eliziff gives Beaver one address book for its legal workflows

- streamingCitationRecovery: mocked-adapter integration test that a
  truncated CITATIONS block still yields recovered citations in the
  final SSE event and never leaks into visible text.
- prompt-live-harness: six new adversarial scenarios (no page markers,
  multi-doc attribution, mixed pdf+spreadsheet, fabrication trap,
  page-break quoting, prompt injection). 57/60 across three OpenAI
  tiers; injection and multi-doc 6/6 each. Old-arm scaffolding removed
  now the pre/post-trim comparison is archived in benchmarks.
- prompt-cache-check: provider counters prove the conditional
  spreadsheet splice reuses the identical 2,304 cached prefix tokens.
- liveToolLoop: real-model E2E through the account-free /chat route;
  the model reads an uploaded lease via library tools and routes a
  drafting-errors request to library_lint_docx_structure, relaying its
  verified findings. Gated behind LIVE_E2E=1.
- citations: extract shared extractJsonObjects so the truncation
  scanner exists once, used by both the server and the harness.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QUsMXzBsEJ27DjJVPSfW5o

Playwright/Chromium suite that opens real pinpoint URLs against live
court sites and asserts what server probes cannot see: anchor exists
and the viewport landed on it, the page still scrolls afterwards (the
site_preference=mobile regression detector), and expected text renders.
Fresh context per case so Decisia's SITE_PREFERENCE cookie cannot leak
between cases. Includes a negative control (the bare Decisia shell URL
must fail) and a no-anchor bench judgment documenting graceful
degradation. 6/6 on SCC/ONCA/NSCA samples, screenshots archived under
benchmarks/deeplink_gate/. Accepts the SourceDoc gate-urls.json shape.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QUsMXzBsEJ27DjJVPSfW5o

knip sweep (script entry points and stage-3 surfaces excluded): 12
internal-only types lose their export, the mcpConnectors barrel drops
five type re-exports and validateRemoteMcpUrl nobody imported, and
llm/index's streamCodex wrapper goes private. contextBuilders no
longer materializes the whole doc index into fresh objects on every
chat turn for a dev-only log line. providerPdfLibraryBridge's backoff
test stops racing its detached background write under full-suite load
(waitFor 1s default -> bounded 10s).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QUsMXzBsEJ27DjJVPSfW5o

Five adapters each carried identical abortError/throwIfAborted
copies; codex additionally exported its own name for the app-server
adapter. All six files now share llm/abort.ts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QUsMXzBsEJ27DjJVPSfW5o

nextInlineMatch listed <strong|b>, <em|i> and <code> twice. The earlier
entries match everywhere the later ones do and win the priority tie, so the
duplicates were dead weight executed against every offset of every legal
document rendered.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QUsMXzBsEJ27DjJVPSfW5o

resolveSofficeBinaryPaths probed only extensionless soffice plus Unix
install paths, so DOCX->PDF reported LibreOffice missing on every
Windows machine even with soffice.exe installed and on PATH. Probe
.exe names and the Program Files install dirs on win32. Verified with
a real conversion: hello.docx -> 19,351-byte %PDF in 2.2s.

Also: unexport four knip-flagged dead surfaces (the projects.ts
handleDocumentUpload twin of the documents.ts one is now internal;
dedup of the two bodies queued), drop the supabase.ts legacy re-export
of isServerSupabaseConfigured, and delete three spent probe scripts
whose results are recorded in commit messages.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QUsMXzBsEJ27DjJVPSfW5o

routes/documents.ts carried the same select-doc/ensureDocAccess/404
block ten times, the extension allowlist three times, the best-effort
Office->PDF rendition four times, and the version-insert/point-current
pair twice; each is now one helper with identical status codes, check
ordering, and response bodies. documentOps' generateDocx duplicated
persistGeneratedFile end to end - it now delegates (generated DOCX
still gets no PDF rendition), and read_document's dev-log narration
went with it. -420 lines across the pair.

Verified: tsc clean, 8 affected suites (53 tests) green, filenames and
result shapes byte-compatible (renderer already used
safeGeneratedFilename, persistGeneratedFile returns the legacy shape).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QUsMXzBsEJ27DjJVPSfW5o

routes/projects.ts carried a 140-line near-verbatim twin of the
documents.ts upload handler. The documents.ts version is a superset:
library_kind defaults to 'file' in both (explicit vs column default)
and the only response delta is an additive folder_id: null. Projects
now imports the shared handler; four upload-only imports pruned.

Verified: tsc clean; projects.routes suite green. The
localMatter.routes failure in the same run predates this change - it
expects the old attached-document message format while another
session's uncommitted contextBuilders.ts WIP emits the new one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QUsMXzBsEJ27DjJVPSfW5o

list_workflows/read_workflow join the local assistant toolset, tools
return canonical app_url values via appRoutes, and the workflows route
gains local coverage. localAssistantTools also lands its compaction:
a tool() schema builder over all hand-written schemas, shared arg
coercion helpers, one DOCX_WORKFLOWS dispatch table for the three
structurally identical library workflows, and fail()/errorText()
replacing ~30 identical error wraps (tool names, schemas, and result
JSON key order unchanged).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QUsMXzBsEJ27DjJVPSfW5o

Consolidates downloadTokens, llmModels, safeError, and storage suites to the
assertions that catch real regressions; sourceDocFixtures matrix now derives
its inventory from the fixture directory and covers the seven limitation and
honest-performance fixtures.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016yXxuitxX5h4wm1v88hnga

version_id leaves the revise contract (server resolves the active
version; providing one still asserts). Native notes leave the drafting
extraction as [^id] markers with definitions, so precedent adaptation
carries tokens instead of converting notation; multi-paragraph bodies
flatten deterministically with a typed warning. The tool-round budget
sentence duplicated harness enforcement and is gone. Corpus paths follow
the benchmarks/ vendoring.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012AgUm5EcRKbT3duVFMbrQD

Inherited working-tree state now owned by this line of work: store and
route changes, tool dispatcher and streaming updates, test adjustments,
and the attachment announced-not-preloaded contract (the session note
accompanying it is honored and removed). Also carries this session's
prompt-variant conditionals and shape-aware prompt text in routes/chat.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012AgUm5EcRKbT3duVFMbrQD

Account, library, projects, tabular, and workflow surfaces plus shared
components and hooks, inherited as working state and owned from here.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012AgUm5EcRKbT3duVFMbrQD