@malloy-publisher/server 0.0.231 → 0.0.232

package/package.json

@@ -1,7 +1,7 @@
 {
    "name": "@malloy-publisher/server",
    "description": "Malloy Publisher Server",
-   "version": "0.0.231",
+   "version": "0.0.232",
    "main": "dist/server.mjs",
    "bin": {
       "malloy-publisher": "dist/server.mjs"
@@ -36,17 +36,17 @@
       "@azure/storage-blob": "^12.26.0",
       "@duckdb/node-api": "1.5.3-r.2",
       "@google-cloud/storage": "^7.16.0",
-      "@malloydata/db-bigquery": "^0.0.423",
-      "@malloydata/db-databricks": "^0.0.423",
-      "@malloydata/db-duckdb": "^0.0.423",
-      "@malloydata/db-mysql": "^0.0.423",
-      "@malloydata/db-postgres": "^0.0.423",
-      "@malloydata/db-publisher": "^0.0.423",
-      "@malloydata/db-snowflake": "^0.0.423",
-      "@malloydata/db-trino": "^0.0.423",
-      "@malloydata/malloy": "^0.0.423",
-      "@malloydata/malloy-sql": "^0.0.423",
-      "@malloydata/render-validator": "^0.0.423",
+      "@malloydata/db-bigquery": "^0.0.426",
+      "@malloydata/db-databricks": "^0.0.426",
+      "@malloydata/db-duckdb": "^0.0.426",
+      "@malloydata/db-mysql": "^0.0.426",
+      "@malloydata/db-postgres": "^0.0.426",
+      "@malloydata/db-publisher": "^0.0.426",
+      "@malloydata/db-snowflake": "^0.0.426",
+      "@malloydata/db-trino": "^0.0.426",
+      "@malloydata/malloy": "^0.0.426",
+      "@malloydata/malloy-sql": "^0.0.426",
+      "@malloydata/render-validator": "^0.0.426",
       "@modelcontextprotocol/sdk": "^1.13.2",
       "@opentelemetry/api": "^1.9.0",
       "@opentelemetry/auto-instrumentations-node": "^0.57.0",

package/scripts/bake-duckdb-extensions.js

@@ -25,7 +25,9 @@ import { DuckDBInstance } from "@duckdb/node-api";
 // Every extension the connection layer (packages/server/src/service/connection.ts)
 // and storage manager INSTALL/LOAD at runtime, for cloud attach, the per-package
 // sandbox, federated-database attach, and the materialization catalog. Keep this
-// in sync with the install sites in those files.
+// in sync with the install sites in those files. `excel` is the exception: it
+// has no INSTALL site because DuckDB autoloads it when a package reads an
+// .xlsx file, so baking is what makes those reads work offline.
 //
 // `community: true` marks the community-repo extensions (bigquery, snowflake);
 // the rest are core extensions installed by name. The bake deliberately uses
@@ -40,6 +42,7 @@ const EXTENSIONS = [
    { name: "azure", community: false }, // azure blob storage
    { name: "postgres", community: false, registered: "postgres_scanner" }, // postgres attach + ducklake postgres catalog
    { name: "ducklake", community: false }, // materialization catalog
+   { name: "excel", community: false }, // .xlsx reads in per-package sandboxes (autoloaded on demand)
    { name: "bigquery", community: true },
    { name: "snowflake", community: true },
 ];

package/src/config.spec.ts

@@ -2,6 +2,7 @@ import { afterEach, beforeEach, describe, expect, it } from "bun:test";
 import fs from "fs";
 import path from "path";
 import {
+   getPersistCollisionEnforce,
    getPublisherConfig,
    getPublisherConfigDir,
    type PublisherConfig,
@@ -1494,3 +1495,41 @@ describe("getPublisherConfigDir", () => {
       expect(getPublisherConfigDir(testRoot)).toBeNull();
    });
 });
+
+describe("PERSIST_COLLISION_ENFORCE", () => {
+   // The flag decides whether a persist-target collision blocks a publish, so
+   // mis-parsing it leaves the check warn-only — failing open in exactly the
+   // direction it exists to prevent. An ad-hoc `=== "true"` did that for `1`,
+   // `yes` and `on`.
+   const prev = process.env.PERSIST_COLLISION_ENFORCE;
+   afterEach(() => {
+      if (prev === undefined) delete process.env.PERSIST_COLLISION_ENFORCE;
+      else process.env.PERSIST_COLLISION_ENFORCE = prev;
+   });
+
+   it("defaults to warn-only when unset or empty", () => {
+      delete process.env.PERSIST_COLLISION_ENFORCE;
+      expect(getPersistCollisionEnforce()).toBe(false);
+      process.env.PERSIST_COLLISION_ENFORCE = "   ";
+      expect(getPersistCollisionEnforce()).toBe(false);
+   });
+
+   it("enforces for every spelling of true an operator might use", () => {
+      for (const raw of ["true", "TRUE", " True ", "1", "yes", "on"]) {
+         process.env.PERSIST_COLLISION_ENFORCE = raw;
+         expect(getPersistCollisionEnforce()).toBe(true);
+      }
+   });
+
+   it("stays warn-only for every spelling of false", () => {
+      for (const raw of ["false", "FALSE", "0", "no", "off"]) {
+         process.env.PERSIST_COLLISION_ENFORCE = raw;
+         expect(getPersistCollisionEnforce()).toBe(false);
+      }
+   });
+
+   it("throws on a value that is neither, rather than guessing", () => {
+      process.env.PERSIST_COLLISION_ENFORCE = "enabled";
+      expect(() => getPersistCollisionEnforce()).toThrow(/expected a boolean/i);
+   });
+});

package/src/config.ts

@@ -262,6 +262,73 @@ export const getMemoryGovernorConfig = (): MemoryGovernorConfig | null => {
    };
 };
 
+/**
+ * Settings for the optional embedding provider behind semantic
+ * `malloy_getContext` retrieval. See {@link getEmbeddingConfig}.
+ */
+export interface EmbeddingConfig {
+   /** Bearer token sent to the embedding endpoint. */
+   apiKey: string;
+   /** Embedding model name, e.g. "text-embedding-3-small". */
+   model: string;
+   /** Base URL of an OpenAI-compatible API (no trailing slash). */
+   baseUrl: string;
+   /**
+    * Optional `dimensions` request parameter. Omitted from requests when
+    * unset; the vector length then comes from the provider's response.
+    */
+   dimensions?: number;
+}
+
+const DEFAULT_EMBEDDING_MODEL = "text-embedding-3-small";
+const DEFAULT_EMBEDDING_API_BASE = "https://api.openai.com/v1";
+
+/**
+ * Embedding-provider settings for semantic `malloy_getContext` retrieval,
+ * or `null` when the feature is disabled. The feature is enabled iff
+ * `EMBEDDING_API_KEY` is set and non-empty; without it the tool keeps its
+ * lexical (lunr) ranking unchanged.
+ *
+ * The key must be set explicitly. An ambient provider key (for example
+ * `OPENAI_API_KEY`) is deliberately NOT read: enabling this feature sends
+ * entity names, `#(doc)` text, and query strings to the configured
+ * endpoint, and that egress must never switch on just because a commonly
+ * exported variable happens to be present.
+ *
+ * Throws on malformed companion values (bad URL, bad integer) so a typo
+ * surfaces loudly in the log rather than silently degrading to lexical.
+ */
+export const getEmbeddingConfig = (): EmbeddingConfig | null => {
+   const apiKey = process.env.EMBEDDING_API_KEY?.trim();
+   if (!apiKey) {
+      return null;
+   }
+
+   const rawBase = process.env.EMBEDDING_API_BASE;
+   const baseUrl = (rawBase?.trim() || DEFAULT_EMBEDDING_API_BASE).replace(
+      /\/+$/,
+      "",
+   );
+   try {
+      new URL(baseUrl);
+   } catch {
+      throw new Error(
+         `Invalid value for EMBEDDING_API_BASE: expected a URL, got "${rawBase}"`,
+      );
+   }
+
+   const model = process.env.EMBEDDING_MODEL?.trim() || DEFAULT_EMBEDDING_MODEL;
+
+   const dimensions = parseIntEnv("EMBEDDING_DIMENSIONS");
+   if (dimensions !== undefined && dimensions <= 0) {
+      throw new Error(
+         `EMBEDDING_DIMENSIONS must be a positive integer (got ${dimensions})`,
+      );
+   }
+
+   return { apiKey, model, baseUrl, dimensions };
+};
+
 /**
  * Tunables for the standalone {@link MaterializationScheduler}. Sourced from
  * environment variables at startup; see {@link getMaterializationSchedulerConfig}.
@@ -480,6 +547,74 @@ export const getExtensionFetchPolicy = (): ExtensionFetchPolicy => {
    );
 };
 
+/**
+ * The three `#@ persist storage=<conn>` deployment modes, read from
+ * `PERSIST_STORAGE_MODE`. This is a runtime kill switch — flipping DOWN must
+ * never fail an already-loaded package, only change how `storage=` is honored:
+ *
+ *  - `off` (default): `storage=` is inert. Sources build into (colocated) and serve
+ *    from their own warehouse exactly as before the feature existed; a source
+ *    that declares `storage=` is served live and surfaced as a package warning.
+ *    The safe resting state and the incident kill switch.
+ *  - `write-only`: builds materialize into the storage destination (so operators
+ *    can measure and inspect the tables), but the serve path still ignores
+ *    `storage=` and serves live. The de-risking / measurement rung.
+ *  - `on`: full end to end — build into storage AND serve via the virtual-source
+ *    transform, with a per-query fallback to live for anything the transform
+ *    cannot yet serve.
+ *
+ * The publisher NEVER hard-fails a package on `storage=` in any mode; any
+ * stricter "refuse a new package that uses storage= while off" policy is the
+ * caller's, not here (the mechanism/policy split).
+ */
+export type PersistStorageMode = "off" | "write-only" | "on";
+
+const PERSIST_STORAGE_MODES: readonly PersistStorageMode[] = [
+   "off",
+   "write-only",
+   "on",
+];
+
+/**
+ * Resolve the `storage=` deployment mode from `PERSIST_STORAGE_MODE`. Defaults
+ * to `off` (feature dark) when unset/empty; loud-fails on an unrecognized value
+ * so a typo can't silently leave the fleet in a surprising mode. Case-insensitive,
+ * like the sibling `PERSIST_COLLISION_ENFORCE`.
+ */
+export const getPersistStorageMode = (): PersistStorageMode => {
+   const raw = process.env.PERSIST_STORAGE_MODE;
+   if (raw === undefined || raw.trim() === "") return "off";
+   const value = raw.trim().toLowerCase();
+   if ((PERSIST_STORAGE_MODES as readonly string[]).includes(value)) {
+      return value as PersistStorageMode;
+   }
+   throw new Error(
+      `PERSIST_STORAGE_MODE must be one of ${PERSIST_STORAGE_MODES.join(
+         " | ",
+      )} (got ${JSON.stringify(raw)})`,
+   );
+};
+
+/**
+ * Whether a within-package persist-target COLLISION (two distinct persist
+ * sources resolving to the same physical table in the same destination) is a
+ * hard publish rejection, from `PERSIST_COLLISION_ENFORCE` (default `false`).
+ *
+ * Staged on purpose: a package published BEFORE this check existed may carry a
+ * latent collision, so the check ships warn-only — surfaced at load and publish
+ * (so operators can find and remediate) but NOT blocking a re-publish. Flip this
+ * to `true` only after auditing and remediating known collisions, so the
+ * transition to reject-at-publish is deliberate and doesn't break routine
+ * re-publishes of existing packages. Load is ALWAYS warn-only regardless — the
+ * flag only governs whether publish rejects.
+ */
+export const getPersistCollisionEnforce = (): boolean =>
+   // parseBoolEnv, not an ad-hoc === "true": an operator who writes `1` or `yes`
+   // has asked for the check to block, and an ad-hoc compare would silently leave
+   // it warn-only — the flag failing open in exactly the direction it exists to
+   // prevent. A typo throws at startup, like every other flag here.
+   parseBoolEnv("PERSIST_COLLISION_ENFORCE") ?? false;
+
 function substituteEnvVars(value: string): string {
    const envVarPattern = /\$\{([A-Z_][A-Z0-9_]*)\}/g;
 

package/src/controller/materialization.controller.spec.ts

@@ -128,6 +128,68 @@ describe("MaterializationController.createMaterialization validation", () => {
       });
    });
 
+   it("preserves the storage `destination` on a build instruction", async () => {
+      // Regression: `destination` is the orchestrated `storage=` axis. Dropping it
+      // here silently downgrades an orchestrated build to a colocated
+      // build, so it never materializes into the storage destination.
+      const parsed = await parse({
+         buildInstructions: {
+            sources: [
+               {
+                  sourceEntityId: "b2",
+                  materializedTableId: "mt-2",
+                  physicalTableName: "downstream_v1",
+                  realization: "COPY",
+                  destination: "lake",
+               },
+            ],
+         },
+      });
+      expect(parsed.buildInstructions).toEqual([
+         {
+            sourceEntityId: "b2",
+            sourceID: undefined,
+            materializedTableId: "mt-2",
+            physicalTableName: "downstream_v1",
+            realization: "COPY",
+            destination: "lake",
+         },
+      ]);
+   });
+
+   it("preserves the optional `connectionName` on a manifest reference", async () => {
+      // Regression: `connectionName` (added by #904) lets the seed loop dialect-
+      // quote the referenced upstream for a case-folding engine. Dropping it here
+      // silently reverts to an unquoted seed — the same manual-copy drift that
+      // dropped BuildInstruction.destination.
+      const parsed = await parse({
+         buildInstructions: {
+            sources: [
+               {
+                  sourceEntityId: "b2",
+                  materializedTableId: "mt-2",
+                  physicalTableName: "downstream_v1",
+                  realization: "COPY",
+               },
+            ],
+            referenceManifest: [
+               {
+                  sourceEntityId: "b1",
+                  physicalTableName: "upstream_table",
+                  connectionName: "sf",
+               },
+            ],
+         },
+      });
+      expect(parsed.referenceManifest).toEqual([
+         {
+            sourceEntityId: "b1",
+            physicalTableName: "upstream_table",
+            connectionName: "sf",
+         },
+      ]);
+   });
+
    it("rejects a referenceManifest entry missing a required field", async () => {
       const { controller } = build();
       await expect(

package/src/controller/materialization.controller.ts

@@ -141,6 +141,14 @@ export class MaterializationController {
       return {
          sourceEntityId: ref.sourceEntityId as string,
          physicalTableName: ref.physicalTableName as string,
+         // The connection the upstream table lives on. Optional; carried through
+         // so the seed loop can dialect-quote the reference for a case-folding
+         // engine (#904). Dropping it silently reverts to an unquoted seed, which
+         // fails a downstream build on such an engine — the same manual-copy drift
+         // that dropped BuildInstruction.destination.
+         ...(typeof ref.connectionName === "string"
+            ? { connectionName: ref.connectionName }
+            : {}),
       };
    }
 
@@ -179,6 +187,13 @@ export class MaterializationController {
          materializedTableId: instruction.materializedTableId as string,
          physicalTableName: instruction.physicalTableName as string,
          realization: instruction.realization,
+         // The `storage=` destination the orchestrator targets. Optional in the
+         // schema; must be carried through, or an orchestrated build silently
+         // falls back to a colocated build (isStorageBuild=false) and
+         // never materializes into the storage destination.
+         ...(typeof instruction.destination === "string"
+            ? { destination: instruction.destination }
+            : {}),
       };
    }
 

package/src/controller/package.controller.spec.ts

@@ -19,6 +19,7 @@ describe("PackageController.addPackage explores validation", () => {
       const mockPackage = {
          formatInvalidExplores: () => invalidMsg,
          formatInvalidPersistencePolicy: () => "",
+         formatPersistenceCollisionRejections: () => "",
       };
       const unloadPackage = sinon.stub().resolves(undefined);
       const deletePackage = sinon.stub().resolves(undefined);
@@ -56,6 +57,7 @@ describe("PackageController.addPackage explores validation", () => {
       const mockPackage = {
          formatInvalidExplores: () => invalidMsg,
          formatInvalidPersistencePolicy: () => "",
+         formatPersistenceCollisionRejections: () => "",
       };
       // installPackage mimics the real contract: invoke the validator and, if it
       // returns a message, throw BadRequestError (after its internal rollback).
@@ -105,6 +107,7 @@ describe("PackageController.addPackage explores validation", () => {
       const mockPackage = {
          formatInvalidExplores: () => "",
          formatInvalidPersistencePolicy: () => "",
+         formatPersistenceCollisionRejections: () => "",
       };
       const addPackage = sinon.stub().resolves(mockPackage);
       const getEnvironment = sinon.stub().resolves({ addPackage });
@@ -143,6 +146,7 @@ describe("PackageController.addPackage persistence policy validation", () => {
       const mockPackage = {
          formatInvalidExplores: () => "",
          formatInvalidPersistencePolicy: () => cronMsg,
+         formatPersistenceCollisionRejections: () => "",
       };
       const unloadPackage = sinon.stub().resolves(undefined);
       const addPackage = sinon.stub().resolves(mockPackage);
@@ -172,6 +176,7 @@ describe("PackageController.addPackage persistence policy validation", () => {
       const mockPackage = {
          formatInvalidExplores: () => "",
          formatInvalidPersistencePolicy: () => cronMsg,
+         formatPersistenceCollisionRejections: () => "",
       };
       const installPackage = sinon
          .stub()
@@ -226,6 +231,7 @@ describe("PackageController.updatePackage explores validation", () => {
          formatInvalidExplores: (override?: string[]) =>
             override?.includes("nope.malloy") ? invalidMsg : "",
          formatInvalidPersistencePolicy: () => "",
+         formatPersistenceCollisionRejections: () => "",
       };
       const installPackage = sinon
          .stub()

package/src/controller/package.controller.ts

@@ -18,19 +18,24 @@ export type PackageReloadMode = "in-place" | "reinstalled";
  * the Malloy Persistence policy gate (scope is package-level; a
  * `materialization.schedule` is package-root-only + version-scope-only and
  * mutually exclusive with freshness; per-source `sharing`/`schedule` are
- * retired — see Package.persistencePolicyWarnings). At startup/reload both are
- * warn-only instead (fail-safe; see Package.loadViaWorker).
+ * retired — see Package.persistencePolicyWarnings), plus persist-target
+ * collisions ONLY when `PERSIST_COLLISION_ENFORCE` is set (otherwise those are
+ * surfaced warn-only so a pre-existing latent collision doesn't block a routine
+ * re-publish — see Package.formatPersistenceCollisionRejections). At
+ * startup/reload all are warn-only instead (fail-safe; see Package.loadViaWorker).
  */
 function formatPublishRejections(
    pkg: {
       formatInvalidExplores(exploresOverride?: string[]): string;
       formatInvalidPersistencePolicy(): string;
+      formatPersistenceCollisionRejections(): string;
    },
    exploresOverride?: string[],
 ): string | undefined {
    const message = [
       pkg.formatInvalidExplores(exploresOverride),
       pkg.formatInvalidPersistencePolicy(),
+      pkg.formatPersistenceCollisionRejections(),
    ]
       .filter(Boolean)
       .join("\n");

package/src/errors.ts

@@ -24,6 +24,8 @@ export function internalErrorToHttpError(error: Error) {
       return httpError(422, error.message);
    } else if (error instanceof UnsupportedCatalogFormatError) {
       return httpError(422, error.message);
+   } else if (error instanceof MaterializationEligibilityError) {
+      return httpError(422, error.message);
    } else if (error instanceof ModelCompilationError) {
       return httpError(424, error.message);
    } else if (error instanceof ConnectionError) {
@@ -122,6 +124,23 @@ export class ModelCompilationError extends Error {
    }
 }
 
+/**
+ * A persist source was asked to materialize into a `storage=` destination (the
+ * DuckDB/DuckLake tier) but is ineligible: it has an unbound free parameter, it
+ * references a given (an RLAC/tenant-isolation refusal), or its served shape
+ * does not compile in DuckDB. Mapped to HTTP **422** (the request is
+ * well-formed, but the source cannot be processed into a materialized artifact)
+ * — a hard refuse, never a silent fallback. Kept a distinct class so the
+ * givens/RLAC refusal is greppable for security review. Accepts a
+ * message-bearing object to match {@link ModelCompilationError}'s ergonomics.
+ */
+export class MaterializationEligibilityError extends Error {
+   constructor(error: { message: string }) {
+      super(error.message);
+      this.name = "MaterializationEligibilityError";
+   }
+}
+
 export class FrozenConfigError extends Error {
    constructor(
       message = `Publisher config can't be updated when ${PUBLISHER_CONFIG_NAME} has { "frozenConfig": true }`,

package/src/logger.spec.ts

@@ -1,8 +1,25 @@
 import { describe, expect, it } from "bun:test";
 import type { AxiosError } from "axios";
-import { buildAxiosErrorLog, redactSensitive } from "./logger";
+import {
+   SENSITIVE_KEY_NAMES,
+   buildAxiosErrorLog,
+   redactSensitive,
+} from "./logger";
 
 describe("redactSensitive", () => {
+   it("redacts every name in SENSITIVE_KEY_NAMES (reflective lock)", () => {
+      // Iterates the list itself so a newly-added credential field cannot
+      // be introduced without redaction, and pins apiKey/api_key.
+      const input: Record<string, string> = {};
+      for (const name of SENSITIVE_KEY_NAMES) input[name] = "leak-me";
+      const out = redactSensitive(input) as Record<string, unknown>;
+      for (const name of SENSITIVE_KEY_NAMES) {
+         expect(out[name]).toBe("[REDACTED]");
+      }
+      expect(SENSITIVE_KEY_NAMES).toContain("apiKey");
+      expect(SENSITIVE_KEY_NAMES).toContain("api_key");
+   });
+
    it("masks every known credential field at the top level", () => {
       const input = {
          password: "hunter2",

package/src/logger.ts

@@ -91,7 +91,7 @@ export function formatDuration(durationMs: number): string {
 // headers (Authorization, Cookie). Those values are masked by key name before
 // they reach a log transport. Matching is case-insensitive so header casing
 // (Authorization vs authorization) does not slip through.
-const SENSITIVE_KEY_NAMES = [
+export const SENSITIVE_KEY_NAMES = [
    // connection config credentials
    "password",
    "connectionString",
@@ -107,6 +107,8 @@ const SENSITIVE_KEY_NAMES = [
    "peakaKey",
    "token",
    "accessToken",
+   "apiKey",
+   "api_key",
    // credential-bearing HTTP headers
    "authorization",
    "proxy-authorization",

package/src/materialization_metrics.spec.ts

@@ -1,10 +1,16 @@
 import { afterEach, beforeEach, describe, expect, it } from "bun:test";
 
 import {
+   recordChainedStorageBuild,
    recordConnectionDigestSkipped,
    recordDropTables,
+   recordEligibilityRefused,
    recordMaterializationRun,
+   recordServeShapeTierDrop,
+   recordServeShapeTypeFallback,
    recordSourcesOutcome,
+   recordStorageBuildFailure,
+   recordStorageServeRouting,
    resetMaterializationTelemetryForTesting,
 } from "./materialization_metrics";
 import {
@@ -64,15 +70,21 @@ describe("materialization_metrics", () => {
       ).toBe(2);
    });
 
-   it("counts drop-table outcomes and connection-digest skips", async () => {
-      recordDropTables("success");
-      recordDropTables("failure");
+   it("counts drop-table outcomes (labeled by engine) and connection-digest skips", async () => {
+      recordDropTables("success", "storage");
+      recordDropTables("failure", "in_warehouse");
       recordConnectionDigestSkipped();
 
       expect(
          await harness.collectCounter(
             "publisher_materialization_drop_tables_total",
-            { outcome: "failure" },
+            { outcome: "failure", engine: "in_warehouse" },
+         ),
+      ).toBe(1);
+      expect(
+         await harness.collectCounter(
+            "publisher_materialization_drop_tables_total",
+            { outcome: "success", engine: "storage" },
          ),
       ).toBe(1);
       expect(
@@ -81,4 +93,77 @@ describe("materialization_metrics", () => {
          ),
       ).toBe(1);
    });
+
+   it("counts storage= serve-routing decisions labeled by outcome", async () => {
+      recordStorageServeRouting("storage");
+      recordStorageServeRouting("storage");
+      recordStorageServeRouting("live_fallback");
+
+      expect(
+         await harness.collectCounter("publisher_storage_serve_routing_total", {
+            outcome: "storage",
+         }),
+      ).toBe(2);
+      expect(
+         await harness.collectCounter("publisher_storage_serve_routing_total", {
+            outcome: "live_fallback",
+         }),
+      ).toBe(1);
+   });
+
+   it("counts chained storage builds labeled by outcome", async () => {
+      recordChainedStorageBuild("parent_reuse");
+      recordChainedStorageBuild("parent_reuse");
+      recordChainedStorageBuild("inline_fallback");
+      recordChainedStorageBuild("strict_refused");
+
+      expect(
+         await harness.collectCounter("publisher_storage_chained_build_total", {
+            outcome: "parent_reuse",
+         }),
+      ).toBe(2);
+      expect(
+         await harness.collectCounter("publisher_storage_chained_build_total", {
+            outcome: "inline_fallback",
+         }),
+      ).toBe(1);
+      expect(
+         await harness.collectCounter("publisher_storage_chained_build_total", {
+            outcome: "strict_refused",
+         }),
+      ).toBe(1);
+   });
+
+   it("counts storage build failures, eligibility refusals, tier drops, and type fallbacks", async () => {
+      recordStorageBuildFailure("lake");
+      recordEligibilityRefused("given");
+      recordEligibilityRefused("free_parameter");
+      recordServeShapeTierDrop(0);
+      recordServeShapeTypeFallback("array");
+
+      expect(
+         await harness.collectCounter(
+            "publisher_storage_build_failures_total",
+            { destination: "lake" },
+         ),
+      ).toBe(1);
+      expect(
+         await harness.collectCounter(
+            "publisher_materialization_eligibility_refused_total",
+            { reason: "given" },
+         ),
+      ).toBe(1);
+      expect(
+         await harness.collectCounter(
+            "publisher_storage_serve_shape_tier_drop_total",
+            { tier: "0" },
+         ),
+      ).toBe(1);
+      expect(
+         await harness.collectCounter(
+            "publisher_storage_serve_shape_type_fallback_total",
+            { kind: "array" },
+         ),
+      ).toBe(1);
+   });
 });