feat: Galaxy v6 physics engine, graph scene overhaul, and ledger UI improvements

.claude-plugin/skill-assets.sha256

@@ -2,5 +2,5 @@
 94bfa06317a8fe6a6a7e204bb70c5abdc9e4bbc34d79dd6f8447a30140bc8b85  .claude-plugin/plugin.json
 055655db84af07561d002f0c69744313d8413c39f3e873f941f0fa0b1e76dc66  skills/engraphis-memory/references/CONVENTIONS.md
 62019760766ff472a76a0f81437898f39e3c1fe2631732b7b7733e50c1ad837f  skills/engraphis-memory/references/SCOPING.md
-4ce83a2768680ec84488a767fc3bd6cd62688d785010a0abd1d4b3edbf14d03a  skills/engraphis-memory/references/TOOLS.md
-605181000a20a808e570b00cd2e852561f21234f041db03ade73f533b0e8bdaf  skills/engraphis-memory/SKILL.md
+96c8e9b9cee1b3cb43c4bef9e48c57ed92af707f7f7a5d28d73b1ac247d2f0c6  skills/engraphis-memory/references/TOOLS.md
+0f98098df695b9a00dc78402911124ebf09a4a058f6c8bec2c6234ec61fac13a  skills/engraphis-memory/SKILL.md

.gitignore

@@ -7,6 +7,11 @@ __pycache__/
 *.db-shm
 *.db-journal
 *.db.*.bak
+*.sqlite
+*.sqlite3
+*.sqlite-wal
+*.sqlite-shm
+*.sqlite-journal
 
 # Webhook fulfillment runtime state — dedup DB + the undelivered-key fallback,
 # which can contain live license keys. Must never be committed.
@@ -28,6 +33,9 @@ build/
 /engraphis-[0-9]*/
 .pytest_cache/
 /.pytest-*-tmp/
+# Focused UI/API test runs use named repository-local base directories.
+/.pytest-tmp-ui-*/
+/.codex-pytest-tmp/
 .ruff_cache/
 .coverage
 node_modules/

CHANGELOG.md

@@ -3,15 +3,98 @@
 All notable changes to Engraphis are documented here. Format loosely follows
 [Keep a Changelog](https://keepachangelog.com/); versions use SemVer.
 
-## [Unreleased]
-
-## [1.6] - 2026-08-08
+## [Unreleased]
+
+## [1.6] - 2026-08-08
 
 Minor release advancing the v2 engine through schema 16 with deterministic sync state, trusted
-local document and Obsidian import, tighter trust boundaries, synchronized agent guidance, and
-stronger release and evaluation evidence.
-
-### Added
+local document and Obsidian import, tighter trust boundaries, synchronized agent guidance, and
+stronger release and evaluation evidence.
+
+### Changed
+
+- The Ledger knowledge graph now defaults to evidence-mass Galaxy gravity. The `galaxy-v6`
+  scene contract retains the magnitude of degree, PageRank, support, and repository evidence;
+  one mass value determines both visibly distinct star radius and gravitational pull. Deterministic
+  mass-ranked cores and orbital bands form local solar systems. The highest-evidence node becomes
+  the central black hole, rendered at least twice the ordinary evidence radius so its event horizon
+  remains visible at minimum Node size. Deterministic logarithmic arms seed a non-uniform disk, and
+  a fixed-step leapfrog clock advances eccentric, differential system orbits through an
+  evidence-derived core-plus-halo potential. Gravity now treats the dominant evidence node as
+  the explicit black-hole source: its field is `240` at the default slider and `864` at maximum,
+  while local solar-system, bridge, and drag gravity receives exactly half (`120` and `432`). The
+  smooth response remains true-zero and monotonic, and the rest of the core community contributes
+  through the softened halo rather than silently inflating the black-hole node's mass. External
+  solar systems also exert a weaker softened mutual field on one another: nearby evidence-heavy
+  systems perturb each other without requiring a relation edge, while the black hole remains the
+  dominant galaxy-wide potential.
+  The controlled centre pull is also doubled, retaining an immediate radial response rather than
+  hiding the stronger field behind a slower projector. Galaxy dynamics no
+  longer depend on D3 alpha decay, render cadence, or
+  force-directed settling. Galactic and local-system motion now uses a `0.021328125` fixed timestep,
+  another 30% slower than the preceding `0.03046875` cadence, while direct pointer movement remains responsive.
+  Every live seed coordinate and local orbit begins another 20% inward, putting
+  system centers at 40% of the original Galaxy radius. While live, the black-hole frame follows a
+  controlled inward spiral: Gravity 0 holds the loose seeded radius, and default/maximum convergence
+  now advances the same inward trajectory at 70% of its immediately preceding speed. Gravity slider input also
+  applies an immediate, reversible system-center response without changing local geometry or velocity:
+  its full range spans 40% radius contraction, and default-to-maximum visibly contracts about 31%
+  synchronously while maximum gravity retains its 3.6x field;
+  outward attempts still receive a 110% radial counter-projection and can never increase their
+  radius. Link distance now drives same-system evidence springs with twice the prior response and
+  a squared scale curve. Its default is now `8`, giving connected nodes a 0.25x rest length, 75%
+  tighter than the preceding default, while the full range still spans 1/16x tight orbits through
+  25x loose orbits without allowing
+  cross-system relations to collapse the galaxy. A bounded mass-weighted positional relation
+  constraint makes Link distance respond immediately while preserving each solar system's centre
+  of mass. Orbital separation now owns an explicit same-system safety envelope instead of relying
+  on an imperceptible softening side effect: both its positional response and cushion scale are
+  doubled, spanning zero added space through 30 world units while preserving evidence-mass centre
+  of mass and removing closing energy. Dense projections retain the requested
+  compact radius and report unavoidable projected overlap instead of silently expanding the disk.
+  Near the core, the direct close-encounter term is 25% lower and its weight moves into the smooth
+  halo, reducing ejection without weakening the total evidence-mass field. Legacy layouts and
+  `/api/graph` remain available.
+
+### Fixed
+
+- Replace the packed-disk Galaxy regression with persistent softened-Newtonian dynamics. Galaxy
+  phase space is isolated from Compact and other legacy layouts, angular momentum is preserved
+  across layout changes, and large stars are visibly distinct. A smooth evidence-mass field keeps
+  each solar system bound while direct star-to-star gravity supplies smaller organic perturbations;
+  evidence bridges remain visible provenance without injecting non-central orbital energy or
+  relation springs compressing the scene into a graph blob. Dragging now leaves the fixed-step
+  Galaxy clock live without alpha changes, global reheats, reseeding, or detaching any global force.
+  The pointer owns exactly one moving mass source while every live body follows its softened
+  inverse-square gravity, whether linked or unlinked; distance and evidence mass determine the
+  response, and explicit relations only strengthen it. A bounded once-per-physics-slice projection
+  makes nearby unlinked bodies visibly follow without teleporting, freezing the rest of the graph,
+  or depending on pointer-event frequency. Pointer events update only the source position and
+  field membership--the gravitational response is sampled by the 30 Hz physics clock. The selected
+  Link orbit supplies a safe periapsis,
+  tangential momentum is retained, and release adds no wake or impulse. Freeze remains the sole
+  explicit motion gate. The explicit **Reheat layout** action now gives Galaxy a finite custom-
+  solver relaxation burst (30 extra steps, or 12 for large live scenes) instead of merely ensuring
+  its already-running clock exists; repeated clicks coalesce, current orbital phase is preserved,
+  and no D3 alpha, random kick, or orbital reseed is introduced.
+- Eliminate false Galaxy "reheating" caused by two local solvers fighting each other every tick.
+  Link distance and Orbital separation now share the same lower-bound target, the redundant live
+  velocity spring no longer injects energy alongside the positional constraint, and close-range
+  separation dissipates closing radial motion. Correction-distance diagnostics expose whether a
+  system is genuinely settling without changing its orbital phase or waking D3.
+- Stabilize dense solar systems and high-degree hubs without weakening their gravity. Link and
+  Orbital-separation constraints now sample one immutable phase and apply one simultaneous,
+  mass-balanced update per node instead of stacking an update for every incident edge. Aggregate
+  position and contact-velocity caps prevent a hub slingshot, while a system-relative speed fuse
+  damps only anomalous member motion and preserves each free system's center-of-mass orbit.
+- Show unlinked entities in new Ledger and Classic graph views by default so isolated evidence is
+  not silently omitted. The toolbar still switches to a linked-only view, and persisted user or
+  saved-view preferences remain authoritative.
+- Keep large Galaxy scenes interactive by replacing quadratic entity-visibility scans with
+  set-wise privacy pruning, driving evidence lookups from the requested relation IDs, and making
+  Ledger retries cancel and supersede stale scene requests safely.
+
+### Added
 
 - A dependency-free, source-neutral local document importer for Markdown, plain text,
   reStructuredText, HTML, JSON/JSONL, CSV/TSV, configuration/XML text, and stdlib-readable
@@ -33,7 +116,7 @@ stronger release and evaluation evidence.
 - Fail closed on new `user`-scope memory writes until records carry an immutable owner identity;
   preserve historical reads and the existing promotion rejection instead of presenting
   workspace-bound rows as private personal memory.
-- Parse bounded dotenv-style configuration without an optional runtime dependency, and load it only from the owner-private
+- Parse bounded dotenv-style configuration without an optional runtime dependency, and load it only from the owner-private
   `~/.engraphis/config.env` or an absolute owner-private file selected by
   `ENGRAPHIS_ENV_FILE`; arbitrary working-directory `.env` files are not a trust boundary.
 - Clarify Cloud Sync credential-origin binding, secret-manager-only unattended credentials,
@@ -225,7 +308,7 @@ tombstones remain global.
 
 ### Upgrade notes
 
-- `engraphis-mcp` now exposes nine Smart tools instead of 33 direct tools. Clients that depend on
+- `engraphis-mcp` now exposes nine Smart tools instead of 34 direct tools. Clients that depend on
   the former names should switch their server command to `engraphis-mcp-classic`; HTTP clients can
   use `engraphis-mcp-http --classic`.
 - Existing v2 databases migrate automatically to schema 9 on first open; the change is additive
@@ -237,7 +320,7 @@ tombstones remain global.
 
 - Smart MCP is now the zero-configuration `engraphis-mcp` default. It exposes nine compact tools:
   sessions, prompt-ready recall, durable memory, discovery, validated read/action execution, and
-  governed record read/update plus conflict review. `engraphis-mcp-classic` preserves the former 33
+  governed record read/update plus conflict review. `engraphis-mcp-classic` preserves the former 34
   direct tool names and legacy alias response shapes for pinned integrations.
 - The first-party `@engraphis/pi` package under `integrations/pi` exposes that Smart MCP surface
   as native Pi tools, verifies the Engraphis 1.4.x handshake, and ships with independent npm

README.md

@@ -37,11 +37,12 @@ context Engraphis actually emitted, keeps token counters and release versions se
 labels adaptive history reductions separately from packing savings. Receipts without estimator
 metadata remain historical/unclassified. This measures estimated prompt-context reduction; it
 does not measure provider billing. The `/context-savings` API and
-`engraphis_context_savings` MCP tool accept optional `from_ts`, `to_ts`, and `release_version`
-filters.
+`engraphis_context_savings` MCP tool aggregate the complete history across all visible workspaces
+by default, or accept an explicit workspace plus optional `from_ts`, `to_ts`, and
+`release_version` filters.
 
 <p align="center">
-  <img src="https://raw.githubusercontent.com/Coding-Dev-Tools/engraphis/main/docs/images/context-efficiency.svg" alt="Dark chart showing three deterministic offline comparisons. Structure-aware chunks reduce mean retrieved content from 740.3 to 214.3 tokens and the smallest evidence-holding memory from 162.2 to 42.4 tokens while Recall at 5 remains 1.000. A compact recall JSON-shape proxy uses 10,202 rather than 23,810 tokens. Evidence artifact SHA-256: c3a74f1770ad3f868f55261ba11680e2dadca30167082ac2cb6669f9e3bdfad2." width="100%">
+  <img src="https://raw.githubusercontent.com/Coding-Dev-Tools/engraphis/main/docs/images/context-efficiency.svg" alt="Dark chart of local measurements and deterministic fixtures, including a local LoCoMo diagnostic marked with an asterisk. Cross-session handoff satisfaction rises from 3 of 15 queries with the last memories to 15 of 15 with proactive ranking or a consolidated summary. Intent-layered graph routing rises from 0 of 3 to 3 of 3 correct top-1 targets, and two-hop graph recall rises from 0 of 3 with one-hop expansion to 3 of 3 with Personalized PageRank. Consolidation-aware ranking selects the expected digest in 2 of 2 summary cases instead of 0 of 2 for the baseline. Structure-aware chunks reduce context from 740.3 to 214.3 tokens and the smallest evidence-holding memory from 162.2 to 42.4 tokens. A compact JSON-shape proxy uses 10,202 rather than 23,810 tokens. Grounded recall makes 10 of 10 correct decisions and packed context averages 85.38 tokens under a 1,500-token cap." width="100%">
   <br>
   <sup>Less repeated history means more room for the task, tools, and useful evidence.</sup>
 </p>
@@ -154,7 +155,7 @@ selection, set `ENGRAPHIS_UPDATE_EXTRAS` to a comma-separated list (for example
 `server,mcp`), or set it to `none` for the base package only.
 
 > **Upgrading to 1.4:** `engraphis-mcp` now exposes the nine-tool Smart gateway. Integrations that
-> require the former 33 direct tool names should run `engraphis-mcp-classic`. The SQLite schema
+> require the former 34 direct tool names should run `engraphis-mcp-classic`. The SQLite schema
 > in the 1.4.0 release was version 9. Existing v7-to-v8 databases already contain `confidence`
 > and `pinned_at`/`unpinned_at`; v9 adds the `memory_tombstones` repository-scope column/table
 > and performs a one-time entity-canonicalization repair, then migrates automatically on first
@@ -693,7 +694,7 @@ file. It never searches the working directory for `.env`, and explicit process v
 | Env Var | Default | Description |
 |---------|---------|-------------|
 | `ENGRAPHIS_ENV_FILE` | `~/.engraphis/config.env` | Optional trusted config leaf selected before trusted values load. Its bounded dependency-free parser performs no interpolation. An explicit value must be an absolute path to an owner-private regular file; arbitrary working-directory `.env` files are ignored. |
-| `ENGRAPHIS_DB_PATH` | Source: `<repo>/engraphis.db`; installed: platform user-data directory | SQLite database file. Installed defaults are `%LOCALAPPDATA%\engraphis\engraphis.db` (Windows), `~/Library/Application Support/engraphis/engraphis.db` (macOS), and `$XDG_DATA_HOME/engraphis/engraphis.db` or `~/.local/share/engraphis/engraphis.db` (Linux). The environment variable overrides every default. |
+| `ENGRAPHIS_DB_PATH` | Source: `<repo>/engraphis.db`; installed: platform user-data directory | SQLite database file. Installed defaults are `%LOCALAPPDATA%\engraphis\engraphis.db` (Windows), `~/Library/Application Support/engraphis/engraphis.db` (macOS), and `$XDG_DATA_HOME/engraphis/engraphis.db` or `~/.local/share/engraphis/engraphis.db` (Linux). The environment variable overrides every default; a relative value is resolved from the trusted `~/.engraphis/config.env` directory so launch CWD cannot select a different workspace database. |
 | `ENGRAPHIS_HOST` | `127.0.0.1` | Server bind address |
 | `ENGRAPHIS_PORT` | `8700` | Dashboard port |
 | `ENGRAPHIS_SERVICE_MODE` | `customer` | The public package supports only `customer`; hosted vendor, relay, compute, and worker roles are not distributed here |

docs/MCP_TOOLS.md

@@ -98,7 +98,7 @@ the [memory write trust model](WRITE_REVIEW.md) and [recall recovery guide](RECA
 | Code | `engraphis_export_code_graph` | Exports graph JSON, Markdown, and HTML. |
 | Code | `engraphis_link_symbol` | Manually links a code symbol to a memory (idempotent). |
 | Audit | `engraphis_receipts` | Lists content-free hashed operation receipts. |
-| Audit | `engraphis_context_savings` | Reports receipt-backed estimated context tokens saved, eligible/excluded deliveries, basis, confidence, and token-counter identity; optional `from_ts`, `to_ts`, and `release_version` filters are supported. This is estimated prompt-context reduction, not provider billing. |
+| Audit | `engraphis_context_savings` | Reports receipt-backed estimated context tokens saved across all visible workspaces by default, or one workspace when supplied; optional `from_ts`, `to_ts`, and `release_version` filters are supported. This is estimated prompt-context reduction, not provider billing. |
 | Audit | `engraphis_verify_receipts` | Verifies the receipt chain, local tail anchor, and an optional saved head/count. |
 | Audit | `engraphis_export_receipts` | Exports a shareable receipt-only audit bundle. |
 | Governance | `engraphis_retire` | Retires a memory by closing its validity window. It does not delete history. |
@@ -111,12 +111,14 @@ the [memory write trust model](WRITE_REVIEW.md) and [recall recovery guide](RECA
 | Operations | `engraphis_stats` | Returns memory counts for health checks. |
 | Operations | `engraphis_check_update` | Refreshes the release cache and reports whether a newer version is available. |
 
-All four recall tools (`engraphis_recall`, `engraphis_recall_context`,
+The classic recall, grounded, and answer tools (`engraphis_recall`,
 `engraphis_recall_grounded`, and the `engraphis_answer` alias) accept `planning="off"|"auto"`,
 optional `mtype_limits` such as `{"working": 1, "semantic": 3}`, and optional
-`max_response_tokens` from `1` through `1000000`. `response_mode="full"` returns the classic
+`max_response_tokens` from `2` through `1000000`. `response_mode="full"` returns the classic
 response; `"compact"` removes packed context and citation/memory bodies from the end while
-preserving source/citation references. Responses include a stable `context_revision`. Planner
+preserving source/citation references. `engraphis_recall_context` is always compact and does
+not accept `response_mode`; it shares the same `max_response_tokens` floor. Responses include
+a stable `context_revision`. Planner
 details, per-query rankings, type-limit drops, and fallback reasons are returned only when
 `diagnostics=true`. Type limits are post-rank maxima and can intentionally return fewer than `k`;
 they do not raise a memory type's relevance. Every planned query remains inside the caller's scope,