@mindrian_os/install 1.13.0-beta.11

package/lib/memory/validators/navigation-invariants.cjs

@@ -0,0 +1,340 @@
+/*
+ * Copyright (c) 2026 Mindrian. BSL 1.1.
+ * Phase 91-09 -- navigation-invariants validator.
+ *
+ * Registry-compatible drop-in for the Phase 88-13 guardian. Auto-loaded
+ * by scripts/feynman-minto-guardian.cjs's loadValidators() walker; no
+ * guardian.cjs edits required (extensibility promise of Phase 88-13
+ * registry contract).
+ *
+ * Converts five silent Phase 91 navigation failure modes into first-class
+ * health signals visible at session-start, on-stop, and pre-commit:
+ *
+ *   INV-1  trace_missing_field         every persisted decision_trace
+ *                                      entry must carry all 8 Section 8
+ *                                      brain_md_* fields per
+ *                                      navigation-engine-brain-interface
+ *                                      v1. Missing field -> error.
+ *   INV-2  recommended_in_wrong_mode   RECOMMENDED marker may render only
+ *                                      in mode_a (Canon Part 3 Section 6).
+ *                                      Rendered in mode_b or tier_0 ->
+ *                                      error.
+ *   INV-3  weight_clamp_breach         brain_md_weight_applied must lie
+ *                                      in [0.0, 1.0] inclusive. Out-of-
+ *                                      range -> error.
+ *   INV-4  trace_file_malformed        decision-traces/*.json that fails
+ *                                      JSON.parse -> error. Sibling files
+ *                                      continue to be scanned.
+ *   INV-5  unknown_verb_passed         trace.fire_skill (when present)
+ *                                      must be in CANONICAL_VERBS (Canon
+ *                                      Part 3 frozen 10-verb vocabulary).
+ *                                      Unknown -> warning. Graceful when
+ *                                      shared module unavailable.
+ *
+ * Canon Part 8 (Graph Boundary): pure LOCAL reader. Reads only files
+ * under <roomDir>/.mindrian/decision-traces/. Zero network surface; zero
+ * Brain MCP queries; zero shell-out. Test 13 source-scans this file for
+ * forbidden references.
+ *
+ * Canon Part 7 (Reuse Before Build): Phase 88-13 built the validator
+ * registry for exactly this scenario. This file plugs in; guardian.cjs
+ * stays untouched. Fail-open is inherited from the registry loader (a
+ * malformed sibling validator never prevents this validator from running).
+ *
+ * Three-surface compatibility: pure CJS + node built-ins (fs, path).
+ * Works identically on Claude Code CLI, Claude Desktop MCP, and Cowork
+ * shared-room scenarios.
+ *
+ * Mode dispatch (set by guardian invocation):
+ *   session-start  advisory; emitted to TRIPLE_CONTEXT footer.
+ *   on-stop        advisory; aggregated into invariant-report.json.
+ *   pre-commit     blocking at error/critical (guardian exits 2). This
+ *                  validator just emits; guardian owns exit codes.
+ */
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+// ---------- Constants ----------
+
+const SEVERITY_MAP = Object.freeze({
+  // 6 categories the validator emits, mapped to severities the guardian
+  // aggregates. Phase 88-13 expects the shape (object); the guardian's
+  // SEVERITY_ORDER alone owns numeric ordering.
+  trace_missing_field: 'error',
+  recommended_in_wrong_mode: 'error',
+  weight_clamp_breach: 'error',
+  unknown_verb_passed: 'warning',
+  trace_file_malformed: 'error',
+  session_file_absent: 'info',
+});
+
+// 8 Section 8 fields per .planning/research/navigation-engine-brain-
+// interface.md v1. Order is documentation-stable; the validator does not
+// rely on order, but the test suite reads this list defensively.
+const REQUIRED_TRACE_FIELDS = Object.freeze([
+  'brain_md_version',
+  'brain_md_staleness',
+  'brain_md_stale_reason',
+  'brain_md_weight_applied',
+  'brain_md_recommended_confidence',
+  'brain_md_recommended_marker_rendered',
+  'brain_md_tier_mode',
+  'brain_md_sections_consumed',
+]);
+
+const VALID_TIER_MODES = Object.freeze(['mode_a', 'mode_b', 'tier_0']);
+const ROOM_SCOPE = '__room__';
+
+// ---------- Lazy CANONICAL_VERBS load (graceful degradation) ----------
+
+let _canonicalVerbs = undefined; // undefined: not yet loaded; null: unavailable.
+function getCanonicalVerbs() {
+  if (_canonicalVerbs !== undefined) return _canonicalVerbs;
+  try {
+    const sharedPath = path.join(__dirname, '..', '..', 'core',
+      'navigation-engine-shared.cjs');
+    // Best-effort require. If the shared module fails to load (missing,
+    // syntax error), fall back to null so INV-5 silently skips. Per the
+    // plan: graceful degradation, not noisy failure.
+    const mod = require(sharedPath);
+    if (mod && Array.isArray(mod.CANONICAL_VERBS) && mod.CANONICAL_VERBS.length > 0) {
+      _canonicalVerbs = mod.CANONICAL_VERBS;
+    } else {
+      _canonicalVerbs = null;
+    }
+  } catch (_) {
+    _canonicalVerbs = null;
+  }
+  return _canonicalVerbs;
+}
+
+// ---------- Helpers ----------
+
+function isFiniteNumber(n) {
+  return typeof n === 'number' && isFinite(n);
+}
+
+function safeReadDir(dir) {
+  try {
+    return fs.readdirSync(dir, { withFileTypes: true })
+      .filter(function (d) { return d.isFile() && /\.json$/i.test(d.name); })
+      .map(function (d) { return d.name; })
+      .sort();
+  } catch (_) {
+    return null; // sentinel: directory absent or unreadable
+  }
+}
+
+function makeViolation(category, message, extras) {
+  const sev = SEVERITY_MAP[category] || 'warning';
+  const base = {
+    validator: 'navigation-invariants',
+    category: category,
+    severity: sev,
+    message: message,
+    scope: ROOM_SCOPE,
+  };
+  if (extras && typeof extras === 'object') {
+    return Object.assign(base, extras);
+  }
+  return base;
+}
+
+// ---------- Per-trace invariant checks ----------
+
+/**
+ * Check a single persisted trace entry for INV-1, INV-2, INV-3, INV-5.
+ * Pushes violations into the supplied array. Each violation carries
+ * session_id (when known) + turn (when known) so /mos:explain-decision
+ * and the guardian footer can pinpoint the offending row.
+ */
+function checkTraceEntry(trace, sessionId, fileName, violations) {
+  if (!trace || typeof trace !== 'object') return;
+  const turn = (typeof trace.turn === 'number') ? trace.turn : null;
+  const idCommon = {
+    session_id: sessionId,
+    file: fileName,
+  };
+  if (turn !== null) idCommon.turn = turn;
+
+  // INV-1 trace_missing_field. Use hasOwnProperty so explicit `null` /
+  // 0 / '' / false / [] do NOT trip the check (Section 8 sentinels are
+  // valid values).
+  for (const field of REQUIRED_TRACE_FIELDS) {
+    if (!Object.prototype.hasOwnProperty.call(trace, field)) {
+      violations.push(makeViolation(
+        'trace_missing_field',
+        'decision_trace missing required Section 8 field "' + field +
+          '" in session ' + sessionId +
+          (turn !== null ? ' turn ' + turn : ''),
+        Object.assign({ field: field, action_hint: 'review_decision_trace_emitter' },
+          idCommon)
+      ));
+    }
+  }
+
+  // INV-2 recommended_in_wrong_mode. RECOMMENDED marker may render only
+  // when tier_mode === 'mode_a' per Canon Part 3 Section 6.
+  const rendered = trace.brain_md_recommended_marker_rendered;
+  const tierMode = trace.brain_md_tier_mode;
+  if (rendered === true && tierMode !== 'mode_a' &&
+      VALID_TIER_MODES.indexOf(tierMode) !== -1) {
+    violations.push(makeViolation(
+      'recommended_in_wrong_mode',
+      'RECOMMENDED marker rendered while tier_mode="' + tierMode +
+        '" (Canon Part 3 Section 6 requires mode_a) in session ' +
+        sessionId + (turn !== null ? ' turn ' + turn : ''),
+      Object.assign({ tier_mode: tierMode, action_hint: 'audit_recommended_gate' },
+        idCommon)
+    ));
+  }
+
+  // INV-3 weight_clamp_breach. brain_md_weight_applied in [0.0, 1.0].
+  const weight = trace.brain_md_weight_applied;
+  if (isFiniteNumber(weight) && (weight < 0.0 || weight > 1.0)) {
+    violations.push(makeViolation(
+      'weight_clamp_breach',
+      'brain_md_weight_applied=' + weight + ' outside [0.0, 1.0] in session ' +
+        sessionId + (turn !== null ? ' turn ' + turn : ''),
+      Object.assign({ weight_applied: weight, action_hint: 'enforce_clamp_at_emitter' },
+        idCommon)
+    ));
+  }
+
+  // INV-5 unknown_verb_passed. Only check when CANONICAL_VERBS available
+  // AND fire_skill is a non-empty string (absent/null fire_skill is
+  // valid: the engine emits null when no skill is recommended).
+  const verbs = getCanonicalVerbs();
+  if (verbs !== null && typeof trace.fire_skill === 'string' &&
+      trace.fire_skill.length > 0 && verbs.indexOf(trace.fire_skill) === -1) {
+    violations.push(makeViolation(
+      'unknown_verb_passed',
+      'fire_skill="' + trace.fire_skill +
+        '" is not in Canon Part 3 vocabulary (10 frozen verbs) in session ' +
+        sessionId + (turn !== null ? ' turn ' + turn : ''),
+      Object.assign({ fire_skill: trace.fire_skill,
+        action_hint: 'route_through_canonicalizeVerb' }, idCommon)
+    ));
+  }
+}
+
+// ---------- Main validate() ----------
+
+function validateRoom(roomDir) {
+  const violations = [];
+  const tracesDir = path.join(roomDir, '.mindrian', 'decision-traces');
+  const files = safeReadDir(tracesDir);
+
+  if (files === null) {
+    // INV: no decision-traces dir. This is the healthy fresh-room state;
+    // surface as info so /mos:explain-decision telemetry has something
+    // benign to report rather than a confusing silence.
+    violations.push(makeViolation(
+      'session_file_absent',
+      'No decision traces recorded yet (fresh room or pre-engine state).',
+      { action_hint: 'none' }
+    ));
+    return finalize(violations);
+  }
+
+  if (files.length === 0) {
+    // Directory exists but is empty. Treat the same as absent for
+    // signaling purposes.
+    violations.push(makeViolation(
+      'session_file_absent',
+      'decision-traces directory present but contains no session files.',
+      { action_hint: 'none' }
+    ));
+    return finalize(violations);
+  }
+
+  for (const fname of files) {
+    const fullPath = path.join(tracesDir, fname);
+    let raw;
+    try {
+      raw = fs.readFileSync(fullPath, 'utf8');
+    } catch (e) {
+      // Read failure is treated as malformed: the file exists but cannot
+      // be processed. Continue to the next sibling.
+      violations.push(makeViolation(
+        'trace_file_malformed',
+        'decision-traces file "' + fname + '" could not be read: ' +
+          (e && e.message ? e.message : String(e)),
+        { file: fname, action_hint: 'inspect_file_permissions' }
+      ));
+      continue;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch (e) {
+      violations.push(makeViolation(
+        'trace_file_malformed',
+        'decision-traces file "' + fname + '" is not valid JSON: ' +
+          (e && e.message ? e.message : String(e)),
+        { file: fname, action_hint: 'rotate_or_remove_corrupt_trace' }
+      ));
+      continue;
+    }
+    if (!parsed || typeof parsed !== 'object') {
+      violations.push(makeViolation(
+        'trace_file_malformed',
+        'decision-traces file "' + fname + '" did not parse to an object.',
+        { file: fname, action_hint: 'rotate_or_remove_corrupt_trace' }
+      ));
+      continue;
+    }
+    const sessionId = (typeof parsed.session_id === 'string' &&
+      parsed.session_id.length > 0) ? parsed.session_id : fname.replace(/\.json$/i, '');
+    const traces = Array.isArray(parsed.traces) ? parsed.traces : [];
+    for (const t of traces) {
+      checkTraceEntry(t, sessionId, fname, violations);
+    }
+  }
+
+  return finalize(violations);
+}
+
+function finalize(violations) {
+  // Aggregate severity for guardian's per-validator summary line.
+  const order = ['info', 'warning', 'error', 'critical'];
+  let max = -1;
+  for (const v of violations) {
+    const i = order.indexOf(v.severity);
+    if (i > max) max = i;
+  }
+  return {
+    severity: max === -1 ? null : order[max],
+    violations: violations,
+  };
+}
+
+// ---------- Exports ----------
+
+module.exports = {
+  id: 'navigation-invariants',
+  severity_map: SEVERITY_MAP,
+  scope: 'room',
+  validate: function (sectionDirOrRoomDir, ctx) {
+    // Phase 88-13 contract: when scope === 'room' the guardian invokes
+    // validate(roomDir, ctx). For defensive symmetry with the other
+    // room-scoped validators (snapshot-integrity, queue-health,
+    // stale-lifecycle), prefer ctx.roomDir when available.
+    const roomDir = (ctx && typeof ctx.roomDir === 'string' && ctx.roomDir.length > 0)
+      ? ctx.roomDir
+      : sectionDirOrRoomDir;
+    if (typeof roomDir !== 'string' || roomDir.length === 0) {
+      return { severity: null, violations: [] };
+    }
+    return validateRoom(roomDir);
+  },
+  // Internal exports for tests (not part of the registry contract; the
+  // guardian ignores extra keys):
+  __internal: {
+    REQUIRED_TRACE_FIELDS: REQUIRED_TRACE_FIELDS,
+    VALID_TIER_MODES: VALID_TIER_MODES,
+  },
+};

package/lib/memory/validators/queue-health.cjs

@@ -0,0 +1,95 @@
+/*
+ * Copyright (c) 2026 Mindrian. BSL 1.1.
+ * Phase 88-13 MEM-GUARDIAN-QUEUE-01.
+ *
+ * Enforces size ceilings on the minto-debouncer queue
+ * (.mindrian/minto-queue.json shipped by 88-02). Without this validator,
+ * unbounded queue growth (drain never fires) accumulates silently for
+ * hundreds of sessions before anyone notices. This converts the silent
+ * growth into a visible session-start signal.
+ *
+ * Thresholds:
+ *   entries <  500              healthy, no violation
+ *   entries >= 500 && <= 999    warning  queue_approaching_ceiling
+ *   entries >= 1000             error    queue_ceiling_exceeded +
+ *                                        action_hint halt_enqueue_until_drained
+ *
+ * Emits at most ONE aggregate violation per invocation (not N per entry).
+ * Missing queue file -> no violation (healthy first-session state).
+ */
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const SEVERITY_MAP = { critical: 3, error: 2, warning: 1, info: 0 };
+const WARN_THRESHOLD = 500;
+const ERROR_THRESHOLD = 1000;
+const ROOM_SCOPE = '__room__';
+
+function validateRoom(roomDir) {
+  const qp = path.join(roomDir, '.mindrian', 'minto-queue.json');
+  if (!fs.existsSync(qp)) {
+    return { severity: null, violations: [] };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(fs.readFileSync(qp, 'utf8'));
+  } catch (_) {
+    // Malformed queue file is a silent-failure signal in its own right.
+    return {
+      severity: 'warning',
+      violations: [{
+        validator: 'queue-health',
+        category: 'queue_unparseable',
+        severity: 'warning',
+        message: 'minto-queue.json is unparseable; debouncer self-healed or writer crashed',
+        scope: ROOM_SCOPE,
+      }],
+    };
+  }
+  const entries = (parsed && Array.isArray(parsed.entries)) ? parsed.entries : [];
+  const count = entries.length;
+  if (count < WARN_THRESHOLD) {
+    return { severity: null, violations: [] };
+  }
+  if (count >= ERROR_THRESHOLD) {
+    return {
+      severity: 'error',
+      violations: [{
+        validator: 'queue-health',
+        category: 'queue_ceiling_exceeded',
+        severity: 'error',
+        message: 'minto-debouncer queue at ' + count +
+          ' entries, ceiling ' + ERROR_THRESHOLD,
+        action_hint: 'halt_enqueue_until_drained',
+        count: count,
+        scope: ROOM_SCOPE,
+      }],
+    };
+  }
+  return {
+    severity: 'warning',
+    violations: [{
+      validator: 'queue-health',
+      category: 'queue_approaching_ceiling',
+      severity: 'warning',
+      message: 'minto-debouncer queue at ' + count +
+        ' entries, ceiling ' + ERROR_THRESHOLD,
+      action_hint: 'drain_soon',
+      count: count,
+      scope: ROOM_SCOPE,
+    }],
+  };
+}
+
+module.exports = {
+  id: 'queue-health',
+  severity_map: SEVERITY_MAP,
+  scope: 'room',
+  validate: function (sectionDirOrRoomDir, ctx) {
+    const roomDir = (ctx && ctx.roomDir) ? ctx.roomDir : sectionDirOrRoomDir;
+    return validateRoom(roomDir);
+  },
+};

package/lib/memory/validators/snapshot-integrity.cjs

@@ -0,0 +1,129 @@
+/*
+ * Copyright (c) 2026 Mindrian. BSL 1.1.
+ * Phase 88-13 MEM-GUARDIAN-SNAPSHOT-01.
+ *
+ * Detects partial session-snapshot.json produced by an on-stop walk that
+ * crashed mid-iteration before the atomic rename landed. Without this
+ * validator the drift stays silent for 20+ sessions (no visible
+ * TRIPLE_CONTEXT entry for the affected section, but user never sees why).
+ *
+ * Signals emitted:
+ *   partial_snapshot        warning per missing section, action_hint
+ *                           'partial_snapshot_detected'
+ *   snapshot_empty          error when snapshot has zero sections but the
+ *                           room has at least one ROOM.md section on disk.
+ *                           Action hint 'rerun_on_stop'.
+ *   (missing file)          silent: no violation. Healthy first-session.
+ *
+ * Emits violations against a synthetic section key `__room__` so the
+ * guardian aggregator can surface them without tying them to a specific
+ * section (they are a room-wide health signal).
+ */
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const SEVERITY_MAP = { critical: 3, error: 2, warning: 1, info: 0 };
+const ROOM_SCOPE = '__room__';
+
+function safeReadSections(roomDir) {
+  // Returns an array of section dir names that hold a ROOM.md, per the
+  // ICM Layer 0 identity invariant (CLAUDE.md decision #15).
+  try {
+    return fs.readdirSync(roomDir, { withFileTypes: true })
+      .filter(function (d) { return d.isDirectory() && d.name[0] !== '.'; })
+      .filter(function (d) {
+        try {
+          return fs.existsSync(path.join(roomDir, d.name, 'ROOM.md'));
+        } catch (_) { return false; }
+      })
+      .map(function (d) { return d.name; });
+  } catch (_) {
+    return [];
+  }
+}
+
+function validateRoom(roomDir) {
+  const snapPath = path.join(roomDir, '.mindrian', 'session-snapshot.json');
+  if (!fs.existsSync(snapPath)) {
+    return { severity: null, violations: [] };
+  }
+  let parsed;
+  try {
+    const raw = fs.readFileSync(snapPath, 'utf8');
+    parsed = JSON.parse(raw);
+  } catch (_) {
+    // Malformed JSON surfaced as error (silent-to-loud conversion).
+    return {
+      severity: 'error',
+      violations: [{
+        validator: 'snapshot-integrity',
+        category: 'snapshot_unparseable',
+        severity: 'error',
+        message: 'session-snapshot.json is unparseable; on-stop likely crashed',
+        action_hint: 'rerun_on_stop',
+        scope: ROOM_SCOPE,
+      }],
+    };
+  }
+  const snapSections = (parsed && parsed.sections && typeof parsed.sections === 'object')
+    ? Object.keys(parsed.sections)
+    : [];
+  const diskSections = safeReadSections(roomDir);
+
+  const violations = [];
+  if (snapSections.length === 0 && diskSections.length > 0) {
+    violations.push({
+      validator: 'snapshot-integrity',
+      category: 'snapshot_empty',
+      severity: 'error',
+      message: 'on-stop walk crashed or never ran: snapshot empty while room has ' +
+        diskSections.length + ' section' + (diskSections.length === 1 ? '' : 's'),
+      action_hint: 'rerun_on_stop',
+      scope: ROOM_SCOPE,
+    });
+  } else {
+    const snapSet = new Set(snapSections);
+    for (const d of diskSections) {
+      if (!snapSet.has(d)) {
+        violations.push({
+          validator: 'snapshot-integrity',
+          category: 'partial_snapshot',
+          severity: 'warning',
+          message: 'section "' + d + '" exists on disk but missing from session-snapshot.json',
+          action_hint: 'partial_snapshot_detected',
+          scope: ROOM_SCOPE,
+          section: d,
+        });
+      }
+    }
+  }
+  // Aggregate severity
+  let max = -1;
+  const order = ['info', 'warning', 'error', 'critical'];
+  for (const v of violations) {
+    const i = order.indexOf(v.severity);
+    if (i > max) max = i;
+  }
+  return {
+    severity: max === -1 ? null : order[max],
+    violations: violations,
+  };
+}
+
+module.exports = {
+  id: 'snapshot-integrity',
+  severity_map: SEVERITY_MAP,
+  // Section-scoped validators get a sectionDir; this one is room-scoped so
+  // the guardian invokes it once per room (sectionDir parameter is ignored
+  // when context.scope === 'room'). The guardian honors a special
+  // `scope: 'room'` field so we do not duplicate work across N sections.
+  scope: 'room',
+  validate: function (sectionDirOrRoomDir, ctx) {
+    // The guardian always passes the room path when scope === 'room'.
+    const roomDir = (ctx && ctx.roomDir) ? ctx.roomDir : sectionDirOrRoomDir;
+    return validateRoom(roomDir);
+  },
+};

package/lib/memory/validators/stale-lifecycle.cjs

@@ -0,0 +1,116 @@
+/*
+ * Copyright (c) 2026 Mindrian. BSL 1.1.
+ * Phase 88-13 MEM-GUARDIAN-STALE-01.
+ *
+ * Re-validates every .mindrian/minto-stale.json entry (written by 88-06
+ * for sections whose MINTO couldn't regen) against the current MINTO
+ * state. A stale entry whose section now has a valid MINTO is a GHOST:
+ * the ledger lies. This validator emits a warning per ghost so the
+ * on-stop mode of the guardian can prune the ghost atomically. Without
+ * this, ghost entries linger forever and pollute session-start footers
+ * with false alarms.
+ *
+ * Signals:
+ *   stale_ghost  (warning)  entry lists section X but invariants.validate(X)
+ *                           is now clean. Carries section name + action_hint
+ *                           'prune_stale_entry'. Consumed by guardian on-stop
+ *                           mode to rewrite stale.json atomically.
+ *   (MINTO still invalid)   no new violation; real staleness is already
+ *                           surfaced by the stale.json consumer (88-07).
+ *   (missing stale.json)    no violation; healthy.
+ */
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const SEVERITY_MAP = { critical: 3, error: 2, warning: 1, info: 0 };
+const ROOM_SCOPE = '__room__';
+
+const { validate: invariantsValidate } = require('../../core/feynman-minto-invariants.cjs');
+
+function validateRoom(roomDir) {
+  const stalePath = path.join(roomDir, '.mindrian', 'minto-stale.json');
+  if (!fs.existsSync(stalePath)) {
+    return { severity: null, violations: [] };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(fs.readFileSync(stalePath, 'utf8'));
+  } catch (_) {
+    return {
+      severity: 'warning',
+      violations: [{
+        validator: 'stale-lifecycle',
+        category: 'stale_file_unparseable',
+        severity: 'warning',
+        message: 'minto-stale.json is unparseable',
+        scope: ROOM_SCOPE,
+      }],
+    };
+  }
+  const list = (parsed && Array.isArray(parsed.sections)) ? parsed.sections : [];
+  const violations = [];
+  // Reasons owned by the invariants module. Only these reasons are
+  // candidates for ghost detection via re-validation. Other reasons
+  // (never_generated, missing_timestamps, artifacts_newer_than_minto) are
+  // signaled by folder-memory.computeStale() independently of invariants
+  // state -- re-running invariants won't learn anything about them and
+  // pruning based on invariant cleanliness would erase real signals.
+  const INVARIANT_OWNED_REASONS = new Set(['invariant_violation', 'parse_failed']);
+  for (const entry of list) {
+    if (!entry || typeof entry !== 'object') continue;
+    const section = entry.section;
+    if (typeof section !== 'string' || section.length === 0) continue;
+    const reason = typeof entry.reason === 'string' ? entry.reason : '';
+    if (!INVARIANT_OWNED_REASONS.has(reason)) {
+      // Skip entries whose reason is not owned by the invariants module;
+      // folder-memory is the authoritative source for these, and pruning
+      // would erase valid staleness. These stay in stale.json until the
+      // originating producer (88-06 on-stop walk) removes them.
+      continue;
+    }
+    const mintoPath = path.join(roomDir, section, 'MINTO.md');
+    if (!fs.existsSync(mintoPath)) continue;
+    let result;
+    try { result = invariantsValidate(mintoPath); }
+    catch (_) { continue; }
+    // Ghost condition: MINTO is fully invariant-clean. If ANY violation
+    // survives (including freshness/coherence warnings), the section is
+    // still stale and must NOT be pruned.
+    const violationsList = (result && result.violations) || [];
+    if (violationsList.length === 0) {
+      violations.push({
+        validator: 'stale-lifecycle',
+        category: 'stale_ghost',
+        severity: 'warning',
+        message: 'stale.json lists "' + section + '" (reason=' + reason +
+          ') but MINTO is now invariant-clean',
+        action_hint: 'prune_stale_entry',
+        section: section,
+        scope: ROOM_SCOPE,
+      });
+    }
+  }
+  let max = -1;
+  const order = ['info', 'warning', 'error', 'critical'];
+  for (const v of violations) {
+    const i = order.indexOf(v.severity);
+    if (i > max) max = i;
+  }
+  return {
+    severity: max === -1 ? null : order[max],
+    violations: violations,
+  };
+}
+
+module.exports = {
+  id: 'stale-lifecycle',
+  severity_map: SEVERITY_MAP,
+  scope: 'room',
+  validate: function (sectionDirOrRoomDir, ctx) {
+    const roomDir = (ctx && ctx.roomDir) ? ctx.roomDir : sectionDirOrRoomDir;
+    return validateRoom(roomDir);
+  },
+};