feat: open-world trust-loop UX (chat-first review, edge review, layout reshape)

Chat-first magic build; radial + chat-driven Accept/Reject review; edge-claim fix (edges now reviewable + amber); inspector panel dropped + full-width layout; fcose auto-arrange on build; confidence-tier voice; stable full-source context. 44 files, gate-verified upstream (mypy + full pytest green).

cytoscapecanvas/frontend/Index.svelte

@@ -1,10 +1,14 @@
 <script module lang="ts">
 	import cytoscapeLib from "cytoscape";
 	import cxtmenu from "cytoscape-cxtmenu";
-	// Register the radial context-menu extension exactly once. Module scope runs
-	// a single time for the whole component (not per instance / remount), so this
-	// avoids Cytoscape's "extension already registered" warning.
+	// @ts-expect-error cytoscape-fcose ships no types (same as cxtmenu)
+	import fcose from "cytoscape-fcose";
+	// Register extensions exactly once. Module scope runs a single time for the
+	// whole component (not per instance / remount), so this avoids Cytoscape's
+	// "extension already registered" warning. cxtmenu = radial menu; fcose =
+	// force-directed auto-layout (the "Arrange" button).
 	cytoscapeLib.use(cxtmenu);
+	cytoscapeLib.use(fcose);
 </script>
 
 <script lang="ts">
@@ -16,7 +20,12 @@
 	import {
 		applyCommands,
 		resetCanvas,
-		spotlightTurnNodes,
+		dimBurst,
+		collectTurnNodeIds,
+		startReviewPulse,
+		stopReviewPulse,
+		wireHoverFade,
+		wireEdgeHover,
 		wireSelectionEvents,
 		wireRenameEvents,
 		wireTrustTooltip,
@@ -55,6 +64,47 @@
 	let focusedNodeId = $state<string | null>(null);
 	// FE-01: non-fatal patch-apply warning surfaced as a dismissible toast.
 	let patchError = $state<string | null>(null);
+	// Review-queue badge: count of model-inferred proposals still awaiting the
+	// user's decision. Derived from the canvas after every patch so it counts down
+	// as proposals are accepted/rejected — framing review as the act that makes
+	// knowledge real. Pure frontend (no backend arity), so it never touches turn_outputs.
+	let pendingCount = $state(0);
+	// Task 4: ids of nodes added/touched by the most-recent non-snapshot turn.
+	// Used by settleNewNodes() to pin existing nodes and only lay out the new ones.
+	// Reset to empty on a snapshot (full rebuild) so "Settle new" falls back to
+	// a full layout on the first turn after a reload.
+	let lastTurnNodeIds = $state<Set<string>>(new Set());
+
+	// Auto-arrange debounce: after a BUILD/LOAD snapshot lands, wait 450 ms for
+	// streaming to settle, then run fcose once over all visible nodes. Reset on
+	// each new snapshot patch so bursts coalesce into a single layout run.
+	// Cleared on teardown so the timer never fires after the component is gone.
+	let autoArrangeTimer: ReturnType<typeof setTimeout> | null = null;
+
+	function updatePendingCount(): void {
+		if (cy) pendingCount = cy.$(".review-pending.origin-model-inferred").length;
+	}
+
+	/** j/k review-queue cycling: focus the next/prev pending proposal and select it
+	 *  (which surfaces its Accept/Reject in the inspector). Returns false if none. */
+	function cyclePending(dir: 1 | -1): boolean {
+		if (!cy) return false;
+		const pending = cy
+			.$(".review-pending.origin-model-inferred")
+			.filter((el) => el.isNode() && el.style("display") !== "none");
+		const ids = pending.map((n) => n.id());
+		if (ids.length === 0) return false;
+		const cur = focusedNodeId ? ids.indexOf(focusedNodeId) : -1;
+		const next = ids[(cur + (dir === 1 ? 1 : ids.length - 1)) % ids.length];
+		if (focusedNodeId) cy.getElementById(focusedNodeId).removeClass("focus-ring");
+		focusedNodeId = next;
+		const node = cy.getElementById(next);
+		node.addClass("focus-ring");
+		cy.animate({ center: { eles: node }, zoom: Math.max(cy.zoom(), 1.2) }, { duration: 300 });
+		cy.$(":selected").unselect();
+		node.select();
+		return true;
+	}
 
 	function fitGraph(): void {
 		if (!cy || cy.elements().length === 0) return;
@@ -65,6 +115,115 @@
 		cy.fit(cy.elements(), 28);
 	}
 
+	// Layout algorithms offered in the toolbar. fcose is the force-directed default
+	// (registered in the module script); concentric/grid/breadthfirst are native
+	// Cytoscape layouts (no extra dep). The frontend owns positions (plan/05), so a
+	// user-triggered re-layout is allowed.
+	type LayoutName = "fcose" | "concentric" | "grid" | "breadthfirst";
+
+	// Auto-arrange — the "✦ Arrange" button (fcose) + the layout <select>. Animates
+	// to a tidy arrangement and re-fits. Lays out only visible (non-fogged) elements
+	// so fogged nodes keep their place. No-op on an empty canvas.
+	function runLayout(name: LayoutName): void {
+		if (!cy || cy.elements().length === 0) return;
+		cy.elements().removeClass("dimmed");
+		const eles = cy.elements().filter((el) => !el.hasClass("fogged"));
+		// Per-algorithm options. fcose keeps the existing tuning; the native layouts
+		// share the same animate/fit/padding feel so switching is seamless.
+		const optsByName: Record<LayoutName, Record<string, unknown>> = {
+			fcose: {
+				name: "fcose",
+				animate: true,
+				animationDuration: 650,
+				fit: true,
+				padding: 36,
+				nodeSeparation: 95,
+				randomize: false,
+				quality: "default",
+			},
+			concentric: {
+				name: "concentric",
+				animate: true,
+				animationDuration: 650,
+				fit: true,
+				padding: 36,
+				minNodeSpacing: 40,
+			},
+			grid: {
+				name: "grid",
+				animate: true,
+				animationDuration: 650,
+				fit: true,
+				padding: 36,
+				avoidOverlap: true,
+			},
+			breadthfirst: {
+				name: "breadthfirst",
+				animate: true,
+				animationDuration: 650,
+				fit: true,
+				padding: 36,
+				spacingFactor: 1.2,
+				directed: false,
+			},
+		};
+		const opts = optsByName[name] as unknown as import("cytoscape").LayoutOptions;
+		eles.layout(opts).run();
+	}
+
+	/**
+	 * Task 4: Partial fcose layout — settle ONLY newly-added nodes while keeping
+	 * existing nodes pinned at their current positions via fcose `fixedNodeConstraint`.
+	 * If the last-turn set is empty (no turn applied yet) or covers all canvas nodes
+	 * (a full rebuild), falls back to a full runLayout("fcose") instead.
+	 */
+	function settleNewNodes(): void {
+		if (!cy || cy.elements().length === 0) return;
+		const allNodeIds = cy.nodes().map((n) => n.id());
+		// Fall back to full layout when there are no last-turn nodes (fresh snapshot
+		// with no turn yet applied) or when every node is a new node.
+		if (lastTurnNodeIds.size === 0 || lastTurnNodeIds.size >= allNodeIds.length) {
+			runLayout("fcose");
+			return;
+		}
+		// Build fixedNodeConstraint for every node NOT in lastTurnNodeIds so they
+		// keep their positions. Only visible (non-fogged) nodes join the layout.
+		interface FixedConstraint { nodeId: string; position: { x: number; y: number } }
+		const fixedNodeConstraint: FixedConstraint[] = [];
+		cy.nodes().forEach((n) => {
+			if (!lastTurnNodeIds.has(n.id()) && !n.hasClass("fogged")) {
+				const pos = n.position();
+				fixedNodeConstraint.push({ nodeId: n.id(), position: { x: pos.x, y: pos.y } });
+			}
+		});
+		const eles = cy.elements().filter((el) => !el.hasClass("fogged"));
+		const opts = {
+			name: "fcose",
+			animate: true,
+			animationDuration: 650,
+			fit: true,
+			padding: 36,
+			nodeSeparation: 95,
+			randomize: false,
+			quality: "default",
+			fixedNodeConstraint,
+		} as unknown as import("cytoscape").LayoutOptions;
+		eles.layout(opts).run();
+	}
+
+	// Pure-view zoom around the viewport center (the ＋ / － toolbar buttons). No
+	// backend call; animates a smooth zoom so the gesture reads as deliberate.
+	function zoomBy(factor: number): void {
+		if (!cy) return;
+		cy.animate(
+			{
+				zoom: cy.zoom() * factor,
+				renderedPosition: { x: cy.width() / 2, y: cy.height() / 2 },
+			},
+			{ duration: 180 },
+		);
+	}
+
 	onMount(() => {
 		cy = cytoscape({
 			container,
@@ -115,6 +274,18 @@
 
 		wireTrustTooltip(cy);
 
+		// Hover-fade: fade everything outside the hovered node's neighbourhood so
+		// local structure pops (uses its own class; clears on mouseout).
+		wireHoverFade(cy);
+
+		// Edge hover-emphasis: brighten + thicken the hovered edge (class toggle only).
+		wireEdgeHover(cy);
+
+		// Pulse the amber "awaiting review" border on model-inferred pending nodes
+		// so a proposal that needs the user's decision draws the eye. Stopped in the
+		// teardown below before cy.destroy() so the interval never hits a dead core.
+		startReviewPulse(cy);
+
 		// T3-03: Keyboard navigation handler (thin wiring; logic lives in keyboardNav.ts).
 		// Arrow keys: move focus ring to the nearest visible non-fogged node.
 		// Enter: dispatch a select event for the focused node.
@@ -122,6 +293,44 @@
 		function handleKeydown(e: KeyboardEvent): void {
 			if (!cy) return;
 
+			// Single-key review shortcuts (the high-frequency path; far cheaper than a
+			// command palette). Guarded against firing while typing in a field; the
+			// handler is bound to the canvas container, so it only fires when the
+			// canvas has focus anyway. A = accept, R = reject the selected (or focused)
+			// node's proposal; F = zoom-to-fit. A/R reuse the same "review" select
+			// channel the radial menu dispatches, so the backend routing is unchanged.
+			const target = e.target as HTMLElement | null;
+			const typing =
+				target?.tagName === "INPUT" ||
+				target?.tagName === "TEXTAREA" ||
+				target?.isContentEditable === true;
+			if (!typing) {
+				const k = e.key.toLowerCase();
+				if (k === "f") {
+					e.preventDefault();
+					fitGraph();
+					return;
+				}
+				if (k === "a" || k === "r") {
+					const sel = cy.$("node:selected").first();
+					const id = sel.nonempty() ? sel.id() : focusedNodeId;
+					if (id) {
+						e.preventDefault();
+						gradio.dispatch("select", {
+							index: null,
+							value: { kind: "review", id, action: k === "a" ? "accepted" : "rejected" },
+							selected: false,
+						});
+					}
+					return;
+				}
+				if (k === "j" || k === "k") {
+					// Cycle the review queue: focus next/prev pending proposal + select it.
+					if (cyclePending(k === "j" ? 1 : -1)) e.preventDefault();
+					return;
+				}
+			}
+
 			if (e.key === "Escape") {
 				cy.$(":selected").unselect();
 				cy.elements().removeClass("dimmed");
@@ -191,6 +400,11 @@
 		return () => {
 			container.removeEventListener("keydown", handleKeydown);
 			ro.disconnect();
+			if (autoArrangeTimer !== null) {
+				clearTimeout(autoArrangeTimer);
+				autoArrangeTimer = null;
+			}
+			if (cy) stopReviewPulse(cy);
 			cy?.destroy();
 			cy = null;
 		};
@@ -226,13 +440,33 @@
 				resetCanvas(cy);
 				currentSceneId = value.scene_id;
 				pendingFit = true;
+				// A snapshot replaces the whole scene — clear the last-turn set so
+				// "Settle new" falls back to a full layout on the next turn.
+				lastTurnNodeIds = new Set();
+				// Auto-arrange: schedule fcose 450 ms after the most-recent snapshot
+				// patch so streaming bursts coalesce into a single layout run. The
+				// timer is reset on each new snapshot patch and cleared on teardown.
+				// Guard: only run when at least one visible (non-fogged) node exists.
+				if (autoArrangeTimer !== null) clearTimeout(autoArrangeTimer);
+				autoArrangeTimer = setTimeout(() => {
+					autoArrangeTimer = null;
+					if (!cy) return;
+					const visibleNodes = cy.nodes().filter((n) => !n.hasClass("fogged"));
+					if (visibleNodes.length === 0) return;
+					runLayout("fcose");
+				}, 450);
 			}
 			const result = applyCommands(cy, value.operations);
 			lastAppliedPatchId = value.patch_id;
-			// C1: briefly spotlight the nodes this turn touched (not on a load
-			// snapshot, where everything is "new" and a spotlight is meaningless).
+			updatePendingCount(); // refresh the review-queue badge after every patch
+			// C1+C3: post-turn dim-burst — glow what the agent just touched and
+			// briefly fade the rest, so "what changed" is unmistakable. Not on a
+			// load snapshot, where everything is "new" and a burst is meaningless.
 			if (!value.is_snapshot) {
-				spotlightTurnNodes(cy, value.operations);
+				const turnIds = collectTurnNodeIds(value.operations);
+				dimBurst(cy, turnIds);
+				// Track the set for Task 4 partial layout ("Settle new" button).
+				lastTurnNodeIds = new Set(turnIds);
 			}
 			// FE-01: per-op failures are non-fatal — the rest of the patch still
 			// applied. Surface a dismissible toast and notify the host.
@@ -285,10 +519,50 @@
 	{/if}
 
 	<div class="lc-canvas-wrapper">
-		<!-- T3-03: Zoom-to-fit toolbar button; pure view operation, no backend call -->
-		<button class="lc-fit-btn" type="button" aria-label="Zoom to fit all nodes" onclick={() => fitGraph()}>
-			⊡ Fit
-		</button>
+		<!-- Pure view operations; no backend call. Arrange = fcose auto-layout;
+		     the select switches force/concentric/grid/tree; the zoom buttons zoom
+		     around the viewport center; Fit fits all nodes. -->
+		<div class="lc-canvas-toolbar">
+			<button class="lc-fit-btn" type="button" aria-label="Auto-arrange the graph layout" onclick={() => runLayout("fcose")}>
+				✦ Arrange
+			</button>
+			<button class="lc-fit-btn" type="button" aria-label="Settle newly-added nodes while pinning existing ones" onclick={() => settleNewNodes()}>
+				⊕ Settle new
+			</button>
+			<select
+				class="lc-fit-btn lc-layout-select"
+				aria-label="Choose graph layout algorithm"
+				onchange={(e) => runLayout(e.currentTarget.value as LayoutName)}
+			>
+				<option value="fcose">Force</option>
+				<option value="concentric">Concentric</option>
+				<option value="grid">Grid</option>
+				<option value="breadthfirst">Tree</option>
+			</select>
+			<button class="lc-fit-btn lc-zoom-btn" type="button" aria-label="Zoom in" onclick={() => zoomBy(1.2)}>
+				＋
+			</button>
+			<button class="lc-fit-btn lc-zoom-btn" type="button" aria-label="Zoom out" onclick={() => zoomBy(0.8)}>
+				－
+			</button>
+			<button class="lc-fit-btn" type="button" aria-label="Zoom to fit all nodes" onclick={() => fitGraph()}>
+				⊡ Fit
+			</button>
+		</div>
+		<!-- Review-queue badge: frames review as the act that makes knowledge real.
+		     Counts down as proposals are accepted/rejected; press j/k to cycle them. -->
+		<div
+			class="lc-review-badge"
+			class:lc-review-clear={pendingCount === 0}
+			aria-live="polite"
+			title="Model proposals awaiting your review — press j/k to cycle them"
+		>
+			{#if pendingCount > 0}
+				⬡ {pendingCount} awaiting review
+			{:else}
+				✓ all reviewed
+			{/if}
+		</div>
 		<div bind:this={container} class="lc-cytoscape-canvas"></div>
 	</div>
 
@@ -313,11 +587,15 @@
 	.lc-canvas-wrapper {
 		position: relative;
 	}
-	.lc-fit-btn {
+	.lc-canvas-toolbar {
 		position: absolute;
 		top: 8px;
 		right: 8px;
 		z-index: 10;
+		display: flex;
+		gap: 6px;
+	}
+	.lc-fit-btn {
 		padding: 4px 8px;
 		background: rgba(17, 19, 26, 0.85);
 		color: #cbd5e0;
@@ -329,6 +607,42 @@
 	.lc-fit-btn:hover {
 		background: #2d3748;
 	}
+	/* Dark pill <select> matching the buttons. Fixed sizing only (never vh). */
+	.lc-layout-select {
+		appearance: none;
+		-webkit-appearance: none;
+		height: 26px;
+		padding-right: 18px;
+	}
+	.lc-layout-select option {
+		background: #11131a;
+		color: #cbd5e0;
+	}
+	/* Square zoom pills with a slightly larger, centered glyph. */
+	.lc-zoom-btn {
+		width: 28px;
+		text-align: center;
+		font-size: 14px;
+		line-height: 1;
+	}
+	.lc-review-badge {
+		position: absolute;
+		top: 8px;
+		left: 8px;
+		z-index: 10;
+		padding: 4px 10px;
+		background: rgba(17, 19, 26, 0.85);
+		color: #f59e0b;
+		border: 1px solid #f59e0b;
+		border-radius: 999px;
+		font-size: 12px;
+		font-weight: 600;
+		pointer-events: none;
+	}
+	.lc-review-clear {
+		color: #34d399;
+		border-color: #34d399;
+	}
 	.lc-cytoscape-canvas {
 		width: 100%;
 		/* CRITICAL: fixed px height, NEVER vh. The app is embedded in an HF Spaces

cytoscapecanvas/frontend/renderer.test.ts

@@ -9,16 +9,20 @@
 // which still throws and rejects the whole patch.
 
 import { describe, it, expect, vi } from "vitest";
-import type { Core, NodeSingular } from "cytoscape";
+import type { Core, NodeSingular, EdgeSingular } from "cytoscape";
 
 import {
   applyCommands,
   collectTurnNodeIds,
   MAX_PATCH_OPS,
   cytoscapeStyle,
+  startReviewPulse,
+  stopReviewPulse,
   wireCxtMenu,
+  wireEdgeHover,
   wireSelectionEvents,
   promptRename,
+  promptEdgeLabel,
 } from "./renderer";
 import type { CxtMenuCommand, CxtMenuOptions, CxtMenuDispatch } from "./renderer";
 import type { RendererCommand } from "./types";
@@ -324,6 +328,107 @@ describe("cytoscapeStyle — node shape encoding (node-shape-encoding)", () => {
   });
 });
 
+describe("cytoscapeStyle — awaiting-review affordance (review-pending lynchpin)", () => {
+  // Regression: the awaiting-review signal was an 18% Cytoscape pie rendered
+  // dead-centre UNDER the centred node label — invisible. The fix is an amber
+  // dashed border (+ a pulse-peak step driven by startReviewPulse).
+  it("uses an amber dashed border, not a centred pie", () => {
+    const rule = ruleFor(".review-pending.origin-model-inferred");
+    expect(rule, "missing .review-pending.origin-model-inferred rule").toBeDefined();
+    expect(rule!.style["border-color"]).toBe("#f59e0b");
+    expect(rule!.style["border-style"]).toBe("dashed");
+    expect(Number(rule!.style["border-width"])).toBeGreaterThanOrEqual(4);
+    // The invisible pie must be gone.
+    expect(rule!.style["pie-size"]).toBeUndefined();
+    // The pulse is a class toggle smoothed by a border transition.
+    expect(String(rule!.style["transition-property"])).toContain("border");
+  });
+
+  it("defines a brighter, thicker pulse-peak step", () => {
+    const base = ruleFor(".review-pending.origin-model-inferred");
+    const peak = ruleFor(".review-pending.origin-model-inferred.pulse-peak");
+    expect(peak, "missing pulse-peak rule").toBeDefined();
+    expect(Number(peak!.style["border-width"])).toBeGreaterThan(Number(base!.style["border-width"]));
+  });
+});
+
+describe("startReviewPulse / stopReviewPulse (awaiting-review breathing)", () => {
+  function makePulseCy(pendingLength = 1) {
+    const classesOnPending = new Set<string>();
+    let len = pendingLength;
+    const scratchStore = new Map<string, unknown>();
+    const collection = {
+      get length() {
+        return len;
+      },
+      addClass: (c: string) => {
+        classesOnPending.add(c);
+      },
+      removeClass: (c: string) => {
+        classesOnPending.delete(c);
+      },
+    };
+    const cy = {
+      // Mirrors Cytoscape's overloaded scratch(ns) read / scratch(ns, val) write.
+      scratch: (ns: string, val?: unknown) => {
+        if (val !== undefined) {
+          scratchStore.set(ns, val);
+          return undefined;
+        }
+        return scratchStore.get(ns);
+      },
+      $: () => collection,
+    } as unknown as Core;
+    return { cy, classesOnPending, setPendingLength: (n: number) => (len = n) };
+  }
+
+  it("toggles .pulse-peak on pending nodes over time and is idempotent", () => {
+    vi.useFakeTimers();
+    try {
+      const s = makePulseCy(2);
+      startReviewPulse(s.cy, 800);
+      startReviewPulse(s.cy, 800); // 2nd call must NOT start a second timer
+      expect(s.classesOnPending.has("pulse-peak")).toBe(false);
+      vi.advanceTimersByTime(800);
+      expect(s.classesOnPending.has("pulse-peak")).toBe(true); // peak
+      vi.advanceTimersByTime(800);
+      expect(s.classesOnPending.has("pulse-peak")).toBe(false); // trough
+      stopReviewPulse(s.cy);
+      vi.advanceTimersByTime(2400);
+      expect(s.classesOnPending.has("pulse-peak")).toBe(false); // no toggles after stop
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it("is a quiet no-op tick when nothing is awaiting review", () => {
+    vi.useFakeTimers();
+    try {
+      const s = makePulseCy(0);
+      startReviewPulse(s.cy, 800);
+      vi.advanceTimersByTime(1600);
+      expect(s.classesOnPending.has("pulse-peak")).toBe(false);
+      stopReviewPulse(s.cy);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+});
+
+describe("cytoscapeStyle — delight affordances (hover-fade + dim-burst)", () => {
+  it("defines hover-fade and burst-dim as strong fade opacities", () => {
+    expect(Number(ruleFor(".hover-faded")!.style.opacity)).toBeLessThan(0.2);
+    expect(Number(ruleFor(".burst-dim")!.style.opacity)).toBeLessThan(0.2);
+  });
+
+  it("burst-glow uses a visible overlay halo (the 'what just changed' glow)", () => {
+    const glow = ruleFor(".burst-glow");
+    expect(glow, "missing .burst-glow rule").toBeDefined();
+    expect(glow!.style["overlay-color"]).toBeTruthy();
+    expect(Number(glow!.style["overlay-opacity"])).toBeGreaterThan(0);
+  });
+});
+
 describe("cytoscapeStyle — edge arrow mapping (edge-arrow-style-mapping)", () => {
   it("maps each edge kind to a VALID Cytoscape arrow shape", () => {
     for (const kind of ["implies", "is_a", "part_of", "contains", "related_to", "relates_to", "contradicts"]) {
@@ -361,6 +466,7 @@ interface OnCall {
 interface CxtScratch {
   suppressSelect: boolean;
   pendingDeleteEdgeId: string | null;
+  pendingDeleteNodeId: string | null;
 }
 
 interface CxtCyStub {
@@ -372,6 +478,8 @@ interface CxtCyStub {
   getScratch: () => CxtScratch | undefined;
   getFitCalls: () => number;
   getDimCleared: () => number;
+  /** Classes added/removed via getElementById(...).addClass/removeClass (pending-delete arming). */
+  getElClasses: () => Set<string>;
 }
 
 function makeCxtCy(): CxtCyStub {
@@ -389,9 +497,16 @@ function makeCxtCy(): CxtCyStub {
     },
     length: 0,
   };
+  const elClasses = new Set<string>();
   const elHandle = {
-    addClass: () => elHandle,
-    removeClass: () => elHandle,
+    addClass: (c: string) => {
+      elClasses.add(c);
+      return elHandle;
+    },
+    removeClass: (c: string) => {
+      elClasses.delete(c);
+      return elHandle;
+    },
     length: 1,
   };
   const cyObj = {
@@ -431,6 +546,7 @@ function makeCxtCy(): CxtCyStub {
     getScratch: () => scratchStore,
     getFitCalls: () => fitCalls,
     getDimCleared: () => dimCleared,
+    getElClasses: () => elClasses,
   };
 }
 
@@ -584,6 +700,88 @@ describe("wireCxtMenu — Focus + Rename commands (C2)", () => {
   });
 });
 
+describe("wireCxtMenu — node editing commands (Summary + Delete arm/confirm)", () => {
+  it("a normal (non-armed) node menu includes Summary and Delete commands", () => {
+    const { cy, getCxtOptions } = makeCxtCy();
+    wireCxtMenu(cy, () => {});
+    const cmds = getCxtOptions()!.commands(nodeStub({ id: "n1" }));
+    const contents = cmds.map((c) => c.content.toLowerCase());
+    expect(
+      contents.some((t) => /summary/i.test(t)),
+      "no Summary command"
+    ).toBe(true);
+    expect(
+      contents.some((t) => /delete/i.test(t)),
+      "no Delete command"
+    ).toBe(true);
+  });
+
+  it("selecting Delete ARMS the node (sets pendingDeleteNodeId + adds pending-delete class), no dispatch", () => {
+    const { cy, getCxtOptions, getScratch, getElClasses } = makeCxtCy();
+    const dispatched: Parameters<CxtMenuDispatch>[0][] = [];
+    wireCxtMenu(cy, (p) => dispatched.push(p));
+    const del = getCxtOptions()!
+      .commands(nodeStub({ id: "n3" }))
+      .find((c) => /delete/i.test(c.content))!;
+    del.select(nodeStub({ id: "n3" }));
+    expect(getScratch()!.pendingDeleteNodeId).toBe("n3");
+    expect(getElClasses().has("pending-delete")).toBe(true);
+    expect(dispatched).toHaveLength(0); // armed only — not deleted
+  });
+
+  it("when armed (pendingDeleteNodeId === id) returns exactly Confirm + Cancel; Confirm dispatches delete_node", () => {
+    const { cy, getCxtOptions, getScratch } = makeCxtCy();
+    const dispatched: Parameters<CxtMenuDispatch>[0][] = [];
+    wireCxtMenu(cy, (p) => dispatched.push(p));
+    const opts = getCxtOptions()!;
+    opts
+      .commands(nodeStub({ id: "n3" }))
+      .find((c) => /delete/i.test(c.content))!
+      .select(nodeStub({ id: "n3" })); // arm
+    const armed = opts.commands(nodeStub({ id: "n3" })); // second right-click on the same node
+    expect(armed).toHaveLength(2);
+    const contents = armed.map((c) => c.content.toLowerCase());
+    expect(contents.some((t) => t.includes("confirm"))).toBe(true);
+    expect(contents.some((t) => t.includes("cancel"))).toBe(true);
+    const confirm = armed.find((c) => c.content.toLowerCase().includes("confirm"))!;
+    confirm.select(nodeStub({ id: "n3" }));
+    expect(dispatched[0].value).toMatchObject({ kind: "delete_node", id: "n3" });
+    expect(getScratch()!.pendingDeleteNodeId).toBeNull(); // cleared after confirm
+  });
+
+  it("when armed, Cancel clears the armed state without dispatching", () => {
+    const { cy, getCxtOptions, getScratch } = makeCxtCy();
+    const dispatched: Parameters<CxtMenuDispatch>[0][] = [];
+    wireCxtMenu(cy, (p) => dispatched.push(p));
+    const opts = getCxtOptions()!;
+    opts
+      .commands(nodeStub({ id: "n3" }))
+      .find((c) => /delete/i.test(c.content))!
+      .select(nodeStub({ id: "n3" })); // arm
+    const cancel = opts.commands(nodeStub({ id: "n3" })).find((c) => c.content.toLowerCase().includes("cancel"))!;
+    cancel.select(nodeStub({ id: "n3" }));
+    expect(getScratch()!.pendingDeleteNodeId).toBeNull();
+    expect(dispatched).toHaveLength(0);
+  });
+
+  it("the Summary command opens an inline input and dispatches kind:'edit_summary' on Enter", () => {
+    const { cy, getCxtOptions } = makeCxtCy();
+    const dispatched: Parameters<CxtMenuDispatch>[0][] = [];
+    wireCxtMenu(cy, (p) => dispatched.push(p));
+    const summary = getCxtOptions()!
+      .commands(nodeStub({ id: "n5" }))
+      .find((c) => /summary/i.test(c.content))!;
+    summary.select(nodeStub({ id: "n5" }));
+    const input = document.querySelector("input");
+    expect(input, "Summary did not open an inline input").not.toBeNull();
+    input!.value = "A new summary";
+    input!.dispatchEvent(new KeyboardEvent("keydown", { key: "Enter" }));
+    const evt = dispatched.find((d) => d.value.kind === "edit_summary");
+    expect(evt, "no edit_summary dispatch").toBeDefined();
+    expect(evt!.value).toMatchObject({ kind: "edit_summary", id: "n5", text: "A new summary" });
+  });
+});
+
 describe("wireCxtMenu — background (core) menu (C5)", () => {
   it("registers a second cxtmenu on the 'core' selector with Fit + Clusters", () => {
     const { cy, getCoreOptions } = makeCxtCy();
@@ -596,6 +794,27 @@ describe("wireCxtMenu — background (core) menu (C5)", () => {
     expect(contents.some((t) => t.includes("cluster"))).toBe(true);
   });
 
+  it("includes an 'Add node' command that opens a centered input and dispatches kind:'add_node'", () => {
+    const { cy, getCoreOptions } = makeCxtCy();
+    const dispatched: Parameters<CxtMenuDispatch>[0][] = [];
+    wireCxtMenu(cy, (p) => dispatched.push(p));
+    const core = getCoreOptions()!;
+    const contents = core.commands(nodeStub()).map((c) => c.content.toLowerCase());
+    expect(
+      contents.some((t) => /add node/i.test(t)),
+      "no Add node command"
+    ).toBe(true);
+    const addNode = core.commands(nodeStub()).find((c) => /add node/i.test(c.content))!;
+    addNode.select(nodeStub());
+    const input = document.querySelector("input");
+    expect(input, "Add node did not open an inline input").not.toBeNull();
+    input!.value = "Fresh Node";
+    input!.dispatchEvent(new KeyboardEvent("keydown", { key: "Enter" }));
+    const evt = dispatched.find((d) => d.value.kind === "add_node");
+    expect(evt, "no add_node dispatch").toBeDefined();
+    expect(evt!.value).toMatchObject({ kind: "add_node", label: "Fresh Node" });
+  });
+
   it("Fit resizes, clears the Focus dim, and fits", () => {
     const { cy, getCoreOptions, getFitCalls, getDimCleared } = makeCxtCy();
     wireCxtMenu(cy, () => {});
@@ -636,9 +855,11 @@ describe("wireCxtMenu — edge menu, two-step delete confirm (C5b)", () => {
     expect(edgeOpts, "no edge menu registered").not.toBeNull();
     expect(edgeOpts!.selector).toBe("edge");
     const cmds = edgeOpts!.commands(edgeStub("e1"));
-    expect(cmds).toHaveLength(1);
-    expect(cmds[0].content.toLowerCase()).toContain("delete");
-    cmds[0].select(edgeStub("e1"));
+    // expanded to Accept + Reject + Edit label + Delete (4 commands now)
+    expect(cmds.length).toBeGreaterThanOrEqual(4);
+    const delCmd = cmds.find((c) => /delete/i.test(c.content));
+    expect(delCmd, "no Delete command in edge menu").toBeDefined();
+    delCmd!.select(edgeStub("e1"));
     expect(getScratch()!.pendingDeleteEdgeId).toBe("e1"); // armed
     expect(dispatched).toHaveLength(0); // but NOT deleted
   });
@@ -648,7 +869,9 @@ describe("wireCxtMenu — edge menu, two-step delete confirm (C5b)", () => {
     const dispatched: Parameters<CxtMenuDispatch>[0][] = [];
     wireCxtMenu(cy, (p) => dispatched.push(p));
     const edgeOpts = getEdgeOptions()!;
-    edgeOpts.commands(edgeStub("e1"))[0].select(edgeStub("e1")); // arm
+    // Arm via the Delete command (find it by content, not by index)
+    const armCmd = edgeOpts.commands(edgeStub("e1")).find((c) => /delete/i.test(c.content))!;
+    armCmd.select(edgeStub("e1")); // arm
     const armed = edgeOpts.commands(edgeStub("e1")); // second right-click on the same edge
     const contents = armed.map((c) => c.content.toLowerCase());
     expect(contents.some((t) => t.includes("confirm"))).toBe(true);
@@ -665,7 +888,9 @@ describe("wireCxtMenu — edge menu, two-step delete confirm (C5b)", () => {
     const dispatched: Parameters<CxtMenuDispatch>[0][] = [];
     wireCxtMenu(cy, (p) => dispatched.push(p));
     const edgeOpts = getEdgeOptions()!;
-    edgeOpts.commands(edgeStub("e1"))[0].select(edgeStub("e1")); // arm
+    // Arm via the Delete command (find it by content, not by index)
+    const armCmd = edgeOpts.commands(edgeStub("e1")).find((c) => /delete/i.test(c.content))!;
+    armCmd.select(edgeStub("e1")); // arm
     const cancel = edgeOpts.commands(edgeStub("e1")).find((c) => c.content.toLowerCase().includes("cancel"))!;
     cancel.select(edgeStub("e1"));
     expect(getScratch()!.pendingDeleteEdgeId).toBeNull();
@@ -774,3 +999,181 @@ describe("collectTurnNodeIds", () => {
     expect(collectTurnNodeIds(ops)).toEqual([]);
   });
 });
+
+// ── node.pending-delete style (armed-node "right-click again to confirm") ─────
+
+describe("cytoscapeStyle — node.pending-delete (armed delete affordance)", () => {
+  it("mirrors the edge armed-delete style: red dashed border", () => {
+    const rule = ruleFor("node.pending-delete");
+    expect(rule, "missing node.pending-delete rule").toBeDefined();
+    // Red (LC_EDGE_CONTRADICTS) so it reads as the same "armed for deletion" language.
+    expect(rule!.style["border-color"]).toBe("#ef4444");
+    expect(rule!.style["border-style"]).toBe("dashed");
+    expect(Number(rule!.style["border-width"])).toBeGreaterThanOrEqual(3);
+  });
+});
+
+// ── wireEdgeHover (edge hover-emphasis) ───────────────────────────────────────
+
+describe("wireEdgeHover (edge hover emphasis)", () => {
+  it("binds mouseover/mouseout on edges that toggle the edge-hover class", () => {
+    const onCalls: OnCall[] = [];
+    const added: string[] = [];
+    const removed: string[] = [];
+    const edgeTarget = {
+      addClass: (c: string) => added.push(c),
+      removeClass: (c: string) => removed.push(c),
+    };
+    const cy = {
+      on(events: string, a?: unknown, b?: unknown) {
+        if (typeof a === "function") onCalls.push({ events, handler: a as (...args: unknown[]) => void });
+        else onCalls.push({ events, selector: a as string, handler: b as (...args: unknown[]) => void });
+      },
+    } as unknown as Core;
+    wireEdgeHover(cy);
+    const over = onCalls.find((c) => c.events.includes("mouseover") && c.selector === "edge");
+    const out = onCalls.find((c) => c.events.includes("mouseout") && c.selector === "edge");
+    expect(over, "no mouseover edge handler").toBeDefined();
+    expect(out, "no mouseout edge handler").toBeDefined();
+    over!.handler({ target: edgeTarget });
+    expect(added).toContain("edge-hover");
+    out!.handler({ target: edgeTarget });
+    expect(removed).toContain("edge-hover");
+  });
+
+  it("defines a brighter/thicker .edge-hover style rule", () => {
+    // Accept either ".edge-hover" or "edge.edge-hover" selector form.
+    const rule = ruleFor("edge.edge-hover") ?? ruleFor(".edge-hover");
+    expect(rule, "missing edge-hover style rule").toBeDefined();
+    expect(Number(rule!.style.width)).toBeGreaterThanOrEqual(4);
+    expect(rule!.style["line-color"], "edge-hover should brighten the line").toBeTruthy();
+  });
+});
+
+// ── Task 5: edge-menu expanded commands + promptEdgeLabel (Task 2/3/5) ─────────
+//
+// These tests cover the NEW edge-menu Accept/Reject/Edit-label commands and the
+// promptEdgeLabel helper. They share the makeCxtCy + edgeStub infrastructure above.
+
+describe("wireCxtMenu — edge menu expanded: Accept / Reject / Edit-label (Task 2/5)", () => {
+  function edgeStubFull(id = "e1", fogged = false): NodeSingular {
+    return {
+      id: () => id,
+      isNode: () => false,
+      hasClass: (c: string) => (c === "fogged" ? fogged : false),
+      data: (k: string) => (k === "label" ? "existing label" : undefined),
+      renderedMidpoint: () => ({ x: 200, y: 150 }),
+    } as unknown as NodeSingular;
+  }
+
+  it("(1) Accept dispatches {kind:'review_edge', id, action:'accepted'}", () => {
+    const { cy, getEdgeOptions } = makeCxtCy();
+    const dispatched: Parameters<CxtMenuDispatch>[0][] = [];
+    wireCxtMenu(cy, (p) => dispatched.push(p));
+    const cmds = getEdgeOptions()!.commands(edgeStubFull("e2"));
+    const accept = cmds.find((c) => /accept/i.test(c.content));
+    expect(accept, "no Accept command on edge menu").toBeDefined();
+    accept!.select(edgeStubFull("e2"));
+    expect(dispatched).toHaveLength(1);
+    expect(dispatched[0].value).toMatchObject({ kind: "review_edge", id: "e2", action: "accepted" });
+  });
+
+  it("(2) Reject dispatches {kind:'review_edge', id, action:'rejected'}", () => {
+    const { cy, getEdgeOptions } = makeCxtCy();
+    const dispatched: Parameters<CxtMenuDispatch>[0][] = [];
+    wireCxtMenu(cy, (p) => dispatched.push(p));
+    const cmds = getEdgeOptions()!.commands(edgeStubFull("e3"));
+    const reject = cmds.find((c) => /reject/i.test(c.content));
+    expect(reject, "no Reject command on edge menu").toBeDefined();
+    reject!.select(edgeStubFull("e3"));
+    expect(dispatched[0].value).toMatchObject({ kind: "review_edge", id: "e3", action: "rejected" });
+  });
+
+  it("(3) a fogged edge yields no actionable menu (empty [])", () => {
+    const { cy, getEdgeOptions } = makeCxtCy();
+    wireCxtMenu(cy, () => {});
+    const cmds = getEdgeOptions()!.commands(edgeStubFull("e4", true));
+    expect(cmds).toEqual([]);
+  });
+
+  it("(4) Edit-label opens an inline input and dispatches {kind:'relabel_edge', id, label} on Enter", () => {
+    const { cy, getEdgeOptions } = makeCxtCy();
+    const dispatched: Parameters<CxtMenuDispatch>[0][] = [];
+    wireCxtMenu(cy, (p) => dispatched.push(p));
+    const cmds = getEdgeOptions()!.commands(edgeStubFull("e5"));
+    const editLabel = cmds.find(
+      (c) => /edit.?label/i.test(c.content) || /relabel/i.test(c.content) || /label/i.test(c.content)
+    );
+    expect(editLabel, "no Edit-label command on edge menu").toBeDefined();
+    editLabel!.select(edgeStubFull("e5"));
+    const input = document.querySelector("input");
+    expect(input, "Edit-label did not open an inline input").not.toBeNull();
+    input!.value = "New Edge Label";
+    input!.dispatchEvent(new KeyboardEvent("keydown", { key: "Enter" }));
+    const evt = dispatched.find((d) => d.value.kind === "relabel_edge");
+    expect(evt, "no relabel_edge dispatch").toBeDefined();
+    expect(evt!.value).toMatchObject({ kind: "relabel_edge", id: "e5", label: "New Edge Label" });
+  });
+
+  it("(5) a non-fogged edge menu exposes >= 4 commands (Accept, Reject, Edit label, Delete)", () => {
+    const { cy, getEdgeOptions } = makeCxtCy();
+    wireCxtMenu(cy, () => {});
+    const cmds = getEdgeOptions()!.commands(edgeStubFull("e6"));
+    expect(cmds.length).toBeGreaterThanOrEqual(4);
+    const contents = cmds.map((c) => c.content.toLowerCase());
+    expect(
+      contents.some((t) => /accept/i.test(t)),
+      "missing Accept"
+    ).toBe(true);
+    expect(
+      contents.some((t) => /reject/i.test(t)),
+      "missing Reject"
+    ).toBe(true);
+    expect(
+      contents.some((t) => /delete/i.test(t)),
+      "missing Delete"
+    ).toBe(true);
+  });
+});
+
+describe("promptEdgeLabel (inline label input for edges, Task 3)", () => {
+  function edgeStubForPrompt(id = "e1", label = "current label"): EdgeSingular {
+    return {
+      id: () => id,
+      data: (k: string) => (k === "label" ? label : undefined),
+      renderedMidpoint: () => ({ x: 200, y: 150 }),
+    } as unknown as EdgeSingular;
+  }
+
+  it("opens an inline input pre-filled with the edge's current label and commits on Enter", () => {
+    const container = document.createElement("div");
+    document.body.appendChild(container);
+    const cy = { container: () => container } as unknown as Core;
+    let committed: string | null = null;
+    promptEdgeLabel(cy, edgeStubForPrompt("e1", "old label"), (label) => {
+      committed = label;
+    });
+    const input = document.querySelector("input");
+    expect(input, "no input opened").not.toBeNull();
+    expect(input!.value).toBe("old label");
+    input!.value = "new label";
+    input!.dispatchEvent(new KeyboardEvent("keydown", { key: "Enter" }));
+    expect(committed).toBe("new label");
+    expect(document.querySelector("input"), "input not removed after commit").toBeNull();
+  });
+
+  it("cancels on Escape without committing", () => {
+    const container = document.createElement("div");
+    document.body.appendChild(container);
+    const cy = { container: () => container } as unknown as Core;
+    let committed: string | null = null;
+    promptEdgeLabel(cy, edgeStubForPrompt("e1", "old"), (label) => {
+      committed = label;
+    });
+    const input = document.querySelector("input")!;
+    input.value = "whatever";
+    input.dispatchEvent(new KeyboardEvent("keydown", { key: "Escape" }));
+    expect(committed).toBeNull();
+    expect(document.querySelector("input")).toBeNull();
+  });
+});

cytoscapecanvas/frontend/renderer.ts

@@ -25,6 +25,8 @@ const LC_HIGHLIGHTED = "#ff9800"; // amber orange
 const LC_INFERRED_EDGE = "#9f7aea"; // purple (legible on dark, less garish than #a0a)
 const LC_EDGE_CONTRADICTS = "#ef4444"; // red — "contradicts" relations (high-signal trust edge)
 const LC_EDGE_SUPPORTS = "#34d399"; // green — "supports" relations (matches user-asserted accent)
+const LC_REVIEW_AMBER = "#f59e0b"; // awaiting-review border (matches the legend swatch in main.py)
+const LC_REVIEW_AMBER_BRIGHT = "#fbbf24"; // pulse peak — brighter amber so the border "breathes"
 
 // Fixed cluster-colour hue pool (cluster-louvain-colors). One hue per `cluster-N`
 // class emitted by the backend (renderer_adapter cluster deltas). Deliberately
@@ -66,6 +68,12 @@ interface RendererScratch {
   connectSource: string | null;
   /** Edge id armed for deletion (radial menu first step); null = none pending. */
   pendingDeleteEdgeId: string | null;
+  /** Node id armed for deletion (radial menu first step); null = none pending. */
+  pendingDeleteNodeId: string | null;
+  /** Interval id driving the awaiting-review border pulse; null when stopped. */
+  reviewPulseTimer: ReturnType<typeof setInterval> | null;
+  /** Current phase of the review pulse (true = peak/bright, false = trough). */
+  reviewPulsePeak: boolean;
 }
 
 const SCRATCH_NS = "_lc";
@@ -81,6 +89,9 @@ function getScratch(cy: Core): RendererScratch {
       connectMode: false,
       connectSource: null,
       pendingDeleteEdgeId: null,
+      pendingDeleteNodeId: null,
+      reviewPulseTimer: null,
+      reviewPulsePeak: false,
     };
     cy.scratch(SCRATCH_NS, state);
   }
@@ -248,6 +259,30 @@ export const cytoscapeStyle: StylesheetJson = [
       opacity: 0.4,
     },
   },
+  // Hover-fade: while hovering a node, everything outside its closed neighbourhood
+  // fades so the local structure pops (the drop-in users expect from Obsidian/Kumu).
+  {
+    selector: ".hover-faded",
+    style: {
+      opacity: 0.12,
+    },
+  },
+  // Post-turn dim-burst: briefly fade the rest of the graph (burst-dim) and glow
+  // what the agent just added (burst-glow) so "what just changed" is unmistakable.
+  {
+    selector: ".burst-dim",
+    style: {
+      opacity: 0.12,
+    },
+  },
+  {
+    selector: ".burst-glow",
+    style: {
+      "overlay-color": LC_SELECTED,
+      "overlay-opacity": 0.3,
+      "overlay-padding": 8,
+    },
+  },
   // T3-03: keyboard focus ring — distinct outset border, composes with .selected/.highlighted.
   {
     selector: ".focus-ring",
@@ -276,6 +311,29 @@ export const cytoscapeStyle: StylesheetJson = [
       "line-style": "dashed",
     },
   },
+  // Node armed for deletion (radial "Delete node" first step) — mirrors the edge
+  // armed treatment: a red (LC_EDGE_CONTRADICTS) dashed border so the node reads as
+  // "right-click again to confirm". Cleared by the Confirm/Cancel follow-up menu.
+  {
+    selector: "node.pending-delete",
+    style: {
+      "border-color": LC_EDGE_CONTRADICTS,
+      "border-style": "dashed",
+      "border-width": 4,
+    },
+  },
+  // Edge hover-emphasis (wireEdgeHover): brighten + thicken the hovered edge so it
+  // pops from the slate background. Class toggle only — cheap and reversible.
+  {
+    selector: "edge.edge-hover",
+    style: {
+      width: 4,
+      "line-color": LC_HIGHLIGHTED,
+      "target-arrow-color": LC_HIGHLIGHTED,
+      opacity: 1,
+      "z-index": 10,
+    },
+  },
   // ── Trust origin → shape + border style (node-shape-encoding) ─────────────
   // Shape reinforces the border-style origin signal (redundant encoding aids
   // colour-blind / low-contrast reading). Shapes are convex with a large interior
@@ -304,7 +362,10 @@ export const cytoscapeStyle: StylesheetJson = [
       shape: "hexagon",
       "border-style": "dashed",
       "border-color": LC_NODE_BORDER,
-      opacity: 0.92,
+      // NB: no base opacity here. A static opacity:0.92 here is a LATER stylesheet
+      // rule than .dimmed/.hover-faded/.burst-dim (opacity 0.12/0.4) and would WIN,
+      // making hover-fade + dim-burst invisible on model_inferred nodes (the whole
+      // seed). The hexagon + dashed amber border already distinguish inferred nodes.
     },
   },
   // ── Cluster colours (cluster-louvain-colors) — placed BEFORE trust support so
@@ -318,13 +379,54 @@ export const cytoscapeStyle: StylesheetJson = [
       "background-color": "#7c3aed",
     },
   },
-  // ── Pending review dot — only for model_inferred + pending ───────────────
+  // ── Awaiting review — amber dashed border + gentle pulse (model_inferred) ──
+  // Replaces a prior 18% Cytoscape pie that rendered DEAD-CENTRE under the
+  // centred node label → invisible. An amber border overrides the indigo dashed
+  // origin border (above) so an awaiting-review proposal is unmistakable; the
+  // `transition-*` props smooth the `.pulse-peak` toggle (driven by
+  // startReviewPulse) into a breathing pulse. Pies can't be corner badges in
+  // Cytoscape (always centred), so a border treatment is the correct affordance.
   {
     selector: ".review-pending.origin-model-inferred",
     style: {
-      "pie-size": "18%",
-      "pie-1-background-color": "#f59e0b",
-      "pie-1-background-size": 100,
+      "border-color": LC_REVIEW_AMBER,
+      "border-width": 4,
+      "border-style": "dashed",
+      "transition-property": "border-width, border-color",
+      // Numeric time = milliseconds (Cytoscape `time` type implicitUnits:'ms') — 650ms.
+      "transition-duration": 650,
+      "transition-timing-function": "ease-in-out",
+    },
+  },
+  // Pulse peak — startReviewPulse toggles this class ~every 800ms; the transition
+  // on the rule above smooths the border-width/colour step so it "breathes".
+  {
+    selector: ".review-pending.origin-model-inferred.pulse-peak",
+    style: {
+      "border-width": 7,
+      "border-color": LC_REVIEW_AMBER_BRIGHT,
+    },
+  },
+  // Awaiting-review on EDGES (e.g. a freshly-proposed "hidden connection"). Border
+  // props are no-ops on edges, so the amber awaiting-review signal becomes an amber
+  // dashed LINE — the edge equivalent of the node's amber border. Same trust language.
+  {
+    selector: "edge.review-pending.origin-model-inferred",
+    style: {
+      "line-color": LC_REVIEW_AMBER,
+      "line-style": "dashed",
+      "target-arrow-color": LC_REVIEW_AMBER,
+      width: 3,
+      "transition-property": "width, line-color",
+      "transition-duration": 650,
+    },
+  },
+  {
+    selector: "edge.review-pending.origin-model-inferred.pulse-peak",
+    style: {
+      width: 5,
+      "line-color": LC_REVIEW_AMBER_BRIGHT,
+      "target-arrow-color": LC_REVIEW_AMBER_BRIGHT,
     },
   },
 ];
@@ -423,6 +525,44 @@ export function spotlightTurnNodes(cy: Core, commands: RendererCommand[], durati
   }
 }
 
+/**
+ * Start the "awaiting review" border pulse. Every `periodMs`, toggle `.pulse-peak`
+ * on all model-inferred review-pending nodes so the amber border breathes (the
+ * stylesheet `transition-*` on `.review-pending.origin-model-inferred` smooths the
+ * step into a gentle pulse). This is the spatial cue that a proposal needs the
+ * user's decision — the prior centred pie was invisible under the node label.
+ *
+ * Idempotent: a second call is a no-op while a timer is live. The timer lives for
+ * the `cy` lifetime; the host MUST call {@link stopReviewPulse} before
+ * `cy.destroy()` so the interval never touches a destroyed core.
+ */
+export function startReviewPulse(cy: Core, periodMs = 800): void {
+  const state = getScratch(cy);
+  if (state.reviewPulseTimer != null) return;
+  state.reviewPulseTimer = setInterval(() => {
+    const pending = cy.$(".review-pending.origin-model-inferred");
+    if (pending.length === 0) {
+      // Nothing awaiting review — keep the phase at trough so a freshly-added
+      // pending node starts calm rather than mid-flash.
+      state.reviewPulsePeak = false;
+      return;
+    }
+    state.reviewPulsePeak = !state.reviewPulsePeak;
+    if (state.reviewPulsePeak) pending.addClass("pulse-peak");
+    else pending.removeClass("pulse-peak");
+  }, periodMs);
+}
+
+/** Stop the review pulse and clear its interval. Safe to call when not running. */
+export function stopReviewPulse(cy: Core): void {
+  const state = getScratch(cy);
+  if (state.reviewPulseTimer != null) {
+    clearInterval(state.reviewPulseTimer);
+    state.reviewPulseTimer = null;
+    state.reviewPulsePeak = false;
+  }
+}
+
 /**
  * Full reset: remove all elements, tear down callout overlays, and clear
  * transient state. Called only on `is_snapshot: true` (load / reconnect).
@@ -631,6 +771,63 @@ function dimExcept(cy: Core, keepIds: string[]): void {
   });
 }
 
+/**
+ * Post-turn "dim-burst": fade the rest of the graph and glow what the agent just
+ * added/touched for `duration` ms, so the eye lands on the change. The glow + dim
+ * auto-clear, leaving no persistent chrome (calm-canvas safe). Fogged elements are
+ * left untouched (they carry their own opacity — re-dimming/restoring them would
+ * invert it). A no-op when `ids` resolves to nothing.
+ */
+export function dimBurst(cy: Core, ids: string[], duration = 2200): void {
+  const fresh = cy.collection();
+  for (const id of ids) fresh.merge(cy.getElementById(id));
+  if (fresh.length === 0) return;
+  const keep = fresh.closedNeighborhood();
+  const others = cy.elements().filter((el) => !keep.has(el) && !el.hasClass("fogged"));
+  others.addClass("burst-dim");
+  fresh.addClass("burst-glow");
+  setTimeout(() => {
+    others.removeClass("burst-dim");
+    fresh.removeClass("burst-glow");
+  }, duration);
+}
+
+/**
+ * Hover-fade: while the pointer is over a node, fade everything outside that node's
+ * closed neighbourhood (the node + its edges + adjacent nodes) so local structure
+ * pops. Uses its own `.hover-faded` class so it never clobbers search/focus `.dimmed`
+ * state, and clears on mouseout. Fogged nodes don't trigger it (they're not "real"
+ * targets yet). Idempotent-safe: re-wiring would double-bind, so call once per cy.
+ */
+export function wireHoverFade(cy: Core): void {
+  cy.on("mouseover", "node", (evt) => {
+    const node = evt.target as NodeSingular;
+    if (node.hasClass("fogged")) return;
+    const keep = node.closedNeighborhood();
+    cy.elements()
+      .filter((el) => !keep.has(el))
+      .addClass("hover-faded");
+  });
+  cy.on("mouseout", "node", () => {
+    cy.elements().removeClass("hover-faded");
+  });
+}
+
+/**
+ * Edge hover-emphasis: while the pointer is over an edge, add `.edge-hover` so the
+ * stylesheet brightens + thickens it (and bumps its z-index above its neighbours);
+ * remove it on mouseout. Class toggle only — cheap and fully reversible, so it never
+ * mutates graph state. Call once per `cy` (re-wiring would double-bind).
+ */
+export function wireEdgeHover(cy: Core): void {
+  cy.on("mouseover", "edge", (evt) => {
+    (evt.target as EdgeSingular).addClass("edge-hover");
+  });
+  cy.on("mouseout", "edge", (evt) => {
+    (evt.target as EdgeSingular).removeClass("edge-hover");
+  });
+}
+
 function selectElement(cy: Core, id: string | null): void {
   const state = getScratch(cy);
   // Suppress re-dispatch: this selection is backend-driven, not user-driven.
@@ -790,25 +987,37 @@ export function wireTrustTooltip(cy: Core): void {
 
 // ── Rename gesture + connect mode ────────────────────────────────────────────
 
+/** Options for {@link buildInlineInput}: the shared inline-input affordance. */
+interface InlineInputOptions {
+  /** Initial value (plain text; NEVER assigned to innerHTML). */
+  value?: string;
+  /** Placeholder shown when the input is empty. */
+  placeholder?: string;
+  /** Absolute left/top in the parent's coordinate space (px). */
+  left: number;
+  top: number;
+  /** Called with the trimmed value on commit; the caller decides whether to act. */
+  onCommit: (value: string) => void;
+}
+
 /**
- * Show an inline text input over a node to rename it. On Enter or blur it commits
- * the trimmed value via `onCommit` (only when non-empty AND changed); Escape
- * cancels. Extracted from the double-tap gesture so the radial menu's "Rename"
- * command reuses the exact same affordance.
+ * Create an absolutely-positioned inline `<input>` over the cy container's parent.
+ * Enter / blur commit the trimmed value via `onCommit`; Escape cancels. The input
+ * removes itself from the DOM on commit OR cancel. Shared by {@link promptRename},
+ * {@link promptSummary}, and {@link promptNewNode} so all three behave identically.
  *
- * XSS guard: `input.value` is used as plain text — NEVER assigned to innerHTML.
+ * XSS guard: `input.value` is read as plain text — NEVER assigned to innerHTML.
+ * Returns false (and does nothing) when the cy container is absent.
  */
-export function promptRename(cy: Core, node: NodeSingular, onCommit: (label: string) => void): void {
-  const id = node.id();
-  const currentLabel = (node.data("label") as string | undefined) ?? id;
-
+function buildInlineInput(cy: Core, opts: InlineInputOptions): boolean {
   const container = cy.container();
-  if (!container) return;
+  if (!container) return false;
   const parent = container.parentElement ?? container;
 
   const input = document.createElement("input");
   input.type = "text";
-  input.value = currentLabel;
+  input.value = opts.value ?? "";
+  if (opts.placeholder) input.placeholder = opts.placeholder;
   input.style.position = "absolute";
   input.style.zIndex = "2000";
   input.style.background = "#1a1a2e";
@@ -823,9 +1032,8 @@ export function promptRename(cy: Core, node: NodeSingular, onCommit: (label: str
     (parent as HTMLElement).style.position = "relative";
   }
 
-  const pos = node.renderedPosition();
-  input.style.left = `${pos.x - 40}px`;
-  input.style.top = `${pos.y - 12}px`;
+  input.style.left = `${opts.left}px`;
+  input.style.top = `${opts.top}px`;
   parent.appendChild(input);
   input.focus();
   input.select();
@@ -835,11 +1043,9 @@ export function promptRename(cy: Core, node: NodeSingular, onCommit: (label: str
   function commit(): void {
     if (committed) return;
     committed = true;
-    const newLabel = input.value.trim();
+    const value = input.value.trim();
     input.remove();
-    if (newLabel && newLabel !== currentLabel) {
-      onCommit(newLabel);
-    }
+    opts.onCommit(value);
   }
 
   input.addEventListener("keydown", (e) => {
@@ -852,6 +1058,94 @@ export function promptRename(cy: Core, node: NodeSingular, onCommit: (label: str
     }
   });
   input.addEventListener("blur", commit);
+  return true;
+}
+
+/**
+ * Show an inline text input over a node to rename it. On Enter or blur it commits
+ * the trimmed value via `onCommit` (only when non-empty AND changed); Escape
+ * cancels. Extracted from the double-tap gesture so the radial menu's "Rename"
+ * command reuses the exact same affordance.
+ *
+ * XSS guard: `input.value` is used as plain text — NEVER assigned to innerHTML.
+ */
+export function promptRename(cy: Core, node: NodeSingular, onCommit: (label: string) => void): void {
+  const id = node.id();
+  const currentLabel = (node.data("label") as string | undefined) ?? id;
+  const pos = node.renderedPosition();
+  buildInlineInput(cy, {
+    value: currentLabel,
+    left: pos.x - 40,
+    top: pos.y - 12,
+    onCommit: (newLabel) => {
+      // Commit only a non-empty, changed label (preserves the prior behaviour).
+      if (newLabel && newLabel !== currentLabel) onCommit(newLabel);
+    },
+  });
+}
+
+/**
+ * Show an inline text input anchored at the edge's rendered midpoint to relabel
+ * it. Prefilled with the edge's current `label` data field; on Enter or blur
+ * commits the trimmed value via `onCommit` (only when non-empty AND changed);
+ * Escape cancels. Mirrors {@link promptRename} but uses `edge.renderedMidpoint()`
+ * for placement (edges have no `renderedPosition`).
+ *
+ * XSS guard: `input.value` is used as plain text — NEVER assigned to innerHTML.
+ */
+export function promptEdgeLabel(cy: Core, edge: EdgeSingular, onCommit: (label: string) => void): void {
+  const currentLabel = (edge.data("label") as string | undefined) ?? "";
+  const pos = edge.renderedMidpoint();
+  buildInlineInput(cy, {
+    value: currentLabel,
+    placeholder: "Edge label…",
+    left: pos.x - 40,
+    top: pos.y - 12,
+    onCommit: (newLabel) => {
+      if (newLabel && newLabel !== currentLabel) onCommit(newLabel);
+    },
+  });
+}
+
+/**
+ * Show an inline text input over a node to edit its summary. Empty value +
+ * "Edit summary…" placeholder (the frontend doesn't hold the current summary).
+ * Commits the trimmed text via `onCommit` only when non-empty; Escape cancels.
+ *
+ * XSS guard: `input.value` is used as plain text — NEVER assigned to innerHTML.
+ */
+export function promptSummary(cy: Core, node: NodeSingular, onCommit: (text: string) => void): void {
+  const pos = node.renderedPosition();
+  buildInlineInput(cy, {
+    placeholder: "Edit summary…",
+    left: pos.x - 40,
+    top: pos.y - 12,
+    onCommit: (text) => {
+      if (text) onCommit(text);
+    },
+  });
+}
+
+/**
+ * Show an inline text input centered over the canvas to create a new node. Empty
+ * value + "New node label…" placeholder. Commits the trimmed label via `onCommit`
+ * only when non-empty; Escape cancels.
+ *
+ * XSS guard: `input.value` is used as plain text — NEVER assigned to innerHTML.
+ */
+export function promptNewNode(cy: Core, onCommit: (label: string) => void): void {
+  const container = cy.container();
+  // Center over the canvas using the container's pixel box (renderer-owned space).
+  const cx = container ? container.clientWidth / 2 - 60 : 0;
+  const cy0 = container ? container.clientHeight / 2 - 10 : 0;
+  buildInlineInput(cy, {
+    placeholder: "New node label…",
+    left: cx,
+    top: cy0,
+    onCommit: (label) => {
+      if (label) onCommit(label);
+    },
+  });
 }
 
 /**
@@ -968,7 +1262,9 @@ interface CxtMenuCore extends Core {
  */
 export type CxtMenuDispatch = (payload: {
   index: null;
-  value: { kind: string; id: string; action?: string; label?: string };
+  // `id` is optional because the add_node command has no node id yet (the backend
+  // mints one). Every other command supplies it.
+  value: { kind: string; id?: string; action?: string; label?: string; text?: string };
   selected: boolean;
 }) => void;
 
@@ -991,6 +1287,27 @@ export function wireCxtMenu(cy: Core, dispatch: CxtMenuDispatch): void {
     // openMenu() early-return.
     if (ele.hasClass("fogged")) return [];
     const id = ele.id();
+    const scratch = getScratch(cy);
+    const clearArmed = (): void => {
+      scratch.pendingDeleteNodeId = null;
+      cy.getElementById(id).removeClass("pending-delete");
+    };
+    // Armed for deletion (second right-click on the same node): offer only a
+    // Confirm / Cancel pair. Mirrors the edge two-step delete confirm — a
+    // node deletion is destructive, so it must be a deliberate second action.
+    if (scratch.pendingDeleteNodeId === id) {
+      return [
+        {
+          content: "⚠ Confirm",
+          fillColor: "rgba(180, 40, 40, 0.9)",
+          select: () => {
+            clearArmed();
+            dispatch({ index: null, value: { kind: "delete_node", id }, selected: false });
+          },
+        },
+        { content: "Cancel", select: () => clearArmed() },
+      ];
+    }
     const reviewCommand = (action: "accepted" | "rejected"): CxtMenuCommand => ({
       content: action === "accepted" ? "✓ Accept" : "✕ Reject",
       select: () => dispatch({ index: null, value: { kind: "review", id, action }, selected: false }),
@@ -1014,12 +1331,41 @@ export function wireCxtMenu(cy: Core, dispatch: CxtMenuDispatch): void {
           dispatch({ index: null, value: { kind: "rename", id, label }, selected: false })
         ),
     };
-    return [reviewCommand("accepted"), reviewCommand("rejected"), focusCommand, expandCommand, renameCommand];
+    const summaryCommand: CxtMenuCommand = {
+      content: "✎ Summary",
+      // Inline input (empty + placeholder); commits a new summary via edit_summary.
+      select: () =>
+        promptSummary(cy, ele as NodeSingular, (text) =>
+          dispatch({ index: null, value: { kind: "edit_summary", id, text }, selected: false })
+        ),
+    };
+    const deleteCommand: CxtMenuCommand = {
+      content: "🗑 Delete",
+      // Arm only — does NOT delete. The red dashed border signals "right-click
+      // again to confirm" (the Confirm/Cancel pair appears on the armed branch).
+      select: () => {
+        scratch.pendingDeleteNodeId = id;
+        cy.getElementById(id).addClass("pending-delete");
+      },
+    };
+    return [
+      reviewCommand("accepted"),
+      reviewCommand("rejected"),
+      focusCommand,
+      expandCommand,
+      renameCommand,
+      summaryCommand,
+      deleteCommand,
+    ];
   };
 
   // Edge menu with an in-canvas, two-step delete confirm (deletion is irreversible
   // except via undo). First right-click arms the edge (red dashed); the follow-up
   // menu on the same edge offers Confirm / Cancel.
+  // Full command set (wedge order): Accept | Reject | Edit label | Delete
+  // (non-armed state). Accept/Reject mirror the node reviewCommand; Edit-label
+  // opens a promptEdgeLabel inline input (non-destructive, no arm step);
+  // Delete arms on first click and requires a second confirm (destructive).
   const buildEdgeCommands = (ele: CxtMenuEle): CxtMenuCommand[] => {
     if (ele.hasClass("fogged")) return [];
     const id = ele.id();
@@ -1041,22 +1387,35 @@ export function wireCxtMenu(cy: Core, dispatch: CxtMenuDispatch): void {
         { content: "Cancel", select: () => clearArmed() },
       ];
     }
-    return [
-      {
-        content: "✕ Delete",
-        // Arm only — does NOT delete. The red highlight signals "right-click again".
-        select: () => {
-          scratch.pendingDeleteEdgeId = id;
-          cy.getElementById(id).addClass("pending-delete");
-        },
+    const edgeReviewCommand = (action: "accepted" | "rejected"): CxtMenuCommand => ({
+      content: action === "accepted" ? "✓ Accept" : "✕ Reject",
+      select: () => dispatch({ index: null, value: { kind: "review_edge", id, action }, selected: false }),
+    });
+    const editLabelCommand: CxtMenuCommand = {
+      content: "✎ Edit label",
+      // Non-destructive — no arm step. Opens inline input; commits relabel_edge.
+      select: () =>
+        promptEdgeLabel(cy, ele as EdgeSingular, (label) =>
+          dispatch({ index: null, value: { kind: "relabel_edge", id, label }, selected: false })
+        ),
+    };
+    const deleteCommand: CxtMenuCommand = {
+      content: "🗑 Delete",
+      // Arm only — does NOT delete. The red highlight signals "right-click again".
+      select: () => {
+        scratch.pendingDeleteEdgeId = id;
+        cy.getElementById(id).addClass("pending-delete");
       },
-    ];
+    };
+    return [edgeReviewCommand("accepted"), edgeReviewCommand("rejected"), editLabelCommand, deleteCommand];
   };
 
   (cy as CxtMenuCore).cxtmenu({
     selector: "node",
     commands: buildNodeCommands,
-    menuRadius: () => 80,
+    // Larger wheel to fit the expanded command set (Accept/Reject/Focus/Expand/
+    // Rename/Summary/Delete) without crowding the wedges.
+    menuRadius: () => 100,
     fillColor: "rgba(17, 19, 26, 0.92)", // matches LC_LABEL_BG pill tone
     activeFillColor: "rgba(59, 91, 219, 0.85)", // LC_NODE_BG indigo
     itemColor: LC_NODE_TEXT,
@@ -1095,6 +1454,12 @@ export function wireCxtMenu(cy: Core, dispatch: CxtMenuDispatch): void {
         content: "🎨 Clusters",
         select: () => dispatch({ index: null, value: { kind: "cluster", id: "" }, selected: false }),
       },
+      {
+        content: "＋ Add node",
+        // Centered inline input; commits a new node label via add_node.
+        select: () =>
+          promptNewNode(cy, (label) => dispatch({ index: null, value: { kind: "add_node", label }, selected: false })),
+      },
     ],
     menuRadius: () => 70,
     fillColor: "rgba(17, 19, 26, 0.92)",

cytoscapecanvas/frontend/types.ts

@@ -107,7 +107,9 @@ export interface ConnectEvent {
 export type SelectPayload =
   | { kind: "node" | "edge" | "none"; id: string }
   | { kind: "rename"; id: string; label: string }
-  | { kind: "connect"; source: string; target: string; label: string };
+  | { kind: "connect"; source: string; target: string; label: string }
+  | { kind: "review_edge"; id: string; action: string }
+  | { kind: "relabel_edge"; id: string; label: string };
 
 export interface CytoscapeCanvasEvents {
   change: never;

fixtures/seed_local_ai.json

@@ -0,0 +1,729 @@
+{
+  "graph": {
+    "nodes": [
+      {
+        "id": "concept::local_language_model",
+        "kind": "concept",
+        "label": "Local Language Model",
+        "summary": "A model running on a user's own machine that ensures data privacy.",
+        "properties": {},
+        "metadata": {
+          "origin": "model_inferred",
+          "support_state": "unverified"
+        },
+        "evidence_refs": [
+          {
+            "source_id": "text::what-you-build-with-local-ai",
+            "node_id": "concept::local_language_model",
+            "start_line": 1,
+            "end_line": 1,
+            "snippet_hash": "527e4efd4bcea8eb4e7857615797c4c9c7d4e1e3700f7224968865312cc26d35"
+          }
+        ]
+      },
+      {
+        "id": "concept::rag",
+        "kind": "concept",
+        "label": "Retrieval-Augmented Generation (RAG)",
+        "summary": "A technique that grounds model answers in specific documents to reduce hallucinations.",
+        "properties": {},
+        "metadata": {
+          "origin": "model_inferred",
+          "support_state": "unverified"
+        },
+        "evidence_refs": [
+          {
+            "source_id": "text::what-you-build-with-local-ai",
+            "node_id": "concept::rag",
+            "start_line": 1,
+            "end_line": 3,
+            "snippet_hash": "e36d3a792740cfda99064bdbd5a9efecf4fb40473945d4bcf35ecf9eed0c88ea"
+          }
+        ]
+      },
+      {
+        "id": "concept::embeddings",
+        "kind": "concept",
+        "label": "Embeddings",
+        "summary": "Numeric vectors that capture the semantic meaning of text.",
+        "properties": {},
+        "metadata": {
+          "origin": "model_inferred",
+          "support_state": "unverified"
+        },
+        "evidence_refs": [
+          {
+            "source_id": "text::what-you-build-with-local-ai",
+            "node_id": "concept::embeddings",
+            "start_line": 3,
+            "end_line": 3,
+            "snippet_hash": "a1b134578828dda6a026d13c149b5a883c0d7703a65b85baba3b71c36b9556fe"
+          }
+        ]
+      },
+      {
+        "id": "concept::vector_database",
+        "kind": "concept",
+        "label": "Vector Database",
+        "summary": "A storage system that allows for searching by meaning rather than keywords.",
+        "properties": {},
+        "metadata": {
+          "origin": "model_inferred",
+          "support_state": "unverified"
+        },
+        "evidence_refs": [
+          {
+            "source_id": "text::what-you-build-with-local-ai",
+            "node_id": "concept::vector_database",
+            "start_line": 3,
+            "end_line": 3,
+            "snippet_hash": "3434f2f64ea638101826dbe1aada727f6ffdb23e659e5512b1b6fe7b204574c2"
+          }
+        ]
+      },
+      {
+        "id": "concept::agent",
+        "kind": "concept",
+        "label": "Agent",
+        "summary": "A model that can perform actions by invoking tools to complete tasks.",
+        "properties": {},
+        "metadata": {
+          "origin": "model_inferred",
+          "support_state": "unverified"
+        },
+        "evidence_refs": [
+          {
+            "source_id": "text::what-you-build-with-local-ai",
+            "node_id": "concept::agent",
+            "start_line": 3,
+            "end_line": 3,
+            "snippet_hash": "669c0a4763e07218022e5ace4af8b0d143cefec33fc9fc0d12f8b4a63800ed42"
+          }
+        ]
+      },
+      {
+        "id": "concept::tool_calling",
+        "kind": "concept",
+        "label": "Tool Calling",
+        "summary": "The process where a model decides to invoke a function or API.",
+        "properties": {},
+        "metadata": {
+          "origin": "model_inferred",
+          "support_state": "unverified"
+        },
+        "evidence_refs": [
+          {
+            "source_id": "text::what-you-build-with-local-ai",
+            "node_id": "concept::tool_calling",
+            "start_line": 3,
+            "end_line": 3,
+            "snippet_hash": "2ff6b971eeb8ebcc4ebf47cf517b7a7065f9fb3e8b577712d2a65d394b04f681"
+          }
+        ]
+      },
+      {
+        "id": "concept::structured_output",
+        "kind": "concept",
+        "label": "Structured Output",
+        "summary": "Machine-readable output, such as JSON, required for tool calling and precise RAG citations.",
+        "properties": {},
+        "metadata": {
+          "origin": "model_inferred",
+          "support_state": "unverified"
+        },
+        "evidence_refs": [
+          {
+            "source_id": "text::what-you-build-with-local-ai",
+            "node_id": "concept::structured_output",
+            "start_line": 3,
+            "end_line": 3,
+            "snippet_hash": "d153caffaef0d004d5ea80a9d2d79de76444b0f1af4a22f69436a5b5c4c7a26a"
+          }
+        ]
+      },
+      {
+        "id": "concept::fine_tuning",
+        "kind": "concept",
+        "label": "Fine-tuning",
+        "summary": "Adjusting a model's weights on specific examples to teach lasting behavior.",
+        "properties": {},
+        "metadata": {
+          "origin": "model_inferred",
+          "support_state": "unverified"
+        },
+        "evidence_refs": [
+          {
+            "source_id": "text::what-you-build-with-local-ai",
+            "node_id": "concept::fine_tuning",
+            "start_line": 5,
+            "end_line": 5,
+            "snippet_hash": "8bd39e784347707c5d4b96bc28d11ba3b99a139e2798a6e29a67ff5377212fae"
+          }
+        ]
+      },
+      {
+        "id": "concept::lora",
+        "kind": "concept",
+        "label": "LoRA",
+        "summary": "A parameter-efficient fine-tuning method that trains only small adapter layers.",
+        "properties": {},
+        "metadata": {
+          "origin": "model_inferred",
+          "support_state": "unverified"
+        },
+        "evidence_refs": [
+          {
+            "source_id": "text::what-you-build-with-local-ai",
+            "node_id": "concept::lora",
+            "start_line": 5,
+            "end_line": 5,
+            "snippet_hash": "44d1331560c7ce9bd6e813333f32e3ab6b816117dfbbf6d1faf83f5dd9e9ce6b"
+          }
+        ]
+      },
+      {
+        "id": "concept::open_source_models",
+        "kind": "concept",
+        "label": "Open-source Models",
+        "summary": "Models with open weights that enable privacy, inspection, and customization.",
+        "properties": {},
+        "metadata": {
+          "origin": "model_inferred",
+          "support_state": "unverified"
+        },
+        "evidence_refs": [
+          {
+            "source_id": "text::what-you-build-with-local-ai",
+            "node_id": "concept::open_source_models",
+            "start_line": 5,
+            "end_line": 5,
+            "snippet_hash": "87998699bfff48c57e15c35e7fbfb2a952e5b52bb9fcbc3260ca6bac16c5d30c"
+          }
+        ]
+      }
+    ],
+    "edges": [
+      {
+        "id": "concept::rag::prerequisite_of::concept::embeddings",
+        "source": "concept::rag",
+        "target": "concept::embeddings",
+        "type": "prerequisite_of",
+        "label": "depends on",
+        "properties": {
+          "origin": "model_inferred",
+          "support_state": "unverified"
+        }
+      },
+      {
+        "id": "concept::embeddings::related_to::concept::vector_database",
+        "source": "concept::embeddings",
+        "target": "concept::vector_database",
+        "type": "related_to",
+        "label": "stored in",
+        "properties": {
+          "origin": "model_inferred",
+          "support_state": "unverified"
+        }
+      },
+      {
+        "id": "concept::agent::explains::concept::tool_calling",
+        "source": "concept::agent",
+        "target": "concept::tool_calling",
+        "type": "explains",
+        "label": "works by",
+        "properties": {
+          "origin": "model_inferred",
+          "support_state": "unverified"
+        }
+      },
+      {
+        "id": "concept::tool_calling::prerequisite_of::concept::structured_output",
+        "source": "concept::tool_calling",
+        "target": "concept::structured_output",
+        "type": "prerequisite_of",
+        "label": "depends on",
+        "properties": {
+          "origin": "model_inferred",
+          "support_state": "unverified"
+        }
+      },
+      {
+        "id": "concept::structured_output::related_to::concept::rag",
+        "source": "concept::structured_output",
+        "target": "concept::rag",
+        "type": "related_to",
+        "label": "disciplines",
+        "properties": {
+          "origin": "model_inferred",
+          "support_state": "unverified"
+        }
+      },
+      {
+        "id": "concept::fine_tuning::explains::concept::lora",
+        "source": "concept::fine_tuning",
+        "target": "concept::lora",
+        "type": "explains",
+        "label": "efficient version of",
+        "properties": {
+          "origin": "model_inferred",
+          "support_state": "unverified"
+        }
+      },
+      {
+        "id": "concept::rag::related_to::concept::fine_tuning",
+        "source": "concept::rag",
+        "target": "concept::fine_tuning",
+        "type": "related_to",
+        "label": "complementary to",
+        "properties": {
+          "origin": "model_inferred",
+          "support_state": "unverified"
+        }
+      },
+      {
+        "id": "concept::open_source_models::prerequisite_of::concept::fine_tuning",
+        "source": "concept::open_source_models",
+        "target": "concept::fine_tuning",
+        "type": "prerequisite_of",
+        "label": "enables",
+        "properties": {
+          "origin": "model_inferred",
+          "support_state": "unverified"
+        }
+      },
+      {
+        "id": "concept::open_source_models::related_to::concept::local_language_model",
+        "source": "concept::open_source_models",
+        "target": "concept::local_language_model",
+        "type": "related_to",
+        "label": "underpins",
+        "properties": {
+          "origin": "model_inferred",
+          "support_state": "unverified"
+        }
+      }
+    ],
+    "claims": [
+      {
+        "id": "claim::concept::local_language_model",
+        "claim_type": "concept_node",
+        "target_id": "concept::local_language_model",
+        "source_id": "",
+        "text": "A model running on a user's own machine that ensures data privacy.",
+        "origin": "model_inferred",
+        "support_state": "unverified",
+        "review_state": "pending",
+        "evidence_refs": [
+          {
+            "source_id": "text::what-you-build-with-local-ai",
+            "node_id": "concept::local_language_model",
+            "start_line": 1,
+            "end_line": 1,
+            "snippet_hash": "527e4efd4bcea8eb4e7857615797c4c9c7d4e1e3700f7224968865312cc26d35"
+          }
+        ]
+      },
+      {
+        "id": "claim::concept::rag",
+        "claim_type": "concept_node",
+        "target_id": "concept::rag",
+        "source_id": "",
+        "text": "A technique that grounds model answers in specific documents to reduce hallucinations.",
+        "origin": "model_inferred",
+        "support_state": "unverified",
+        "review_state": "pending",
+        "evidence_refs": [
+          {
+            "source_id": "text::what-you-build-with-local-ai",
+            "node_id": "concept::rag",
+            "start_line": 1,
+            "end_line": 3,
+            "snippet_hash": "e36d3a792740cfda99064bdbd5a9efecf4fb40473945d4bcf35ecf9eed0c88ea"
+          }
+        ]
+      },
+      {
+        "id": "claim::concept::embeddings",
+        "claim_type": "concept_node",
+        "target_id": "concept::embeddings",
+        "source_id": "",
+        "text": "Numeric vectors that capture the semantic meaning of text.",
+        "origin": "model_inferred",
+        "support_state": "unverified",
+        "review_state": "pending",
+        "evidence_refs": [
+          {
+            "source_id": "text::what-you-build-with-local-ai",
+            "node_id": "concept::embeddings",
+            "start_line": 3,
+            "end_line": 3,
+            "snippet_hash": "a1b134578828dda6a026d13c149b5a883c0d7703a65b85baba3b71c36b9556fe"
+          }
+        ]
+      },
+      {
+        "id": "claim::concept::vector_database",
+        "claim_type": "concept_node",
+        "target_id": "concept::vector_database",
+        "source_id": "",
+        "text": "A storage system that allows for searching by meaning rather than keywords.",
+        "origin": "model_inferred",
+        "support_state": "unverified",
+        "review_state": "pending",
+        "evidence_refs": [
+          {
+            "source_id": "text::what-you-build-with-local-ai",
+            "node_id": "concept::vector_database",
+            "start_line": 3,
+            "end_line": 3,
+            "snippet_hash": "3434f2f64ea638101826dbe1aada727f6ffdb23e659e5512b1b6fe7b204574c2"
+          }
+        ]
+      },
+      {
+        "id": "claim::concept::agent",
+        "claim_type": "concept_node",
+        "target_id": "concept::agent",
+        "source_id": "",
+        "text": "A model that can perform actions by invoking tools to complete tasks.",
+        "origin": "model_inferred",
+        "support_state": "unverified",
+        "review_state": "pending",
+        "evidence_refs": [
+          {
+            "source_id": "text::what-you-build-with-local-ai",
+            "node_id": "concept::agent",
+            "start_line": 3,
+            "end_line": 3,
+            "snippet_hash": "669c0a4763e07218022e5ace4af8b0d143cefec33fc9fc0d12f8b4a63800ed42"
+          }
+        ]
+      },
+      {
+        "id": "claim::concept::tool_calling",
+        "claim_type": "concept_node",
+        "target_id": "concept::tool_calling",
+        "source_id": "",
+        "text": "The process where a model decides to invoke a function or API.",
+        "origin": "model_inferred",
+        "support_state": "unverified",
+        "review_state": "pending",
+        "evidence_refs": [
+          {
+            "source_id": "text::what-you-build-with-local-ai",
+            "node_id": "concept::tool_calling",
+            "start_line": 3,
+            "end_line": 3,
+            "snippet_hash": "2ff6b971eeb8ebcc4ebf47cf517b7a7065f9fb3e8b577712d2a65d394b04f681"
+          }
+        ]
+      },
+      {
+        "id": "claim::concept::structured_output",
+        "claim_type": "concept_node",
+        "target_id": "concept::structured_output",
+        "source_id": "",
+        "text": "Machine-readable output, such as JSON, required for tool calling and precise RAG citations.",
+        "origin": "model_inferred",
+        "support_state": "unverified",
+        "review_state": "pending",
+        "evidence_refs": [
+          {
+            "source_id": "text::what-you-build-with-local-ai",
+            "node_id": "concept::structured_output",
+            "start_line": 3,
+            "end_line": 3,
+            "snippet_hash": "d153caffaef0d004d5ea80a9d2d79de76444b0f1af4a22f69436a5b5c4c7a26a"
+          }
+        ]
+      },
+      {
+        "id": "claim::concept::fine_tuning",
+        "claim_type": "concept_node",
+        "target_id": "concept::fine_tuning",
+        "source_id": "",
+        "text": "Adjusting a model's weights on specific examples to teach lasting behavior.",
+        "origin": "model_inferred",
+        "support_state": "unverified",
+        "review_state": "pending",
+        "evidence_refs": [
+          {
+            "source_id": "text::what-you-build-with-local-ai",
+            "node_id": "concept::fine_tuning",
+            "start_line": 5,
+            "end_line": 5,
+            "snippet_hash": "8bd39e784347707c5d4b96bc28d11ba3b99a139e2798a6e29a67ff5377212fae"
+          }
+        ]
+      },
+      {
+        "id": "claim::concept::lora",
+        "claim_type": "concept_node",
+        "target_id": "concept::lora",
+        "source_id": "",
+        "text": "A parameter-efficient fine-tuning method that trains only small adapter layers.",
+        "origin": "model_inferred",
+        "support_state": "unverified",
+        "review_state": "pending",
+        "evidence_refs": [
+          {
+            "source_id": "text::what-you-build-with-local-ai",
+            "node_id": "concept::lora",
+            "start_line": 5,
+            "end_line": 5,
+            "snippet_hash": "44d1331560c7ce9bd6e813333f32e3ab6b816117dfbbf6d1faf83f5dd9e9ce6b"
+          }
+        ]
+      },
+      {
+        "id": "claim::concept::open_source_models",
+        "claim_type": "concept_node",
+        "target_id": "concept::open_source_models",
+        "source_id": "",
+        "text": "Models with open weights that enable privacy, inspection, and customization.",
+        "origin": "model_inferred",
+        "support_state": "unverified",
+        "review_state": "pending",
+        "evidence_refs": [
+          {
+            "source_id": "text::what-you-build-with-local-ai",
+            "node_id": "concept::open_source_models",
+            "start_line": 5,
+            "end_line": 5,
+            "snippet_hash": "87998699bfff48c57e15c35e7fbfb2a952e5b52bb9fcbc3260ca6bac16c5d30c"
+          }
+        ]
+      },
+      {
+        "id": "claim::semantic::concept::rag->concept::embeddings::prerequisite_of",
+        "claim_type": "semantic_edge",
+        "target_id": "concept::rag::prerequisite_of::concept::embeddings",
+        "source_id": "concept::rag",
+        "text": "prerequisite_of",
+        "origin": "model_inferred",
+        "support_state": "unverified",
+        "review_state": "pending",
+        "evidence_refs": [
+          {
+            "source_id": "text::what-you-build-with-local-ai",
+            "node_id": "concept::rag::prerequisite_of::concept::embeddings",
+            "start_line": 1,
+            "end_line": 10,
+            "snippet_hash": "bfc6a0f0a78bf80ff6e83ef84be0aedfd0deca978d5414a69cb36fe4e050c32f"
+          }
+        ]
+      },
+      {
+        "id": "claim::semantic::concept::embeddings->concept::vector_database::related_to",
+        "claim_type": "semantic_edge",
+        "target_id": "concept::embeddings::related_to::concept::vector_database",
+        "source_id": "concept::embeddings",
+        "text": "related_to",
+        "origin": "model_inferred",
+        "support_state": "unverified",
+        "review_state": "pending",
+        "evidence_refs": [
+          {
+            "source_id": "text::what-you-build-with-local-ai",
+            "node_id": "concept::embeddings::related_to::concept::vector_database",
+            "start_line": 1,
+            "end_line": 10,
+            "snippet_hash": "bfc6a0f0a78bf80ff6e83ef84be0aedfd0deca978d5414a69cb36fe4e050c32f"
+          }
+        ]
+      },
+      {
+        "id": "claim::semantic::concept::agent->concept::tool_calling::explains",
+        "claim_type": "semantic_edge",
+        "target_id": "concept::agent::explains::concept::tool_calling",
+        "source_id": "concept::agent",
+        "text": "explains",
+        "origin": "model_inferred",
+        "support_state": "unverified",
+        "review_state": "pending",
+        "evidence_refs": [
+          {
+            "source_id": "text::what-you-build-with-local-ai",
+            "node_id": "concept::agent::explains::concept::tool_calling",
+            "start_line": 1,
+            "end_line": 10,
+            "snippet_hash": "bfc6a0f0a78bf80ff6e83ef84be0aedfd0deca978d5414a69cb36fe4e050c32f"
+          }
+        ]
+      },
+      {
+        "id": "claim::semantic::concept::tool_calling->concept::structured_output::prerequisite_of",
+        "claim_type": "semantic_edge",
+        "target_id": "concept::tool_calling::prerequisite_of::concept::structured_output",
+        "source_id": "concept::tool_calling",
+        "text": "prerequisite_of",
+        "origin": "model_inferred",
+        "support_state": "unverified",
+        "review_state": "pending",
+        "evidence_refs": [
+          {
+            "source_id": "text::what-you-build-with-local-ai",
+            "node_id": "concept::tool_calling::prerequisite_of::concept::structured_output",
+            "start_line": 1,
+            "end_line": 10,
+            "snippet_hash": "bfc6a0f0a78bf80ff6e83ef84be0aedfd0deca978d5414a69cb36fe4e050c32f"
+          }
+        ]
+      },
+      {
+        "id": "claim::semantic::concept::structured_output->concept::rag::related_to",
+        "claim_type": "semantic_edge",
+        "target_id": "concept::structured_output::related_to::concept::rag",
+        "source_id": "concept::structured_output",
+        "text": "related_to",
+        "origin": "model_inferred",
+        "support_state": "unverified",
+        "review_state": "pending",
+        "evidence_refs": [
+          {
+            "source_id": "text::what-you-build-with-local-ai",
+            "node_id": "concept::structured_output::related_to::concept::rag",
+            "start_line": 1,
+            "end_line": 10,
+            "snippet_hash": "bfc6a0f0a78bf80ff6e83ef84be0aedfd0deca978d5414a69cb36fe4e050c32f"
+          }
+        ]
+      },
+      {
+        "id": "claim::semantic::concept::fine_tuning->concept::lora::explains",
+        "claim_type": "semantic_edge",
+        "target_id": "concept::fine_tuning::explains::concept::lora",
+        "source_id": "concept::fine_tuning",
+        "text": "explains",
+        "origin": "model_inferred",
+        "support_state": "unverified",
+        "review_state": "pending",
+        "evidence_refs": [
+          {
+            "source_id": "text::what-you-build-with-local-ai",
+            "node_id": "concept::fine_tuning::explains::concept::lora",
+            "start_line": 1,
+            "end_line": 10,
+            "snippet_hash": "bfc6a0f0a78bf80ff6e83ef84be0aedfd0deca978d5414a69cb36fe4e050c32f"
+          }
+        ]
+      },
+      {
+        "id": "claim::semantic::concept::rag->concept::fine_tuning::related_to",
+        "claim_type": "semantic_edge",
+        "target_id": "concept::rag::related_to::concept::fine_tuning",
+        "source_id": "concept::rag",
+        "text": "related_to",
+        "origin": "model_inferred",
+        "support_state": "unverified",
+        "review_state": "pending",
+        "evidence_refs": [
+          {
+            "source_id": "text::what-you-build-with-local-ai",
+            "node_id": "concept::rag::related_to::concept::fine_tuning",
+            "start_line": 1,
+            "end_line": 10,
+            "snippet_hash": "bfc6a0f0a78bf80ff6e83ef84be0aedfd0deca978d5414a69cb36fe4e050c32f"
+          }
+        ]
+      },
+      {
+        "id": "claim::semantic::concept::open_source_models->concept::fine_tuning::prerequisite_of",
+        "claim_type": "semantic_edge",
+        "target_id": "concept::open_source_models::prerequisite_of::concept::fine_tuning",
+        "source_id": "concept::open_source_models",
+        "text": "prerequisite_of",
+        "origin": "model_inferred",
+        "support_state": "unverified",
+        "review_state": "pending",
+        "evidence_refs": [
+          {
+            "source_id": "text::what-you-build-with-local-ai",
+            "node_id": "concept::open_source_models::prerequisite_of::concept::fine_tuning",
+            "start_line": 1,
+            "end_line": 10,
+            "snippet_hash": "bfc6a0f0a78bf80ff6e83ef84be0aedfd0deca978d5414a69cb36fe4e050c32f"
+          }
+        ]
+      },
+      {
+        "id": "claim::semantic::concept::open_source_models->concept::local_language_model::related_to",
+        "claim_type": "semantic_edge",
+        "target_id": "concept::open_source_models::related_to::concept::local_language_model",
+        "source_id": "concept::open_source_models",
+        "text": "related_to",
+        "origin": "model_inferred",
+        "support_state": "unverified",
+        "review_state": "pending",
+        "evidence_refs": [
+          {
+            "source_id": "text::what-you-build-with-local-ai",
+            "node_id": "concept::open_source_models::related_to::concept::local_language_model",
+            "start_line": 1,
+            "end_line": 10,
+            "snippet_hash": "bfc6a0f0a78bf80ff6e83ef84be0aedfd0deca978d5414a69cb36fe4e050c32f"
+          }
+        ]
+      }
+    ],
+    "metadata": {
+      "schema_version": "0.1.0",
+      "node_count": 10,
+      "edge_count": 9
+    }
+  },
+  "scene": {
+    "scene_id": "seed_local_ai_initial",
+    "visible_node_ids": [
+      "concept::rag",
+      "concept::fine_tuning",
+      "concept::structured_output",
+      "concept::embeddings",
+      "concept::tool_calling",
+      "concept::open_source_models",
+      "concept::lora",
+      "concept::vector_database",
+      "concept::local_language_model",
+      "concept::agent"
+    ],
+    "visible_edge_ids": [
+      "concept::rag::prerequisite_of::concept::embeddings",
+      "concept::embeddings::related_to::concept::vector_database",
+      "concept::agent::explains::concept::tool_calling",
+      "concept::tool_calling::prerequisite_of::concept::structured_output",
+      "concept::structured_output::related_to::concept::rag",
+      "concept::fine_tuning::explains::concept::lora",
+      "concept::rag::related_to::concept::fine_tuning",
+      "concept::open_source_models::prerequisite_of::concept::fine_tuning",
+      "concept::open_source_models::related_to::concept::local_language_model"
+    ],
+    "fogged_node_ids": [],
+    "highlighted_ids": [],
+    "selected_id": "",
+    "callouts": [],
+    "node_positions": {
+      "concept::rag": [359.3254889740797, 413.93124693993104],
+      "concept::fine_tuning": [427.90556718584685, 501.1807331162357],
+      "concept::structured_output": [459.9388127470801, 266.3831793829436],
+      "concept::embeddings": [263.19949505847364, 575.2638023784646],
+      "concept::tool_calling": [562.8504920579213, 157.5174883009194],
+      "concept::open_source_models": [667.7714962697, 680.5737168938729],
+      "concept::lora": [445.549280906602, 680.8558430944295],
+      "concept::vector_database": [200.66715948740705, 724.4091315938329],
+      "concept::local_language_model": [900.0, 876.1056318950547],
+      "concept::agent": [712.7922073128894, 123.77922640431535]
+    },
+    "node_cluster_map": {
+      "concept::tool_calling": 0,
+      "concept::rag": 0,
+      "concept::agent": 0,
+      "concept::structured_output": 0,
+      "concept::fine_tuning": 1,
+      "concept::local_language_model": 1,
+      "concept::open_source_models": 1,
+      "concept::lora": 1,
+      "concept::vector_database": 2,
+      "concept::embeddings": 2
+    }
+  }
+}

scripts/playwright_cxtmenu.py

@@ -109,6 +109,51 @@ EDGE_POINT = """
 }
 """
 
+# First non-fogged node, preferring one still awaiting review (amber). Used to
+# verify the reject-removes-node FIX: rejecting must KEEP the node on canvas.
+PICK_REVIEWABLE_NODE = """
+() => {
+  const cy = window.__cy;
+  if (!cy) return null;
+  const pending = cy.nodes().filter((n) => !n.hasClass('fogged') && n.hasClass('review-pending'));
+  const n = pending[0] || cy.nodes().filter((n) => !n.hasClass('fogged'))[0];
+  if (!n) return null;
+  const rp = n.renderedPosition();
+  const rect = cy.container().getBoundingClientRect();
+  return {
+    id: n.id(), x: rect.left + rp.x, y: rect.top + rp.y,
+    reviewPending: n.hasClass('review-pending'),
+  };
+}
+"""
+
+# Live state of a specific node id (plus total node count) — for before/after a reject.
+NODE_STATE = """
+(id) => {
+  const cy = window.__cy;
+  if (!cy) return null;
+  const n = cy.getElementById(id);
+  return { exists: n.length > 0, classes: n.length ? n.classes() : [], total: cy.nodes().length };
+}
+"""
+
+# Page-coord center of the OPEN menu wedge whose text matches `label` (case-insensitive).
+WEDGE_BBOX = """
+(label) => {
+  const wraps = Array.from(document.querySelectorAll('.cxtmenu'));
+  const open = wraps.find((w) => {
+    const p = w.querySelector('div');
+    return p && getComputedStyle(p).display === 'block';
+  });
+  if (!open) return null;
+  const el = Array.from(open.querySelectorAll('.cxtmenu-content'))
+    .find((e) => (e.textContent || '').toLowerCase().includes(label.toLowerCase()));
+  if (!el) return null;
+  const r = el.getBoundingClientRect();
+  return { x: r.left + r.width / 2, y: r.top + r.height / 2 };
+}
+"""
+
 
 def main() -> int:
     console: list[str] = []
@@ -217,13 +262,61 @@ def main() -> int:
             report["edge_menu_wedges"] = edge_items
             page.screenshot(path=str(OUT / "cxtmenu_04_edge.png"))
             edge_joined = " ".join(edge_items).lower()
-            if "delete" not in edge_joined:
-                failures.append(
-                    f"edge right-click did not open the Delete menu; got {edge_items}"
-                )
+            # WF-A: the edge menu now offers Accept / Reject / Edit label / Delete
+            # (parity with the node review menu), not just Delete.
+            for want in ("accept", "reject", "edit", "delete"):
+                if want not in edge_joined:
+                    failures.append(
+                        f"edge menu missing a '{want}' wedge; got {edge_items}"
+                    )
             page.mouse.up(button="right")
             page.wait_for_timeout(150)
 
+        # F. Reject a node's claim → the node must STAY on the canvas.
+        # This is the rendered proof of the reject-removes-node FIX: before the fix,
+        # a node-claim rejection emitted remove_element(#node_id) and the canvas
+        # deleted the whole node; now it clears the amber badge but keeps the node.
+        rnode = page.evaluate(PICK_REVIEWABLE_NODE)
+        report["reject_node"] = rnode
+        if not rnode:
+            failures.append("no node available to test reject")
+        else:
+            before = page.evaluate(NODE_STATE, rnode["id"])
+            report["reject_node_before"] = before
+            page.mouse.move(rnode["x"], rnode["y"])
+            page.mouse.down(button="right")
+            page.wait_for_timeout(250)
+            wedge = page.evaluate(WEDGE_BBOX, "reject")
+            report["reject_wedge_bbox"] = wedge
+            if not wedge:
+                failures.append("no Reject wedge found in the node menu")
+                page.mouse.up(button="right")
+            else:
+                # Swipe to the Reject wedge and release → fires the reject dispatch.
+                page.mouse.move(wedge["x"], wedge["y"])
+                page.wait_for_timeout(150)
+                page.mouse.up(button="right")
+                # Wait for the backend round-trip + renderer patch to apply.
+                page.wait_for_timeout(2000)
+                after = page.evaluate(NODE_STATE, rnode["id"])
+                report["reject_node_after"] = after
+                page.screenshot(path=str(OUT / "cxtmenu_05_after_reject.png"))
+                if not after["exists"]:
+                    failures.append(
+                        f"REJECT REMOVED NODE {rnode['id']!r} — the reject-removes-node "
+                        "bug is NOT fixed (node gone from cy after reject)"
+                    )
+                if before and after["total"] != before["total"]:
+                    failures.append(
+                        f"node count changed on reject: {before['total']} -> "
+                        f"{after['total']} (reject must not delete nodes)"
+                    )
+                # Soft signal: a single-claim node should also lose its amber badge.
+                report["reject_amber_cleared"] = (
+                    rnode.get("reviewPending")
+                    and "review-pending" not in after["classes"]
+                )
+
         browser.close()
 
     # C. No page errors (console 'error' lines or pageerror entries).

src/loosecanvas/agent_harness.py

@@ -19,6 +19,7 @@ llama.cpp gotcha (verified by the spike): do NOT pass ``stream_options`` to
 from __future__ import annotations
 
 import asyncio
+import logging
 import os
 import time
 from collections.abc import AsyncIterator
@@ -53,41 +54,41 @@ from loosecanvas.turn_logic import (
     SessionRecord,
     TurnResult,
     _get_lock,
+    effective_node_label,
     session_store,
 )
 
+logger = logging.getLogger(__name__)
+
 # ── System prompt ──────────────────────────────────────────────────────────────
 
-SYSTEM_PROMPT = """You are a calm, curious collaborator helping the user build understanding on a shared canvas.
-You are NOT a chatbot, NOT a JSON emitter, NOT an authority on the graph.
-
-The canvas is your primary surface. Your voice is a quieter companion. Talk when it clarifies the map, act when the move is obvious, or do both when both matter.
-
-VOICE CALIBRATION (scales inversely with confidence):
-- On deterministic facts (what's visible on the canvas, structure you can read): be silent or minimal. Let the structure speak.
-- On model-inferred claims (relationships, patterns, labels you notice): be a suggestor. Offer one clear idea. Use hedged language: "This appears to...", "I notice that...".
-- On open questions and hypotheses: be a provocateur. Challenge the current view. Ask "But what if...". Surface the uncertainty.
-
-WHEN YOU ACT:
-- Call tools to reveal, center, highlight, propose, or edit the canvas.
-- Narrate your intent in one short clause, then CALL THE TOOL in the same reply. Narrating is NOT acting: never say "I'll link them now" / "I'll connect them" / "next I'll..." and then stop. If you announce an action, you must emit its tool call in this same turn -- do not defer it to a later turn or wait for the user to say "continue".
-- FINISH THE WHOLE BUILD BEFORE YOU YIELD. When a request implies several steps (add concepts AND connect them; add multiple nodes; rename several edges), perform every tool call needed to complete it in this one turn. Do not split "create the nodes" and "connect the nodes" across turns. Only stop early to ask for confirmation on a destructive removal, or when you genuinely need information you cannot read with get_canvas_state.
-- Do NOT recap what the tool already visibly did.
-- Call get_canvas_state first if you are unsure what is visible, hidden, or selected -- it is your external memory. Never guess node ids.
-- Navigation (reveal_node, center_on, highlight, fog_all_except, show_callout, expand_around): act autonomously.
-- Proposals (propose_edge_label, propose_note, propose_hypothesis, propose_question): frame as ideas the user can accept or dismiss.
-- Autonomous edits (create_node, create_edge, update_node): act without waiting.
-- To grow the map: call create_node to add a NEW concept the canvas is missing (it becomes a model-inferred, unverified node), then create_edge to connect it -- in the SAME turn. Always emit each create_node BEFORE the create_edge that links to it. Add as many nodes and edges as the request warrants in one turn; a newly created node has no edges until you add them, so never leave a node you just created unconnected.
-- Destructive removal (remove_node, remove_edge): ALWAYS ask the user to confirm in conversation FIRST. Never call a remove tool until the user has explicitly said yes.
-
-WHEN YOU SPEAK:
-- Keep prose warm but economical. No filler, no "As an AI...", no emojis.
-- If the user's message is informational and no graph change is warranted, just talk -- do not force an action.
-- One or two sentences when confident; a longer explanation only when uncertain or interpretive.
-
-TRUST MODEL:
-- Your proposals are proposals: the user (and the validator) decide what becomes real. Never assert unsupported claims as fact.
-- Ground what you propose in evidence visible on the canvas or in the conversation.
+SYSTEM_PROMPT = """You are a warm, curious thinking partner helping the user grow a shared map of ideas on a canvas. You build understanding together: the user sets the direction, and you bring initiative, a sharp eye for connections, and a real willingness to act. Talk like a thoughtful person, not a system -- you are a collaborator, never a form to fill out or a function that emits JSON.
+
+The canvas is where the thinking becomes visible. In any turn you can speak, act (call tools to shape the canvas), or do both -- whatever actually helps the user think.
+
+HOW YOU TALK
+- Be a genuine conversational partner. A sentence of orientation almost always helps: what you notice, what you just did, what you're curious about. Reserve silence for pure navigation (a pan or a zoom) where words would only be noise.
+- You don't need to read back changes the canvas already shows -- instead say what they mean, or ask what's worth doing next.
+- Match your certainty to the evidence. State what's plainly on the canvas matter-of-factly. Offer an inferred relationship or pattern as an idea -- "I notice...", "this looks like..." -- that the user can keep or drop. On the genuinely open questions, be a friendly provocateur: ask "but what if...", surface the tension, invite pushback.
+- Warm and natural, but no filler and no emojis. Ask a real follow-up when it would move the thinking forward.
+
+CALIBRATE YOUR VOICE TO YOUR CONFIDENCE
+- Facts the user explicitly named or drew (user-asserted, deterministic): state them plainly and matter-of-factly. Do not hedge what is already established.
+- Your own inferences, suggestions, or pattern-readings (model-inferred): hedge clearly. Use "I notice…", "one reading is…", "this looks like…" so the user can accept or drop the idea.
+- Open questions, hypotheses, genuine unknowns: be a friendly provocateur. Ask "but what if…", surface the tension, invite pushback. Make clear you are raising a question, not asserting an answer.
+
+If the user asks you to shift how you talk — be more skeptical, more concise, blunter, gentler, whatever — just go with it for the rest of the conversation; you'll remember.
+
+HOW YOU ACT -- you can reshape the map the way the user could by hand: add ideas, rename and annotate them, connect them, surface hidden links, and (with the user's yes) remove things.
+- When you say you'll do something, do it in the same turn. Don't promise an edit and then stop -- if you mention it, make the tool call now.
+- Carry a request all the way through. If "add these ideas and connect them" implies several moves, make every tool call needed to finish it this turn. A new node has no edges until you draw them, so add the node first, then connect it -- never leave a node you just created floating.
+- Reach for whatever fits: reveal_node / center_on / highlight to guide attention; create_node, create_edge, update_node, update_edge to grow and refine (update_edge relabels an existing connection so it shows on the canvas — use it when the user wants the edges clearer or more informative); propose_edge_label / propose_note / propose_hypothesis / propose_question to float an idea the user can accept or dismiss. Follow where the user wants to go rather than running a fixed script.
+- Removing is the one move you always confirm first. Ask in plain conversation, and only call remove_node or remove_edge once the user has clearly said yes.
+- When the user says to accept, approve, reject, or dismiss a proposal or a node/edge with an amber "awaiting review" badge, call review_element(target_id, action) where action is "accepted" or "rejected" — call get_canvas_state first to find the right id.
+- get_canvas_state is your eyes on the current map -- lean on it whenever you're unsure what's visible or selected. If you reference something that isn't there, the system tells you, so act and adjust rather than over-checking everything first.
+
+WHAT STAYS TRUE
+- What you add starts as a proposal: the user (and the validator) decide what becomes real. Don't state a guess as a fact -- ground what you propose in what's on the canvas or what the user has said.
 """
 
 # ── Streaming events ─────────────────────────────────────────────────────────
@@ -318,7 +319,7 @@ def _compose_user_message(
         if record is not None:
             record.attention.last_selected_node_id = sel_id
         return f"[The user currently has node '{sel_id}' selected.]\n\n{message}"
-    if record is not None and record.attention.last_selected_node_id:
+    elif record is not None and record.attention.last_selected_node_id:
         remembered = record.attention.last_selected_node_id
         record.attention.last_selected_node_id = ""  # consume — one-turn grace
         return f"[The user was just looking at node '{remembered}'.]\n\n{message}"
@@ -370,6 +371,41 @@ def _build_turn_messages(
     return messages
 
 
+# Friendly, present-tense narration for the streamed tool-activity ("what the agent
+# is doing now") so the chat reads like a collaborator, not a function trace. Unknown
+# tools fall back to a humanized name. Only the STREAMED narration is humanized; the
+# final collapsible receipts keep the precise tool:id labels (they're the audit detail).
+_FRIENDLY_TOOL_NAMES = {
+    "create_node": "Adding a concept",
+    "add_concept": "Adding a concept",
+    "create_concept": "Adding a concept",
+    "create_edge": "Drawing a connection",
+    "connect_nodes": "Drawing a connection",
+    "add_edge": "Drawing a connection",
+    "propose_hypothesis": "Proposing a hidden connection",
+    "rename_node": "Renaming a concept",
+    "update_node": "Updating a concept",
+    "update_edge": "Relabeling a connection",
+    "set_summary": "Annotating a concept",
+    "annotate_node": "Annotating a concept",
+    "reveal_node": "Revealing a related idea",
+    "expand_node": "Revealing related ideas",
+    "remove_node": "Removing a concept",
+    "remove_edge": "Removing a connection",
+    "get_canvas_state": "Looking at the map",
+    "search_nodes": "Searching the map",
+    "review_element": "Reviewing a proposal",
+}
+
+
+def _friendly_tool(name: str) -> str:
+    """Map a raw tool name to a friendly present-tense phrase for live narration."""
+    if name in _FRIENDLY_TOOL_NAMES:
+        return _FRIENDLY_TOOL_NAMES[name]
+    words = name.replace("_", " ").strip()
+    return (words[:1].upper() + words[1:]) if words else name
+
+
 async def run_agent_turn_streaming(
     session_id: str,
     selection: dict[str, Any],
@@ -425,7 +461,7 @@ async def run_agent_turn_streaming(
                 for call in tool_call_chunks:
                     name = call.get("name") if isinstance(call, dict) else None
                     if name:
-                        yield ToolActivityEvent(message=f"{name}…")
+                        yield ToolActivityEvent(message=f"{_friendly_tool(name)}…")
             content = getattr(token, "content", "")
             if isinstance(content, str) and content and node == "model":
                 parts.append(content)
@@ -442,3 +478,68 @@ async def run_agent_turn_streaming(
         )
     finally:
         lock.release()
+
+
+# ── First-turn opener (magic build) ─────────────────────────────────────────────
+#
+# The very first Send builds the graph via the deterministic text→graph extractor
+# (turn_logic.stream_text_session), which mints the session but does NOT run the
+# conversational agent. To make turn one feel like every later turn, ``main.py``
+# streams THIS opener into the chat right after the graph paints — the same warm
+# voice the user meets on turn two, naming the concepts that were actually pulled
+# out. It is a plain (tool-less) streaming completion, so it never mutates the
+# canvas and never pollutes the agent's conversation memory; the source document is
+# seeded into that memory on the first real agent turn (see ``_build_turn_messages``).
+
+_OPENER_SYSTEM = """You just helped the user turn their own text into a first map of ideas on a shared canvas. This is the opening line of your conversation with them — speak in your own warm, curious voice as their thinking partner.
+
+In two to four sentences: weave in a few of the concepts you actually pulled out (they are listed below), make clear this first pass is your inference — a starting point they own and can reshape — and invite the next move (tightening a connection, renaming something, adding what's missing, or digging into one idea). No filler, no emojis, and don't just recite counts. The user is the driver."""
+
+
+async def stream_build_opener(session_id: str) -> AsyncIterator[str]:
+    """Stream a warm, topic-aware opening line for a just-built magic-build graph.
+
+    Yields prose chunks (to be appended into the chat bubble exactly like a normal
+    turn's ``TokenEvent``). Replaces the old canned "Built a graph: N concepts"
+    template so turn one sounds like the same collaborator the user meets on every
+    later turn. If the model call fails for any reason, falls back to a single warm
+    static line that still names the extracted concepts — so turn one never lands
+    silent or with a bare count.
+    """
+    record = session_store.get(session_id)
+    labels: list[str] = []
+    n_edges = 0
+    if record is not None:
+        labels = [
+            effective_node_label(node, record.graph.claims.values())
+            for node in record.graph.nodes.values()
+        ]
+        n_edges = len(record.graph.edges)
+    sample = ", ".join(labels[:8]) if labels else "a handful of ideas"
+    user_msg = (
+        f"Concepts you extracted: {sample}. "
+        f"You also drew {n_edges} relation(s) between them."
+    )
+    emitted = False
+    try:
+        model = make_model()
+        async for chunk in model.astream(
+            [("system", _OPENER_SYSTEM), ("human", user_msg)]
+        ):
+            content = getattr(chunk, "content", "")
+            if isinstance(content, str) and content:
+                emitted = True
+                yield content
+    except Exception:  # noqa: BLE001 — an opener hiccup must never break the build
+        logger.debug("build opener stream failed; using static fallback", exc_info=True)
+    # Only fall back when NOTHING streamed — a mid-stream failure that already
+    # emitted real tokens must not double-post the static line on top of them.
+    if emitted:
+        return
+    # Fallback: warm, names the concepts, never a bare count.
+    connected = " and connected them" if n_edges else ""
+    yield (
+        f"Here's a first pass at your map — I pulled out {sample}{connected}. "
+        "It's all my inference for now, a starting point you own. "
+        "Tell me what to sharpen, rename, or add."
+    )

src/loosecanvas/agent_tools.py

@@ -27,12 +27,23 @@ from typing import Any
 
 from langchain.tools import tool
 
-from loosecanvas.contracts import SceneAction, SceneActionType, ScenePlan, SceneState
+from loosecanvas.contracts import (
+    RendererCommand,
+    SceneAction,
+    SceneActionType,
+    ScenePlan,
+    SceneState,
+)
 from loosecanvas.turn_logic import (
     _AGENT_MAX_ACTIONS,
     _AGENT_MAX_REVEAL,
+    RendererPatch,
+    ReviewClaimResult,
     SessionRecord,
     TurnResult,
+    effective_edge_label,
+    review_edge_claim,
+    review_node_claim,
     session_store,
 )
 from loosecanvas.validator import validate_sceneplan
@@ -47,6 +58,7 @@ class AgentTurnContext:
     session_id: str
     accumulated_actions: list[SceneAction] = field(default_factory=list)
     activity: list[str] = field(default_factory=list)
+    review_patches: list[RendererPatch] = field(default_factory=list)
 
 
 _current_turn: ContextVar[AgentTurnContext | None] = ContextVar(
@@ -127,19 +139,36 @@ def _validate_and_accumulate(action: SceneAction, activity_label: str) -> str:
 
 @tool
 def get_canvas_state() -> str:
-    """Return a compact JSON snapshot: visible nodes/labels, fogged count, visible edge ids, selection.
-    Call this first to discover valid IDs before using any other tool."""
+    """Return a compact JSON snapshot of the canvas. Call this first to discover valid IDs.
+    Includes visible_nodes (id+label), visible_edges (id, source, target, current label —
+    use these to relabel a connection with update_edge), fogged_count, and selected_id.
+    """
     ctx = get_turn_context()
     record: SessionRecord = session_store[ctx.session_id]
     scene: SceneState = record.scene
+    claims = record.graph.claims.values()
     visible_nodes = []
     for nid in scene.visible_node_ids:
         node = record.graph.get_node(nid)
         label = node.label if node is not None else nid
         visible_nodes.append({"id": nid, "label": label})
+    visible_edges = []
+    for eid in scene.visible_edge_ids:
+        edge = record.graph.get_edge(eid)
+        if edge is None:
+            continue
+        visible_edges.append(
+            {
+                "id": eid,
+                "source": edge.source,
+                "target": edge.target,
+                "label": effective_edge_label(edge, claims),
+            }
+        )
     return json.dumps(
         {
             "visible_nodes": visible_nodes,
+            "visible_edges": visible_edges,
             "fogged_count": len(scene.fogged_node_ids),
             "visible_edge_ids": list(scene.visible_edge_ids),
             "selected_id": scene.selected_id,
@@ -334,6 +363,18 @@ def update_node(node_id: str, label: str = "", note: str = "") -> str:
     )
 
 
+@tool
+def update_edge(edge_id: str, label: str) -> str:
+    """Relabel an existing visible edge so the new, clearer label shows on the canvas.
+    Use this to make a connection more informative or descriptive. Requires edge_id
+    (call get_canvas_state to list visible_edges with their ids and current labels) and
+    a non-empty label."""
+    return _validate_and_accumulate(
+        SceneAction(type=SceneActionType.update_edge, edge_id=edge_id, label=label),
+        f"update_edge:{edge_id}",
+    )
+
+
 @tool
 def remove_node(node_id: str) -> str:
     """Remove a visible node from the graph (permanent).
@@ -379,6 +420,76 @@ def expand_around(node_id: str) -> str:
     return json.dumps({"status": "rejected", "reason": reason, "hint": hint})
 
 
+@tool
+def review_element(target_id: str, action: str) -> str:
+    """Accept or reject a model-inferred proposal (node or edge) awaiting review.
+
+    Call get_canvas_state first to discover valid node and edge ids on the canvas.
+    ``action`` must be "accepted" or "rejected".
+    Only works on model-inferred elements whose review badge (amber border) is still
+    showing — i.e. elements with review_state "pending".
+
+    Returns a JSON string with status, target_id, and the new review_state.
+    """
+    if action not in ("accepted", "rejected"):
+        return json.dumps(
+            {
+                "status": "error",
+                "reason": "action must be 'accepted' or 'rejected'",
+                "target_id": target_id,
+            }
+        )
+    ctx = get_turn_context()
+    record: SessionRecord | None = session_store.get(ctx.session_id)
+    if record is None:
+        return json.dumps(
+            {"status": "error", "reason": "session not found", "target_id": target_id}
+        )
+
+    # Determine whether target is a node or an edge and call the appropriate helper.
+    result: ReviewClaimResult | None
+    if target_id in record.graph.nodes:
+        try:
+            result = review_node_claim(ctx.session_id, target_id, action)
+        except Exception as exc:  # noqa: BLE001
+            return json.dumps(
+                {"status": "error", "reason": str(exc), "target_id": target_id}
+            )
+    elif target_id in record.graph.edges:
+        try:
+            result = review_edge_claim(ctx.session_id, target_id, action)
+        except Exception as exc:  # noqa: BLE001
+            return json.dumps(
+                {"status": "error", "reason": str(exc), "target_id": target_id}
+            )
+    else:
+        return json.dumps(
+            {
+                "status": "not_found",
+                "reason": f"no node or edge with id {target_id!r} — call get_canvas_state to see valid ids",
+                "target_id": target_id,
+            }
+        )
+
+    if result is None:
+        return json.dumps(
+            {
+                "status": "not_reviewable",
+                "reason": f"{target_id!r} has no model-inferred claims awaiting review",
+                "target_id": target_id,
+            }
+        )
+
+    ctx.review_patches.append(result.renderer_patch)
+    return json.dumps(
+        {
+            "status": "ok",
+            "target_id": target_id,
+            "review_state": result.review_state,
+        }
+    )
+
+
 # ── Exported tool list ─────────────────────────────────────────────────────────
 
 TOOLS: list[Any] = [
@@ -395,9 +506,11 @@ TOOLS: list[Any] = [
     create_node,
     create_edge,
     update_node,
+    update_edge,
     remove_node,
     remove_edge,
     expand_around,
+    review_element,
 ]
 
 
@@ -411,18 +524,67 @@ def finalize_agent_turn(
 ) -> TurnResult | None:
     """Validate accumulated actions, reduce, apply patches, and finalize the turn.
 
-    Returns ``None`` when no actions were accumulated (pure-speech turn — no canvas
-    patch).  Otherwise returns the ``TurnResult`` produced by the authoritative
-    validate→reduce→apply→_finalize_turn pipeline.
+    Returns ``None`` when no actions were accumulated AND no review patches exist
+    (pure-speech turn — no canvas patch).
+
+    When accumulated_actions is empty but review_patches is non-empty (the user only
+    asked to accept/reject something), builds a minimal TurnResult carrying the merged
+    review ops so the canvas updates.
+
+    Otherwise runs the authoritative validate→reduce→apply→_finalize_turn pipeline and
+    merges any review patch operations into the returned RendererPatch.
     """
     from loosecanvas.turn_logic import (
         apply_agent_actions,
     )  # imported here to avoid import-time circularity
 
     ctx = get_turn_context()
+    review_ops: list[RendererCommand] = [
+        op for rp in ctx.review_patches for op in rp.operations
+    ]
+
     if not ctx.accumulated_actions:
-        return None
-    record: SessionRecord = session_store[session_id]
-    return apply_agent_actions(
+        if not review_ops:
+            # Pure-speech turn: no canvas changes at all.
+            return None
+        # Review-only turn: build a minimal TurnResult with just the review ops.
+        record: SessionRecord = session_store[session_id]
+        record.patch_id += 1
+        patch = RendererPatch(
+            patch_id=record.patch_id,
+            is_snapshot=False,
+            scene_id=record.render_scene_id,
+            operations=review_ops,
+        )
+        return TurnResult(
+            renderer_patch=patch,
+            inspector_update=None,
+            assistant_message=assistant_message,
+            scene_patch=None,
+            status="success",
+            warnings=[],
+        )
+
+    record = session_store[session_id]
+    turn_result = apply_agent_actions(
         record, ctx.accumulated_actions, selection, assistant_message
     )
+    if not review_ops:
+        return turn_result
+
+    # Merge review ops into the returned patch (new patch_id, same scene/snapshot).
+    record.patch_id += 1
+    merged_patch = RendererPatch(
+        patch_id=record.patch_id,
+        is_snapshot=turn_result.renderer_patch.is_snapshot,
+        scene_id=turn_result.renderer_patch.scene_id,
+        operations=list(turn_result.renderer_patch.operations) + review_ops,
+    )
+    return TurnResult(
+        renderer_patch=merged_patch,
+        inspector_update=turn_result.inspector_update,
+        assistant_message=turn_result.assistant_message,
+        scene_patch=turn_result.scene_patch,
+        status=turn_result.status,
+        warnings=turn_result.warnings,
+    )

src/loosecanvas/contracts.py

@@ -215,7 +215,7 @@ class SuggestedPathway(BaseModel):
 
 
 class SceneActionType(StrEnum):
-    """The 15 ``SceneAction`` variants. Must serialize INLINE (no ``$ref``)."""
+    """The 16 ``SceneAction`` variants. Must serialize INLINE (no ``$ref``)."""
 
     # Visual actions (low-risk; no Claims created).
     center_on = "center_on"
@@ -234,6 +234,7 @@ class SceneActionType(StrEnum):
     remove_edge = "remove_edge"  # uses SceneAction.edge_id
     # User-edit actions (T2-03):
     update_node = "update_node"  # uses target_id + (label | note)
+    update_edge = "update_edge"  # uses edge_id + label (relabel an existing edge)
     create_edge = "create_edge"  # uses source_id + target_id + label
     # Graph-growth action: the agent proposes a NEW concept node (model_inferred).
     create_node = "create_node"  # uses target_id (new id) + label + note (summary)

src/loosecanvas/exporter.py

@@ -15,6 +15,16 @@ Trust filtering (guards against bug **R14** — user-confirmed inferences being
 
 ``open_question`` claims are routed to their own ``open_questions`` section, mapping
 ``Claim.text`` onto the output ``note`` key (``Claim`` has **no** ``note`` field).
+
+Topology redaction (guards against the **trust-gate leak** — unreviewed model guesses
+leaking as full topology): the same trust rule that filters claims also filters the
+``nodes`` and ``edges`` arrays. Dropping the claim alone is not enough — an unreviewed
+``model_inferred`` node (``create_node``) or edge (``find_connection``/``propose_hypothesis``)
+would otherwise still ship its full shape. Element trust is derived from its governing
+claims (claims whose ``target_id`` is the element id), falling back to the element's own
+``properties["origin"]`` / ``metadata["origin"]`` only when it has **no** governing claim
+(e.g. an element that is not yet claim-backed). After excluding nodes, any edge whose
+source or target was dropped is cascade-removed.
 """
 
 from __future__ import annotations
@@ -22,7 +32,7 @@ from __future__ import annotations
 from datetime import UTC, datetime
 from typing import Any
 
-from loosecanvas.contracts import Claim, MapEvent, SuggestedPathway
+from loosecanvas.contracts import Claim, Edge, MapEvent, Node, SuggestedPathway
 from loosecanvas.graph_repository import LooseGraphRepository
 
 SCHEMA_VERSION = "0.1.0"
@@ -46,6 +56,45 @@ def _include_claim(claim: Claim) -> bool:
     return False
 
 
+def _include_origin(origin: str, *, has_accepting_review: bool) -> bool:
+    """Trust decision for an element, mirroring :func:`_include_claim`.
+
+    ``deterministic``/``user_asserted`` always pass; ``model_inferred`` passes only when
+    an accepting review exists. Any unknown origin fails closed.
+    """
+    if origin in (_DETERMINISTIC_ORIGIN, _USER_ASSERTED_ORIGIN):
+        return True
+    if origin == _MODEL_INFERRED_ORIGIN:
+        return has_accepting_review
+    return False
+
+
+def _element_origin(element: Node | Edge) -> str:
+    """Best-effort origin for an element with no governing claim.
+
+    Producers disagree on where they stamp origin: ``_model_node``/``_hypothesis_edge``
+    use ``properties["origin"]`` while the seed fixture's nodes use ``metadata``. Check
+    both. Absent any stamp, treat as ``deterministic`` (extraction output is trusted).
+    """
+    origin = element.properties.get("origin")
+    if origin is None and isinstance(element, Node):
+        origin = element.metadata.get("origin")
+    return origin if origin is not None else _DETERMINISTIC_ORIGIN
+
+
+def _include_element(element: Node | Edge, governing: list[Claim]) -> bool:
+    """Return ``True`` if ``element`` (a node or edge) is trustworthy enough to export.
+
+    With governing claims: pass if **any** governing claim passes :func:`_include_claim`
+    (an accepting review on one claim promotes the element). Without governing claims:
+    fall back to the element's own stamped origin.
+    """
+    if governing:
+        return any(_include_claim(c) for c in governing)
+    origin = _element_origin(element)
+    return _include_origin(origin, has_accepting_review=False)
+
+
 async def export_session(
     graph: LooseGraphRepository,
     *,
@@ -58,16 +107,41 @@ async def export_session(
     The result is deterministic for a fixed input (aside from the ``created_at`` stamp)
     and round-trips through ``json.dumps``/``json.loads`` unchanged.
     """
-    nodes = [node.model_dump(mode="json") for node in graph.nodes.values()]
+    # Group governing claims by the id they target so element trust can aggregate them.
+    claims_by_target: dict[str, list[Claim]] = {}
+    for claim in graph.claims.values():
+        claims_by_target.setdefault(claim.target_id, []).append(claim)
+
+    # Topology redaction: drop unreviewed model inferences at the artifact level, then
+    # cascade-drop any edge whose endpoint was excluded.
+    kept_node_ids: set[str] = {
+        node.id
+        for node in graph.nodes.values()
+        if _include_element(node, claims_by_target.get(node.id, []))
+    }
+    nodes = [
+        node.model_dump(mode="json")
+        for node in graph.nodes.values()
+        if node.id in kept_node_ids
+    ]
     edges = [
-        edge.model_dump(mode="json", by_alias=True) for edge in graph.edges.values()
+        edge.model_dump(mode="json", by_alias=True)
+        for edge in graph.edges.values()
+        if edge.source in kept_node_ids
+        and edge.target in kept_node_ids
+        and _include_element(edge, claims_by_target.get(edge.id, []))
     ]
 
     claims: list[dict[str, Any]] = []
     open_questions: list[dict[str, str]] = []
     for claim in graph.claims.values():
         if claim.claim_type == _OPEN_QUESTION_TYPE:
-            open_questions.append({"target_id": claim.target_id, "note": claim.text})
+            # Open questions are also trust-gated: an unreviewed model_inferred question
+            # (reducer._question_claim mints exactly that) must not leak.
+            if _include_claim(claim):
+                open_questions.append(
+                    {"target_id": claim.target_id, "note": claim.text}
+                )
             continue
         if _include_claim(claim):
             claims.append(claim.model_dump(mode="json"))

src/loosecanvas/extractors/fixture_adapter.py

@@ -38,9 +38,18 @@ def load_fixture_from_dict(data: dict[str, Any]) -> tuple[LooseGraph, SceneState
     """Validate an inline fixture ``dict`` into ``(LooseGraph, SceneState)``.
 
     The explicit ``scene`` is read verbatim — no auto-curation (M12) is performed.
+
+    A corrupt/partial fixture (missing the top-level ``graph`` or ``scene`` key) raises
+    ``ValueError`` — NOT a bare ``KeyError``. ``/api/load_graph`` maps ``ValueError`` to
+    HTTP 400 (a ``KeyError`` would surface as an opaque 500), and on_seed's resilience
+    handler treats it as a normal load failure and falls back instead of crashing.
     """
-    graph = LooseGraph.model_validate(data["graph"])
-    scene = SceneState.model_validate(data["scene"])
+    raw_graph = data.get("graph")
+    raw_scene = data.get("scene")
+    if raw_graph is None or raw_scene is None:
+        raise ValueError("fixture missing graph/scene")
+    graph = LooseGraph.model_validate(raw_graph)
+    scene = SceneState.model_validate(raw_scene)
     return graph, scene
 
 

src/loosecanvas/extractors/text_graph_adapter.py

@@ -72,18 +72,34 @@ _ALLOWED_EDGE_KINDS: frozenset[str] = frozenset(
 _SLUG_RE = re.compile(r"[^a-z0-9_]+")
 
 _SYSTEM_PROMPT = """\
-Read this text and identify the key concepts and the relationships between them.
-Return a JSON object only. No prose outside the JSON.
+Read this text and build a clear, genuinely useful concept map: the key ideas and how
+they connect. Return a JSON object only. No prose outside the JSON.
+
 Schema:
 {
   "concept_nodes": [{"id": "concept::<snake_case>", "label": "<Name>",
                      "summary": "<1 sentence>", "start_char": <int>, "end_char": <int>}],
   "semantic_edges": [{"source_id": "concept::<...>", "target_id": "concept::<...>",
                       "type": "explains|prerequisite_of|contradicts|related_to|mentions",
-                      "label": "<short label>"}]
+                      "label": "<relationship phrase>"}]
 }
-start_char/end_char are character offsets into the provided text marking where the
-concept is introduced. All edge source_id/target_id must reference a concept id.\
+
+Quality bar — write it for a human reader, not a parser:
+- NODE label: the specific, recognizable name of the concept the way a person would say
+  it — a concrete noun phrase in Title Case ("Retrieval-Augmented Generation", "Local AI",
+  "llama.cpp"), preferring the exact term the text uses. Never a vague umbrella word, a
+  whole sentence, or a bare fragment. The id is that same name in snake_case.
+- NODE summary: one plain, informative sentence saying what the concept actually is.
+- EDGE label: a short, SPECIFIC phrase describing how source relates to target, written so
+  it reads naturally as "source <label> target" — e.g. "grounds answers in your documents",
+  "runs models offline through", "adapts a base model to your domain". Do NOT fall back on
+  empty connectors like "uses", "related to", "is part of", or the bare relationship type
+  when the text supports something more precise. Every edge needs a descriptive label.
+- "type" is the relationship CATEGORY (it picks the arrow); "label" is the human-readable
+  detail. They are different — never just copy the type into the label.
+
+start_char/end_char are character offsets into the provided text marking where the concept
+is introduced. Every edge source_id/target_id must reference a concept id you listed.\
 """
 
 _TEXT_GRAPH_SCHEMA: dict[str, Any] = {
@@ -114,7 +130,10 @@ _TEXT_GRAPH_SCHEMA: dict[str, Any] = {
                     "type": {"type": "string", "enum": sorted(_ALLOWED_EDGE_KINDS)},
                     "label": {"type": "string"},
                 },
-                "required": ["source_id", "target_id", "type"],
+                # ``label`` is required so the grammar always emits a descriptive
+                # relationship phrase — a blank edge label renders as a bare line and
+                # is exactly the "generic/uninformative edges" problem we're fixing.
+                "required": ["source_id", "target_id", "type", "label"],
                 "additionalProperties": False,
             },
         },
@@ -375,11 +394,11 @@ def _ingest_edge(
             id=claim_id,
             claim_type=_SEMANTIC_EDGE_CLAIM,
             source_id=src,
-            target_id=tgt,
+            target_id=edge_id,
             text=kind,
             origin=_MODEL_INFERRED,
             support_state=_UNVERIFIED,
-            evidence_refs=[_chunk_span_evidence(chunk, source_id, tgt)],
+            evidence_refs=[_chunk_span_evidence(chunk, source_id, edge_id)],
         )
 
 

src/loosecanvas/graph_repository.py

@@ -212,15 +212,29 @@ class LooseGraphRepository:
             else patch.set_selected_id
         )
 
+        # ``set_highlighted_ids`` is "unset" when empty (the real producer, reducer.py,
+        # only assigns a NON-empty list — ``if highlighted:``). Mirror ``selected_id``:
+        # preserve the existing highlight when unset, override when explicitly set. Else a
+        # benign turn after a search would wipe the highlight (diff_scene → remove_class).
+        highlighted_ids = (
+            list(scene.highlighted_ids)
+            if not patch.set_highlighted_ids
+            else list(patch.set_highlighted_ids)
+        )
+
         return SceneState(
             scene_id=scene.scene_id,
             visible_node_ids=visible_nodes,
             visible_edge_ids=visible_edges,
             fogged_node_ids=fogged_nodes,
-            highlighted_ids=list(patch.set_highlighted_ids),
+            highlighted_ids=highlighted_ids,
             selected_id=selected_id,
             callouts=callouts,
             node_positions=dict(scene.node_positions),
+            # ``ScenePatch`` has no cluster slot — cluster colours live on the scene and
+            # are recomputed only by the 'Colour clusters' path; carry them forward so a
+            # later turn never drops them (diff_scene → remove_class cluster-N).
+            node_cluster_map=dict(scene.node_cluster_map),
         )
 
     # ── Fog replenishment (own adjacency only; no NetworkX, no M12) ───────────

src/loosecanvas/main.py

@@ -29,6 +29,7 @@ from loosecanvas.agent_harness import (
     TokenEvent,
     ToolActivityEvent,
     run_agent_turn_streaming,
+    stream_build_opener,
 )
 from loosecanvas.contracts import RendererCommand
 from loosecanvas.llm_client import LLMClient
@@ -40,6 +41,7 @@ from loosecanvas.turn_logic import (
     _commit_snapshot,
     apply_user_edge,
     apply_user_edit,
+    find_connection_session,
     inspector_for_selection,
     load_fixture_session,
     load_repo_session,
@@ -49,8 +51,8 @@ from loosecanvas.turn_logic import (
     push_focus,
     redo_turn,
     save_session,
+    session_locks,
     session_store,
-    stream_text_session,
     undo_turn,
 )
 
@@ -59,7 +61,105 @@ _WORKSPACE_ROOT = Path(__file__).resolve().parents[2]
 _FIXTURES: dict[str, Path] = {
     "annotated_graph": _WORKSPACE_ROOT / "fixtures" / "annotated_graph.json",
     "small_graph": _WORKSPACE_ROOT / "fixtures" / "small_graph.json",
+    "seed_local_ai": _WORKSPACE_ROOT / "fixtures" / "seed_local_ai.json",
 }
+# Open-world entry seeds this graph on page load (zero-LLM sync path) so a cold
+# model never paints an empty canvas. on_seed falls back to annotated_graph until
+# the baked hackathon-meta seed (seed_local_ai.json) exists, so this is safe to
+# point at the baked seed before the file lands — it upgrades on the next restart.
+_SEED_FIXTURE_NAME = "seed_local_ai"
+
+# Open-world entry: the composer is PREFILLED with this editable seed text and the canvas
+# starts empty. The first Send builds a graph FROM this text (on_turn's no-session branch
+# runs Gemma extraction) — edit it and you get a different map; the non-determinism is the
+# point. Kept short enough to extract fast and rich enough to yield a few linked concepts.
+_SEED_TEXT = (
+    "Local AI puts the whole stack on your own machine: open-weight models like Gemma "
+    "run offline through llama.cpp, so your data never leaves the room. "
+    "Retrieval-augmented generation grounds answers in your own documents, agents call "
+    "tools to act on them, and fine-tuning adapts a base model to your domain. "
+    "The thread tying them together is sovereignty: you own the model, the data, and "
+    "the meaning you build from them."
+)
+
+# Friendly onboarding copy shown when seeding can't paint a starter map (e.g. every
+# fixture is missing/corrupt). NEVER leaks 'session_cap' or a stack trace, and never
+# leaves the "Building your starter map…" banner stuck over an empty canvas.
+_SEED_FALLBACK_MESSAGE = (
+    "**loosecanvas** — the local AI proposes, you decide. "
+    "Your starter map isn't available right now, but you can begin: "
+    "tell me what you're trying to map and I'll start sketching it with you."
+)
+
+
+def _evict_lru_session() -> bool:
+    """Evict the single least-recently-seen session (smallest ``last_seen``).
+
+    Drops the record AND its paired lock together (mirrors ``_evict_stale_sessions``).
+    Returns ``True`` if a session was evicted, ``False`` if the store was already empty.
+
+    The alternate loaders (``load_fixture_session`` et al.) raise
+    ``OverflowError("session_cap")`` at capacity. The existing eviction is TTL-only, so
+    a store full of FRESH sessions hard-rejects a new visitor — bricking the open-world
+    seed-on-load entry. Evicting the LRU session here makes room so a fresh visitor
+    ALWAYS gets a seeded canvas (mirrors a classic LRU cache under pressure).
+    """
+    if not session_store:
+        return False
+    victim = min(session_store, key=lambda sid: session_store[sid].last_seen)
+    session_store.pop(victim, None)
+    session_locks.pop(victim, None)
+    return True
+
+
+async def _seed_snapshot() -> tuple[Any, str, str]:
+    """Resolve the seed-on-load snapshot resiliently. Returns
+    ``(renderer_value, session_id, onboarding_message)``.
+
+    Resilience contract (adversarial-QA hardened):
+
+    * **Session cap** — on ``OverflowError("session_cap")`` evict the LRU session and
+      retry, so a busy HF Space always seeds a fresh visitor instead of leaving an empty
+      canvas + a leaked 'session_cap' toast.
+    * **Missing/corrupt seed** — fall back from the configured seed fixture to the
+      shipped ``annotated_graph`` on ANY load failure (not only ``not path.exists()``;
+      a partial/corrupt JSON now raises ``ValueError`` rather than ``KeyError``).
+    * **Total failure** — if nothing loads, return an empty-but-valid ``RendererPatch``
+      snapshot + a FRIENDLY onboarding message; never crash, never leak internals, never
+      leave the "Building…" banner stuck over a blank canvas.
+    """
+    # Candidate fixtures in preference order, de-duped (seed may equal the fallback).
+    candidates: list[Path] = []
+    for name in (_SEED_FIXTURE_NAME, "annotated_graph"):
+        path = _FIXTURES.get(name)
+        if path is not None and path not in candidates:
+            candidates.append(path)
+
+    for path in candidates:
+        if not path.exists():
+            continue
+        # One retry budget per fixture for the cap: evict LRU, then try again.
+        for attempt in range(2):
+            try:
+                sid, snapshot = await load_fixture_session(fixture_path=path)
+                return snapshot.model_dump(), sid, ""
+            except OverflowError:
+                # Session cap: make room and retry once. If nothing could be evicted
+                # (store somehow empty), stop retrying this fixture.
+                if attempt == 0 and _evict_lru_session():
+                    continue
+                break
+            except Exception:  # corrupt/partial fixture, path error, etc.
+                logger.exception("seed-on-load failed for fixture %s", path)
+                break  # try the next candidate fixture
+
+    # Nothing loaded: empty-but-valid snapshot + friendly onboarding (no leaked cap).
+    logger.warning("seed-on-load exhausted all fixtures; serving empty starter canvas")
+    empty = RendererPatch(
+        patch_id=0, is_snapshot=True, scene_id="empty-seed", operations=[]
+    )
+    return empty.model_dump(), "", _SEED_FALLBACK_MESSAGE
+
 
 # Public-Space safety: cap pasted/loaded text so one request can't monopolize the
 # single (--parallel 1) GPU slot. ~100 KB is generous for an article paste; the
@@ -208,6 +308,21 @@ def _tool_receipt_messages(activity: list[str]) -> list[dict[str, Any]]:
     return messages
 
 
+def _tool_steplist_message(steps: list[str], status: str) -> dict[str, Any]:
+    """Return a Gradio collapsible thought-panel message showing live tool steps.
+
+    ``steps`` is the ordered list of friendly tool-activity labels accumulated so far.
+    ``status`` is ``"pending"`` (spinner, panel open mid-turn) or ``"done"`` (closed).
+    An empty ``steps`` list produces a placeholder bullet so the panel is never blank.
+    """
+    lines = [f"- {s}" for s in steps] if steps else ["- Working…"]
+    return {
+        "role": "assistant",
+        "content": "\n".join(lines),
+        "metadata": {"title": "Working…", "status": status},
+    }
+
+
 async def _search_nodes(session_id: str, query: str, limit: int = 50) -> dict[str, Any]:
     """Shared fog-aware search core. Pure-read; never mutates session state."""
     limit = max(0, min(limit, _SEARCH_LIMIT_CAP))
@@ -471,6 +586,13 @@ _CSS = """
     padding: 0.5rem;
     opacity: 0.7;
 }
+/* Consequence copy under the Export button: reads as quiet helper text, not a heading. */
+.lc-export-note {
+    text-align: center;
+    opacity: 0.6;
+    font-size: 0.8rem;
+    margin-top: 0.15rem;
+}
 /* ── P0-03: CSS-grid layout shell ──────────────────────────────────── */
 /* Expand the Gradio app container to full viewport width */
 .gradio-container {
@@ -485,17 +607,20 @@ _CSS = """
 /* Gradio wraps custom components in a <span> — that span is the actual flex item,
    not #lc-canvas itself. Target it directly to defeat the 25%/75% default split. */
 #lc-canvas-row > span {
-    flex: 1 1 64% !important;
+    flex: 1 1 100% !important;
     min-width: 0 !important;
 }
-/* Right rail (inspector + chat). Height is a FIXED px value, never vh — see the
-   canvas rule below for why. overflow-y lets the rail scroll if its content is tall. */
+/* Slim inspector rail (the LIGHT path — chat is now a co-equal hero below the canvas,
+   not in this rail). Height is a FIXED px value, never vh — see the canvas rule below
+   for why. overflow-y lets the rail scroll if its content is tall. */
 #lc-inspector-col {
-    flex: 0 0 34% !important;
+    flex: 0 0 26% !important;
     min-width: 0 !important;
     overflow-y: auto;
     max-height: 540px;
 }
+/* Chat + composer are full-width heroes under the canvas. */
+#lc-chat-row, #lc-composer-row { width: 100%; }
 /* Cap the inspector JSON so the chat below it stays on screen; it scrolls if a node
    has many claims. */
 #lc-inspector { max-height: 150px; overflow: auto; }
@@ -565,8 +690,11 @@ _HEADER_HTML = """
 
 # Trust legend. The SVG swatches MUST match renderer.ts's origin→shape rules
 # (round-rectangle/solid = deterministic, ellipse/solid-green = user-asserted,
-# hexagon/dashed = model-inferred, + amber pie-dot = review-pending) so the on-canvas
-# encoding is decodable at a glance instead of only on hover.
+# hexagon/dashed-indigo = model-inferred, + AMBER dashed border = awaiting-review)
+# so the on-canvas encoding is decodable at a glance instead of only on hover.
+# The awaiting-review swatch mirrors the .review-pending.origin-model-inferred rule
+# (amber dashed border + gentle pulse) — NOT a corner dot (Cytoscape pies centre under
+# the label and were invisible); keep this swatch in sync with that stylesheet rule.
 _LEGEND_HTML = """
 <div class="lc-legend" role="note" aria-label="Trust legend">
   <span class="lc-legend-title">Trust map</span>
@@ -594,8 +722,7 @@ _LEGEND_HTML = """
   <span class="lc-legend-item">
     <svg class="lc-legend-svg" width="26" height="22" aria-hidden="true">
       <polygon points="13,2 22,7 22,15 13,20 4,15 4,7"
-               fill="#3b5bdb" stroke="#748ffc" stroke-width="2" stroke-dasharray="3 2"/>
-      <circle cx="21" cy="4" r="3.6" fill="#f59e0b"/>
+               fill="#3b5bdb" stroke="#f59e0b" stroke-width="2.5" stroke-dasharray="3 2"/>
     </svg>
     Awaiting your review
   </span>
@@ -651,6 +778,20 @@ async def on_search(q: str, sid: str) -> tuple[dict[str, Any], list[dict[str, An
                 )
             )
         record.scene.highlighted_ids = vis_ids
+    else:
+        # No visible matches → clear any PRIOR search dim/highlight so a stale match
+        # from a previous query doesn't stay lit (QA: 'Ret' then a no-match term left
+        # the old highlight + dim stuck). Mirrors the empty-query reset above.
+        ops2.append(RendererCommand(op="clear_dim"))
+        for nid in record.scene.highlighted_ids:
+            ops2.append(
+                RendererCommand(
+                    op="remove_class",
+                    selector=f"#{nid}",
+                    data={"class": "highlighted"},
+                )
+            )
+        record.scene.highlighted_ids = []
 
     record.patch_id += 1
     patch2 = RendererPatch(
@@ -784,28 +925,10 @@ def build_app() -> tuple[Any, Any]:
         session_id = gr.State()
         current_selection = gr.State({"kind": "none", "id": ""})
 
-        with gr.Row():
-            fixture_dropdown = gr.Dropdown(
-                choices=list(_FIXTURES.keys()),
-                value="annotated_graph",
-                label="Fixture",
-                scale=3,
-            )
-            load_btn = gr.Button("Load graph", scale=1)
-
-        with gr.Accordion("Build from text (Gemma)", open=False):
-            text_title = gr.Textbox(
-                label="Title",
-                placeholder="e.g. Gradient Descent",
-                value="Pasted text",
-            )
-            text_content = gr.Textbox(
-                label="Content",
-                placeholder="Paste prose, notes, or an article — Gemma extracts a "
-                "concept graph (requires the LLM server).",
-                lines=8,
-            )
-            build_btn = gr.Button("Build graph from text", variant="primary")
+        # Open-world entry: no fixture picker, no "build from text" accordion. The
+        # canvas is seeded on load (demo.load -> on_seed) and the user shapes it by
+        # chatting — "chat in, spatial review out". (The text->graph path still lives
+        # in turn_logic.stream_text_session + the /api build route; just not in the UI.)
 
         # P0-03 + whitespace reclaim: canvas (left) shares one row with a right rail
         # holding the inspector + chat, so the canvas and the conversation are on
@@ -813,15 +936,17 @@ def build_app() -> tuple[Any, Any]:
         # dead band. CSS flex gives canvas ~64% / rail ~34% (defeating Gradio's
         # min-width collapse); Index.svelte's ResizeObserver re-fits the canvas.
         onboarding = gr.Markdown(
-            "**loosecanvas** — paste text above and click *Build graph from text* to create a "
-            "knowledge graph, or load a fixture below.",
+            "**loosecanvas** — the local AI proposes, you decide.  "
+            "✏️ The text below is a starting point — edit it however you like, then press "
+            "**Send** to grow a knowledge graph from it. Nothing is built until you do.",
             visible=True,
             elem_classes=["lc-onboarding"],
         )
         gr.HTML(_LEGEND_HTML)
+        # The graph is the hero; the inspector is a slim LIGHT-path rail beside it.
         with gr.Row(elem_id="lc-canvas-row"):
             canvas = CytoscapeCanvas(elem_id="lc-canvas")
-            with gr.Column(scale=3, elem_id="lc-inspector-col"):
+            with gr.Column(scale=1, elem_id="lc-inspector-col", visible=False):
                 inspector = gr.JSON(label="Inspector", elem_id="lc-inspector")
                 gr.Markdown(
                     "*Select a node to see where each claim came from and whether "
@@ -834,25 +959,46 @@ def build_app() -> tuple[Any, Any]:
                     reject_btn = gr.Button("✗ Reject", variant="secondary", scale=1)
                     dispute_btn = gr.Button("? Dispute", variant="secondary", scale=1)
                 claim_review_status = gr.Markdown("", visible=False)
-                chatbot = gr.Chatbot(label="Assistant", height=220, elem_id="lc-chat")
-                with gr.Row():
-                    msg = gr.Textbox(
-                        placeholder="Ask about the graph…",
-                        scale=8,
-                        show_label=False,
-                        # A1: keep lines=1 so Enter still submits (no Enter-semantics
-                        # regression), but auto-grow up to 6 lines for a pasted paragraph.
-                        lines=1,
-                        max_lines=6,
-                        autofocus=True,
-                    )
-                    send_btn = gr.Button("Send", scale=1)
+        # Chat is the second hero: a full-width row under the canvas (not tucked in the
+        # inspector rail), so "chat in, spatial review out" reads at a glance. The
+        # composer is PREFILLED with editable seed text — the first Send builds the map.
+        with gr.Row(elem_id="lc-chat-row"):
+            chatbot = gr.Chatbot(label="Assistant", height=360, elem_id="lc-chat")
+        with gr.Row(elem_id="lc-composer-row"):
+            msg = gr.Textbox(
+                value=_SEED_TEXT,
+                placeholder="Describe a topic, then press Send to grow a map…",
+                scale=8,
+                show_label=False,
+                # Multi-line so the seed paragraph is comfortably editable; Enter still
+                # submits (Shift+Enter for a newline).
+                lines=3,
+                max_lines=10,
+                autofocus=True,
+            )
+            send_btn = gr.Button("Send", variant="primary", scale=1)
         status_md = gr.Markdown(value="", elem_classes=["lc-turn-status"])
+        # Time-travel (undo/redo/back) + search are hidden for now — they don't fit the
+        # chat+graph paradigm. The handlers + wiring stay intact (flip visible=True to
+        # restore); see on_undo/on_redo/on_back and test_time_travel_output_arity.
         with gr.Row():
-            undo_btn = gr.Button("↩ Undo", scale=1)
-            redo_btn = gr.Button("↪ Redo", scale=1)
+            undo_btn = gr.Button("↩ Undo", scale=1, visible=False)
+            redo_btn = gr.Button("↪ Redo", scale=1, visible=False)
             cluster_btn = gr.Button("🎨 Colour clusters", scale=1)
-        with gr.Row():
+            # On-demand "surprising knowledge": propose a cross-cluster link the
+            # structure implies but no edge yet states. Never auto-applied — it
+            # lands as an amber model proposal you accept or reject.
+            find_conn_btn = gr.Button("✨ Find a hidden connection", scale=1)
+            # Export is the trust-gate payoff: the exporter drops model_inferred
+            # claims you haven't accepted, so the file is exactly what you vouched for.
+            export_btn = gr.DownloadButton(
+                "⬇ Export map", scale=1, elem_classes=["lc-export-btn"]
+            )
+        gr.Markdown(
+            "*Export carries only the facts you've accepted — unreviewed AI guesses stay out.*",
+            elem_classes=["lc-export-note"],
+        )
+        with gr.Row(visible=False):  # search/back hidden for now (kept wired)
             search_box = gr.Textbox(
                 placeholder="Search graph nodes…",
                 scale=9,
@@ -869,98 +1015,129 @@ def build_app() -> tuple[Any, Any]:
 
         # ── Handlers ──────────────────────────────────────────────────────────
 
-        async def on_load_graph(
-            fixture_name: str,
-        ) -> tuple[Any, str, Any]:
-            path = _FIXTURES.get(fixture_name, _FIXTURES["annotated_graph"])
-            sid, snapshot = await load_fixture_session(fixture_path=path)
-            return snapshot.model_dump(), sid, gr.update(visible=False)
-
-        async def on_build_text(content: str, title: str) -> AsyncGenerator[Any]:
-            # P2-02 streamed build: a status appears immediately (UI not frozen for
-            # the ~15-30s extraction), then the graph snaps in on completion. The six
-            # outputs, in order, are canvas, session_id, chatbot, onboarding, status_md
-            # and text_content. The canvas is left untouched until the final success
-            # event so a partial or error frame never clears it; A4 clears text_content
-            # only on a successful build.
-            if not content or not content.strip():
-                yield (
-                    gr.update(),
-                    "",
-                    [
-                        {
-                            "role": "assistant",
-                            "content": "⚠️ Paste some text first, then click Build.",
-                        }
-                    ],
-                    gr.update(),
-                    "",
-                    gr.update(),
-                )
-                return
-            if len(content) > _MAX_TEXT_LEN:
-                yield (
-                    gr.update(),
-                    "",
-                    [
-                        {
-                            "role": "assistant",
-                            "content": (
-                                f"⚠️ That text is too long (>{_MAX_TEXT_LEN:,} chars). "
-                                "Please shorten it and try again."
-                            ),
-                        }
-                    ],
-                    gr.update(),
-                    "",
-                    gr.update(),
-                )
-                return
-            async for prog in stream_text_session(
-                content, title or "Pasted text", LLMClient()
-            ):
-                if prog.is_partial:
+        async def on_open() -> tuple[Any, str, Any]:
+            """Open-world entry: paint an EMPTY canvas and leave the editable seed text in
+            the composer. No graph is built until the user presses Send — then on_turn's
+            no-session branch runs Gemma extraction on whatever text is there (the magic).
+
+            Returns ``(empty snapshot, empty session id, invitation banner)``. The empty
+            session id routes the first Send into the build branch; seeing the graph
+            appear from your own words is the moment that sells 'chat in, map out'."""
+            empty = RendererPatch(
+                patch_id=0,
+                is_snapshot=True,
+                scene_id="open-world-empty",
+                operations=[],
+            )
+            return empty.model_dump(mode="json"), "", gr.update(visible=True)
+
+        async def on_turn(
+            message: str, sid: str, selection: dict[str, Any], history: list[Any]
+        ) -> AsyncGenerator[Any]:
+            # Outputs: [canvas, inspector, chatbot, msg, status_md, send_btn,
+            #           session_id, onboarding]. The last two are set ONLY by the
+            #           no-session "magic build" branch below; normal turns pass them
+            #           through unchanged (the same sid + a no-op onboarding update).
+            if not sid:
+                # MAGIC BUILD: no graph yet → the composer text IS the seed. Gemma
+                # extracts a graph from it (non-deterministic — edit the text, get a
+                # different map). Stream a growing-state, then the built snapshot + the
+                # new session id, and retire the onboarding banner. The text→graph path
+                # lives in turn_logic.stream_text_session (lazy-imported like the others).
+                from loosecanvas.turn_logic import stream_text_session
+
+                if not message.strip():
                     yield (
                         gr.update(),
                         gr.update(),
                         gr.update(),
                         gr.update(),
-                        f"⏳ {prog.status}",
+                        "✏️ Add or edit some text, then press Send to grow your map.",
                         gr.update(),
-                    )
-                elif prog.is_error:
-                    yield (
-                        gr.update(),
-                        gr.update(),
-                        prog.chat_message,
-                        gr.update(),
-                        "",
+                        sid,
                         gr.update(),
                     )
-                else:
-                    yield (
-                        prog.canvas_patch,
-                        prog.session_id,
-                        prog.chat_message,
-                        gr.update(visible=False),
-                        "",
-                        gr.update(value=""),  # A4: clear the source textarea
-                    )
-
-        async def on_turn(
-            message: str, sid: str, selection: dict[str, Any], history: list[Any]
-        ) -> AsyncGenerator[Any]:
-            # Outputs: [canvas, inspector, chatbot, msg, status_md, send_btn].
-            if not sid:
-                # A3: preserve the draft — warn in status, don't commit to history.
+                    return
+                base_history = list(history) + [{"role": "user", "content": message}]
                 yield (
                     gr.update(),
                     gr.update(),
-                    gr.update(),
-                    gr.update(),
-                    "⚠️ No graph loaded yet — load one first.",
+                    base_history,
+                    gr.update(interactive=False),
+                    "🌱 Growing your map from your text…",
+                    gr.update(interactive=False),
+                    sid,
                     gr.update(),
                 )
+                async for prog in stream_text_session(
+                    message, "Your text", LLMClient()
+                ):
+                    if prog.is_partial:
+                        yield (
+                            gr.update(),
+                            gr.update(),
+                            gr.update(),
+                            gr.update(interactive=False),
+                            prog.status or "Calling Gemma…",
+                            gr.update(interactive=False),
+                            sid,
+                            gr.update(),
+                        )
+                    elif prog.is_error:
+                        # Build failed (e.g. LLM down) → surface in chat, keep the text
+                        # for a retry, leave the session empty + the banner up.
+                        yield (
+                            gr.update(),
+                            gr.update(),
+                            base_history + list(prog.chat_message),
+                            gr.update(interactive=True),
+                            "",
+                            gr.update(interactive=True),
+                            sid,
+                            gr.update(),
+                        )
+                    else:
+                        # Success → paint the built graph, adopt the new session id,
+                        # and retire the invitation banner FIRST (the map appears),
+                        # then stream a warm, agent-voiced opening line into the chat
+                        # so turn one reads like every later turn instead of a canned
+                        # summary. Keep the composer disabled until the opener finishes.
+                        new_sid = prog.session_id or sid
+                        yield (
+                            prog.canvas_patch or gr.update(),
+                            gr.update(),
+                            gr.update(),
+                            gr.update(interactive=False),
+                            "",
+                            gr.update(interactive=False),
+                            new_sid,
+                            gr.update(visible=False),
+                        )
+                        opener = ""
+                        async for tok in stream_build_opener(new_sid):
+                            opener += tok
+                            yield (
+                                gr.update(),
+                                gr.update(),
+                                base_history
+                                + [{"role": "assistant", "content": opener}],
+                                gr.update(interactive=False),
+                                gr.update(),
+                                gr.update(interactive=False),
+                                new_sid,
+                                gr.update(visible=False),
+                            )
+                        # Finalize turn one: clear the composer and re-enable Send.
+                        yield (
+                            gr.update(),
+                            gr.update(),
+                            base_history + [{"role": "assistant", "content": opener}],
+                            gr.update(value="", interactive=True),
+                            "",
+                            gr.update(interactive=True),
+                            new_sid,
+                            gr.update(visible=False),
+                        )
                 return
             base_history = list(history) + [{"role": "user", "content": message}]
             # A2: disable the composer + Send for the turn; keep the text visible.
@@ -971,15 +1148,27 @@ def build_app() -> tuple[Any, Any]:
                 gr.update(interactive=False),
                 "Thinking…",
                 gr.update(interactive=False),
+                sid,
+                gr.update(),
             )
             reply = ""
+            step_labels: list[str] = []
             try:
                 async for ev in run_agent_turn_streaming(sid, selection, message):
                     if isinstance(ev, TokenEvent):
                         reply += ev.text
-                        streaming_history = base_history + [
-                            {"role": "assistant", "content": reply}
-                        ]
+                        # Build streaming history: if steps are accumulating, keep the
+                        # live step-list bubble followed by the partial prose bubble so
+                        # both are visible mid-turn.
+                        if step_labels:
+                            streaming_history = list(base_history) + [
+                                _tool_steplist_message(step_labels, "pending"),
+                                {"role": "assistant", "content": reply},
+                            ]
+                        else:
+                            streaming_history = base_history + [
+                                {"role": "assistant", "content": reply}
+                            ]
                         yield (
                             gr.update(),
                             gr.update(),
@@ -987,15 +1176,23 @@ def build_app() -> tuple[Any, Any]:
                             gr.update(),
                             gr.update(),
                             gr.update(),
+                            sid,
+                            gr.update(),
                         )
                     elif isinstance(ev, ToolActivityEvent):
+                        # Accumulate the friendly step label and yield a live collapsible
+                        # step-list bubble in the chatbot; also update the status strip.
+                        step_labels.append(ev.message)
                         yield (
                             gr.update(),
                             gr.update(),
-                            gr.update(),
+                            list(base_history)
+                            + [_tool_steplist_message(step_labels, "pending")],
                             gr.update(),
                             ev.message,
                             gr.update(),
+                            sid,
+                            gr.update(),
                         )
                     elif isinstance(ev, FinalEvent):
                         reply = ev.assistant_message or reply
@@ -1005,6 +1202,8 @@ def build_app() -> tuple[Any, Any]:
                             prefix = f"{reply}\n\n" if reply else ""
                             reply = f"{prefix}⚠️ Some actions were rejected: {reasons}"
                         tool_receipts = _tool_receipt_messages(ev.tool_activity)
+                        # Drop the pending step-list bubble: final history starts clean
+                        # from base_history (user message only) then appends prose + receipts.
                         final_history = list(base_history)
                         if reply:
                             final_history.append(
@@ -1032,6 +1231,8 @@ def build_app() -> tuple[Any, Any]:
                             gr.update(value="", interactive=True),
                             "",
                             gr.update(interactive=True),
+                            sid,
+                            gr.update(),
                         )
             except Exception as exc:  # noqa: BLE001
                 error_history = base_history + [
@@ -1045,6 +1246,8 @@ def build_app() -> tuple[Any, Any]:
                     gr.update(interactive=True),
                     "",
                     gr.update(interactive=True),
+                    sid,
+                    gr.update(),
                 )
 
         async def on_select(
@@ -1204,6 +1407,126 @@ def build_app() -> tuple[Any, Any]:
                         pass
                 return {"kind": "none", "id": ""}, None, {}, gr.update(visible=False)
 
+            if kind == "review_edge" and sid:
+                # B2 radial-cxtmenu: Accept/Reject fired on an EDGE → transition the
+                # edge's first actionable governing claim. Mirrors the kind=='review'
+                # branch above. Payload: {kind:'review_edge', id:<edge_id>,
+                # action:'accepted'|'rejected'|'disputed'}.
+                from loosecanvas.claim_state_machine import InvalidTransitionError
+                from loosecanvas.turn_logic import review_edge_claim
+
+                edge_id = str(raw.get("id", ""))
+                action = str(raw.get("action", ""))
+                if edge_id and action in {"accepted", "rejected", "disputed"}:
+                    try:
+                        review_result = review_edge_claim(sid, edge_id, action)
+                    except (KeyError, InvalidTransitionError):
+                        review_result = None
+                    if review_result is not None:
+                        sel = {"kind": "edge", "id": edge_id}
+                        has_claims = bool(
+                            review_result.inspector.get("governing_claims")
+                            if review_result.inspector is not None
+                            else []
+                        )
+                        return (
+                            sel,
+                            review_result.inspector,
+                            review_result.renderer_patch.model_dump(mode="json"),
+                            gr.update(visible=has_claims),
+                        )
+                # Graceful no-op: refresh the edge inspector without mutating the graph.
+                sel = {"kind": "edge", "id": edge_id}
+                insp = inspector_for_selection(sid, sel)
+                insp_claims = insp.get("governing_claims") if insp is not None else []
+                return sel, insp, {}, gr.update(visible=bool(insp_claims))
+
+            if kind == "relabel_edge" and sid:
+                # B2 radial-cxtmenu: "Edit edge label" → overlay a user_asserted
+                # label claim on the edge (no LLM round-trip). Mirrors the
+                # kind=='rename' branch above.
+                # Payload: {kind:'relabel_edge', id:<edge_id>, label:<new_label>}.
+                from loosecanvas.turn_logic import apply_user_edge_edit
+
+                edge_id = str(raw.get("id", ""))
+                new_label = str(raw.get("label", ""))
+                if edge_id and new_label:
+                    try:
+                        result = await apply_user_edge_edit(
+                            sid, edge_id, label=new_label
+                        )
+                        sel = {"kind": "edge", "id": edge_id}
+                        return (
+                            sel,
+                            result.inspector_update,
+                            result.renderer_patch.model_dump(mode="json"),
+                            gr.update(),
+                        )
+                    except (KeyError, ValueError):
+                        pass
+                sel = {"kind": "edge", "id": edge_id}
+                return sel, inspector_for_selection(sid, sel), {}, gr.update()
+
+            if kind == "edit_summary" and sid:
+                # Radial cxtmenu: "Edit summary" → overlay a user_asserted summary
+                # claim on the node (reuses the existing apply_user_edit path).
+                node_id = str(raw.get("id", ""))
+                text = str(raw.get("text", ""))
+                if node_id and text:
+                    try:
+                        result = await apply_user_edit(sid, node_id, summary=text)
+                        sel = {"kind": "node", "id": node_id}
+                        return (
+                            sel,
+                            result.inspector_update,
+                            result.renderer_patch.model_dump(mode="json"),
+                            gr.update(),
+                        )
+                    except (KeyError, ValueError):
+                        pass
+                sel = {"kind": "node", "id": node_id}
+                return sel, inspector_for_selection(sid, sel), {}, gr.update()
+
+            if kind == "delete_node" and sid:
+                # Radial cxtmenu node menu: "Delete node" (confirmed in-canvas before
+                # this fires). Removal cascades incident edges and is undoable.
+                from loosecanvas.turn_logic import remove_user_node
+
+                node_id = str(raw.get("id", ""))
+                if node_id:
+                    try:
+                        node_result = await remove_user_node(sid, node_id)
+                        return (
+                            {"kind": "none", "id": ""},
+                            node_result.inspector_update,
+                            node_result.renderer_patch.model_dump(mode="json"),
+                            gr.update(visible=False),
+                        )
+                    except KeyError:
+                        pass
+                return {"kind": "none", "id": ""}, None, {}, gr.update(visible=False)
+
+            if kind == "add_node" and sid:
+                # Radial cxtmenu background menu: "Add node" → mint a user_asserted
+                # node on the open periphery and reveal it (no LLM round-trip).
+                from loosecanvas.turn_logic import apply_user_node
+
+                label = str(raw.get("label", ""))
+                if label:
+                    try:
+                        add_result = await apply_user_node(
+                            sid, label, str(raw.get("text", ""))
+                        )
+                        return (
+                            {"kind": "none", "id": ""},
+                            None,
+                            add_result.renderer_patch.model_dump(mode="json"),
+                            gr.update(visible=False),
+                        )
+                    except (KeyError, ValueError):
+                        pass
+                return {"kind": "none", "id": ""}, None, {}, gr.update(visible=False)
+
             # Normal selection
             selection: dict[str, Any] = {"kind": kind, "id": str(raw.get("id", ""))}
             # T3-03: update focus history for node selections
@@ -1223,41 +1546,39 @@ def build_app() -> tuple[Any, Any]:
         # real class object so the event-data parameter is detected.
         on_select.__annotations__["evt"] = gr.SelectData
 
-        # Manual reload via button
-        load_btn.click(
-            on_load_graph,
-            inputs=[fixture_dropdown],
-            outputs=[canvas, session_id, onboarding],
-        )
-
-        # Deploy-only first-paint seed. Default OFF preserves the P0-01 blank-slate
-        # workspace; the public HF Space sets LOOSECANVAS_DEMO_SEED=1 so a visitor
-        # lands on a populated canvas (instant-magic) instead of an empty one. This
-        # is a narrowly-scoped, opt-in deviation from P0-01 for the demo deployment.
-        if os.environ.get("LOOSECANVAS_DEMO_SEED", "0") == "1":
-            demo.load(
-                on_load_graph,
-                inputs=[fixture_dropdown],
-                outputs=[canvas, session_id, onboarding],
-            )
-
-        # Build a graph from pasted text via Gemma (M04b adapter).
-        build_btn.click(
-            on_build_text,
-            inputs=[text_content, text_title],
-            outputs=[canvas, session_id, chatbot, onboarding, status_md, text_content],
-        )
+        # Open-world entry: always seed the canvas on page load via the zero-LLM
+        # sync path. No fixture picker, no manual load/build buttons — the user
+        # shapes the map by chatting. Seeding IS the entry now (no DEMO_SEED gate);
+        # on_seed falls back to annotated_graph if the baked seed isn't present.
+        demo.load(on_open, inputs=[], outputs=[canvas, session_id, onboarding])
 
         turn_inputs = [msg, session_id, current_selection, chatbot]
+        # turn_outputs (6) is shared with on_undo/on_redo. on_turn needs two MORE
+        # outputs — session_id (the magic build mints a new session) and onboarding
+        # (retire the banner once a map exists) — so it gets its own wider list while
+        # the time-travel handlers keep the 6-wide one untouched.
         turn_outputs = [canvas, inspector, chatbot, msg, status_md, send_btn]
-        msg.submit(on_turn, turn_inputs, turn_outputs)
-        send_btn.click(on_turn, turn_inputs, turn_outputs)
-
+        turn_outputs_full = turn_outputs + [session_id, onboarding]
+        msg.submit(on_turn, turn_inputs, turn_outputs_full)
+        send_btn.click(on_turn, turn_inputs, turn_outputs_full)
+
+        # NB: these are wired to ``turn_outputs`` (6 components, incl. send_btn). EVERY
+        # return must supply all 6 values or Gradio raises "didn't return enough output
+        # values" the moment the button is pressed — the live time-travel bug the unit
+        # tests (which call undo_turn/redo_turn directly) never exercised. The 6th slot
+        # is send_btn; keep Send enabled after a time-travel action, like on_turn does.
         async def on_undo(
             sid: str, history: list[Any]
-        ) -> tuple[Any, Any, list[Any], str, str]:
+        ) -> tuple[Any, Any, list[Any], str, str, Any]:
             if not sid:
-                return gr.update(), gr.update(), history, "", "No session"
+                return (
+                    gr.update(),
+                    gr.update(),
+                    history,
+                    "",
+                    "No session",
+                    gr.update(interactive=True),
+                )
             result = await undo_turn(sid)
             return (
                 result.renderer_patch.model_dump(mode="json"),
@@ -1265,13 +1586,21 @@ def build_app() -> tuple[Any, Any]:
                 history,
                 "",
                 result.status,
+                gr.update(interactive=True),
             )
 
         async def on_redo(
             sid: str, history: list[Any]
-        ) -> tuple[Any, Any, list[Any], str, str]:
+        ) -> tuple[Any, Any, list[Any], str, str, Any]:
             if not sid:
-                return gr.update(), gr.update(), history, "", "No session"
+                return (
+                    gr.update(),
+                    gr.update(),
+                    history,
+                    "",
+                    "No session",
+                    gr.update(interactive=True),
+                )
             result = await redo_turn(sid)
             return (
                 result.renderer_patch.model_dump(mode="json"),
@@ -1279,6 +1608,7 @@ def build_app() -> tuple[Any, Any]:
                 history,
                 "",
                 result.status,
+                gr.update(interactive=True),
             )
 
         undo_btn.click(on_undo, inputs=[session_id, chatbot], outputs=turn_outputs)
@@ -1296,18 +1626,64 @@ def build_app() -> tuple[Any, Any]:
 
         cluster_btn.click(on_cluster, inputs=[session_id], outputs=[canvas])
 
+        async def on_find_connection(sid: str) -> Any:
+            """C14/C15: surface a surprising cross-cluster link as a model proposal
+            (amber, awaiting review). No-op (no canvas change) if none is found."""
+            if not sid:
+                return {}
+            patch = await find_connection_session(sid)
+            return {} if patch is None else patch.model_dump(mode="json")
+
+        find_conn_btn.click(on_find_connection, inputs=[session_id], outputs=[canvas])
+
+        async def on_export(sid: str) -> Any:
+            """Export the map as JSON. Trust gate: ``export_session`` drops any
+            model_inferred claim you haven't accepted, so the downloaded file is
+            exactly the knowledge you've vouched for — the review loop made provable.
+            """
+            if not sid:
+                return gr.update()
+            record = session_store.get(sid)
+            if record is None:
+                return gr.update()
+            import json
+            import tempfile
+
+            from loosecanvas.exporter import export_session
+
+            data = await export_session(record.graph, session_id=sid)
+            out_path = Path(tempfile.gettempdir()) / f"loosecanvas-map-{sid[:8]}.json"
+            out_path.write_text(
+                json.dumps(data, indent=2, ensure_ascii=False), encoding="utf-8"
+            )
+            return str(out_path)
+
+        export_btn.click(on_export, inputs=[session_id], outputs=[export_btn])
+
+        # Wired to ``turn_outputs + [search_results_display]`` (7 components). The 6th
+        # slot is send_btn (keep Send enabled), the 7th is the search results — every
+        # return must supply all 7 (see the on_undo note for why the unit tests missed
+        # the original 6-value returns that errored live).
         async def on_back(
             sid: str, history: list[Any]
-        ) -> tuple[dict[str, Any] | None, Any, list[Any], str, str, list[Any]]:
+        ) -> tuple[dict[str, Any] | None, Any, list[Any], str, str, Any, list[Any]]:
             """T3-03: navigate back in focus history via pop_focus."""
             if not sid:
-                return None, None, history, "", "No session", []
+                return None, None, history, "", "No session", gr.update(), []
             record = session_store.get(sid)
             if record is None:
-                return None, None, history, "", "No session", []
+                return None, None, history, "", "No session", gr.update(), []
             prev = pop_focus(record)
             if prev is None:
-                return gr.update(), gr.update(), history, "", "no_back_history", []
+                return (
+                    gr.update(),
+                    gr.update(),
+                    history,
+                    "",
+                    "no_back_history",
+                    gr.update(),
+                    [],
+                )
             record.patch_id += 1
             patch = RendererPatch(
                 patch_id=record.patch_id,
@@ -1321,7 +1697,15 @@ def build_app() -> tuple[Any, Any]:
                 ],
             )
             insp = inspector_for_selection(sid, {"kind": "node", "id": prev})
-            return patch.model_dump(mode="json"), insp, history, "", "back", []
+            return (
+                patch.model_dump(mode="json"),
+                insp,
+                history,
+                "",
+                "back",
+                gr.update(interactive=True),
+                [],
+            )
 
         search_box.submit(
             on_search,

src/loosecanvas/reducer.py

@@ -126,6 +126,11 @@ def reduce_turn(
                 graph_patch.upsert_claims.append(
                     _user_overlay_claim(action, "summary", action.note)
                 )
+        elif action.type is SceneActionType.update_edge:
+            # Relabel an existing edge via a user_asserted overlay claim — never mutate
+            # edge.label in place. effective_edge_label resolves the overlay for both
+            # rendering and export, exactly like update_node does for node labels.
+            graph_patch.upsert_claims.append(_user_edge_label_claim(action))
         elif action.type is SceneActionType.create_node:
             node = _model_node(action)
             graph_patch.upsert_nodes.append(node)
@@ -134,10 +139,13 @@ def reduce_turn(
             if node.id not in scene_patch.add_visible_node_ids:
                 scene_patch.add_visible_node_ids.append(node.id)
         elif action.type is SceneActionType.create_edge:
-            edge = _user_edge(action.source_id, action.target_id, action.label)
-            claim = _user_edge_claim(
-                edge.id, action.source_id, action.target_id, action.label
-            )
+            # The AGENT is proposing a relationship → model_inferred + pending, exactly
+            # like create_node. (Direct user-UI connects go through apply_user_edge,
+            # which stays user_asserted.) Stamping an agent edge user_asserted/accepted
+            # flattened trust — the model-invented relationship passed as user-vouched
+            # on export (plan/06 forbids this collapse).
+            edge = _model_edge(action.source_id, action.target_id, action.label)
+            claim = _model_edge_claim(edge.id, action.label)
             graph_patch.upsert_edges.append(edge)
             graph_patch.upsert_claims.append(claim)
             # Reveal the edge if both endpoints are visible (incl. same-batch new nodes).
@@ -306,6 +314,24 @@ def _user_overlay_claim(action: SceneAction, claim_type: str, text: str) -> Clai
     )
 
 
+def _user_edge_label_claim(action: SceneAction) -> Claim:
+    """A user_asserted overlay claim relabeling an existing edge (edge.label preserved).
+
+    The ``"useredit"`` discriminator in the stable id keeps this distinct from a
+    model-inferred ``propose_edge_label`` claim on the same edge with the same text,
+    so a user edit and a model proposal never collide on a single claim id.
+    """
+    return Claim(
+        id=_stable_id("claim", "label", "useredit", action.edge_id, action.label),
+        claim_type="label",
+        target_id=action.edge_id,
+        text=action.label,
+        origin=_USER_ORIGIN,
+        support_state="unverified",
+        review_state="accepted",
+    )
+
+
 def _model_node(action: SceneAction) -> Node:
     """A model_inferred concept node proposed by the agent (the model is proposing)."""
     return Node(
@@ -321,7 +347,8 @@ def _model_node_claim(node_id: str, label: str) -> Claim:
     """Governing claim for an agent-created concept node (unverified + pending review).
 
     Trust stays unflattened: the model proposing a node is ``model_inferred`` /
-    ``unverified`` / ``pending`` — distinct from a user_asserted create_edge.
+    ``unverified`` / ``pending`` — like an agent-proposed edge (see _model_edge_claim)
+    and unlike a direct user_asserted edge (apply_user_edge).
     """
     return Claim(
         id=_stable_id("claim", "concept_node", node_id, label),
@@ -334,6 +361,36 @@ def _model_node_claim(node_id: str, label: str) -> Claim:
     )
 
 
+def _model_edge(source_id: str, target_id: str, label: str) -> Edge:
+    """A model_inferred edge proposed by the agent (the model proposes a relationship)."""
+    return Edge(
+        id=_stable_id("modeledge", source_id, target_id, label),
+        source=source_id,
+        target=target_id,
+        type="related",
+        label=label,
+        properties={"origin": _MODEL_ORIGIN},
+    )
+
+
+def _model_edge_claim(edge_id: str, label: str) -> Claim:
+    """Governing claim for an agent-created edge: model_inferred / unverified / pending.
+
+    Keeps trust unflattened (plan/06) — the model proposing a relationship is a
+    reviewable proposal awaiting the user's decision, NOT a user-vouched fact.
+    Mirrors :func:`_model_node_claim`.
+    """
+    return Claim(
+        id=_stable_id("claim", "relationship", edge_id, label),
+        claim_type="relationship",
+        target_id=edge_id,
+        text=label,
+        origin=_MODEL_ORIGIN,
+        support_state="unverified",
+        review_state="pending",
+    )
+
+
 def _user_edge(source_id: str, target_id: str, label: str) -> Edge:
     """A user_asserted edge (accepted-by-construction)."""
     return Edge(

src/loosecanvas/scene_curator.py

@@ -77,6 +77,53 @@ def compute_node_clusters(repo: LooseGraphRepository) -> dict[str, int]:
     return mapping
 
 
+def find_bridge_candidate(
+    repo: LooseGraphRepository,
+    clusters: dict[str, int],
+    visible_ids: list[str],
+) -> tuple[str, str] | None:
+    """Pick a SURPRISING cross-cluster link to propose ("find a hidden connection").
+
+    Returns ``(src, tgt)`` for two **visible** nodes that sit in *different*
+    communities, are **not already directly connected**, and form the most
+    structurally interesting bridge — high combined betweenness endpoints joined by
+    a short path (a near-miss structural hole). Returns ``None`` when no such pair
+    exists (single cluster, every cross pair already linked, or fewer than two
+    visible nodes) so the caller can no-op gracefully.
+
+    Deterministic: betweenness uses a fixed pivot ``seed`` so the same graph always
+    surfaces the same connection. Endpoints are restricted to visible nodes because
+    the validator requires both endpoints visible for a hypothesis edge.
+    """
+    undirected = repo.to_networkx().to_undirected()
+    if undirected.number_of_nodes() < 2:
+        return None
+    btw = nx.betweenness_centrality(
+        undirected,
+        k=min(_BETWEENNESS_PIVOTS, undirected.number_of_nodes()),
+        seed=42,
+    )
+    visible = [n for n in visible_ids if n in undirected]
+    best: tuple[float, str, str] | None = None
+    for i, a in enumerate(visible):
+        for b in visible[i + 1 :]:
+            if clusters.get(a) == clusters.get(b):
+                continue  # same community → not a cross-cluster surprise
+            if undirected.has_edge(a, b):
+                continue  # already directly linked → not hidden
+            try:
+                dist = nx.shortest_path_length(undirected, a, b)
+            except nx.NetworkXNoPath:
+                continue
+            # Prefer high-betweenness endpoints joined by a short bridge.
+            score = (btw.get(a, 0.0) + btw.get(b, 0.0)) - 0.01 * dist
+            if best is None or score > best[0]:
+                best = (score, a, b)
+    if best is None:
+        return None
+    return best[1], best[2]
+
+
 class SceneCurator:
     """Ranks a ``LooseGraph`` into an initial scene and suggested pathways (M12)."""
 
@@ -86,9 +133,18 @@ class SceneCurator:
     # ── Public API ────────────────────────────────────────────────────────────
 
     def curate_initial_scene(
-        self, max_visible: int = 12, max_fog: int = 25
+        self, max_visible: int = 12, max_fog: int = 25, min_visible: int = 8
     ) -> tuple[SceneState, list[SuggestedPathway]]:
-        """Return ``(scene, pathways)`` curated from the repository's whole graph."""
+        """Return ``(scene, pathways)`` curated from the repository's whole graph.
+
+        ``min_visible`` sets a floor: if fewer than ``min_visible`` nodes are
+        selected by the scoring pass, eligible nodes (passing ``_is_visible_excluded``)
+        are promoted in stable composite-score order until ``min(min_visible,
+        eligible_count)`` are visible.  The floor is capped at ``max_visible``.
+        """
+        assert (
+            min_visible <= max_visible
+        ), f"min_visible ({min_visible}) must not exceed max_visible ({max_visible})"
         graph = self.repo.to_networkx()
         if len(graph) == 0:
             return SceneState(scene_id=_new_scene_id()), []
@@ -96,7 +152,7 @@ class SceneCurator:
         undirected = graph.to_undirected()
         composite, pagerank = self._score(graph, undirected)
 
-        visible = self._select_visible(undirected, composite, max_visible)
+        visible = self._select_visible(undirected, composite, max_visible, min_visible)
         fog = self._select_fog(undirected, visible, composite, max_fog)
         positions = self._layout(graph, visible)
 
@@ -201,9 +257,20 @@ class SceneCurator:
     # ── Visible selection ─────────────────────────────────────────────────────
 
     def _select_visible(
-        self, undirected: nx.Graph, composite: dict[str, float], max_visible: int
+        self,
+        undirected: nx.Graph,
+        composite: dict[str, float],
+        max_visible: int,
+        min_visible: int = 0,
     ) -> list[str]:
-        """Force eligible articulation points first, then fill by composite score."""
+        """Force eligible articulation points first, then fill by composite score.
+
+        After the normal scoring pass, if ``len(visible) < min_visible`` and there are
+        still unused eligible nodes, those are promoted in stable composite-score order
+        (ties broken by node id) until ``min(min_visible, eligible_count)`` are visible.
+        Excluded nodes (``_is_visible_excluded``) are never promoted regardless of the
+        floor. The result never exceeds ``max_visible``.
+        """
         visible: list[str] = []
 
         articulation = [
@@ -229,6 +296,17 @@ class SceneCurator:
             if node_id not in visible:
                 visible.append(node_id)
 
+        # min_visible floor: promote remaining eligible nodes if we are under the floor.
+        if min_visible > 0 and len(visible) < min_visible:
+            visible_set = set(visible)
+            # eligible is already sorted stably; iterate in that order to keep determinism.
+            for node_id in eligible:
+                if len(visible) >= min(min_visible, len(eligible)):
+                    break
+                if node_id not in visible_set:
+                    visible.append(node_id)
+                    visible_set.add(node_id)
+
         return visible[:max_visible]
 
     # ── Fog selection ─────────────────────────────────────────────────────────

src/loosecanvas/turn_logic.py

@@ -142,6 +142,18 @@ def effective_node_summary(node: Node, claims: Iterable[Claim]) -> str:
     return overlay.text if overlay is not None else ""
 
 
+def effective_edge_label(edge: Edge, claims: Iterable[Claim]) -> str:
+    """Displayed edge label: newest user_asserted label claim, else edge.label.
+
+    The edge analogue of :func:`effective_node_label` — a user relabel (from the
+    agent's ``update_edge`` tool or the inline edge-edit UI) is stored as a
+    user_asserted overlay claim targeting the edge id; the raw ``edge.label`` is
+    preserved underneath so provenance is never destroyed.
+    """
+    overlay = _latest_user_claim(claims, edge.id, claim_type="label")
+    return overlay.text if overlay is not None else edge.label
+
+
 def _latest_user_claim(
     claims: Iterable[Claim], node_id: str, *, claim_type: str
 ) -> Claim | None:
@@ -442,7 +454,10 @@ def _restore(record: SessionRecord, snap: GraphSnapshot, *, status: str) -> Turn
         nid: effective_node_label(n, record.graph.claims.values())
         for nid, n in record.graph.nodes.items()
     }
-    edge_label_map = {eid: e.label for eid, e in record.graph.edges.items()}
+    edge_label_map = {
+        eid: effective_edge_label(e, record.graph.claims.values())
+        for eid, e in record.graph.edges.items()
+    }
     edge_kind_map = {eid: e.kind for eid, e in record.graph.edges.items()}
     operations = diff_scene(
         prev_scene,
@@ -637,7 +652,10 @@ async def load_session(
         nid: effective_node_label(n, repo.claims.values())
         for nid, n in repo.nodes.items()
     }
-    edge_label_map = {eid: e.label for eid, e in repo.edges.items()}
+    edge_label_map = {
+        eid: effective_edge_label(e, repo.claims.values())
+        for eid, e in repo.edges.items()
+    }
     edge_kind_map = {eid: e.kind for eid, e in repo.edges.items()}
     ops = diff_scene(
         SceneState(),
@@ -713,7 +731,10 @@ async def load_fixture_session(
         nid: effective_node_label(n, repo.claims.values())
         for nid, n in repo.nodes.items()
     }
-    edge_label_map = {eid: e.label for eid, e in repo.edges.items()}
+    edge_label_map = {
+        eid: effective_edge_label(e, repo.claims.values())
+        for eid, e in repo.edges.items()
+    }
     edge_kind_map = {eid: e.kind for eid, e in repo.edges.items()}
     ops = diff_scene(
         SceneState(),
@@ -789,7 +810,10 @@ async def load_text_session(
         nid: effective_node_label(n, repo.claims.values())
         for nid, n in repo.nodes.items()
     }
-    edge_label_map = {eid: e.label for eid, e in repo.edges.items()}
+    edge_label_map = {
+        eid: effective_edge_label(e, repo.claims.values())
+        for eid, e in repo.edges.items()
+    }
     edge_kind_map = {eid: e.kind for eid, e in repo.edges.items()}
     ops = diff_scene(
         SceneState(),
@@ -851,24 +875,16 @@ async def stream_text_session(
             is_error=True,
         )
         return
-    record = session_store[sid]
-    n_nodes = len(record.graph.nodes)
-    n_edges = len(record.graph.edges)
+    # Success carries the snapshot + new session id but NO chat message: the
+    # conversational opening line is streamed separately by main.py via
+    # agent_harness.stream_build_opener, so turn one greets the user in the same
+    # warm agent voice as every later turn instead of a canned count template.
     yield TextBuildProgress(
         is_partial=False,
         status="",
         canvas_patch=snapshot.model_dump(mode="json"),
         session_id=sid,
-        chat_message=[
-            {
-                "role": "assistant",
-                "content": (
-                    f"Built a graph from your text: {n_nodes} concepts, "
-                    f"{n_edges} relations. Everything here is model-inferred — "
-                    "ask me to refine it."
-                ),
-            }
-        ],
+        chat_message=[],
     )
 
 
@@ -927,7 +943,10 @@ async def load_repo_session(
         nid: effective_node_label(n, repo.claims.values())
         for nid, n in repo.nodes.items()
     }
-    edge_label_map = {eid: e.label for eid, e in repo.edges.items()}
+    edge_label_map = {
+        eid: effective_edge_label(e, repo.claims.values())
+        for eid, e in repo.edges.items()
+    }
     edge_kind_map = {eid: e.kind for eid, e in repo.edges.items()}
     ops = diff_scene(
         SceneState(),
@@ -1199,6 +1218,73 @@ async def apply_user_edit(
         )
 
 
+async def apply_user_edge_edit(
+    session_id: str,
+    edge_id: str,
+    *,
+    label: str,
+) -> TurnResult:
+    """Apply a user-asserted label overlay on an EDGE directly (no LLM round-trip).
+
+    Mirror of :func:`apply_user_edit` for edges: validates the edge exists, builds a
+    ``user_asserted`` label :class:`Claim` overlay (raw ``edge.label`` is preserved —
+    only the effective label is updated), applies the claim, and emits an
+    ``update_data`` :class:`RendererCommand` carrying the new effective label so the
+    canvas repaints immediately without a full diff. Commits an undo snapshot like its
+    node sibling.
+
+    Raises ``KeyError`` for an unknown session or a missing edge id.
+    """
+    record = session_store.get(session_id)
+    if record is None:
+        raise KeyError(session_id)
+    edge = record.graph.get_edge(edge_id)
+    if edge is None:
+        raise KeyError(f"edge not found: {edge_id}")
+    async with _get_lock(session_id):
+        claim = Claim(
+            id=_stable_id("claim", "label", "useredit", edge_id, label),
+            claim_type="label",
+            target_id=edge_id,
+            text=label,
+            origin="user_asserted",
+            support_state="unverified",
+            review_state="accepted",
+        )
+        graph_patch = GraphPatch(upsert_claims=[claim])
+        scene_patch = ScenePatch()
+        record.graph.apply_graph_patch(graph_patch)
+        # Emit explicit update_data op so the canvas edge label refreshes immediately.
+        effective = effective_edge_label(edge, record.graph.claims.values())
+        extra_ops: list[RendererCommand] = []
+        if edge_id in record.scene.visible_edge_ids:
+            extra_ops.append(
+                RendererCommand(
+                    op="update_data",
+                    data={"id": edge_id, "data": {"label": effective}},
+                )
+            )
+        record.patch_id += 1
+        patch = RendererPatch(
+            patch_id=record.patch_id,
+            is_snapshot=False,
+            scene_id=record.render_scene_id,
+            operations=extra_ops,
+        )
+        record.graph_version += 1
+        record.last_seen = time.time()
+        _commit_snapshot(record)
+        selection: dict[str, Any] = {"kind": "edge", "id": edge_id}
+        return TurnResult(
+            renderer_patch=patch,
+            inspector_update=_inspector_update(record, selection),
+            assistant_message=f"Updated edge {edge_id}.",
+            scene_patch=scene_patch,
+            status="success",
+            warnings=[],
+        )
+
+
 async def apply_user_edge(
     session_id: str,
     source_id: str,
@@ -1310,6 +1396,144 @@ async def remove_user_edge(session_id: str, edge_id: str) -> TurnResult:
         )
 
 
+async def remove_user_node(session_id: str, node_id: str) -> TurnResult:
+    """Remove a visible node directly (user-trusted, no LLM) — the radial menu's
+    "Delete node" command (confirmed in-canvas before it reaches here).
+
+    Mirrors :func:`remove_user_edge`: the user *proposes* the deletion, the
+    validator + reducer still *decide*. The validator's ``would_empty_scene`` guard
+    keeps the last visible node, and the reducer cascades incident visible edges and
+    emits ``actor="user"`` — both free. Serialised under the per-session lock. An
+    unknown / non-visible node degrades to a graceful failure (no mutation); an
+    unknown session raises ``KeyError``.
+    """
+    record = session_store.get(session_id)
+    if record is None:
+        raise KeyError(session_id)
+    selection: dict[str, Any] = {"kind": "none", "id": ""}
+    async with _get_lock(session_id):
+        if node_id not in record.scene.visible_node_ids:
+            return _graceful_failure(record, selection, ["node not visible"])
+        plan = ScenePlan(
+            actions=[SceneAction(type=SceneActionType.remove_node, target_id=node_id)],
+            summary=f"Removing node {node_id}.",
+        )
+        val_result = validate_sceneplan(plan, record.graph, record.scene)
+        if not val_result.valid_actions:
+            return _graceful_failure(record, selection, val_result.rejection_reasons)
+        graph_patch, scene_patch, _events = reduce_turn(
+            val_result.valid_actions, record.graph, record.scene
+        )
+        record.graph.apply_graph_patch(graph_patch)
+        new_scene = record.graph.apply_scene_patch(record.scene, scene_patch)
+        return _finalize_turn(
+            record,
+            prev_scene=record.scene,
+            new_scene=new_scene,
+            revealed_ids=[],
+            graph_mutated=True,
+            assistant_message="Removed node.",
+            scene_patch=scene_patch,
+            status="success",
+            warnings=[],
+            selection=selection,
+        )
+
+
+def _place_user_node(scene: SceneState, node_id: str) -> SceneState:
+    """Return a copy of ``scene`` with ``node_id`` placed on the open periphery.
+
+    A user-added node is an orphan (no edges yet), so it has no positioned visible
+    neighbour — :func:`_assign_reveal_positions` would drop it on the cluster
+    centroid (on top of the existing graph). Instead we place it deterministically
+    to the right of the rightmost positioned node, at the vertical centroid; if no
+    positions exist yet, a fixed default. ``_assign_reveal_positions`` then skips it
+    because the entry already exists.
+    """
+    positions = dict(scene.node_positions)
+    if positions:
+        new_x = max(x for x, _y in positions.values()) + 200.0
+        new_y = sum(y for _x, y in positions.values()) / len(positions)
+    else:
+        new_x, new_y = 400.0, 400.0
+    positions[node_id] = (new_x, new_y)
+    return scene.model_copy(update={"node_positions": positions})
+
+
+async def apply_user_node(session_id: str, label: str, summary: str = "") -> TurnResult:
+    """Create a user_asserted node directly (no LLM round-trip) — the radial menu's
+    "Add node" command.
+
+    Mirrors :func:`apply_user_edge`: mints a unique node id, builds the node + its
+    ``user_asserted`` label (and optional summary) claim(s), reveals it, places it on
+    the open periphery, and finalizes so the renderer diff + camera re-fit fire.
+    Empty label raises ``ValueError``; unknown session raises ``KeyError``.
+    """
+    record = session_store.get(session_id)
+    if record is None:
+        raise KeyError(session_id)
+    label = label.strip()
+    if not label:
+        raise ValueError("apply_user_node requires a non-empty label")
+    async with _get_lock(session_id):
+        # Deterministic, collision-free id: append a numeric suffix until unique.
+        node_id = _stable_id("usernode", label)
+        if node_id in record.graph.nodes:
+            suffix = 2
+            while f"{node_id}-{suffix}" in record.graph.nodes:
+                suffix += 1
+            node_id = f"{node_id}-{suffix}"
+        node = Node(
+            id=node_id,
+            kind="concept",
+            label=label,
+            properties={"origin": "user_asserted"},
+        )
+        claims: list[Claim] = [
+            Claim(
+                id=_stable_id("claim", "label", node_id, label),
+                claim_type="label",
+                target_id=node_id,
+                text=label,
+                origin="user_asserted",
+                support_state="unverified",
+                review_state="accepted",
+            )
+        ]
+        if summary:
+            claims.append(
+                Claim(
+                    id=_stable_id("claim", "summary", node_id, summary),
+                    claim_type="summary",
+                    target_id=node_id,
+                    text=summary,
+                    origin="user_asserted",
+                    support_state="unverified",
+                    review_state="accepted",
+                )
+            )
+        graph_patch = GraphPatch(upsert_nodes=[node], upsert_claims=claims)
+        scene_patch = ScenePatch(add_visible_node_ids=[node_id])
+        record.graph.apply_graph_patch(graph_patch)
+        new_scene = record.graph.apply_scene_patch(record.scene, scene_patch)
+        # An orphan node has no positioned neighbour — place it on the periphery so
+        # _assign_reveal_positions doesn't drop it on the centroid (on the graph).
+        new_scene = _place_user_node(new_scene, node_id)
+        selection: dict[str, Any] = {"kind": "node", "id": node_id}
+        return _finalize_turn(
+            record,
+            prev_scene=record.scene,
+            new_scene=new_scene,
+            revealed_ids=[node_id],
+            graph_mutated=True,
+            assistant_message=f"Added {label}.",
+            scene_patch=scene_patch,
+            status="success",
+            warnings=[],
+            selection=selection,
+        )
+
+
 # ── Intent classification (pure; routes navigate vs. expand) ──────────────────
 
 _EXPAND_INTENT_RE = re.compile(
@@ -1770,11 +1994,15 @@ def _finalize_turn(
     status: str,
     warnings: list[str],
     selection: dict[str, Any],
+    relabeled_ids: list[str] | None = None,
 ) -> TurnResult:
     """Replenish fog, lay out reveals, diff to a RendererPatch, and persist.
 
     Shared by ``_navigate_turn`` and ``_expand_turn`` so both paths produce
-    identical render/camera/lineage behaviour.
+    identical render/camera/lineage behaviour. ``relabeled_ids`` lists node/edge ids
+    whose overlay label changed this turn: diff_scene only writes labels onto
+    newly-added elements, so a pure relabel of a persisting element needs an explicit
+    ``update_data`` op (the mechanism apply_user_edit already uses for inline edits).
     """
     if revealed_ids:
         replenished = record.graph.fog_replenish(new_scene, max_fog=_MAX_FOG)
@@ -1791,7 +2019,10 @@ def _finalize_turn(
         nid: effective_node_label(n, record.graph.claims.values())
         for nid, n in record.graph.nodes.items()
     }
-    edge_label_map = {eid: e.label for eid, e in record.graph.edges.items()}
+    edge_label_map = {
+        eid: effective_edge_label(e, record.graph.claims.values())
+        for eid, e in record.graph.edges.items()
+    }
     edge_kind_map = {eid: e.kind for eid, e in record.graph.edges.items()}
     operations = diff_scene(
         prev_scene,
@@ -1805,6 +2036,42 @@ def _finalize_turn(
     )
     if operations:
         new_scene = new_scene.model_copy(update={"scene_id": str(uuid.uuid4())})
+    # Explicit label refresh for elements relabeled THIS turn that persist (visible in
+    # both scenes): diff_scene only writes labels onto newly-added elements, so a pure
+    # overlay relabel of a still-visible node/edge needs an update_data op of its own.
+    for rid in relabeled_ids or []:
+        edge = record.graph.get_edge(rid)
+        if edge is not None:
+            if rid in new_scene.visible_edge_ids:
+                operations.append(
+                    RendererCommand(
+                        op="update_data",
+                        data={
+                            "id": rid,
+                            "data": {
+                                "label": effective_edge_label(
+                                    edge, record.graph.claims.values()
+                                )
+                            },
+                        },
+                    )
+                )
+            continue
+        node = record.graph.get_node(rid)
+        if node is not None and rid in new_scene.visible_node_ids:
+            operations.append(
+                RendererCommand(
+                    op="update_data",
+                    data={
+                        "id": rid,
+                        "data": {
+                            "label": effective_node_label(
+                                node, record.graph.claims.values()
+                            )
+                        },
+                    },
+                )
+            )
     # After any reveal, re-fit the camera so newly-placed nodes are in view.
     if revealed_ids and new_scene.visible_node_ids:
         operations.append(
@@ -2008,22 +2275,9 @@ def _aggregate_trust(governing: list[Claim]) -> _TrustSummary:
     }
 
 
-def _inspector_update(
-    record: SessionRecord, selection: dict[str, Any]
-) -> InspectorPayload | None:
-    """Inspector payload: ``None`` unless a known node is selected."""
-    if selection.get("kind") != "node":
-        return None
-    node_id = selection.get("id")
-    if not node_id:
-        return None
-    node = record.graph.get_node(node_id)
-    if node is None:
-        return None
-    effective = effective_node_label(node, record.graph.claims.values())
-    # --- governing claims: all claims targeting this node ---
-    governing = [c for c in record.graph.claims.values() if c.target_id == node_id]
-    governing_claims: list[_ClaimSummary] = [
+def _claim_summaries(claims: list[Any]) -> list[_ClaimSummary]:
+    """Project full Claim objects to the inspector's claim-summary shape."""
+    return [
         {
             "id": c.id,
             "claim_type": c.claim_type,
@@ -2032,20 +2286,56 @@ def _inspector_update(
             "support_state": c.support_state,
             "review_state": c.review_state,
         }
-        for c in governing
+        for c in claims
     ]
-    # --- trust aggregation: pick the most informative governing claim ---
-    trust = _aggregate_trust(governing)
-    return {
-        "selected_id": node.id,
-        "label": effective,
-        "original_label": node.label,
-        "kind": node.kind,
-        "edited": effective != node.label,
-        "trust": trust,
-        "governing_claims": governing_claims,
-        "evidence_count": len(node.evidence_refs),
-    }
+
+
+def _inspector_update(
+    record: SessionRecord, selection: dict[str, Any]
+) -> InspectorPayload | None:
+    """Inspector payload for a selected NODE or EDGE; ``None`` otherwise.
+
+    Edges expose their governing claims too, so a model-inferred *proposed* edge
+    (e.g. a "find a hidden connection" result) is reviewable via the same
+    Accept/Reject affordance as nodes — the review loop applies to relationships,
+    not just concepts.
+    """
+    kind = selection.get("kind")
+    sel_id = selection.get("id")
+    if not sel_id:
+        return None
+    if kind == "node":
+        node = record.graph.get_node(sel_id)
+        if node is None:
+            return None
+        effective = effective_node_label(node, record.graph.claims.values())
+        governing = [c for c in record.graph.claims.values() if c.target_id == sel_id]
+        return {
+            "selected_id": node.id,
+            "label": effective,
+            "original_label": node.label,
+            "kind": node.kind,
+            "edited": effective != node.label,
+            "trust": _aggregate_trust(governing),
+            "governing_claims": _claim_summaries(governing),
+            "evidence_count": len(node.evidence_refs),
+        }
+    if kind == "edge":
+        edge = record.graph.edges.get(sel_id)
+        if edge is None:
+            return None
+        governing = [c for c in record.graph.claims.values() if c.target_id == sel_id]
+        return {
+            "selected_id": edge.id,
+            "label": edge.label or edge.kind,
+            "original_label": edge.label,
+            "kind": edge.kind,
+            "edited": False,
+            "trust": _aggregate_trust(governing),
+            "governing_claims": _claim_summaries(governing),
+            "evidence_count": 0,
+        }
+    return None
 
 
 def inspector_for_selection(
@@ -2086,19 +2376,66 @@ class ReviewClaimResult:
     renderer_patch: RendererPatch  # proper patch for Gradio → CytoscapeCanvas
 
 
-def _review_canvas_hint_dict(claim: Any) -> dict[str, Any]:
-    """Produce the canvas-hint dict for a just-reviewed claim."""
+def _target_fully_reviewed(graph: LooseGraphRepository, target_id: str) -> bool:
+    """True iff no model_inferred claim on ``target_id`` is still awaiting review.
+
+    The amber ``review-pending`` affordance covers a node/edge as a whole, but a
+    single target may govern several ``model_inferred`` claims (seed nodes carry
+    2–3). The amber may only clear once EVERY model_inferred claim on the target
+    has been reviewed (``review_state != "pending"`` — i.e. accepted or rejected);
+    while any remain pending the affordance must stay up. Non-model_inferred claims
+    (user_asserted / deterministic) never drive the amber, so they're ignored.
+    """
+    return not any(
+        c.target_id == target_id
+        and c.origin == "model_inferred"
+        and c.review_state == "pending"
+        for c in graph.claims.values()
+    )
+
+
+def _review_canvas_hint_dict(claim: Any, graph: LooseGraphRepository) -> dict[str, Any]:
+    """Produce the canvas-hint dict for a just-reviewed claim.
+
+    ``clear_pending`` (which drops the amber awaiting-review border) fires when:
+    - the target has NO remaining pending model_inferred claims after accept; or
+    - the claim's target is a NODE that was just rejected (nodes are durable entities
+      — rejecting a governing claim must NOT remove the node from canvas; the amber
+      badge is simply cleared, matching the accept path's badge-clear behaviour).
+
+    For EDGE claims, rejection keeps the ``remove`` action — a rejected proposed
+    relationship revokes the edge from canvas (the intended behaviour, locked by
+    ``test_edge_claim_review.py::test_reject_edge_claim_still_removes_edge``).
+    """
     if claim.review_state == "accepted":
-        return {"action": "clear_pending", "target_id": claim.target_id}
+        if _target_fully_reviewed(graph, claim.target_id):
+            return {"action": "clear_pending", "target_id": claim.target_id}
+        return {"action": "none", "target_id": claim.target_id}
     if claim.review_state == "rejected":
+        # Distinguish node vs edge: nodes are retained on canvas; edges are revoked.
+        if claim.target_id in graph.nodes:
+            # Node claim rejection — keep the node; only clear the amber badge.
+            if _target_fully_reviewed(graph, claim.target_id):
+                return {"action": "clear_pending", "target_id": claim.target_id}
+            return {"action": "none", "target_id": claim.target_id}
+        # Edge claim rejection — remove the proposed relationship from canvas.
         return {"action": "remove", "target_id": claim.target_id}
     return {"action": "none", "target_id": claim.target_id}
 
 
 def _canvas_hint_to_renderer_patch(
-    record: SessionRecord, hint: dict[str, Any]
+    record: SessionRecord,
+    hint: dict[str, Any],
+    review_state: str = "",
 ) -> RendererPatch:
-    """Convert a canvas-hint dict to a proper RendererPatch for the Gradio layer."""
+    """Convert a canvas-hint dict to a proper RendererPatch for the Gradio layer.
+
+    ``review_state`` is the snake_case value of the just-reviewed claim after
+    transition (e.g. ``"accepted"`` or ``"rejected"``).  When the action is
+    ``"clear_pending"`` an ``update_data`` op is also emitted so the element's
+    Cytoscape ``data('review')`` field is refreshed — without it the hover tooltip
+    still says "pending review" even after the amber badge is cleared.
+    """
     ops: list[RendererCommand] = []
     action = hint.get("action", "none")
     target_id = hint.get("target_id", "")
@@ -2107,9 +2444,22 @@ def _canvas_hint_to_renderer_patch(
             RendererCommand(
                 op="remove_class",
                 selector=f"#{target_id}",
-                data={"class": "pending-review"},
+                # Must match the stylesheet selector `.review-pending` (renderer.ts) —
+                # the class is hyphenated from the snake_case review_state "pending".
+                # A prior typo ("pending-review") meant Accept never cleared the amber
+                # awaiting-review border. Keep this string and the stylesheet in sync.
+                data={"class": "review-pending"},
             )
         )
+        # Also refresh the element's data('review') so the hover tooltip reflects the
+        # new state rather than the stale "pending" value set at add_element time.
+        if review_state:
+            ops.append(
+                RendererCommand(
+                    op="update_data",
+                    data={"id": target_id, "data": {"review": review_state}},
+                )
+            )
     elif action == "remove":
         ops.append(RendererCommand(op="remove_element", selector=f"#{target_id}"))
     record.patch_id += 1
@@ -2140,11 +2490,17 @@ def do_review_claim(
     record.graph.upsert_claims([updated])
     record.graph_version += 1
     # T3-01: emit MapEvent(review, before=claim.review_state, after=updated.review_state)
-    hint = _review_canvas_hint_dict(updated)
-    patch = _canvas_hint_to_renderer_patch(record, hint)
-    insp = inspector_for_selection(
-        session_id, {"kind": "node", "id": updated.target_id}
+    # Pass the live graph (already carrying the upserted ``updated`` claim) so the
+    # hint only clears the amber when the WHOLE target is reviewed, not on the first
+    # of several model_inferred claims.
+    hint = _review_canvas_hint_dict(updated, record.graph)
+    patch = _canvas_hint_to_renderer_patch(
+        record, hint, review_state=updated.review_state
     )
+    # Infer kind dynamically: hardcoding "node" was wrong for edge claims and
+    # produced an inspector for the wrong element type. Determine from the graph.
+    _kind = "edge" if updated.target_id in record.graph.edges else "node"
+    insp = inspector_for_selection(session_id, {"kind": _kind, "id": updated.target_id})
     return ReviewClaimResult(
         review_state=updated.review_state,
         graph_version=record.graph_version,
@@ -2196,6 +2552,44 @@ def review_node_claim(
     return do_review_claim(session_id, preferred[0].id, state)
 
 
+def review_edge_claim(
+    session_id: str,
+    edge_id: str,
+    state: str,
+) -> ReviewClaimResult | None:
+    """Transition the review_state of the most meaningful governing claim of an EDGE.
+
+    Mirror of :func:`review_node_claim` — the radial context menu can fire Accept/
+    Reject on an EDGE as well as a node. Resolves the edge's governing reviewable
+    claim using the same priority logic (skip ``open_question``, prefer
+    ``model_inferred`` whose ``review_state`` gates the export), then delegates to
+    :func:`do_review_claim`.
+
+    Returns ``None`` when the edge has no reviewable governing claims — a graceful
+    no-op. Propagates ``InvalidTransitionError`` on an illegal transition and
+    ``KeyError`` for an unknown session/claim; the caller (``on_select``) maps these
+    to its own idiom.
+    """
+    record = session_store.get(session_id)
+    if record is None or edge_id not in record.graph.edges:
+        return None
+    insp = inspector_for_selection(session_id, {"kind": "edge", "id": edge_id})
+    governing = (insp.get("governing_claims") if insp is not None else None) or []
+    if not governing:
+        return None
+    resolved = [
+        record.graph.claims[c["id"]]
+        for c in governing
+        if c.get("id") in record.graph.claims
+    ]
+    reviewable = [c for c in resolved if c.claim_type != "open_question"] or resolved
+    if not reviewable:
+        return None
+    actionable = [c for c in reviewable if c.review_state != "accepted"] or reviewable
+    preferred = [c for c in actionable if c.origin == "model_inferred"] or actionable
+    return do_review_claim(session_id, preferred[0].id, state)
+
+
 def focus_node(session_id: str, node_id: str) -> RendererPatch | None:
     """Build a transient *focus* patch for a node: dim everything except the node
     and its currently-visible neighbours, then animate the camera to the node.
@@ -2292,7 +2686,10 @@ def expand_node(
         nid: effective_node_label(n, record.graph.claims.values())
         for nid, n in record.graph.nodes.items()
     }
-    edge_label_map = {eid: e.label for eid, e in record.graph.edges.items()}
+    edge_label_map = {
+        eid: effective_edge_label(e, record.graph.claims.values())
+        for eid, e in record.graph.edges.items()
+    }
     edge_kind_map = {eid: e.kind for eid, e in record.graph.edges.items()}
     ops = diff_scene(
         old_scene,
@@ -2323,6 +2720,145 @@ def expand_node(
     return patch
 
 
+# Max outstanding (still-pending) model-inferred hypothesis edges per session.
+# "Find a hidden connection" proposes a fresh cross-cluster bridge each click; as
+# accepted/rejected ones drop out of the pending set the budget refills, so this
+# caps how many AMBER awaiting-review hypotheses can pile up at once — it does not
+# cap the lifetime total.
+_MAX_PENDING_HYPOTHESES = 4
+
+
+def _pending_hypothesis_count(graph: LooseGraphRepository) -> int:
+    """Count outstanding model-inferred hypothesis edges still awaiting review.
+
+    A hypothesis edge is governed by a ``model_inferred`` / ``review_state="pending"``
+    relationship claim whose ``target_id`` is a ``hypedge`` edge id (the prefix
+    minted by :func:`find_connection_session`).
+    """
+    return sum(
+        1
+        for c in graph.claims.values()
+        if c.origin == "model_inferred"
+        and c.review_state == "pending"
+        and c.target_id.startswith("hypedge")
+        and c.target_id in graph.edges
+    )
+
+
+async def find_connection_session(session_id: str) -> RendererPatch | None:
+    """ "Find a hidden connection": surface a SURPRISING cross-cluster link as a
+    model-inferred *proposal* (amber, awaiting review) — never auto-applied.
+
+    Picks two visible nodes in different communities that aren't already linked but
+    sit on a short structural bridge (``scene_curator.find_bridge_candidate``), then
+    proposes a ``model_inferred`` / ``review_state="pending"`` hypothesis edge between
+    them, flashes it, and pans the camera to it. The edge carries a governing pending
+    Claim so it renders as the amber awaiting-review affordance and is reviewable /
+    redacted-on-export exactly like any other model proposal (trust model intact).
+
+    Mirrors :func:`expand_node`'s self-contained diff path (not the LLM pipeline).
+    Returns ``None`` for an unknown session, when there's no cross-cluster candidate
+    (single cluster / all pairs already linked), or when there are already
+    ``_MAX_PENDING_HYPOTHESES`` outstanding pending hypotheses — all graceful no-ops.
+    """
+    record = session_store.get(session_id)
+    if record is None:
+        return None
+    async with _get_lock(session_id):
+        # Cap outstanding amber hypotheses: each click adds a NEW cross-cluster pair
+        # (the bridge finder skips existing-edge pairs, so a fresh pair never collides
+        # — the old ``edge_id in record.graph.edges`` guard was dead). Without this cap
+        # repeated clicks flood the canvas with unreviewed proposals. Review some first
+        # to refill the budget.
+        if _pending_hypothesis_count(record.graph) >= _MAX_PENDING_HYPOTHESES:
+            return None
+
+        from loosecanvas.scene_curator import (
+            compute_node_clusters,
+            find_bridge_candidate,
+        )
+
+        clusters = compute_node_clusters(record.graph)
+        pair = find_bridge_candidate(
+            record.graph, clusters, list(record.scene.visible_node_ids)
+        )
+        if pair is None:
+            return None
+        src, tgt = pair
+        label = "might relate to"
+        edge_id = _stable_id("hypedge", src, tgt, label)
+
+        # The model proposes a hypothesis edge; the governing pending Claim is what
+        # makes it render amber + reviewable (edge.properties alone don't drive the
+        # trust map). Origin is frozen model_inferred — review never upgrades it.
+        edge = Edge(
+            id=edge_id,
+            source=src,
+            target=tgt,
+            type="hypothesis",
+            label=label,
+            properties={"origin": "model_inferred"},
+        )
+        edge_claim = Claim(
+            id=_stable_id("claim", "relationship", edge_id, label),
+            claim_type="relationship",
+            target_id=edge_id,
+            text=label,
+            origin="model_inferred",
+            support_state="unverified",
+            review_state="pending",
+        )
+        graph_patch = GraphPatch(upsert_edges=[edge], upsert_claims=[edge_claim])
+        scene_patch = ScenePatch(add_visible_edge_ids=[edge_id])
+
+        old_scene = record.scene
+        record.graph.apply_graph_patch(graph_patch)
+        candidate = record.graph.apply_scene_patch(old_scene, scene_patch)
+
+        edge_map = {eid: (e.source, e.target) for eid, e in record.graph.edges.items()}
+        node_map = {
+            nid: effective_node_label(n, record.graph.claims.values())
+            for nid, n in record.graph.nodes.items()
+        }
+        edge_label_map = {
+            eid: effective_edge_label(e, record.graph.claims.values())
+            for eid, e in record.graph.edges.items()
+        }
+        edge_kind_map = {eid: e.kind for eid, e in record.graph.edges.items()}
+        ops = diff_scene(
+            old_scene,
+            candidate,
+            edge_map=edge_map,
+            node_map=node_map,
+            edge_label_map=edge_label_map,
+            edge_kind_map=edge_kind_map,
+            node_trust_map=_build_node_trust_map(record.graph),
+            edge_trust_map=_build_edge_trust_map(record.graph),
+        )
+        ops.append(
+            RendererCommand(op="flash", data={"ids": [edge_id], "duration": 1400})
+        )
+        ops.append(
+            RendererCommand(
+                op="animate_camera",
+                data={"fit_selector": f"#{edge_id}", "padding": 80},
+            )
+        )
+
+        record.scene = candidate  # atomic: only after diff_scene succeeded
+        record.graph_version += 1
+        record.last_seen = time.time()
+        record.patch_id += 1
+        patch = RendererPatch(
+            patch_id=record.patch_id,
+            is_snapshot=False,
+            scene_id=record.render_scene_id,
+            operations=ops,
+        )
+        _commit_snapshot(record)
+        return patch
+
+
 # ── Agent-turn pipeline (called by agent_tools.finalize_agent_turn) ───────────
 
 # The agent composes a turn from many individually-validated tool calls; the legacy
@@ -2362,6 +2898,13 @@ def apply_agent_actions(
     )
     record.graph.apply_graph_patch(graph_patch)
     new_scene = record.graph.apply_scene_patch(record.scene, scene_patch)
+    # Label overlays upserted this turn (update_edge / update_node) need an explicit
+    # render refresh — diff_scene won't repaint a persisting element's label.
+    relabeled_ids = [
+        claim.target_id
+        for claim in graph_patch.upsert_claims
+        if claim.claim_type == "label"
+    ]
     return _finalize_turn(
         record,
         prev_scene=record.scene,
@@ -2373,4 +2916,5 @@ def apply_agent_actions(
         status=_status(result),
         warnings=result.rejection_reasons,
         selection=selection,
+        relabeled_ids=relabeled_ids,
     )

src/loosecanvas/validator.py

@@ -244,6 +244,8 @@ def _missing_required_field(action: SceneAction) -> str | None:
         if not action.label and not action.note:
             return "missing_required_field:label_or_note"
         required = ()  # already checked above
+    elif action.type == SceneActionType.update_edge:
+        required = (("edge_id", action.edge_id), ("label", action.label))
     elif action.type == SceneActionType.create_edge:
         required = (
             ("source_id", action.source_id),
@@ -343,6 +345,13 @@ def _existence_and_scene_reason(
             return f"id_not_found:{action.target_id}"
         return None
 
+    if action.type == SceneActionType.update_edge:
+        if graph.get_edge(action.edge_id) is None:
+            return f"id_not_found:{action.edge_id}"
+        if action.edge_id not in scene.visible_edge_ids:
+            return f"edge_not_visible:{action.edge_id}"
+        return None
+
     if action.type == SceneActionType.create_node:
         if graph.get_node(action.target_id) is not None or (
             action.target_id in pending_created
@@ -373,12 +382,18 @@ _USER_ASSERTED_ORIGIN = "user_asserted"
 
 
 def _has_duplicate_user_edge(action: SceneAction, graph: LooseGraphRepository) -> bool:
-    """True if a user_asserted edge already exists for this source/target/label."""
+    """True if ANY edge already connects source→target with a similar label.
+
+    A ``create_edge`` re-asserting an existing relationship is redundant regardless
+    of that edge's origin — including a model_inferred one (agent ``create_edge`` is
+    now model_inferred, so origin-gating this to user_asserted let the agent pile up
+    duplicate edges). ``propose_hypothesis`` keeps its own laxer dedup
+    (:func:`_has_duplicate_deterministic_edge`) so a hypothesis isn't blocked by a
+    prior model guess.
+    """
     for edge in graph.edges.values():
         if edge.source != action.source_id or edge.target != action.target_id:
             continue
-        if edge.properties.get("origin") != _USER_ASSERTED_ORIGIN:
-            continue
         if _labels_similar(action.label, edge.label):
             return True
     return False

tests/test_agent_harness.py

@@ -147,7 +147,11 @@ async def test_streaming_emits_tool_activity(live_session_id: str) -> None:
         )
     ]
     activity = [ev for ev in events if isinstance(ev, ToolActivityEvent)]
-    assert any("reveal_node" in ev.message for ev in activity)
+    # Streamed activity is narrated in friendly present tense, not the raw tool name.
+    from loosecanvas.agent_harness import _friendly_tool
+
+    assert any(_friendly_tool("reveal_node") in ev.message for ev in activity)
+    assert all("reveal_node" not in ev.message for ev in activity)
 
 
 async def test_source_text_seeded_once_at_front(live_session_id: str) -> None:
@@ -284,3 +288,22 @@ def test_compose_without_record_is_backward_compatible() -> None:
         "[The user currently has node 'n2' selected.]"
     )
     assert _compose_user_message("hi", {"kind": "none", "id": ""}) == "hi"
+
+
+# ── Slice (b): confidence-tier voice ─────────────────────────────────────────
+
+
+def test_system_prompt_contains_confidence_tier_voice_cue() -> None:
+    """SYSTEM_PROMPT must contain the calibrate-voice-to-confidence block."""
+    assert "CALIBRATE YOUR VOICE TO YOUR CONFIDENCE" in SYSTEM_PROMPT
+    # Check all three tiers are present.
+    assert "user-asserted" in SYSTEM_PROMPT or "explicitly named" in SYSTEM_PROMPT
+    assert "model-inferred" in SYSTEM_PROMPT or "I notice" in SYSTEM_PROMPT
+    assert "provocateur" in SYSTEM_PROMPT or "but what if" in SYSTEM_PROMPT
+
+
+def test_system_prompt_honors_conversational_tone_requests() -> None:
+    """SYSTEM_PROMPT must instruct the agent to honor user tone/style requests."""
+    # The sentence added in place of the old steering-lens machinery tells the
+    # agent to shift its voice when the user asks (e.g. "be more skeptical").
+    assert "skeptical" in SYSTEM_PROMPT

tests/test_agent_tools.py

@@ -23,6 +23,7 @@ from loosecanvas.agent_tools import (
     remove_node,
     reveal_node,
     set_turn_context,
+    update_edge,
 )
 from loosecanvas.turn_logic import (
     TurnResult,
@@ -94,6 +95,34 @@ async def test_reveal_node_accept_path(live_session_id: str) -> None:
     assert len(ctx.activity) == 1
 
 
+async def test_get_canvas_state_includes_visible_edges(live_session_id: str) -> None:
+    set_turn_context(live_session_id)
+    state = json.loads(get_canvas_state.invoke({}))
+    assert "visible_edges" in state, "agent must be able to see edges to relabel them"
+    for edge in state["visible_edges"]:
+        assert set(edge) >= {"id", "source", "target", "label"}
+        assert edge["id"] in state["visible_edge_ids"]
+
+
+async def test_update_edge_accumulates_for_visible_edge(live_session_id: str) -> None:
+    set_turn_context(live_session_id)
+    state = json.loads(get_canvas_state.invoke({}))
+    if not state["visible_edges"]:
+        pytest.skip("fixture has no visible edge to relabel")
+    edge_id = state["visible_edges"][0]["id"]
+    result = json.loads(
+        update_edge.invoke({"edge_id": edge_id, "label": "clearer link"})
+    )
+    assert result["status"] == "accepted"
+    ctx = get_turn_context()
+    assert any(
+        a.type.value == "update_edge"
+        and a.edge_id == edge_id
+        and a.label == "clearer link"
+        for a in ctx.accumulated_actions
+    )
+
+
 async def test_reveal_node_reject_path(live_session_id: str) -> None:
     set_turn_context(live_session_id)
     # Completely nonexistent node id — validator gives id_not_found

tests/test_b2_cxtmenu_review.py

@@ -25,6 +25,7 @@ from loosecanvas.turn_logic import (
     expand_node,
     focus_node,
     remove_user_edge,
+    review_edge_claim,
     review_node_claim,
 )
 
@@ -333,3 +334,146 @@ async def test_remove_user_edge_unknown_session_raises() -> None:
     """An unknown session raises KeyError (the on_select branch catches it)."""
     with pytest.raises(KeyError):
         await remove_user_edge("no-such-session", "e1")
+
+
+# ── TASK 1: reject a node claim must NOT remove the node ─────────────────────
+
+
+def test_reject_node_claim_keeps_node_on_canvas() -> None:
+    """Bug fix: rejecting a governing model_inferred claim on a NODE must NOT emit
+    remove_element for the node id. The node stays on canvas; only the amber
+    'awaiting review' badge is cleared (clear_pending action, same as accept).
+
+    The backend graph_repository retains the node — this test verifies that the
+    renderer patch also does NOT contain a remove_element op targeting the node id,
+    i.e. the canvas/backend desync is prevented.
+    """
+    claim = Claim(
+        id="c-node",
+        claim_type="label",
+        target_id="n1",
+        origin="model_inferred",
+        review_state="pending",
+        support_state="unverified",
+        text="test label",
+    )
+    sid = _make_session([claim])
+    result = turn_logic.do_review_claim(sid, "c-node", "rejected")
+    record = turn_logic.session_store[sid]
+
+    # Node still present in the graph (backend).
+    assert (
+        "n1" in record.graph.nodes
+    ), "node must NOT be removed from the graph on claim reject"
+
+    # Renderer patch must NOT contain a remove_element op targeting the node id.
+    remove_ops = [
+        o
+        for o in result.renderer_patch.operations
+        if o.op == "remove_element" and "n1" in (o.selector or "")
+    ]
+    assert (
+        not remove_ops
+    ), f"rejecting a node claim must not emit remove_element for the node; got: {remove_ops}"
+
+    # The canvas hint should clear the pending badge, not remove the element.
+    assert (
+        result.canvas_hint["action"] == "clear_pending"
+    ), f"expected clear_pending for rejected node claim, got {result.canvas_hint['action']!r}"
+    assert result.canvas_hint["target_id"] == "n1"
+
+
+# ── TASK 2: review_edge_claim (wrapper parity with review_node_claim) ─────────
+
+
+def _make_session_with_pending_edge_claim() -> str:
+    """Session with a model_inferred pending edge claim on e1 (n1→n2)."""
+    nodes = [
+        Node(id="n1", kind="concept", label="N1"),
+        Node(id="n2", kind="concept", label="N2"),
+    ]
+    edge = Edge(id="e1", source="n1", target="n2", kind="related_to", label="links")
+    claim = Claim(
+        id="c-edge",
+        claim_type="relationship",
+        target_id="e1",
+        origin="model_inferred",
+        review_state="pending",
+        support_state="unverified",
+        text="links",
+    )
+    repo = LooseGraphRepository.from_extraction(
+        nodes, [edge], [claim], SourceSnapshot()
+    )
+    scene = SceneState(
+        scene_id="s1",
+        visible_node_ids=["n1", "n2"],
+        visible_edge_ids=["e1"],
+    )
+    sid = str(uuid.uuid4())
+    now = time.time()
+    turn_logic.session_store[sid] = turn_logic.SessionRecord(
+        session_id=sid,
+        graph=repo,
+        scene=scene,
+        history=[],
+        graph_version=1,
+        created_at=now,
+        last_seen=now,
+        render_scene_id="s1",
+    )
+    return sid
+
+
+def test_review_edge_claim_accept_transitions_claim() -> None:
+    """review_edge_claim accept → claim transitions to accepted, result carries inspector."""
+    sid = _make_session_with_pending_edge_claim()
+    result = review_edge_claim(sid, "e1", "accepted")
+    assert isinstance(result, ReviewClaimResult)
+    assert result.review_state == "accepted"
+    assert (
+        turn_logic.session_store[sid].graph.claims["c-edge"].review_state == "accepted"
+    )
+
+
+def test_review_edge_claim_reject_transitions_claim() -> None:
+    """review_edge_claim reject → claim transitions to rejected."""
+    sid = _make_session_with_pending_edge_claim()
+    result = review_edge_claim(sid, "e1", "rejected")
+    assert isinstance(result, ReviewClaimResult)
+    assert result.review_state == "rejected"
+    assert (
+        turn_logic.session_store[sid].graph.claims["c-edge"].review_state == "rejected"
+    )
+
+
+def test_review_edge_claim_returns_none_for_edge_without_pending_claims() -> None:
+    """An edge with no reviewable claims is a graceful no-op."""
+    nodes = [
+        Node(id="n1", kind="concept", label="N1"),
+        Node(id="n2", kind="concept", label="N2"),
+    ]
+    edge = Edge(id="e1", source="n1", target="n2", kind="related_to")
+    repo = LooseGraphRepository.from_extraction(nodes, [edge], [], SourceSnapshot())
+    scene = SceneState(
+        scene_id="s1", visible_node_ids=["n1", "n2"], visible_edge_ids=["e1"]
+    )
+    sid = str(uuid.uuid4())
+    now = time.time()
+    turn_logic.session_store[sid] = turn_logic.SessionRecord(
+        session_id=sid,
+        graph=repo,
+        scene=scene,
+        history=[],
+        graph_version=1,
+        created_at=now,
+        last_seen=now,
+        render_scene_id="s1",
+    )
+    assert review_edge_claim(sid, "e1", "accepted") is None
+
+
+def test_review_edge_claim_returns_none_for_unknown_edge() -> None:
+    """An unknown edge_id is a graceful no-op."""
+    sid = _make_session_with_pending_edge_claim()
+    assert review_edge_claim(sid, "does_not_exist", "accepted") is None

tests/test_contracts.py

@@ -258,8 +258,8 @@ def test_edgespec_position_roundtrip() -> None:
 
 def test_scene_action_type_has_ten_values() -> None:
     # T2-01 added remove_node/remove_edge (10 → 12); T2-03 added update_node/create_edge (12 → 14);
-    # agent graph-growth added create_node (14 → 15).
-    assert len(list(SceneActionType)) == 15
+    # agent graph-growth added create_node (14 → 15); edge editing added update_edge (15 → 16).
+    assert len(list(SceneActionType)) == 16
 
 
 @pytest.mark.parametrize("action_type", list(SceneActionType))
@@ -295,6 +295,7 @@ def test_scene_action_type_values() -> None:
         "remove_edge",
         # T2-03 user-edit actions:
         "update_node",
+        "update_edge",
         "create_edge",
         # Agent graph-growth action:
         "create_node",

tests/test_edge_claim_review.py

@@ -0,0 +1,238 @@
+"""Edge/claim-level review (#4 multidigraph).
+
+A model-inferred *proposed* edge (a "find a hidden connection" hypothesis, or an
+agent ``create_edge``) carries its own relationship claim and must be reviewable
+with the same Accept/Reject affordance as a node — the review loop applies to
+relationships, not just concepts. The Gradio review handlers are claim-id based and
+kind-agnostic (``do_review_claim`` / ``on_review_claim``), and the edge inspector
+exposes ``governing_claims``, so selecting an edge surfaces its pending claim and the
+generic Accept/Reject buttons transition it.
+
+These tests lock that end-to-end backend capability so a refactor can't silently
+regress edge review back to node-only.
+"""
+
+from __future__ import annotations
+
+import json
+import time
+import uuid
+
+from loosecanvas import turn_logic
+from loosecanvas.contracts import Claim, Edge, Node, SceneState, SourceSnapshot
+from loosecanvas.graph_repository import LooseGraphRepository
+
+
+def _session_with_model_edge() -> tuple[str, str, str]:
+    """A session whose single edge is a model_inferred PROPOSAL (pending review)."""
+    nodes = [
+        Node(id="n1", kind="concept", label="N1"),
+        Node(id="n2", kind="concept", label="N2"),
+    ]
+    edge = Edge(
+        id="e1",
+        source="n1",
+        target="n2",
+        kind="related",
+        label="links",
+        properties={"origin": "model_inferred"},
+    )
+    claim = Claim(
+        id="c-rel",
+        claim_type="relationship",
+        target_id="e1",
+        text="links",
+        origin="model_inferred",
+        support_state="unverified",
+        review_state="pending",
+    )
+    repo = LooseGraphRepository.from_extraction(
+        nodes, [edge], [claim], SourceSnapshot()
+    )
+    scene = SceneState(
+        scene_id="s1", visible_node_ids=["n1", "n2"], visible_edge_ids=["e1"]
+    )
+    sid = str(uuid.uuid4())
+    now = time.time()
+    turn_logic.session_store[sid] = turn_logic.SessionRecord(
+        session_id=sid,
+        graph=repo,
+        scene=scene,
+        history=[],
+        graph_version=1,
+        created_at=now,
+        last_seen=now,
+        render_scene_id="s1",
+    )
+    return sid, "e1", "c-rel"
+
+
+def test_edge_inspector_surfaces_pending_claim() -> None:
+    sid, edge_id, claim_id = _session_with_model_edge()
+    try:
+        insp = turn_logic.inspector_for_selection(sid, {"kind": "edge", "id": edge_id})
+        assert insp is not None, "selecting an edge must yield an inspector payload"
+        claims = insp["governing_claims"]
+        actionable = [c for c in claims if c["review_state"] != "accepted"]
+        assert any(c["id"] == claim_id for c in actionable), (
+            "a pending model-inferred edge claim must surface as reviewable — this is "
+            "what the generic Accept/Reject buttons act on"
+        )
+    finally:
+        turn_logic.session_store.pop(sid, None)
+
+
+def test_do_review_claim_accepts_edge_claim() -> None:
+    sid, edge_id, claim_id = _session_with_model_edge()
+    try:
+        result = turn_logic.do_review_claim(sid, claim_id, "accepted")
+        record = turn_logic.session_store[sid]
+        assert record.graph.claims[claim_id].review_state == "accepted"
+        # The review result targets the EDGE — proving review works at edge level.
+        assert result is not None
+        assert result.renderer_patch is not None
+    finally:
+        turn_logic.session_store.pop(sid, None)
+
+
+def test_do_review_claim_rejects_edge_claim() -> None:
+    sid, edge_id, claim_id = _session_with_model_edge()
+    try:
+        turn_logic.do_review_claim(sid, claim_id, "rejected")
+        record = turn_logic.session_store[sid]
+        assert record.graph.claims[claim_id].review_state == "rejected"
+    finally:
+        turn_logic.session_store.pop(sid, None)
+
+
+def test_reject_edge_claim_still_removes_edge() -> None:
+    """Regression guard: rejecting a model_inferred EDGE claim must still emit a
+    remove_element op for the edge — edge rejection removing the proposed
+    relationship from canvas is the intended behaviour (locked by this test).
+
+    This is the OPPOSITE of the node-claim fix: a rejected node claim must NOT
+    remove the node (the node is a durable entity); a rejected edge claim MUST
+    remove the edge (the proposed relationship is revoked). Both paths must be
+    preserved independently.
+    """
+    sid, edge_id, claim_id = _session_with_model_edge()
+    try:
+        result = turn_logic.do_review_claim(sid, claim_id, "rejected")
+        # Claim is marked rejected.
+        assert (
+            turn_logic.session_store[sid].graph.claims[claim_id].review_state
+            == "rejected"
+        )
+        # The renderer patch MUST contain a remove_element op for the edge.
+        remove_ops = [
+            o
+            for o in result.renderer_patch.operations
+            if o.op == "remove_element" and edge_id in (o.selector or "")
+        ]
+        assert remove_ops, (
+            "rejecting an edge claim must emit remove_element for the edge id; "
+            f"got ops: {[o.op for o in result.renderer_patch.operations]}"
+        )
+        # Canvas hint action must be 'remove' (not 'clear_pending').
+        assert result.canvas_hint["action"] == "remove"
+        assert result.canvas_hint["target_id"] == edge_id
+    finally:
+        turn_logic.session_store.pop(sid, None)
+
+
+# --------------------------------------------------------------------------- #
+# End-to-end: text-extracted edge (semantic_edge claim) review                #
+# --------------------------------------------------------------------------- #
+
+_HAPPY_EDGE_JSON = json.dumps(
+    {
+        "concept_nodes": [
+            {
+                "id": "concept::alpha",
+                "label": "Alpha",
+                "summary": "First concept.",
+                "start_char": 0,
+                "end_char": 5,
+            },
+            {
+                "id": "concept::beta",
+                "label": "Beta",
+                "summary": "Second concept.",
+                "start_char": 7,
+                "end_char": 11,
+            },
+        ],
+        "semantic_edges": [
+            {
+                "source_id": "concept::alpha",
+                "target_id": "concept::beta",
+                "type": "explains",
+                "label": "introduces",
+            }
+        ],
+    }
+)
+
+
+async def test_text_extracted_edge_review_end_to_end() -> None:
+    """Build a session from text-extracted output; call review_edge_claim on the
+    text-extracted edge and assert the governing semantic_edge claim transitions to
+    'accepted'.  This locks the no-longer-no-op review path.
+    """
+    import httpx
+    from loosecanvas.extractors.text_graph_adapter import extract_graph_from_text
+    from loosecanvas.llm_client import LLMClient
+
+    def handler(_request: httpx.Request) -> httpx.Response:
+        return httpx.Response(
+            200, json={"choices": [{"message": {"content": _HAPPY_EDGE_JSON}}]}
+        )
+
+    client = LLMClient(base_url="http://test", transport=httpx.MockTransport(handler))
+    graph = await extract_graph_from_text("Alpha explains Beta.", "test", client)
+
+    assert len(graph.edges) == 1, f"expected 1 edge, got {len(graph.edges)}"
+    edge = graph.edges[0]
+    # The semantic_edge claim must target the edge id (not the target node id).
+    semantic_claims = [c for c in graph.claims if c.claim_type == "semantic_edge"]
+    assert len(semantic_claims) == 1
+    governing_claim = semantic_claims[0]
+    assert (
+        governing_claim.target_id == edge.id
+    ), f"governing claim targets {governing_claim.target_id!r}, not edge id {edge.id!r}"
+    assert governing_claim.review_state == "pending"
+
+    # Build a live session via the real repository/session_store path.
+    repo = LooseGraphRepository.from_extraction(
+        graph.nodes, graph.edges, graph.claims, SourceSnapshot()
+    )
+    scene = SceneState(
+        scene_id="s1",
+        visible_node_ids=[n.id for n in graph.nodes],
+        visible_edge_ids=[edge.id],
+    )
+    sid = str(uuid.uuid4())
+    now = time.time()
+    turn_logic.session_store[sid] = turn_logic.SessionRecord(
+        session_id=sid,
+        graph=repo,
+        scene=scene,
+        history=[],
+        graph_version=1,
+        created_at=now,
+        last_seen=now,
+        render_scene_id="s1",
+    )
+    try:
+        result = turn_logic.do_review_claim(sid, governing_claim.id, "accepted")
+        record = turn_logic.session_store[sid]
+        assert (
+            record.graph.claims[governing_claim.id].review_state == "accepted"
+        ), "review_edge_claim was a no-op: governing semantic_edge claim not updated"
+        assert result is not None
+        assert result.renderer_patch is not None
+        # After accepting, the canvas hint must clear the amber (single-claim edge).
+        assert result.canvas_hint["action"] == "clear_pending"
+        assert result.canvas_hint["target_id"] == edge.id
+    finally:
+        turn_logic.session_store.pop(sid, None)

tests/test_exporter.py

@@ -4,7 +4,17 @@ from __future__ import annotations
 
 import json
 
-from loosecanvas.contracts import Claim, Edge, MapEvent, Node, SuggestedPathway
+from loosecanvas import reducer
+from loosecanvas.contracts import (
+    Claim,
+    Edge,
+    MapEvent,
+    Node,
+    SceneAction,
+    SceneActionType,
+    SceneState,
+    SuggestedPathway,
+)
 from loosecanvas.exporter import export_session
 from loosecanvas.graph_repository import LooseGraphRepository
 
@@ -29,7 +39,7 @@ def _repo() -> LooseGraphRepository:
             Node(id="n2", kind="function", label="bar"),
         ]
     )
-    repo.upsert_edges([Edge(id="e1", source="n1", target="n2", kind="calls")])
+    repo.upsert_edges([Edge(id="e1", source="n1", target="n2", type="calls")])
     repo.upsert_claims(
         [
             Claim(id="c1", claim_type="fact", target_id="n1", origin="deterministic"),
@@ -55,6 +65,7 @@ def _repo() -> LooseGraphRepository:
                 claim_type="open_question",
                 target_id="n1",
                 origin="model_inferred",
+                review_state="accepted",  # reviewed: a trusted open question
                 text="Why does n1 exist?",
             ),
         ]
@@ -86,7 +97,11 @@ async def test_unreviewed_model_inferred_excluded() -> None:
     assert "c4" not in claim_ids
 
 
-async def test_open_question_routed_to_open_questions_with_text_as_note() -> None:
+async def test_reviewed_open_question_routed_to_open_questions_with_text_as_note() -> (
+    None
+):
+    """A reviewed (accepted) open_question routes to ``open_questions`` mapping
+    ``text`` -> ``note``; it is never emitted into the ``claims`` array."""
     export = await export_session(_repo(), session_id="s1")
     claim_ids = {c["id"] for c in export["claims"]}
     assert "c5" not in claim_ids
@@ -148,3 +163,307 @@ async def test_export_size_is_reasonable() -> None:
     events = [MapEvent(actor="user", action="noop", detail=str(i)) for i in range(200)]
     export = await export_session(repo, session_id="s1", events=events)
     assert len(json.dumps(export)) < 10_000_000
+
+
+# ── Topology-redaction tests (grounded on the REAL producers) ──────────────────
+#
+# These assert the trust gate at the ARTIFACT level: an unreviewed model_inferred
+# NODE/EDGE must not leak as topology even though its governing pending claim is
+# already dropped. State is built by the real producers (``reducer.reduce_turn`` for
+# create_node, the ``find_connection_session`` edge/claim shape, ``_question_claim``)
+# rather than a hand-built fixture, because the leak shipped green under fiction.
+
+
+def _real_model_node_repo() -> LooseGraphRepository:
+    """Repo with a real model_inferred *pending* node from the create_node producer.
+
+    A trusted ``anchor`` node is seeded so cascade behaviour can be observed against a
+    node that should survive the redaction.
+    """
+    repo = LooseGraphRepository()
+    repo.upsert_nodes([Node(id="anchor", kind="concept", label="Anchor")])
+    scene = SceneState(scene_id="s", visible_node_ids=["anchor"])
+    action = SceneAction(
+        type=SceneActionType.create_node,
+        target_id="concept::proposed",
+        label="Proposed Concept",
+        note="a model guess",
+    )
+    graph_patch, _scene_patch, _events = reducer.reduce_turn([action], repo, scene)
+    repo.apply_graph_patch(graph_patch)
+    return repo
+
+
+def _add_find_connection_edge(repo: LooseGraphRepository, src: str, tgt: str) -> str:
+    """Mint a model_inferred *pending* hypothesis edge exactly like find_connection does.
+
+    Mirrors ``turn_logic.find_connection_session``: an Edge stamped
+    ``properties["origin"]="model_inferred"`` plus a governing pending relationship Claim.
+    Returns the edge id.
+    """
+    label = "might relate to"
+    edge_id = reducer._stable_id("hypedge", src, tgt, label)
+    edge = Edge(
+        id=edge_id,
+        source=src,
+        target=tgt,
+        type="hypothesis",
+        label=label,
+        properties={"origin": "model_inferred"},
+    )
+    edge_claim = Claim(
+        id=reducer._stable_id("claim", "relationship", edge_id, label),
+        claim_type="relationship",
+        target_id=edge_id,
+        text=label,
+        origin="model_inferred",
+        support_state="unverified",
+        review_state="pending",
+    )
+    repo.upsert_edges([edge])
+    repo.upsert_claims([edge_claim])
+    return edge_id
+
+
+async def test_unreviewed_model_node_is_redacted_from_topology() -> None:
+    """The create_node producer's pending node must NOT leak into exported nodes."""
+    repo = _real_model_node_repo()
+    export = await export_session(repo, session_id="s1")
+    node_ids = {n["id"] for n in export["nodes"]}
+    assert "concept::proposed" not in node_ids
+    assert "anchor" in node_ids  # trusted node survives
+
+
+async def test_accepted_model_node_appears_in_topology() -> None:
+    """Once the governing claim is accepted, the node ships."""
+    repo = _real_model_node_repo()
+    # Accept the governing claim (the only claim targeting the proposed node).
+    [claim] = [c for c in repo.claims.values() if c.target_id == "concept::proposed"]
+    repo.upsert_claims([claim.model_copy(update={"review_state": "accepted"})])
+    export = await export_session(repo, session_id="s1")
+    node_ids = {n["id"] for n in export["nodes"]}
+    assert "concept::proposed" in node_ids
+
+
+async def test_unreviewed_model_edge_is_redacted_from_topology() -> None:
+    """A find_connection-style pending hypothesis edge must NOT leak into edges."""
+    repo = LooseGraphRepository()
+    repo.upsert_nodes(
+        [
+            Node(id="a", kind="concept", label="A"),
+            Node(id="b", kind="concept", label="B"),
+        ]
+    )
+    edge_id = _add_find_connection_edge(repo, "a", "b")
+    export = await export_session(repo, session_id="s1")
+    edge_ids = {e["id"] for e in export["edges"]}
+    assert edge_id not in edge_ids
+    # Both endpoints are trusted, so they still ship — only the edge is redacted.
+    assert {n["id"] for n in export["nodes"]} == {"a", "b"}
+
+
+async def test_accepted_model_edge_appears_in_topology() -> None:
+    """Accepting the governing claim promotes the edge into the export."""
+    repo = LooseGraphRepository()
+    repo.upsert_nodes(
+        [
+            Node(id="a", kind="concept", label="A"),
+            Node(id="b", kind="concept", label="B"),
+        ]
+    )
+    edge_id = _add_find_connection_edge(repo, "a", "b")
+    [claim] = [c for c in repo.claims.values() if c.target_id == edge_id]
+    repo.upsert_claims([claim.model_copy(update={"review_state": "accepted"})])
+    export = await export_session(repo, session_id="s1")
+    edge_ids = {e["id"] for e in export["edges"]}
+    assert edge_id in edge_ids
+
+
+async def test_model_edge_redacted_via_properties_when_no_governing_claim() -> None:
+    """Edge with NO governing claim falls back to ``properties['origin']`` for redaction.
+
+    An element that is not claim-backed (e.g. an agent-created edge not yet reviewed)
+    derives its trust from ``properties['origin']``; a ``model_inferred`` such edge must
+    still be redacted from export.
+    """
+    repo = LooseGraphRepository()
+    repo.upsert_nodes(
+        [
+            Node(id="a", kind="concept", label="A"),
+            Node(id="b", kind="concept", label="B"),
+        ]
+    )
+    repo.upsert_edges(
+        [
+            Edge(
+                id="a::rel::b",
+                source="a",
+                target="b",
+                type="prerequisite_of",
+                label="depends on",
+                properties={"origin": "model_inferred"},
+            )
+        ]
+    )
+    export = await export_session(repo, session_id="s1")
+    assert {e["id"] for e in export["edges"]} == set()
+
+
+async def test_cascade_drops_edge_whose_endpoint_is_redacted() -> None:
+    """A user_asserted edge is dropped when one endpoint node is redacted."""
+    repo = _real_model_node_repo()  # anchor (trusted) + concept::proposed (redacted)
+    # A user-accepted edge between the trusted anchor and the redacted proposed node.
+    repo.upsert_edges(
+        [
+            Edge(
+                id="anchor::rel::proposed",
+                source="anchor",
+                target="concept::proposed",
+                type="related",
+                label="relates",
+                properties={"origin": "user_asserted"},
+            )
+        ]
+    )
+    repo.upsert_claims(
+        [
+            Claim(
+                id="claim::rel::proposed",
+                claim_type="relationship",
+                target_id="anchor::rel::proposed",
+                origin="user_asserted",
+                support_state="unverified",
+                review_state="accepted",
+            )
+        ]
+    )
+    export = await export_session(repo, session_id="s1")
+    # Even though the edge itself is user_asserted/accepted, its target node was
+    # redacted, so the edge must cascade-drop (no dangling edge in the artifact).
+    assert {e["id"] for e in export["edges"]} == set()
+    assert "concept::proposed" not in {n["id"] for n in export["nodes"]}
+
+
+async def test_unreviewed_open_question_does_not_export() -> None:
+    """``reducer._question_claim`` mints a model_inferred/pending open_question — it must
+    not leak into ``open_questions``."""
+    repo = LooseGraphRepository()
+    repo.upsert_nodes([Node(id="n1", kind="concept", label="N1")])
+    action = SceneAction(
+        type=SceneActionType.propose_question,
+        target_id="n1",
+        note="Is this even real?",
+    )
+    question_claim = reducer._question_claim(action)
+    assert question_claim.origin == "model_inferred"
+    assert question_claim.review_state == "pending"
+    repo.upsert_claims([question_claim])
+    export = await export_session(repo, session_id="s1")
+    assert export["open_questions"] == []
+
+
+async def test_accepted_open_question_does_export() -> None:
+    """A reviewed (accepted) open_question still surfaces in ``open_questions``."""
+    repo = LooseGraphRepository()
+    repo.upsert_nodes([Node(id="n1", kind="concept", label="N1")])
+    action = SceneAction(
+        type=SceneActionType.propose_question,
+        target_id="n1",
+        note="Worth keeping?",
+    )
+    question_claim = reducer._question_claim(action).model_copy(
+        update={"review_state": "accepted"}
+    )
+    repo.upsert_claims([question_claim])
+    export = await export_session(repo, session_id="s1")
+    assert any(
+        q["target_id"] == "n1" and q["note"] == "Worth keeping?"
+        for q in export["open_questions"]
+    )
+
+
+async def test_metadata_counts_reflect_filtered_topology() -> None:
+    """node_count/edge_count must match the FILTERED lists, not the raw store."""
+    repo = _real_model_node_repo()  # anchor kept, concept::proposed redacted
+    _add_find_connection_edge(repo, "anchor", "concept::proposed")  # pending edge
+    export = await export_session(repo, session_id="s1")
+    meta = export["metadata"]
+    assert meta["node_count"] == len(export["nodes"]) == 1  # only anchor
+    assert meta["edge_count"] == len(export["edges"]) == 0
+    assert meta["claim_count"] == len(export["claims"])
+
+
+# ── Text-extracted semantic_edge claim — exporter trust gate ─────────────────
+
+
+def _text_extracted_repo() -> tuple[LooseGraphRepository, str, str]:
+    """Build a repo mirroring a text-extracted graph with a semantic_edge claim.
+
+    Uses the corrected claim shape (target_id = edge_id, not target node id) so
+    the exporter's governing-claim lookup works as intended.
+
+    Returns (repo, edge_id, claim_id).
+    """
+    repo = LooseGraphRepository()
+    repo.upsert_nodes(
+        [
+            Node(id="concept::alpha", kind="concept", label="Alpha"),
+            Node(id="concept::beta", kind="concept", label="Beta"),
+        ]
+    )
+    edge_id = "concept::alpha::explains::concept::beta"
+    repo.upsert_edges(
+        [
+            Edge(
+                id=edge_id,
+                source="concept::alpha",
+                target="concept::beta",
+                type="explains",
+                label="introduces",
+                properties={"origin": "model_inferred", "support_state": "unverified"},
+            )
+        ]
+    )
+    # Governing claim with the CORRECTED target_id = edge_id (not target node id).
+    claim_id = "claim::semantic::concept::alpha->concept::beta::explains"
+    repo.upsert_claims(
+        [
+            Claim(
+                id=claim_id,
+                claim_type="semantic_edge",
+                source_id="concept::alpha",
+                target_id=edge_id,
+                text="explains",
+                origin="model_inferred",
+                support_state="unverified",
+                review_state="pending",
+            )
+        ]
+    )
+    return repo, edge_id, claim_id
+
+
+async def test_text_extracted_pending_edge_excluded_from_export() -> None:
+    """A text-extracted model_inferred edge is EXCLUDED while its governing claim
+    is pending — the exporter's trust gate applies to semantic_edge claims just as
+    it does to relationship claims from find_connection."""
+    repo, edge_id, _claim_id = _text_extracted_repo()
+    export = await export_session(repo, session_id="s1")
+    edge_ids = {e["id"] for e in export["edges"]}
+    assert (
+        edge_id not in edge_ids
+    ), "pending model_inferred text-extracted edge must be excluded from export"
+
+
+async def test_text_extracted_accepted_edge_included_in_export() -> None:
+    """After the governing semantic_edge claim is accepted, the text-extracted edge
+    IS included in the export — the trust gate opens correctly."""
+    repo, edge_id, claim_id = _text_extracted_repo()
+    # Accept the governing claim.
+    claim = repo.claims[claim_id]
+    repo.upsert_claims([claim.model_copy(update={"review_state": "accepted"})])
+    export = await export_session(repo, session_id="s1")
+    edge_ids = {e["id"] for e in export["edges"]}
+    assert (
+        edge_id in edge_ids
+    ), "accepted model_inferred text-extracted edge must appear in export"

tests/test_find_connection.py

@@ -0,0 +1,189 @@
+"""Tests for the on-demand "find a hidden connection" beat (C14/C15).
+
+Runs against the REAL baked seed fixture (seed_local_ai.json: 3 communities with
+RAG as the articulation hub) so the cross-cluster candidate selection is exercised
+on a genuine graph, not a hand-built one.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from loosecanvas import turn_logic
+from loosecanvas.scene_curator import compute_node_clusters, find_bridge_candidate
+from loosecanvas.turn_logic import (
+    do_review_claim,
+    find_connection_session,
+    inspector_for_selection,
+    load_fixture_session,
+)
+
+_SEED = Path(__file__).resolve().parents[1] / "fixtures" / "seed_local_ai.json"
+
+
+async def test_find_connection_proposes_amber_cross_cluster_edge() -> None:
+    """The button proposes ONE model_inferred/pending edge across two clusters,
+    rendered with the trust hints that drive the amber awaiting-review styling."""
+    sid, _ = await load_fixture_session(fixture_path=_SEED)
+    record = turn_logic.session_store[sid]
+    clusters = compute_node_clusters(record.graph)
+    before_edges = set(record.graph.edges)
+
+    patch = await find_connection_session(sid)
+    assert patch is not None, "seed has 3 clusters → a cross-cluster candidate exists"
+
+    new_edges = set(record.graph.edges) - before_edges
+    assert len(new_edges) == 1, "exactly one connection proposed per press"
+    edge_id = next(iter(new_edges))
+    edge = record.graph.edges[edge_id]
+
+    # Genuinely cross-cluster (the "surprise").
+    assert clusters.get(edge.source) != clusters.get(edge.target)
+
+    # A model proposal awaiting review — origin frozen model_inferred, review pending.
+    assert edge.properties.get("origin") == "model_inferred"
+    governing = [c for c in record.graph.claims.values() if c.target_id == edge_id]
+    assert governing, "the proposed edge must carry a governing claim"
+    assert governing[0].origin == "model_inferred"
+    assert governing[0].review_state == "pending"
+
+    # The patch actually renders it: add the edge + flash + pan to it, with the
+    # trust hints that make the frontend draw it amber/awaiting-review.
+    ops = patch.operations
+    add_ops = [o for o in ops if o.op == "add_element" and o.data.get("id") == edge_id]
+    assert add_ops, "patch must add the proposed edge element"
+    assert add_ops[0].data.get("origin") == "model_inferred"
+    assert add_ops[0].data.get("review") == "pending"
+    assert any(o.op == "flash" for o in ops)
+    assert any(o.op == "animate_camera" for o in ops)
+
+
+async def test_find_connection_proposes_a_different_pair_each_press() -> None:
+    """Two presses never re-propose the same edge (the first is now linked, so it's
+    excluded); the second is a different connection or a graceful None."""
+    sid, _ = await load_fixture_session(fixture_path=_SEED)
+    first = await find_connection_session(sid)
+    assert first is not None
+    second = await find_connection_session(sid)
+    if second is not None:
+        first_edge = next(
+            o.data["id"] for o in first.operations if o.op == "add_element"
+        )
+        second_edge = next(
+            o.data["id"] for o in second.operations if o.op == "add_element"
+        )
+        assert first_edge != second_edge
+
+
+async def test_found_connection_edge_is_reviewable_end_to_end() -> None:
+    """The 'you decide' half: selecting the proposed EDGE exposes its governing
+    model_inferred/pending claim, and accepting it clears the amber (remove_class
+    review-pending on the edge id). Edges are reviewable just like nodes."""
+    sid, _ = await load_fixture_session(fixture_path=_SEED)
+    record = turn_logic.session_store[sid]
+    before = set(record.graph.edges)
+    patch = await find_connection_session(sid)
+    assert patch is not None
+    edge_id = next(iter(set(record.graph.edges) - before))
+
+    # Selecting the EDGE surfaces its governing claim (previously edges returned None).
+    insp = inspector_for_selection(sid, {"kind": "edge", "id": edge_id})
+    assert insp is not None, "edge selection must yield an inspector payload"
+    gov = insp.get("governing_claims") or []
+    assert gov, "the proposed edge must expose a governing claim to review"
+    claim = gov[0]
+    assert claim["origin"] == "model_inferred"
+    assert claim["review_state"] == "pending"
+
+    # Accepting it clears the amber awaiting-review affordance on the edge.
+    result = do_review_claim(sid, claim["id"], "accepted")
+    assert result.review_state == "accepted"
+    remove_ops = [
+        op
+        for op in result.renderer_patch.operations
+        if op.op == "remove_class" and op.data.get("class") == "review-pending"
+    ]
+    assert any(
+        op.selector == f"#{edge_id}" for op in remove_ops
+    ), "accepting the edge must clear review-pending on the edge id"
+
+
+def test_find_bridge_candidate_none_when_too_small() -> None:
+    """Fewer than two visible nodes → no cross-cluster pair → graceful None."""
+    from loosecanvas.contracts import Node, SourceSnapshot
+    from loosecanvas.graph_repository import LooseGraphRepository
+
+    repo = LooseGraphRepository.from_extraction(
+        [Node(id="n1", kind="concept", label="A")], [], [], SourceSnapshot()
+    )
+    clusters = compute_node_clusters(repo)
+    assert find_bridge_candidate(repo, clusters, ["n1"]) is None
+
+
+# ── BUG 2: repeated clicks must not flood the graph with hypothesis edges ──────
+
+
+def _pending_hypedge_claims(record: turn_logic.SessionRecord) -> list[str]:
+    """Ids of outstanding model_inferred / pending claims governing hypedge edges."""
+    return [
+        c.id
+        for c in record.graph.claims.values()
+        if c.origin == "model_inferred"
+        and c.review_state == "pending"
+        and c.target_id.startswith("hypedge")
+        and c.target_id in record.graph.edges
+    ]
+
+
+async def test_find_connection_caps_outstanding_pending_hypotheses() -> None:
+    """BUG 2 regression. Loop find_connection_session until it returns None: it must
+    stop at the per-session cap, not flood (the dead ``edge_id in edges`` guard let
+    ~23 amber proposals pile up on this real fixture).
+
+    Grounded on the REAL producer (load_fixture_session over seed_local_ai), so the
+    actual bridge-finder + cluster computation are exercised — not a hand-built graph.
+    """
+    from loosecanvas.turn_logic import _MAX_PENDING_HYPOTHESES
+
+    sid, _ = await load_fixture_session(fixture_path=_SEED)
+    record = turn_logic.session_store[sid]
+
+    successes = 0
+    for _ in range(40):  # loop well past the cap; correct impl no-ops once hit
+        patch = await find_connection_session(sid)
+        if patch is None:
+            break
+        successes += 1
+    else:  # pragma: no cover - only reached if the cap never engages (the bug)
+        raise AssertionError(
+            "find_connection_session never returned None in 40 calls — "
+            "the pending-hypothesis cap is not engaging (flood bug)"
+        )
+
+    assert successes == _MAX_PENDING_HYPOTHESES, (
+        f"expected exactly {_MAX_PENDING_HYPOTHESES} proposals before the cap "
+        f"no-ops, got {successes} (pre-fix this fixture yielded ~23)"
+    )
+    assert len(_pending_hypedge_claims(record)) == _MAX_PENDING_HYPOTHESES
+
+
+async def test_reviewing_a_hypothesis_refills_the_budget() -> None:
+    """The cap is on OUTSTANDING pending hypotheses, not lifetime total: after the
+    cap is hit, accepting one frees a slot so a new proposal can land."""
+    from loosecanvas.turn_logic import _MAX_PENDING_HYPOTHESES
+
+    sid, _ = await load_fixture_session(fixture_path=_SEED)
+    record = turn_logic.session_store[sid]
+
+    for _ in range(_MAX_PENDING_HYPOTHESES):
+        assert await find_connection_session(sid) is not None
+    assert await find_connection_session(sid) is None, "cap should be engaged"
+
+    pending = _pending_hypedge_claims(record)
+    assert len(pending) == _MAX_PENDING_HYPOTHESES
+    do_review_claim(sid, pending[0], "accepted")
+    assert len(_pending_hypedge_claims(record)) == _MAX_PENDING_HYPOTHESES - 1
+
+    # A genuinely new cross-cluster pair exists (pre-fix probe found ~23), so freeing
+    # a slot lets a fresh proposal through.
+    assert await find_connection_session(sid) is not None

tests/test_fixture_adapter.py

@@ -121,3 +121,34 @@ def test_annotated_graph_loads() -> None:
     assert isinstance(scene, SceneState)
     # The annotated variant adds notes / hypotheses / open questions on top of the base.
     assert len(graph.claims) > 3
+
+
+def test_load_fixture_from_dict_missing_graph_raises_value_error() -> None:
+    """A partial/corrupt fixture (no ``graph`` key) must raise ``ValueError`` — NOT a
+    bare ``KeyError`` that bubbles up as an opaque 500 on /api/load_graph."""
+    data = {
+        "scene": {
+            "scene_id": "s0",
+            "visible_node_ids": [],
+            "visible_edge_ids": [],
+            "fogged_node_ids": [],
+            "node_positions": {},
+        },
+    }
+    with pytest.raises(ValueError, match="fixture missing graph/scene"):
+        load_fixture_from_dict(data)
+
+
+def test_load_fixture_from_dict_missing_scene_raises_value_error() -> None:
+    """A partial fixture (no ``scene`` key) must raise ``ValueError`` (mapped to 400),
+    not ``KeyError`` (opaque 500)."""
+    data = {
+        "graph": {
+            "nodes": [{"id": "n1", "kind": "concept", "label": "Concept One"}],
+            "edges": [],
+            "claims": [],
+            "metadata": {"schema_version": "0.1.0", "node_count": 1, "edge_count": 0},
+        },
+    }
+    with pytest.raises(ValueError, match="fixture missing graph/scene"):
+        load_fixture_from_dict(data)

tests/test_graph_repository.py

@@ -19,11 +19,14 @@ from loosecanvas.contracts import (
     Edge,
     GraphPatch,
     Node,
+    SceneAction,
+    SceneActionType,
     ScenePatch,
     SceneState,
     SourceSnapshot,
 )
 from loosecanvas.graph_repository import LooseGraphRepository
+from loosecanvas.reducer import reduce_turn
 
 # ── Fixtures ──────────────────────────────────────────────────────────────────
 
@@ -167,6 +170,53 @@ def test_apply_scene_patch_idempotent() -> None:
     assert once == twice
 
 
+# ── apply_scene_patch: carry forward cluster colours + search highlight ────────
+
+
+def test_apply_scene_patch_benign_turn_preserves_clusters_and_highlight() -> None:
+    """Grounded on the REAL producer: a benign turn (a ``reveal``) reduces to a
+    ``ScenePatch`` that does NOT touch highlights, so apply must carry the existing
+    ``node_cluster_map`` and ``highlighted_ids`` forward.
+
+    Regression for the bug where the next turn after 'Colour clusters' / a search wiped
+    both — diff_scene then emitted ``remove_class cluster-N`` and removed the highlight.
+    """
+    repo = _populated()  # nodes a,b,c,d; edges a-b, b-c, a-c
+    # A scene that already has cluster colours (from 'Colour clusters') and a search
+    # highlight, plus a fogged node "d" that the benign turn will reveal.
+    scene = SceneState(
+        scene_id="s1",
+        visible_node_ids=["a", "b"],
+        fogged_node_ids=["d"],
+        highlighted_ids=["a"],  # e.g. a prior search highlight
+        node_cluster_map={"a": 0, "b": 1},  # e.g. 'Colour clusters'
+    )
+    # Build the patch via the real reducer with a benign reveal — NOT a hand-built patch.
+    reveal = SceneAction(type=SceneActionType.reveal, target_id="d")
+    _graph_patch, scene_patch, _events = reduce_turn([reveal], repo, scene)
+    # Ground the premise: the real producer leaves highlights unset on a benign turn.
+    assert scene_patch.set_highlighted_ids == []
+
+    result = repo.apply_scene_patch(scene, scene_patch)
+
+    # The benign reveal happened ...
+    assert "d" in result.visible_node_ids
+    # ... and BOTH the cluster colours and the search highlight survived.
+    assert result.node_cluster_map == {"a": 0, "b": 1}
+    assert result.highlighted_ids == ["a"]
+
+
+def test_apply_scene_patch_explicit_highlight_still_overrides() -> None:
+    """An explicit (non-empty) ``set_highlighted_ids`` must still replace the old set."""
+    repo = LooseGraphRepository()
+    scene = SceneState(highlighted_ids=["a"], node_cluster_map={"a": 0})
+    patch = ScenePatch(set_highlighted_ids=["b", "c"])
+    result = repo.apply_scene_patch(scene, patch)
+    assert result.highlighted_ids == ["b", "c"]
+    # node_cluster_map is still carried forward (the patch has no cluster slot).
+    assert result.node_cluster_map == {"a": 0}
+
+
 # ── fog_replenish ─────────────────────────────────────────────────────────────
 
 

tests/test_magic_build_opener.py

@@ -0,0 +1,172 @@
+"""Magic-build turn-one opener: turn one greets in the agent's voice, not a canned
+count template.
+
+The first Send builds the graph via the deterministic extractor (which mints the
+session but does NOT run the conversational agent). To make turn one feel like every
+later turn, ``main.py`` streams ``agent_harness.stream_build_opener`` into the chat
+right after the graph paints. These tests pin that contract:
+
+* ``stream_text_session`` success no longer carries a canned chat message (the voice
+  moved to the streamed opener).
+* ``stream_build_opener`` streams the model's own tokens, hands the model the concepts
+  that were actually extracted (topic-aware), and falls back to a warm, concept-naming
+  line — never silent, never a bare count — if the model call fails.
+
+Real ``SessionRecord`` / ``LooseGraphRepository`` objects are used (not MagicMocks) so
+the asserted shapes match the real producer; only the LLM is faked.
+"""
+
+from __future__ import annotations
+
+import time
+from collections.abc import AsyncIterator
+from typing import Any
+from unittest.mock import AsyncMock, patch
+
+from loosecanvas import turn_logic
+from loosecanvas.agent_harness import stream_build_opener
+from loosecanvas.contracts import Node, SceneState, SourceSnapshot
+from loosecanvas.graph_repository import LooseGraphRepository
+from loosecanvas.llm_client import LLMClient
+from loosecanvas.turn_logic import RendererPatch, SessionRecord
+
+
+def _record_with(sid: str, labels: list[str]) -> SessionRecord:
+    nodes = [
+        Node(id=f"n{i}", kind="concept", label=lbl) for i, lbl in enumerate(labels)
+    ]
+    repo = LooseGraphRepository.from_extraction(nodes, [], [], SourceSnapshot())
+    return SessionRecord(
+        session_id=sid,
+        graph=repo,
+        scene=SceneState(scene_id="s"),
+        history=[],
+        graph_version=1,
+        created_at=time.time(),
+        last_seen=time.time(),
+        render_scene_id="s",
+        patch_id=0,
+    )
+
+
+class _FakeChunk:
+    def __init__(self, content: str) -> None:
+        self.content = content
+
+
+class _FakeModel:
+    """Captures the prompt messages and streams the given chunks back as content."""
+
+    def __init__(self, chunks: list[str]) -> None:
+        self._chunks = chunks
+        self.seen: Any = None
+
+    async def astream(self, messages: Any) -> AsyncIterator[_FakeChunk]:
+        self.seen = messages
+        for chunk in self._chunks:
+            yield _FakeChunk(chunk)
+
+
+class _BoomModel:
+    async def astream(self, messages: Any) -> AsyncIterator[_FakeChunk]:
+        raise RuntimeError("model down")
+        yield _FakeChunk("")  # pragma: no cover — makes this a generator
+
+
+class _MidStreamBoomModel:
+    """Streams one good chunk, then dies — exercises the no-double-post guard."""
+
+    async def astream(self, messages: Any) -> AsyncIterator[_FakeChunk]:
+        yield _FakeChunk("Nice start — ")
+        raise RuntimeError("model died mid-stream")
+
+
+# ── stream_text_session: the canned turn-one template is gone ──
+
+
+async def test_stream_text_session_success_has_no_chat_message() -> None:
+    sid = "opener-no-canned"
+    patch_obj = RendererPatch(patch_id=0, is_snapshot=True, scene_id="s", operations=[])
+    with patch(
+        "loosecanvas.turn_logic.load_text_session", new_callable=AsyncMock
+    ) as mock_load:
+        mock_load.return_value = (sid, patch_obj)
+        turn_logic.session_store[sid] = _record_with(sid, ["Alpha", "Beta"])
+        try:
+            events = [
+                e async for e in turn_logic.stream_text_session("t", "t", LLMClient())
+            ]
+        finally:
+            turn_logic.session_store.pop(sid, None)
+
+    final = next(e for e in events if not e.is_partial)
+    assert not final.is_error
+    assert final.session_id == sid
+    assert final.canvas_patch == patch_obj.model_dump(mode="json")
+    assert (
+        final.chat_message == []
+    ), "turn-one voice now streams via the opener, not a canned count template"
+
+
+# ── stream_build_opener: streams the model's own voice, topic-aware ──
+
+
+async def test_opener_streams_model_tokens() -> None:
+    sid = "opener-ok"
+    turn_logic.session_store[sid] = _record_with(sid, ["Alpha", "Beta"])
+    fake = _FakeModel(["Nice — ", "I see Alpha", " and Beta here."])
+    try:
+        with patch("loosecanvas.agent_harness.make_model", return_value=fake):
+            chunks = [c async for c in stream_build_opener(sid)]
+    finally:
+        turn_logic.session_store.pop(sid, None)
+
+    assert chunks == ["Nice — ", "I see Alpha", " and Beta here."]
+    # The model was handed the concepts that were actually extracted (topic-aware).
+    assert fake.seen is not None
+    human_msg = fake.seen[-1]
+    assert "Alpha" in human_msg[1] and "Beta" in human_msg[1]
+
+
+async def test_opener_falls_back_when_model_fails() -> None:
+    sid = "opener-fail"
+    turn_logic.session_store[sid] = _record_with(sid, ["Alpha", "Beta"])
+    try:
+        with patch("loosecanvas.agent_harness.make_model", return_value=_BoomModel()):
+            chunks = [c async for c in stream_build_opener(sid)]
+    finally:
+        turn_logic.session_store.pop(sid, None)
+
+    text = "".join(chunks)
+    assert text, "opener must never land silent, even when the model call fails"
+    assert "Alpha" in text, "fallback must still name a real extracted concept"
+    # Not a bare count: it should read like a sentence, not 'N concepts, M relations'.
+    assert "first pass" in text.lower()
+
+
+async def test_opener_does_not_double_post_on_midstream_failure() -> None:
+    # If the model dies AFTER emitting real tokens, we keep what streamed and do
+    # NOT also append the static fallback on top of it.
+    sid = "opener-midboom"
+    turn_logic.session_store[sid] = _record_with(sid, ["Alpha"])
+    try:
+        with patch(
+            "loosecanvas.agent_harness.make_model", return_value=_MidStreamBoomModel()
+        ):
+            chunks = [c async for c in stream_build_opener(sid)]
+    finally:
+        turn_logic.session_store.pop(sid, None)
+
+    text = "".join(chunks)
+    assert text == "Nice start — ", "must keep streamed tokens, not append a fallback"
+    assert "first pass" not in text.lower(), "fallback must not double-post"
+
+
+async def test_opener_handles_missing_session_gracefully() -> None:
+    # A session that vanished (evicted) must not crash the opener — it falls back.
+    fake = _FakeModel(["hello"])
+    with patch("loosecanvas.agent_harness.make_model", return_value=fake):
+        chunks = [c async for c in stream_build_opener("does-not-exist")]
+    assert "".join(chunks) == "hello"
+    # Even with no record, the model was still handed a (generic) opener prompt.
+    assert fake.seen is not None

tests/test_p1_03_claim_review_consumer.py

@@ -68,6 +68,41 @@ async def test_do_review_claim_returns_renderer_patch() -> None:
     assert isinstance(result.renderer_patch, RendererPatch)
 
 
+async def test_accept_clears_the_review_pending_class_with_the_real_selector() -> None:
+    """Lynchpin regression: accepting a claim must emit remove_class for the SAME
+    class the stylesheet uses (`review-pending`, hyphenated from review_state
+    "pending"). A prior typo emitted `pending-review`, so the amber awaiting-review
+    border never cleared on Accept. Pin the exact payload — the older SC-B test only
+    checked the patch existed, which is how the bug shipped green.
+    """
+    claim = Claim(
+        id="c1",
+        claim_type="label",
+        target_id="n1",
+        origin="model_inferred",
+        review_state="pending",
+        support_state="unverified",
+        text="test",
+    )
+    sid = _make_session([claim])
+    result = do_review_claim(sid, "c1", "accepted")
+    remove_class_ops = [
+        op for op in result.renderer_patch.operations if op.op == "remove_class"
+    ]
+    assert (
+        remove_class_ops
+    ), "accept must emit a remove_class op to clear the amber border"
+    classes = {op.data.get("class") for op in remove_class_ops}
+    assert (
+        "review-pending" in classes
+    ), f"accept must remove the stylesheet class 'review-pending', got {classes}"
+    assert (
+        "pending-review" not in classes
+    ), "regression: the old buggy class name is back"
+    # Targets the reviewed node by id.
+    assert any(op.selector == "#n1" for op in remove_class_ops)
+
+
 async def test_illegal_transition_raises_invalid_transition_error() -> None:
     """SC-C: do_review_claim raises InvalidTransitionError (not HTTPException) for 409 cases."""
     claim = Claim(

tests/test_renderer_contract_parity.py

@@ -10,8 +10,10 @@ unknown ops). This test makes that drift fail loudly.
 We DERIVE the produced op-set from source (rather than hardcoding it) so adding
 a NEW producer with a NEW op trips this test until ``types.ts`` is updated. We
 assert SUBSET, not equality: the TS union legitimately carries union-only extras
-(``flash`` is the unimplemented M18 highlight op; ``select`` is a frontend→
-backend event op, never produced by the backend renderer adapter).
+(``select`` is a frontend→backend event op, never produced by the backend renderer
+adapter). NB: ``flash`` USED to be union-only but now has a backend producer
+(``turn_logic.find_connection_session`` flashes a freshly-proposed hidden-connection
+edge), so it is no longer in the allow-list.
 """
 
 from __future__ import annotations
@@ -25,9 +27,10 @@ SRC_DIR = REPO_ROOT / "src" / "loosecanvas"
 TYPES_TS = REPO_ROOT / "cytoscapecanvas" / "frontend" / "types.ts"
 
 # Union-only extras the TS side declares but the backend never produces:
-#   flash  — unimplemented M18 highlight op (planned, no producer yet)
 #   select — a frontend→backend event op, not a backend-emitted render command
-KNOWN_UNION_ONLY = {"flash", "select"}
+# (flash WAS here, but find_connection_session now emits op="flash", so it's
+#  produced by the backend and no longer union-only.)
+KNOWN_UNION_ONLY = {"select"}
 
 # op="..." in Python sources (the RendererCommand constructor argument).
 _PY_OP_RE = re.compile(r'op="([a-z_]+)"')

tests/test_review_agent_tool.py

@@ -0,0 +1,271 @@
+"""Tests for the review_element agent tool (Task A).
+
+Covers:
+- review_element on a model_inferred pending NODE claim
+- review_element on a model_inferred pending EDGE claim (edge variant)
+- finalize_agent_turn with EMPTY accumulated_actions but non-empty review_patches
+  returns a TurnResult (not None) carrying the review ops
+"""
+
+from __future__ import annotations
+
+import json
+import time
+import uuid
+from collections.abc import Iterator
+
+import pytest
+from loosecanvas import turn_logic
+from loosecanvas.agent_tools import (
+    _current_turn,
+    finalize_agent_turn,
+    get_turn_context,
+    review_element,
+    set_turn_context,
+)
+from loosecanvas.contracts import Claim, Edge, Node, SceneState, SourceSnapshot
+from loosecanvas.graph_repository import LooseGraphRepository
+from loosecanvas.turn_logic import (
+    RendererPatch,
+    TurnResult,
+    session_locks,
+    session_store,
+)
+
+# ── Session isolation ─────────────────────────────────────────────────────────
+
+
+@pytest.fixture(autouse=True)
+def _isolate_sessions() -> Iterator[None]:
+    session_store.clear()
+    session_locks.clear()
+    yield
+    session_store.clear()
+    session_locks.clear()
+
+
+@pytest.fixture(autouse=True)
+def _reset_agent_context() -> Iterator[None]:
+    _current_turn.set(None)
+    yield
+    _current_turn.set(None)
+
+
+# ── Session helpers ───────────────────────────────────────────────────────────
+
+
+def _make_session(claims: list[Claim] | None = None) -> str:
+    """Create a minimal session with node n1 in session_store; return session_id."""
+    node = Node(id="n1", kind="concept", label="Test Node")
+    repo = LooseGraphRepository.from_extraction(
+        [node], [], claims or [], SourceSnapshot()
+    )
+    scene = SceneState(scene_id="s1", visible_node_ids=["n1"])
+    sid = str(uuid.uuid4())
+    now = time.time()
+    turn_logic.session_store[sid] = turn_logic.SessionRecord(
+        session_id=sid,
+        graph=repo,
+        scene=scene,
+        history=[],
+        graph_version=1,
+        created_at=now,
+        last_seen=now,
+        render_scene_id="s1",
+    )
+    return sid
+
+
+def _pending_claim() -> Claim:
+    return Claim(
+        id="c1",
+        claim_type="label",
+        target_id="n1",
+        origin="model_inferred",
+        review_state="pending",
+        support_state="unverified",
+        text="test",
+    )
+
+
+def _make_session_with_pending_edge_claim() -> str:
+    """Session with n1, n2, and a model_inferred pending edge claim on e1."""
+    nodes = [
+        Node(id="n1", kind="concept", label="N1"),
+        Node(id="n2", kind="concept", label="N2"),
+    ]
+    edge = Edge(id="e1", source="n1", target="n2", kind="related_to", label="links")
+    claim = Claim(
+        id="c-edge",
+        claim_type="relationship",
+        target_id="e1",
+        origin="model_inferred",
+        review_state="pending",
+        support_state="unverified",
+        text="links",
+    )
+    repo = LooseGraphRepository.from_extraction(
+        nodes, [edge], [claim], SourceSnapshot()
+    )
+    scene = SceneState(
+        scene_id="s1",
+        visible_node_ids=["n1", "n2"],
+        visible_edge_ids=["e1"],
+    )
+    sid = str(uuid.uuid4())
+    now = time.time()
+    turn_logic.session_store[sid] = turn_logic.SessionRecord(
+        session_id=sid,
+        graph=repo,
+        scene=scene,
+        history=[],
+        graph_version=1,
+        created_at=now,
+        last_seen=now,
+        render_scene_id="s1",
+    )
+    return sid
+
+
+# ── review_element: node tests ────────────────────────────────────────────────
+
+
+def test_review_element_node_accept_returns_ok_and_transitions_claim() -> None:
+    """review_element('n1', 'accepted') returns status=ok and flips the claim."""
+    sid = _make_session([_pending_claim()])
+    set_turn_context(sid)
+
+    raw = review_element.invoke({"target_id": "n1", "action": "accepted"})
+    data = json.loads(raw)
+
+    assert data["status"] == "ok", f"expected ok, got: {data}"
+    assert data["target_id"] == "n1"
+    assert data["review_state"] == "accepted"
+    # The stored claim actually transitioned.
+    assert turn_logic.session_store[sid].graph.claims["c1"].review_state == "accepted"
+
+
+def test_review_element_node_accept_appends_review_patch() -> None:
+    """Accepted review appends a RendererPatch to ctx.review_patches."""
+    sid = _make_session([_pending_claim()])
+    set_turn_context(sid)
+
+    review_element.invoke({"target_id": "n1", "action": "accepted"})
+    ctx = get_turn_context()
+
+    assert len(ctx.review_patches) == 1
+    patch = ctx.review_patches[0]
+    assert isinstance(patch, RendererPatch)
+    # Should carry a remove_class (clear_pending) op.
+    ops = [o.op for o in patch.operations]
+    assert "remove_class" in ops or "clear_pending" in ops or len(patch.operations) > 0
+
+
+def test_review_element_node_reject_returns_ok_and_transitions_claim() -> None:
+    """review_element('n1', 'rejected') returns status=ok with rejected state."""
+    sid = _make_session([_pending_claim()])
+    set_turn_context(sid)
+
+    raw = review_element.invoke({"target_id": "n1", "action": "rejected"})
+    data = json.loads(raw)
+
+    assert data["status"] == "ok"
+    assert data["review_state"] == "rejected"
+    assert turn_logic.session_store[sid].graph.claims["c1"].review_state == "rejected"
+
+
+def test_review_element_unknown_id_returns_not_found() -> None:
+    """An unknown id returns status=not_found gracefully."""
+    sid = _make_session([_pending_claim()])
+    set_turn_context(sid)
+
+    raw = review_element.invoke({"target_id": "does_not_exist", "action": "accepted"})
+    data = json.loads(raw)
+
+    assert data["status"] == "not_found"
+
+
+def test_review_element_invalid_action_returns_error() -> None:
+    """An invalid action value returns status=error."""
+    sid = _make_session([_pending_claim()])
+    set_turn_context(sid)
+
+    raw = review_element.invoke({"target_id": "n1", "action": "approve"})
+    data = json.loads(raw)
+
+    assert data["status"] == "error"
+
+
+def test_review_element_no_pending_claims_returns_not_reviewable() -> None:
+    """A node without reviewable pending claims returns not_reviewable."""
+    sid = _make_session([])  # no claims
+    set_turn_context(sid)
+
+    raw = review_element.invoke({"target_id": "n1", "action": "accepted"})
+    data = json.loads(raw)
+
+    assert data["status"] == "not_reviewable"
+
+
+# ── review_element: edge tests ────────────────────────────────────────────────
+
+
+def test_review_element_edge_accept_transitions_claim() -> None:
+    """review_element on an edge id transitions the edge claim."""
+    sid = _make_session_with_pending_edge_claim()
+    set_turn_context(sid)
+
+    raw = review_element.invoke({"target_id": "e1", "action": "accepted"})
+    data = json.loads(raw)
+
+    assert data["status"] == "ok"
+    assert data["review_state"] == "accepted"
+    assert (
+        turn_logic.session_store[sid].graph.claims["c-edge"].review_state == "accepted"
+    )
+
+
+def test_review_element_edge_appends_review_patch() -> None:
+    """Edge review appends a RendererPatch to ctx.review_patches."""
+    sid = _make_session_with_pending_edge_claim()
+    set_turn_context(sid)
+
+    review_element.invoke({"target_id": "e1", "action": "accepted"})
+    ctx = get_turn_context()
+
+    assert len(ctx.review_patches) == 1
+
+
+# ── finalize_agent_turn: review-only (empty accumulated_actions) ──────────────
+
+
+def test_finalize_with_review_patches_only_returns_turn_result() -> None:
+    """finalize_agent_turn with no SceneActions but non-empty review_patches must
+    return a TurnResult (not None) whose renderer_patch carries the review ops."""
+    sid = _make_session([_pending_claim()])
+    set_turn_context(sid)
+
+    # Invoke review_element — this adds a RendererPatch to ctx.review_patches without
+    # touching accumulated_actions.
+    review_element.invoke({"target_id": "n1", "action": "accepted"})
+    ctx = get_turn_context()
+    assert ctx.accumulated_actions == []
+    assert len(ctx.review_patches) == 1
+
+    result = finalize_agent_turn(sid, {}, "I accepted that for you.")
+
+    assert result is not None, "review-only finalize must return TurnResult, not None"
+    assert isinstance(result, TurnResult)
+    # The renderer patch must contain the review ops.
+    assert result.renderer_patch is not None
+    assert len(result.renderer_patch.operations) > 0
+
+
+def test_finalize_with_no_actions_no_reviews_returns_none() -> None:
+    """Pure-speech turn (no actions, no reviews) still returns None."""
+    sid = _make_session([_pending_claim()])
+    set_turn_context(sid)
+
+    result = finalize_agent_turn(sid, {}, "Just talking.")
+
+    assert result is None

tests/test_review_amber_clear.py

@@ -0,0 +1,214 @@
+"""BUG 1 regression: the amber 'review-pending' affordance must NOT clear after
+accepting just ONE of a node's several model_inferred claims.
+
+A target (node/edge) may govern 2-3 model_inferred claims. The amber awaiting-review
+border covers the WHOLE target, so it may only clear once EVERY model_inferred claim
+on it has been reviewed. The original ``_review_canvas_hint_dict`` emitted
+``clear_pending`` on ANY accept, so the amber vanished while sibling claims were still
+pending — silently telling the user "reviewed" when it wasn't.
+
+These tests are grounded on the REAL producer: ``load_fixture_session`` over the
+canonical ``seed_local_ai`` fixture (whose node ``concept::local_language_model``
+genuinely carries two model_inferred pending claims), not a hand-built fixture — the
+prompt-assumed shape (two claims both ``claim_type`` matching) is NOT how the real
+producer emits per-node claims (the second is a ``semantic_edge`` claim), and only a
+real-shape test exercises that.
+"""
+
+from __future__ import annotations
+
+import time
+import uuid
+from pathlib import Path
+
+from loosecanvas import turn_logic
+from loosecanvas.contracts import Claim, Node, SceneState, SourceSnapshot
+from loosecanvas.graph_repository import LooseGraphRepository
+from loosecanvas.turn_logic import do_review_claim, load_fixture_session
+
+_FIXTURE = Path(__file__).resolve().parents[1] / "fixtures" / "seed_local_ai.json"
+
+
+def _make_session(claims: list[Claim]) -> str:
+    """Minimal single-node session in turn_logic.session_store; return session_id."""
+    node = Node(id="n1", kind="concept", label="Test Node")
+    repo = LooseGraphRepository.from_extraction([node], [], claims, SourceSnapshot())
+    scene = SceneState(scene_id="s1", visible_node_ids=["n1"])
+    sid = str(uuid.uuid4())
+    now = time.time()
+    turn_logic.session_store[sid] = turn_logic.SessionRecord(
+        session_id=sid,
+        graph=repo,
+        scene=scene,
+        history=[],
+        graph_version=1,
+        created_at=now,
+        last_seen=now,
+        render_scene_id="s1",
+    )
+    return sid
+
+
+def _remove_class_classes(result: turn_logic.ReviewClaimResult) -> set[str]:
+    return {
+        str(op.data.get("class"))
+        for op in result.renderer_patch.operations
+        if op.op == "remove_class"
+    }
+
+
+async def test_amber_persists_until_all_node_claims_reviewed_real_fixture() -> None:
+    """REAL-producer grounding: the ``seed_local_ai`` node
+    ``concept::local_language_model`` carries exactly ONE model_inferred pending
+    claim (its ``concept_node`` claim) after the edge-claim target_id bug was fixed
+    (semantic_edge claims now correctly target edge ids, not the target node id).
+
+    This test verifies that accepting the single governing claim on a real-fixture
+    node fires ``clear_pending`` exactly once — the correct single-claim clear behavior
+    on a real-producer shape.
+
+    The multi-claim path (accept #1 leaves amber, accept #2 clears) is exercised by
+    the hand-built ``test_accept_one_of_two_leaves_amber_then_second_clears`` below,
+    which directly constructs a two-claim node session.
+    """
+    sid, _snapshot = await load_fixture_session(fixture_path=_FIXTURE)
+    record = turn_logic.session_store[sid]
+    target = "concept::local_language_model"
+    pending = [
+        c.id
+        for c in record.graph.claims.values()
+        if c.target_id == target
+        and c.origin == "model_inferred"
+        and c.review_state == "pending"
+    ]
+    assert len(pending) == 1, (
+        "fixture changed: after the edge-claim bug fix, "
+        f"concept::local_language_model should have exactly 1 model_inferred "
+        f"pending claim (the concept_node claim), got {len(pending)}"
+    )
+
+    result = do_review_claim(sid, pending[0], "accepted")
+    assert (
+        result.canvas_hint["action"] == "clear_pending"
+    ), "accepting the only model_inferred claim on the node must fire clear_pending"
+    assert "review-pending" in _remove_class_classes(result)
+
+
+async def test_accept_one_of_two_leaves_amber_then_second_clears() -> None:
+    """Focused unit form of BUG 1 on a node governing two model_inferred pending
+    claims (both targeting the node): accept #1 -> no clear_pending (amber stays);
+    accept #2 -> clear_pending fires."""
+    c1 = Claim(
+        id="c1",
+        claim_type="label",
+        target_id="n1",
+        origin="model_inferred",
+        review_state="pending",
+        support_state="unverified",
+        text="first",
+    )
+    c2 = Claim(
+        id="c2",
+        claim_type="summary",
+        target_id="n1",
+        origin="model_inferred",
+        review_state="pending",
+        support_state="unverified",
+        text="second",
+    )
+    sid = _make_session([c1, c2])
+
+    r1 = do_review_claim(sid, "c1", "accepted")
+    assert r1.canvas_hint == {"action": "none", "target_id": "n1"}
+    assert "review-pending" not in _remove_class_classes(r1)
+
+    r2 = do_review_claim(sid, "c2", "accepted")
+    assert r2.canvas_hint == {"action": "clear_pending", "target_id": "n1"}
+    assert "review-pending" in _remove_class_classes(r2)
+
+
+async def test_single_claim_node_still_clears_amber_on_accept() -> None:
+    """No regression for the simple case: a node with ONE model_inferred pending
+    claim clears the amber on accept (the old behavior, preserved)."""
+    c1 = Claim(
+        id="c1",
+        claim_type="label",
+        target_id="n1",
+        origin="model_inferred",
+        review_state="pending",
+        support_state="unverified",
+        text="only",
+    )
+    sid = _make_session([c1])
+    result = do_review_claim(sid, "c1", "accepted")
+    assert result.canvas_hint == {"action": "clear_pending", "target_id": "n1"}
+    assert "review-pending" in _remove_class_classes(result)
+
+
+async def test_rejection_does_not_remove_node_when_sibling_claims_remain() -> None:
+    """Bug fix: rejecting a NODE claim must NOT remove the node from canvas, even when
+    sibling model_inferred claims remain pending. A rejected node claim clears the
+    amber badge only when all model_inferred claims are resolved (same gate as accept),
+    otherwise it leaves the badge up ('none') — the node stays on canvas either way.
+
+    This test previously asserted action=='remove' (the buggy behavior that caused
+    the canvas/backend desync). It is corrected to assert the fixed behavior:
+    rejecting c1 with c2 still pending → action='none' (sibling pending → badge stays);
+    the node is NOT removed.
+
+    For EDGE claims, rejection still emits action='remove' — that is a separate
+    code path locked by test_edge_claim_review.py::test_reject_edge_claim_still_removes_edge.
+    """
+    c1 = Claim(
+        id="c1",
+        claim_type="label",
+        target_id="n1",
+        origin="model_inferred",
+        review_state="pending",
+        support_state="unverified",
+        text="first",
+    )
+    c2 = Claim(
+        id="c2",
+        claim_type="summary",
+        target_id="n1",
+        origin="model_inferred",
+        review_state="pending",
+        support_state="unverified",
+        text="second",
+    )
+    sid = _make_session([c1, c2])
+    result = do_review_claim(sid, "c1", "rejected")
+    # c2 is still pending → _target_fully_reviewed returns False → badge stays up.
+    # The node must NOT be removed from canvas.
+    assert result.canvas_hint == {"action": "none", "target_id": "n1"}
+    # Node still in the graph (backend retained it).
+    assert "n1" in turn_logic.session_store[sid].graph.nodes
+
+
+async def test_non_model_claims_do_not_hold_the_amber() -> None:
+    """Only model_inferred claims gate the amber. A node with one accepted
+    model_inferred claim plus a user_asserted pending-ish claim still clears —
+    user_asserted/deterministic claims never drive the awaiting-review affordance."""
+    mi = Claim(
+        id="mi",
+        claim_type="label",
+        target_id="n1",
+        origin="model_inferred",
+        review_state="pending",
+        support_state="unverified",
+        text="model",
+    )
+    user = Claim(
+        id="user",
+        claim_type="summary",
+        target_id="n1",
+        origin="user_asserted",
+        review_state="accepted",
+        support_state="unverified",
+        text="user",
+    )
+    sid = _make_session([mi, user])
+    result = do_review_claim(sid, "mi", "accepted")
+    # The only model_inferred claim is now accepted -> amber clears.
+    assert result.canvas_hint == {"action": "clear_pending", "target_id": "n1"}

tests/test_scene_curator.py

@@ -170,3 +170,85 @@ def test_compute_node_clusters_empty_graph_returns_empty() -> None:
     from loosecanvas.scene_curator import compute_node_clusters
 
     assert compute_node_clusters(LooseGraphRepository()) == {}
+
+
+# ── min_visible floor ──────────────────────────────────────────────────────────
+
+
+def _sparse_repo() -> LooseGraphRepository:
+    """3 connected concept nodes + 5 isolated concept nodes + 2 excluded nodes.
+
+    With max_visible=20 the classic scoring would normally surface only the connected
+    nodes first (higher betweenness/pagerank), so a min_visible floor must promote the
+    isolated nodes to reach 8 visible.
+    """
+    nodes = [
+        # Connected triple
+        Node(id="a", kind="concept", label="alpha"),
+        Node(id="b", kind="concept", label="beta"),
+        Node(id="c", kind="concept", label="gamma"),
+        # Isolated concept nodes (low score, but eligible)
+        Node(id="d", kind="concept", label="delta"),
+        Node(id="e", kind="concept", label="epsilon"),
+        Node(id="f", kind="concept", label="zeta"),
+        Node(id="g", kind="concept", label="eta"),
+        Node(id="h", kind="concept", label="theta"),
+        # Excluded nodes (must NOT be promoted by min_visible)
+        Node(id="test_module", kind="module", label="test_module"),
+        Node(id="ext_dep", kind="external_dep", label="numpy"),
+    ]
+    edges = [
+        Edge(id="ab", source="a", target="b", kind="relates_to"),
+        Edge(id="bc", source="b", target="c", kind="relates_to"),
+    ]
+    return _repo(nodes, edges)
+
+
+def test_min_visible_promotes_eligible_nodes_on_sparse_graph() -> None:
+    """A small graph with 8 eligible nodes should yield >= min(8, eligible) visible."""
+    repo = _sparse_repo()
+    # 8 eligible nodes (a,b,c,d,e,f,g,h), 2 excluded (test_module, ext_dep)
+    scene, _ = SceneCurator(repo).curate_initial_scene(max_visible=20, min_visible=8)
+
+    eligible_ids = {"a", "b", "c", "d", "e", "f", "g", "h"}
+    assert len(scene.visible_node_ids) >= 8
+    # All promoted nodes must still be eligible (not excluded)
+    for nid in scene.visible_node_ids:
+        assert nid in eligible_ids
+
+
+def test_min_visible_never_promotes_excluded_nodes() -> None:
+    """Even when min_visible exceeds eligible count, excluded nodes must stay out."""
+    repo = _sparse_repo()
+    # 8 eligible nodes; requesting min_visible=12 exceeds eligible, so we cap at eligible
+    scene, _ = SceneCurator(repo).curate_initial_scene(max_visible=20, min_visible=12)
+
+    assert "test_module" not in scene.visible_node_ids
+    assert "ext_dep" not in scene.visible_node_ids
+    # Should have all 8 eligible nodes (capped at eligible_count=8, not min_visible=12)
+    assert len(scene.visible_node_ids) == 8
+
+
+def test_min_visible_default_unchanged_for_small_graph() -> None:
+    """Default min_visible=8 still works; a graph with <8 eligible nodes is fine."""
+    # Only 3 eligible nodes: solo, pair_a, pair_b
+    nodes = [
+        Node(id="solo", kind="concept", label="Solo"),
+        Node(id="pair_a", kind="concept", label="PairA"),
+        Node(id="pair_b", kind="concept", label="PairB"),
+    ]
+    edges = [Edge(id="e1", source="pair_a", target="pair_b", kind="relates_to")]
+    repo = _repo(nodes, edges)
+    # min_visible=8, but only 3 eligible → should surface all 3 without crash
+    scene, _ = SceneCurator(repo).curate_initial_scene(max_visible=20, min_visible=8)
+    assert len(scene.visible_node_ids) == 3
+    assert set(scene.visible_node_ids) == {"solo", "pair_a", "pair_b"}
+
+
+def test_min_visible_guard_fires_when_exceeds_max_visible() -> None:
+    """assert min_visible <= max_visible must raise AssertionError."""
+    import pytest
+
+    repo = _sparse_repo()
+    with pytest.raises(AssertionError):
+        SceneCurator(repo).curate_initial_scene(max_visible=5, min_visible=8)

tests/test_search_no_match_reset.py

@@ -0,0 +1,57 @@
+"""Regression: a no-match search after a match must clear the prior highlight/dim.
+
+QA found: search 'Ret' (highlights RAG, dims the rest), then a no-match term without
+clearing — the previous highlight + dim stayed lit, so the graph looked like the old
+match was still selected.
+"""
+
+from __future__ import annotations
+
+import time
+import uuid
+
+from loosecanvas import turn_logic
+from loosecanvas.contracts import Node, SceneState, SourceSnapshot
+from loosecanvas.graph_repository import LooseGraphRepository
+from loosecanvas.main import on_search
+
+
+def _make_session() -> str:
+    nodes = [
+        Node(id="n1", kind="concept", label="Alpha"),
+        Node(id="n2", kind="concept", label="Beta"),
+    ]
+    repo = LooseGraphRepository.from_extraction(nodes, [], [], SourceSnapshot())
+    scene = SceneState(scene_id="s1", visible_node_ids=["n1", "n2"])
+    sid = str(uuid.uuid4())
+    now = time.time()
+    turn_logic.session_store[sid] = turn_logic.SessionRecord(
+        session_id=sid,
+        graph=repo,
+        scene=scene,
+        history=[],
+        graph_version=1,
+        created_at=now,
+        last_seen=now,
+        render_scene_id="s1",
+    )
+    return sid
+
+
+async def test_no_match_search_clears_prior_highlight_and_dim() -> None:
+    sid = _make_session()
+    record = turn_logic.session_store[sid]
+
+    # First search matches a visible node → it highlights + dims the rest.
+    patch1, _ = await on_search("Alpha", sid)
+    assert record.scene.highlighted_ids, "a matching search must highlight something"
+
+    # A second, NO-MATCH search must clear the prior highlight/dim (not leave it lit).
+    patch2, matches2 = await on_search("zzz-no-such-node", sid)
+    assert record.scene.highlighted_ids == [], "stale highlight must be cleared"
+    ops = patch2["operations"]
+    assert any(o["op"] == "clear_dim" for o in ops), "no-match must lift the dim filter"
+    assert any(
+        o["op"] == "remove_class" and o.get("data", {}).get("class") == "highlighted"
+        for o in ops
+    ), "no-match must remove the prior 'highlighted' class"

tests/test_seed_resilience.py

@@ -0,0 +1,132 @@
+"""Seed-on-load resilience (on_seed / _seed_snapshot).
+
+These are the bugs an adversarial QA + audit sweep surfaced:
+
+1. Every page load creates a NEW session. Once ``session_store`` hits ``_MAX_SESSIONS``
+   the alternate loaders raise ``OverflowError("session_cap")``. ``on_seed`` had no
+   try/except, so on a busy HF Space the canvas stayed permanently EMPTY with the
+   "Building your starter map…" banner stuck and an "Error / session_cap" toast leaking
+   the raw identifier. A fresh visitor must ALWAYS get a seeded canvas — the cap should
+   EVICT the least-recently-seen session to make room, not hard-reject.
+
+2. A corrupt/partial seed (bad JSON / missing ``scene`` key) got no fallback.
+
+3. ``on_seed`` only fell back when ``not path.exists()`` — any other failure crashed.
+
+Grounded against the REAL producer (``load_fixture_session`` + the shipped fixtures),
+not a hand-built fiction fixture.
+"""
+
+from __future__ import annotations
+
+import time
+from pathlib import Path
+from typing import Any
+
+import pytest
+from loosecanvas.contracts import SceneState, SourceSnapshot
+from loosecanvas.graph_repository import LooseGraphRepository
+from loosecanvas.main import _FIXTURES, _seed_snapshot
+from loosecanvas.turn_logic import (
+    _MAX_SESSIONS,
+    RendererPatch,
+    SessionRecord,
+    session_store,
+)
+
+
+def _stuff_session(session_id: str, *, last_seen: float) -> None:
+    """Insert a minimal-but-REAL ``SessionRecord`` directly into ``session_store``.
+
+    Mirrors how ``load_fixture_session`` builds a record (a ``LooseGraphRepository``
+    plus a ``SceneState``), so the cap math sees the same shape the live path creates.
+    """
+    repo = LooseGraphRepository.from_extraction([], [], [], SourceSnapshot())
+    now = time.time()
+    session_store[session_id] = SessionRecord(
+        session_id=session_id,
+        graph=repo,
+        scene=SceneState(),
+        history=[],
+        graph_version=1,
+        created_at=now,
+        last_seen=last_seen,
+        patch_id=0,
+    )
+
+
+@pytest.mark.asyncio
+async def test_seed_succeeds_when_store_is_at_cap_via_lru_eviction() -> None:
+    """The lynchpin bug: with the store FULL of fresh (non-stale) sessions, a new
+    visitor must still get a SEEDED canvas. LRU eviction makes room; no empty canvas,
+    no leaked ``session_cap`` string."""
+    now = time.time()
+    # Fill to the cap with NON-stale sessions (well within the TTL) so the existing
+    # TTL-only ``_evict_stale_sessions`` can't help — only LRU eviction can.
+    for i in range(_MAX_SESSIONS):
+        _stuff_session(f"full-{i}", last_seen=now - i)  # full-0 newest, last is oldest
+    assert len(session_store) == _MAX_SESSIONS
+
+    snapshot, sid, onboarding_msg = await _seed_snapshot()
+
+    # The renderer value is the RendererPatch serialized for the Gradio component value
+    # (``model_dump()`` dict), carrying a real, seeded snapshot.
+    assert isinstance(snapshot, dict)
+    assert snapshot["is_snapshot"] is True
+    assert snapshot[
+        "operations"
+    ], "expected a seeded (non-empty) canvas, not a blank one"
+    # A fresh session id was minted and lives in the store.
+    assert sid
+    assert sid in session_store
+    # The least-recently-seen session ("full-19") was evicted to make room.
+    assert f"full-{_MAX_SESSIONS - 1}" not in session_store
+    assert len(session_store) <= _MAX_SESSIONS
+    # The user-visible onboarding text must NEVER leak the raw cap identifier.
+    assert "session_cap" not in str(onboarding_msg)
+
+
+@pytest.mark.asyncio
+async def test_seed_falls_back_to_annotated_when_seed_file_missing(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """If the configured seed file does not exist, on_seed must fall back to the
+    shipped ``annotated_graph`` and still paint a canvas."""
+    monkeypatch.setitem(_FIXTURES, "seed_local_ai", Path("does-not-exist-on-disk.json"))
+
+    snapshot, sid, onboarding_msg = await _seed_snapshot()
+
+    assert isinstance(snapshot, dict)
+    assert snapshot["operations"], "annotated_graph fallback should seed a real canvas"
+    assert sid in session_store
+    assert "session_cap" not in str(onboarding_msg)
+
+
+@pytest.mark.asyncio
+async def test_seed_survives_corrupt_seed_and_corrupt_fallback(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """A corrupt/partial seed AND a corrupt fallback must never crash on_seed or leave
+    the 'Building…' banner stuck over an empty canvas: a valid (possibly empty)
+    snapshot + a FRIENDLY message is returned, with no leaked 'session_cap'/stacktrace.
+    """
+    bad: dict[str, dict[str, Any]] = {"graph": {}}  # missing 'scene' -> ValueError path
+
+    async def boom(*args: Any, **kwargs: Any) -> tuple[str, RendererPatch]:
+        from loosecanvas.extractors.fixture_adapter import load_fixture_from_dict
+
+        # Exercise the real producer's failure mode (ValueError), not a synthetic one.
+        load_fixture_from_dict(bad)
+        raise AssertionError("unreachable")
+
+    # Every fixture load fails the same way the real producer would on a corrupt dict.
+    monkeypatch.setattr("loosecanvas.main.load_fixture_session", boom)
+    snapshot, sid, onboarding_msg = await _seed_snapshot()
+
+    # Never crash; always a valid (serialized) snapshot envelope.
+    assert isinstance(snapshot, dict)
+    assert snapshot["is_snapshot"] is True
+    # Friendly onboarding copy, no leaked internals.
+    assert "session_cap" not in str(onboarding_msg)
+    assert "Traceback" not in str(onboarding_msg)
+    assert str(onboarding_msg).strip(), "must show a friendly onboarding message"

tests/test_t1_03_polish.py

@@ -38,12 +38,27 @@ def test_main_has_onboarding_markdown() -> None:
     assert "lc-onboarding" in content, "main.py should have lc-onboarding elem_classes"
 
 
-def test_main_build_from_text_accordion_open() -> None:
-    """Build from text accordion is open=False (P0-03: collapsed by default; secondary entry)."""
+def test_main_open_world_entry() -> None:
+    """Chat-first magic-build entry (supersedes the seed-on-load graph): the canvas
+    opens EMPTY via on_open, the composer is prefilled with editable seed text, and the
+    first Send builds the graph from that text via stream_text_session. Export stays; the
+    fixture Dropdown / build Accordion remain gone.
+    """
     content = (ROOT / "src/loosecanvas/main.py").read_text(encoding="utf-8")
     assert (
-        "open=False" in content
-    ), "Build from text accordion should be open=False (P0-03)"
+        "demo.load(on_open" in content
+    ), "page load wires the empty-canvas on_open entry"
+    assert "_SEED_TEXT" in content, "composer must be prefilled with editable seed text"
+    assert (
+        "stream_text_session" in content
+    ), "the first Send must build a graph from the seed text (magic build)"
+    assert (
+        "gr.DownloadButton" in content
+    ), "Export button (DownloadButton) must be present"
+    assert (
+        "gr.Accordion(" not in content
+    ), "open-world entry removes the build accordion"
+    assert "gr.Dropdown(" not in content, "open-world entry removes the fixture picker"
 
 
 def test_main_config_streaming_true() -> None:

tests/test_t2_01_removal.py

@@ -61,7 +61,7 @@ def test_schema_has_remove_variants() -> None:
     assert "remove_edge" in schema_str
     assert "remove_node" in [e.value for e in SceneActionType]
     assert "remove_edge" in [e.value for e in SceneActionType]
-    assert len(SceneActionType) == 15
+    assert len(SceneActionType) == 16
 
 
 # ── SC2: Validator rejects malformed removals ─────────────────────────────────

tests/test_t2_02_claim_review.py

@@ -209,7 +209,13 @@ async def test_response_shape_and_graph_version() -> None:
 
 
 async def test_reject_canvas_hint() -> None:
-    """SC6 (rejected): canvas hint is action=remove for a rejected claim."""
+    """SC6 (rejected): for a NODE claim, canvas hint is action=clear_pending (NOT
+    remove). Rejecting a claim on a node must keep the node on canvas — only the
+    amber 'awaiting review' badge is cleared. This test was previously encoding the
+    bug (action='remove'), and is corrected to assert the fixed behaviour.
+    (For EDGE claims, rejection still emits action='remove' — locked by
+    test_edge_claim_review.py::test_reject_edge_claim_still_removes_edge.)
+    """
     claim = Claim(
         id="c1",
         claim_type="label",
@@ -227,7 +233,9 @@ async def test_reject_canvas_hint() -> None:
         resp = await client.post(f"/api/claim/{sid}/c1/review?state=rejected")
     assert resp.status_code == 200
     canvas = resp.json()["canvas"]
-    assert canvas["action"] == "remove"
+    # Node claims: reject clears the badge but keeps the node (clear_pending).
+    assert canvas["action"] == "clear_pending"
+    assert canvas["target_id"] == "n1"
 
 
 async def test_do_review_claim_round_trip_inspector_updated() -> None:

tests/test_t2_03_edit_edges.py

@@ -88,8 +88,9 @@ def test_schema_has_edit_variants() -> None:
 
     schema_str = str(sceneplan_validation_schema())
     assert "update_node" in schema_str
+    assert "update_edge" in schema_str
     assert "create_edge" in schema_str
-    assert len(SceneActionType) == 15
+    assert len(SceneActionType) == 16
 
 
 # ── SC1: Overlay without destroying original ──────────────────────────────────
@@ -197,9 +198,11 @@ def test_create_edge_valid() -> None:
     result = validate_sceneplan(ScenePlan(actions=[action]), graph, scene)
     assert len(result.valid_actions) == 1
     gp, sp, events = reduce_turn([action], graph, scene)
-    assert any(e.properties.get("origin") == "user_asserted" for e in gp.upsert_edges)
+    # Agent create_edge is model_inferred (the model PROPOSES a relationship), not
+    # user_asserted — keeps trust unflattened so it renders amber + redacts on export.
+    assert any(e.properties.get("origin") == "model_inferred" for e in gp.upsert_edges)
     assert any(
-        c.claim_type == "relationship" and c.origin == "user_asserted"
+        c.claim_type == "relationship" and c.origin == "model_inferred"
         for c in gp.upsert_claims
     )
     # Edge is surfaced since both endpoints are visible
@@ -221,7 +224,11 @@ def test_reducer_update_node_idempotent() -> None:
 # ── SC5: Trust renders correctly ─────────────────────────────────────────────
 
 
-def test_create_edge_claim_has_user_asserted_origin() -> None:
+def test_create_edge_claim_has_model_inferred_origin() -> None:
+    """Agent-proposed edges are model_inferred + pending (awaiting review), NOT
+    user_asserted/accepted — the model proposing a relationship must not pass as
+    user-vouched on export (plan/06 trust model). Direct user connects
+    (apply_user_edge) remain user_asserted/accepted."""
     graph = _graph("n1", "n2")
     scene = _scene(visible_nodes=["n1", "n2"])
     action = SceneAction(
@@ -229,8 +236,8 @@ def test_create_edge_claim_has_user_asserted_origin() -> None:
     )
     gp, sp, ev = reduce_turn([action], graph, scene)
     edge_claim = next(c for c in gp.upsert_claims if c.claim_type == "relationship")
-    assert edge_claim.origin == "user_asserted"
-    assert edge_claim.review_state == "accepted"
+    assert edge_claim.origin == "model_inferred"
+    assert edge_claim.review_state == "pending"
     assert edge_claim.support_state == "unverified"
 
 
@@ -317,6 +324,185 @@ def test_update_node_id_not_found() -> None:
     assert "id_not_found" in result.rejection_reasons[0]
 
 
+# ── update_edge: relabel an existing edge (user_asserted overlay) ─────────────
+
+
+def _edge_l(edge_id: str, src: str, tgt: str, label: str) -> Edge:
+    return Edge(id=edge_id, source=src, target=tgt, kind="relates_to", label=label)
+
+
+def test_effective_edge_label_prefers_user_overlay() -> None:
+    from loosecanvas.contracts import Claim
+    from loosecanvas.turn_logic import effective_edge_label
+
+    edge = _edge_l("e1", "n1", "n2", "original")
+    # No claims → the raw edge.label.
+    assert effective_edge_label(edge, []) == "original"
+    # A model_inferred label claim is a PROPOSAL — it does not change the displayed label.
+    model_claim = Claim(
+        id="c-model",
+        claim_type="label",
+        target_id="e1",
+        text="model guess",
+        origin="model_inferred",
+    )
+    assert effective_edge_label(edge, [model_claim]) == "original"
+    # A user_asserted label claim overrides the displayed label.
+    user_claim = Claim(
+        id="c-user",
+        claim_type="label",
+        target_id="e1",
+        text="clearer label",
+        origin="user_asserted",
+        review_state="accepted",
+    )
+    assert effective_edge_label(edge, [model_claim, user_claim]) == "clearer label"
+
+
+def test_reducer_update_edge_user_overlay() -> None:
+    graph = _graph("n1", "n2", edges=[_edge_l("e1", "n1", "n2", "original")])
+    scene = _scene(visible_nodes=["n1", "n2"], visible_edges=["e1"])
+    action = SceneAction(
+        type=SceneActionType.update_edge, edge_id="e1", label="clearer"
+    )
+    gp, sp, events = reduce_turn([action], graph, scene)
+    claim = next(c for c in gp.upsert_claims if c.claim_type == "label")
+    assert claim.target_id == "e1"
+    assert claim.origin == "user_asserted"
+    assert claim.review_state == "accepted"
+    assert claim.text == "clearer"
+    # Original edge.label is preserved underneath the overlay.
+    graph.apply_graph_patch(gp)
+    assert graph.get_edge("e1").label == "original"
+    from loosecanvas.turn_logic import effective_edge_label
+
+    assert (
+        effective_edge_label(graph.get_edge("e1"), graph.claims.values()) == "clearer"
+    )
+
+
+def test_validator_update_edge_missing_fields() -> None:
+    graph = _graph("n1", "n2", edges=[_edge_l("e1", "n1", "n2", "x")])
+    scene = _scene(visible_nodes=["n1", "n2"], visible_edges=["e1"])
+    r1 = validate_sceneplan(
+        ScenePlan(actions=[SceneAction(type=SceneActionType.update_edge, label="y")]),
+        graph,
+        scene,
+    )
+    assert "edge_id" in r1.rejection_reasons[0]
+    r2 = validate_sceneplan(
+        ScenePlan(
+            actions=[SceneAction(type=SceneActionType.update_edge, edge_id="e1")]
+        ),
+        graph,
+        scene,
+    )
+    assert "label" in r2.rejection_reasons[0]
+
+
+def test_validator_update_edge_not_found_and_not_visible() -> None:
+    graph = _graph("n1", "n2", edges=[_edge_l("e1", "n1", "n2", "x")])
+    scene = _scene(visible_nodes=["n1", "n2"], visible_edges=["e1"])
+    r1 = validate_sceneplan(
+        ScenePlan(
+            actions=[
+                SceneAction(
+                    type=SceneActionType.update_edge, edge_id="ghost", label="y"
+                )
+            ]
+        ),
+        graph,
+        scene,
+    )
+    assert "id_not_found" in r1.rejection_reasons[0]
+    scene_hidden = _scene(visible_nodes=["n1", "n2"], visible_edges=[])
+    r2 = validate_sceneplan(
+        ScenePlan(
+            actions=[
+                SceneAction(type=SceneActionType.update_edge, edge_id="e1", label="y")
+            ]
+        ),
+        graph,
+        scene_hidden,
+    )
+    assert "edge_not_visible" in r2.rejection_reasons[0]
+
+
+def test_validator_update_edge_valid() -> None:
+    graph = _graph("n1", "n2", edges=[_edge_l("e1", "n1", "n2", "x")])
+    scene = _scene(visible_nodes=["n1", "n2"], visible_edges=["e1"])
+    result = validate_sceneplan(
+        ScenePlan(
+            actions=[
+                SceneAction(
+                    type=SceneActionType.update_edge, edge_id="e1", label="clearer"
+                )
+            ]
+        ),
+        graph,
+        scene,
+    )
+    assert len(result.valid_actions) == 1
+
+
+def _make_edge_session() -> str:
+    nodes = [
+        Node(id="n1", kind="concept", label="N1"),
+        Node(id="n2", kind="concept", label="N2"),
+    ]
+    edges = [_edge_l("e1", "n1", "n2", "original")]
+    repo = LooseGraphRepository.from_extraction(nodes, edges, [], SourceSnapshot())
+    scene = SceneState(
+        scene_id="s1", visible_node_ids=["n1", "n2"], visible_edge_ids=["e1"]
+    )
+    sid = str(uuid.uuid4())
+    now = time.time()
+    turn_logic.session_store[sid] = turn_logic.SessionRecord(
+        session_id=sid,
+        graph=repo,
+        scene=scene,
+        history=[],
+        graph_version=1,
+        created_at=now,
+        last_seen=now,
+        render_scene_id="s1",
+    )
+    return sid
+
+
+def test_apply_agent_actions_update_edge_emits_update_data() -> None:
+    """The load-bearing render assertion: relabeling an already-visible edge must
+    emit an explicit update_data op carrying the new effective label (diff_scene
+    alone won't repaint a persisting element's label)."""
+    sid = _make_edge_session()
+    record = turn_logic.session_store[sid]
+    try:
+        action = SceneAction(
+            type=SceneActionType.update_edge, edge_id="e1", label="clearer link"
+        )
+        result = turn_logic.apply_agent_actions(
+            record, [action], {"kind": "edge", "id": "e1"}, "done"
+        )
+        ops = result.renderer_patch.operations
+        update_ops = [
+            o for o in ops if o.op == "update_data" and o.data.get("id") == "e1"
+        ]
+        assert len(update_ops) == 1, "relabeled visible edge must emit update_data"
+        assert update_ops[0].data["data"]["label"] == "clearer link"
+        # Effective label resolves to the overlay; raw edge.label preserved.
+        from loosecanvas.turn_logic import effective_edge_label
+
+        assert record.graph.get_edge("e1").label == "original"
+        assert (
+            effective_edge_label(
+                record.graph.get_edge("e1"), record.graph.claims.values()
+            )
+            == "clearer link"
+        )
+    finally:
+        turn_logic.session_store.pop(sid, None)
+
+
 # ── Duplicate user_asserted edge rejection ────────────────────────────────────
 
 

tests/test_t2_04_node_edits.py

@@ -0,0 +1,367 @@
+"""T2-04 — user-initiated node edits (radial menu: add / remove node, edit summary).
+
+These mirror the sibling edge-edit tests in ``tests/test_b2_cxtmenu_review.py``
+(``remove_user_edge``). User edits are ``user_asserted`` (never ``model_inferred`` —
+the trust model in plan/06 must not be flattened):
+
+- ``remove_user_node`` routes through the authoritative validate→reduce→finalize
+  pipeline (same as the agent's remove-node turn); the reducer cascades incident
+  visible edges and the validator's ``would_empty_scene`` guard keeps the last node.
+- ``apply_user_node`` mints a unique node + ``user_asserted`` label/summary claims,
+  reveals it, and places it on the open periphery (an orphan has no positioned
+  neighbour, so ``_assign_reveal_positions`` would otherwise drop it on the centroid).
+- edit-summary reuses the existing ``apply_user_edit(summary=...)`` overlay path.
+"""
+
+from __future__ import annotations
+
+import time
+import uuid
+
+import pytest
+from loosecanvas import turn_logic
+from loosecanvas.contracts import Edge, Node, SceneState, SourceSnapshot
+from loosecanvas.graph_repository import LooseGraphRepository
+from loosecanvas.turn_logic import (
+    RendererPatch,
+    apply_user_edge_edit,
+    apply_user_edit,
+    apply_user_node,
+    effective_edge_label,
+    effective_node_summary,
+    remove_user_node,
+)
+
+
+def _make_session_with_visible_nodes() -> str:
+    """n1—n2—n3 with all three nodes visible and one visible edge (e1: n1—n2).
+
+    Three visible nodes so ``remove_node`` does not trip ``would_empty_scene``.
+    """
+    nodes = [
+        Node(id="n1", kind="concept", label="One"),
+        Node(id="n2", kind="concept", label="Two"),
+        Node(id="n3", kind="concept", label="Three"),
+    ]
+    edges = [Edge(id="e1", source="n1", target="n2", kind="related_to", label="rel")]
+    repo = LooseGraphRepository.from_extraction(nodes, edges, [], SourceSnapshot())
+    scene = SceneState(
+        scene_id="s1",
+        visible_node_ids=["n1", "n2", "n3"],
+        visible_edge_ids=["e1"],
+        node_positions={
+            "n1": (0.0, 0.0),
+            "n2": (100.0, 0.0),
+            "n3": (50.0, 100.0),
+        },
+    )
+    sid = str(uuid.uuid4())
+    now = time.time()
+    turn_logic.session_store[sid] = turn_logic.SessionRecord(
+        session_id=sid,
+        graph=repo,
+        scene=scene,
+        history=[],
+        graph_version=1,
+        created_at=now,
+        last_seen=now,
+        render_scene_id="s1",
+    )
+    return sid
+
+
+def _make_session_single_node() -> str:
+    """A scene with exactly one visible node (to exercise ``would_empty_scene``)."""
+    node = Node(id="solo", kind="concept", label="Solo")
+    repo = LooseGraphRepository.from_extraction([node], [], [], SourceSnapshot())
+    scene = SceneState(
+        scene_id="s1",
+        visible_node_ids=["solo"],
+        node_positions={"solo": (0.0, 0.0)},
+    )
+    sid = str(uuid.uuid4())
+    now = time.time()
+    turn_logic.session_store[sid] = turn_logic.SessionRecord(
+        session_id=sid,
+        graph=repo,
+        scene=scene,
+        history=[],
+        graph_version=1,
+        created_at=now,
+        last_seen=now,
+        render_scene_id="s1",
+    )
+    return sid
+
+
+# ── remove_user_node ─────────────────────────────────────────────────────────
+
+
+async def test_remove_user_node_removes_visible_node() -> None:
+    """Delete-node removes a visible node from graph + scene via the authoritative
+    validate→reduce pipeline and emits a remove patch."""
+    sid = _make_session_with_visible_nodes()
+    assert "n3" in turn_logic.session_store[sid].graph.nodes  # precondition
+    result = await remove_user_node(sid, "n3")
+    assert isinstance(result.renderer_patch, RendererPatch)
+    assert "n3" not in turn_logic.session_store[sid].graph.nodes
+    assert "n3" not in turn_logic.session_store[sid].scene.visible_node_ids
+    assert any(o.op == "remove_element" for o in result.renderer_patch.operations)
+
+
+async def test_remove_user_node_cascades_incident_edges() -> None:
+    """Removing n1 cascades the incident visible edge e1 (n1—n2) out of the scene."""
+    sid = _make_session_with_visible_nodes()
+    assert "e1" in turn_logic.session_store[sid].scene.visible_edge_ids
+    result = await remove_user_node(sid, "n1")
+    assert "n1" not in turn_logic.session_store[sid].graph.nodes
+    assert "e1" not in turn_logic.session_store[sid].scene.visible_edge_ids
+    assert isinstance(result.renderer_patch, RendererPatch)
+
+
+async def test_remove_user_node_graceful_on_unknown_node() -> None:
+    """An unknown / non-visible node degrades gracefully (no crash, no mutation)."""
+    sid = _make_session_with_visible_nodes()
+    result = await remove_user_node(sid, "no_such_node")
+    assert result is not None  # a TurnResult (graceful failure), not an exception
+    assert "n1" in turn_logic.session_store[sid].graph.nodes  # untouched
+    assert "n3" in turn_logic.session_store[sid].graph.nodes
+
+
+async def test_remove_user_node_would_empty_scene_is_graceful() -> None:
+    """Removing the last visible node is rejected (``would_empty_scene``) gracefully."""
+    sid = _make_session_single_node()
+    result = await remove_user_node(sid, "solo")
+    assert result.status == "failed"
+    assert "solo" in turn_logic.session_store[sid].graph.nodes  # not mutated
+    assert "solo" in turn_logic.session_store[sid].scene.visible_node_ids
+
+
+async def test_remove_user_node_unknown_session_raises() -> None:
+    """An unknown session raises KeyError (the on_select branch catches it)."""
+    with pytest.raises(KeyError):
+        await remove_user_node("no-such-session", "n1")
+
+
+# ── apply_user_node ──────────────────────────────────────────────────────────
+
+
+async def test_apply_user_node_adds_node_to_graph_and_scene() -> None:
+    """Add-node mints a node into the graph and reveals it in the scene."""
+    sid = _make_session_with_visible_nodes()
+    result = await apply_user_node(sid, "Fresh Concept")
+    record = turn_logic.session_store[sid]
+    new_ids = [
+        nid
+        for nid in record.graph.nodes
+        if record.graph.nodes[nid].label == "Fresh Concept"
+    ]
+    assert len(new_ids) == 1
+    new_id = new_ids[0]
+    assert new_id in record.scene.visible_node_ids
+    assert isinstance(result.renderer_patch, RendererPatch)
+    assert any(o.op == "add_element" for o in result.renderer_patch.operations)
+
+
+async def test_apply_user_node_label_claim_is_user_asserted() -> None:
+    """The new node's label claim is origin=user_asserted (trust not flattened)."""
+    sid = _make_session_with_visible_nodes()
+    await apply_user_node(sid, "Trust Me")
+    record = turn_logic.session_store[sid]
+    label_claims = [
+        c
+        for c in record.graph.claims.values()
+        if c.claim_type == "label" and c.text == "Trust Me"
+    ]
+    assert label_claims, "expected a label claim for the new node"
+    assert all(c.origin == "user_asserted" for c in label_claims)
+    assert all(c.review_state == "accepted" for c in label_claims)
+    assert all(c.support_state == "unverified" for c in label_claims)
+
+
+async def test_apply_user_node_assigns_a_position() -> None:
+    """A position is assigned for the new (orphan) node so it is not dropped on the centroid."""
+    sid = _make_session_with_visible_nodes()
+    await apply_user_node(sid, "Floating")
+    record = turn_logic.session_store[sid]
+    new_id = next(
+        nid for nid in record.graph.nodes if record.graph.nodes[nid].label == "Floating"
+    )
+    assert new_id in record.scene.node_positions
+    new_x, _new_y = record.scene.node_positions[new_id]
+    # Periphery: to the right of the rightmost pre-existing node (max x was 100.0).
+    assert new_x > 100.0
+
+
+async def test_apply_user_node_with_summary_creates_summary_claim() -> None:
+    """A summary= argument creates a user_asserted summary claim reflected in the effective summary."""
+    sid = _make_session_with_visible_nodes()
+    await apply_user_node(sid, "Documented", "A helpful summary.")
+    record = turn_logic.session_store[sid]
+    new_id = next(
+        nid
+        for nid in record.graph.nodes
+        if record.graph.nodes[nid].label == "Documented"
+    )
+    summary_claims = [
+        c
+        for c in record.graph.claims.values()
+        if c.claim_type == "summary" and c.target_id == new_id
+    ]
+    assert summary_claims
+    assert all(c.origin == "user_asserted" for c in summary_claims)
+    node = record.graph.get_node(new_id)
+    assert node is not None
+    assert (
+        effective_node_summary(node, record.graph.claims.values())
+        == "A helpful summary."
+    )
+
+
+async def test_apply_user_node_empty_label_raises() -> None:
+    """An empty / whitespace label is rejected with ValueError."""
+    sid = _make_session_with_visible_nodes()
+    with pytest.raises(ValueError):
+        await apply_user_node(sid, "   ")
+
+
+async def test_apply_user_node_unique_id_on_collision() -> None:
+    """Two nodes with the same label get distinct ids (deterministic suffixing)."""
+    sid = _make_session_with_visible_nodes()
+    await apply_user_node(sid, "Dup")
+    await apply_user_node(sid, "Dup")
+    record = turn_logic.session_store[sid]
+    dup_ids = [
+        nid for nid in record.graph.nodes if record.graph.nodes[nid].label == "Dup"
+    ]
+    assert len(dup_ids) == 2
+    assert len(set(dup_ids)) == 2  # ids are distinct
+
+
+async def test_apply_user_node_unknown_session_raises() -> None:
+    """An unknown session raises KeyError (the on_select branch catches it)."""
+    with pytest.raises(KeyError):
+        await apply_user_node("no-such-session", "Whatever")
+
+
+# ── edit summary (reuses apply_user_edit(summary=...)) ───────────────────────
+
+
+async def test_apply_user_edit_summary_adds_user_asserted_claim() -> None:
+    """Editing a node's summary adds a user_asserted summary claim; the effective
+    summary reflects it."""
+    sid = _make_session_with_visible_nodes()
+    result = await apply_user_edit(sid, "n2", summary="My own note.")
+    assert isinstance(result.renderer_patch, RendererPatch)
+    record = turn_logic.session_store[sid]
+    summary_claims = [
+        c
+        for c in record.graph.claims.values()
+        if c.claim_type == "summary" and c.target_id == "n2"
+    ]
+    assert summary_claims
+    assert all(c.origin == "user_asserted" for c in summary_claims)
+    node = record.graph.get_node("n2")
+    assert node is not None
+    assert effective_node_summary(node, record.graph.claims.values()) == "My own note."
+
+
+# ── TASK 3: apply_user_edge_edit ─────────────────────────────────────────────
+
+
+def _make_session_with_visible_edge_for_edit() -> str:
+    """Session with n1—n2 (e1, 'original label') both visible."""
+    from loosecanvas.contracts import Edge
+
+    nodes = [
+        Node(id="n1", kind="concept", label="N1"),
+        Node(id="n2", kind="concept", label="N2"),
+    ]
+    edges = [
+        Edge(id="e1", source="n1", target="n2", kind="related_to", label="original")
+    ]
+    repo = LooseGraphRepository.from_extraction(nodes, edges, [], SourceSnapshot())
+    scene = SceneState(
+        scene_id="s1",
+        visible_node_ids=["n1", "n2"],
+        visible_edge_ids=["e1"],
+        node_positions={"n1": (0.0, 0.0), "n2": (100.0, 0.0)},
+    )
+    sid = str(uuid.uuid4())
+    now = time.time()
+    turn_logic.session_store[sid] = turn_logic.SessionRecord(
+        session_id=sid,
+        graph=repo,
+        scene=scene,
+        history=[],
+        graph_version=1,
+        created_at=now,
+        last_seen=now,
+        render_scene_id="s1",
+    )
+    return sid
+
+
+async def test_apply_user_edge_edit_effective_label_updated() -> None:
+    """After apply_user_edge_edit, effective_edge_label returns the new label."""
+    sid = _make_session_with_visible_edge_for_edit()
+    record = turn_logic.session_store[sid]
+    result = await apply_user_edge_edit(sid, "e1", label="clearer link")
+    assert result.status == "success"
+    edge = record.graph.get_edge("e1")
+    assert edge is not None
+    # Raw edge.label is preserved.
+    assert edge.label == "original"
+    # Effective label reflects the overlay.
+    assert effective_edge_label(edge, record.graph.claims.values()) == "clearer link"
+
+
+async def test_apply_user_edge_edit_raw_label_unchanged() -> None:
+    """The raw edge.label is preserved underneath the user_asserted overlay."""
+    sid = _make_session_with_visible_edge_for_edit()
+    record = turn_logic.session_store[sid]
+    await apply_user_edge_edit(sid, "e1", label="new label")
+    edge = record.graph.get_edge("e1")
+    assert edge is not None
+    assert edge.label == "original"
+
+
+async def test_apply_user_edge_edit_claim_is_user_asserted() -> None:
+    """The overlay claim has origin=user_asserted and review_state=accepted."""
+    sid = _make_session_with_visible_edge_for_edit()
+    record = turn_logic.session_store[sid]
+    await apply_user_edge_edit(sid, "e1", label="labeled")
+    label_claims = [
+        c
+        for c in record.graph.claims.values()
+        if c.claim_type == "label" and c.target_id == "e1"
+    ]
+    assert label_claims, "expected a label claim for the edge"
+    assert all(c.origin == "user_asserted" for c in label_claims)
+    assert all(c.review_state == "accepted" for c in label_claims)
+
+
+async def test_apply_user_edge_edit_emits_update_data_op() -> None:
+    """The renderer patch carries an update_data op for the edge with the new label."""
+    sid = _make_session_with_visible_edge_for_edit()
+    result = await apply_user_edge_edit(sid, "e1", label="updated")
+    update_ops = [
+        o
+        for o in result.renderer_patch.operations
+        if o.op == "update_data" and o.data.get("id") == "e1"
+    ]
+    assert update_ops, "must emit update_data for visible edge"
+    assert update_ops[0].data["data"]["label"] == "updated"
+
+
+async def test_apply_user_edge_edit_unknown_edge_raises() -> None:
+    """An unknown edge id raises KeyError."""
+    sid = _make_session_with_visible_edge_for_edit()
+    with pytest.raises(KeyError):
+        await apply_user_edge_edit(sid, "no_such_edge", label="x")
+
+
+async def test_apply_user_edge_edit_unknown_session_raises() -> None:
+    """An unknown session raises KeyError."""
+    with pytest.raises(KeyError):
+        await apply_user_edge_edit("no-such-session", "e1", label="x")

tests/test_text_graph_adapter.py

@@ -29,6 +29,19 @@ from loosecanvas.llm_client import LLMClient
 
 _TITLE = "Gradient Descent"
 
+
+def test_edge_schema_requires_label() -> None:
+    """Every extracted edge must carry a label (the grammar requires it) so the magic
+    build never produces bare, uninformative connections — the KG-quality contract."""
+    from loosecanvas.extractors.text_graph_adapter import TEXT_GRAPH_RESPONSE_FORMAT
+
+    edge_items = TEXT_GRAPH_RESPONSE_FORMAT["json_schema"]["schema"]["properties"][
+        "semantic_edges"
+    ]["items"]
+    assert "label" in edge_items["required"]
+    assert {"source_id", "target_id", "type"} <= set(edge_items["required"])
+
+
 _HAPPY_JSON = json.dumps(
     {
         "concept_nodes": [
@@ -365,3 +378,64 @@ async def test_extract_from_file_reads_allowed_path(tmp_path: Path) -> None:
     )
     graph = await extract_graph_from_file(source, _TITLE, _mock_client(_HAPPY_JSON))
     assert len(graph.nodes) == 2
+
+
+# --------------------------------------------------------------------------- #
+# BUG FIX: semantic_edge claim must target the edge id, not the target node   #
+# --------------------------------------------------------------------------- #
+
+
+async def test_edge_claim_targets_edge_id() -> None:
+    """semantic_edge claims must have target_id == edge_id, NOT a node id.
+
+    The edge_id in _ingest_edge is computed as ``f"{src}::{kind}::{tgt}"``.
+    The bug had target_id=tgt (the target NODE id), which made _build_edge_trust_map
+    always miss → edges showed fallback deterministic/pending, review was a no-op.
+    """
+    text = "Gradient descent\nis a loss function method used widely in practice."
+    graph = await extract_graph_from_text(text, _TITLE, _mock_client(_HAPPY_JSON))
+
+    edge_ids = {e.id for e in graph.edges}
+    node_ids = {n.id for n in graph.nodes}
+    semantic_edge_claims = [c for c in graph.claims if c.claim_type == "semantic_edge"]
+    assert semantic_edge_claims, "expected at least one semantic_edge claim"
+    for claim in semantic_edge_claims:
+        assert claim.target_id in edge_ids, (
+            f"semantic_edge claim {claim.id} has target_id={claim.target_id!r} "
+            f"which is NOT an edge id; edge ids: {edge_ids}"
+        )
+        assert claim.target_id not in node_ids, (
+            f"semantic_edge claim {claim.id} has target_id={claim.target_id!r} "
+            f"which is a node id — the bug has recurred"
+        )
+
+
+async def test_text_session_edges_render_amber() -> None:
+    """From an extracted graph, every edge must be in the trust map as model_inferred/pending.
+
+    _build_edge_trust_map checks claim.target_id in graph.edges; with the bug
+    (target_id = node id) this always misses → trust map is empty → no amber.
+    After the fix (target_id = edge_id) every edge gets an entry.
+    """
+    from loosecanvas.contracts import SourceSnapshot
+    from loosecanvas.turn_logic import _build_edge_trust_map
+
+    text = "Gradient descent\nis a loss function method used widely in practice."
+    graph = await extract_graph_from_text(text, _TITLE, _mock_client(_HAPPY_JSON))
+
+    repo = LooseGraphRepository.from_extraction(
+        graph.nodes, graph.edges, graph.claims, SourceSnapshot()
+    )
+    trust_map = _build_edge_trust_map(repo)
+
+    for edge in graph.edges:
+        assert (
+            edge.id in trust_map
+        ), f"edge {edge.id!r} missing from trust map — amber affordance will not render"
+        entry = trust_map[edge.id]
+        assert (
+            entry["origin"] == "model_inferred"
+        ), f"edge {edge.id!r} trust origin={entry['origin']!r}, want 'model_inferred'"
+        assert (
+            entry["review"] == "pending"
+        ), f"edge {edge.id!r} review={entry['review']!r}, want 'pending'"

tests/test_time_travel_output_arity.py

@@ -0,0 +1,95 @@
+"""Regression guard: time-travel handlers return as many values as their wired outputs.
+
+The undo/redo/back buttons errored live with "A function (on_undo) didn't return enough
+output values (needed: 6, returned: 5)" the moment they were pressed, yet the whole suite
+was green — because the unit tests call ``undo_turn``/``redo_turn`` directly and never
+exercise the Gradio output-arity binding (``turn_outputs`` grew to include ``send_btn``
+for ``on_turn`` but the time-travel handlers were not updated). This builds the REAL
+Blocks app and asserts each handler returns exactly ``len(outputs)`` values, so an
+output/arity drift fails the gate instead of only the live button.
+"""
+
+from __future__ import annotations
+
+import time
+import uuid
+
+import pytest
+from loosecanvas import turn_logic
+from loosecanvas.contracts import Node, SceneState, SourceSnapshot
+from loosecanvas.graph_repository import LooseGraphRepository
+from loosecanvas.main import build_app
+from loosecanvas.turn_logic import SessionRecord, _commit_snapshot
+
+TIME_TRAVEL = ("on_undo", "on_redo", "on_back")
+
+
+def _handlers() -> dict[str, tuple[object, int]]:
+    """Map each time-travel handler name -> (fn, declared output count) from the app."""
+    demo, _app = build_app()
+    out: dict[str, tuple[object, int]] = {}
+    for block_fn in demo.fns.values():
+        fn = getattr(block_fn, "fn", None)
+        name = getattr(fn, "__name__", "")
+        if name in TIME_TRAVEL and name not in out:
+            out[name] = (fn, len(block_fn.outputs))
+    return out
+
+
+@pytest.fixture(scope="module")
+def handlers() -> dict[str, tuple[object, int]]:
+    h = _handlers()
+    missing = [n for n in TIME_TRAVEL if n not in h]
+    assert not missing, f"handlers not found in demo.fns: {missing}"
+    return h
+
+
+def _session_with_undo_history() -> str:
+    """A session with two committed snapshots so undo_turn has a prior state to pop."""
+    nodes = [
+        Node(id="n1", kind="concept", label="One"),
+        Node(id="n2", kind="concept", label="Two"),
+    ]
+    repo = LooseGraphRepository.from_extraction(nodes, [], [], SourceSnapshot())
+    scene = SceneState(
+        scene_id="s1",
+        visible_node_ids=["n1", "n2"],
+        node_positions={"n1": (0.0, 0.0), "n2": (100.0, 0.0)},
+    )
+    sid = str(uuid.uuid4())
+    now = time.time()
+    record = SessionRecord(
+        session_id=sid,
+        graph=repo,
+        scene=scene,
+        history=[],
+        graph_version=1,
+        created_at=now,
+        last_seen=now,
+        render_scene_id="s1",
+    )
+    turn_logic.session_store[sid] = record
+    _commit_snapshot(record)  # baseline (load) snapshot
+    record.graph_version = 2
+    _commit_snapshot(record)  # a second state so undo can revert to the baseline
+    return sid
+
+
+@pytest.mark.parametrize("name", TIME_TRAVEL)
+async def test_no_session_return_matches_output_arity(handlers, name: str) -> None:
+    """The no-session early-return path supplies exactly len(outputs) values."""
+    fn, n_outputs = handlers[name]
+    result = await fn("", [])  # type: ignore[operator]
+    assert isinstance(result, tuple)
+    assert (
+        len(result) == n_outputs
+    ), f"{name} returned {len(result)} values for {n_outputs} wired outputs"
+
+
+async def test_on_undo_success_path_matches_output_arity(handlers) -> None:
+    """The success path (real session with undo history) also matches output arity."""
+    fn, n_outputs = handlers["on_undo"]
+    sid = _session_with_undo_history()
+    result = await fn(sid, [])  # type: ignore[operator]
+    assert isinstance(result, tuple)
+    assert len(result) == n_outputs

tests/test_tool_narration_chat.py

@@ -0,0 +1,183 @@
+"""Tests for workstream (a): live collapsible step-list inside the chat thread.
+
+Covers:
+* _tool_steplist_message shape (pending / done / empty steps).
+* on_turn streaming: mid-turn chatbot output contains a metadata-titled pending
+  bubble; final chatbot output drops the pending bubble and appends tool_receipts.
+
+The tests drive on_turn via a thin harness that replaces run_agent_turn_streaming
+with a fake generator — no LLM, no session lookup required for the event-path under
+test.  The fake yields one ToolActivityEvent then a FinalEvent with one tool-activity
+label so both branches are exercised in a single streaming run.
+"""
+
+from __future__ import annotations
+
+from collections.abc import AsyncGenerator
+from typing import Any
+from unittest.mock import patch
+
+import pytest
+from loosecanvas.agent_harness import FinalEvent, ToolActivityEvent
+from loosecanvas.main import _tool_steplist_message
+
+# ── unit tests for _tool_steplist_message ─────────────────────────────────────
+
+
+def test_steplist_pending_shape() -> None:
+    """pending status produces a message with metadata title and status."""
+    msg = _tool_steplist_message(["step one", "step two"], "pending")
+    assert msg["role"] == "assistant"
+    assert msg["metadata"]["title"] == "Working…"
+    assert msg["metadata"]["status"] == "pending"
+    assert "- step one" in msg["content"]
+    assert "- step two" in msg["content"]
+
+
+def test_steplist_done_shape() -> None:
+    """done status produces same structure but status='done'."""
+    msg = _tool_steplist_message(["finished"], "done")
+    assert msg["metadata"]["status"] == "done"
+    assert "- finished" in msg["content"]
+
+
+def test_steplist_empty_steps_placeholder() -> None:
+    """Empty step list must not produce a blank content field (shows placeholder)."""
+    msg = _tool_steplist_message([], "pending")
+    assert msg["content"].strip() != ""
+    assert "Working" in msg["content"]
+
+
+# ── helpers for on_turn harness ───────────────────────────────────────────────
+
+
+async def _fake_streaming(
+    tool_label: str = "relabel_edge:woody->dylan",
+) -> AsyncGenerator[Any]:
+    """Fake run_agent_turn_streaming: one ToolActivityEvent then a FinalEvent."""
+    yield ToolActivityEvent(message=tool_label)
+
+    # FinalEvent with no TurnResult (pure-speech path without canvas mutation);
+    # tool_activity carries the label so _tool_receipt_messages has something to show.
+    yield FinalEvent(
+        turn_result=None,
+        assistant_message="Here is what I did.",
+        tool_activity=[tool_label],
+    )
+
+
+# ── on_turn streaming event-path tests ───────────────────────────────────────
+
+
+@pytest.fixture()
+def _on_turn_fn() -> Any:
+    """Extract the on_turn coroutine from the real Blocks app."""
+    from loosecanvas.main import build_app
+
+    demo, _app = build_app()
+    for block_fn in demo.fns.values():
+        fn = getattr(block_fn, "fn", None)
+        if getattr(fn, "__name__", "") == "on_turn":
+            return fn
+    pytest.fail("on_turn not found in demo.fns")
+
+
+async def _collect_chatbot_snapshots(
+    on_turn: Any,
+    message: str = "relabel the edges",
+    sid: str = "fake-session",
+    selection: dict[str, Any] | None = None,
+    history: list[Any] | None = None,
+) -> list[Any]:
+    """Run the on_turn generator and return every chatbot value that is NOT gr.update().
+
+    We only collect concrete list values (the chatbot history snapshots) so we can
+    assert on what was pushed to the Gradio Chatbot at each stage.
+    """
+    import gradio as gr  # noqa: PLC0415
+
+    snapshots: list[Any] = []
+    async for output_tuple in on_turn(message, sid, selection or {}, history or []):
+        # on_turn yields 8-tuples; chatbot is index 2.
+        chatbot_val = output_tuple[2]
+        if not isinstance(chatbot_val, gr.update().__class__):  # type: ignore[arg-type]
+            snapshots.append(chatbot_val)
+    return snapshots
+
+
+async def test_pending_bubble_appears_mid_stream(_on_turn_fn: Any) -> None:
+    """A metadata-titled pending bubble must appear in at least one mid-stream snapshot."""
+    with patch(
+        "loosecanvas.main.run_agent_turn_streaming",
+        side_effect=lambda *_a, **_kw: _fake_streaming(),
+    ):
+        snapshots = await _collect_chatbot_snapshots(_on_turn_fn)
+
+    # At least one snapshot must contain a metadata message with status="pending".
+    pending_found = False
+    for snap in snapshots:
+        if not isinstance(snap, list):
+            continue
+        for msg in snap:
+            meta = msg.get("metadata", {}) if isinstance(msg, dict) else {}
+            if meta.get("status") == "pending":
+                pending_found = True
+                break
+    assert pending_found, (
+        f"No pending step-list bubble found in any mid-stream chatbot snapshot.\n"
+        f"Snapshots: {snapshots}"
+    )
+
+
+async def test_final_chatbot_has_no_pending_bubble(_on_turn_fn: Any) -> None:
+    """The final chatbot snapshot must NOT contain any pending bubble."""
+    with patch(
+        "loosecanvas.main.run_agent_turn_streaming",
+        side_effect=lambda *_a, **_kw: _fake_streaming(),
+    ):
+        snapshots = await _collect_chatbot_snapshots(_on_turn_fn)
+
+    assert snapshots, "on_turn yielded no chatbot snapshots"
+    final_snap = snapshots[-1]
+    assert isinstance(final_snap, list), f"Final snapshot is not a list: {final_snap}"
+    for msg in final_snap:
+        meta = msg.get("metadata", {}) if isinstance(msg, dict) else {}
+        assert (
+            meta.get("status") != "pending"
+        ), f"Pending bubble found in final chatbot snapshot: {msg}"
+
+
+async def test_final_chatbot_contains_tool_receipts(_on_turn_fn: Any) -> None:
+    """The final chatbot snapshot must include the tool-receipt messages from FinalEvent."""
+    tool_label = "relabel_edge:edge-1->edge-2"
+
+    async def _fake_with_label() -> AsyncGenerator[Any]:
+        yield ToolActivityEvent(message="relabelling edges")
+        yield FinalEvent(
+            turn_result=None,
+            assistant_message="Done.",
+            tool_activity=[tool_label],
+        )
+
+    with patch(
+        "loosecanvas.main.run_agent_turn_streaming",
+        side_effect=lambda *_a, **_kw: _fake_with_label(),
+    ):
+        snapshots = await _collect_chatbot_snapshots(_on_turn_fn)
+
+    assert snapshots, "on_turn yielded no chatbot snapshots"
+    final_snap = snapshots[-1]
+    assert isinstance(final_snap, list)
+
+    # The tool receipt appears as a metadata-titled message with title containing the
+    # tool name extracted from the label (the part before the first ':').
+    tool_name = tool_label.split(":")[0]
+    receipt_found = any(
+        isinstance(msg, dict)
+        and tool_name in (msg.get("metadata") or {}).get("title", "")
+        for msg in final_snap
+    )
+    assert receipt_found, (
+        f"No tool-receipt message for '{tool_name}' found in final snapshot.\n"
+        f"Final snapshot: {final_snap}"
+    )

tests/test_tooltip_stale_review.py

@@ -0,0 +1,135 @@
+"""Tests for Task B — stale hover-tooltip fix.
+
+After a review the clear_pending RendererPatch must ALSO emit an update_data op
+carrying {'id': node_id, 'data': {'review': <new_review_state>}} so the element's
+Cytoscape data('review') field is refreshed and the hover tooltip no longer shows
+the stale "pending review" text.
+"""
+
+from __future__ import annotations
+
+import time
+import uuid
+from collections.abc import Iterator
+
+import pytest
+from loosecanvas import turn_logic
+from loosecanvas.contracts import Claim, Node, SceneState, SourceSnapshot
+from loosecanvas.graph_repository import LooseGraphRepository
+from loosecanvas.turn_logic import (
+    do_review_claim,
+    session_locks,
+    session_store,
+)
+
+# ── Session isolation ─────────────────────────────────────────────────────────
+
+
+@pytest.fixture(autouse=True)
+def _isolate_sessions() -> Iterator[None]:
+    session_store.clear()
+    session_locks.clear()
+    yield
+    session_store.clear()
+    session_locks.clear()
+
+
+# ── Session helpers ───────────────────────────────────────────────────────────
+
+
+def _make_session(claims: list[Claim] | None = None) -> str:
+    node = Node(id="n1", kind="concept", label="Test Node")
+    repo = LooseGraphRepository.from_extraction(
+        [node], [], claims or [], SourceSnapshot()
+    )
+    scene = SceneState(scene_id="s1", visible_node_ids=["n1"])
+    sid = str(uuid.uuid4())
+    now = time.time()
+    turn_logic.session_store[sid] = turn_logic.SessionRecord(
+        session_id=sid,
+        graph=repo,
+        scene=scene,
+        history=[],
+        graph_version=1,
+        created_at=now,
+        last_seen=now,
+        render_scene_id="s1",
+    )
+    return sid
+
+
+def _pending_claim() -> Claim:
+    return Claim(
+        id="c1",
+        claim_type="label",
+        target_id="n1",
+        origin="model_inferred",
+        review_state="pending",
+        support_state="unverified",
+        text="test",
+    )
+
+
+# ── Tooltip fix tests ─────────────────────────────────────────────────────────
+
+
+def test_do_review_claim_accept_emits_update_data_with_accepted_state() -> None:
+    """Accepting a pending node claim must emit an update_data op refreshing
+    data('review') to 'accepted' so the hover tooltip no longer shows 'pending'."""
+    sid = _make_session([_pending_claim()])
+    result = do_review_claim(sid, "c1", "accepted")
+
+    update_ops = [
+        o
+        for o in result.renderer_patch.operations
+        if o.op == "update_data"
+        and o.data.get("id") == "n1"
+        and isinstance(o.data.get("data"), dict)
+        and "review" in o.data["data"]
+    ]
+    assert update_ops, (
+        "do_review_claim(accept) must emit an update_data op for the reviewed node; "
+        f"got operations: {[o.op for o in result.renderer_patch.operations]}"
+    )
+    review_value = update_ops[0].data["data"]["review"]
+    assert (
+        review_value == "accepted"
+    ), f"update_data review field must be 'accepted', got {review_value!r}"
+
+
+def test_do_review_claim_reject_node_emits_update_data_with_rejected_state() -> None:
+    """Rejecting a pending node claim clears the badge AND refreshes data('review')
+    to 'rejected' (not 'pending') so the tooltip reflects the real state."""
+    sid = _make_session([_pending_claim()])
+    result = do_review_claim(sid, "c1", "rejected")
+
+    update_ops = [
+        o
+        for o in result.renderer_patch.operations
+        if o.op == "update_data"
+        and o.data.get("id") == "n1"
+        and isinstance(o.data.get("data"), dict)
+        and "review" in o.data["data"]
+    ]
+    assert update_ops, (
+        "do_review_claim(reject) on a node claim must emit an update_data op; "
+        f"got operations: {[o.op for o in result.renderer_patch.operations]}"
+    )
+    review_value = update_ops[0].data["data"]["review"]
+    assert (
+        review_value == "rejected"
+    ), f"update_data review field must be 'rejected', got {review_value!r}"
+
+
+def test_do_review_claim_update_data_contains_snake_case_state() -> None:
+    """The review value in update_data must be the snake_case state string
+    ('accepted', 'rejected') — NOT a class name ('review-accepted' etc.)."""
+    sid = _make_session([_pending_claim()])
+    result = do_review_claim(sid, "c1", "accepted")
+
+    for op in result.renderer_patch.operations:
+        if op.op == "update_data" and op.data.get("id") == "n1":
+            review_val = op.data.get("data", {}).get("review", "")
+            assert (
+                "-" not in review_val
+            ), f"review value must be snake_case, not a class name; got {review_val!r}"