docs(graphs): add generated documentation atlas

docs/graphs/tool-execution-pipeline.md

@@ -0,0 +1,30 @@
+<!-- Generated by scripts/gen-doc-graphs.ts - do not edit by hand.
+     Run `pnpm run gen-doc-graphs` to regenerate. -->
+
+# Tool Execution Pipeline
+
+Maintenance mode: curated Mermaid flow; exact tool schemas and event signatures live in generated catalogs.
+
+This graph shows where policy, hooks, sandboxing, and future filesystem guards fit without changing the loop. The key extension point is the `tools/execute` waterfall.
+
+```mermaid
+flowchart TD
+  model["Assistant message contains tool-call block"]
+  call["Session event: tool/call"]
+  waterfall["ctx.tools.execute()<br/>tools/execute waterfall"]
+  policy["Policy / permission / hooks listener"]
+  body["Registered tool execute() body"]
+  owned["Tool-owned session events<br/>todo/write, future fs policy facts"]
+  result["Session event: tool/result"]
+  ui["UI presentation<br/>presentCall / presentResult"]
+  model --> call --> waterfall
+  waterfall --> policy
+  policy -->|next()| body
+  policy -->|veto / throw| result
+  body --> owned
+  body --> result
+  call --> ui
+  result --> ui
+```
+
+Future pressure from the fs stack: PR #128 snapshots a policy rejection card. The graph keeps the veto path explicit because filesystem read-before-edit checks, permission prompts, and hook bridges all belong on this path.