…boarescu#10/rboarescu#12/rboarescu#13 to main

The amendments to those open upstream PRs caught real bugs that exist
on fork main too — production at disks runs fork main, so these were
shipping live until now.

## main.py — /graph endpoint (from PR rboarescu#13)

- `_read_wings_rooms_direct()`: build `rooms` from union of
  `wings.keys()` + `rooms_by_wing.keys()` rather than just wings.
  Otherwise a partial schema-drift (one query OperationalError-ed
  but the other succeeded) silently drops the half that worked.
  Real data-loss bug for the SME / /viz consumers.
- `/graph` handler: gate the direct-sqlite reads on `_read_sem` via
  a `_direct_under_sem` helper. Coordinates with `_exclusive_palace()`
  used by `/repair mode=rebuild` (so /graph yields rather than racing
  delete-then-create on chroma.sqlite3) and rate-limits unbounded
  `asyncio.to_thread` reads under load (was 2 threads/request × N
  concurrent requests).
- `_canonical_topic()` (from PR rboarescu#8): drop the `topic: str` annotation
  and add a non-string isinstance guard at the top, coerce
  `None`/numbers/lists to `CHECKPOINT_TOPIC` with a warning. A
  malformed `{"topic": null}` JSON payload no longer leaks `None`
  through to `tool_diary_write`.

## scripts/verify-routes.sh (from PR rboarescu#9)

- `set -euo pipefail` (was `set -e`) — pipeline failures and unset
  vars now surface instead of being masked.
- `curl -fsS` instead of `-sS` on every probe so HTTP non-2xx
  (e.g. `/health` 503 when palace is degraded) fails curl directly.
  Without this, a 503 body with `"daemon":"palace-daemon"` slips
  through the body-grep as a pass.
- Limit-check rewrite: split curl exit code from JSON parse so a
  connection error or non-JSON response `?`-flags rather than
  fails-with-traceback (the previous `2>&1` redirect captured
  Python tracebacks into `$COUNT`, which then triggered the fail
  path with a confusing message).

## clients/palace-mcp-dispatch.sh (from PR rboarescu#10)

- Replace `readlink -f` (GNU-specific, fails on macOS BSD readlink)
  with `cd "$(dirname …)" && pwd -P`. POSIX-portable; covers the
  actual common case (parent directory is a symlink under the
  Claude Code plugin cache).
- Add explicit existence check on `$MCP_CLIENT` before exec, with
  a clear error message instead of a generic Python "can't open
  file" trace.

## clients/palace-mode (from PR rboarescu#12)

- Make `PALACE_API_KEY` optional in `set_mode_remote`. Server-side
  `_check_auth` only enforces auth when its own `PALACE_API_KEY` is
  set, so a daemon running without auth accepts unauthenticated
  clients. The previous fail-fast was overly strict for that case.
  Warn-but-proceed instead.

All five fixes are amendments on the corresponding upstream PR
branches (force-pushed earlier today). No behavior change for the
healthy path; the changes harden failure modes that were caught in
review.

…nding queue; trim patch

Filed four upstream PRs on 2026-04-30:
- rboarescu#15  feat: GET /viz status dashboard (stacks on rboarescu#13)
- rboarescu#16  feat: GET /list — query-free metadata browse
- rboarescu#17  feat: DELETE /memory + PATCH /memory
- rboarescu#18  feat(lifespan): auto-migrate Stop-hook checkpoints on startup

Also rebased PR rboarescu#13 onto upstream/main to clear a CHANGELOG conflict
left by upstream's b4aee82 (patch sync) — state went CONFLICTING ->
MERGEABLE / CLEAN.

README:
- Open upstream PRs table: four new rows (rboarescu#15-rboarescu#18) plus a 2026-04-30
  note covering today's rebase + new PRs in one breath.
- Pending PRs queue: now empty. Replaced the four stale rows
  (event-log-frame and graph-endpoint were already in flight via
  rboarescu#11 and rboarescu#13; mempal-fast.py was already upstream via the merged
  PR #4 omnibus; /viz is now PR rboarescu#15) with a brief empty-state note.

CLAUDE.md:
- Patch description trimmed to reflect that the hnsw:num_threads
  enforcement landed upstream via _pin_hnsw_threads(); only the
  log + retry-once slice remains.

patches/mcp_server_get_collection.patch:
- Regenerated against current mempalace develop. The patch is now
  just the "log exception + retry once on cache failure" change.
  Filed upstream as MemPalace/mempalace#1286; once that merges this
  patch retires.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

README:
- Intro paragraph: appended GET /list (PR rboarescu#16), DELETE/PATCH /memory
  (PR rboarescu#17), and lifespan auto-migrate (PR rboarescu#18) to "what this fork
  adds" since they're already on fork main even though the PRs are
  awaiting review upstream.
- Links bar: added docs/typescript-port-plan.md.
- Added a "Cross-repo coordination" subsection under "Recently landed
  in upstream" — calls out the local patches/ directory and the
  in-flight MemPalace/mempalace#1286 that retires it. Also references
  #1142 (RELEASING.md) for completeness.
- Requirements: dropped the stale "kind= searcher filter" justification
  for recommending the fork (kind= was retired in 1.7.1); replaced
  with daemon-strict hook mode + warnings/sqlite-fallback search path
  as the actual current reasons. Added the patches/ re-apply step.
- API table: added /list, DELETE /memory/{id}, PATCH /memory/{id}
  rows so the table reflects what the fork main actually exposes.
- Sources: cross-repo PR note for #1286.

CHANGELOG:
- Added [Unreleased] section: patch trim (Maintenance), TS port plan
  doc, hook-routing-fix.md status header, and a Docs entry covering
  today's README updates + PR rboarescu#13 rebase context.

docs/hook-routing-fix.md:
- Added a Status: SHIPPED header pointing at 62425e3 (2026-04-24
  clients/hook.py introduction) and clarifying mempal-fast.py is the
  simpler successor — same shape as docs/graph-endpoint.md's status
  header.

No daemon behaviour changes.

Eight comments addressed across main.py, static/viz.html, CHANGELOG.md.
Comments on docs/graph-endpoint.md and main.py:640 were inherited from
PR rboarescu#13's review and are already settled by the 152e428 backport on
main; left untouched here.

## Auth (was: /viz served publicly)

main.py: /viz now goes through _check_auth on the same code path as
every other endpoint. Accepts the key from either the X-Api-Key header
(preferred) or the ?key=… query param (bookmarkable shortcut).
_check_auth is a no-op when PALACE_API_KEY is unset, so the
zero-config local-dev experience is unchanged.

## CDN integrity (was: D3 + Mermaid loaded without SRI, version not pinned)

static/viz.html: pinned to [email protected] and [email protected] with SHA-384
SRI hashes via cdn.jsdelivr.net. Added crossorigin="anonymous" (required
for SRI on cross-origin scripts) and referrerpolicy="no-referrer".
Comment block above the script tags explains the version-bump+hash-
together rule for future maintainers.

## Mermaid sanitization (was: label sanitizer didn't strip control chars; securityLevel "loose")

static/viz.html:
- mermaidSafe() now strips ASCII control chars (\n, \r, \t, etc.) in
  addition to the existing parser-breaking chars. A label containing
  raw newlines used to render half a label on each side of the break.
- mermaid.initialize({ securityLevel: "strict" }) — "loose" was
  over-permissive (relaxes label sanitization, enables clickable
  diagram nodes). The dashboard never needs node click handlers, and
  our own mermaidSafe() runs before labels reach Mermaid anyway, so
  strict is the right default.

## Mermaid render-error fallback (was: <div> appended inside <pre>)

static/viz.html: target was <pre id="hierarchy">; appending a <div>
inside it produced invalid HTML and inconsistent cross-browser
rendering. Surface the error as plain text inside the existing element
and tag the container with class="err" so CSS can style it.

## ?key= leakage warning

static/viz.html: comment on the KEY parsing block calls out that
?key=… leaks into browser history, referer headers, and proxy logs.
Same caveat surfaced in the /viz docstring and CHANGELOG entry.

## Docstring drift (was: "cached at module load" but actually lazy)

main.py: docstring rewritten to describe the actual lazy-load behaviour
("lazy-loaded on first request and cached in-process thereafter; one
disk read per daemon process").

## CHANGELOG.md (was: two ### Added headings under [Unreleased])

The /viz changelog block and the /graph block both used "### Added";
merged them under one heading. Also folded the new security details
(SRI pinning, securityLevel: strict, control-char strip, /viz auth)
into the /viz security bullet so the audit trail of what shipped here
is complete.

No daemon behaviour changes outside /viz. /viz behaviour change is
the auth gate — operators with PALACE_API_KEY set will get 401 on
unauthenticated /viz requests, which matches every other endpoint.