@theronap/agnoclast-mcp 0.9.96

package/lib/server.mjs

@@ -0,0 +1,2986 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
+import { z } from 'zod'
+import { writeFileSync, mkdirSync } from 'fs'
+import { homedir } from 'os'
+import { join } from 'path'
+import { createHash, randomUUID } from 'crypto'
+import { fetchCortex, classify, resolveBase, resolveEnvToken, setSessionKey } from './diagnose.mjs'
+import { resolveSessionKey, resolveLogSessionId } from './session_key.mjs'
+import { runSendImessage } from './imessage_send.mjs'
+import { formatGrepHits } from './grep_cli.mjs'
+import { renderTriage } from './red_link_triage.mjs'
+import { runCodeGraphQuery } from './code_graph_cli.mjs'
+
+// Reactive red-link triage (Mechanism 2). On a read_page miss, ask the server whether the name is a
+// tracked wanted page, whether a bare node exists for it, and whether it's a deliberately demoted page,
+// and turn that into an actionable prompt. Wording lives in ./red_link_triage.mjs (pure + tested).
+// Returns '' on any error so a miss never gets worse.
+async function redLinkTriage(BASE, TOKEN, name) {
+  try {
+    const r = await fetchCortex(`${BASE}/api/brain/red-link?name=${encodeURIComponent(name)}`, {
+      headers: { Authorization: `Bearer ${TOKEN}` },
+    })
+    if (!r.ok) return ''
+    return renderTriage(await r.json(), name)
+  } catch {
+    return ''
+  }
+}
+
+// MCP tool results carry an `isError` flag, and a failure that omits it is indistinguishable from a
+// success at the protocol level — the caller just sees a normal result whose text happens to begin
+// "Could not". This file had 41 tools, 64 failure returns and ZERO uses of isError, so nothing
+// downstream could tell a rejected write from a completed one. Measured 2026-07-31: a walker over
+// 397 transcripts scored 18 REJECTED `author` calls as successful writes for exactly this reason,
+// and an agent skimming its own tool result is exposed the same way. Route every failure through
+// here so the flag cannot be forgotten at a new call site.
+//
+// NAME: deliberately not `fail` — runServer already has a local `fail(verb, res)` for the
+// file-request tools, and a module-level `fail` would be silently shadowed by it from that point on.
+const toolError = (text) => ({ content: [{ type: 'text', text }], isError: true })
+
+// SECTION CURRENCY (gate 3) — ONE renderer, used by BOTH read_page and project_status.
+//
+// Extracted as a PURE function on the pickBrainMatch precedent: that fix pulled a shared rule out of two
+// resolvers specifically so they could not drift, after they drifted. This is the same situation found
+// 2026-08-15. THREE surfaces render authored sections from the same server-computed fields:
+//   • renderAuthoredNodeBody (web/lib/engine/authored_page_tiers.ts) — console/web
+//   • read_page here          — printed a date and "⚠ Undated section" as two adjacent lines
+//   • project_status here     — printed NO currency at all: no as-of, no warning, nothing
+// PR #558 fixed only the first. project_status is the tool the routing docs reach for FIRST, and gate 3
+// reads "a reader can date any claim without a second query" — a reader there could date nothing.
+//
+// The two dates are DIFFERENT facts and both true: `asOf` is when the section's text last CHANGED; an
+// explicit date in the prose is when the CLAIM was true. Stated as one sentence they inform; stacked as
+// two lines they read as the page contradicting itself.
+//
+// ⚠ Do NOT "simplify" this by keying on `asOf` — it is set on every section always, so the detector
+// would go silent everywhere. The branch must key on `hasExplicitDate`, and on `=== false` rather than
+// falsy: `undefined` is an older server mid-rolling-deploy that has computed no verdict, and inventing
+// one there is the 0093 don't-impute violation.
+export const sectionCurrencyStamp = (s, day) => {
+  const on = s.asOf ? day(s.asOf) : ''
+  return s.hasExplicitDate === false
+    ? `${on ? ` · text last written ${on} —` : ' —'} ⚠ the claim itself carries no date; verify before relying on it`
+    : (on ? ` · as of ${on}` : '')
+}
+
+// ⚠ The newline is a FIX, not cosmetics. read_page's old form was `${asOf}${currency}${s.body}`, where
+// only the UNDATED branch contributed a trailing \n — so every DATED section ran its body straight onto
+// the header line ("· as of 2026-08-14Identifiers are candidates, never publication."). The defect was
+// invisible on exactly the sections that were healthy.
+export const renderSection = (s, day) => `### ${s.heading}${sectionCurrencyStamp(s, day)}\n${s.body}`
+
+// The Agnoclast MCP server (stdio). Serves the signed-in employee's scoped org
+// context to their AI assistant. CORTEX_TOKEN identifies the user + org.
+
+export async function runServer(version) {
+  const TOKEN = resolveEnvToken().token
+  const BASE = resolveBase(process.env.CORTEX_URL)
+
+  if (!TOKEN) {
+    process.stderr.write('cortex-mcp: CORTEX_TOKEN is required. Get yours from the Agnoclast console → Connect your AI.\n')
+    process.exit(1)
+  }
+
+  // Self active-sessions (ADR-0017): one MCP process = one AI session. A stable per-process key + the
+  // working dir identify this session; we heartbeat /api/session-ping while alive so the user can see
+  // all THEIR sessions via my_sessions. Self-only on the server; best-effort (never breaks serving).
+  //
+  // PGL-21 fix: "one MCP process = one AI session" is an assumption, not a guarantee — the HOST
+  // (Claude Code) can restart this stdio process mid-conversation (reconnects, tool-loading events),
+  // and a fresh randomUUID() on every restart silently orphaned the PRIOR process's session-scoped
+  // ADR-0022 deleted the write pointer, so a session no longer carries a brain of its own.
+  // stop taking effect one restart later, falling back to the account pointer with no visible cause
+  // — reproduced live 2026-07-27. Claude Code sets CLAUDE_CODE_SESSION_ID for the lifetime of one
+  // logical conversation across any number of subprocess restarts, so prefer it as the session key;
+  // fall back to a fresh randomUUID() for any other MCP host that doesn't set it (unchanged behavior
+  // there — no host that never had continuity loses anything). Bonus: my_sessions / session_presence
+  // (also keyed on SESSION_KEY, ADR-0017) stop fragmenting one conversation into several "sessions" too.
+  const SESSION_KEY = resolveSessionKey(process.env, randomUUID)
+  // ADR-0020 Stage 2: stamp this key on every outbound request (fetchCortex injects it) so writes
+  // resolve THIS session's brain pointer. Must be set BEFORE the first fetchCortex call below —
+  // otherwise the opening requests of a session would silently resolve by the account pointer.
+  setSessionKey(SESSION_KEY)
+  async function pingSession() {
+    try {
+      await fetchCortex(`${BASE}/api/session-ping`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+        // mcpVersion (ADR-0033 T9): the fleet currently has NO way to report which client build a
+        // seat runs — session-ping carried liveness only. That is why every version gate in this
+        // ADR was unobservable. Additive and forward-compatible: the route destructures sessionKey
+        // and cwd and ignores the rest, so this is inert until a column exists to store it.
+        body: JSON.stringify({ sessionKey: SESSION_KEY, cwd: process.cwd(), mcpVersion: version }),
+      })
+    } catch { /* best-effort heartbeat — never disrupt the session */ }
+  }
+  void pingSession()
+  const _hb = setInterval(() => void pingSession(), 60_000)
+  if (typeof _hb.unref === 'function') _hb.unref()   // don't keep the process alive just for the heartbeat
+
+  // Cache context for 5 minutes so repeated tool calls don't re-fetch.
+  let cache = null
+  async function fetchContext() {
+    const now = Date.now()
+    if (cache && now - cache.ts < 5 * 60 * 1000) return cache.text
+    // fetchCortex retries transient infra/5xx; classify turns a failure into an honest message
+    // (token vs infra-block vs network) instead of a bare "Agnoclast API 403: unknown".
+    const res = await fetchCortex(`${BASE}/api/mcp-context`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+    if (!res.ok) {
+      const body = await res.text()
+      throw new Error(classify(res.status, res.headers.get('content-type'), body, res.headers.get('x-vercel-id')).message)
+    }
+    const { context, brainRefs } = await res.json()
+    cache = { text: context, ts: now }
+    // T11: stash the digest node refs surfaced this fetch so capture.mjs can forward them as
+    // hydrated_from at the session's ingest (feedback-loop guard). Keyed by cwd so the matching
+    // session picks them up. Best-effort + inert when brainRefs is empty (digest flag off).
+    try {
+      if (Array.isArray(brainRefs) && brainRefs.length) {
+        const dir = join(homedir(), '.cortex', 'brain-refs')
+        mkdirSync(dir, { recursive: true })
+        const key = createHash('sha1').update(process.cwd()).digest('hex').slice(0, 16)
+        writeFileSync(join(dir, `${key}.json`), JSON.stringify({ refs: brainRefs, ts: now }))
+      }
+    } catch { /* best-effort — never break context serving */ }
+    return context
+  }
+
+  const server = new McpServer({ name: 'cortex', version })
+
+  server.registerTool(
+    'my_context',
+    {
+      title: 'My Agnoclast context',
+      description: 'Your current work context from the org. Pass a question to get query-centered session context seeded from the most relevant node and its neighborhood; omit it for the baseline snapshot.',
+      inputSchema: { question: z.string().optional().describe('optional opening user question to center the context around') },
+    },
+    async ({ question }) => {
+      if (!question?.trim()) return { content: [{ type: 'text', text: await fetchContext() }] }
+      const res = await fetchCortex(`${BASE}/api/session-context`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify({ question }),
+      })
+      if (!res.ok) {
+        const body = await res.text()
+        throw new Error(classify(res.status, res.headers.get('content-type'), body, res.headers.get('x-vercel-id')).message)
+      }
+      const { context } = await res.json()
+      return { content: [{ type: 'text', text: context }] }
+    },
+  )
+
+  // Where this machine's unattended session captures land. The server half shipped 2026-08-09 with no
+  // client surface at all, so the only way to set it was a hand-written authenticated HTTP call —
+  // which meant three real users whose sessions were silently being held could not fix it themselves.
+  // This is the surface that makes it answerable in conversation: "put my sessions in TTO".
+  server.registerTool(
+    'set_capture_brain',
+    {
+      title: 'Choose where your session captures are saved',
+      description:
+        'Set which brain THIS PERSON\'s unattended session captures (the automatic end-of-session record) land in, or read the current setting by omitting `brain`. WHEN TO USE: whenever the user says their sessions are not being saved, asks where their work is going, or a session-start notice says captures are being HELD. WHY IT IS NEEDED: with more than one brain, a capture that names no brain cannot be routed and is held outside every brain — correct, but invisible, so it accumulates silently. This is per-PERSON and applies to their own captures only; it cannot be set for someone else. ⚠ PASS THE ORG ID when the user has two brains with the SAME NAME (e.g. two called "Personal") — a name matching more than one is REFUSED rather than guessed, and the error lists the ids to choose from. Setting this does NOT file already-held captures; those keep their original dates and may belong in different brains, so sort them deliberately rather than dumping them into the new default.',
+      inputSchema: {
+        brain: z.string().optional().describe('the brain name or org id (from my_brains) where this person\'s session captures should land. Omit to read the current setting instead of changing it.'),
+      },
+    },
+    async ({ brain }) => {
+      const url = `${BASE}/api/brain/capture-default`
+      if (!brain?.trim()) {
+        const res = await fetchCortex(url, { headers: { Authorization: `Bearer ${TOKEN}` } })
+        if (!res.ok) {
+          const body = await res.text()
+          throw new Error(classify(res.status, res.headers.get('content-type'), body, res.headers.get('x-vercel-id')).message)
+        }
+        const { defaults } = await res.json()
+        if (!defaults?.length) {
+          return { content: [{ type: 'text', text: 'No capture brain is set. If you belong to more than one brain, your session captures are being HELD outside every brain until you set one. Call this tool again with `brain` to fix it.' }] }
+        }
+        const lines = defaults.map((d) => `${d.sourceType} captures land in "${d.orgName}" (${d.orgId}), set ${String(d.updatedAt).slice(0, 10)}`)
+        return { content: [{ type: 'text', text: lines.join('\n') }] }
+      }
+      const res = await fetchCortex(url, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify({ sourceType: 'claude-code', brain: brain.trim() }),
+      })
+      const body = await res.text()
+      if (!res.ok) {
+        // Prefer the server's own error: a 409 lists the org ids of an ambiguous name, which IS the
+        // remedy, and a generic classification would throw that away.
+        let msg
+        try { msg = JSON.parse(body).error } catch { /* fall through to the classified message */ }
+        throw new Error(msg ?? classify(res.status, res.headers.get('content-type'), body, res.headers.get('x-vercel-id')).message)
+      }
+      const j = JSON.parse(body)
+      return { content: [{ type: 'text', text: `✓ Your Claude Code sessions now land in "${j.brain}" (${j.orgId}). Sessions captured before now are still held and keep their original dates — file those deliberately, they may not all belong in this brain.` }] }
+    },
+  )
+
+  // T8: cortex-log's authoritative writer. The skill composes a curated summary, then calls this to
+  // persist it AS the durable record (capture_source='skill'). The ingest conflict guard ensures the
+  // auto-capture hook never clobbers it. Pass the SAME sessionId the hook uses so the two dedupe onto
+  // one record; without it the curated log still lands as its own authoritative record.
+  server.registerTool(
+    'log_session',
+    {
+      title: 'Log this session to Agnoclast',
+      description: 'Persist a CURATED summary of this work session as its durable Agnoclast record (authoritative — supersedes the auto-capture hook). Call at session close after composing the summary. `sessionId` now defaults to this session automatically (from CLAUDE_CODE_SESSION_ID) so the log dedupes with the auto-capture of the same session — pass it explicitly only to log on behalf of a DIFFERENT session, e.g. recovering one whose own close-out failed. If you belong to more than one brain you MUST name one — without a brain a session log has no route and is STAGED rather than recorded. **If the session touched work belonging to different brains, pass `segments` instead of `summary` and split it** — one segment per brain, each summary standing on its own and never alluding to the others. Reports every segment individually; a partial result is reported as PARTIAL, never as success.',
+      inputSchema: {
+        summary: z.string().optional().describe('the curated session summary — the single-brain form. Omit when passing `segments`'),
+        segments: z.array(z.object({
+          brain: z.string().describe('destination brain for this half of the session (name or org id)'),
+          summary: z.string().describe('a summary that stands ON ITS OWN. It must not mention, allude to, or imply that other segments exist — "the rest of this session covered personal projects" leaks in prose exactly what splitting was meant to contain'),
+          title: z.string().optional(),
+          project: z.string().optional(),
+        })).optional().describe('SPLIT the log, one entry per brain. Use whenever a session touched work belonging to different brains: a session is a container of time, not a topic, and every single-brain answer is wrong — filing it all in the org brain exposes personal work to colleagues, filing it all in the personal one denies the org its record, and summarizing half silently drops the other half. Max ONE segment per brain (they share this session\'s dedupe key, so two aimed at the same brain would overwrite each other). When a chunk is ambiguous, put it in the MORE PRIVATE brain — a misfile there is private, a misfile the other way is visible to everyone in the org.'),
+        project: z.string().optional().describe('project key/name this session worked in'),
+        title: z.string().optional().describe('short title for the session'),
+        sessionId: z.string().optional().describe('the Claude Code session id — DEFAULTS to the current session, so omit it unless you are logging on behalf of another one. It is shared by every segment and the only thing pairing them, and it is also the join to the pages this session wrote (page_revisions.session_key); without it the record is unattributable forever, since the fallback dedupe key is a timestamp. Deliberately NOT a link: segments never reference each other, so a reader cleared for one brain cannot tell the others exist, while you can join on it across brains'),
+        brain: z.string().optional().describe('which brain to record this session in (name or org id, one of your own). REQUIRED IN EFFECT for a multi-brain member: session-class sources route only by an explicit brain or a sole membership, so omitting it stages the log instead of recording it.'),
+        privacy: z.enum(['accessible', 'scoped', 'confidential']).optional().describe('tier this record AT WRITE TIME. Use when the summary names confidential work (a candidate evaluation, a security finding) — safer than letting it land org-visible and re-tiering after, which leaves it readable in between.'),
+      },
+    },
+    async ({ summary, segments, project, title, sessionId, brain, privacy }) => {
+      // Default the session id from the environment when the caller omits it.
+      //
+      // `sessionId` is optional and the model routinely does not pass it, so the record lands with a
+      // TIMESTAMP dedupe key (`claude-code:<ISO>`) and a null payload.session_id. Measured against
+      // prod 2026-08-19: of 136 skill records, only 33 carried a session id — the other 103 are
+      // unattributable by any means, because the timestamp key is not a fallback identity. That is
+      // 76% of every /cortex-log close-out unable to be joined to the pages that session wrote
+      // (page_revisions.session_key), which is the join the whole currency audit runs on.
+      //
+      // The process has always known this value. It is the same CLAUDE_CODE_SESSION_ID the capture
+      // hook sends as hook.session_id, which is precisely what makes the two dedupe onto one record
+      // instead of two — the stated purpose of the parameter in this tool's own description.
+      //
+      // ⚠ resolveLogSessionId, NOT resolveSessionKey / SESSION_KEY. The latter falls back to
+      // randomUUID(), and a random per-process uuid here would be WORSE than the timestamp it
+      // replaces: it looks like a real session id, mints `claude-code:<random>` as a dedupe key that
+      // pairs with no capture record and matches no page_revisions.session_key, and so manufactures a
+      // confident-looking join that is silently wrong. A missing id is honest; an invented one is not.
+      // Hosts that do not set the var keep today's timestamp behaviour. Negative-controlled in
+      // session_key.test.mjs.
+      sessionId = resolveLogSessionId(sessionId, process.env)
+      // A session is a container of TIME, not a topic (ADR-0029 step 4). Normalize to a list of
+      // segments; the single-brain call is just a one-segment list.
+      const list = Array.isArray(segments) && segments.length
+        ? segments.map((s) => ({ brain: s.brain, summary: s.summary, title: s.title ?? title, project: s.project ?? project }))
+        : (summary ? [{ brain, summary, title, project }] : null)
+      if (!list) {
+        return toolError('Pass `summary` (single brain) or a non-empty `segments` array (one entry per brain).')
+      }
+
+      // Records are unique on the ORG-SCOPED (org_id, dedupe_key) and every segment carries this
+      // session's dedupe key. Cross-brain segments therefore never collide — that constraint is what
+      // makes the whole design work — but two aimed at the SAME brain would silently merge and lose
+      // one. Refuse instead of letting that happen quietly.
+      const seenBrain = new Set()
+      for (const s of list) {
+        const k = String(s.brain ?? '').trim().toLowerCase()
+        if (seenBrain.has(k)) {
+          return toolError(`Two segments target the same brain (${s.brain}). They share this session's dedupe key, so the second would overwrite the first — merge them into one segment.`)
+        }
+        seenBrain.add(k)
+      }
+
+      let brainIndex = null
+      const orgIdFor = async (nameOrId) => {
+        if (!nameOrId) return null
+        if (!brainIndex) {
+          try {
+            const r = await fetchCortex(`${BASE}/api/brains`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+            brainIndex = r.ok ? ((await r.json().catch(() => ({}))).brains ?? []) : []
+          } catch {
+            brainIndex = []
+          }
+        }
+        const q = String(nameOrId).trim().toLowerCase()
+        const hit = brainIndex.find(
+          (b) => String(b.orgId ?? '').toLowerCase() === q || String(b.name ?? '').toLowerCase() === q,
+        )
+        return hit?.orgId ?? null
+      }
+
+      const lines = []
+      let failures = 0
+
+      for (const seg of list) {
+        const where = seg.brain ?? '(no brain named)'
+        let res
+        try {
+          res = await fetchCortex(`${BASE}/api/ingest`, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+              source: 'claude-code',
+              captureSource: 'skill',
+              summary: seg.summary,
+              ...(seg.project ? { project: seg.project } : {}),
+              ...(seg.title ? { title: seg.title } : {}),
+              ...(sessionId ? { sessionId } : {}),
+              // ADR-0022 deleted the write pointer, so a session-class source routes ONLY by an
+              // explicit brain or a sole membership — anything else STAGES. This tool never sent one,
+              // so every close-out from a multi-brain member landed in staged_records instead of the
+              // org. Measured 2026-08-09: 86 staged rows, not drainable by /api/staged/promote.
+              ...(seg.brain ? { brain: seg.brain } : {}),
+              ...(privacy ? { privacy } : {}),
+              payload: { via: 'log_session' },
+            }),
+          })
+        } catch (e) {
+          failures++
+          lines.push(`✗ ${where}: ${e.message}`)
+          continue
+        }
+        if (!res.ok) {
+          const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+          failures++
+          lines.push(`✗ ${where}: ${d.message}`)
+          continue
+        }
+        const j = await res.json().catch(() => ({}))
+
+        // NEVER report a non-record as "logged". `staged` and `skipped` are 200 OK responses that
+        // wrote no record, and this used to print "Logged … updated existing" for both, because
+        // `j.inserted` is merely falsy on a staged write.
+        if (j.staged) {
+          const why = j.reason === 'no_route_for_source' && !seg.brain
+            ? 'no brain named and you belong to more than one, so it had nowhere to route'
+            : `reason: ${j.reason ?? 'unknown'}`
+          failures++
+          lines.push(`✗ ${where}: NOT LOGGED — staged, not recorded (${why}). Re-run this segment with brain:"<name>" — staged session logs cannot be drained by /api/staged/promote.`)
+          continue
+        }
+        if (j.skipped) {
+          failures++
+          lines.push(`✗ ${where}: NOT LOGGED — server skipped the write: ${j.skipped}`)
+          continue
+        }
+
+        // Gate 4 routes a session log into PRIVATE INTAKE rather than straight to records, answering
+        // `via:"private_intake"` with an intakeItemId and no id. The previous check fell through to
+        // "no record id" and reported NOT LOGGED over a write that had landed — a false negative that
+        // drives retries, and retries against ingest make duplicates.
+        //
+        // Materializing here is not an optimization. Close-out is the ONLY moment the destination
+        // brain is known; a unit left in intake goes cleanup-due in a day and becomes an item no later
+        // session has the authority to route, because deciding which brain half of someone's session
+        // belongs in is exactly the judgment a stranger cannot make.
+        if (!j.id && j.via === 'private_intake' && j.intakeItemId) {
+          const orgId = await orgIdFor(seg.brain)
+          if (!orgId) {
+            failures++
+            lines.push(`✗ ${where}: captured to intake as ${j.intakeItemId}, but that brain did not resolve to an org id — materialize it by hand`)
+            continue
+          }
+          let m
+          try {
+            m = await fetchCortex(`${BASE}/api/intake/materialize`, {
+              method: 'POST',
+              headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+              // NESTED under `record`, and snake_case inside it. The route reads the record body
+              // from `body.record` and ignores top-level title/summary entirely — a flat body still
+              // answers `ok` with a recordId, having written a record with no content. Four such
+              // records exist in the corpus from exactly this mistake, and this call was the fifth
+              // until 2026-08-15: the close-out reported success while changing nothing.
+              body: JSON.stringify({
+                intakeItemId: j.intakeItemId,
+                orgId,
+                record: {
+                  title: seg.title,
+                  summary: seg.summary,
+                  source: 'claude-code',
+                  record_type: 'ai_session',
+                },
+              }),
+            })
+          } catch (e) {
+            failures++
+            lines.push(`✗ ${where}: intake ${j.intakeItemId} NOT materialized — ${e.message}`)
+            continue
+          }
+          const mj = await m.json().catch(() => ({}))
+          if (!m.ok || !mj.recordId) {
+            failures++
+            lines.push(`✗ ${where}: intake ${j.intakeItemId} NOT materialized — ${mj.error ?? m.status}`)
+            continue
+          }
+          lines.push(`✓ ${where}: record ${mj.recordId}`)
+          continue
+        }
+
+        if (!j.id) {
+          failures++
+          lines.push(`✗ ${where}: NOT LOGGED — no record id. Raw: ${JSON.stringify(j).slice(0, 200)}`)
+          continue
+        }
+        lines.push(`✓ ${where}: record ${j.id}${j.inserted ? '' : ' (updated existing)'}`)
+      }
+
+      // Partial success is a real outcome once there is more than one segment, and "3 of 4 landed"
+      // must never read as done — that is the same silent-loss shape this whole path was repaired for.
+      const head = failures === 0
+        ? `Logged ${lines.length} segment${lines.length === 1 ? '' : 's'}.`
+        : `PARTIAL — ${lines.length - failures} of ${lines.length} segments logged, ${failures} FAILED. A partly-logged session is not a logged session; re-run the failed segments.`
+      return { content: [{ type: 'text', text: `${head}\n${lines.join('\n')}` }] }
+    },
+  )
+
+  server.registerTool(
+    'maintenance_candidates',
+    {
+      title: 'Review recent project-linked maintenance evidence',
+      description: 'Start here when preparing a handoff, status, or next step for a NAMED project. Returns a bounded, RLS-scoped set of recent raw records already linked to that project, before you trust the authored page. These are candidate evidence, not a command to edit: read them, call project_status, then decide whether a material contradiction warrants a minimal accountable correction. When correcting, retain the decisive factual qualifier (for example completion date or state) in the current-status text. Never mutate merely to clear a candidate.',
+      inputSchema: {
+        project: z.string().describe('the project key or exact project name from the task, e.g. "checkout-v2" or "Checkout v2"'),
+        brain: z.string().optional().describe('brain name or org id when you belong to more than one brain; omit for a sole brain'),
+        since_days: z.number().optional().describe('how far back to inspect (1-90 days, default 30)'),
+        limit: z.number().optional().describe('max candidate records (1-50, default 20)'),
+      },
+    },
+    async ({ project, brain, since_days, limit }) => {
+      const qs = new URLSearchParams({ project })
+      if (brain) qs.set('brain', brain)
+      if (since_days != null) qs.set('since_days', String(since_days))
+      if (limit != null) qs.set('limit', String(limit))
+      const res = await fetchCortex(`${BASE}/api/maintenance/candidates?${qs}`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+      if (!res.ok) {
+        const body = await res.text()
+        throw new Error(classify(res.status, res.headers.get('content-type'), body, res.headers.get('x-vercel-id')).message)
+      }
+      const { text } = await res.json()
+      return { content: [{ type: 'text', text }] }
+    },
+  )
+
+  server.registerTool(
+    'gate3_status',
+    {
+      title: 'Gate 3 currency monitor',
+      description: 'Read the aggregate-only Gate 3 currency-monitor status for this brain. It counts explicit maintenance-candidate reviews and their same-session durable corrections in the rolling window; it never exposes project names, evidence content, or session keys. "machine_evidence_ready" means enough ordinary-work evidence has accumulated to request a human closure decision, not that the monitor closes the gate itself.',
+      inputSchema: {
+        days: z.number().optional().describe('rolling window in days (1-90, default 14)'),
+        brain: z.string().optional().describe('brain name or org id when you belong to more than one brain; omit for a sole brain'),
+      },
+    },
+    async ({ days, brain }) => {
+      const qs = new URLSearchParams()
+      if (days != null) qs.set('days', String(days))
+      if (brain) qs.set('brain', brain)
+      const suffix = qs.size ? `?${qs}` : ''
+      const res = await fetchCortex(`${BASE}/api/gates/3/status${suffix}`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+      if (!res.ok) {
+        const body = await res.text()
+        throw new Error(classify(res.status, res.headers.get('content-type'), body, res.headers.get('x-vercel-id')).message)
+      }
+      const status = await res.json()
+      const text = status.machineEvidenceReady
+        ? `Gate 3 machine evidence is ready: ${status.maintenanceReviewSessions} independent maintenance-review sessions and ${status.correctionSessions} correction sessions in ${status.days} days. A human should confirm these were ordinary work before closing the gate.`
+        : `Gate 3 is still collecting evidence: ${status.maintenanceReviewSessions}/${status.requiredReviewSessions} independent maintenance-review sessions and ${status.correctionSessions}/${status.requiredCorrectionSessions} correction sessions in ${status.days} days. No gate decision has been made.`
+      return { content: [{ type: 'text', text }] }
+    },
+  )
+
+  server.registerTool(
+    'gate2_status',
+    {
+      title: 'Gate 2 edit-accountability monitor',
+      description: 'Read the aggregate-only Gate 2 status for this brain — whether every edit records WHICH SESSION made it. It counts only the REPAIRED write paths (absorb, retier, replace) since the 2026-08-17 fix, because the author path was never broken and would certify a repair it never exercised. Operator and migration writes are excluded: they legitimately have no session, and imputing one would violate the 0093 don\'t-impute rule. It never exposes page titles, refs, reasons or session keys. "regressed" means a repaired path lost its session attribution again and the gate must NOT be closed; "machine_evidence_ready" means enough ordinary-work evidence has accumulated to request a human closure decision.',
+      inputSchema: {
+        days: z.number().optional().describe('rolling window in days (1-90, default 14)'),
+        brain: z.string().optional().describe('brain name or org id when you belong to more than one brain; omit for a sole brain'),
+      },
+    },
+    async ({ days, brain }) => {
+      const qs = new URLSearchParams()
+      if (days != null) qs.set('days', String(days))
+      if (brain) qs.set('brain', brain)
+      const suffix = qs.size ? `?${qs}` : ''
+      const res = await fetchCortex(`${BASE}/api/gates/2/status${suffix}`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+      if (!res.ok) {
+        const body = await res.text()
+        throw new Error(classify(res.status, res.headers.get('content-type'), body, res.headers.get('x-vercel-id')).message)
+      }
+      const status = await res.json()
+      const text = status.status === 'regressed'
+        ? `\u26a0 Gate 2 has REGRESSED: ${status.unattributedMcpRevisions} MCP-authored revisions since ${status.since} carry NO session (${status.unattributedRepairedRevisions} of them on the repaired absorb/retier/replace paths). Attribution is being dropped again — do not close this gate; find the writer.`
+        : status.machineEvidenceReady
+          ? `Gate 2 machine evidence is ready: ${status.repairedPathSessions} distinct sessions exercised the repaired write paths across ${status.repairedPathRevisions} revisions since ${status.since}, and NONE lost its session. A human should confirm these were ordinary work before closing the gate.`
+          : `Gate 2 is still collecting evidence: ${status.repairedPathSessions}/${status.requiredRepairedPathSessions} distinct sessions have exercised the repaired write paths (absorb/retier/replace) since ${status.since}, across ${status.repairedPathRevisions} revisions, 0 unattributed. No gate decision has been made.`
+      return { content: [{ type: 'text', text }] }
+    },
+  )
+
+  server.registerTool(
+    'session_context',
+    {
+      title: 'Query-centered session context',
+      description: 'Build a session-start context block around the user\'s opening question: pick the most relevant seed node, pull its neighborhood, and compress farther hops.',
+      inputSchema: { question: z.string().describe('the opening user question or request for this session') },
+    },
+    async ({ question }) => {
+      const res = await fetchCortex(`${BASE}/api/session-context`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify({ question }),
+      })
+      if (!res.ok) {
+        const body = await res.text()
+        throw new Error(classify(res.status, res.headers.get('content-type'), body, res.headers.get('x-vercel-id')).message)
+      }
+      const { context } = await res.json()
+      return { content: [{ type: 'text', text: context }] }
+    },
+  )
+
+  // Pull/claim attribution ([[cortex-subscription-inference]]): the agent decides which project a
+  // messaging thread is about — on ITS subscription, zero server-metered inference — and records it
+  // here. The server stamps `project:<slug>` onto the thread's timeline events via the locked-down
+  // cortex_labeler role, so the thread threads onto that project's node timeline (retroactive @> join).
+  server.registerTool(
+    'attribute_thread',
+    {
+      title: 'Attribute a messaging thread to a project',
+      description: "Record that a messaging thread (email, etc.) belongs to a project — stamps project:<slug> onto the thread's timeline events so its whole history threads onto that project's node timeline. Attribute AS YOU WORK: when you recognize which known project a thread you're looking at is about, attribute it. KNOWN projects only — if you're not confident, don't (a wrong tag pollutes a timeline; leaving it unattributed self-heals). Idempotent (safe to re-call) and reversible (remove:true undoes an attribution you made).",
+      inputSchema: {
+        threadKey: z.string().describe('the thread identifier — a Gmail threadId, or a full `thread:<id>` key'),
+        project: z.string().describe('the slug/key of the EXISTING project the thread belongs to'),
+        remove: z.boolean().optional().describe('true to REMOVE a project attribution you previously made (reversibility)'),
+      },
+    },
+    async ({ threadKey, project, remove }) => {
+      const res = await fetchCortex(`${BASE}/api/timeline/attribute`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify({ threadKey, project, ...(remove ? { remove: true } : {}) }),
+      })
+      if (!res.ok) {
+        const body = await res.text()
+        throw new Error(classify(res.status, res.headers.get('content-type'), body, res.headers.get('x-vercel-id')).message)
+      }
+      const j = await res.json().catch(() => ({}))
+      const verb = remove ? 'Removed' : 'Attributed'
+      const prep = remove ? 'from' : 'to'
+      return { content: [{ type: 'text', text: `${verb} ${j.threadKey ?? threadKey} ${prep} ${j.project ?? `project:${project}`} — ${j.stamped ?? 0} event(s) ${remove ? 'un' : ''}stamped.` }] }
+    },
+  )
+
+  // The PULL half: surface the org's unattributed messaging backlog so the agent can triage it and
+  // attribute the threads it recognizes (pairs with attribute_thread above).
+  server.registerTool(
+    'timeline_pull',
+    {
+      title: 'Pull the unclaimed backlog to triage',
+      description: "Surface everything captured in the org that NO ONE has judged yet — the backlog awaiting your judgment. Two sections: unattributed EMAIL threads (grouped, since a thread is what you actually triage), and unclaimed RECORDS from every other source (commits, sessions, docs, calendar) one by one. Call it as you work; when you recognize which KNOWN project a surfaced thread is about, attribute it with attribute_thread. Things you don't recognize: leave them — they stay in the backlog and self-heal as the graph fills. Pass a `project` you're working on to RANK the thread half by relevance (threads sharing participants with that project come first, marked ★); records are always newest-first. Returns enough to RECOGNIZE an item — participants, subject, title, recency — never the bodies.",
+      inputSchema: {
+        limit: z.number().optional().describe('max threads to return (default 20)'),
+        project: z.string().optional().describe('optional KNOWN project slug to rank the backlog by relevance to what you are working on; omit for the whole backlog newest-first'),
+      },
+    },
+    async ({ limit, project }) => {
+      const params = new URLSearchParams()
+      if (typeof limit === 'number') params.set('limit', String(limit))
+      if (typeof project === 'string' && project) params.set('project', project)
+      const qs = params.toString() ? `?${params}` : ''
+      const res = await fetchCortex(`${BASE}/api/timeline/pull${qs}`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+      if (!res.ok) {
+        const body = await res.text()
+        throw new Error(classify(res.status, res.headers.get('content-type'), body, res.headers.get('x-vercel-id')).message)
+      }
+      const { threads, records } = await res.json()
+      if (!threads?.length && !records?.length) return { content: [{ type: 'text', text: 'Nothing in the backlog — everything captured so far has been claimed.' }] }
+
+      const sections = []
+
+      if (threads?.length) {
+        const lines = threads.map((t) => {
+          const who = (t.participants ?? []).map((p) => String(p).replace(/^email:/, '')).join(', ')
+          const when = t.lastAt ? String(t.lastAt).slice(0, 10) : '—'
+          const rel = t.relevance && t.relevance.score > 0 ? ` · ★${t.relevance.score} ${t.relevance.reason}` : ''
+          return `- ${t.threadKey} — ${t.subject ?? '(no subject)'} · ${who || 'unknown participants'} · ${t.eventCount} msg · ${when}${rel}`
+        })
+        const header = project
+          ? `Unattributed threads (${threads.length}), ranked for project:${project} (★ = shares participants)`
+          : `Unattributed threads (${threads.length})`
+        sections.push(`${header} — attribute recognized ones with attribute_thread(threadKey, project):\n${lines.join('\n')}`)
+      }
+
+      // The other 12 sources. No thread concept exists for a commit or a session log, so each is one
+      // row. `node` is shown when the record already carries a project — often the whole answer, and it
+      // is why these are NOT ranked by relevance: a record that already has a node needs judgment least.
+      if (records?.length) {
+        const lines = records.map((r) => {
+          const when = r.occurredAt ? String(r.occurredAt).slice(0, 10) : '—'
+          const node = r.node ? ` · → ${r.node}` : ''
+          return `- ${r.source}/${r.recordType ?? 'record'} — ${r.title ?? '(untitled)'} · ${when}${node}  [${r.recordId}]`
+        })
+        sections.push(`Unclaimed records (${records.length}) from other sources — newest first:\n${lines.join('\n')}`)
+      }
+
+      return { content: [{ type: 'text', text: sections.join('\n\n') }] }
+    },
+  )
+
+  // ── Gate 4 private intake (Slice 3) ──────────────────────────────────────────────────────────
+  server.registerTool(
+    'intake_changes',
+    {
+      title: 'Check private intake changes',
+      description:
+        'Session heartbeat for Gate 4 private intake. Returns an operational delta since your cursor (no ciphertext) plus cleanupDueCount. Call at session start, before each user turn, after long actions, and at least every two minutes while actively working. cleanupDueCount is advisory: prefer to service it with claimKind=cleanup when you reach a natural break, but never park the work you were actually asked to do in order to drain the queue first. NOTE afterSeq is this feed\'s own sequence — the changeSeq returned by ingest is a different counter, and passing it here seeks past the end and looks like a dead feed.',
+      inputSchema: {
+        afterSeq: z.number().optional().describe('cursor from the previous call (default 0)'),
+        limit: z.number().optional().describe('max change rows (default 100)'),
+      },
+    },
+    async ({ afterSeq, limit }) => {
+      const params = new URLSearchParams()
+      if (typeof afterSeq === 'number') params.set('afterSeq', String(afterSeq))
+      if (typeof limit === 'number') params.set('limit', String(limit))
+      const qs = params.toString() ? `?${params}` : ''
+      const res = await fetchCortex(`${BASE}/api/intake/changes${qs}`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+      if (!res.ok) {
+        const body = await res.text()
+        if (res.status === 403) return toolError('Private intake is not enabled for this account.')
+        throw new Error(classify(res.status, res.headers.get('content-type'), body, res.headers.get('x-vercel-id')).message)
+      }
+      return { content: [{ type: 'text', text: JSON.stringify(await res.json(), null, 2) }] }
+    },
+  )
+
+  server.registerTool(
+    'intake_claim',
+    {
+      title: 'Claim private intake items',
+      description:
+        'Claim a lease on private intake items (relevance or cleanup). Returns decrypted payloads for the lease holder only. Requires x-cortex-session-key (set automatically by this MCP server). Aged work never blocks a claim: the response reports cleanupDueCount and how far behind the oldest unit is, and servicing it is expected but always your call. Claiming is a commitment to process — hand back anything you will not finish with intake_release, or intake_defer if it is the owner\'s decision to make.',
+      inputSchema: {
+        claimKind: z.enum(['relevance', 'cleanup']).optional().describe('default relevance'),
+        limit: z.number().optional().describe('max items (default 10). Ignored when intakeItemIds is given.'),
+        intakeItemIds: z.array(z.string()).optional().describe(
+          'claim these specific units instead of the head of the queue (max 50). Without it you get FIFO, ' +
+          'so reaching one known unit means claiming everything ahead of it. Ids come from intake_changes ' +
+          'or from an ingest response. The reply adds an `outcomes` entry per requested id — claimed, ' +
+          'held_by_you (you already hold a live lease on it — proceed, do not re-claim), ' +
+          'held (someone else has a live lease; the holder is a stable hash, never their session key), ' +
+          'ineligible (already resolved or deferred to the owner), not_found, or unavailable (a momentary ' +
+          'lock — retrying is reasonable). Outcomes are best-effort, not a snapshot you can rely on.',
+        ),
+      },
+    },
+    async ({ claimKind, limit, intakeItemIds }) => {
+      const res = await fetchCortex(`${BASE}/api/intake/claim`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          claimKind: claimKind ?? 'relevance',
+          limit,
+          includePayload: true,
+          // Forwarded only when present. An empty array is a real request to claim nothing and must
+          // survive as one; sending `[]` where the caller sent nothing would silently switch a FIFO
+          // claim into a no-op.
+          ...(intakeItemIds ? { intakeItemIds } : {}),
+        }),
+      })
+      if (!res.ok) {
+        const body = await res.text()
+        if (res.status === 403) return toolError('Private intake is not enabled for this account.')
+        // Kept deliberately after the server stopped sending it. A published MCP build outlives any
+        // one deployment, so this client will meet servers that still refuse relevance claims while
+        // cleanup is due. Surfacing that as its own message beats a generic HTTP failure.
+        if (res.status === 409) return toolError(body)
+        throw new Error(classify(res.status, res.headers.get('content-type'), body, res.headers.get('x-vercel-id')).message)
+      }
+
+      const j = await res.json()
+
+      // The nudge that replaced the 409. It has to be legible without doing arithmetic on a
+      // timestamp, so say how far behind rather than printing an ISO string and hoping — "6 days"
+      // is a reason to act and "2026-08-09T…" is a field to skim past.
+      let nudge = ''
+      if ((j?.cleanupDueCount ?? 0) > 0) {
+        const n = j.cleanupDueCount
+        let behind = ''
+        const oldest = j?.oldestCleanupDueAt ? Date.parse(j.oldestCleanupDueAt) : NaN
+        if (Number.isFinite(oldest)) {
+          const mins = Math.max(0, Math.floor((Date.now() - oldest) / 60000))
+          behind = mins >= 1440 ? `, oldest ${Math.floor(mins / 1440)}d overdue`
+                 : mins >= 60   ? `, oldest ${Math.floor(mins / 60)}h overdue`
+                 : `, oldest ${mins}m overdue`
+        }
+        nudge = `\n\n⏳ ${n} intake unit${n === 1 ? '' : 's'} past the cleanup deadline${behind}. `
+              + `Nothing is blocked — run intake_claim with claimKind:"cleanup" when you reach a natural break.`
+      }
+
+      return { content: [{ type: 'text', text: JSON.stringify(j, null, 2) + nudge }] }
+    },
+  )
+
+  server.registerTool(
+    'intake_materialize',
+    {
+      title: 'Materialize a private intake item',
+      description:
+        'Atomically publish a claimed intake item into one brain. Deterministic identifier homes in that brain are always attached; documentIds may add further pages. Sets record confidentiality to the strictest attached page tier. Never writes private intake into search/history before this call.',
+      inputSchema: {
+        intakeItemId: z.string().describe('intake item uuid'),
+        orgId: z.string().describe('destination brain org uuid'),
+        documentIds: z.array(z.string()).optional().describe('additional brain_documents ids in orgId (deterministic homes are merged automatically)'),
+        title: z.string().optional(),
+        summary: z.string().optional(),
+        source: z.string().optional(),
+        recordType: z.string().optional(),
+        dedupeKey: z.string().optional(),
+        origin: z.enum(['deterministic', 'llm', 'user', 'session']).optional(),
+      },
+    },
+    async (args) => {
+      const res = await fetchCortex(`${BASE}/api/intake/materialize`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          intakeItemId: args.intakeItemId,
+          orgId: args.orgId,
+          documentIds: args.documentIds ?? [],
+          record: {
+            title: args.title,
+            summary: args.summary,
+            source: args.source,
+            record_type: args.recordType,
+            dedupe_key: args.dedupeKey,
+          },
+          attachmentMeta: (args.documentIds ?? []).map(() => ({ origin: args.origin ?? 'llm' })),
+        }),
+      })
+      if (!res.ok) {
+        const body = await res.text()
+        return toolError(body)
+      }
+      return { content: [{ type: 'text', text: JSON.stringify(await res.json(), null, 2) }] }
+    },
+  )
+
+  server.registerTool(
+    'intake_discard',
+    {
+      title: 'Discard a private intake item',
+      description:
+        'The OTHER terminal outcome for a claimed intake unit: this is nothing, drop it. Use it for content that should never become a record — unsubscribe receipts, empty greetings, marketing blasts, a stranger\'s photo — instead of materializing junk into a brain because materialize was the only verb available. IRREVERSIBLE: the ciphertext and nonces are destroyed in the same transaction, and a content-free tombstone stops the connector re-delivering the unit. You must already hold the claim (discarding something you never read is refused), `reason` is required and is stored, and it is one item per call — a loop discarding a whole pile on one decision is a bulk job, not judgment.',
+      inputSchema: {
+        intakeItemId: z.string().describe('intake item uuid from intake_claim'),
+        reason: z.string().describe('why this is nothing — recorded on the claim, and the only surviving trace of the decision'),
+      },
+    },
+    async ({ intakeItemId, reason }) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/intake/discard`, {
+          method: 'POST',
+          headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({ intakeItemId, reason }),
+        })
+      } catch (e) {
+        return toolError(`Could not discard: ${e.message}`)
+      }
+      const out = await res.json().catch(() => null)
+      if (!res.ok) {
+        if (out?.error === 'not_claimed') {
+          return toolError('You do not hold a claim on that item — intake_claim it first, so the discard follows from having read it.')
+        }
+        if (out?.error === 'already_materialized') {
+          return toolError('That unit already became a record. Discarding it now would orphan the record from its source — detach or retier the record instead.')
+        }
+        return toolError(`Could not discard: ${out?.error ?? res.status}${out?.detail ? ` — ${out.detail}` : ''}`)
+      }
+      if (out?.alreadyDiscarded) {
+        return { content: [{ type: 'text', text: 'Already discarded — nothing to do.' }] }
+      }
+      return { content: [{ type: 'text', text: 'Discarded. Content destroyed, tombstone written so the source cannot re-deliver it.' }] }
+    },
+  )
+
+  server.registerTool(
+    'intake_defer',
+    {
+      title: 'Defer a private intake item to the owner',
+      description:
+        'The THIRD terminal outcome, and the right one whenever the honest answer is "this is not mine to decide." Use it when a claimed unit is someone else\'s private content, when the destination brain is a real judgment call rather than a lookup, or when publishing and destroying are both wrong — a stranger\'s message thread, a photo you cannot place, an email whose brain depends on context only the owner has. Destroys NOTHING: the unit stays encrypted and intact, its state becomes `awaiting_user`, and your `question` is what the owner actually sees. Prefer this over letting a lease lapse — a lapsed lease says nothing, increments `attempts`, and hands the identical dead end to the next session. Requires the claim, one item per call.',
+      inputSchema: {
+        intakeItemId: z.string().describe('intake item uuid from intake_claim'),
+        question: z.string().describe('what you need the owner to decide, in their words not yours — this is the entire message they get, so "which brain should this iMessage thread go to, if any?" beats "needs triage"'),
+        options: z.array(z.string()).optional().describe('the concrete choices, when the decision is a pick rather than an open question — e.g. ["Personal","TTO","Discard — nothing to record"]. Stored on the question and rendered by intake_cleanup_status, so the owner can answer with a choice instead of prose.'),
+      },
+    },
+    async ({ intakeItemId, question, options }) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/intake/defer`, {
+          method: 'POST',
+          headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({ intakeItemId, question, ...(options?.length ? { options } : {}) }),
+        })
+      } catch (e) {
+        return toolError(`Could not defer: ${e.message}`)
+      }
+      const out = await res.json().catch(() => null)
+      if (!res.ok) {
+        if (out?.error === 'not_claimed') {
+          return toolError('You do not hold a claim on that item — intake_claim it first, so the question follows from having read it.')
+        }
+        if (out?.error === 'already_terminal') {
+          return toolError(`Nothing left to ask about: ${out?.detail ?? 'the unit is already materialized or discarded'}.`)
+        }
+        return toolError(`Could not defer: ${out?.error ?? res.status}${out?.detail ? ` — ${out.detail}` : ''}`)
+      }
+      if (out?.alreadyDeferred) {
+        return { content: [{ type: 'text', text: 'Already awaiting the owner — nothing to do.' }] }
+      }
+      return { content: [{ type: 'text', text: 'Deferred to the owner. Content preserved, question queued in intake_cleanup_status.openQuestions, and the unit no longer gates cleanup.' }] }
+    },
+  )
+
+  server.registerTool(
+    'intake_release',
+    {
+      title: 'Hand an intake claim back',
+      description:
+        'Give a claimed unit back to the queue WITHOUT deciding anything. This is not a fourth outcome — materialize, discard and defer resolve a unit; release just ends your hold on it. Use it when you claimed more than you can act on, or when the unit turns out to belong to work you are not doing. Prefer it over letting the lease expire: a lapse and a crash are indistinguishable in the ledger, so silently timing out costs the pile the one signal that says a session looked and chose to pass. Use intake_defer instead when the unit needs the OWNER to decide — release puts it back in front of the next session, which will hit whatever wall you did.',
+      inputSchema: {
+        intakeItemId: z.string().describe('intake item uuid from intake_claim'),
+        reason: z.string().describe('why you are handing it back — "claimed too broadly", "not related to this session\'s work". Recorded on the claim, and the only thing distinguishing this from a lapsed lease'),
+      },
+    },
+    async ({ intakeItemId, reason }) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/intake/release`, {
+          method: 'POST',
+          headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({ intakeItemId, reason }),
+        })
+      } catch (e) {
+        return toolError(`Could not release: ${e.message}`)
+      }
+      const out = await res.json().catch(() => null)
+      if (!res.ok) {
+        if (out?.error === 'not_claimed') {
+          return toolError('You do not hold a claim on that item — there is nothing to hand back.')
+        }
+        if (out?.error === 'awaiting_user') {
+          return toolError('That unit is already deferred to the owner. Releasing it would orphan the open question — leave it, or have the owner answer it.')
+        }
+        if (out?.error === 'already_terminal') {
+          return toolError(`Nothing to release: ${out?.detail ?? 'the unit is already materialized or discarded'}.`)
+        }
+        return toolError(`Could not release: ${out?.error ?? res.status}${out?.detail ? ` — ${out.detail}` : ''}`)
+      }
+      return { content: [{ type: 'text', text: 'Released. The unit is back in the queue as pending, and your lease is gone.' }] }
+    },
+  )
+
+  server.registerTool(
+    'intake_cleanup_status',
+    {
+      title: 'Private intake cleanup status',
+      description: 'Counts of pending/claimed/awaiting/cleanup-due intake items, open clarifying questions for the owner, and `needsAttention` — units that keep coming back, with attempts / releases / deferrals / lapses each broken out. A high `lapses` means sessions claimed that unit and neither resolved it nor handed it back; a `deferrals` above 1 means the owner has already been asked more than once. Both are the OWNER\'s signal to act on, not yours — surface them rather than trying to clear them yourself.',
+      inputSchema: {},
+    },
+    async () => {
+      const res = await fetchCortex(`${BASE}/api/intake/cleanup-status`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+      if (!res.ok) {
+        const body = await res.text()
+        if (res.status === 403) return toolError('Private intake is not enabled for this account.')
+        throw new Error(classify(res.status, res.headers.get('content-type'), body, res.headers.get('x-vercel-id')).message)
+      }
+      return { content: [{ type: 'text', text: JSON.stringify(await res.json(), null, 2) }] }
+    },
+  )
+
+  server.registerTool(
+    'search_org',
+    {
+      title: 'Search the org',
+      description: 'Search your visible work activity and projects by keyword.',
+      inputSchema: { query: z.string().describe('keyword to search for — people or work activity') },
+    },
+    async ({ query }) => {
+      // Real search via /api/search: records (RLS-scoped retrieve) + graph entities (people),
+      // instead of substring-grepping the cached context. People were previously invisible to search.
+      const res = await fetchCortex(`${BASE}/api/search?q=${encodeURIComponent(query)}`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+      if (!res.ok) {
+        const body = await res.text()
+        throw new Error(classify(res.status, res.headers.get('content-type'), body, res.headers.get('x-vercel-id')).message)
+      }
+      const { people = [], records = [], brains = [] } = await res.json()
+      if (!people.length && !records.length) return { content: [{ type: 'text', text: `No visible results for "${query}".` }] }
+      // Multi-brain: tag each hit with its brain only when results span more than one (single-brain
+      // callers see no noise). `brains` also carries any brain that errored (fail-soft).
+      const multi = brains.filter((b) => b.ok).length > 1
+      const tag = (brain) => (multi && brain ? `  · ${brain}` : '')
+      const lines = []
+      if (people.length) {
+        lines.push('People:')
+        for (const p of people) {
+          const meta = [p.title, p.company].filter(Boolean).join(', ')
+          lines.push(`- ${p.name}${meta ? ` (${meta})` : ''} — mentioned in ${p.mentions} record${p.mentions === 1 ? '' : 's'}${tag(p.brain)}`)
+        }
+      }
+      if (records.length) {
+        if (lines.length) lines.push('')
+        lines.push('Activity:')
+        for (const r of records) lines.push(`- [${r.source}] ${r.title}${r.project ? ` (${r.project})` : ''}${tag(r.brain)}`)
+      }
+      const failed = brains.filter((b) => !b.ok)
+      if (failed.length) lines.push('', `(couldn't reach ${failed.length} brain${failed.length === 1 ? '' : 's'}: ${failed.map((b) => b.name).join(', ')})`)
+      return { content: [{ type: 'text', text: `Results for "${query}":\n${lines.join('\n')}` }] }
+    },
+  )
+
+  server.registerTool(
+    'search_spam_email',
+    {
+      title: 'Search Gmail Spam intentionally',
+      description: 'Search a connected Gmail Spam folder only when the user explicitly asks you to find a message that may have been marked as Spam. This is read-only: results are returned for this request only and are NOT added to Agnoclast records, timeline, or future context. Give a specific Gmail search such as a sender, subject words, or date. Normal Gmail sync never reads Spam.',
+      inputSchema: {
+        query: z.string().min(2).describe('specific Gmail search within Spam, e.g. `from:billing@example.com`, `subject:(appointment reminder)`, or `after:2026/08/01`'),
+        account: z.string().email().optional().describe('which connected Gmail account to search when more than one is available'),
+        limit: z.number().int().min(1).max(10).optional().describe('maximum matches to return (default 5; max 10)'),
+      },
+    },
+    async ({ query, account, limit }) => {
+      const res = await fetchCortex(`${BASE}/api/gmail/search-spam`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify({ query, ...(account ? { account } : {}), ...(limit ? { limit } : {}) }),
+      })
+      const body = await res.json().catch(() => null)
+      if (!res.ok) {
+        if (res.status === 409 && Array.isArray(body?.accounts)) {
+          return toolError(`Choose a connected Gmail account and call again with account: ${body.accounts.join(', ')}`)
+        }
+        return toolError(body?.error ?? `Spam search failed (${res.status}).`)
+      }
+      const rows = Array.isArray(body?.messages) ? body.messages : []
+      if (!rows.length) return { content: [{ type: 'text', text: `No Spam matches in ${body?.account ?? 'the connected Gmail account'}. Nothing was saved to Agnoclast.` }] }
+      const lines = [`Spam matches in ${body.account} (read-only; not saved to Agnoclast):`]
+      for (const m of rows) {
+        lines.push(`- ${m.date || 'unknown date'} · ${m.from || 'unknown sender'} · ${m.subject}\n  ${m.snippet || '(no preview)'}\n  ${m.sourceUri}`)
+      }
+      return { content: [{ type: 'text', text: lines.join('\n') }] }
+    },
+  )
+
+  server.registerTool(
+    'grep',
+    {
+      title: 'Grep the brain wiki',
+      description:
+        'Ranked keyword search across your visible brain wiki pages. Multi-word natural-language queries work (results are ranked by relevance). Pass mode:"substring" for an exact literal match of symbols, identifiers, or [[links]]. Returns matching sections with a context snippet and their outbound [[links]].',
+      inputSchema: {
+        query: z.string().describe('search terms (natural language is fine)'),
+        mode: z.enum(['substring', 'fts']).optional().describe("'fts' (default, ranked keyword) or 'substring' (exact literal — for identifiers / [[links]] / code)"),
+      },
+    },
+    async ({ query, mode }) => {
+      const qs = new URLSearchParams({ q: query, mode: mode === 'substring' ? 'substring' : 'fts' })
+      const res = await fetchCortex(`${BASE}/api/grep?${qs.toString()}`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+      if (!res.ok) {
+        const body = await res.text()
+        throw new Error(classify(res.status, res.headers.get('content-type'), body, res.headers.get('x-vercel-id')).message)
+      }
+      const payload = await res.json()
+      return { content: [{ type: 'text', text: formatGrepHits(payload, query) }] }
+    },
+  )
+
+  server.registerTool(
+    'code_graph_query',
+    {
+      title: 'Query the local code structure graph (graphify)',
+      description:
+        'Query a structural code graph for the repo at the CURRENT working directory, built locally by graphify (tree-sitter AST — deterministic, no LLM, no server round-trip; this is LOCAL MACHINE data, not org-shared Agnoclast content, and reflects a snapshot of one commit, not live files). Use for MULTI-HOP questions a single grep cannot answer: what calls/imports/depends on X, how A structurally reaches B, or a repo-wide overview (hub/community files). Do NOT use for single-hop lookups (does file X import Y) — grep is faster and always current. Structure only — it knows what imports/calls what, never WHY; read the actual files or authored Agnoclast pages for intent.',
+      inputSchema: {
+        action: z.enum(['query', 'path', 'explain']).describe('"query" = open-ended natural-language question (graph traversal); "path" = shortest structural path between two named nodes; "explain" = describe one node and list its direct connections'),
+        question: z.string().optional().describe('required for action:"query" — the natural-language question'),
+        from: z.string().optional().describe('required for action:"path" — the starting node name'),
+        to: z.string().optional().describe('required for action:"path" — the target node name'),
+        node: z.string().optional().describe('required for action:"explain" — the node name to describe'),
+      },
+    },
+    async ({ action, question, from, to, node }) => {
+      const result = runCodeGraphQuery({ action, question, from, to, node })
+      return { content: [{ type: 'text', text: result.text }] }
+    },
+  )
+
+  server.registerTool(
+    'project_status',
+    {
+      title: 'Project status',
+      description: 'Status of a specific project by key (e.g. checkout-v2). Returns the AUTHORED wiki page (the synthesized understanding) when one exists, falling back to the records-derived line. Returns only what you can see.',
+      inputSchema: { key: z.string().describe('project key, e.g. checkout-v2') },
+    },
+    async ({ key }) => {
+      // Prefer the AUTHORED page (synthesized understanding, sovereign over records). Freshest tier leads,
+      // each dated, so diverged tiers read as "newest first" instead of an undated stale/fresh blend.
+      try {
+        const res = await fetchCortex(`${BASE}/api/brain/page?kind=project&key=${encodeURIComponent(key)}`,
+          { headers: { Authorization: `Bearer ${TOKEN}` } })
+        if (res.ok) {
+          const page = await res.json()
+          // Multi-brain: /api/brain/page returns matches[] (one per brain that has the page).
+          let matches = Array.isArray(page?.matches) ? page.matches.filter((m) => m.authored && Array.isArray(m.tiers) && m.tiers.length) : []
+          // Rollout back-compat: adapt an older server's single-page shape to one match.
+          if (!matches.length && page?.authored && Array.isArray(page.tiers) && page.tiers.length) {
+            matches = [{ brain: null, authored: true, title: page.title, tiers: page.tiers }]
+          }
+          if (matches.length) {
+            const day = (d) => (d ? String(d).slice(0, 10) : '')
+            const renderMatch = (m) => {
+              const blocks = m.tiers.map((t) => {
+                // Was heading-then-body with NO currency at all — no as-of, no warning — while
+                // read_page showed it. project_status is what the routing docs reach for first, so a
+                // reader here could date nothing. Same renderer as read_page now, so the two cannot
+                // drift again.
+                const secs = (t.sections ?? []).map((s) => renderSection(s, day)).join('\n\n')
+                const head = `[${t.tier}${day(t.updated_at) ? ` · authored ${day(t.updated_at)}` : ''}${t.validity && t.validity !== 'current' ? ` · ${t.validity}` : ''}]`
+                return [head, t.summary, secs].filter(Boolean).join('\n')
+              })
+              const brainTag = matches.length > 1 ? ` · brain: ${m.brain}` : ''
+              return `# ${m.title ?? key} (authored page${brainTag})\n\n${blocks.join('\n\n---\n\n')}`
+            }
+            return { content: [{ type: 'text', text: matches.map(renderMatch).join('\n\n═══\n\n') }] }
+          }
+        }
+      } catch { /* fall through to the records-derived line */ }
+      // Fallback: no authored page yet — surface the records-derived line from the context snapshot.
+      const text = await fetchContext()
+      const line = text.split('\n').find((l) => l.includes(`**${key}**`) || l.includes(key))
+      return { content: [{ type: 'text', text: line ? `Project ${key} (records-derived; not yet authored):\n${line.trim()}` : `No visible project "${key}".` }] }
+    },
+  )
+
+  server.registerTool(
+    'read_page',
+    {
+      title: 'Read a wiki page in full',
+      description:
+        'READ the full authored wiki page for one node (project/person/org/you) by its canonical name — every section, every tier you can see. This is how you READ a node; `grep` only LOCATES pages (snippets + their [[links]]), it does not read them. Navigate like a researcher: read the page you need, then FOLLOW its inline [[links]] by calling read_page on each linked name — keep following while the linked pages stay relevant, stop when they do not. You decide how deep to go. Returns only what you are permitted to see.',
+      inputSchema: {
+        name: z.string().describe('the canonical node name exactly as written (e.g. "Agnoclast", "Ben", or a [[link]] target) — identifier links ([[repo:owner/name]]) resolve to their authored HOME + a visible-event count'),
+        kind: z.enum(['project', 'person', 'org', 'user']).optional().describe('node kind (default project; pass person/org for people/teams)'),
+        expand: z.boolean().optional().describe('identifier names only: also list recent visible timeline events for this identifier (default: home + count)'),
+        history: z.boolean().optional().describe('node names only: return the node\'s TIMELINE (events joined via its [[repo:…]] stamps, reverse-chron, viewer-visible) instead of the page body. The page is the present; this is the history.'),
+        version: z.string().optional().describe('read a HISTORICAL version of this page instead of the current one: a rev_no (e.g. "3") or a content_hash from page_history. Use page_history first to see the versions, then rollback_page to restore one.'),
+      },
+    },
+    async ({ name, kind, expand, history, version }) => {
+      const k = kind ?? 'project'
+      // PAGE HISTORY (Part A): a specific version reads one historical body, resolved within this page's
+      // own history. Not for identifier-shaped names (those are join keys, handled below).
+      if (version && !/^[a-z][a-z0-9_-]*:.+/i.test(name)) {
+        try {
+          const qs = new URLSearchParams({ kind: k, key: name, version })
+          const vr = await fetchCortex(`${BASE}/api/brain/page?${qs}`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+          if (vr.status === 404) return { content: [{ type: 'text', text: `No version "${version}" for "${name}" (or you can't see it). Use page_history "${name}" to list its versions.` }] }
+          if (!vr.ok) {
+            const d = classify(vr.status, vr.headers.get('content-type'), await vr.text(), vr.headers.get('x-vercel-id'))
+            return toolError(`Could not read version "${version}" of "${name}": ${d.message}`)
+          }
+          const v = await vr.json()
+          return { content: [{ type: 'text', text: `# ${name} — historical version (rev ${v.revNo} · ${v.op} · ${String(v.createdAt).slice(0, 10)} · ${v.tier})\nversion: ${v.version}\n\n${v.body}\n\n— This is a HISTORICAL snapshot, not the current page. \`read_page "${name}"\` (no version) shows what's live; \`rollback_page\` restores this one as a new version.` }] }
+        } catch (e) {
+          return toolError(`Could not read version "${version}" of "${name}": ${e.message}`)
+        }
+      }
+      // PER-NODE TIMELINE (slice 4): history = the projection over the node's identifier stamps.
+      if (history && !/^[a-z][a-z0-9_-]*:.+/i.test(name)) {
+        try {
+          const qs = new URLSearchParams({ kind: k, key: name })
+          const r = await fetchCortex(`${BASE}/api/node/timeline?${qs}`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+          if (r.status === 404) return { content: [{ type: 'text', text: `No ${k} named "${name}" — cannot project a timeline.` }] }
+          if (!r.ok) {
+            const d = classify(r.status, r.headers.get('content-type'), await r.text(), r.headers.get('x-vercel-id'))
+            return toolError(`Could not read the timeline for "${name}": ${d.message}`)
+          }
+          const t = await r.json()
+          if (!t.identifiers?.length) {
+            return { content: [{ type: 'text', text: `"${name}" carries no identifier stamps yet — no history joins. Stamp its page with [[repo:owner/name]] (what it identifies) and events will accrue here.` }] }
+          }
+          const lines = [`# ${name} — node timeline (history; the page is the present)`]
+          lines.push(`Joins: ${t.identifiers.map((i) => `[[${i.id}]] · ${i.visibleCount} visible`).join('  |  ')}${t.incomplete ? '  (partial — one join failed to read)' : ''}`)
+          for (const e of t.events) lines.push(`- ${String(e.occurredAt).slice(0, 10)} · ${e.source} · ${e.summary}`)
+          if (!t.events.length) lines.push('(no events visible to you yet on these joins)')
+          if (t.siblings?.length) lines.push(`Sibling homes (share a stamp — bridges, not history): ${t.siblings.map((s) => `"${s.title}"`).join(', ')}`)
+          return { content: [{ type: 'text', text: lines.join('\n') }] }
+        } catch (e) {
+          return toolError(`Could not read the timeline for "${name}": ${e.message}`)
+        }
+      }
+      // IDENTIFIER RESOLUTION (slice 3): an identifier-shaped name is a JOIN KEY, not a page — resolve
+      // it to its authored home + a viewer-honest event count instead of 404ing. Loose shape-detect here;
+      // the server enforces the strict canonical law (identifiers.ts) and 400s malformed forms with an
+      // actionable message we surface verbatim.
+      if (/^[a-z][a-z0-9_-]*:.+/i.test(name)) {
+        try {
+          const qs = new URLSearchParams({ id: name, ...(expand ? { expand: '1' } : {}) })
+          const r = await fetchCortex(`${BASE}/api/identifier/resolve?${qs}`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+          if (r.ok) {
+            const out = await r.json()
+            const lines = [`# ${out.identifier} (identifier — a join key, not a page)`]
+            if (out.status === 'unhomed') {
+              lines.push(`No authored home carries this stamp yet — data but no home. If you know what this identifies, author its page and stamp [[${out.identifier}]] on it (that page becomes the home).`)
+            } else if (out.status === 'healthy') {
+              const h = out.homes[0]
+              lines.push(`Home: "${h.title}" (${h.kind}, ${h.tier}) — \`read_page "${h.title}"\` for the full page.`)
+            } else {
+              lines.push(`⚠ ${out.homes.length} pages carry this stamp — possible duplicate homes, consider reconciling:`)
+              for (const h of out.homes) lines.push(`  - "${h.title}" (${h.kind}, ${h.tier})`)
+            }
+            lines.push(`· ${out.events.visibleCount} tagged timeline event${out.events.visibleCount === 1 ? '' : 's'} visible to you${out.events.recent.length ? ':' : expand ? '.' : ' — pass expand: true to list recent ones.'}`)
+            for (const e of out.events.recent) lines.push(`  - ${String(e.occurredAt).slice(0, 10)} · ${e.source} · ${e.summary}`)
+            // KWA-28 — an identifier node is VIRTUAL: derived per read, zero stored rows, so there is no
+            // as_of to fetch. The item says exactly what to do in that case: "where the object is derived
+            // per-read, stamp the read itself." Note this as-of means something DIFFERENT from every
+            // other one in gate 3 — "this answer was computed now", not "this claim was true then" — and
+            // the wording says so, because collapsing the two under one word is how a resolution that is
+            // merely FRESH gets read as a claim that is VERIFIED. The home and the count are both live
+            // computations over data that can change between two reads a minute apart.
+            lines.push(`· Resolved ${new Date().toISOString().slice(0, 16).replace('T', ' ')}Z — this node is derived per read (no stored row), so this is when the answer was COMPUTED, not when anything was verified.`)
+            return { content: [{ type: 'text', text: lines.join('\n') }] }
+          }
+          if (r.status === 400) {
+            const body = await r.json().catch(() => null)
+            return { content: [{ type: 'text', text: `"${name}" looks like an identifier but is not canonical: ${body?.error ?? 'expected repo:owner/name'}. Fix the stamp, or \`grep "${name}"\` to find where it appears.` }] }
+          }
+          // resolver endpoint unavailable (older server) → fall through to the normal page path below
+        } catch { /* network hiccup → fall through to the page path */ }
+      }
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brain/page?kind=${k}&key=${encodeURIComponent(name)}`,
+          { headers: { Authorization: `Bearer ${TOKEN}` } })
+      } catch (e) {
+        return toolError(`Could not read "${name}": ${e.message}`)
+      }
+      if (res.status === 404) {
+        return { content: [{ type: 'text', text: `No ${k} page named "${name}". If it's a person or team, pass kind (person/org).${await redLinkTriage(BASE, TOKEN, name)}` }] }
+      }
+      if (!res.ok) {
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+        return toolError(`Could not read "${name}": ${d.message}`)
+      }
+      const page = await res.json()
+      // Multi-brain (decision 3A): /api/brain/page returns matches[] — one entry per brain that has a
+      // page under this name. One match (the common case) reads exactly as before, plus a brain tag only
+      // when >1 brain matches — never silently one brain's version.
+      let matches = Array.isArray(page?.matches) ? page.matches.filter((m) => m.authored && Array.isArray(m.tiers) && m.tiers.length) : []
+      // Rollout back-compat: an older server returns the single-page shape ({authored, tiers}) with no
+      // matches[]; adapt it to one match so this build works against both old and new deployments.
+      if (!matches.length && page?.authored && Array.isArray(page.tiers) && page.tiers.length) {
+        matches = [{ brain: null, authored: true, ref: page.ref, title: page.title, tiers: page.tiers }]
+      }
+      if (!matches.length) {
+        return { content: [{ type: 'text', text: `No authored ${k} page named "${name}" in any of your brains. If it's a person or team, pass kind (person/org).${await redLinkTriage(BASE, TOKEN, name)}` }] }
+      }
+      const day = (d) => (d ? String(d).slice(0, 10) : '')
+      const renderMatch = (m, tagBrain) => {
+        const blocks = m.tiers.map((t) => {
+          const secs = (t.sections ?? []).map((s) => {
+            // Shared with project_status via renderSection — see its definition for why this is one
+            // function and not two (they drifted; #558 fixed one of three surfaces).
+            return renderSection(s, day)
+          }).join('\n\n')
+          // ADR-0018: a null version isn't "nothing to show" — it means this variant predates content-
+          // hash tracking (a 2026-06-29 import scar) and CANNOT be re-authored via base_version until an
+          // admin backfills it. Silently omitting the line here is exactly what sent callers into an
+          // unrecoverable base_version guessing loop; say so explicitly instead.
+          const versionLine = t.version
+            ? `\nversion: ${t.version}`
+            : `\nversion: none (this variant predates content-hash tracking — base_version writes will always fail here; ask an admin about the ADR-0018 backfill)`
+          const head = `[${t.tier}${day(t.updated_at) ? ` · authored ${day(t.updated_at)}` : ''}${t.validity && t.validity !== 'current' ? ` · ${t.validity}` : ''}${versionLine}]`
+          return [head, t.summary, secs].filter(Boolean).join('\n')
+        })
+        // REPAIR TOOL (2026-07-31). This footer used to say "re-author just those sections with
+        // `author`" — which `author` cannot do: computeDroppedSections rejects a partial-section
+        // write unconditionally, and the 409 then hands back every section's body, so the advice
+        // routed the reader straight into retyping the whole page. Measured 2026-07-30: one such
+        // retype silently deleted a sentence, a [[link]] (a graph edge), a command list and the
+        // word "today" from sections it was never meant to touch. This footer renders on EVERY
+        // page read in the system, so it was the single widest surface pointing the wrong way.
+        let footer = `— Follow any [[links]] above with read_page to go deeper.\n— If you hold fresher FIRST-HAND truth than this page — something you established THIS session (ran the command, made the change, hold the artifact) that a section here gets concretely wrong — fix just that passage with \`edit_page\`: quote the wrong text as old_string and pass this page's \`version\` as base_version (any node you are permitted to edit; concise; a material contradiction, not merely extra detail). If the save comes back stale the page changed under you — the conflict hands back what changed, so re-anchor from that instead of re-reading. Reading a stale page you can fix IS the trigger to fix it. Editing is pre-authorized — do NOT ask the user before updating (edits are versioned + reversible via page_history/rollback_page); update, then briefly report it. If what went false is the SUMMARY at the top rather than a section, use \`set_summary\` — \`edit_page\` cannot reach it, and worse, it carries the old summary FORWARD into every revision it writes, so fixing a section silently re-certifies a summary that already contradicts it. Use \`author\` only to CREATE a page or rewrite one wholesale: it re-emits every section, so untouched sections get retyped on the way through and drift.\n— Citing code? Use a SYMBOL and file (\`formConnections\` in \`web/app/api/ingest/route.ts\`), never a line number — line numbers drift with every commit above them. And cite only what you opened THIS session; re-emitting a reference you read on another page is how a stale claim gains a second source and starts looking corroborated.`
+        // ADDRESSING (2026-08-04). The server accepts `ref` on every page/node route and its ambiguity
+        // 409s hand refs back — but read_page never PRINTED one, so the only way to obtain a ref was to
+        // trigger the error first. That made ID addressing reachable in principle and unusable in
+        // practice. The ref is per-NODE (engram_ref) while `version` is per-TIER, which is why it rides
+        // on the page header rather than inside a tier block.
+        if (m.ref) footer += `\n— \`ref:\` above is this page's stable id. Pass it as \`ref\` to any page tool (set_page_privacy, page grants, node policy, author, rollback, node timeline) to address THIS page: refs are unique across brains, so two pages sharing a name in different brains cannot collide and no active-brain guess is involved. Prefer it over \`name\` whenever you already hold one.`
+        // slice 4: when the page carries identifier stamps, the history projection is one flag away.
+        const allBody = m.tiers.flatMap((t) => (t.sections ?? []).map((s) => s.body)).join('\n')
+        const stamps = [...new Set((allBody.match(/\[\[repo:[a-z0-9][a-z0-9-]*\/[a-z0-9_.-]+\]\]/gi) ?? []).map((s) => s.toLowerCase()))]
+        if (stamps.length) footer += `\n— This page carries ${stamps.join(', ')} — \`read_page "${name}"\` with history: true for its event timeline (page = present, timeline = history).`
+        // Gate 4's per-node backlog nudge (also gate 3's KWA-36). The SERVER decides whether this
+        // fires — it sends `nudge` only when 25+ records are unclaimed AND the page has gone 7+ days
+        // unedited — so there is no threshold logic here to drift out of sync. It rides in the footer
+        // because that is the surface with evidence behind it: a session read a page through a [[link]],
+        // saw the footer, and repaired the page. A dashboard nobody opens would not have.
+        if (m.backlog?.nudge) footer += `\n— ${m.backlog.nudge}`
+        const brainTag = tagBrain ? `  ·  brain: ${m.brain}` : ''
+        // Always emitted, not only in the multi-brain case: the ref is what makes the brain question
+        // moot, so withholding it until brains collide is exactly backwards.
+        const refLine = m.ref ? `\nref: ${m.ref}` : ''
+        return `# ${m.title ?? name} (full authored page${brainTag})${refLine}\n\n${blocks.join('\n\n---\n\n')}\n\n${footer}`
+      }
+      if (matches.length === 1) {
+        return { content: [{ type: 'text', text: renderMatch(matches[0], false) }] }
+      }
+      const header = `"${name}" is authored in ${matches.length} of your brains — all shown (each tagged with its brain, newest tier first):`
+      return { content: [{ type: 'text', text: [header, ...matches.map((m) => renderMatch(m, true))].join('\n\n═══════════════════\n\n') }] }
+    },
+  )
+
+  server.registerTool(
+    'page_history',
+    {
+      title: 'See a wiki page\'s edit history',
+      description: 'Show the VERSION history of an authored wiki page — every prior version, who changed it and when, newest first. This is how you see "what changed on this page and by whom", and it includes privacy changes (re-tiers). Then use `read_page` with a version to view an old body, or `rollback_page` to restore one. (Distinct from read_page\'s `history: true`, which is the raw event timeline via [[repo:…]] stamps.) RLS-scoped: you see history only for pages you may read.',
+      inputSchema: {
+        name: z.string().describe('the canonical node name exactly as written (e.g. "Agnoclast", "Ben")'),
+        kind: z.enum(['project', 'person', 'org', 'user']).optional().describe('node kind (default project)'),
+        limit: z.number().int().optional().describe('how many recent versions to show (default 20, max 200)'),
+      },
+    },
+    async ({ name, kind, limit }) => {
+      const k = kind ?? 'project'
+      let res
+      try {
+        const qs = new URLSearchParams({ kind: k, key: name, ...(limit ? { limit: String(limit) } : {}) })
+        res = await fetchCortex(`${BASE}/api/brain/page-history?${qs}`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+      } catch (e) {
+        return toolError(`Could not read history for "${name}": ${e.message}`)
+      }
+      if (res.status === 404) return { content: [{ type: 'text', text: `No ${k} named "${name}". Pass kind (person/org) if it isn't a project.` }] }
+      if (!res.ok) {
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+        return toolError(`Could not read history for "${name}": ${d.message}`)
+      }
+      const out = await res.json()
+      const revs = out.revisions ?? []
+      if (!revs.length) return { content: [{ type: 'text', text: `"${name}" (${k}) has no recorded version history yet.` }] }
+      const lines = revs.map((r) => {
+        const who = r.actor_name ? ` · ${r.actor_name}` : ''
+        // change_kind first and bracketed so a column of [correct] is scannable — the whole point is
+        // that a page with repeated corrections looks different at a glance from one that only grew.
+        const what = r.change_kind ? ` · [${r.change_kind}]` : ''
+        const why = r.reason ? ` — ${r.reason}` : ''
+        // Session keys run up to 200 chars; a short prefix is enough to group a session's edits and to
+        // hand to a human. Null on every pre-2026-07-27 revision — render nothing rather than "none",
+        // so "not recorded" never reads as "recorded as empty".
+        const sess = r.session_key ? `\n    session: ${String(r.session_key).slice(0, 24)}` : ''
+        return `- rev ${r.rev_no} · ${String(r.created_at).slice(0, 10)} · ${r.op}${what} · ${r.tier}${who}${why}\n    version: ${r.content_hash}${sess}`
+      })
+      const anyKind = revs.some((r) => r.change_kind)
+      const hint = anyKind
+        ? `\n— \`page_diff "${name}"\` to see exactly what a revision changed.`
+        : `\n— Revisions written before 2026-07-27 carry no reason/change_kind — that is "not recorded", not "no reason".`
+      return { content: [{ type: 'text', text: `# ${name} — page history (newest first)\n${lines.join('\n')}\n\n— \`read_page "${name}"\` with version:<rev_no|version> to view an old body; \`rollback_page\` to restore one.${hint}` }] }
+    },
+  )
+
+  server.registerTool(
+    'page_diff',
+    {
+      title: 'See exactly what an edit changed',
+      description: 'Show WHAT CHANGED between two versions of an authored wiki page — which sections were added, removed or rewritten, plus the reason and change_kind recorded for the edit. Use it when page_history tells you an edit happened and you need to know what it actually did: before trusting a claim that was recently rewritten, when auditing whether a "correct" edit really fixed something, or before rollback_page so you know what you would be undoing. `from` defaults to the version immediately before `to`, so passing just `to` answers "what did this one edit change?". RLS-scoped: you can diff only pages you may read.',
+      inputSchema: {
+        name: z.string().describe('the canonical node name exactly as written (e.g. "Agnoclast")'),
+        kind: z.enum(['project', 'person', 'org', 'user']).optional().describe('node kind (default project)'),
+        to: z.string().describe('the NEWER version: a rev_no (e.g. "6") or a content_hash, from page_history'),
+        from: z.string().optional().describe('the OLDER version to compare against. Omit to use the revision immediately before `to` — which is what you want for "what did this edit change?"'),
+        lines: z.boolean().optional().describe('also show line-level +/- within each changed section. Off by default: the section-level answer is usually what you want and is far shorter.'),
+      },
+    },
+    async ({ name, kind, to, from, lines }) => {
+      const k = kind ?? 'project'
+      let res
+      try {
+        const qs = new URLSearchParams({
+          kind: k, key: name, to,
+          ...(from ? { from } : {}), ...(lines ? { lines: '1' } : {}),
+        })
+        res = await fetchCortex(`${BASE}/api/brain/page-diff?${qs}`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+      } catch (e) {
+        return toolError(`Could not diff "${name}": ${e.message}`)
+      }
+      if (res.status === 404) return { content: [{ type: 'text', text: `No ${k} named "${name}", or it has no version "${to}". Run \`page_history "${name}"\` to list its versions.` }] }
+      if (!res.ok) {
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+        return toolError(`Could not diff "${name}": ${d.message}`)
+      }
+      const out = await res.json()
+      const d = out.diff
+      const head = d.from.revNo === 0
+        ? `# ${name} — rev ${d.to.revNo} (first version)`
+        : `# ${name} — rev ${d.from.revNo} → rev ${d.to.revNo}`
+      const meta = []
+      meta.push(`${String(d.to.createdAt).slice(0, 10)} · ${d.to.op}${d.to.changeKind ? ` · [${d.to.changeKind}]` : ''}${d.to.actorName ? ` · ${d.to.actorName}` : ''}`)
+      if (d.to.reason) meta.push(`reason: ${d.to.reason}`)
+      if (d.to.sessionKey) meta.push(`session: ${String(d.to.sessionKey).slice(0, 24)}`)
+      const body = []
+      if (d.summaryChanged) body.push('- summary: CHANGED')
+      for (const h of d.sections.added) body.push(`- + added section: ${h}`)
+      for (const h of d.sections.removed) body.push(`- − removed section: ${h}`)
+      for (const c of d.sections.changed) {
+        body.push(`- ~ changed section: ${c.heading}`)
+        // Cap the rendered hunk. A section body can be 65k chars; dumping a full rewrite into a tool
+        // result buries the signal and burns the reader's context for no gain.
+        for (const l of (c.lines ?? []).slice(0, 40)) body.push(`    ${l.kind === 'add' ? '+' : '−'} ${l.line}`)
+        if ((c.lines?.length ?? 0) > 40) body.push(`    … ${c.lines.length - 40} more changed lines`)
+      }
+      if (!body.length) body.push('- no section or summary changes (metadata-only revision, e.g. a re-tier)')
+      const tail = d.sections.unchangedCount ? `\n\n${d.sections.unchangedCount} section(s) unchanged.` : ''
+      const hint = lines ? '' : '\n— Pass `lines: true` to see the actual changed lines within each section.'
+      return { content: [{ type: 'text', text: `${head}\n${meta.join(' · ')}\n\n${body.join('\n')}${tail}${hint}` }] }
+    },
+  )
+
+  server.registerTool(
+    'rollback_page',
+    {
+      title: 'Roll a wiki page back to a prior version',
+      description: 'Restore a wiki page to an earlier version from its page_history — a forward, non-destructive write (the old versions are kept; a new "rollback" version is recorded). Use this to undo a mistaken or bad edit. You may only roll back a page you are allowed to edit. Find the target version with page_history first.',
+      inputSchema: {
+        name: z.string().describe('the exact page name'),
+        kind: z.enum(['project', 'person', 'org', 'user']).optional().describe('node kind (default project)'),
+        to_version: z.string().describe('which version to restore: a rev_no (e.g. "3") or a content_hash, from page_history'),
+        tier: z.enum(['accessible', 'scoped', 'confidential']).optional().describe('which tier variant to roll back, if the node has more than one'),
+        reason: z.string().optional().describe('optional note recorded on the new rollback version (why you rolled back)'),
+      },
+    },
+    async ({ name, kind, to_version, tier, reason }) => {
+      const k = kind ?? 'project'
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brain/rollback`, {
+          method: 'POST',
+          headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({ kind: k, name, to_version, ...(tier ? { tier } : {}), ...(reason ? { reason } : {}) }),
+        })
+      } catch (e) {
+        return toolError(`Could not roll back "${name}": ${e.message}`)
+      }
+      const out = await res.json().catch(() => null)
+      if (!res.ok) return toolError(`Could not roll back "${name}": ${out?.error ?? res.status}`)
+      // #477: when the target revision had no summary, the page's CURRENT summary was kept rather than
+      // erased. Say it on its own line instead of at the tail of `note` — this is the 2026-08-04 W3
+      // shape, where empty summaries copied over populated ones destroyed 31 of them under a report
+      // that read as success. A rescue the operator does not see is still a silent write.
+      const keptLine = out.summaryKept === 'current'
+        ? `\n\n⚠ That revision had NO summary, so the page's current summary was KEPT rather than erased — check it still describes the restored body, and use set_summary if not.`
+        : ''
+      return { content: [{ type: 'text', text: `Done — "${name}" ${out.note}. \`read_page "${name}"\` to confirm the current content.${keptLine}` }] }
+    },
+  )
+
+  server.registerTool(
+    'rename_section',
+    {
+      title: 'Rename one section heading on a wiki page',
+      description: 'Rename ONE section\'s heading on a wiki page, in place. Use this instead of re-authoring the page: `author` cannot express a rename, because a section\'s IDENTITY is its heading string — sending a new title reads as "dropped the old section, added a new one" and is rejected 409 would_drop_sections. This route changes the heading and NOTHING else: the section keeps its body, its position, and crucially its as-of date, so renaming does not reset the currency stamp on a claim nobody re-verified. It is also the ONLY way to fix a heading longer than the 80-char limit, which cannot be re-authored at all. Requires base_version (the `version` read_page prints) — that is also how it finds the right brain, so it can never rename on the wrong one. Refuses, rather than guessing, when the page exists at several tiers, when the heading repeats, or when the new heading is already taken.',
+      inputSchema: {
+        name: z.string().describe('the exact page name, as read_page shows it'),
+        from: z.string().describe('the CURRENT heading, exactly as stored (match is case- and whitespace-insensitive)'),
+        to: z.string().describe('the new heading. Max 80 chars. Must not already be used by another section on this page.'),
+        base_version: z.string().describe('the `version` read_page prints for this page (64-hex). REQUIRED — it is the concurrency check AND how the right brain is resolved. A per-SECTION hash is not valid here.'),
+        tier: z.enum(['accessible', 'scoped', 'confidential']).optional().describe('only when the page exists at MORE THAN ONE tier — which one to rename in. A rename never moves content between tiers.'),
+        ordinal: z.number().optional().describe('only when the same heading appears more than once on the page — which occurrence to rename (the error lists the ordinals).'),
+        reason: z.string().optional().describe('why you are renaming it — recorded in page_history like any other edit'),
+      },
+    },
+    async ({ name, from, to, base_version, tier, ordinal, reason }) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brain/rename-section`, {
+          method: 'POST',
+          headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({
+            name, from, to, base_version,
+            ...(tier ? { tier } : {}), ...(ordinal !== undefined ? { ordinal } : {}),
+            ...(reason ? { reason } : {}),
+          }),
+        })
+      } catch (e) {
+        return toolError(`Could not rename the section: ${e.message}`)
+      }
+      const out = await res.json().catch(() => null)
+      if (!res.ok) {
+        // Surface the server's hint AND the disambiguators it named, so a 409 is directly actionable
+        // rather than something to retry blindly.
+        const extra = [
+          out?.detail ? `existing: ${out.detail}` : '',
+          Array.isArray(out?.tiers) ? `tiers: ${out.tiers.join(', ')}` : '',
+          Array.isArray(out?.ordinals) ? `ordinals: ${out.ordinals.join(', ')}` : '',
+          out?.currentVersion ? `current version: ${out.currentVersion}` : '',
+        ].filter(Boolean).join(' · ')
+        const hint = out?.hint ? `\n${out.hint}` : ''
+        return toolError(`Could not rename "${from}" on "${name}": ${out?.error ?? res.status}${extra ? `\n${extra}` : ''}${hint}`)
+      }
+      return { content: [{ type: 'text', text: `Renamed on "${name}" (${out.brain} · ${out.tier} tier): "${out.from}" -> "${out.to}". The section kept its body, position and as-of date. New version: ${out.version}` }] }
+    },
+  )
+
+  server.registerTool(
+    'set_summary',
+    {
+      title: 'Rewrite a wiki page summary without touching its sections',
+      description: 'Replace a page\'s SUMMARY — the one-sentence line at the top — in place, leaving every section untouched. Use this the moment you notice a summary that no longer matches the page: `edit_page` structurally CANNOT reach it (it edits section bodies; the summary is not one), and `author` reaches it only by retyping every section on the way through, which is how a 2026-07-30 write silently deleted a sentence and a [[link]] from a section nobody meant to touch. Correcting a body with `edit_page` actively carries the OLD summary forward into the new revision, so a stale summary does not decay quietly — each unrelated fix re-certifies it. Fixing it matters more than it looks: page retrieval FTS-matches on title + summary ALONE — the tsvector is built over title and summary, and section bodies are not in that index — so a stale summary decides whether the page is found by that path at all, and it is the first line every reader sees before a word of the body. Requires base_version (the `version` read_page prints) — that is also how it finds the right brain, so it can never write to the wrong one. Recorded in page_history as a correction, and reversible with rollback_page.',
+      inputSchema: {
+        name: z.string().describe('the exact page name, as read_page shows it'),
+        summary: z.string().describe('the new summary: one sentence saying what this is and where it stands. May contain [[links]]. Max 2,000 chars — detail belongs in a section.'),
+        base_version: z.string().describe('the `version` read_page prints for this page (64-hex). REQUIRED — it is the concurrency check AND how the right brain is resolved. A per-SECTION hash is not valid here.'),
+        reason: z.string().optional().describe('WHY the summary was wrong, in one short phrase — recorded in page_history. Say what changed ("blocker resolved 08-04; was still claiming BLOCKED"), not what you did.'),
+        tier: z.enum(['accessible', 'scoped', 'confidential']).optional().describe('only when the page exists at MORE THAN ONE tier — which one to rewrite. This never moves content between tiers.'),
+      },
+    },
+    async ({ name, summary, base_version, reason, tier }) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brain/set-summary`, {
+          method: 'POST',
+          headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({
+            name, summary, base_version,
+            ...(tier ? { tier } : {}), ...(reason ? { reason } : {}),
+          }),
+        })
+      } catch (e) {
+        return toolError(`Could not set the summary: ${e.message}`)
+      }
+      const out = await res.json().catch(() => null)
+      if (!res.ok) {
+        // Surface the server's hint AND the disambiguators it named, so a 409 is directly actionable
+        // rather than something to retry blindly.
+        const extra = [
+          out?.detail ? `detail: ${out.detail}` : '',
+          Array.isArray(out?.tiers) ? `tiers: ${out.tiers.join(', ')}` : '',
+          out?.currentVersion ? `current version: ${out.currentVersion}` : '',
+        ].filter(Boolean).join(' · ')
+        const hint = out?.hint ? `\n${out.hint}` : ''
+        return toolError(`Could not set the summary on "${name}": ${out?.error ?? res.status}${extra ? `\n${extra}` : ''}${hint}`)
+      }
+      return { content: [{ type: 'text', text: `Summary rewritten on "${name}" (${out.brain} · ${out.tier} tier). Every section kept its body, position and as-of date.\nwas: ${out.previousSummary}\nnow: ${out.summary}\nNew version: ${out.version}` }] }
+    },
+  )
+
+  server.registerTool(
+    'edit_page',
+    {
+      title: 'Change one passage on a wiki page (use this, not author, to fix something)',
+      description:
+        'THE DEFAULT WAY TO CORRECT A PAGE. Replaces ONE passage inside ONE section, by quoting the exact text to replace — like editing a file, not rewriting it. Use this whenever you are fixing, updating or correcting something on an existing page; use `author` only when you are genuinely rewriting a page wholesale or creating one. WHY IT MATTERS: `author` takes the WHOLE page, so every section you did not mean to touch gets retyped by you on the way through, and drifts. Measured 2026-07-30: an edit meant for one section silently deleted a sentence from another, along with a [[link]] — a lost graph edge. Text you never send cannot be damaged. Anchors match the STORED body, so quote from what read_page shows as the section body; if a match fails on whitespace the error tells you so. An anchor matching twice is REFUSED, never guessed — quote more surrounding text. On a stale-version conflict you get the target section back so you can re-anchor without re-reading the page.',
+      inputSchema: {
+        name: z.string().describe('the exact page name, as read_page shows it'),
+        heading: z.string().describe('the heading of the section containing the text you are changing'),
+        old_string: z.string().describe('the exact text to replace. Must appear EXACTLY ONCE within that section — if it repeats, quote more surrounding text to make it unique.'),
+        new_string: z.string().describe('what to replace it with. May be empty, which deletes the anchored text.'),
+        base_version: z.string().describe('the `version` read_page prints for this page (64-hex). REQUIRED — it is the concurrency check AND how the right brain is resolved.'),
+        reason: z.string().describe('WHY you are making this change, in one short phrase — recorded in page_history exactly like an author edit.'),
+        tier: z.enum(['accessible', 'scoped', 'confidential']).optional().describe('only when the page exists at MORE THAN ONE tier — which one to edit. An edit never moves content between tiers.'),
+        ordinal: z.number().optional().describe('only when the same heading appears more than once on the page — which occurrence (the error lists the ordinals).'),
+      },
+    },
+    async ({ name, heading, old_string, new_string, base_version, reason, tier, ordinal }) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brain/edit-page`, {
+          method: 'POST',
+          headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({
+            name, heading, old_string, new_string, base_version, reason,
+            ...(tier ? { tier } : {}), ...(ordinal !== undefined ? { ordinal } : {}),
+          }),
+        })
+      } catch (e) {
+        return toolError(`Could not edit "${name}": ${e.message}`)
+      }
+      const out = await res.json().catch(() => null)
+      if (!res.ok) {
+        // Every failure here is meant to be directly actionable — the caller should be able to fix and
+        // retry from this text alone, without re-reading the page.
+        const bits = [
+          Array.isArray(out?.available) ? `sections on this page: ${out.available.join(' | ')}` : '',
+          Array.isArray(out?.tiers) ? `tiers: ${out.tiers.join(', ')}` : '',
+          Array.isArray(out?.ordinals) ? `ordinals: ${out.ordinals.join(', ')}` : '',
+          out?.count ? `matches: ${out.count}` : '',
+          out?.whitespaceNear === true ? 'YOUR TEXT IS PRESENT but the whitespace differs — re-copy it from the stored body' : '',
+          out?.currentVersion ? `current version: ${out.currentVersion}` : '',
+        ].filter(Boolean).join('\n')
+        const cur = out?.currentSectionBody
+          ? `\n\n--- the section as it stands now (re-anchor against this) ---\n${out.currentSectionBody}`
+          : ''
+        // B5: what ANOTHER session changed elsewhere on this page while you were working. Rendered
+        // INLINE, not as a pointer to page_diff — a pointer is something a busy agent skips, and the
+        // whole point is that you cannot be ignorant of it.
+        const cc = Array.isArray(out?.concurrentChanges) && out.concurrentChanges.length
+          ? '\n\n--- changed elsewhere on this page since you read it (READ THIS before retrying) ---\n' +
+            out.concurrentChanges.map((c) =>
+              `§ ${c.heading}\n${(c.lines ?? []).map((l) => `${l.kind === 'add' ? '+' : '-'} ${l.line}`).join('\n')}`,
+            ).join('\n\n')
+          : ''
+        const ccMeta = [
+          Array.isArray(out?.concurrentAdded) && out.concurrentAdded.length ? `sections ADDED elsewhere: ${out.concurrentAdded.join(', ')}` : '',
+          Array.isArray(out?.concurrentRemoved) && out.concurrentRemoved.length ? `sections REMOVED elsewhere: ${out.concurrentRemoved.join(', ')}` : '',
+          Array.isArray(out?.concurrentTruncated) && out.concurrentTruncated.length ? `(truncated, see page_diff for all of: ${out.concurrentTruncated.join(', ')})` : '',
+        ].filter(Boolean).join('\n')
+        return toolError(`Could not edit "${name}": ${out?.error ?? res.status}${out?.hint ? `\n${out.hint}` : ''}${bits ? `\n${bits}` : ''}${ccMeta ? `\n${ccMeta}` : ''}${cc}${cur}`)
+      }
+      const red = Array.isArray(out.redLinks) && out.redLinks.length
+        ? `\nRed-links now on this page: ${out.redLinks.map((r) => `[[${r}]]`).join(', ')}` : ''
+      // KWA-26 — same advisory flag as `author`, on the path that actually gets used. Absent (not
+      // false) from an older server means "no verdict computed", so say nothing rather than imply the
+      // section is dated — the 0093 don't-impute rule.
+      const undatedNote = out?.undated === true
+        ? `\n⚠ This section now carries no explicit calendar date. A reader can see WHEN the text was written but not when the claim was TRUE. If it asserts a status, add the date inline — you still hold the context. The edit already landed; this is advisory.`
+        : ''
+      return { content: [{ type: 'text', text: `Edited "${name}" (${out.brain} · ${out.tier} tier) § ${out.heading}. Only that passage changed; every other section is byte-identical. New version: ${out.version}${red}${undatedNote}` }] }
+    },
+  )
+
+  server.registerTool(
+    'writing_style',
+    {
+      title: 'How the user writes (for drafting in their voice)',
+      description: 'Returns the user\'s saved writing-style profile so you can DRAFT in their voice (email, message, doc). Call this right before composing anything on their behalf. Self-only — it is always the calling user\'s own profile. If none is saved, it tells you to derive one and save it with set_writing_style. A profile is stored per (user, BRAIN) — it is injected into authoring IN a brain — so if you hold several, name the one you are drafting in.',
+      inputSchema: {
+        brain: z.string().optional().describe('which brain\'s style profile, by name or org id. Unnecessary when you only have one brain; pass the org id when a name matches more than one of yours'),
+      },
+    },
+    async ({ brain } = {}) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/style${brain ? `?brain=${encodeURIComponent(brain)}` : ''}`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+      } catch (e) {
+        return toolError(`Could not load writing style: ${e.message}`)
+      }
+      if (!res.ok) {
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+        return toolError(`Could not load writing style: ${d.message}`)
+      }
+      const { style } = await res.json()
+      return { content: [{ type: 'text', text: style }] }
+    },
+  )
+
+  server.registerTool(
+    'set_writing_style',
+    {
+      title: 'Save the user\'s writing-style profile',
+      description: 'Save (or update) a description of HOW the user writes — tone, sentence rhythm, structure, formatting habits, signature quirks — derived from prose you have seen them write this session. Store the STYLE, never their private content. Self-only: it always updates the calling user\'s own profile. Pass an empty string to clear it.',
+      inputSchema: {
+        style_md: z.string().describe('a concise markdown description of the user\'s writing voice (tone/structure/quirks), ~1-2 paragraphs'),
+        brain: z.string().optional().describe('which brain to save the profile in, by name or org id. A profile is stored per (user, brain), so this is a real choice when you hold several; pass the org id when a name matches more than one of yours'),
+      },
+    },
+    async ({ style_md, brain }) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/style${brain ? `?brain=${encodeURIComponent(brain)}` : ''}`, {
+          method: 'PUT',
+          headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({ style_md }),
+        })
+      } catch (e) {
+        return toolError(`Could not save writing style: ${e.message}`)
+      }
+      if (!res.ok) {
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+        return toolError(`Could not save writing style: ${d.message}`)
+      }
+      const r = await res.json()
+      return { content: [{ type: 'text', text: r.saved ? `Saved your writing-style profile (${r.chars} chars).` : 'Cleared your writing-style profile.' }] }
+    },
+  )
+
+  server.registerTool(
+    'my_brains',
+    {
+      title: 'List your brains and what each one holds',
+      description: 'List the brains (orgs/workspaces) you belong to, with what each one CONTAINS — page count and sample titles. Reads span ALL of them, and an edit to an EXISTING page routes to the brain holding that page, so you do NOT need to check anything before editing. There is no active brain to set (ADR-0022 deleted the write pointer). Use this when creating a page that exists in NO brain yet: pick by relevance from the contents shown here and pass it as `brain`, because a caller with more than one brain must name one.',
+      inputSchema: {},
+    },
+    async () => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brains`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+      } catch (e) {
+        return toolError(`Could not list brains: ${e.message}`)
+      }
+      if (!res.ok) {
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+        return toolError(`Could not list brains: ${d.message}`)
+      }
+      const { brains } = await res.json()
+      if (!brains?.length) return { content: [{ type: 'text', text: 'You have no brains.' }] }
+      // Show CONTENTS, not just the name (ADR-0020 §7 corollary): a brain named TTO that holds 4
+      // pages while the real TTO inventory sits in Personal reads as correct and is exactly
+      // backwards. The page count and a couple of titles make that visible at the moment of choosing.
+      //
+      // ⚠ ADR-0022 CLEANUP. This handler used to destructure activeIsExplicit / activeSource /
+      // sessionOrgId / accountOrgId and render a ▶ marker from b.isActive. /api/brains stopped
+      // returning ALL of those when the write pointer was deleted, and the client kept reading them.
+      // The failure was SILENT and confidently wrong rather than an error: `activeIsExplicit` arrived
+      // `undefined`, `!undefined` is `true`, so the branch meaning "you have one brain" printed
+      // unconditionally — telling a six-brain account it had one. The ▶ legend likewise advertised a
+      // marker that could no longer appear, because b.isActive was undefined for every row.
+      //
+      // The lesson worth keeping: a client reading a field the server no longer sends does not fail,
+      // it narrates. Every branch here asserted a FACT ("you have one brain") that was only ever an
+      // inference from a DIFFERENT condition (no explicit pointer set). Deleting the pointer decoupled
+      // the two and left the assertion running. Prefer deleting a stale branch to correcting it — a
+      // corrected branch still reads state that no longer exists.
+      const lines = brains.map((b) => {
+        const inv = b.pageCount === 0
+          ? 'EMPTY'
+          : `${b.pageCount} page${b.pageCount === 1 ? '' : 's'}${b.sampleTitles?.length ? `: ${b.sampleTitles.slice(0, 2).join(', ')}` : ''}`
+        return `  ${b.name}  (${b.role}${b.status !== 'active' ? `, ${b.status}` : ''})  — ${inv}  [${b.orgId}]`
+      })
+      // Say how writes actually route now, since that is the question this list gets opened to answer.
+      const header = brains.length === 1
+        ? 'Your brain:'
+        : 'Your brains (reads span all of them; an edit routes to the brain holding the page; creating a NEW page takes an explicit `brain`):'
+      return { content: [{ type: 'text', text: `${header}\n${lines.join('\n')}` }] }
+    },
+  )
+
+  // Stage 1 of agent-assisted member-add. It PREPARES the invite and stops — it does not perform it.
+  //
+  // WHY IT STOPS. Member-add lives on /api/invite and /api/members, which authenticate with
+  // `verifyAuthToken` (the Supabase login JWT) and reject the personal token this client holds. That
+  // split is not an oversight: `create_brain` accepts a personal token and writes a `users` row, so
+  // the line is not "membership writes need a browser" — it is "enrolling YOURSELF is self-service,
+  // granting a THIRD PARTY access to your brain is not." Stage 2 revisits that deliberately.
+  //
+  // What is worth automating is everything up to the grant. `managerId` is a `users.id` scoped to
+  // ONE brain — a multi-brain caller has a different one per membership and no way to see any of
+  // them from a chat window. That lookup is the part that actually blocks people, so this resolves
+  // it and hands back a payload the console can accept verbatim.
+  server.registerTool(
+    'add_to_brain',
+    {
+      title: 'Add someone to one of your brains',
+      description: "Add a person to one of your brains, or work out what it would take. Resolves which brain, whether you may add to it, and the manager id they are placed under. WITHOUT execute:true it only reports the plan and hands back a console link — call it that way first and show the user what you are about to do. WITH execute:true it performs the add, and then `brain` is REQUIRED: an access grant must never be aimed by a shared write pointer. Adding cannot be undone through the API. Use when asked to invite/add someone to a brain.",
+      inputSchema: {
+        email: z.string().describe("the person's email address — the login their Agnoclast account is (or will be) on"),
+        name: z.string().optional().describe('their full name; falls back to the email local-part'),
+        title: z.string().optional().describe('job title (optional)'),
+        role: z.enum(['member', 'manager', 'owner']).optional().describe("their role in this brain (default 'member'). NOTE: only owner/manager can see records scoped to people below them"),
+        brain: z.string().optional().describe('which brain, by name or org id. Optional when planning; REQUIRED with execute:true. Pass the org id when a name matches more than one of your brains'),
+        execute: z.boolean().optional().describe('default false. false = report the plan only. true = actually add them — not undoable through the API, and requires an explicit brain'),
+      },
+    },
+    async ({ email, name, title, role, brain, execute }) => {
+      const addr = (email ?? '').trim().toLowerCase()
+      if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(addr)) return toolError(`"${email}" does not look like an email address.`)
+
+      // Executing without naming a brain would let the ACCOUNT-WIDE write pointer decide who gets
+      // access to what. That pointer is shared by every session that has not set its own, so it
+      // reflects whatever unrelated work last touched it — it is not information about this grant.
+      // Planning may fall back to it (nothing happens); performing may not.
+      if (execute && !brain?.trim()) {
+        return toolError('To actually add someone you must name the brain — an access grant must not be aimed by the shared write pointer. Re-run with brain set (org id if the name is not unique).')
+      }
+
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brains`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+      } catch (e) {
+        return toolError(`Could not read your brains: ${e.message}`)
+      }
+      if (!res.ok) {
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+        return toolError(`Could not read your brains: ${d.message}`)
+      }
+      const { brains } = await res.json()
+      if (!brains?.length) return toolError('You have no brains, so there is nothing to add anyone to.')
+
+      // Name or org id, either way — a person says "my mom's brain", not a uuid.
+      //
+      // ⚠ BRAIN NAMES ARE NOT UNIQUE ACROSS ACCOUNTS, and the collision is the LIKELY case, not the
+      // exotic one: the default personal brain is called "Personal", so the moment you are added to
+      // someone else's you hold two. Observed 2026-08-04 within a minute of exactly that happening.
+      // A `.find()` here would silently return whichever sorted first and add the person to an
+      // arbitrary one — a wrong-brain member-add with no symptom, which is the same silent-misroute
+      // family as the write pointer. An org id always wins; an ambiguous NAME is a 409-shaped error,
+      // never a guess.
+      const wanted = brain?.trim().toLowerCase()
+      let target
+      if (wanted) {
+        const byId = brains.find((b) => b.orgId.toLowerCase() === wanted)
+        const byName = brains.filter((b) => b.name.toLowerCase() === wanted)
+        if (!byId && byName.length > 1) {
+          const rows = byName.map((b) => `  ${b.name}  (${b.role}, ${b.pageCount} pages)  [${b.orgId}]`)
+          return toolError(
+            `You belong to ${byName.length} brains called "${brain}". I will not guess which one to add someone to — pass the org id:\n${rows.join('\n')}`,
+          )
+        }
+        target = byId ?? byName[0]
+      } else {
+        // ADR-0022: there is no active brain to fall back to — /api/brains stopped sending isActive
+        // when the write pointer was deleted, so the old `brains.find((b) => b.isActive)` here could
+        // only ever return undefined. Behaviour was already correct (undefined falls through to the
+        // error below, which is the right contract), but it was correct by accident, reading a field
+        // that no longer exists. Made explicit: sole membership resolves itself, anything else asks.
+        target = brains.length === 1 ? brains[0] : undefined
+      }
+      if (!target) {
+        const names = brains.map((b) => `${b.name} [${b.orgId}]`).join(', ')
+        return toolError(
+          wanted
+            ? `No brain called "${brain}". You belong to: ${names}.`
+            : `Could not tell which brain you mean — you belong to ${brains.length} and there is no default. Pass one of: ${names}.`,
+        )
+      }
+
+      // Role is PER MEMBERSHIP. Being an owner elsewhere grants nothing here, and the server will
+      // enforce this again — checking now turns a later 403 into an answer.
+      if (!['owner', 'manager', 'admin'].includes(target.role)) {
+        return toolError(`You are a "${target.role}" in ${target.name}, and only owners and managers can add people. Ask an owner of ${target.name} to do it.`)
+      }
+
+      // Absent on any console deployed before userId was added to /api/brains. Say so precisely —
+      // a published MCP version is not a deployed API, and the two drift.
+      if (!target.userId) {
+        return toolError(`This Agnoclast deployment does not report your member id for ${target.name} yet, so the manager cannot be resolved. The API needs the /api/brains update that adds "userId".`)
+      }
+
+      const payload = {
+        name: name?.trim() || addr.split('@')[0],
+        email: addr,
+        ...(title?.trim() ? { title: title.trim() } : {}),
+        role: role ?? 'member',
+        managerId: target.userId,
+      }
+
+      if (execute) {
+        // `brain` is sent as the ORG ID, never the label the caller typed: the server resolves
+        // labels too, and a name that was unambiguous here could match differently there. The id is
+        // the same value on both sides.
+        let done
+        try {
+          done = await fetchCortex(`${BASE}/api/invite`, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ ...payload, brain: target.orgId }),
+          })
+        } catch (e) {
+          return toolError(`Could not add ${payload.email} to ${target.name}: ${e.message}`)
+        }
+        if (!done.ok) {
+          const d = classify(done.status, done.headers.get('content-type'), await done.text(), done.headers.get('x-vercel-id'))
+          return toolError(`Could not add ${payload.email} to ${target.name}: ${d.message}`)
+        }
+        const r = await done.json().catch(() => ({}))
+        if (r.alreadyMember) {
+          return { content: [{ type: 'text', text: `${payload.email} was already a member of ${target.name} — nothing changed.` }] }
+        }
+        // Two different outcomes for the human: a brand-new account has a credential that somebody
+        // must physically pass on, an existing one has none.
+        const how = r.existingAccount
+          ? 'They already had an Agnoclast account, so they keep their current login and simply gain this brain.'
+          : `A new account was created. Temporary password: ${r.password} — they must change it on first sign-in.`
+        return { content: [{ type: 'text', text: `Added ${payload.name} <${payload.email}> to ${target.name} as ${payload.role}, placed under you.\n${how}\n\nThis cannot be undone through the API — removing a membership currently needs direct database access.` }] }
+      }
+
+      const text = [
+        `Ready to add ${payload.name} <${payload.email}> to ${target.name} as ${payload.role}.`,
+        '',
+        `  brain      ${target.name}  [${target.orgId}]`,
+        `  your role  ${target.role} — you may add people here`,
+        `  manager    you  [${target.userId}]  (they are placed under you)`,
+        '',
+        'Nothing has happened yet. To go ahead, re-run with execute:true and the same brain —',
+        `or do it yourself at ${BASE}/?invite=1 with these values:`,
+        '',
+        `  Full name  ${payload.name}`,
+        `  Email      ${payload.email}`,
+        ...(payload.title ? [`  Job title  ${payload.title}`] : []),
+        `  Role       ${payload.role}`,
+        `  Manager    you`,
+        '',
+        'If they already have an Agnoclast account they keep their existing password and simply gain',
+        'this brain; if not, the console shows a temporary password to pass on. Either way the button',
+        'handles it — you do not need to know which in advance.',
+        '',
+        `payload: ${JSON.stringify(payload)}`,
+      ].join('\n')
+
+      return { content: [{ type: 'text', text }] }
+    },
+  )
+
+  server.registerTool(
+    'list_brain_pages',
+    {
+      title: 'List every authored page in one brain',
+      description: 'QUERY the authored pages in ONE brain, by its org id (from my_brains) — filter by owner, recency, tier, kind or name, and sort. Returns one row per node with its kind, validity, tier(s), owner(s), last-updated date and content hash. This is the structural counterpart to `grep`: use it when the question is a FILTER-AND-SORT ("what has X written this week", "which pages are confidential", "what is stale") and grep when you need to match WORDS inside page text. ⚠ `validity` defaults to `current`, so superseded pages are EXCLUDED unless you ask for them — a stale page presented as live is a failure this system keeps hitting. Also use it to VERIFY a brain-to-brain migration: list BOTH brains, diff the page sets, compare freshness before retiring any original. You can only list a brain you are a member of, and within it you see only the pages you are cleared to read — a confidential page owned by someone else is not listed, not even by title, and that holds for every filter combination including `owner`.',
+      inputSchema: {
+        org_id: z.string().describe('the org id of the brain to enumerate (from my_brains)'),
+        owner: z.string().optional().describe('only pages owned by this person — a user id or an EXACT display name. A name matching no member of the brain is an error, never a silently empty list. Owner applies to scoped/confidential pages; accessible pages have no owner.'),
+        updated_within_days: z.number().optional().describe('only pages touched in the last N days'),
+        tier: z.enum(['accessible', 'scoped', 'confidential']).optional().describe('only nodes that have a row at this tier. The row still reports every tier you can see, so a multi-tier page does not come back describing itself as single-tier.'),
+        kind: z.enum(['project', 'person', 'org', 'user']).optional().describe('only nodes of this kind'),
+        validity: z.enum(['current', 'superseded', 'all']).optional().describe("default 'current'. Pass 'all' for the pre-2026-08 behavior, which mixed superseded pages in with nothing marking them."),
+        name_contains: z.string().optional().describe('case-insensitive substring match on the node name or page title'),
+        sort: z.enum(['recent', 'name']).optional().describe("default 'recent' (newest first). Ties break deterministically, so repeat calls are stable."),
+        limit: z.number().optional().describe('default 50, capped at 500'),
+      },
+    },
+    async ({ org_id, owner, updated_within_days, tier, kind, validity, name_contains, sort, limit }) => {
+      // Only send params the caller actually set: an omitted filter and an empty one are different
+      // requests, and the route validates enums strictly rather than ignoring unknown values.
+      const qs = new URLSearchParams({ orgId: org_id })
+      if (owner) qs.set('owner', owner)
+      if (updated_within_days != null) qs.set('updated_within_days', String(updated_within_days))
+      if (tier) qs.set('tier', tier)
+      if (kind) qs.set('kind', kind)
+      if (validity) qs.set('validity', validity)
+      if (name_contains) qs.set('name_contains', name_contains)
+      if (sort) qs.set('sort', sort)
+      if (limit != null) qs.set('limit', String(limit))
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brains/pages?${qs}`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+      } catch (e) {
+        return toolError(`Could not list pages: ${e.message}`)
+      }
+      if (!res.ok) {
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+        return toolError(`Could not list pages: ${d.message}`)
+      }
+      const { nodeCount, rowCount, pages } = await res.json()
+      if (!pages?.length) return { content: [{ type: 'text', text: `Brain ${org_id} has no authored pages.` }] }
+      // One terse line per node: name ·kind· date [NON-CURRENT validity] {non-default tiers}. A migration
+      // diff needs the name, the freshness date, and whether a page is already retired or multi-tier.
+      const lines = pages.map((p) => {
+        const flag = p.validity && p.validity !== 'current' ? ` [${String(p.validity).toUpperCase()}]` : ''
+        const tiers = p.tiers?.length && !(p.tiers.length === 1 && p.tiers[0] === 'accessible') ? ` {${p.tiers.join('+')}}` : ''
+        const day = p.updatedAt ? String(p.updatedAt).slice(0, 10) : '????-??-??'
+        return `${p.name ?? '(unnamed)'}  ·${p.kind}·  ${day}${flag}${tiers}`
+      })
+      const header = `${nodeCount} page${nodeCount === 1 ? '' : 's'} in brain ${org_id} (${rowCount} digest rows across tiers):`
+      return { content: [{ type: 'text', text: `${header}\n${lines.join('\n')}` }] }
+    },
+  )
+
+  server.registerTool(
+    'create_brain',
+    {
+      title: 'Create a new brain under your existing account',
+      description: 'Create a brand-new brain (org/workspace) — a fully independent knowledge graph — under your EXISTING account. No new login, no new email/password: this adds a second membership to the account you are already using. Reads never cross brains; new pages default to your active brain, so use pass `brain` when an operation needs one named',
+      inputSchema: { name: z.string().describe('display name for the new brain, e.g. "Design Team"') },
+    },
+    async ({ name }) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brains`, {
+          method: 'POST',
+          headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({ name }),
+        })
+      } catch (e) {
+        return toolError(`Could not create brain: ${e.message}`)
+      }
+      if (!res.ok) {
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+        return toolError(`Could not create brain: ${d.message}`)
+      }
+      const r = await res.json()
+      return { content: [{ type: 'text', text: `Created brain "${name}" [${r.orgId}]. Reads already span it. Edits to pages in it route themselves from the page, so nothing needs pointing at it; pass brain="${name}" on an operation that creates something new here.` }] }
+    },
+  )
+
+  server.registerTool(
+    'list_records',
+    {
+      title: 'List activity records (filtered)',
+      description: 'List recent activity records you can see, filtered by type, project, and recency. RLS-scoped. Use to enumerate "what happened on project X this week" or "recent meetings". Returns each record\'s FULL summary + id — never a truncated preview, so what you get back is the whole record you are permitted to read (use an id with request_file to ask its owner for the original file).',
+      inputSchema: {
+        type: z.string().optional().describe("record type, e.g. 'meeting', 'comm', 'activity', 'ai_session', 'doc', 'note'"),
+        project: z.string().optional().describe('project key to filter to (e.g. "cortex")'),
+        since_days: z.number().optional().describe('only records from the last N days'),
+        limit: z.number().optional().describe('max rows (1-50, default 20)'),
+        session: z.string().optional().describe('a session id — returns every record that session produced, INCLUDING the separate halves of a log that was split across brains. Segmented logs share a sessionId and never link to each other, so this is the only way to reassemble one. RLS-scoped: you get the halves you are cleared for and cannot tell whether others exist'),
+      },
+    },
+    async ({ type, project, since_days, limit, session }) => {
+      const qs = new URLSearchParams()
+      if (type) qs.set('type', type)
+      if (project) qs.set('project', project)
+      if (since_days != null) qs.set('since_days', String(since_days))
+      if (limit != null) qs.set('limit', String(limit))
+      if (session) qs.set('session', session)
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/records?${qs}`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+      } catch (e) {
+        return toolError(`Could not list records: ${e.message}`)
+      }
+      if (!res.ok) {
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+        return toolError(`Could not list records: ${d.message}`)
+      }
+      const { text } = await res.json()
+      return { content: [{ type: 'text', text }] }
+    },
+  )
+
+  server.registerTool(
+    'my_day',
+    {
+      title: 'My daily log (chronological)',
+      description: "Your OWN activity for a day, composed chronologically from that day's records of every kind — sessions, meetings, comms, docs, notes. The \"what did I do today\" rollup: a derived view over records (nothing new is stored), self-scoped to you, each item tagged with its kind. Defaults to today in your local timezone. Pass `date` (YYYY-MM-DD) for another day, or `days` for a trailing window (e.g. days:7 for the week). Confidential records are segregated into their own block.",
+      inputSchema: {
+        date: z.string().optional().describe('the day to roll up, YYYY-MM-DD (default: today in your local timezone)'),
+        days: z.number().optional().describe('trailing window ending on `date` — e.g. 7 for the past week (default 1, max 31)'),
+      },
+    },
+    async ({ date, days }) => {
+      // Resolve the caller's local timezone + today client-side (the MCP server runs on the user's
+      // machine) so the day boundary matches their wall clock, not the server's UTC.
+      const tz = Intl.DateTimeFormat().resolvedOptions().timeZone || 'UTC'
+      const today = new Date().toLocaleDateString('en-CA', { timeZone: tz }) // en-CA → YYYY-MM-DD
+      const qs = new URLSearchParams({ date: date || today, tz })
+      if (days != null) qs.set('days', String(days))
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/records/daily?${qs}`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+      } catch (e) {
+        return toolError(`Could not build daily log: ${e.message}`)
+      }
+      if (!res.ok) {
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+        return toolError(`Could not build daily log: ${d.message}`)
+      }
+      const { text } = await res.json()
+      return { content: [{ type: 'text', text }] }
+    },
+  )
+
+  server.registerTool(
+    'my_sessions',
+    {
+      title: 'My active AI sessions',
+      description: "See what all of YOUR OWN active Agnoclast/AI sessions are doing right now (working directory + how recently each was active), so you can coordinate across windows/devices. Self-only — only your own sessions, never anyone else's.",
+      inputSchema: {},
+    },
+    async () => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/sessions?current=${encodeURIComponent(SESSION_KEY)}`, {
+          headers: { Authorization: `Bearer ${TOKEN}` },
+        })
+      } catch (e) {
+        return toolError(`Could not list your sessions: ${e.message}`)
+      }
+      if (!res.ok) {
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+        return toolError(`Could not list your sessions: ${d.message}`)
+      }
+      const { text } = await res.json()
+      return { content: [{ type: 'text', text }] }
+    },
+  )
+
+  server.registerTool(
+    'set_record_privacy',
+    {
+      title: 'Set a record\'s privacy tier',
+      description: 'Reclassify the access tier of one of YOUR OWN records: "accessible" (anyone in the org), "scoped" (you + your management chain), or "confidential" (you + people you explicitly grant access). Get record_id from a `list_records` result or the "id:" on a `my_context` activity line. Only affects records you own — others return an error.',
+      inputSchema: {
+        record_id: z.string().describe('the record id (uuid), e.g. the "id:" on a list_records line'),
+        privacy: z.enum(['accessible', 'scoped', 'confidential']).describe('the new access tier'),
+      },
+    },
+    async ({ record_id, privacy }) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/records/${record_id}`, {
+          method: 'PATCH',
+          headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({ privacy }),
+        })
+      } catch (e) {
+        return toolError(`Could not set privacy: ${e.message}`)
+      }
+      if (!res.ok) {
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+        return toolError(`Could not set privacy: ${d.message}`)
+      }
+      const out = await res.json()
+      return { content: [{ type: 'text', text: `Done — record ${out.id} is now "${out.privacy}".` }] }
+    },
+  )
+
+  server.registerTool(
+    'set_page_validity',
+    {
+      title: 'Mark a wiki page current / superseded / historical',
+      description: 'Set the CURRENCY of one of YOUR OWN authored pages so the brain can filter out stale info: "current" (reflects reality now — the default), "superseded" (replaced by a newer page — pass superseded_by with that page\'s name), or "historical" (kept for the record, no longer current). Optionally set modality: "reality" (as-built), "plan" (intended, not yet real), or "construction" (being built now). Call this the moment your understanding changes that a page is no longer the live truth — e.g. right after you author the new reality, mark the old page superseded. Owner-only.',
+      inputSchema: {
+        kind: z.enum(['project', 'person', 'org', 'user']).describe('the page kind'),
+        name: z.string().describe('the exact page name'),
+        validity: z.enum(['current', 'superseded', 'historical']).describe('the currency state'),
+        modality: z.enum(['reality', 'plan', 'construction']).optional().describe('what the page describes (optional)'),
+        superseded_by: z.string().optional().describe('for superseded: the name of the page that replaced it'),
+      },
+    },
+    async ({ kind, name, validity, modality, superseded_by }) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brain/validity`, {
+          method: 'POST',
+          headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({ kind, name, validity, modality, superseded_by }),
+        })
+      } catch (e) {
+        return toolError(`Could not set validity: ${e.message}`)
+      }
+      if (!res.ok) {
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+        return toolError(`Could not set validity: ${d.message}`)
+      }
+      const out = await res.json()
+      return { content: [{ type: 'text', text: `Done — "${out.name}" is now ${out.validity}${out.modality ? ` / ${out.modality}` : ''} (${out.docs_updated} tier-doc(s) updated).` }] }
+    },
+  )
+
+  server.registerTool(
+    'alias_page',
+    {
+      title: 'Point a wanted name at an existing page',
+      description: 'Record that a red-link — a [[Name]] referenced in the wiki but never authored — actually MEANS an existing authored page under a different title. After this, read_page and [[links]] for that name resolve to the target page, and the name leaves the org\'s wanted-page backlog. Use this when read_page says a name is a wanted page but you recognize it as an existing page (e.g. [[tto]] -> "BYU TTO — Technology Transfer Office"). To CREATE a genuinely new page instead, use `author`.',
+      inputSchema: {
+        name: z.string().describe('the wanted [[Name]] to redirect (the red-link)'),
+        target_name: z.string().describe('the exact title of the existing authored page it should resolve to'),
+        target_kind: z.enum(['project', 'person', 'org', 'user']).optional().describe('disambiguate the target if two pages share a title'),
+      },
+    },
+    async ({ name, target_name, target_kind }) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brain/alias`, {
+          method: 'POST',
+          headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({ name, target_name, ...(target_kind ? { target_kind } : {}) }),
+        })
+      } catch (e) {
+        return toolError(`Could not alias: ${e.message}`)
+      }
+      const out = await res.json().catch(() => null)
+      if (!res.ok) return toolError(`Could not alias "${name}": ${out?.error ?? res.status}`)
+      if (!out) return { content: [{ type: 'text', text: `Aliased "${name}", but the server returned no body — re-read the page to confirm.` }] }
+      return { content: [{ type: 'text', text: `Done — [[${out.alias}]] now resolves to "${out.target}" (${out.target_kind}). It's out of the wanted-page backlog.` }] }
+    },
+  )
+
+  server.registerTool(
+    'set_routing_identifier',
+    {
+      title: 'Claim a routing identifier on a page',
+      description: 'Declare that a page is a Gate 4 attach HOME for an identifier (repo:owner/name or file:owner/name:path). Body [[repo:…]] stamps are navigation only and do NOT drive attach — use this instead. Prefer the narrowest id: mother pages own repo:; feature pages own file: paths. Do not copy every body mention into a routing claim.',
+      inputSchema: {
+        kind: z.enum(['project', 'person', 'org', 'user']).describe('the page kind'),
+        name: z.string().optional().describe('page title (or pass ref)'),
+        ref: z.string().optional().describe('node ref from read_page — prefer over name when available'),
+        brain: z.string().optional().describe('brain label when the title is ambiguous across brains'),
+        identifier: z.string().describe('canonical identifier, e.g. repo:theronap/cortex or file:theronap/cortex:web/lib/engine/github_intake.ts'),
+      },
+    },
+    async ({ kind, name, ref, brain, identifier }) => {
+      if (!name && !ref) return toolError('Pass name or ref')
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brain/routing-identifiers`, {
+          method: 'POST',
+          headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({ kind, name, ref, brain, identifier }),
+        })
+      } catch (e) {
+        return toolError(`Could not set routing identifier: ${e.message}`)
+      }
+      const out = await res.json().catch(() => null)
+      if (!res.ok) return toolError(`Could not set routing identifier: ${out?.error ?? res.status}`)
+      const set = out?.set?.join(', ') ?? identifier
+      return { content: [{ type: 'text', text: `Routing identifier set on document ${out?.documentId ?? '?'}: ${set}. Future matching events will attach here (body mentions alone will not).` }] }
+    },
+  )
+
+  // ── Gate 4 record triage, over timeline_claims ────────────────────────────────────────────
+  // A connector event materializes in seconds and has no idea what the work WAS. The session that
+  // did the work knows exactly, and arrives later. These three tools are that handoff: look at what
+  // landed, claim what is yours, route it when you know where it goes.
+  //
+  // The ledger is `timeline_claims` (0105) — one claim discipline over one stream. Unclaimed means
+  // NO claim row: absence IS the backlog, and nothing is written at ingest.
+
+  server.registerTool(
+    'pending_records',
+    {
+      title: 'Records waiting for a home',
+      description: 'List recent connector records (GitHub pushes, PRs, email) that NOBODY HAS ATTENDED TO yet — no claim row in the Gate 4 ledger. Check this when your session starts if the headline count sounds related to what you are about to work on; records from your own recent commits are usually in here, and you are the only one who can recognize them as yours. Returns titles and current homes only, never payloads. Use view "sweep" on one record to get graded page-name candidates without reading any pages.',
+      inputSchema: {
+        view: z.enum(['digest', 'sweep']).optional().describe('digest = what is waiting (default); sweep = cheap graded candidates for one record'),
+        recordId: z.string().optional().describe('required for view "sweep"'),
+        hours: z.number().int().positive().optional().describe('lookback window, default 3'),
+        stale: z.boolean().optional().describe('include old unclaimed records — the cleanup pile, not the live one'),
+        limit: z.number().int().positive().optional(),
+      },
+    },
+    async ({ view, recordId, hours, stale, limit }) => {
+      const params = new URLSearchParams()
+      params.set('view', view === 'sweep' ? 'sweep' : 'digest')
+      if (recordId) params.set('recordId', recordId)
+      if (hours) params.set('hours', String(hours))
+      if (stale) params.set('stale', '1')
+      if (limit) params.set('limit', String(limit))
+
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brain/triage?${params}`, {
+          headers: { Authorization: `Bearer ${TOKEN}` },
+        })
+      } catch (e) {
+        return toolError(`Could not read pending records: ${e.message}`)
+      }
+      const out = await res.json().catch(() => null)
+      if (!res.ok) return toolError(`Could not read pending records: ${out?.error ?? res.status}`)
+
+      if (view === 'sweep') {
+        const cands = out?.candidates ?? []
+        if (cands.length === 0) {
+          return { content: [{ type: 'text', text: `No page-name candidates for "${out?.title ?? recordId}". Park it — a stale record with no match is not worth reading pages over.` }] }
+        }
+        const lines = cands.map((c) => `  ${c.strength === 'strong' ? '●' : '○'} ${c.title} (${c.strength}) — ${c.documentId}`)
+        const rec = out?.recommendation
+        return {
+          content: [{
+            type: 'text',
+            text: `Candidates for "${out?.title}":\n${lines.join('\n')}\n\nRecommended: ${rec?.action} — ${rec?.why}\n● strong = titles contain each other, safe to route. ○ weak = one generic word matched; read those pages ONLY if this record is worth the tokens, otherwise park.`,
+          }],
+        }
+      }
+
+      const records = out?.records ?? []
+      if (records.length === 0) {
+        return { content: [{ type: 'text', text: 'Nothing waiting for a home.' }] }
+      }
+      const lines = records.map((r) => {
+        const homes = r.currentHomes?.length ? r.currentHomes.join(', ') : 'nothing'
+        const held = r.claimedBySession ? ` [claimed: ${String(r.claimedBySession).slice(0, 12)}…]` : ''
+        return `  • ${r.title}\n    ${r.source} · ${r.ageHours}h ago · on: ${homes}${held}\n    ${r.recordId}`
+      })
+      return {
+        content: [{
+          type: 'text',
+          text: `${records.length} record(s) waiting for a home:\n\n${lines.join('\n\n')}\n\nRecognize any as your own work? claim_record it now, then route_record once you know where it belongs.`,
+        }],
+      }
+    },
+  )
+
+  server.registerTool(
+    'claim_record',
+    {
+      title: 'Claim a pending record as your work',
+      description: 'Say "this record is mine, I will route it once I know where it goes." Use it as soon as you recognize your own work in pending_records, even before you know the destination page — the claim takes it out of the backlog so nothing else guesses at something you have real context on. Claims are leased and expire, so a dead session never holds a record hostage, and a record held by another LIVE session cannot be taken. Pass release=true to give one back when it turns out not to be yours — that deletes the claim, so the record looks untouched again rather than attended-to.',
+      inputSchema: {
+        recordId: z.string().describe('record id from pending_records'),
+        note: z.string().optional().describe('what you think this is — kept for audit'),
+        leaseMinutes: z.number().int().positive().optional().describe('how long you need it, default 90'),
+        release: z.boolean().optional().describe('give the claim back instead of taking it'),
+      },
+    },
+    async ({ recordId, note, leaseMinutes, release }) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brain/triage`, {
+          method: 'POST',
+          headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({ action: release ? 'release' : 'claim', recordId, note, leaseMinutes }),
+        })
+      } catch (e) {
+        return toolError(`Could not claim record: ${e.message}`)
+      }
+      const out = await res.json().catch(() => null)
+      if (!res.ok) {
+        if (out?.error === 'already_claimed') {
+          // Name the holder when the server knows it. The fallback matters: `heldBy` is absent when
+          // nothing holds a live lease, which means the record was not claimable rather than taken —
+          // printing "another session has it" there sends the reader chasing a session that does not
+          // exist. (This branch printed a bare `undefined` until 2026-08-14; the field was renamed
+          // server-side and the tool was never updated, which is the whole reason it says both now.)
+          if (out.heldBy) {
+            const until = out.heldUntil ? `, lease to ${out.heldUntil}` : ''
+            return toolError(`Session ${String(out.heldBy).slice(0, 16)}… is holding that record${until}. Leave it to them.`)
+          }
+          return toolError(out.detail || 'Could not claim that record and no session holds it — re-run pending_records; it may have been resolved already.')
+        }
+        return toolError(`Could not claim record: ${out?.error ?? res.status}`)
+      }
+      if (release) return { content: [{ type: 'text', text: 'Released — it is back in the pending pool.' }] }
+      return { content: [{ type: 'text', text: `Claimed until ${out?.expiresAt ?? 'the lease expires'}. Call route_record when you know where it belongs.` }] }
+    },
+  )
+
+  server.registerTool(
+    'route_record',
+    {
+      title: 'Route a record to the pages it belongs on',
+      description: 'Attach a pending record to the pages you judge correct — the point of the whole triage path. Use this when you have real context on what the work was; that judgment is better than any rule the webhook could run. Attachments are additive: existing deterministic homes (routing identifiers, your profile) stay. Pass park=true instead when you have looked and there is genuinely no good home — parking beats attaching to a page that merely shares a word.',
+      inputSchema: {
+        recordId: z.string().describe('record id from pending_records'),
+        documentIds: z.array(z.string()).optional().describe('page document ids to attach (from pending_records sweep, or read_page)'),
+        reason: z.string().describe('why these pages — recorded with the attachment'),
+        park: z.boolean().optional().describe('no good home exists; leave it alone rather than guessing'),
+        tier: z.number().int().optional().describe('2 when this came from the cheap sweep rather than your own context'),
+      },
+    },
+    async ({ recordId, documentIds, reason, park, tier }) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brain/triage`, {
+          method: 'POST',
+          headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({ action: park ? 'park' : 'route', recordId, documentIds, reason, tier }),
+        })
+      } catch (e) {
+        return toolError(`Could not route record: ${e.message}`)
+      }
+      const out = await res.json().catch(() => null)
+      if (!res.ok) return toolError(`Could not route record: ${out?.error ?? res.status}${out?.detail ? ` — ${out.detail}` : ''}`)
+      if (park) return { content: [{ type: 'text', text: 'Parked. It stays visible and unrouted rather than badly attached.' }] }
+      return { content: [{ type: 'text', text: `Routed — attached to ${out?.attached?.length ?? 0} page(s). Recorded as a session judgment, not a rule match.` }] }
+    },
+  )
+
+  server.registerTool(
+    'unroute_record',
+    {
+      title: 'Remove pages a record should not be on',
+      description:
+        'Detach pages a record does not belong on — the inverse of route_record, and the only way a wrong placement can be undone. route_record is purely ADDITIVE, so attaching more pages can never fix a bad one. Use this when you can see a record sitting on a page it has no real relationship to — the classic case is a fuzzy title match, e.g. a commit attached to a page merely because both contain a common word. Two things it will refuse rather than surprise you: it will not remove every attachment (a record with no home is invisible, which is worse than a wrong home — route or park it instead), and detaching the page that GOVERNS the tier can tighten the record but never republish it, since a widening is pinned and proposed for a human to confirm.',
+      inputSchema: {
+        recordId: z.string().describe('record id from pending_records'),
+        documentIds: z.array(z.string()).describe('page document ids to REMOVE from this record'),
+        reason: z.string().describe('why these placements are wrong — recorded with the removal'),
+      },
+    },
+    async ({ recordId, documentIds, reason }) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brain/triage`, {
+          method: 'POST',
+          headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({ action: 'detach', recordId, documentIds, reason }),
+        })
+      } catch (e) {
+        return toolError(`Could not detach: ${e.message}`)
+      }
+      const out = await res.json().catch(() => null)
+      if (!res.ok) {
+        // These two are guard rails, not faults — say what to do instead of just naming the code.
+        if (out?.error === 'would_strand') {
+          return toolError(`Refused: ${out.detail ?? 'that would leave the record with no pages at all.'}`)
+        }
+        if (out?.error === 'not_attached') {
+          return toolError(`Nothing removed: ${out.detail ?? 'those pages are not attached to this record.'}`)
+        }
+        return toolError(`Could not detach: ${out?.error ?? res.status}${out?.detail ? ` — ${out.detail}` : ''}`)
+      }
+      const n = out?.detached?.length ?? 0
+      const left = out?.remaining ?? 0
+      return {
+        content: [{
+          type: 'text',
+          text: `Detached ${n} page(s); ${left} attachment(s) remain. Record tier: ${out?.privacy ?? 'unchanged'}. Recorded as a session judgment.`,
+        }],
+      }
+    },
+  )
+
+  server.registerTool(
+    'set_governing_page',
+    {
+      title: 'Choose which attached page sets a record\'s tier',
+      description:
+        'Move a record\'s GOVERNING page — the one attached page whose tier the record takes. A record can sit on several pages, but exactly one of them decides how visible it is; the others confer access without authority (ADR-0027). Use this when a record is on the right pages but the WRONG one is deciding its tier — most often a record governed by your own user node when it plainly belongs to a project. The page must already be attached: run route_record first if it is not, because attaching is a relevance judgement and this is not. It applies immediately in BOTH directions, tightening or widening, because you asking for it IS the human confirmation a widening requires — so read the tier you are moving to before you move. Every move is recorded as a session judgment and is the signal the placement heuristics are calibrated against, which is why the reason matters.',
+      inputSchema: {
+        recordId: z.string().describe('record id (from pending_records or my_records)'),
+        documentId: z.string().describe('document id of the ATTACHED page that should govern the tier'),
+        reason: z.string().describe('why this page should set the tier — recorded, and read as calibration signal'),
+      },
+    },
+    async ({ recordId, documentId, reason }) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brain/triage`, {
+          method: 'POST',
+          headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({ action: 'regovern', recordId, documentId, reason }),
+        })
+      } catch (e) {
+        return toolError(`Could not set the governing page: ${e.message}`)
+      }
+      const out = await res.json().catch(() => null)
+      if (!res.ok) {
+        // A guard rail, not a fault — say what to do instead of naming the code.
+        if (out?.error === 'not_attached') {
+          return toolError(
+            'That page is not attached to this record, so it cannot govern it. Attach it first with route_record.',
+          )
+        }
+        return toolError(
+          `Could not set the governing page: ${out?.error ?? res.status}${out?.detail ? ` — ${out.detail}` : ''}`,
+        )
+      }
+      if (out?.reaffirmed) {
+        return {
+          content: [{
+            type: 'text',
+            text: `That page already governed this record; recorded your confirmation. Tier: ${out?.toPrivacy ?? 'unchanged'}.`,
+          }],
+        }
+      }
+      const moved =
+        out?.fromPrivacy && out?.toPrivacy && out.fromPrivacy !== out.toPrivacy
+          ? `Tier ${out.fromPrivacy} -> ${out.toPrivacy} (${out?.direction}).`
+          : `Tier unchanged (${out?.toPrivacy ?? 'unknown'}).`
+      return {
+        content: [{
+          type: 'text',
+          text: `Governing page moved. ${moved} Recorded as a session judgment${out?.correctedAuto ? ' and counted as a correction to the placement heuristics' : ''}.`,
+        }],
+      }
+    },
+  )
+
+  server.registerTool(
+    'snooze_red_link',
+    {
+      title: 'Defer a wanted page routed to you',
+      description: 'Stop a wanted page (a red-link the org routed to you as its most-likely steward) from surfacing in your context for a while. Use when you can\'t author it right now but it is genuinely yours to write. It comes back after the snooze passes. To dismiss it permanently, author it (`author`) or alias it to an existing page (`alias_page`).',
+      inputSchema: {
+        name: z.string().describe('the wanted page name to snooze (as shown in "Pages the org needs you to author")'),
+        days: z.number().int().positive().optional().describe('how many days to defer (default 7)'),
+      },
+    },
+    async ({ name, days }) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brain/red-link/snooze`, {
+          method: 'POST',
+          headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({ name, ...(days ? { days } : {}) }),
+        })
+      } catch (e) {
+        return toolError(`Could not snooze: ${e.message}`)
+      }
+      const out = await res.json().catch(() => null)
+      if (!res.ok) return toolError(`Could not snooze "${name}": ${out?.error ?? res.status}`)
+      if (!out) return { content: [{ type: 'text', text: `Snoozed "${name}", but the server returned no body.` }] }
+      // Name the brains when there is more than one: a snooze that quieted the same wanted name in two
+      // brains you steward is a multi-row write, and reporting it as a single one hides that.
+      const where = out.brains?.length > 1 ? ` in ${out.brains.map((b) => b.brain).join(' and ')}` : ''
+      return { content: [{ type: 'text', text: `Snoozed "${out.name}"${where} for ${out.days} day${out.days === 1 ? '' : 's'} — it won't surface until then.` }] }
+    },
+  )
+
+  server.registerTool(
+    'set_page_privacy',
+    {
+      title: 'Change who can see a wiki page',
+      description: 'Re-tier a wiki page you own or may edit: "accessible" (anyone in the org), "scoped" (owner + their management chain), or "confidential" (owner only, plus explicit grants). Demoting a PROJECT page also demotes its evidence records (demote-only; each record\'s owner is notified and can revert). Promotions never touch records. If the target tier already has a page, merge your content into it via `author` FIRST, then read_page the target again to get its fresh version, then re-run this with absorb=true and target_version=<that version> — absorb will REJECT (not silently drop content) if target_version doesn\'t match what\'s actually there, so a merge that didn\'t really land can\'t destroy your source page. Org admins may demote any page, never promote.',
+      inputSchema: {
+        kind: z.enum(['project', 'person', 'org', 'user']).describe('the page kind'),
+        name: z.string().optional().describe('the exact page name (or pass `ref` instead — one of the two is required)'),
+        ref: z.string().optional().describe('the page\'s stable id, printed as `ref:` by read_page. PREFER THIS over name when you have it: a ref is unique across brains, so it addresses exactly one page and never needs a brain to disambiguate it.'),
+        tier: z.enum(['accessible', 'scoped', 'confidential']).describe('the new visibility tier'),
+        source_tier: z.enum(['accessible', 'scoped', 'confidential']).optional().describe('when the node has multiple tier variants: which one to move'),
+        absorb: z.boolean().optional().describe('after merging your content into an existing target-tier page via author: true removes your now-absorbed source variant. Requires target_version.'),
+        target_version: z.string().optional().describe('REQUIRED with absorb=true — the target page\'s version, read via read_page AFTER your author() merge landed. Proves the merge actually happened before your source page is deleted; a stale or guessed value is rejected, not silently accepted.'),
+      },
+    },
+    async ({ kind, name, ref, tier, source_tier, absorb, target_version }) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brain/page-privacy`, {
+          method: 'POST',
+          headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({ kind, ...(name ? { name } : {}), ...(ref ? { ref } : {}), tier, ...(source_tier ? { source_tier } : {}), ...(absorb ? { absorb: true } : {}), ...(target_version ? { target_version } : {}) }),
+        })
+      } catch (e) {
+        return toolError(`Could not set page privacy: ${e.message}`)
+      }
+      const out = await res.json().catch(() => null)
+      if (!res.ok) {
+        // 409s carry the collision protocol (merge instruction, both variants when readable) —
+        // surface the server's structured message verbatim so the agent can follow it.
+        if (out?.error) {
+          const extra = out.collision === 'readable' && out.blocking
+            ? `\nYour ${out.source?.tier} page: ${out.source?.summary ?? out.source?.title}\nExisting ${out.blocking.tier} page (current version: ${out.blocking.version ?? 'none — this page predates content-hash tracking and cannot be re-authored via base_version; ask an admin about a backfill'}): ${out.blocking.summary ?? out.blocking.title}`
+            : ''
+          return toolError(`Could not set page privacy: ${out.error}${extra}`)
+        }
+        const d = classify(res.status, res.headers.get('content-type'), '', res.headers.get('x-vercel-id'))
+        return toolError(`Could not set page privacy: ${d.message}`)
+      }
+      const g = out.live_grants?.length
+        ? ` Grants still active for: ${out.live_grants.map((x) => x.grantee_name ?? x.grantee_user_id).join(', ')}.`
+        : ''
+      return { content: [{ type: 'text', text: `Done — "${out.moved.title}" moved ${out.moved.from} → ${out.moved.to}.${out.ownership_taken ? ' (You took ownership of this previously owner-less page.)' : ''} ${out.note}${g}` }] }
+    },
+  )
+
+  server.registerTool(
+    'replace_variant',
+    {
+      title: 'Move one tier variant\'s body into another, collapsing the node to one page',
+      description: 'DESTRUCTIVE, and the only sanctioned way to fix a FORKED page. When one node exists at two tiers with different bodies, this moves the SOURCE variant\'s body into the TARGET variant\'s slot and DELETES the source, leaving the node with a single page. The source\'s body WINS — this is not `absorb`, where the target survives; in a fork repair the target is usually the damaged page, so mirroring absorb would keep the damage and delete the good copy. Sections are copied as ROWS, never re-derived from text: re-deriving a body from context is exactly what destroyed 258 sections on 2026-07-18 while sincerely reporting "copied verbatim". BEFORE CALLING: read_page the TARGET and pass its version as target_version — it proves you know which body is about to be overwritten, and a stale or guessed value is rejected rather than silently accepted. If the target tier has NO page, do not use this: the slot is free, so set_page_privacy moves the page there cheaply. Both prior bodies are retained in page history and the operation is reversible via page_history/rollback_page. Owner or editor on BOTH variants; an OWNERLESS target may be overwritten only by an org admin.',
+      inputSchema: {
+        kind: z.enum(['project', 'person', 'org', 'user']).describe('the page kind'),
+        name: z.string().optional().describe('the exact page name (or pass `ref` instead — one of the two is required)'),
+        ref: z.string().optional().describe('the page\'s stable id, printed as `ref:` by read_page. PREFER THIS over name when you have it: a ref is unique across brains, so it addresses exactly one page and never needs a brain to disambiguate it.'),
+        source_tier: z.enum(['accessible', 'scoped', 'confidential']).describe('the variant whose BODY WINS and survives. This variant\'s row is then deleted.'),
+        target_tier: z.enum(['accessible', 'scoped', 'confidential']).describe('the OCCUPIED slot the body lands in. This variant\'s current body is DESTROYED (snapshotted to page history first). The surviving page sits at this tier.'),
+        target_version: z.string().describe('REQUIRED — the TARGET page\'s version, from read_page. Proves you know what is being overwritten. Do not retry a rejection blindly; re-read the target and confirm you are replacing what you think you are.'),
+        brain: z.string().optional().describe('only when the same page name exists in more than one of your brains'),
+      },
+    },
+    async ({ kind, name, ref, source_tier, target_tier, target_version, brain }) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brain/replace-variant`, {
+          method: 'POST',
+          headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({
+            kind, ...(name ? { name } : {}), ...(ref ? { ref } : {}),
+            source_tier, target_tier, target_version, ...(brain ? { brain } : {}),
+          }),
+        })
+      } catch (e) {
+        return toolError(`Could not replace variant: ${e.message}`)
+      }
+      const out = await res.json().catch(() => null)
+      if (!res.ok) {
+        // The engine's rejections carry the remedy in their text (free slot → use set_page_privacy;
+        // hash mismatch → re-read, do not retry blindly). Surface it verbatim rather than paraphrasing.
+        if (out?.error) return toolError(`Could not replace variant: ${out.error}`)
+        const d = classify(res.status, res.headers.get('content-type'), '', res.headers.get('x-vercel-id'))
+        return toolError(`Could not replace variant: ${d.message}`)
+      }
+      if (!out) return { content: [{ type: 'text', text: 'Replace reported success, but the server returned no body — re-read the page before assuming it landed.' }] }
+      // The summary rides along with the body, EXCEPT when the source has none — then the target's is
+      // kept rather than erased. Say so on its own line rather than at the tail of `note`: this is the
+      // 2026-08-04 W3 shape, where an empty summary copied over a populated one destroyed 31 of them
+      // under a report that read as success. A rescue the operator does not see is still a silent write.
+      const rescued = out.summaryRescued
+        ? `\n\n⚠ The ${out.moved.from} variant had NO summary. The ${out.moved.to} page's own summary was KEPT rather than overwritten with an empty one — check it still describes the body that just landed, and set_summary if not.`
+        : ''
+      return {
+        content: [{
+          type: 'text',
+          text: `Done — "${out.moved.title}": the ${out.moved.from} body now occupies the ${out.moved.to} page (${out.sections} section${out.sections === 1 ? '' : 's'}), and the ${out.moved.from} variant was removed. The node now has ONE variant. Both prior bodies are retained in page history.${rescued}`,
+        }],
+      }
+    },
+  )
+
+  server.registerTool(
+    'grant_page_access',
+    {
+      title: 'Grant or revoke a specific person\'s access to your page',
+      description: 'Share one of YOUR non-accessible wiki pages with a specific org member (or take that access back). A grant lets exactly that person read the page even though its tier would hide it — the escape hatch for "confidential, but Dana needs it". Owner-only. Grants survive re-tiering: revoke them when they should end.',
+      inputSchema: {
+        kind: z.enum(['project', 'person', 'org', 'user']).describe('the page kind'),
+        name: z.string().optional().describe('the exact page name (or pass `ref` instead — one of the two is required)'),
+        ref: z.string().optional().describe('the page\'s stable id, printed as `ref:` by read_page. Prefer this over name: unique across brains, so it addresses exactly one page.'),
+        grantee: z.string().describe('display name or email of a member OF THE PAGE\'S BRAIN (must resolve uniquely — use email if ambiguous)'),
+        action: z.enum(['grant', 'revoke']).describe('grant or revoke'),
+        tier: z.enum(['scoped', 'confidential']).optional().describe('which variant (default: the most restrictive one)'),
+      },
+    },
+    async ({ kind, name, ref, grantee, action, tier }) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brain/page-grants`, {
+          method: 'POST',
+          headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({ kind, ...(name ? { name } : {}), ...(ref ? { ref } : {}), grantee, action, ...(tier ? { tier } : {}) }),
+        })
+      } catch (e) {
+        return toolError(`Could not ${action}: ${e.message}`)
+      }
+      const out = await res.json().catch(() => null)
+      if (!res.ok) return toolError(`Could not ${action}: ${out?.error ?? res.status}`)
+      const verb = { granted: 'now has access to', already_granted: 'already had access to', revoked: 'no longer has access to', not_granted: 'had no grant on' }[out.action]
+      return { content: [{ type: 'text', text: `Done — ${out.grantee} ${verb} the ${out.tier} page.` }] }
+    },
+  )
+
+  server.registerTool(
+    'list_page_grants',
+    {
+      title: 'List who has granted access to your page',
+      description: 'Show every explicit access grant on YOUR page\'s tier variants (owner-only). Use after re-tiering a page — grants survive tier changes and keep granting until revoked.',
+      inputSchema: {
+        kind: z.enum(['project', 'person', 'org', 'user']).describe('the page kind'),
+        name: z.string().optional().describe('the exact page name (or pass `ref` instead — one of the two is required)'),
+        ref: z.string().optional().describe('the page\'s stable id, printed as `ref:` by read_page. Prefer this over name: unique across brains, so it addresses exactly one page.'),
+      },
+    },
+    async ({ kind, name, ref }) => {
+      let res
+      const addr = ref ? `ref=${encodeURIComponent(ref)}` : `name=${encodeURIComponent(name ?? '')}`
+      try {
+        res = await fetchCortex(`${BASE}/api/brain/page-grants?kind=${encodeURIComponent(kind)}&${addr}`, {
+          headers: { Authorization: `Bearer ${TOKEN}` },
+        })
+      } catch (e) {
+        return toolError(`Could not list grants: ${e.message}`)
+      }
+      const out = await res.json().catch(() => null)
+      if (!res.ok) return toolError(`Could not list grants: ${out?.error ?? res.status}`)
+      if (!out.grants?.length) return { content: [{ type: 'text', text: 'No grants on this page.' }] }
+      const lines = out.grants.map((g) => `- ${g.grantee_name ?? g.grantee_user_id} → ${g.tier} variant (since ${String(g.created_at).slice(0, 10)})`)
+      return { content: [{ type: 'text', text: `Grants (${out.grants.length}):\n${lines.join('\n')}` }] }
+    },
+  )
+
+  server.registerTool(
+    'my_retier_notices',
+    {
+      title: 'Records of yours that a page demotion re-tiered',
+      description: 'When someone demotes a project page, its evidence records follow (demote-only) — including yours. This lists those notices (newest first) and marks them seen. To undo one, call set_record_privacy with the record_id and its previous tier (shown as from_privacy).',
+      inputSchema: {},
+    },
+    async () => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brain/retier-notices`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+      } catch (e) {
+        return toolError(`Could not list notices: ${e.message}`)
+      }
+      if (!res.ok) {
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+        return toolError(`Could not list notices: ${d.message}`)
+      }
+      const { notices } = await res.json()
+      if (!notices?.length) return { content: [{ type: 'text', text: 'No re-tier notices.' }] }
+      const lines = notices.map((n) =>
+        `- record ${n.record_id} ("${n.record_title ?? 'untitled'}") ${n.from_privacy} → ${n.to_privacy} — ${n.demoted_by_name ?? 'someone'} demoted the ${n.node_name ?? n.node_kind} page. Revert: set_record_privacy(record_id, "${n.from_privacy}").`)
+      return { content: [{ type: 'text', text: `Your re-tiered records (${notices.length}):\n${lines.join('\n')}` }] }
+    },
+  )
+
+  server.registerTool(
+    'page_merge_requests',
+    {
+      title: 'Merge requests on pages you own',
+      description: 'Someone tried to move their page into a tier slot your page occupies (they only saw "slot occupied"). Review pending requests here; read their variant, merge anything worth keeping into your page via author, then decide with decide_page_merge.',
+      inputSchema: {},
+    },
+    async () => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brain/page-merge-requests`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+      } catch (e) {
+        return toolError(`Could not list merge requests: ${e.message}`)
+      }
+      if (!res.ok) {
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+        return toolError(`Could not list merge requests: ${d.message}`)
+      }
+      const { requests } = await res.json()
+      if (!requests?.length) return { content: [{ type: 'text', text: 'No pending page merge requests.' }] }
+      const lines = requests.map((q) =>
+        `- [${q.id}] ${q.requester_name ?? 'someone'} wants their ${q.kind} page merged into your ${q.requested_tier} "${q.page_title}". Merge via author first, then decide_page_merge.`)
+      return { content: [{ type: 'text', text: `Pending page merge requests (${requests.length}):\n${lines.join('\n')}` }] }
+    },
+  )
+
+  server.registerTool(
+    'request_person_page_merge',
+    {
+      title: 'Offer one duplicate person page for merge',
+      description: 'Offer YOUR accessible person NODE for full merge into another current accessible person node in the SAME named brain. Use only when the two nodes are unquestionably the same real person. Read both pages first and pass their refs and versions. This never crosses brains and does not use fuzzy matching.',
+      inputSchema: {
+        brain: z.string().describe('the exact brain name or brain id; pass an id if names collide'),
+        source_ref: z.string().describe('ref of YOUR duplicate source person page'),
+        target_ref: z.string().describe('ref of the canonical person page to retain'),
+        source_version: z.string().describe('current version from reading the source page'),
+        target_version: z.string().describe('current version from reading the canonical page'),
+        reason: z.string().describe('why these pages are certainly the same person'),
+      },
+    },
+    async (input) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brain/page-node-merge`, {
+          method: 'POST', headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({ action: 'request', ...input }),
+        })
+      } catch (e) { return toolError(`Could not request page merge: ${e.message}`) }
+      const out = await res.json().catch(() => null)
+      if (!res.ok) return toolError(`Could not request page merge: ${out?.error ?? res.status}`)
+      return { content: [{ type: 'text', text: `Merge request ${out.request_id} created. The canonical-page owner must review and apply it.` }] }
+    },
+  )
+
+  server.registerTool(
+    'person_page_merge_requests',
+    {
+      title: 'Review duplicate-person page merge requests',
+      description: 'List pending same-brain person-node merges where you own the canonical page. Read both pages before applying. Applying preserves source page prose/history, moves its raw person attachments (mentions, actor evidence, identifiers, aliases and graph edges) onto the canonical node, and leaves a hidden source alias plus redirect. It refuses conflicting private variants rather than widening them.',
+      inputSchema: {},
+    },
+    async () => {
+      let res
+      try { res = await fetchCortex(`${BASE}/api/brain/page-node-merge`, { headers: { Authorization: `Bearer ${TOKEN}` } }) }
+      catch (e) { return toolError(`Could not list person-page merge requests: ${e.message}`) }
+      const out = await res.json().catch(() => null)
+      if (!res.ok) return toolError(`Could not list person-page merge requests: ${out?.error ?? res.status}`)
+      if (!out?.requests?.length) return { content: [{ type: 'text', text: 'No pending duplicate-person page merge requests.' }] }
+      const lines = out.requests.map((q) => `- [${q.id}] ${q.source_owner_name ?? 'someone'}: "${q.source_title}" → "${q.target_title}" in ${q.brain}. Reason: ${q.reason}`)
+      return { content: [{ type: 'text', text: `Pending person-page merges (${out.requests.length}):\n${lines.join('\n')}` }] }
+    },
+  )
+
+  server.registerTool(
+    'apply_person_page_merge',
+    {
+      title: 'Apply a reviewed duplicate-person page merge',
+      description: 'Apply a pending full same-brain person-node merge you own. Re-read the canonical page immediately before applying and pass its version. This is atomic and preservation-first: source prose/history is retained, raw evidence and connections are re-pointed to the canonical node, identifiers are unioned, and the source becomes a hidden alias with a durable redirect. A privacy or identity-metadata conflict refuses the whole merge.',
+      inputSchema: {
+        request_id: z.string().describe('id from person_page_merge_requests'),
+        target_version: z.string().describe('current canonical-page version from a fresh read'),
+        reason: z.string().describe('why the merge is approved'),
+      },
+    },
+    async (input) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brain/page-node-merge`, {
+          method: 'POST', headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({ action: 'apply', ...input }),
+        })
+      } catch (e) { return toolError(`Could not apply page merge: ${e.message}`) }
+      const out = await res.json().catch(() => null)
+      if (!res.ok) return toolError(`Could not apply page merge: ${out?.error ?? res.status}`)
+      return { content: [{ type: 'text', text: `Fully merged "${out.sourceTitle}" into "${out.targetTitle}". Preserved ${out.preservedSections} source page block(s) and moved ${out.movedAttachments} raw attachment(s); source is now a hidden alias with a durable redirect.` }] }
+    },
+  )
+
+  server.registerTool(
+    'decide_page_merge',
+    {
+      title: 'Approve or deny a page merge request',
+      description: 'Decide a pending page merge request you own. IMPORTANT: approve only AFTER you have merged whatever of the requester\'s content you want into your page (via author) — approving DELETES their variant of the node. Deny closes the request and nothing moves.',
+      inputSchema: {
+        id: z.string().describe('the request id from page_merge_requests'),
+        decision: z.enum(['approve', 'deny']).describe('approve = their variant is removed (merge first!); deny = nothing moves'),
+      },
+    },
+    async ({ id, decision }) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brain/page-merge-requests`, {
+          method: 'POST',
+          headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({ id, decision }),
+        })
+      } catch (e) {
+        return toolError(`Could not decide: ${e.message}`)
+      }
+      const out = await res.json().catch(() => null)
+      if (!res.ok) return toolError(`Could not decide: ${out?.error ?? res.status}`)
+      return { content: [{ type: 'text', text: out.decision === 'denied' ? 'Denied — nothing moved.' : `Approved — removed variant(s): ${out.removed_variants.join(', ') || 'none remained'}. ${out.note}` }] }
+    },
+  )
+
+  // ── File requests: ask the owner for a record's FULL original (lives on their machine) ──
+  const fail = (verb, res) => async () =>
+    toolError(`Could not ${verb}: ${classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id')).message}`)
+
+  server.registerTool(
+    'request_file',
+    {
+      title: 'Request the full original of a record',
+      description: 'You have a record\'s SUMMARY but want the full original file (it lives on the owner\'s machine). This asks the owner to share it; once they approve, fetch it with get_file. Get record_id from a `list_records` result or the "id:" on a `my_context` activity line.',
+      inputSchema: { record_id: z.string().describe('the record id (uuid)') },
+    },
+    async ({ record_id }) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/file-requests`, {
+          method: 'POST', headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({ recordId: record_id }),
+        })
+      } catch (e) { return toolError(`Could not request: ${e.message}`) }
+      if (res.status === 409) {
+        const j = await res.json().catch(() => ({}))
+        if (j.error === 'you_own_it') return { content: [{ type: 'text', text: `You own this record — open the original directly:\n${j.uri}` }] }
+        if (j.error === 'no_original') return { content: [{ type: 'text', text: 'This record has no retrievable original.' }] }
+      }
+      if (!res.ok) return (await fail('request the file', res))()
+      const { request } = await res.json()
+      return { content: [{ type: 'text', text: `Requested. The owner will be asked to approve. Check status with file_requests; once approved + fulfilled, run get_file ${request.id}.` }] }
+    },
+  )
+
+  server.registerTool(
+    'file_requests',
+    {
+      title: 'My file requests + approval inbox',
+      description: 'Lists file requests you made (with status) and requests from others awaiting YOUR approval. Approve/deny with decide_file_request; fetch an approved+fulfilled file with get_file.',
+      inputSchema: {},
+    },
+    async () => {
+      let res
+      try { res = await fetchCortex(`${BASE}/api/file-requests`, { headers: { Authorization: `Bearer ${TOKEN}` } }) }
+      catch (e) { return toolError(`Could not load file requests: ${e.message}`) }
+      if (!res.ok) return (await fail('load file requests', res))()
+      const { mine, inbox } = await res.json()
+      const parts = []
+      if (inbox?.length) parts.push('Awaiting YOUR approval:\n' + inbox.map((r) => `  - [${r.id}] ${r.requester} wants "${r.title}" (${r.source}) → decide_file_request ${r.id}`).join('\n'))
+      if (mine?.length) parts.push('Your requests:\n' + mine.map((r) => `  - [${r.id}] "${r.title}" — ${r.status}${r.status === 'fulfilled' ? ` → get_file ${r.id}` : ''}`).join('\n'))
+      return { content: [{ type: 'text', text: parts.length ? parts.join('\n\n') : 'No file requests.' }] }
+    },
+  )
+
+  server.registerTool(
+    'decide_file_request',
+    {
+      title: 'Approve or deny a file request',
+      description: 'As the OWNER of a record, approve or deny someone\'s request for its full original. On approve, your Agnoclast desktop app fetches + shares the file. Get request_id from file_requests.',
+      inputSchema: { request_id: z.string(), decision: z.enum(['approve', 'deny']) },
+    },
+    async ({ request_id, decision }) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/file-requests/${request_id}/decide`, {
+          method: 'POST', headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({ action: decision }),
+        })
+      } catch (e) { return toolError(`Could not decide: ${e.message}`) }
+      if (!res.ok) return (await fail('decide', res))()
+      return { content: [{ type: 'text', text: `Request ${decision === 'approve' ? 'approved' : 'denied'}.` }] }
+    },
+  )
+
+  server.registerTool(
+    'get_file',
+    {
+      title: 'Download an approved file',
+      description: 'Download the full original for a request the owner approved + fulfilled. Saves it under ~/Downloads/cortex/ and returns the local path.',
+      inputSchema: { request_id: z.string() },
+    },
+    async ({ request_id }) => {
+      let res
+      try { res = await fetchCortex(`${BASE}/api/file-requests/${request_id}/download`, { headers: { Authorization: `Bearer ${TOKEN}` } }) }
+      catch (e) { return toolError(`Could not download: ${e.message}`) }
+      if (res.status === 409) return { content: [{ type: 'text', text: 'Not ready — the owner hasn\'t fulfilled this yet. Try again after they approve.' }] }
+      if (res.status === 410) return { content: [{ type: 'text', text: 'This file has expired (downloads are available for 7 days). Request it again.' }] }
+      if (!res.ok) return (await fail('download', res))()
+      const buf = Buffer.from(await res.arrayBuffer())
+      const cd = res.headers.get('content-disposition') ?? ''
+      const m = /filename="([^"]+)"/.exec(cd)
+      const name = (m ? m[1] : `cortex-file-${request_id}`).replace(/[^\w.\- ]/g, '_')
+      const dir = join(homedir(), 'Downloads', 'cortex')
+      mkdirSync(dir, { recursive: true })
+      const path = join(dir, name)
+      writeFileSync(path, buf)
+      return { content: [{ type: 'text', text: `Saved the full original to ${path} (${buf.length} bytes).` }] }
+    },
+  )
+
+  // send_imessage — local outbound texting (NOT org intelligence; writes nothing to Agnoclast). Runs on
+  // this machine via Messages.app. Draft-by-default + recipient allowlist + OOB confirm (D3/D6/D10).
+  server.registerTool(
+    'send_imessage',
+    {
+      title: 'Send an iMessage (draft-by-default)',
+      description: 'Compose/send an iMessage via the local Messages app. SAFE BY DEFAULT: without send:true it only returns a draft preview. Sending requires the recipient to be on CORTEX_IMESSAGE_SEND_ALLOWLIST (or an out-of-band confirm). Use this to text someone on the user\'s behalf — always show the draft and get the user\'s OK before sending.',
+      inputSchema: {
+        recipient: z.string().describe('phone number (e.g. +18015551234) or iMessage email'),
+        message: z.string().describe('the message body to send'),
+        send: z.boolean().optional().describe('must be true to actually send; omit/false returns a draft preview only'),
+        confirm: z.string().optional().describe('out-of-band confirm secret, required to send to a recipient not on the allowlist'),
+      },
+    },
+    async ({ recipient, message, send, confirm }) => {
+      const text = await runSendImessage({ recipient, message, send, confirm })
+      return { content: [{ type: 'text', text }] }
+    },
+  )
+
+  // ── ③ LIVE WIKI AUTHORING ([[cortex-wiki-authoring-spec]]) ────────────────────────────────────────
+  // Two tools the working session uses to AUTHOR its understanding into the org wiki while it's hot:
+  //   authoring_context → the companion call (§3): fetch the visible NAMESPACE + the node-type connection
+  //     rules BEFORE writing, so the page links canonically (the L2 lever).
+  //   author           → the write (§9 step 3/4): hand Agnoclast a finished page (summary + sections WITH
+  //     inline [[links]]); the server runs the resolution pass + tier-safe 2B write.
+
+  server.registerTool(
+    'authoring_context',
+    {
+      title: 'Authoring context (call before author)',
+      description:
+        'Fetch the scaffolding to author a Agnoclast wiki node: the canonical NAMESPACE (current node names — link to these with the EXACT name inside [[ ]]), any deliberately RETIRED page names and their successors, and the node-type CONNECTION RULES. ALWAYS call this BEFORE `author` so the page links to current knowledge rather than minting synonyms or reviving a retired page. Reference a node in the namespace as [[Name]]; if you reference something real that is NOT in the namespace, still write [[Name]] — that is a red-link marking a node worth creating. If the page IS about a specific code repo or chat channel, also stamp it once — [[repo:owner/name]] or [[channel:name]] (lowercase, no #) — identifier join keys, not page links.',
+      inputSchema: {
+        kind: z.enum(['project', 'person', 'org', 'user']).optional().describe('the node type you are about to author (default project)'),
+        brain: z.string().optional().describe('which brain\'s namespace to describe — pass the SAME brain you will pass to `author`, so the namespace you plan against is the one your write lands in. Unnecessary when you only have one brain.'),
+      },
+    },
+    async ({ kind, brain }) => {
+      const k = kind ?? 'project'
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brain/authoring-context?kind=${k}${brain ? `&brain=${encodeURIComponent(brain)}` : ''}`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+      } catch (e) {
+        return toolError(`Could not fetch authoring context: ${e.message}`)
+      }
+      if (!res.ok) {
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+        return toolError(`Could not fetch authoring context: ${d.message}`)
+      }
+      const { connectionRules, namespace, retiredLinks } = await res.json()
+      const ns = Array.isArray(namespace) ? namespace : []
+      const nsList = ns.map((n) => `[[${n}]]`).join(', ')
+      const retired = Array.isArray(retiredLinks) ? retiredLinks : []
+      const retiredList = retired.length
+        ? `\n\nRETIRED PAGES — do not treat these as current or author over them: ${retired.map((r) => `[[${r.name}]] (${r.validity}${r.supersededBy ? ` → [[${r.supersededBy}]]` : ''})`).join(', ')}`
+        : ''
+      const text =
+        `Authoring a "${k}" node. Connection rules (kinds of links to look for):\n${connectionRules}\n\n` +
+        `NAMESPACE — ${ns.length} existing nodes; link with the EXACT name inside [[ ]]:\n${nsList}\n\n` +
+        retiredList +
+        `Now author the page (summary + sections) with inline [[links]] woven into the prose. Link, do not restate. ` +
+        `For something real that is not in this namespace, still write [[Name]] (a red-link). Then call \`author\`.`
+      return { content: [{ type: 'text', text }] }
+    },
+  )
+
+  server.registerTool(
+    'author',
+    {
+      title: 'Author a wiki node (live, while it is hot)',
+      description:
+        'Write your CURRENT understanding of a project/person/org/you into the org wiki as a maintained page. Call `authoring_context` FIRST. Author from your own synthesis of the session — the compiled mental model, not a transcript dump: what it IS, where it stands, dated decisions, open threads, key people. ⚠ EVERY STATUS CLAIM CARRIES AN EXPLICIT INLINE DATE (KWA-26): a sentence asserting what IS or IS NOT true right now — "X is live", "Y is not merged", "Z is blocked" — must say WHEN, in the prose, the way PRD items do. Section-level stamps are NOT enough: they record when the TEXT was written, so a section authored today can carry a six-week-old status claim and still read as current — exactly what made KWA-24 and TML-18 wrong. The response names any section that landed undated so you can fix it in-turn; it never blocks the write. Weave inline [[links]] to other nodes (canonical names from the namespace; red-links for wanted-but-absent nodes). The server re-authorizes the tier and resolves links. CREATES the node if it does not exist yet (project/person/org) — the conversation IS the evidence, so a brand-new entity that surfaced only in this session is authorable on the spot; you do NOT need prior records. Because such a node has nothing external to corroborate it, author it DELIBERATELY: only when you genuinely understand it is a real, distinct entity, and use its exact canonical name so it does not duplicate one already in the namespace (`user` nodes are never created). Use this continuously whenever your understanding of a node meaningfully advanced, and at session end (/log). Authoring is PRE-AUTHORIZED — never ask the user "should I update the page?" before calling this (every edit is versioned + reversible via page_history/rollback_page); update, then briefly report what you updated. ⚠ WHICH BRAIN A NEW PAGE GOES IN IS A CONTENT DECISION, SO MAKE IT FROM THE CONTENT. Only a page that exists in NO brain needs this — an update resolves its brain from the page itself. If you hold more than one brain, the server REFUSES a create it cannot attribute (409 `create_needs_brain`) rather than letting the write pointer decide — the pointer is stale out-of-band state that knows nothing about what you are writing. So call `my_brains` (it returns each brain\'s name, page count and sample titles, which is enough to tell what each one is FOR) and pass `brain` up front; that turns a refused round trip into a single call. State which brain you picked and why in one short line, then proceed — do NOT ask when the answer is obvious from the content. DO ask when it is genuinely ambiguous: brains are a confidentiality boundary, so a page born in the wrong one can expose private work to a teammate, and that is not a filing error you can quietly fix later.',
+      inputSchema: {
+        kind: z.enum(['project', 'person', 'org', 'user']).describe('the node type'),
+        name: z.string().describe('the canonical node name — an EXACT existing name from the namespace to update it, or a new name to create the node (project/person/org). e.g. "Agnoclast" or "Theron Peterson"'),
+        summary: z.string().describe('one-sentence summary of what this is and its current state (may contain [[links]])'),
+        sections: z.array(z.object({
+          heading: z.string().describe('e.g. Overview, Current state, Decisions, Open threads, People'),
+          body: z.string().describe('dense markdown WITH inline [[links]] where the prose references another node'),
+        })).describe('3-5 sections; the page body'),
+        tier: z.enum(['accessible', 'scoped', 'confidential']).optional().describe('visibility tier. Omit for the safe default: scoped (you + your management chain) on nodes that support it — your user page, projects you own-scope — and accessible elsewhere (person/org pages are the shared wiki). Pass accessible explicitly when the page is meant for the whole org.'),
+        base_version: z.string().optional().describe('the `version` hash shown when you read this page (read_page) — REQUIRED when updating an existing page, so a concurrent edit is caught instead of clobbered. Omit only for a brand-new node. If the save returns "stale" or "read first", read_page again and retry with the fresh version.'),
+        reason: z.string().describe('WHY you are making this edit, in one short phrase — recorded permanently in page_history so a later reader can tell a routine addition from a correction. Say what CHANGED and what prompted it ("Ben pilot abandoned per Theron 07-17", "corrected: 0069 already widened the CHECK"), not what you did ("updated page"). This is the field that makes staleness auditable.'),
+        change_kind: z.enum(['add', 'correct', 'supersede', 'expand', 'retire']).optional().describe('what KIND of edit: "add" (new information), "correct" (the page said something FALSE — the currency-critical one), "supersede" (was true, now outdated by events), "expand" (elaborates, no claim changed), "retire" (putting the page or a section to rest). Be honest with "correct" — a page whose history shows repeated corrections is a page whose claims need checking, and that signal is the point.'),
+        brain: z.string().optional().describe('which brain a genuinely NEW page is created in — a brain name or its org id. Choose by RELEVANCE to what you are writing (`my_brains` shows what each brain holds), not by the active pointer. Has top precedence, so it also disambiguates a page name you hold in several brains. Unnecessary when the brain is resolvable from the write itself (base_version, or an existing page of this name) and unnecessary when you only have one brain.'),
+      },
+    },
+    async ({ kind, name, summary, sections, tier, base_version, reason, change_kind, brain }) => {
+      // No client-side tier default — the server computes the per-kind safe default (page-privacy
+      // T4/D10) so version-pinned installs can't bake a stale policy.
+      const pages = [{ ...(tier ? { tier } : {}), summary, base_version, sections: Array.isArray(sections) ? sections : [] }]
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brain/author`, {
+          method: 'POST',
+          headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          // `brain` is forwarded only when the caller named one. The server's resolveAuthorBrain gives
+          // an explicit brain top precedence and 409s on an unknown one rather than falling back to
+          // the pointer, so sending an empty value would turn "I did not choose" into "I chose wrong".
+          body: JSON.stringify({ kind, name, pages, reason, change_kind, ...(brain ? { brain } : {}) }),
+        })
+      } catch (e) {
+        return toolError(`Could not author "${name}": ${e.message}`)
+      }
+      if (!res.ok) {
+        // Read the body ONCE — classify() consumes it as text, so parsing after it is a spent stream.
+        const raw = await res.text()
+        let err = null
+        try { err = JSON.parse(raw) } catch { /* not JSON; classify handles it below */ }
+        // BRAIN-RESOLUTION REFUSALS carry the only thing that makes them actionable: which brains, and
+        // what is in each. classify() flattens a response to a generic status message, so routing these
+        // through it would drop the payload and leave the agent to guess a brain — the exact guess the
+        // 409 exists to prevent. Page counts and sample titles matter more than the names: per
+        // brain_identity.ts a brain's NAME is actively misleading about its contents.
+        if (err?.error === 'create_needs_brain' || err?.error === 'ambiguous_brain' || err?.error === 'unknown_brain') {
+          const list = (err.brains ?? []).map((b) => {
+            const count = b.pageCount != null ? ` — ${b.pageCount} page${b.pageCount === 1 ? '' : 's'}` : ''
+            const sample = b.sampleTitles?.length ? `: ${b.sampleTitles.slice(0, 4).join(', ')}` : ''
+            return `  • ${b.name ?? b.brain} (${b.orgId})${count}${sample}`
+          }).join('\n')
+          return toolError(
+            `Could not author "${name}": ${err.message ?? err.error}` +
+            (list ? `\n\nYour brains:\n${list}` : '') +
+            `\n\nRe-run author with brain:"<name>" — choose by what each brain HOLDS, not by its name.`,
+          )
+        }
+        const d = classify(res.status, res.headers.get('content-type'), raw, res.headers.get('x-vercel-id'))
+        return toolError(`Could not author "${name}": ${d.message}`)
+      }
+      const out = await res.json()
+      const blue = out?.links?.blue ?? 0
+      const retired = out?.links?.retired ?? 0
+      const red = out?.links?.red ?? 0
+      const redList = Array.isArray(out?.redLinks) && out.redLinks.length ? `\nRed-links (wanted nodes): ${out.redLinks.map((r) => `[[${r}]]`).join(', ')}` : ''
+      const retiredList = Array.isArray(out?.retiredLinks) && out.retiredLinks.length ? `\nRetired links (not current or wanted): ${out.retiredLinks.map((r) => `[[${r}]]`).join(', ')}` : ''
+      const stamps = Array.isArray(out?.identifiers) && out.identifiers.length ? `\nIdentifier stamps (join keys): ${out.identifiers.map((i) => `[[${i}]]`).join(', ')}` : ''
+      // TIER RETARGET — say it out loud. The server has always computed these (AuthorResult.tierCorrections)
+      // and its own comment says corrections are "surfaced (not hidden)", but nothing ever printed them, so
+      // the intent died at the client. That silence is not cosmetic: on 2026-07-29 a correction to
+      // cortex-cross-editor-hub landed on the SCOPED tier while the accessible tier kept serving a claim
+      // known to be false, and the response said only "Authored (1 tier)". Whoever reads this line is the
+      // last chance to notice a page was fixed somewhere nobody reads.
+      const corrections = Array.isArray(out?.tierCorrections) && out.tierCorrections.length
+        ? `\n⚠ TIER: this wrote to ${out.tierCorrections.map((c) => `${c.actualTier} (you asked for ${c.requestedTier})`).join('; ')}.` +
+          ` If that is not the tier you meant, read_page and check which copy you just changed —` +
+          ` a page can exist at several tiers and they drift apart independently.`
+        : ''
+      // KWA-26 — the advisory undated flag. The server has computed `undatedSections` since #558 and
+      // the route has returned it ever since; NOTHING PRINTED IT, so the one consumer the item names
+      // never saw it: "the author path returns a flag naming undated status claims SO THE AGENT FIXES
+      // THEM IN-TURN." A flag the agent cannot see does not exist. Same shape as tierCorrections
+      // directly above — computed, returned, and silently dropped at the client — and the fourth
+      // instance of it in this subsystem.
+      //
+      // Advisory by DESIGN, not by omission: the write has already landed by the time this prints
+      // (2026-07-28, option (b) "make this blocking" was weighed and rejected — rejecting the write
+      // would lose the session's understanding, the more expensive failure). So this is phrased as
+      // work the agent can do NOW, while the context is still hot, which is the only moment the fix
+      // is cheap.
+      const undated = Array.isArray(out?.undatedSections) && out.undatedSections.length
+        ? `\n⚠ Undated (${out.undatedSections.length}): ${out.undatedSections.map((h) => `"${h}"`).join(', ')}.` +
+          ` These landed with no explicit calendar date in the heading or body, so a reader cannot tell` +
+          ` WHEN the claim was true — only when the text was last written. If any of them assert a` +
+          ` STATUS ("X is live", "Y is not merged"), add the date inline with edit_page while you still` +
+          ` hold the context. The write already landed; this is advisory.`
+        : ''
+      const verb = out?.created ? 'Created + authored' : 'Authored'
+      const note = out?.built ? `${verb} "${name}" (${out.built} tier${out.built === 1 ? '' : 's'}). Links: ${blue} resolved, ${retired} retired, ${red} red.${corrections}${retiredList}${redList}${stamps}${undated}`
+        : `No change to "${name}"${out?.skipped?.length ? ` (${out.skipped.join(', ')})` : ''}.${corrections}`
+      return { content: [{ type: 'text', text: note }] }
+    },
+  )
+
+  await server.connect(new StdioServerTransport())
+}