@mindrian_os/cli 2.0.0-beta.29 → 2.0.0-beta.31

package/data/corpus-stats-source.json

@@ -0,0 +1,11 @@
+{
+  "corpus_stats_note": "Hand-edited source of truth for the three asserted corpus magnitudes (Canon D1). Edited ONLY when a new live Brain read is recorded; the generator (scripts/build-corpus-stats.cjs) renders docs/CORPUS-STATS.generated.md + data/corpus-stats.generated.json from this file. NO live Brain query runs on the hot path (Canon Part 8 / threat T-186-01): the generator reads only this committed file, never the remote Brain. To refresh, record a fresh live read of the production substrates, update read_date + magnitudes here, and re-run the generator.",
+  "read_date": "2026-06-27",
+  "magnitudes": {
+    "neo4j_nodes": 27904,
+    "frameworks": 177,
+    "pinecone_vectors": 12485
+  },
+  "pinecone_dim": 1024,
+  "directional_only_note": "Sub-counts (teaching-graph core, MethodologyChunk substrate, per-namespace vector splits, relationship counts such as 19,987) are DIRECTIONAL ONLY (Canon D2): zero source-of-truth, admin-gated, NEVER asserted as fact, and NEVER enforced by the tripwire. They are deliberately omitted from the rendered artifact."
+}

package/data/corpus-stats.generated.json

@@ -0,0 +1,10 @@
+{
+  "generated_note": "GENERATED by scripts/build-corpus-stats.cjs - do not hand-edit",
+  "read_date": "2026-06-27",
+  "magnitudes": {
+    "neo4j_nodes": 27904,
+    "frameworks": 177,
+    "pinecone_vectors": 12485
+  },
+  "pinecone_dim": 1024
+}

package/data/cross-domain-analogues.json

@@ -0,0 +1,15 @@
+{
+  "hand_authored_note": "Hand-curated, version-controlled, --check'd seed of CROSS_DOMAIN_ANALOGUE pairs the orchestration-projection generator reads (the curated_chains / curated_extras idiom of data/command-registry.json). Holds GENERIC framework-NAME pairs ONLY (pws-tier handles) -- never command slugs, never user content, never HSI/embedding-derived over room content (Phase 157 D-02; Canon Part 8). This file is the source for the CROSS_DOMAIN_ANALOGUE edges in the projection. The from/to strings MUST match a framework name in data/command-registry.json or data/connector-registry.json framework_index where one exists, so Wave 3's edges resolve to real framework nodes; the node-derivation union mints a pws-tier framework node for any analogue endpoint, so an endpoint that has no command still gets a legal framework node (the analogue edge never dangles). Seeded with the 150.10 prototype pairs (M4 leverage <-> Reverse Salient Analysis; M3 archetype / find-analogies <-> Four Lenses of Innovation).",
+  "analogues": [
+    {
+      "from": "Systems Thinking",
+      "to": "Reverse Salient Analysis",
+      "rationale": "The Meadows leverage-point move (Systems Thinking M4) is cross-domain analogous to the reverse-salient move: both locate the lagging component in an expanding system where a small, well-placed intervention shifts the whole."
+    },
+    {
+      "from": "Systems Thinking",
+      "to": "Four Lenses of Innovation",
+      "rationale": "The systems-archetype move (Systems Thinking M3) is cross-domain analogous to the Four Lenses find-analogies move: both recognize a recurring structural pattern in one domain and transpose it as a generative analogy into another."
+    }
+  ]
+}

package/data/deck-aliases.json

@@ -0,0 +1,6 @@
+{
+  "_note": "Phase 175 (deck-command-consolidation). The deck alias map (D-04b deprecate-not-delete, back-compat). Both prior conversational-skill handles -- the in-repo MOSDeckEngine skill and the out-of-repo feynman-engine skill (~/.claude/skills/feynman-engine) -- now resolve to the consolidated /mos:deck command (commands/deck.md, Plan 175-01) where the Feynman style runs the 6-stage comprehension pipeline. The SKILL.md files are RETAINED (not deleted): skills/mos-deck-engine/SKILL.md is rewritten as a deprecation redirect with its connector: block preserved (the surface stays WIRED so the CIRS born-wired gate sees no regressed surface); feynman-engine lives OUTSIDE the repo, so its alias is realized repo-locally here (this map + doctrine), the non-repo file is never edited. New work should invoke /mos:deck and pick the Feynman style. The alias handles sit at the TOP LEVEL of this object (flat map) so a consumer reads aliases['MOSDeckEngine'] directly; the _note and version keys are reserved metadata and are not alias handles. House rule: hyphens only, NO em-dashes.",
+  "version": 1,
+  "MOSDeckEngine": "/mos:deck",
+  "feynman-engine": "/mos:deck"
+}

package/data/deck-styles.json

@@ -0,0 +1,85 @@
+{
+  "_note": "Phase 175 (deck-command-consolidation). The single source of truth for the /mos:deck command styles + section schemas. The command doctrine (commands/deck.md) and the Plan 175-03 tests both read this map, so the three-route claim and the HEART-5-section claim are DATA-asserted, not prose-asserted. Mirrors the flat data-map idiom of data/publish-needs.json + data/dispatch-framework-map.json. styles[] = the 3 deck styles { id, label, spine, routes_to, composes }; heart_sections[] = the ordered 5 H/E/A/R/T sections { id, letter, name, fill_source } (Canon Part 8: every fill_source is 'local-room-content' -- only LOCAL room content fills the structure; the HEART methodology text is fetched generic from Brain at runtime, never the reverse); feynman_stages[] = the ordered 6 MOSDeckEngine Feynman stages { id, name }, verbatim from skills/mos-deck-engine/SKILL.md. House rule: hyphens only, NO em-dashes anywhere.",
+  "version": 1,
+  "styles": [
+    {
+      "id": "feynman",
+      "label": "Feynman",
+      "spine": "comprehension",
+      "routes_to": "feynman-pipeline",
+      "composes": []
+    },
+    {
+      "id": "heart",
+      "label": "HEART",
+      "spine": "persuasion",
+      "routes_to": "heart-structure",
+      "composes": []
+    },
+    {
+      "id": "mesh",
+      "label": "mesh",
+      "spine": "composite",
+      "routes_to": "mesh-compose",
+      "composes": ["feynman", "heart"]
+    }
+  ],
+  "heart_sections": [
+    {
+      "id": "hypothesis",
+      "letter": "H",
+      "name": "Hypothesis",
+      "fill_source": "local-room-content"
+    },
+    {
+      "id": "enormous-stakes",
+      "letter": "E",
+      "name": "Enormous stakes",
+      "fill_source": "local-room-content"
+    },
+    {
+      "id": "alternatives-inadequate",
+      "letter": "A",
+      "name": "Alternatives inadequate",
+      "fill_source": "local-room-content"
+    },
+    {
+      "id": "radically-different",
+      "letter": "R",
+      "name": "Radically different",
+      "fill_source": "local-room-content"
+    },
+    {
+      "id": "team",
+      "letter": "T",
+      "name": "Team",
+      "fill_source": "local-room-content"
+    }
+  ],
+  "feynman_stages": [
+    {
+      "id": "reduce-to-essence",
+      "name": "Reduce to essence"
+    },
+    {
+      "id": "translate",
+      "name": "Translate to plain language"
+    },
+    {
+      "id": "expose-confusion",
+      "name": "Expose confusion"
+    },
+    {
+      "id": "build-mental-models",
+      "name": "Build mental models"
+    },
+    {
+      "id": "simplify-until-breaks",
+      "name": "Simplify until it breaks"
+    },
+    {
+      "id": "teach-it-back",
+      "name": "Teach it back"
+    }
+  ]
+}

package/data/deployment-surfaces.json

@@ -0,0 +1,69 @@
+{
+  "$schema_note": "Hand-maintained. NOT generated. New deployment surface = one entry, no code change. scripts/session-start reconciles owned (owner='session-start') surfaces whose reconcile=='on-version-change' on version change; scripts/doctor.cjs class J (Plan 123-03) walks every entry to flag drift. Path tokens: $HOME is expanded via os.homedir() at read time; <active_root> is the resolveActivePluginRoot() root (from lib/core/active-plugin-root.cjs); <dev_clone_root> is the same root constrained to topology=='dev-clone'. topology_scope=='dev-clone' entries are skipped entirely on a user (non-dev-clone) box. Phase 123 plan 02 (HARNESS-123-06).",
+  "schema_version": 1,
+  "phase": "123-install-lifecycle-harness",
+  "canon_parts": [5, 6],
+  "surfaces": [
+    {
+      "id": "statusline-dispatch-shim",
+      "path": "$HOME/.claude/statusline-mos",
+      "owner": "session-start",
+      "topology_scope": "all",
+      "check_kind": "marker",
+      "expected": "MINDRIAN-STATUSLINE-DISPATCH",
+      "reconcile": "on-version-change",
+      "remediation": "scripts/session-start Step A re-stamps the dispatcher shim on version change; if it stays stale, an antivirus or sync agent may be quarantining the file -- restart Claude Code or run `mindrian-os doctor --fix`."
+    },
+    {
+      "id": "settings-statusline-command",
+      "path": "$HOME/.claude/settings.json",
+      "path_within_file": "statusLine.command",
+      "owner": "session-start",
+      "topology_scope": "all",
+      "check_kind": "exact-value",
+      "expected": "bash \"$HOME/.claude/statusline-mos\"",
+      "reconcile": "on-version-change",
+      "remediation": "scripts/session-start Step B rewrites statusLine.command when it points at the legacy context-monitor wrapper; if a managed-settings layer overrides it, that is expected and the override wins. Plan 123-03 schema extension: `path_within_file` (dot-path) tells the check_kind=='exact-value' reader to JSON-parse `path` and compare `path_within_file` against `expected` rather than substring-matching the whole file."
+    },
+    {
+      "id": "mindrian-last-version",
+      "path": "$HOME/.mindrian-last-version",
+      "owner": "session-start",
+      "topology_scope": "all",
+      "check_kind": "exact-value",
+      "expected": "<active_version>",
+      "reconcile": "on-version-change",
+      "remediation": "scripts/session-start rewrites it to match active_version on every session (single writer, EARLY -- per Phase 123 D-03 + RESEARCH Override 4). Pitfall 7: the old line-419 write only fired on cold start; the new EARLY write fires unconditionally."
+    },
+    {
+      "id": "install-state-record",
+      "path": "$HOME/.mindrian/install-state.json",
+      "owner": "session-start",
+      "topology_scope": "all",
+      "check_kind": "observed-only",
+      "expected": null,
+      "reconcile": "never",
+      "remediation": "Self -- this surface IS the record. The manifest walker excludes it from its own consistency check. If absent at doctor time: 'run `mindrian-os doctor --fix`' (Plan-03 class I auto-recovers by invoking session-start's record-write path)."
+    },
+    {
+      "id": "plugin-bin-path-entry",
+      "path": "<active_root>/bin",
+      "owner": "claude-code",
+      "topology_scope": "all",
+      "check_kind": "observed-only",
+      "expected": null,
+      "reconcile": "never",
+      "remediation": "Claude Code's plugin loader owns the $PATH entry for `<active_root>/bin`; the manifest records it for the version-of-record cross-check but NEVER writes it. A wrong/vanished entry -> restart Claude Code (its plugin loader re-injects the entry on next launch)."
+    },
+    {
+      "id": "dev-clone-pre-commit-hook",
+      "path": "<dev_clone_root>/.git/hooks/pre-commit",
+      "owner": "session-start",
+      "topology_scope": "dev-clone",
+      "check_kind": "marker",
+      "expected": "check-schema-aliases.cjs",
+      "reconcile": "on-version-change",
+      "remediation": "scripts/session-start idempotently installs/updates the dev-clone pre-commit hook via scripts/install-pre-commit.sh (Phase 108 schema alias drift guard). Skipped entirely on a user (non-dev-clone) box. The marker sentinel is the 'check-schema-aliases.cjs' invocation embedded by install-pre-commit.sh."
+    }
+  ]
+}

package/data/dispatch-framework-map.json

@@ -0,0 +1,18 @@
+{
+  "_note": "OPEN-1 WFL-01 translation layer: each raw sensor dispatch handle / sub_mode maps to its EXACT framework name (data/framework-names.json), never a slug. The intelligence-orchestrator translates the sensor dispatch field through this map BEFORE calling commandsForFramework(). Drift-tested against data/framework-names.json (tests/test-dispatch-framework-map-drift.cjs) so a smuggled slug or a fake framework fails CI.",
+  "mos:research": "Hypothesis-Driven Problem Solving",
+  "mos:research (hat-scoped WebSearch)": "Hypothesis-Driven Problem Solving",
+  "find-bottlenecks": "Reverse Salient Analysis",
+  "reverse-salient": "Reverse Salient Analysis",
+  "find-connections": "Usher's Model of Cumulative Synthesis",
+  "cross-domain-connect": "Usher's Model of Cumulative Synthesis",
+  "find-analogies": "Four Lenses of Innovation",
+  "cross-domain-analogy": "Four Lenses of Innovation",
+  "hsi": "HSI Semantic Surprise Analysis Assistant",
+  "whitespace": "HSI Semantic Surprise Analysis Assistant",
+  "score-innovation": "HSI Semantic Surprise Analysis Assistant",
+  "think-hats": "Six Thinking Hats",
+  "six-hats": "Six Thinking Hats",
+  "team_perspective": "Six Thinking Hats",
+  "adoption-capacity": "Adoption-Capacity Theory"
+}

package/data/doctor-modules.json

@@ -0,0 +1,206 @@
+{
+  "$schema_note": "Hand-maintained module registry for the doctor accumulative engine. NOT generated. New organ module = ONE entry here, no engine code change (mirrors data/deployment-surfaces.json's 'new surface = one entry' discipline). The selector in scripts/doctor.cjs (runAccumulativeEngine) walks this array. CADENCE splits how a module runs (Phase 217 Plan-01): cadence 'always' = a per-invocation DIAGNOSTIC whose check() runs on EVERY doctor invocation, watermark-immune (only an upper introduced_version <= running deferred-guard applies, never a lower watermark bound) -- this is what stops a migrated check from going permanently silent after one run; cadence 'once' = a watermark-gated HEAL (umbilical's semantics) that runs when introduced_version is in the (applied_through, running] window and never re-runs once the persisted watermark at ~/.mindrian/doctor-applied.json advances past it. FLAG names the parseArgs flags key that activates the module: null = the module runs on a bare / --all / --fix run when no class flag is active (the class-A/N gate), and a named flag (e.g. 'roomMd') runs the module only when that flag is set. FIX-THEN-RECHECK: under --fix a module with fix_supported true whose check surfaced a warn/error is passed to the runner fix(), then check() re-runs so the reported result reflects the post-fix state; a fixer's recoveries land in the engine recovered[] array. fix_supported MUST be an explicit boolean (D-03) -- never omitted. Both cadence and flag are gated by introduced_version <= running so an install is NEVER faulted for an organ it predates, and a future-version module (introduced_version > running) is DEFERRED (never run) until the user is on that version. Per-entry contract: { id (stable kebab-case identifier), introduced_version (semver string -- the plugin version that shipped this organ; prerelease labels like 1.13.1-beta.4 compare correctly), cadence ('always' | 'once'), flag (parseArgs flags key | null), fix_supported (explicit boolean -- whether the runner offers a --fix remediation, else check-only), runner (a lib/core/doctor/<id>.cjs-style relative path resolved against the plugin root at run time; its module exports a check(ctx) and optionally a fix(ctx) entry), description (one line) }. SEEDED EMPTY: Plan 03 registers module #1 (umbilical). Do NOT invent organ modules here beyond umbilical -- the 15 remaining SCOUT-2 organs backfill in v1.13.1+ (out_of_scope LOCKED decision).",
+  "schema_version": 1,
+  "phase": "139-doctor-accumulative-engine-skeleton-and-context-fix",
+  "canon_parts": [6, 7, 8],
+  "modules": [
+    {
+      "id": "capability-ledger",
+      "introduced_version": "2.0.0-beta.12",
+      "cadence": "always",
+      "flag": null,
+      "fix_supported": false,
+      "runner": "lib/core/doctor/capability-ledger-module.cjs",
+      "description": "Capability ledger staleness (Phase 265): warns when data/capability-ledger.json's ledger_covers.to trails the installed claude --version beyond MINDRIAN_LEDGER_MAX_VERSION_LAG. Check-only, cadence always."
+    },
+    {
+      "id": "mcp-surface",
+      "introduced_version": "2.0.0-beta.12",
+      "cadence": "always",
+      "flag": null,
+      "fix_supported": false,
+      "runner": "lib/core/doctor/mcp-surface-module.cjs",
+      "description": "MCP tool-count and zero-tool check (Phase 265 R-7): spawns both mindrian-os and mindrian-brain over stdio and reports live per-server tool counts, failing on a zero-tool tools/list response or a wedged server. Warns (never caps) when the combined surface exceeds TOTAL_SURFACE_TOKEN_BUDGET. Check-only, cadence always."
+    },
+    {
+      "id": "umbilical",
+      "introduced_version": "1.13.1-beta.4",
+      "cadence": "once",
+      "flag": null,
+      "fix_supported": true,
+      "runner": "lib/core/doctor/umbilical-module.cjs",
+      "description": "Project .umbilical cords into room.db as AFFILIATED_WITH edges; integrity-check cord<->marker bidirectionality (orphan / removed-marker / unprojected). --fix SUGGESTS orphan cords, never auto-creates."
+    },
+    {
+      "id": "card-fire-health",
+      "introduced_version": "1.15.3-beta.12",
+      "cadence": "always",
+      "flag": "cardFireHealth",
+      "fix_supported": false,
+      "runner": "lib/core/doctor/card-fire-health-module.cjs",
+      "description": "check-card-fire.cjs instrument health: intercept log exists/valid JSONL/fresh, library seams intact, session store parseable"
+    },
+    {
+      "id": "voice-style-log",
+      "introduced_version": "2.0.0-beta.28",
+      "cadence": "always",
+      "flag": null,
+      "fix_supported": false,
+      "runner": "lib/core/doctor/voice-style-log-module.cjs",
+      "description": "Voice-style evidence count since the last release plus the evaluatePromotion verdict per voice policy found in the log (D-04). Never returns warn or error; informational only."
+    },
+    {
+      "id": "mode-select-checkpoint",
+      "introduced_version": "1.15.3-beta.19",
+      "cadence": "always",
+      "flag": null,
+      "fix_supported": false,
+      "runner": "lib/core/doctor/mode-select-checkpoint-module.cjs",
+      "description": "Session-start mode-selection Decision Gate firing checkpoint: warns when a session has had a user turn but no lane-pick was recorded, a possible silent skip. Check-only, advisory."
+    },
+    {
+      "id": "ui-compliance",
+      "introduced_version": "1.12.1-beta.1",
+      "cadence": "always",
+      "flag": "uiCompliance",
+      "fix_supported": false,
+      "runner": "lib/core/doctor/ui-compliance-module.cjs",
+      "description": "UI Ruling System compliance scan (class F): commands body_shape frontmatter, forbidden box chars / glyphs, renderer Zone 1 + Zone 4 patterns. Check-only (D-13)."
+    },
+    {
+      "id": "stale-first-touch-copy",
+      "introduced_version": "1.13.1-beta.4",
+      "cadence": "always",
+      "flag": "staleFirstTouch",
+      "fix_supported": false,
+      "runner": "lib/core/doctor/stale-first-touch-copy-module.cjs",
+      "description": "First-touch greeting surfaces (class K): stale hardcoded version literals + em-dash violations, via lib/core/stale-copy-scanner.cjs. Check-only."
+    },
+    {
+      "id": "deprecated-usage",
+      "introduced_version": "1.13.0-beta.19",
+      "cadence": "always",
+      "flag": "deprecatedUsage",
+      "fix_supported": false,
+      "runner": "lib/core/doctor/deprecated-usage-module.cjs",
+      "description": "Deprecated /mos:<cmd> usage in recent session transcripts (class L): per-command migration hints. Standard status vocabulary; check-only."
+    },
+    {
+      "id": "plugin-enabled-state",
+      "introduced_version": "1.13.1-beta.4",
+      "cadence": "always",
+      "flag": null,
+      "fix_supported": false,
+      "runner": "lib/core/doctor/plugin-enabled-state-module.cjs",
+      "description": "Silent-disable watchdog (class N / DRIFT-12): plugin installed but enabledPlugins key false. Default-gated (bare / --all / --fix). Check-only."
+    },
+    {
+      "id": "cascade-rooms",
+      "introduced_version": "1.12.1-beta.1",
+      "cadence": "always",
+      "flag": "cascadeRooms",
+      "fix_supported": true,
+      "runner": "lib/core/doctor/cascade-rooms-module.cjs",
+      "description": "Room .room-root sentinel presence (class B): every registered room carries its sentinel. --fix CREATES missing sentinels for rooms whose dir exists (dry-run honored; dir-missing rooms suggested, never auto-created)."
+    },
+    {
+      "id": "cascade-rooms-active",
+      "introduced_version": "1.12.1-beta.1",
+      "cadence": "always",
+      "flag": "cascadeRooms",
+      "fix_supported": false,
+      "runner": "lib/core/doctor/cascade-rooms-active-module.cjs",
+      "description": "Active-room guard silence detector (class C): a write to a non-active room would be silenced before the cascade side-channel runs. Shares the --cascade-rooms flag with class B. Check-only."
+    },
+    {
+      "id": "room-md",
+      "introduced_version": "1.12.1-beta.1",
+      "cadence": "always",
+      "flag": "roomMd",
+      "fix_supported": true,
+      "runner": "lib/core/doctor/room-md-module.cjs",
+      "description": "ROOM.md + MINTO.md presence under the active room's .room-root (class E). --fix invokes generate-section-intelligence.cjs --recursive then re-checks."
+    },
+    {
+      "id": "statusline-visibility",
+      "introduced_version": "1.12.5",
+      "cadence": "always",
+      "flag": "statuslineVisibility",
+      "fix_supported": true,
+      "runner": "lib/core/doctor/statusline-visibility-module.cjs",
+      "description": "Statusline invisibility probe (class G): stale user-settings path / broken plugin install / statusline-mos isolated execution / disableAllHooks. --fix removes the stale user-settings statusLine override so plugin-level config takes effect."
+    },
+    {
+      "id": "install-incomplete",
+      "introduced_version": "1.13.0-beta.9",
+      "cadence": "always",
+      "flag": "statuslineVisibility",
+      "fix_supported": true,
+      "runner": "lib/core/doctor/install-incomplete-module.cjs",
+      "description": "Silent install-incomplete detector (class H): missing statusLine block / halted .install-receipt.json tail steps. Shares the --statusline-visibility flag with class G (today's behavior). --fix re-stamps the canonical statusLine block idempotently (recoverable path only; halted-tail case is report-only)."
+    },
+    {
+      "id": "verify-surface",
+      "introduced_version": "1.12.1-beta.1",
+      "cadence": "always",
+      "flag": "verifySurface",
+      "fix_supported": false,
+      "runner": "lib/core/doctor/verify-surface-module.cjs",
+      "description": "Live cascade side-channel end-to-end verification (class D): spawns tests/test-cascade-surface-e2e.cjs (30s timeout) and asserts the 8-key shape. Self-skips when bash or the harness is absent (never faults an install for a missing dev harness). Check-only."
+    },
+    {
+      "id": "install-state",
+      "introduced_version": "1.13.0-beta.13",
+      "cadence": "always",
+      "flag": "installState",
+      "fix_supported": true,
+      "runner": "lib/core/doctor/install-state-module.cjs",
+      "description": "Install-state record + topology classification + 6-way version-of-record consistency (class I): reads ~/.mindrian/install-state.json, live-spot-checks record.active_version vs installed_plugins.json, detects legacy-config-pin drift (F11) and legacy-clone-alongside-marketplace-cache migration candidates. --fix returns MULTIPLE recovery records (session-start record write, LV rewrite, legacy-config reconcile, legacy-clone backup-verify-remove with the dev-clone safety belt). Runs BEFORE deployment-surfaces so class J reads its result via ctx.checks."
+    },
+    {
+      "id": "deployment-surfaces",
+      "introduced_version": "1.13.0-beta.13",
+      "cadence": "always",
+      "flag": "installState",
+      "fix_supported": true,
+      "runner": "lib/core/doctor/deployment-surfaces-module.cjs",
+      "description": "Deployment-surface manifest reconciliation (class J): reconciles every owned surface in data/deployment-surfaces.json against disk (marker / exact-value / observed-only), honoring topology_scope + token expansion. Reads topology/activeRoot/activeVersion from ctx.checks['install-state'] (self-derives via shared.cjs when absent). Shares the --install-state flag with class I; ordered AFTER it. --fix re-stamps ok:false session-start-owned surfaces + prunes the marketplace cache."
+    },
+    {
+      "id": "room-graph-density",
+      "introduced_version": "1.15.3-beta.47",
+      "cadence": "always",
+      "flag": null,
+      "fix_supported": false,
+      "runner": "lib/core/doctor/room-graph-density-module.cjs",
+      "description": "Per-registered-room room.db node-row and edge-row counts, read through the new read-only navigation door so the census never mutates what it measures. Check-only: raw counts and totals, no health or density claim, per SEED-074's hard guard on downstream claims."
+    },
+    {
+      "id": "graph-derive-health",
+      "introduced_version": "1.15.3-beta.49",
+      "cadence": "always",
+      "flag": "graphDeriveHealth",
+      "fix_supported": true,
+      "runner": "lib/core/doctor/graph-derive-health-module.cjs",
+      "description": "Semantic-edge derivation health per room (RCA 4d): BELONGS_TO present with zero cascade edges (derivation never succeeded), a derive queue entry stuck past 3 days, or a graph-derive-failures.json log. Scopes to the active room, or every room with --cascade-rooms. --fix (sugar: --heal-room) re-enqueues each affected room through the existing dedup-by-roomDir sweep."
+    },
+    {
+      "id": "graph-derive-heal-retrofit",
+      "introduced_version": "1.15.3-beta.49",
+      "cadence": "once",
+      "flag": null,
+      "fix_supported": false,
+      "runner": "lib/core/doctor/graph-derive-heal-retrofit-module.cjs",
+      "description": "One-time automatic retrofit (RCA 4c) for rooms whose derive queues were silently cleared before Phase 224-02's keep-on-failure fix. Walks every registered room, reuses graph-derive-health's detectRoomHealth, and re-enqueues each zero-cascade-edge room so the next in-session derive rebuilds its semantic layer. The heal runs inside check() because the ONCE pass is not gated behind --fix; the watermark then advances so it never repeats."
+    },
+    {
+      "id": "eureka-fts-health",
+      "introduced_version": "1.15.3-beta.51",
+      "cadence": "always",
+      "flag": null,
+      "fix_supported": false,
+      "runner": "lib/core/doctor/eureka-fts-health-module.cjs",
+      "description": "Per-registered-room eureka_fts (lexical trigger index) presence, population and staleness census, read through the read-only navigation door so the census never mutates what it measures (RESEARCH BLOCKER B-2). An absent index is reported, not failed: absent is the correct default state of every room today. A stale index (rows pointing at deleted nodes) is a real defect and reports status warn."
+    }
+  ]
+}

package/data/dual-graph-health-baseline.json

@@ -0,0 +1,12 @@
+{
+  "metrics": {
+    "m1_min_cohort": 1,
+    "m2_review_required": 23,
+    "m3_no_fork": true,
+    "m3_raw_cross_label_dups": 103,
+    "m4_max_orphan_rate": 1
+  },
+  "recorded_at": "2026-08-19T06:16:02.596Z",
+  "mode": "baseline",
+  "version": 1
+}

package/data/eureka-critic-tags.json

@@ -0,0 +1,32 @@
+{
+  "schema_version": 1,
+  "_note": "Phase 212 Eureka Grounding Guard closed enum registry. Follows the dispatch-framework-map.json precedent (a closed lookup table read rather than reinvented) and Canon Part 9 typed-packet discipline (enums crossing the Brain boundary are stable and versioned, never free-form strings that drift). verdicts is the four-class critic output enum; reasoning_tags is the closed one-line-explanation enum that replaces free-text reasoning across the MCP boundary (D2); domain_tags is the generic source/target domain enum for the D1 wire payload and NEVER carries room artifact vocabulary. Bump schema_version on any change and recalibrate.",
+  "verdicts": ["transferable", "restatement", "pseudoscience", "general_shallow"],
+  "reasoning_tags": {
+    "unsourced_quantity": "Candidate carries an unsourced K/M/B or dollar figure; routes to pseudoscience before any LLM call.",
+    "domain_swap_invariant": "Mechanism embedding barely moves under noun-swap; generic filler, not a real transfer.",
+    "low_novelty_delta": "Nearest neighbor in the user graph is near-identical; a restatement, not a new salient.",
+    "entity_nonspecific": "Too few specific entities named in the mechanism; vague, not checkable.",
+    "rubric_disagreement": "Neutral and adversarial rubric passes disagreed; routes to general_shallow rather than a coin flip.",
+    "restatement_vocab_swap": "Same idea with vocabulary swapped; high differential is necessary but not sufficient.",
+    "no_checkable_consequence": "The stated mechanism yields no consequence a reader could check.",
+    "schema_orphan": "The shared relational schema has orphan elements with no one-to-one mapping.",
+    "passes_all_gates": "Cleared every Stage A gate and the rubric; a candidate transferable salient.",
+    "calibration_unknown": "The rubric pattern is unseen on the gold set or the encoder was unavailable; route to human review."
+  },
+  "domain_tags": [
+    "engineering",
+    "biology",
+    "medicine",
+    "computing",
+    "materials",
+    "energy",
+    "mathematics",
+    "finance",
+    "social",
+    "food",
+    "unknown"
+  ],
+  "rubric_pattern_len": 6,
+  "rubric_version": 1
+}

package/data/first-reward-surfaces.json

@@ -0,0 +1,66 @@
+{
+  "version": 1,
+  "canon_parts": ["Part 7", "Part 11"],
+  "_doc": {
+    "purpose": "Phase 267.3 (ruling D-A): the out-of-frontmatter first-reward declaration contract for first-touch surfaces that have no frontmatter block to declare in, the motivating case being scripts/session-start, a bash hook whose FIRST_INSTALL, UPDATE, MODE_ROUTING and COLD_START_MENU branches emit user-facing first-touch prose and have nowhere to put an interactive_first_reward key. Registry-is-the-table: this file IS the contract, read at check time by scanDeclaredSurfaces() in lib/core/mva-rule-linter.cjs, never a hardcoded list inside the scanner. Record shape mirrors data/first-touch-surfaces.json (Canon Part 7, reuse before build); the _doc convention mirrors data/hitl-shape-declaration-schema.json.",
+    "reward_vocabulary": [
+      "reframe_question",
+      "instant_brief",
+      "schema_preview",
+      "calibration_distribution_preview",
+      "paragraph_preview",
+      "--none (scripting only)",
+      "methodology_reframe",
+      "--none (diagnostic surface)",
+      "live_deliverable"
+    ],
+    "reward_vocabulary_note": "This array MIRRORS the REWARD_TYPES frozen Set in lib/core/mva-rule-linter.cjs; it does not define it. Set-equality between the two is test-enforced (lib/core/mva-rule-linter.test.cjs and tests/test-267.3-surface-declarations.cjs), so a term added here and not there, or there and not here, reds the suite. A new term is a canon amendment landed in BOTH docs/reward-before-investment-rule.md and the REWARD_TYPES Set together, never a registry-local invention.",
+    "kind_vocabulary": ["shell_script", "injected_prose", "cjs"],
+    "kind_vocabulary_note": "Copied from data/first-touch-surfaces.json's kind values, minus the kinds no record here uses (command_md and agent_md both carry frontmatter, so they declare in frontmatter and never in this registry), plus injected_prose for a named prose branch inside a larger script. Add no kind until a record actually needs it.",
+    "record_shape": {
+      "id": "Required. A unique, non-empty stable surface identifier, for example session-start:FIRST_INSTALL. No two records may share one.",
+      "file": "Required. A repo-relative path to the declaring surface. The file MUST exist on disk at check time, so a declaration cannot outlive the surface it describes.",
+      "kind": "Required. One member of kind_vocabulary.",
+      "anchor": "Required. A grep-able literal or variable name locating the prose inside the file, for example the branch variable FIRST_INSTALL, so a reader can jump from this record to the prose it describes.",
+      "interactive_first_reward": "Required. One member of reward_vocabulary, validated by the SAME validateFrontmatter() the frontmatter path uses, so the two declaration surfaces cannot drift on what a legal value is.",
+      "why": "Required. One non-empty Feynman-simplified sentence naming the surface's ACTUAL first-reward moment, in plain words, hyphens not em-dashes."
+    },
+    "validation_rule": "A record is valid when every required field in record_shape is present, id is unique across the registry, file resolves to an existing file under the repo root, kind is a member of kind_vocabulary, interactive_first_reward is a member of reward_vocabulary, and why is a non-empty string. Any violation fails closed.",
+    "default_on_miss": "reject (fail closed): a file that is not on disk, an unknown kind, an unknown reward value, a duplicate id, an empty why, or an unparseable registry is a hard error, not a silent pass. A gate that reports is better than a gate that crashes, so an unreadable registry is reported as registry_read_error rather than thrown.",
+    "surface_count_principle": "The total count of declaring surfaces is NEVER hardcoded. It is always surfaces.length, read from this file by the gate at check time."
+  },
+  "surfaces": [
+    {
+      "id": "session-start:FIRST_INSTALL",
+      "file": "scripts/session-start",
+      "kind": "injected_prose",
+      "anchor": "[MindrianOS Onboarding] First install detected.",
+      "interactive_first_reward": "instant_brief",
+      "why": "The branch now hands first contact to scripts/first-install-router.cjs, which classifies the user's one-sentence free-text answer locally and, when the shipped MVA classifier judges that sentence venture-shaped, fires the room-free Instant Brief pipeline (lib/core/mva-orchestrator.cjs) out of band as a detached child process. The rendered result is drained and injected as additionalContext on a later turn, not the same turn: the brief lands one turn after the triggering sentence (plan 267.2-07, decision D-D). Stated plainly rather than declared stronger than the machinery supports: a session whose free-text answer never qualifies as venture-shaped delivers no brief. Closes GAP R-1 (.planning/research/2026-08-27-hooked-first-install-audit.md), repaired by Phase 267.2 plans 267.2-06 (the router's arm/route legs), 267.2-07 (the reward fire/drain legs) and this plan (the prose handoff)."
+    },
+    {
+      "id": "session-start:UPDATE",
+      "file": "scripts/session-start",
+      "kind": "injected_prose",
+      "anchor": "Welcome back. The user has updated from v",
+      "interactive_first_reward": "--none (diagnostic surface)",
+      "why": "Delivers a what-is-new digest read out of CHANGELOG.md for the exact version pair the user crossed, which is real machinery (the ONBOARD_STEPS / CHANGELOG_DIFF extraction) but a fully predictable output given those two versions. That is the case docs/reward-before-investment-rule.md:59-60 already names in its own words: a state report is not a reward. Honest opt-out, no repair queued against it."
+    },
+    {
+      "id": "session-start:MODE_ROUTING",
+      "file": "scripts/session-start",
+      "kind": "injected_prose",
+      "anchor": "[MindrianOS Mode Routing] No room detected.",
+      "interactive_first_reward": "--none (diagnostic surface)",
+      "why": "Delivers a three-option routing card and nothing else: it asks the user to pick an entry mode before anything is handed back, which is investment before reward, the exact ordering this rule exists to prevent. Declared as an opt-out because no reward member of the closed vocabulary would be a true statement about it. Repairing the ordering is onboarding-flow work Phase 267.2 owns, not a declaration change."
+    },
+    {
+      "id": "session-start:COLD_START_MENU",
+      "file": "scripts/session-start",
+      "kind": "injected_prose",
+      "anchor": "COLD_START_MENU=\"---\\nGet started:",
+      "interactive_first_reward": "--none (diagnostic surface)",
+      "why": "Delivers a static four-command menu, appended by all three cold-start branches, whose command count is computed live from disk. It reports what is available rather than delivering a variable reward, so the opt-out is literal here. Its one measured defect is a routing gap and not a false reward claim: it never names /mos:ignite, the front door built to deliver the Hooked first-cycle reward (GAP R-1, same audit). Phase 267.2 owns that too."
+    }
+  ]
+}

package/data/first-touch-surfaces.json

@@ -0,0 +1,60 @@
+{
+  "version": 1,
+  "canon_parts": ["Part 6", "Part 7", "Part 10"],
+  "purpose": "Canonical declaration of first-touch surfaces. Each surface MUST stamp the running plugin version. The stale-copy scanner reads this file to know what to scan and how.",
+  "surfaces": [
+    {
+      "id": "banner",
+      "file": "scripts/banner",
+      "kind": "shell_script",
+      "version_stamp_required": true,
+      "allowed_hardcoded_versions": ["1.4.0", "1.5.1"],
+      "allowlist_reason": "Usage example in header comment shows a version-transition (v1.4.0 -> v1.5.1) -- doc example, not greeting copy.",
+      "em_dash_check": true
+    },
+    {
+      "id": "splash",
+      "file": "commands/splash.md",
+      "kind": "command_md",
+      "version_stamp_required": true,
+      "allowed_hardcoded_versions": [],
+      "em_dash_check": true
+    },
+    {
+      "id": "onboard",
+      "file": "commands/onboard.md",
+      "kind": "command_md",
+      "version_stamp_required": true,
+      "allowed_hardcoded_versions": ["1.5.1"],
+      "allowlist_reason": "Parsing-logic doc example references the v1.5.1 CHANGELOG heading format -- doc example, not greeting copy.",
+      "em_dash_check": true
+    },
+    {
+      "id": "sessionstart",
+      "file": "scripts/sessionstart-coordinator.cjs",
+      "kind": "cjs",
+      "version_stamp_required": false,
+      "rationale": "Coordinator emits the consolidated envelope; individual contributors (e.g. install-drift) carry version. Aggregate stamping would be redundant.",
+      "allowed_hardcoded_versions": [],
+      "em_dash_check": true
+    },
+    {
+      "id": "operator-update",
+      "file": "scripts/operator-update.cjs",
+      "kind": "cjs",
+      "version_stamp_required": false,
+      "rationale": "Operator state pulses; version is anchored in the Row 1 statusline (Phase 121.5-03 D-03). Stamping here would echo.",
+      "allowed_hardcoded_versions": [],
+      "em_dash_check": true
+    },
+    {
+      "id": "larry-extended",
+      "file": "agents/larry-extended.md",
+      "kind": "agent_md",
+      "version_stamp_required": false,
+      "rationale": "Persona file -- the version is contextual via the statusline + banner, not the persona prose itself.",
+      "allowed_hardcoded_versions": [],
+      "em_dash_check": true
+    }
+  ]
+}