ The Claude Code SDK marks every MCP tool as **deferred** by default. The model c
 
 The SDK's per-tool override is `_meta["anthropic/alwaysLoad"]: true` on each MCP tool's `tools/list` entry. Two surfaces apply it:
 
-1. **In-process plugins.** Every admin-eager tool is registered via `eagerTool(server, name, description, inputSchema, handler)` from `platform/lib/mcp-eager/` instead of `server.tool(...)`. The helper calls `server.registerTool` with the `_meta` flag set.
+1. **In-process plugins.** Every admin-eager tool is registered via `eagerTool(server, name, description, inputSchema, handler)` from `platform/lib/mcp-eager/` instead of `server.tool(...)`. The helper calls `server.registerTool` with the `_meta` flag set. Both `eagerTool` and the non-eager `lifelineTool` (from `platform/lib/mcp-lifeline/`) wrap the handler with `wrapWithLifeline`, which emits a structured `op=request`/`op=result` log pair per call including a holdings census — see `.docs/mcp-helper-observability.md` "Tool-call lifeline".
 2. **Upstream graph proxy.** The upstream Python `mcp-neo4j-cypher` server has no `_meta` channel, so `platform/lib/graph-mcp/src/index.ts` intercepts every `tools/list` response on the wire and injects `_meta["anthropic/alwaysLoad"]: true` into each tool entry. The `[graph-mcp] tools/list eager-flagged count=<N>` stderr line confirms the injection fired.
 
 **Curation rule.** Every MCP tool the admin agent calls routinely should be eager — registered via `eagerTool` (or arriving through the graph-mcp interceptor). Whether a tool is eager is decided at its registration site in the plugin's MCP `index.ts` (`eagerTool` vs `server.tool`); there is no separate allow-list constant. Admin-skill / specialist / public-agent tools that stay on `server.tool()` pay the ToolSearch tax only when their caller invokes them. The admin tool surface (`toolSurface.admin`, the `adminAllowlist: true` set) is the intended eager set; a routinely-called admin tool left on `server.tool()` is a gap to fix at the registration site.

package/payload/platform/plugins/memory/mcp/dist/index.js

@@ -59,6 +59,7 @@ import { memoryCompiledTruthHistory } from "./tools/memory-compiled-truth-histor
 import { getSession, closeDriver } from "./lib/neo4j.js";
 import { embed } from "./lib/embeddings.js";
 import { notTrashed } from "../../../../lib/graph-trash/dist/index.js";
+import { lifelineTool } from "../../../../lib/mcp-lifeline/dist/index.js";
 const server = new McpServer({
     name: "maxy-memory",
     version: "0.1.0",
@@ -406,7 +407,7 @@ eagerTool(server, "memory-lookup-by-name", "Deterministic by-name entity lookup.
 // so the conversation-archive-enrich skill can drive the dispatched
 // specialist to read each chunk and emit claims in-turn. Read-only.
 // ---------------------------------------------------------------------------
-server.tool("conversation-archive-list-chunks", "Page through the :Section chunks of one named :ConversationArchive and return each chunk's elementId, ordered index, summary, and full body. The conversation-archive-enrich skill calls this per page, then prompts the dispatched specialist to read each chunk's body in-turn and emit claims; the skill hands those claims back to `conversation-archive-derive-insights` for per-kind cypher emission. Read-only.", {
+lifelineTool(server, "conversation-archive-list-chunks", "Page through the :Section chunks of one named :ConversationArchive and return each chunk's elementId, ordered index, summary, and full body. The conversation-archive-enrich skill calls this per page, then prompts the dispatched specialist to read each chunk's body in-turn and emit claims; the skill hands those claims back to `conversation-archive-derive-insights` for per-kind cypher emission. Read-only.", {
     archiveElementId: z
         .string()
         .describe("elementId of the :ConversationArchive parent (Task 397 — keyed on conversationIdentity) the operator named (required)."),
@@ -490,7 +491,7 @@ const claimSchema = z.object({
         .optional()
         .describe("Kind-specific structured fields (taskTitle/taskDueHint for task; preferenceCategory/preferenceKey/preferenceValue for preference; relationshipType for observed-relationship)."),
 });
-server.tool("conversation-archive-derive-insights", "Convert one chunk's agent-produced claims into operator-facing claim proposals (mention, task, preference, observed-relationship). The conversation-archive-enrich skill reads chunk bodies via `conversation-archive-list-chunks`, drives the dispatched specialist to emit claims in-turn, and passes them here for per-kind cypher emission. Applies the durable rejection sidecar so already-triaged claims do not re-surface. Read-only: the per-row operator gate runs in the skill, this tool never writes.", {
+lifelineTool(server, "conversation-archive-derive-insights", "Convert one chunk's agent-produced claims into operator-facing claim proposals (mention, task, preference, observed-relationship). The conversation-archive-enrich skill reads chunk bodies via `conversation-archive-list-chunks`, drives the dispatched specialist to emit claims in-turn, and passes them here for per-kind cypher emission. Applies the durable rejection sidecar so already-triaged claims do not re-surface. Read-only: the per-row operator gate runs in the skill, this tool never writes.", {
     archiveElementId: z
         .string()
         .describe("elementId of the :ConversationArchive parent (Task 397 — keyed on conversationIdentity) the operator named (required)."),
@@ -565,7 +566,7 @@ process.stderr.write("[memory-mcp] registered tool=conversation-archive-derive-i
 //   undo   — drop matching line via atomic-rename (called after a `wire`
 //            so a later wire of a once-rejected key cleans up its rejection).
 // ---------------------------------------------------------------------------
-server.tool("conversation-archive-enrich-rejection", "Record or undo a per-row rejection from conversation-archive-enrich. Writes a sidecar JSONL keyed on (chunkElementId, kind, contentHash). Call with mode='record' on operator `reject`; call with mode='undo' after a successful `wire` so a later wire of a once-rejected key clears its rejection. Idempotent: duplicate records are no-ops.", {
+lifelineTool(server, "conversation-archive-enrich-rejection", "Record or undo a per-row rejection from conversation-archive-enrich. Writes a sidecar JSONL keyed on (chunkElementId, kind, contentHash). Call with mode='record' on operator `reject`; call with mode='undo' after a successful `wire` so a later wire of a once-rejected key clears its rejection. Idempotent: duplicate records are no-ops.", {
     archiveElementId: z
         .string()
         .describe("elementId of the conversation-document parent (carried on each line for diagnostics)."),
@@ -888,7 +889,7 @@ if (!readOnly) {
             };
         }
     });
-    server.tool("memory-update-by-name", "Update an existing node addressed by (label, name, accountId) instead of elementId. Use this as a repair surface when memory-search cannot return an elementId for a node you know exists by name — typically an ingest-created :Organization the search route is failing to surface. Resolves the unique node matching the tuple, then delegates to memory-update (embedding refresh, write gates, compiled-truth refusal, and provenance stamping all carry over). Rejects loudly on zero matches (the row does not exist) and on two-or-more matches (ambiguous — the rejection lists candidate elementIds so you can pick one and call memory-update directly). Trashed nodes are excluded from the lookup. For one-off updates where you already have the elementId from a successful memory-search, prefer memory-update — this tool is the fallback when search hides the node.", {
+    lifelineTool(server, "memory-update-by-name", "Update an existing node addressed by (label, name, accountId) instead of elementId. Use this as a repair surface when memory-search cannot return an elementId for a node you know exists by name — typically an ingest-created :Organization the search route is failing to surface. Resolves the unique node matching the tuple, then delegates to memory-update (embedding refresh, write gates, compiled-truth refusal, and provenance stamping all carry over). Rejects loudly on zero matches (the row does not exist) and on two-or-more matches (ambiguous — the rejection lists candidate elementIds so you can pick one and call memory-update directly). Trashed nodes are excluded from the lookup. For one-off updates where you already have the elementId from a successful memory-search, prefer memory-update — this tool is the fallback when search hides the node.", {
         label: z.string().describe("The single label to MATCH on (e.g. 'Organization', 'Person', 'Project'). Must be exactly the label carried by the target node — the tool does not iterate label variants."),
         name: z.string().describe("The exact `name` property of the target node (case-sensitive). Forbidden-property rules still apply downstream — if the label rejects `name`, use memory-update with the correct identifier instead."),
         properties: z
@@ -930,7 +931,7 @@ if (!readOnly) {
             };
         }
     });
-    server.tool("memory-update", "Update properties on an existing node in the knowledge graph. Finds the node by element ID, verifies account ownership, sets the provided properties, and recomputes the embedding. To refresh `compiledTruth` / `compiledTruthPublic` on :Person / :Organization / :Concept / :Project / :LocalBusiness, dispatch the `compiled-truth-rewriter` specialist via the Task tool — admin sends the nodeId plus any `operatorHint` / `publicOperatorHint`; the specialist reads the node + 90-day timeline, computes the new summary, and writes it back via memory-update. Direct writes to compiled-truth properties via this tool are refused unless the caller is the compiled-truth-rewriter specialist (gated by MAXY_SPECIALIST env). When you only have the node's name (typically because memory-search couldn't return it), use memory-update-by-name instead.", {
+    lifelineTool(server, "memory-update", "Update properties on an existing node in the knowledge graph. Finds the node by element ID, verifies account ownership, sets the provided properties, and recomputes the embedding. To refresh `compiledTruth` / `compiledTruthPublic` on :Person / :Organization / :Concept / :Project / :LocalBusiness, dispatch the `compiled-truth-rewriter` specialist via the Task tool — admin sends the nodeId plus any `operatorHint` / `publicOperatorHint`; the specialist reads the node + 90-day timeline, computes the new summary, and writes it back via memory-update. Direct writes to compiled-truth properties via this tool are refused unless the caller is the compiled-truth-rewriter specialist (gated by MAXY_SPECIALIST env). When you only have the node's name (typically because memory-search couldn't return it), use memory-update-by-name instead.", {
         nodeId: z.string().describe("Element ID of the node to update (from memory-search results)"),
         properties: z
             .record(z.string(), z.unknown())
@@ -970,7 +971,7 @@ if (!readOnly) {
             };
         }
     });
-    server.tool("memory-edge", "Create or delete a typed directed edge between two nodes that already exist in the knowledge graph. Both nodes must belong to the same account. Use action='create' to MERGE the edge (idempotent — returns {created:false} if it already exists) or action='delete' to remove it (returns {deleted:false} if already absent). relationshipType is uppercase-coerced; types starting with underscore are reserved and rejected. Properties are stamped on the edge on CREATE only.", {
+    lifelineTool(server, "memory-edge", "Create or delete a typed directed edge between two nodes that already exist in the knowledge graph. Both nodes must belong to the same account. Use action='create' to MERGE the edge (idempotent — returns {created:false} if it already exists) or action='delete' to remove it (returns {deleted:false} if already absent). relationshipType is uppercase-coerced; types starting with underscore are reserved and rejected. Properties are stamped on the edge on CREATE only.", {
         action: z.enum(["create", "delete"]).describe("'create' MERGEs the edge (idempotent); 'delete' removes it (no-op if absent)."),
         fromId: z.string().describe("elementId of the source node (from memory-search results)."),
         toId: z.string().describe("elementId of the target node (from memory-search results)."),
@@ -1127,7 +1128,7 @@ if (!readOnly) {
             };
         }
     });
-    server.tool("memory-ingest-extract", "Extract text from an uploaded file and cache it server-side for memory-ingest. " +
+    lifelineTool(server, "memory-ingest-extract", "Extract text from an uploaded file and cache it server-side for memory-ingest. " +
         "Supports PDF (via pdftotext), plain text, and markdown. " +
         "Rejects CSV (structured data — use memory-write instead) and images (metadata-only). " +
         "Returns file metadata + a short preview; the full text lives in the in-process cache keyed by attachmentId. " +
@@ -1158,7 +1159,7 @@ if (!readOnly) {
             };
         }
     });
-    server.tool("memory-ingest", "Write a classified document or conversation-archive session into the graph as typed nodes anchored to a subject. " +
+    lifelineTool(server, "memory-ingest", "Write a classified document or conversation-archive session into the graph as typed nodes anchored to a subject. " +
         "Two mutually-exclusive parent paths — exactly one MUST be set: " +
         "(1) **Document path** — set `attachmentId` (requires a prior memory-ingest-extract call for the text cache). MERGEs under `:KnowledgeDocument` keyed on attachmentId. The typed-section JSON in `sections` is produced by the dispatched specialist in-turn from the loaded ontology. " +
         "(2) **Conversation-archive path** — set `conversationIdentity` along with the conversation-document fields (`source`, `archiveSha256`, `archiveSourceFile`, `participantElementIds`, `lastIngestedMessageHash`, `lastIngestedMessageAt`, `sessionIndex`, optionally `archiveTitle` and `cleanupPriorChunks`). MERGEs under `:ConversationArchive` keyed on conversationIdentity. The specialist invokes this once per session prepared by `conversation-archive-ingest.sh`, advancing the cursor atomically with each session's chunks. `:Section.body` is server-sliced from the per-session turnText tempfile the bin wrote at `turnTextCachePath(conversationIdentity, archiveSha256, sessionIndex)` — the specialist emits offsets, never body text (server-sliced via per-session tempfile). " +
@@ -1453,7 +1454,7 @@ if (!readOnly) {
     // `memory/bin/conversation-archive-ingest.{mjs,sh}`. Phase-2 insight
     // derivation will operate on conversation-document :Section chunks regardless of
     // source.
-    server.tool("memory-ingest-web", "Adapter for web-content ingestion. Accepts a URL, its pre-fetched readable content " +
+    lifelineTool(server, "memory-ingest-web", "Adapter for web-content ingestion. Accepts a URL, its pre-fetched readable content " +
         "(the agent calls WebFetch first, then passes the text here), and the page's editorial title parsed from " +
         "the HTML `<title>` / `og:title`. Writes the content to a temp file and delegates to memory-ingest-extract — " +
         "caching the text under a freshly-generated attachmentId. The dispatched specialist then produces typed-section " +
@@ -1505,7 +1506,7 @@ if (!readOnly) {
             };
         }
     });
-    server.tool("memory-find-candidates", "Deterministic bulk-delete selector for Conversation nodes. Returns a structured list of candidates " +
+    lifelineTool(server, "memory-find-candidates", "Deterministic bulk-delete selector for Conversation nodes. Returns a structured list of candidates " +
         "matching a fixed-name filter ('empty' = zero :PART_OF messages; 'single-assistant' = exactly one " +
         "assistant-role message) and an opaque filterToken. Pair with memory-delete(filterToken=…) — the server " +
         "re-runs the same predicate per elementId before trashing, so a stale or forged token never deletes. " +
@@ -1549,7 +1550,7 @@ if (!readOnly) {
             };
         }
     });
-    server.tool("memory-node-exists", "Deterministic label-existence check for installer-seeded singleton roots. " +
+    lifelineTool(server, "memory-node-exists", "Deterministic label-existence check for installer-seeded singleton roots. " +
         "Returns { exists, elementId, labels } for a single label/accountId lookup, " +
         "bypassing the memory-search ranking stack so an installer-seeded node with " +
         "empty content properties (e.g. a freshly seeded :LocalBusiness with no name yet) " +
@@ -1573,7 +1574,7 @@ if (!readOnly) {
             };
         }
     });
-    server.tool("memory-delete", "Soft-delete a single graph node by elementId. Adds the :Trashed label, preserves relationships, " +
+    lifelineTool(server, "memory-delete", "Soft-delete a single graph node by elementId. Adds the :Trashed label, preserves relationships, " +
         "and excludes the node from memory-search and any read filtered via notTrashed. For KnowledgeDocument, " +
         "cascades to linked Section and Chunk children. For Conversation, cascades to attached :PART_OF Messages " +
         ". Hard removal happens later via memory-empty-trash after the grace period (default 30 days). " +
@@ -1608,7 +1609,7 @@ if (!readOnly) {
             };
         }
     });
-    server.tool("memory-restore", "Undo memory-delete on a single graph node by elementId. Removes the :Trashed label and restores " +
+    lifelineTool(server, "memory-restore", "Undo memory-delete on a single graph node by elementId. Removes the :Trashed label and restores " +
         "snapshotted unique-key properties. For KnowledgeDocument, walks HAS_SECTION/HAS_CHUNK edges to bring " +
         "trashed children back too. Fails loudly when an active node already holds a unique slot the trashed " +
         "node needs back (e.g. a fresh LocalBusiness was created while the old one was in trash) — " +
@@ -1636,7 +1637,7 @@ if (!readOnly) {
             };
         }
     });
-    server.tool("memory-empty-trash", "Hard-delete trashed nodes whose trashedAt is older than the grace period (default 30 days). " +
+    lifelineTool(server, "memory-empty-trash", "Hard-delete trashed nodes whose trashedAt is older than the grace period (default 30 days). " +
         "For KnowledgeDocument candidates, also removes the on-disk attachment directory. Use dryRun=true " +
         "to preview candidates without mutating — the absence of [trash:emptied] log lines after a " +
         "[trash:empty-run] dryRun=true line is the correct-behaviour signal. Optional labels filter " +
@@ -1668,7 +1669,7 @@ if (!readOnly) {
             };
         }
     });
-    server.tool("memory-list-attachments", "List stored file attachments for this account with their ingestion status. " +
+    lifelineTool(server, "memory-list-attachments", "List stored file attachments for this account with their ingestion status. " +
         "Returns original filenames, sizes, upload dates, and whether each file has been ingested " +
         "into the knowledge graph. Does not include web-ingested documents (those have no file on disk).", {}, async () => {
         if (!accountId)
@@ -1706,7 +1707,7 @@ if (!readOnly) {
             };
         }
     });
-    server.tool("memory-read-attachment", "Read the content of a stored attachment from disk. Returns the full text for text/markdown files, " +
+    lifelineTool(server, "memory-read-attachment", "Read the content of a stored attachment from disk. Returns the full text for text/markdown files, " +
         "extracted text for PDFs (via pdftotext), and metadata + HTTP URL for images. " +
         "Use this to show the user what's in a file or to prepare content for editing.", {
         attachmentId: z.string().describe("UUID of the attachment to read"),
@@ -1731,7 +1732,7 @@ if (!readOnly) {
             };
         }
     });
-    server.tool("memory-edit-attachment", "Edit a stored text/markdown attachment in place. Replaces the file content on disk, updates the " +
+    lifelineTool(server, "memory-edit-attachment", "Edit a stored text/markdown attachment in place. Replaces the file content on disk, updates the " +
         "metadata timestamp, and re-extracts the file for chunking (populating the extract cache). " +
         "After this call, use memory-ingest with updated summaries to sync the knowledge graph. " +
         "Only text/plain and text/markdown files are editable — PDFs and images are rejected.", {
@@ -1760,7 +1761,7 @@ if (!readOnly) {
             };
         }
     });
-    server.tool("memory-rename-attachment", "Rename a stored attachment. Updates the filename in the .meta.json sidecar and the " +
+    lifelineTool(server, "memory-rename-attachment", "Rename a stored attachment. Updates the filename in the .meta.json sidecar and the " +
         "KnowledgeDocument name in Neo4j (if the file has been ingested). The file on disk " +
         "is not renamed — it uses UUID-based naming. Only the human-readable metadata changes.", {
         attachmentId: z.string().describe("UUID of the attachment to rename"),
@@ -1841,7 +1842,7 @@ if (!readOnly) {
         const agoStr = ago ? ` (${ago})` : "";
         return `${label} [${agentInfo}] · created ${createdStr} · active ${updatedStr}${agoStr} — ${opts.messageCount} messages`;
     }
-    server.tool("conversation-list", "List conversations or retrieve messages from a specific conversation. " +
+    lifelineTool(server, "conversation-list", "List conversations or retrieve messages from a specific conversation. " +
         "Without sessionId: lists all conversations with message counts, ordered by most recent activity (updatedAt DESC). " +
         "Headers show both creation time and last activity time; when they differ, the conversation was resumed. " +
         "With sessionId: returns all messages in that conversation chronologically with per-message timestamps. " +
@@ -2032,7 +2033,7 @@ if (!readOnly) {
             await dbSession.close();
         }
     });
-    server.tool("profile-update", "Create, update, or reinforce a user preference; set top-level UserProfile fields (timezone, locale, givenName, role, expertise) via profileFields; AND set operator-identity fields (email, telephone) on the operator's personal-profile Person via personFields. Person is the canonical operator-identity store; UserProfile carries preferences and behavioural state only. Supports modes: reinforce (re-observed, boost confidence), update (value changed), contradict (value contradicts prior), merge (combine overlapping preferences).", {
+    lifelineTool(server, "profile-update", "Create, update, or reinforce a user preference; set top-level UserProfile fields (timezone, locale, givenName, role, expertise) via profileFields; AND set operator-identity fields (email, telephone) on the operator's personal-profile Person via personFields. Person is the canonical operator-identity store; UserProfile carries preferences and behavioural state only. Supports modes: reinforce (re-observed, boost confidence), update (value changed), contradict (value contradicts prior), merge (combine overlapping preferences).", {
         category: z.enum(["communication", "scheduling", "decision", "workflow", "content", "interaction"])
             .describe("Preference category"),
         key: z.string().describe("Preference identifier (e.g. 'response_length', 'meeting_time')"),
@@ -2089,7 +2090,7 @@ if (!readOnly) {
             };
         }
     });
-    server.tool("profile-delete", "Soft-delete a specific user preference (marks :Trashed, restorable via memory-restore within the grace period; permanently removed later by memory-empty-trash). Use when the owner says 'forget that' or 'don't remember X'. Idempotent — succeeds even if the preference doesn't exist.", {
+    lifelineTool(server, "profile-delete", "Soft-delete a specific user preference (marks :Trashed, restorable via memory-restore within the grace period; permanently removed later by memory-empty-trash). Use when the owner says 'forget that' or 'don't remember X'. Idempotent — succeeds even if the preference doesn't exist.", {
         category: z.enum(["communication", "scheduling", "decision", "workflow", "content", "interaction"])
             .describe("Preference category"),
         key: z.string().describe("Preference key to delete"),
@@ -2122,7 +2123,7 @@ if (!readOnly) {
     });
     // profile-read contains owner PII (name, role, timezone, preferences) —
     // admin-only, not exposed to the public agent.
-    server.tool("profile-read", "Read the business owner's profile and preferences. Returns preferences grouped by category (communication, scheduling, decisions, workflow, content, interaction). " +
+    lifelineTool(server, "profile-read", "Read the business owner's profile and preferences. Returns preferences grouped by category (communication, scheduling, decisions, workflow, content, interaction). " +
         "With detail=true: includes per-preference confidence scores, evidence trail (which conversations the preference was observed in), source (explicit vs behavioural), and summary statistics. " +
         "Use detail=true when the owner asks 'what do you know about me?' or when reviewing memory accuracy.", {
         detail: z.boolean().optional().describe("When true, returns per-preference confidence, source, evidence trail, and memory statistics. " +
@@ -2158,7 +2159,7 @@ if (!readOnly) {
     // :Idea nodes filtered by r.createdByAgent='database-operator'. The
     // admin agent uses this to answer "what has the brain captured today?"
     // without touching cypher. Task 439.
-    server.tool("memory-brain-capture-recent", "Read the most recent per-turn graph-pass writes for this account: entity mentions extracted from operator messages, and original-thinking :Idea nodes. " +
+    lifelineTool(server, "memory-brain-capture-recent", "Read the most recent per-turn graph-pass writes for this account: entity mentions extracted from operator messages, and original-thinking :Idea nodes. " +
         "Default window is the last 24 hours. " +
         "Use this when the operator asks 'what has the brain captured today?', 'show me recent mentions of X', or 'what ideas did I leave on the table this week?'.", {
         windowHours: z.number().int().optional().describe("Hours back from now. Default 24. Capped at 720 (30 days)."),
@@ -2192,7 +2193,7 @@ if (!readOnly) {
     // replaces the removed graph-prune autonomous rule engine whose
     // orphan-delete rule wiped 19 nodes on 2026-04-20.
     // -------------------------------------------------------------------------
-    server.tool("graph-prune-denylist-add", "Add one or more strings to the operator-curated deny-list. The list is a stored signal — no cron, no " +
+    lifelineTool(server, "graph-prune-denylist-add", "Add one or more strings to the operator-curated deny-list. The list is a stored signal — no cron, no " +
         "autonomous sweep. The admin agent reads the list and decides per case whether to null a property " +
         "via memory-update, remove a node via memory-delete, or scrub a conversation's :Memory via " +
         "conversation-memory-expunge. Use to record poisonous substrings (retired domain names, wrong " +
@@ -2221,7 +2222,7 @@ if (!readOnly) {
             };
         }
     });
-    server.tool("graph-prune-denylist-remove", "Remove one or more strings from the operator-curated deny-list. Entries no longer serve as signal " +
+    lifelineTool(server, "graph-prune-denylist-remove", "Remove one or more strings from the operator-curated deny-list. Entries no longer serve as signal " +
         "for the admin agent. Any property values previously nulled via manual memory-update calls are not " +
         "restored — audit entries on each affected node remain for forensic review.", {
         values: z.array(z.string().min(1)).min(1).describe("Substring values to remove (must match exactly as previously added)."),
@@ -2246,7 +2247,7 @@ if (!readOnly) {
             };
         }
     });
-    server.tool("conversation-memory-expunge", "Remove deny-listable content from a specific conversation's :Memory nodes by manually-supplied " +
+    lifelineTool(server, "conversation-memory-expunge", "Remove deny-listable content from a specific conversation's :Memory nodes by manually-supplied " +
         "substring pattern. Targets :Memory nodes linked to the named Conversation; nulls every string property " +
         "whose value contains the pattern, with an audit entry on each affected node. The conversation transcript " +
         "(Message nodes) is immutable history and is never modified — only the derived :Memory payload that " +
@@ -2281,7 +2282,7 @@ if (!readOnly) {
     });
 }
 // graph-prune-denylist-list and conversation-search are read-only — available regardless of readOnly mode.
-server.tool("graph-prune-denylist-list", "List the current operator-curated deny-list values used by the daily graph-prune cron. " +
+lifelineTool(server, "graph-prune-denylist-list", "List the current operator-curated deny-list values used by the daily graph-prune cron. " +
     "Returns the substring values, the timestamp of the last edit, and the total count.", {}, () => {
     if (!accountId)
         return refuseNoAccount("graph-prune-denylist-list");
@@ -2393,7 +2394,7 @@ eagerTool(server, "conversation-search", "Search conversation history using sema
 // Specialist tool, not in ADMIN_CORE_TOOLS — registered via server.tool, not
 // eagerTool (deferred-by-default ToolSearch tax is acceptable because the
 // curator is the only routine caller).
-server.tool("image-fetch", [
+lifelineTool(server, "image-fetch", [
     "Fetch a remote image URL and return its bytes as an inline image content block the model can see.",
     "Guards: http/https only, content-type must start with image/, 10 MB byte cap, 30 s timeout.",
     "Returns one text block summarising the fetch plus one image block on success; one text block with isError on failure.",
@@ -2431,7 +2432,7 @@ server.tool("image-fetch", [
 // (admin Task-spawns it during an on-demand `/insight` pass); NOT in
 // `ADMIN_CORE_TOOLS`. Backfill is via the CLI under `scripts/backfill-typed-edges.ts`,
 // bypassing this tool.
-server.tool("memory-typed-edge-pass", "Run the typed-edge auto-extraction pass over prose-bearing nodes this account wrote since sinceIso. Reads Message/Page/Meeting/Email/Idea/Note/Post/Report nodes, batches them, asks Haiku for typed-edge proposals against the closed allowlist (ATTENDED, WORKS_AT, INVESTED_IN, FOUNDED, ADVISES, MENTIONS, AUTHORED, ATTACHED_TO, REFERENCES), validates each proposal inline, and MERGEs accepted edges with createdBy provenance. Returns the counters (nodes, proposed, accepted, rejected, failed, ms) for the caller to hand back to admin for its insight-pass summary.", {
+lifelineTool(server, "memory-typed-edge-pass", "Run the typed-edge auto-extraction pass over prose-bearing nodes this account wrote since sinceIso. Reads Message/Page/Meeting/Email/Idea/Note/Post/Report nodes, batches them, asks Haiku for typed-edge proposals against the closed allowlist (ATTENDED, WORKS_AT, INVESTED_IN, FOUNDED, ADVISES, MENTIONS, AUTHORED, ATTACHED_TO, REFERENCES), validates each proposal inline, and MERGEs accepted edges with createdBy provenance. Returns the counters (nodes, proposed, accepted, rejected, failed, ms) for the caller to hand back to admin for its insight-pass summary.", {
     sinceIso: z.string().describe("ISO timestamp lower bound. Prose nodes with updatedAt >= sinceIso are processed."),
     sessionId: z.string().optional().describe("Conversation id stamped onto the createdBy provenance of MERGEd edges. Defaults to SESSION_ID env if absent."),
 }, async (args) => {
@@ -2470,7 +2471,7 @@ server.tool("memory-typed-edge-pass", "Run the typed-edge auto-extraction pass o
 // ===================================================================
 // Report MCP tools (Task 332) are registered earlier in this file.
 // Dream-run calls the same writer in-process for the per-run :Report.
-server.tool("memory-dream-run", "Operator-initiated dream-cycle: graph-hygiene sweep across seven phases " +
+lifelineTool(server, "memory-dream-run", "Operator-initiated dream-cycle: graph-hygiene sweep across seven phases " +
     "(orphan detection, stale compiled-truth, edges to :Trashed targets, citation audit on :TimelineEvent, " +
     "prune compiled-truth revisions, materialise :BACKLINKS edges, tag normalisation). " +
     "Writes a :Report node at the end. Failure of any phase logs and continues. " +
@@ -2493,7 +2494,7 @@ server.tool("memory-dream-run", "Operator-initiated dream-cycle: graph-hygiene s
         };
     }
 });
-server.tool("memory-review-queue", "Read-only summary of the dream-cycle's review queues (:OrphanCandidate, :CitationProposal). " +
+lifelineTool(server, "memory-review-queue", "Read-only summary of the dream-cycle's review queues (:OrphanCandidate, :CitationProposal). " +
     "Returns per-queue counts and a small sample so the operator can see whether to triage.", {
     sampleSize: z.number().int().positive().optional().describe("Sample rows per queue. Default 5, max 25."),
 }, async ({ sampleSize }) => {