feat: add readable graph overview groups and member navigation

.agents/inbox/2026-10-27-cold-lod-fixtures-need-separate-budgets.md

@@ -0,0 +1,62 @@
+# Cold database fixture setup must not consume the browser interaction budget
+
+Date: 2026-10-27. Searched the symptom index and the existing LOD ownership and
+performance-evidence lessons. Final PR #192 CI at
+`4abce30030e45e1e9d468c67e414302f270d45e9` failed the strict headed new-user
+sequence even though the earlier focused local browser run passed.
+
+## Evidence and cause
+
+```sh
+gh run view 40541503856 --repo GraphDone/GraphDone-Core --job 122322370157 --log-failed
+gh run download 40541503856 --repo GraphDone/GraphDone-Core \
+  --name smoke-results-e2599a1245884c450fd1635d89b92cc60871a033 --dir <owned-evidence-directory>
+```
+
+The basic smoke sequence passed 6/6. New-user reported 43 pass / 2 fail: one
+desktop LOD case hit its 120-second whole-test timeout, and the second entry
+was the harness's process-exit failure. The phone LOD case passed in 55.3s.
+The trace records eight fixture mutation calls taking approximately 5.7–11.6s
+each. Those calls consumed most of the shared setup/interaction budget on this
+cold database. Navigation, graph switching and camera-restoration assertions
+completed; the timeout interrupted the final source-position readback. That is
+an incomplete persistence check, not a passing journey or proof of a renderer
+hang. Cold query planning is consistent with the earlier local batch-size
+incident; this trace does not separately profile the database planner.
+
+## Corrective rule
+
+Use a bounded Playwright fixture for expensive real API setup and teardown.
+The LOD setup fixture gets 180 seconds; the interaction test keeps
+120 seconds, 10-second actions and its existing assertion timeouts. An ownership
+dependency fixture has an independent 60-second cleanup budget. Preserve
+the 301-item / 370-edge graph, all assertions, and zero retries. Register owned
+graph IDs immediately after creation so partial setup can be cleaned. Teardown
+runs before the page closes, removes the write guard, deletes edges before
+items/graph, verifies graph removal, and surfaces cleanup failures. A teardown
+failure must fail the test, not silently leave fixtures behind.
+
+Independent review caught a flaw in the first correction: Playwright 1.63 shares
+a fixture's timeout slot between setup and teardown and can skip teardown after
+setup exhausts it. Moving ownership/cleanup into a dependency fixture keeps its
+budget independent. Do not describe one fixture timeout as a separate allowance
+for each phase. The harness negative control must intentionally time out its
+dependent setup and still observe strict edge/item/graph cleanup and readback.
+
+The next review identified a late-response race: Playwright timeout does not
+cancel an in-flight create. Cleanup now first aborts future seed batches and
+drains tracked seed promises, retaining the response's graph ID before deletion.
+The ownership fixture rejects new seed work once cleanup starts. A deferred-create
+negative control releases the response after setup timeout and checks that no
+item creation follows and the late graph is still deleted. A request that never
+settles can exhaust cleanup's independent budget; that is a reported failed
+cleanup, not a claim that remote cancellation or lost-ack recovery was proved.
+
+## Limits
+
+This isolates fixture provisioning from interaction correctness; it neither
+improves measured application speed nor proves the large-graph performance
+target. Rerun the complete strict CI sequence and record its actual result.
+Raw CI artifacts are retained under the owned resolution evidence directory;
+they are not added to the public repository because traces can contain fixture
+sessions. The run link remains the canonical CI failure evidence.

.agents/inbox/2026-10-27-explicit-camera-input-must-stop-auto-fit.md

@@ -0,0 +1,49 @@
+# Explicit camera input must stop pending automatic framing
+
+On 2026-10-27, [PR #192 CI run 40567753567](https://github.com/GraphDone/GraphDone-Core/actions/runs/40567753567)
+tested feature head `74c122d17897d61272e056df02a7957a686f2e2a` on GitHub's merge
+composition `f7dd01a57766ff1919237c9852cabfd5130d6eac`. Fixture setup no longer
+exhausted the interaction timeout, but both semantic LOD cases failed their
+first requested camera scale: expected 0.5, observed 0.1379447032 at 1440px
+and 0.0720887246 at 390px. The basic smoke sequence passed 6/6; new-user had
+42 passes, two LOD failures and the harness's failed-process evidence row.
+This is a distinct application race, not the earlier fixture-budget failure.
+
+## Cause and corrective rule
+
+Initial auto-fit samples the settling layout every 250ms. Canvas pointer/wheel
+input stopped that loop, but the minimap's explicit camera functions only set
+`cameraManuallyPositionedRef`. Because the minimap is outside the canvas, a
+pending fit could overwrite its requested zoom. Overview inspection had the
+same omission. Explicit pan, zoom and item inspection now mark the current
+graph as framed; direct D3 source events do so too. Programmatic automatic
+fit/restore still does not claim manual intent. The existing graph ID guard
+keeps this ownership scoped to the current graph.
+
+The first warm local negative control passed, showing that ordinary timing
+was insufficient to reproduce the CI race reliably. The browser regression
+now pauses the browser clock before graph loading, advances through the first
+fit at 350ms, requests the minimap zoom, then advances six 250ms intervals
+while checking the camera remains at 0.5. It resumes real time for the remaining
+mouse/touch/navigation and persistence checks. It does not extend timeouts,
+add retries, wait for auto-fit to finish, or bypass the production camera path.
+
+With the strengthened test, restoring the unmodified component from
+`74c122d` caused the desktop case to fail at the camera-stability assertion;
+restoring the fix passed the same case. Both ordinary desktop/phone cases
+also passed before clock control. Commands used Node 22.18.0, an owned
+Neo4j/API/Vite stack, and headed Playwright with one worker and zero retries.
+Final two-viewport, related camera/resize/detail and CI results are recorded in
+the PR discussion; this lesson alone does not claim those pending gates pass.
+
+Limits: these checks cover camera intent and immutable stored positions on the
+301-item fixture. They do not establish full multilevel semantic projection,
+1k/10k performance, hosted behavior or deployed-source identity. Preserve the
+original failed CI artifacts and the warm negative-control pass alongside the
+deterministic failure; a later green run must not erase either observation.
+
+Independent review identified a lost initial-fit geometry sample after moving
+zoom earlier. The test now checks font size, viewport bounds and card overlap
+both at the first automatic fit and after explicit zoom, retaining both samples
+in its geometry attachment. Clock control keeps the first sample from waiting
+out the pending fit loop.

.agents/inbox/2026-10-27-github-connector-write-permissions.md

@@ -0,0 +1,38 @@
+# A GitHub connector denial describes that client, not every configured client
+
+Date: 2026-10-27. Context: publishing the owner-authorized GraphDone LOD work as
+a draft PR to `dev`. Searched the symptom index and the existing live-ref/transport
+lesson before recording this distinct create-PR case.
+
+## Evidence
+
+The feature branch push succeeded through the existing SSH remote. The GitHub
+connector's `create_pull_request` then returned:
+
+```text
+HTTP 403: Resource not accessible by integration
+```
+
+The existing CLI returned `mvalancy` for `gh api user --jq .login` and successfully
+ran `gh pr create --repo GraphDone/GraphDone-Core --base dev --head
+feature/dynamic-lod-overview-20261027 --draft --body-file <owned file>`.
+Readback confirmed [PR #192](https://github.com/GraphDone/GraphDone-Core/pull/192)
+was open, draft, and pointed at the intended source head. No authentication,
+account, token scope or repository protection was changed. No merge occurred.
+
+## Cause and corrective rule
+
+The integration could read this repository but could not create the PR. Its
+permission boundary differs from the already configured CLI credential. Report
+that specific limitation rather than declaring all GitHub access blocked or
+requesting broader credentials. For an already-authorized operation, an existing
+client with its own valid access can be used; verify the resulting object and
+source head. Do not use another client to evade repository policy, an account
+denial, an approval rejection or an operation outside the user's authorization.
+
+## Limits
+
+This establishes one successful draft-PR creation through existing credentials.
+It does not establish write access for other repositories, non-author approval,
+merge readiness or deployment authority. The narrower admin-integration playbook
+still governs merges; this incident does not amend that policy.

.agents/inbox/2026-10-27-live-graph-review-can-attempt-layout-writes.md

@@ -0,0 +1,72 @@
+# Viewing a live graph can attempt layout writes even without dragging
+
+Date: 2026-10-27 UTC. Searched the current performance-evidence index and the
+October 24 semantic-review worktree's symptom index, write-it-down guidance and
+read-only capture lessons before recording this finding.
+
+## Evidence
+
+The existing harness at `01f0c4df1ba82eaaca9769d366886c76b99f0e6b` ran:
+
+```text
+TEST_URL=http://127.0.0.1:8540 GRAPH_REVIEW_NAME='Graphlings Release' \
+OPERATOR_CREDENTIAL_FILE=<existing private operator file> \
+PLAYWRIGHT_CHANNEL=chrome \
+GRAPH_REVIEW_OUT=test-artifacts/graph-lod-review/continuation-20261027 \
+GRAPH_REVIEW_SNAPSHOT=1 npm run report:graph-lod
+
+finishedAt=2026-10-27T14:56:23.996Z
+nodes=301 edges=370 captures=18 pageErrors=[]
+blockedWrites=4 (POST /api/graphql)
+1 failed: Review attempted a server write; request was blocked, inspect caller
+```
+
+No drag, seed or graph-edit interaction was requested. Node/edge identity
+assertions passed. Desktop and phone fit screenshots still show no readable
+titles or relationships. Served asset: `/assets/index-1788931697531.js`; its
+exact source SHA is not established by the harness revision.
+
+A second bounded diagnostic installed API interception before login, permitting
+queries and only the login mutation. It selected the same graph, waited, resized
+to phone and fit the camera. It printed only operation/field names:
+
+```text
+blocked=4
+operation=UpdateWorkItems
+rootField=updateWorkItems
+variableKeys=[where,update]
+updateFields=[positionX,positionY]
+```
+
+That diagnostic exited 143 after printing; do not record it as a passing test.
+The original sweep exited 1. Both failures remain explicit. Private screenshots
+and the snapshot stay in the prior worktree's ignored artifacts directory.
+
+## Cause and corrective rule
+
+The application attempted automatic position persistence during a visual review.
+Source has a `simulation.on('end.persist', ...)` → `persistAllPositions()` path;
+the exact browser caller and affected graph were not captured, so that path is
+a hypothesis, not a proved request stack. Do not attribute the request to zoom
+alone or assume the selected graph was the mutation target.
+
+Install the read-only guard before application navigation, allowing only the
+intended authentication exchange and reads on the configured API origins.
+Retain safe operation/field names for rejected calls, never tokens, payload values
+or session state. An attempted write remains a failed review even when blocked.
+Reproduce on an owned fixture before correcting persistence intent. Camera, LOD
+expansion and temporary summary coordinates must not enqueue saved positions.
+
+## Limits and regression path
+
+The first sweep installs its guard after login, so its blocked-write evidence
+does not prove there were no earlier writes. Identity-set equality does not prove
+position equality or whole-graph immutability. The diagnostic blocked the four
+observed position updates, but did not establish root-cause completion.
+
+`tests/lib/graphReview.test.mjs` in the prior review branch passed 2/2 guard tests;
+the real sweep supplies a failing acceptance case. LOD-0 in the
+[continuation plan](../../docs/architecture/dynamic-graph-lod.md) ports and extends
+that harness on current dev, with owned layout-persistence reproduction and
+independent coordinate readback. No production fix or new passing regression is
+claimed by this documentation-only change.

.agents/inbox/2026-10-27-lod-projections-need-renderer-ownership.md

@@ -0,0 +1,66 @@
+# Display projections need explicit renderer ownership and real selection checks
+
+Date: 2026-10-27. Repository: GraphDone-Core. Base: current dev
+`ef495eff15ed7aac51e72dc7a1db1bb96d2b3695`. Related implementation:
+`semanticLOD.ts`, `SemanticGraphOverview.tsx`, `InteractiveGraphVisualization.tsx`.
+Existing guidance searched: symptom index, performance-evidence index, the live
+graph write-attempt lesson and the snapshot-merge lesson.
+
+## Evidence and cause
+
+The first nine projection/placement tests passed, but independent review found
+that a sibling summary overlay bypassed the existing SVG's native gestures and
+overlapped Workspace controls. Moving it inside the retained SVG fixed gesture
+ownership, but exposed a second boundary: descendant `svg.select('defs')` could
+select React's nested definitions instead of the source renderer's definitions.
+Source children also override inherited visibility/pointer-events, so hiding only
+their parent with those properties did not reliably disable source hit targets.
+
+The second headed browser run used an owned Neo4j fixture, 301 pinned items and
+370 relationships, at widths 1440 and 390:
+
+```text
+TEST_URL=http://127.0.0.1:28528 QC_BROWSER_PORT=28529 xvfb-run --auto-servernum \
+  npx playwright test tests/e2e/graph/semantic-lod.spec.ts \
+  --project=GraphDone-Core/dev-neo4j/chromium --headed --workers=1 --reporter=line
+2 failed: getByTestId('node-inspector') expected visible; element(s) not found
+```
+
+The item camera moved, but the member click removed its browser section before
+the document outside-click handler inspected the target. A `closest()` exclusion
+alone failed because the target's detached subtree no longer reached the overview
+root. Stop click propagation at the React overview boundary, while allowing native
+camera gestures to reach the owning SVG. The third run passed both viewports,
+including inspector selection, Back, wheel, zero attempted writes and exact saved
+position readback before/after navigation and reload.
+
+Earlier validation failures are retained in ignored
+`test-artifacts/lod-evidence/first-attempt/` and `second-attempt/`. The first run
+also had fixture confounders: a concurrent typecheck rebuilt Core and restarted
+the watched API; 100-input Neo4j create mutations exceeded the test timeout.
+Use the built API without a watcher and repeated 20-input mutation shapes for
+this fixture. Keep the full 301/370 dataset. The default parallel web unit run
+had a 16ms timing assertion fail and a 5s UI timeout; a one-worker run passed all
+335 tests. Do not run timing-sensitive validation alongside heavy fixture work.
+
+## Corrective rule
+
+- Keep source and projected objects separate; projected coordinates never enter
+  simulation merges or the save queue.
+- Give React and D3 explicit sibling roots. Scope D3 definition selection to
+  direct children and preserve the React root during initialization.
+- Hide source groups with `display:none` while the overview owns interaction;
+  refresh text fitting once they become measurable again.
+- Exercise ordinary pointer, keyboard and touch navigation through the actual
+  production component. Assert the inspector and focus, not only camera motion
+  or a `data-active` flag. Check forced Overview at normal item scale too.
+- Bind Back state to an inspection session, including graph changes, and retain
+  exact typed/directed edge accounting even when some labels cannot fit.
+
+## Limits
+
+These are local owned-fixture results, not evidence of deployment or Cloud parity.
+This slice retains the full source SVG and full graph queries. It does not resolve
+legacy autosave of newly placed/overlapping nodes, nested spatial cuts, streaming,
+or the 1k/10k performance targets. A local note is not published knowledge until
+the related reviewed change is integrated.

.agents/inbox/2026-10-27-lod-reuse-needs-live-consumer-evidence.md

@@ -0,0 +1,49 @@
+# Reuse decisions need consumer evidence as well as a passing library test
+
+Date: 2026-10-27 UTC. Searched GraphDone's semantic/performance lessons and
+CodeGraph's current unified-viewer plan before updating the LOD continuation.
+
+The owner identified prior CodeGraph LOD work omitted from the first GraphDone
+plan. Review found useful implemented behavior in the mandala and modern
+continuous Structure workspace, plus a tempting standalone LOD module whose
+comments describe broader sharing than its consumers establish.
+
+## Receipt
+
+At Graphlings source `c5fb0089f4672d1d33c4fbf6c54bef63feab2636`:
+
+```text
+node tools/codegraph/src/codegraph/assets/lib/lod.js --test
+lod.js self-test: OK
+
+rg -n 'lib/lod|window\.LOD|LOD\.(swap|band|hysteresis|labelAlpha|fadeIn)' \
+  tools/codegraph/src/codegraph/assets
+.../assets/lib/lod.js:72:if (typeof window !== "undefined") window.LOD = LOD;
+
+tools/codegraph/docs/UNIFIED-VIEWER-PLAN.md:
+records that lod.js has no viewer consumers and enlighten uses inline LOD
+
+git diff --name-only -- tools/codegraph
+<no paths>
+```
+
+The active inline hierarchy walk retains a parent when estimated children would
+be too small; `placeLabels` prioritizes folders and collision-culls names.
+`structure-workspace.js` separately maintains stable page/world identity,
+bounded requests and generation checks. Those are the stronger reuse references.
+Some legacy browser controls still expect mandala globals at the new Structure
+front door. The installed `/api/runtime` returned 503; no live viewer pass or
+performance guarantee was established in this review.
+
+## Cause, corrective rule and limits
+
+The first plan considered GraphDone in isolation. The follow-up also illustrates
+why a file's name/header and passing pure tests do not establish runtime adoption.
+Before calling code shared, trace imports and actual consumers, then verify the
+behavior contract in each. Reuse observed algorithms and test invariants first;
+extract a minimal common module only with two wired consumers and an appropriate
+licensing boundary. Do not transfer historical FPS claims or stale test routes.
+
+Canonical guidance: [CodeGraph reuse map](../../docs/architecture/codegraph-lod-reuse.md).
+This change updates the plan and its discovery links. It copies no proprietary
+source, changes no renderer, and does not claim the integration is implemented.