…eralization

Mirrors the mempalace fork's README pattern: top-of-document section
listing PRs we've filed and their state, then a "pending" queue for
PR-ready items, then an explicit "needs generalization" table for
items that bake in JP-specific assumptions and are held until they
can be split into a universal shape.

## What's now where

- **Open upstream PRs** (3): rboarescu#7 limit= fix, rboarescu#8 _canonical_topic, rboarescu#9
  verify-routes.sh
- **Recently landed in upstream**: PR #4 (cherry-picked into ef6ac03,
  closed) — the v1.5.0 daemon work
- **Pending PRs — ready to file** (6): GET /graph (folds in
  /graph.tunnels fix), GET /viz, palace-mcp-dispatch.sh, mempal-fast.py,
  event-log-frame.md, graph-endpoint.md
- **Needs generalization before PR** (3): deploy.sh (PALACE_HOST=disks
  + fork-mempalace import-check), palace-mode (Claude Code plugin
  cache layout), auto-repair-if-empty.sh (systemd --user shape)

## Why

JP's note: "we can wait if we need to generalize things but make sure
that is noted in the readme like we do with memorypalace." Filing PRs
that have JP-specific assumptions baked in would either fail in
contributor review or land features other operators couldn't use.
Better to be explicit about which items are PR-ready, which are queued,
and which need generalization work first — and what that work is —
so anyone can pick up a generalization-ready item without re-discovering
the constraint set.

`/graph.tunnels` was previously listed as its own row but it's
structurally a sub-feature of `/graph`; merged into that row to
avoid implying it can ship independently.

…boarescu#10/rboarescu#12/rboarescu#13 to main

The amendments to those open upstream PRs caught real bugs that exist
on fork main too — production at disks runs fork main, so these were
shipping live until now.

## main.py — /graph endpoint (from PR rboarescu#13)

- `_read_wings_rooms_direct()`: build `rooms` from union of
  `wings.keys()` + `rooms_by_wing.keys()` rather than just wings.
  Otherwise a partial schema-drift (one query OperationalError-ed
  but the other succeeded) silently drops the half that worked.
  Real data-loss bug for the SME / /viz consumers.
- `/graph` handler: gate the direct-sqlite reads on `_read_sem` via
  a `_direct_under_sem` helper. Coordinates with `_exclusive_palace()`
  used by `/repair mode=rebuild` (so /graph yields rather than racing
  delete-then-create on chroma.sqlite3) and rate-limits unbounded
  `asyncio.to_thread` reads under load (was 2 threads/request × N
  concurrent requests).
- `_canonical_topic()` (from PR rboarescu#8): drop the `topic: str` annotation
  and add a non-string isinstance guard at the top, coerce
  `None`/numbers/lists to `CHECKPOINT_TOPIC` with a warning. A
  malformed `{"topic": null}` JSON payload no longer leaks `None`
  through to `tool_diary_write`.

## scripts/verify-routes.sh (from PR rboarescu#9)

- `set -euo pipefail` (was `set -e`) — pipeline failures and unset
  vars now surface instead of being masked.
- `curl -fsS` instead of `-sS` on every probe so HTTP non-2xx
  (e.g. `/health` 503 when palace is degraded) fails curl directly.
  Without this, a 503 body with `"daemon":"palace-daemon"` slips
  through the body-grep as a pass.
- Limit-check rewrite: split curl exit code from JSON parse so a
  connection error or non-JSON response `?`-flags rather than
  fails-with-traceback (the previous `2>&1` redirect captured
  Python tracebacks into `$COUNT`, which then triggered the fail
  path with a confusing message).

## clients/palace-mcp-dispatch.sh (from PR rboarescu#10)

- Replace `readlink -f` (GNU-specific, fails on macOS BSD readlink)
  with `cd "$(dirname …)" && pwd -P`. POSIX-portable; covers the
  actual common case (parent directory is a symlink under the
  Claude Code plugin cache).
- Add explicit existence check on `$MCP_CLIENT` before exec, with
  a clear error message instead of a generic Python "can't open
  file" trace.

## clients/palace-mode (from PR rboarescu#12)

- Make `PALACE_API_KEY` optional in `set_mode_remote`. Server-side
  `_check_auth` only enforces auth when its own `PALACE_API_KEY` is
  set, so a daemon running without auth accepts unauthenticated
  clients. The previous fail-fast was overly strict for that case.
  Warn-but-proceed instead.

All five fixes are amendments on the corresponding upstream PR
branches (force-pushed earlier today). No behavior change for the
healthy path; the changes harden failure modes that were caught in
review.