Stale-validated admissions are invisible on who_is_online and cockpit truth labels

Delivery leaf carved from #17304's AC-4 — the admission half shipped in PR #17772; this leaf owns the operator-surface rendering half that PR explicitly deferred.

Context

PR #17772 (#17304) gave the GitHub-PAT verifier a restart-durable validation cache with a stale-while-revalidate tier: during a provider outage, identities are admitted from cache and each such session carries validationState: 'stale-validated' on its AuthInfo, plus a per-admission warn log. The memory-core healthcheck composes the shared getAuthValidationStaleness() registry into a degraded verdict with a named-identity detail line (consumed by HealthService.starvationFold.spec.mjs).

What is NOT delivered: the who_is_online rows and the Fleet Cockpit truth labels still render stale-validated sessions as ordinary authenticated presence. An operator watching the cockpit during exactly the outage this mechanism exists for sees "everything fine", and learns about staleness only from the healthcheck detail or server logs — surfaces nobody stares at mid-outage.

The Problem

whoIsOnline builds presence rows from AgentIdentity graph nodes and wake-subscription state (ai/services/memory-core/whoIsOnline* family); live request-time AuthInfo never reaches that surface, so the staleness flag has nowhere to land. Threading it at admission time would mean writing to identity nodes on every request (write amplification + graph pollution of transient state), which is the wrong shape.

The Architectural Reality

• Admission truth originates in ai/mcp/server/shared/services/AuthService.mjs — module-level registry AUTH_VALIDATION_STALENESS, exposed via getAuthValidationStaleness() ({mode → {since, user}}), already consumed by the memory-core healthcheck composition.
• Presence rows assemble in ai/services/memory-core/whoIsOnline*; the cockpit renders them through its presence/activity panes (apps/agentos).
• The right join point is presence-row ASSEMBLY reading the registry (a read-only lookup keyed by resolved identity), not admission-time graph writes.

The Fix

1. Presence-row assembly consults getAuthValidationStaleness() and stamps matching rows with an explicit validationState: 'stale-validated' (+ since) when the row's subject matches a registry entry.
2. Cockpit truth labels render the stamp as a visible degraded-presence marker (label copy owner: this ticket).
3. A unit arm pins row-stamping against a seeded registry; a negative arm proves fresh admissions leave rows unlabeled.
4. Registry clearing (fresh re-validation) clears the label on the next row build — latch-free, same per-request freshness contract the healthcheck signal already follows.

Contract Ledger Matrix

Acceptance Criteria

• whoIsOnline rows stamp validationState: 'stale-validated' (+ since) iff the auth-staleness registry names the row's subject; fresh/unmatched rows unchanged (unit arms both directions).
• Cockpit presence surface renders a visible marker for stamped rows; unstamped rows render byte-identical to today.
• Registry clearing removes the label on next build without restart (latch-free witness).

Out of Scope

Admission/cache mechanics (delivered, PR #17772) · healthcheck composition (delivered) · new persistence of validation state into graph nodes · GitLab-PAT parity (registry currently keys github-pat only).

Decision Record impact

none — aligned-with the admission-path design settled on #17304; consumes its public accessor read-only.

Related

#17304 (parent delivery, PR #17772) · #17330 (System diagnostics view sibling) · #17682 (live-plane receipt lane)

Live latest-open sweep: checked latest 20 open issues 2026-08-25T19:20Z, no equivalent; A2A herd window clean (only #17778/#17772 traffic).

Origin Session ID: 2ba2b11c-eed0-48f4-ae76-de3752c3fc1a

Retrieval Hint: query_raw_memories("stale-validated who_is_online presence label auth staleness registry")