@sema-agent/server 7.147.0 → 7.148.0

package/dist/session-rules-seat.js

@@ -0,0 +1,19 @@
+import { personOf } from "./owner-brands.js";
+import { recoveredSubject } from "./owner-faces.js";
+export function createEngineSessionRulesSeat(store, headOf) {
+    const keyFor = async (sessionId, principal) => {
+        if (principal === undefined || headOf === undefined)
+            return principal;
+        const owner = (await headOf(sessionId))?.owner;
+        if (owner === undefined || owner === null)
+            return principal;
+        return personOf(recoveredSubject(owner)) === principal ? owner : principal;
+    };
+    return {
+        getRules: async (sessionId, principal) => store.getRules(sessionId, await keyFor(sessionId, principal)),
+        putRules: async (sessionId, principal, rules, opts) => store.putRules(sessionId, await keyFor(sessionId, principal), rules, opts),
+        ...(store.listBySession !== undefined ? { listBySession: store.listBySession.bind(store) } : {}),
+        ...(store.deleteBySession !== undefined ? { deleteBySession: store.deleteBySession.bind(store) } : {}),
+    };
+}
+//# sourceMappingURL=session-rules-seat.js.map

package/dist/session-titler.d.ts

@@ -11,7 +11,9 @@
  * "Has it a title?" is read from the column on every submit (one point read) — the process keeps NO "already titled"
  * memo, because such a memo would be a second answer to that question that a clear turns stale. Generation = one
  * cheap-model one-liner via the deployment's hookLlm face (summarize role → MODEL_CHEAP_ID when configured, else the
- * main model; bounded + timed out).
+ * main model; bounded + timed out), asked at the LOWEST REASONING SEAT (`reasoningSeat: "lowest"`: a one-line title is
+ * not worth a thinking pass — thinking off where the model's wire can spell it, `low` where it cannot; the keys come from
+ * core's one dialect table and the output cap is sized for the answer plus that tier's thinking, both owned by the llm face).
  *
  * WRITE-AFTER NOTICE: the title that lands is announced to the run that triggered it — `maybeTitle`'s `onTitled` hands the
  * seat (`run-acceptance.ts`) the one `session_titled` frame (`session-titled-frame.ts`, contract §4a-ttl) built from the
@@ -24,7 +26,7 @@
  * session; the store's IS NULL guard closes the cross-replica race (double generation costs one extra cheap
  * call at worst, and exactly one title lands).
  */
-import type { HookLlmFailureCode } from "./hooks/hook-runner.js";
+import type { HookLlmCall } from "./hooks/hook-runner.js";
 import { type SessionTitledFrame } from "./session-titled-frame.js";
 export interface SessionTitlerDeps {
     /** Write-once store leg (SQL twins / local sidecar). Resolves false when a title already existed. */
@@ -35,19 +37,9 @@ export interface SessionTitlerDeps {
      *  and if still absent, release the seen slot so the NEXT submit retries (never a permanently-untitled
      *  session via a swallowed early UPDATE-0). Local lane has no row-existence dimension → never "none". */
     probeTitle(sessionId: string): Promise<"none" | "untitled" | "titled">;
-    /** The deployment's cheap one-shot LLM face (main.ts hookLlm — summarize role default). */
-    llm(opts: {
-        prompt: string;
-        timeoutMs: number;
-        model?: string;
-    }): Promise<{
-        ok: true;
-        text: string;
-    } | {
-        ok: false;
-        error: string;
-        code?: HookLlmFailureCode;
-    }>;
+    /** The deployment's cheap one-shot LLM face (main.ts hookLlm — summarize role default). The face's own type, not a
+     *  second spelling of it: the titler declares its reasoning seat (`reasoningSeat`) on this call and the face honors it. */
+    llm: HookLlmCall;
     logger?: {
         debug?(msg: string, meta?: unknown): void;
         info?(msg: string, meta?: unknown): void;

package/dist/session-titler.js

@@ -79,7 +79,7 @@ export function createSessionTitler(deps) {
                     deps.metrics?.inc("session_title_total", { outcome: "already_titled" });
                     return;
                 }
-                const r = await deps.llm({ prompt: buildTitlePrompt(objective), timeoutMs: LLM_TIMEOUT_MS, model });
+                const r = await deps.llm({ prompt: buildTitlePrompt(objective), timeoutMs: LLM_TIMEOUT_MS, model, reasoningSeat: "lowest" });
                 if (!r.ok) {
                     deps.metrics?.inc("session_title_total", { outcome: "llm_failed" });
                     logFailure(sessionId, r.error, r.code);

package/dist/spec-fields.d.ts

@@ -78,12 +78,60 @@ export declare const MAX_TASK_AGENTS = 32;
  * `ruleEntryListShapeOk`):引擎直接 `for (const entry of list)` —— 一个裸字符串 `"Bash"` 会被逐字符迭代成 `B` / `a` / `s` / `h` 四条
  * (deny 侧 = 意图静默落空,安全轴上的放宽方向)。条目的**文法与名字**是引擎的读法:允侧读不出的条目(`*` / 写路径 / 域名 / 退役名 …)引擎在开跑时发
  * `permission.allowed_tool_not_granted`(受众 = 用户);拒侧读成空的条目(文法或名字层)在 `resolveSpec` 拒(提交 400 / 续跑 409,`rule-entry-list.ts` 的
- * `inertToolListEntryOf`,判据 = 引擎的条目读法;同一只函数也拒请求的工具名选择器清单里的近似名 / 退役名)。
+ * `inertToolListEntryOf`,判据 = 引擎的条目读法;同一只函数也拒请求的工具名选择器清单里的近似名 / 有后继的退役名;限制侧**没有后继**的退役名 core 7.66.0 起不拒,引擎保留这一行并发 `config.legacy_tool_name`)。
  * **条数帽**是全部工具名清单的同一只判(`rule-entry-list.ts` 的 `skillToolListsOverCap`;句子与机读位 `field` 点体内坐标 `skills[1].allowedTools` /
  * `agents[0].skills[2].disallowedTools`):顶层 `validateUserSkills` 与子代 {@link validateTaskAgents} 两道门都逐条先形、后帽(与 7.131.0 的拒点与判序同);
  * 拒点 `resolveSpec` 两腿同经的 `inertToolListEntryOf` 先过同一只判;无长度帽([ref])。
  */
 export declare const skillToolListOk: (v: unknown) => v is readonly string[];
+/**
+ * = core `SKILL_CONTENT_MAX_CHARS`(1 MiB 加载门;core 1.293 起 invoke 全文零截断、超 1 MiB 整拒;常量在 `dist/core/runner/synthetic-tools.js`,
+ * 未从 core 包根导出,故钉本地孪生 + 本出处注记)。两道技能门(顶层 `body.skills[i]` 与子代 `agents[a].skills[j]`)读这**一只**:同值两名就是第二个会漂的域。
+ * 🔴 这是技能面**唯一**剩下的尺寸门,而且它不是超集帽:引擎在装配期对超 1 MiB 的技能本就整拒,门上先答只是把同一个判决搬到调用方看得懂的地方
+ * ([ref] 退役的三条帽 —— 条数 / description / name 长度 —— 都没有这个性质)。
+ */
+export declare const MAX_SKILL_CONTENT_CHARS = 1048576;
+/**
+ * 请求面技能上**有名而不收**的键:每只一句句尾,两道门同字节(拒句 = 体内坐标 + 句尾)。本表只给**话**;键在不在由 {@link namedRefusalOf} 答。
+ *  · `manifest` —— core 7.41.0 [ref] 退役(硬破坏,零别名);出路只点本服务上真存在的旋钮:两只清单、deny 规则 / 子代 `allowTools`、会话规则 `allowDirs`。
+ *    任何值都拒(`null` / 空对象同样是「我带了 manifest」),不翻译成 `allowedTools`(那是放宽方向);
+ *  · `mods` —— core 7.56.0 [ref] 的技能座扩展注册(带 `register` 函数的代码对象),不是请求数据(JSON 带不过函数);任何值都拒。
+ */
+export declare const SKILL_NAMED_REFUSALS: {
+    readonly manifest: "was retired in core 7.41.0 — a skill's tools are its allowedTools / disallowedTools now (an allow-rule and a deny-rule source for the run the skill is activated in, never a fence); move manifest.allowTools to allowedTools. To fence tools use deny rules (settings.permissions.deny) or a delegated agent's allowTools; to fence write paths use the session rules' allowDirs";
+    readonly mods: "is not a request key — skill registrations are code the deployment mounts, not request data (this server does not compile skill hooks: GET /v1/capabilities answers mods.skill_seat: false)";
+};
+/** 一键的撞帽读数(形对、只是超了帽;量纲 / 送来的量 / 帽)。形错不是撞帽 —— 那一形只有句子。 */
+interface SkillFieldLimit {
+    readonly measure: LimitMeasure;
+    readonly count: number;
+    readonly cap: number;
+}
+/**
+ * 一条技能的问题 —— **数据,不带坐标**:`key` = 出问题的那一键(缺席 = 这条技能本身不是对象)、`words` = 这一键的话(句尾)、撞帽另带读数。
+ * 坐标由调用方给({@link skillRefusalAt} 一处铸句子与机读位),所以两道门的句尾逐字节同。
+ */
+export interface SkillItemIssue {
+    readonly key?: string;
+    readonly words: string;
+    readonly limit?: SkillFieldLimit;
+}
+/**
+ * **一条技能的唯一判官**(顶层 `validateUserSkills` 与子代 {@link taskAgentIssue} 都只调它):合形 ⇒ `null`;否则第一处问题({@link SkillItemIssue})。
+ * 判序:不是对象 ⇒ 整条;点名拒的两只({@link namedRefusalOf})→ 键序逐键过闭集(未知键);再按键表序判必填与形(撞帽的形对键带读数)。
+ * 键判断用 `Object.hasOwn`:`in` 走原型链,JSON 里的 "toString" / "constructor" 键会被误判成白名单字段(与 {@link taskAgentIssue} 同一条教训)。
+ * 调用方写的键名过唯一回显口径(有界、剥控制 / 双向字符)再进句子与坐标。
+ */
+export declare function skillItemIssue(skill: unknown): SkillItemIssue | null;
+/** 一条技能的拒(两道门同形):句子 = `<坐标> <这一键的话>`;机读位 `field` = 那一键的体内坐标,撞帽另带 `reason` / `count` / `cap`。 */
+export interface SkillItemRefusal {
+    readonly message: string;
+    readonly facts: {
+        readonly field: string;
+    } | LimitFacts;
+}
+/** 把 {@link skillItemIssue} 的问题铸成坐标 `at`(`skills[0]` / `agents[1].skills[2]`)上的拒 —— 句子与机读位的唯一铸点。 */
+export declare function skillRefusalAt(at: string, issue: SkillItemIssue): SkillItemRefusal;
 /**
  * 一条子代定义的裁决:`message` = 一句可 400 的英文(不带下标,调用方加);撞帽时另带 `limit`(`rel` = 相对这条定义的坐标 `allowTools[3]` / `name`),
  * 句子是撞帽的头一句(`agent.allowTools[3] has 129 characters — at most 128 are accepted`:撞了哪一条帽、送来多少、帽多少),
@@ -97,11 +145,16 @@ export interface TaskAgentIssue {
         readonly count: number;
         readonly cap: number;
     };
+    /** 问题在这条定义的第 `index` 条技能上(技能判官的问题,不带坐标)—— {@link validateTaskAgents} 以体内坐标 `agents[i].skills[index]` 铸拒({@link skillRefusalAt})。 */
+    readonly skill?: {
+        readonly index: number;
+        readonly issue: SkillItemIssue;
+    };
 }
-/** 提交体 `agents` 的拒:句子(带下标)+ 撞帽时的机读位(`field` / `reason` / `count` / `cap`,`limit-refusal.ts` 一处铸)。 */
+/** 提交体 `agents` 的拒:句子(带下标)+ 机读位(撞帽:`field` / `reason` / `count` / `cap`,`limit-refusal.ts` 一处铸;技能那一层的每一只拒带 `field`,{@link skillRefusalAt})。 */
 export interface TaskAgentsRefusal {
     readonly message: string;
-    readonly facts?: LimitFacts;
+    readonly facts?: SkillItemRefusal["facts"];
 }
 /** [ref] 单条 agent 定义的形状裁决:null=合法;否则一句可 400 的英文错误(不带索引,调用方自己加)。
  *  白名单外键 fail-loud —— 与 resilience/limits 的「容忍未知键」相反:agents 是能力定义,静默丢字段 =
@@ -262,4 +315,5 @@ export declare function normalizeApproachNotice(raw: unknown): false | {
  * 全空 ⇒ undefined(spec 不挂 limits 键,byte-compat)。
  */
 export declare function resolveTaskLimits(bodyLimits: unknown, caps: TaskLimitCaps, envTimeoutSec: number, requirePrincipal: boolean | undefined, warn?: (event: string, fields: Record<string, unknown>) => void): TaskSpec["limits"];
+export {};
 //# sourceMappingURL=spec-fields.d.ts.map

package/dist/spec-fields.js

@@ -3,7 +3,8 @@ import { taskWallClockSec } from "./task-workflow.js";
 import { ABSOLUTE_HOST_PATH_MAX, isAbsoluteHostPath } from "@sema-agent/settings-schema";
 import { ruleEntryListShapeOk, skillToolListsOverCap } from "./rule-entry-list.js";
 import { describeLimit, limitFacts, limitRefusal } from "./limit-refusal.js";
-import { quotedCallerText } from "./caller-text-echo.js";
+import { echoCallerText, quotedCallerText } from "./caller-text-echo.js";
+import { skillCarriesRetiredManifest } from "./http/retired-skill-manifest.js";
 export function normalizeSuggestNextPrompts(v) {
     if (v === true)
         return true;
@@ -77,7 +78,6 @@ const MAX_AGENT_TEXT_CHARS = 4_096;
 const MAX_AGENT_SYSTEM_PROMPT_CHARS = 65_536;
 const MAX_AGENT_TOOLS = 64;
 const MAX_AGENT_TOOL_NAME_CHARS = 128;
-const MAX_AGENT_SKILL_CONTENT_CHARS = 1_048_576;
 const MAX_AGENT_MAX_TURNS = 1_000;
 const boundedString = (max) => (v) => typeof v === "string" && v.length <= max;
 const toolList = (v) => Array.isArray(v) &&
@@ -96,54 +96,69 @@ const toolListLimit = (v) => {
 };
 const plainObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
 export const skillToolListOk = ruleEntryListShapeOk;
-const skillFilesOk = (v) => Array.isArray(v) &&
-    v.every((f) => plainObject(f) && typeof f.path === "string" && f.path.length > 0 && typeof f.content === "string");
+const SKILL_TOOL_LIST_DESC = "an array of strings (permission-rule spellings: a tool name, mcp__<server> / mcp__<server>__*, Bash(<prefix>:*), Read(//<dir>/**))";
+export const MAX_SKILL_CONTENT_CHARS = 1_048_576;
+export const SKILL_NAMED_REFUSALS = {
+    manifest: "was retired in core 7.41.0 — a skill's tools are its allowedTools / disallowedTools now (an allow-rule and a deny-rule source for the run the skill is activated in, never a fence); move manifest.allowTools to allowedTools. To fence tools use deny rules (settings.permissions.deny) or a delegated agent's allowTools; to fence write paths use the session rules' allowDirs",
+    mods: "is not a request key — skill registrations are code the deployment mounts, not request data (this server does not compile skill hooks: GET /v1/capabilities answers mods.skill_seat: false)",
+};
+const skillCharLimit = (max) => (v) => typeof v === "string" && v.length > max ? { measure: "characters", count: v.length, cap: max } : undefined;
 const SKILL_FIELD_SHAPES = {
-    name: { required: true, ok: (v) => typeof v === "string" && v.length > 0 },
-    description: { required: true, ok: (v) => typeof v === "string" },
-    content: { required: true, ok: (v) => typeof v === "string" && v.length > 0 && v.length <= MAX_AGENT_SKILL_CONTENT_CHARS },
-    allowedTools: { required: false, ok: skillToolListOk },
-    disallowedTools: { required: false, ok: skillToolListOk },
-    files: { required: false, ok: skillFilesOk },
-    baseDir: { required: false, ok: isAbsoluteHostPath },
-    mods: { required: false, ok: () => false },
+    name: { required: true, desc: "a non-empty string", ok: (v) => typeof v === "string" && v.length > 0 },
+    description: { required: true, desc: "a string", ok: (v) => typeof v === "string" },
+    content: {
+        required: true,
+        desc: `a non-empty string of at most ${MAX_SKILL_CONTENT_CHARS} characters (the engine rejects skills over this size outright at load time)`,
+        ok: (v) => typeof v === "string" && v.length > 0 && v.length <= MAX_SKILL_CONTENT_CHARS,
+        limit: skillCharLimit(MAX_SKILL_CONTENT_CHARS),
+    },
+    allowedTools: { required: false, desc: SKILL_TOOL_LIST_DESC, ok: skillToolListOk },
+    disallowedTools: { required: false, desc: SKILL_TOOL_LIST_DESC, ok: skillToolListOk },
+    files: {
+        required: false,
+        desc: "an array of { path, content } entries (path a non-empty string, content a string)",
+        ok: (v) => Array.isArray(v) && v.every((f) => plainObject(f) && typeof f.path === "string" && f.path.length > 0 && typeof f.content === "string"),
+    },
+    baseDir: {
+        required: false,
+        desc: `an absolute path string of at most ${ABSOLUTE_HOST_PATH_MAX} characters with no ".." segment and no NUL byte (it is not resolved or read here — the engine only substitutes it into the skill's own text)`,
+        ok: isAbsoluteHostPath,
+        limit: skillCharLimit(ABSOLUTE_HOST_PATH_MAX),
+    },
 };
-const skillOk = (s) => {
-    if (!plainObject(s))
-        return false;
-    for (const k of Object.keys(s)) {
-        if (!Object.hasOwn(SKILL_FIELD_SHAPES, k))
-            return false;
+const SKILL_UNKNOWN_KEY_TAIL = `is not a skill key — a skill carries ${Object.keys(SKILL_FIELD_SHAPES)
+    .filter((k) => SKILL_FIELD_SHAPES[k].required)
+    .join(", ")} and optionally ${Object.keys(SKILL_FIELD_SHAPES)
+    .filter((k) => !SKILL_FIELD_SHAPES[k].required)
+    .join(", ")}`;
+function namedRefusalOf(skill) {
+    if (skillCarriesRetiredManifest(skill))
+        return "manifest";
+    return Object.hasOwn(skill, "mods") ? "mods" : undefined;
+}
+export function skillItemIssue(skill) {
+    if (!plainObject(skill))
+        return { words: "must be an object { name, description, content }" };
+    const named = namedRefusalOf(skill);
+    if (named !== undefined)
+        return { key: named, words: SKILL_NAMED_REFUSALS[named] };
+    for (const key of Object.keys(skill)) {
+        if (!Object.hasOwn(SKILL_FIELD_SHAPES, key))
+            return { key: echoCallerText(key), words: SKILL_UNKNOWN_KEY_TAIL };
     }
-    for (const [k, shape] of Object.entries(SKILL_FIELD_SHAPES)) {
-        const v = s[k];
-        if (v === undefined) {
-            if (shape.required)
-                return false;
+    for (const [key, shape] of Object.entries(SKILL_FIELD_SHAPES)) {
+        const v = skill[key];
+        if (v === undefined ? !shape.required : shape.ok(v))
             continue;
-        }
-        if (!shape.ok(v))
-            return false;
-    }
-    return true;
-};
-const skillsLimit = (v) => {
-    if (!Array.isArray(v))
-        return undefined;
-    const j = v.findIndex((s) => !skillOk(s));
-    const s = j < 0 ? undefined : v[j];
-    if (!plainObject(s))
-        return undefined;
-    const content = s["content"];
-    const baseDir = s["baseDir"];
-    if (typeof content === "string" && content.length > MAX_AGENT_SKILL_CONTENT_CHARS) {
-        return { sub: `[${j}].content`, measure: "characters", count: content.length, cap: MAX_AGENT_SKILL_CONTENT_CHARS, keepShapeSentence: true };
+        const limit = v === undefined ? undefined : shape.limit?.(v);
+        return { key, words: `must be ${shape.desc}`, ...(limit === undefined ? {} : { limit }) };
     }
-    if (typeof baseDir === "string" && baseDir.length > ABSOLUTE_HOST_PATH_MAX) {
-        return { sub: `[${j}].baseDir`, measure: "characters", count: baseDir.length, cap: ABSOLUTE_HOST_PATH_MAX, keepShapeSentence: true };
-    }
-    return undefined;
-};
+    return null;
+}
+export function skillRefusalAt(at, issue) {
+    const field = issue.key === undefined ? at : `${at}.${issue.key}`;
+    return { message: `${field} ${issue.words}`, facts: issue.limit === undefined ? { field } : limitFacts(field, issue.limit.measure, issue.limit.count, issue.limit.cap) };
+}
 const memoryOk = (v) => {
     if (!plainObject(v))
         return false;
@@ -171,11 +186,7 @@ const TASK_AGENT_FIELD_SHAPES = {
     whenToUseLean: { desc: `a string of at most ${MAX_AGENT_TEXT_CHARS} characters`, ok: boundedString(MAX_AGENT_TEXT_CHARS), limit: charLimit(MAX_AGENT_TEXT_CHARS) },
     allowTools: { desc: `an array of at most ${MAX_AGENT_TOOLS} non-empty strings of at most ${MAX_AGENT_TOOL_NAME_CHARS} characters each`, ok: toolList, limit: toolListLimit },
     denyTools: { desc: `an array of at most ${MAX_AGENT_TOOLS} non-empty strings of at most ${MAX_AGENT_TOOL_NAME_CHARS} characters each`, ok: toolList, limit: toolListLimit },
-    skills: {
-        desc: "an array of { name, description, content } skill objects (optional allowedTools/disallowedTools/files/baseDir; allowedTools/disallowedTools are arrays of strings; files entries need { path, content }; baseDir must be an absolute path with no \"..\" segment) — no count cap; the engine renders the listing within its own byte budget",
-        ok: (v) => Array.isArray(v) && v.every(skillOk),
-        limit: skillsLimit,
-    },
+    skills: { desc: "an array of skill objects — no count cap; the engine renders the listing within its own byte budget", ok: (v) => Array.isArray(v) },
     background: { desc: "a boolean", ok: (v) => typeof v === "boolean" },
     isolation: { desc: '"worktree"', ok: (v) => v === "worktree" },
     model: {
@@ -216,7 +227,15 @@ export function taskAgentIssue(item) {
             return { message: `agent.${k} must be ${shape.desc}` };
         const rel = `${k}${hit.sub}`;
         const limit = { rel, measure: hit.measure, count: hit.count, cap: hit.cap };
-        return hit.keepShapeSentence === true ? { message: `agent.${k} must be ${shape.desc}`, limit } : { message: describeLimit(`agent.${rel}`, hit.measure, hit.count, hit.cap), limit };
+        return { message: describeLimit(`agent.${rel}`, hit.measure, hit.count, hit.cap), limit };
+    }
+    const skills = rec.skills;
+    if (Array.isArray(skills)) {
+        for (let j = 0; j < skills.length; j++) {
+            const issue = skillItemIssue(skills[j]);
+            if (issue !== null)
+                return { message: skillRefusalAt(`agent.skills[${j}]`, issue).message, skill: { index: j, issue } };
+        }
     }
     return null;
 }
@@ -228,6 +247,8 @@ export function validateTaskAgents(v) {
     const names = new Set();
     for (let i = 0; i < v.length; i++) {
         const issue = taskAgentIssue(v[i]);
+        if (issue?.skill !== undefined)
+            return skillRefusalAt(`agents[${i}].skills[${issue.skill.index}]`, issue.skill.issue);
         if (issue) {
             const message = `agents[${i}]: ${issue.message}`;
             return issue.limit === undefined ? { message } : { message, facts: limitFacts(`agents[${i}].${issue.limit.rel}`, issue.limit.measure, issue.limit.count, issue.limit.cap) };

package/dist/store-posture.d.ts

@@ -1,22 +1,9 @@
-/**
- * [ref] ①(设计稿 v1.1 §2①)—— 「这台副本**真的在持久化吗**」的单一推导点:caps `store`、`/health.storeDegraded` / `durable:false`、
- * gauge `store_backend_degraded` 三面读**同一只装配值**({@link StorePosture},`boot/stores.ts` 铸一次)。
- *
- * ## 病
- * 7.105.0 及以前,店降级的痕迹是 gauge + `/health` 两位 + caps `sql:null` —— 而 `sql:null` 同时是「本来就没配 SQL」「local 文件店」
- * 「降级到内存」「最近一次连接初始化被拒」四件事;调用方分不清「以为在持久化,其实在内存」这最坏的一形。
- *
- * ## 形
- * `declared` = 运维的声明(`DB_BACKEND` 词,含缺省推导);`backend` = **装配出的**后端 kind(没装出后端 = `memory`);两者不等是合法的
- * 形(`DB_BACKEND=pg` + 坐标在场 + `SESSION_BACKEND=memory` = 声明 pg、刻意不持久 —— 坐标缺席的声明在配置期拒启,见 `sql-engine-coordinates.ts`;缺省推导 local 起不来)—— 两位都上 wire,
- * 由调用方自己读出落差。`degradedReason` present-iff 降级臂走过(按后端族定词,{@link storeDegradedReasonFor})。
- * 顶层 `sql` 并入 `store.sql`(硬 breaking,零别名;对象逐字同形)。
- */
 import type { StoreBackend as StoreBackendWord } from "@sema-agent/settings-schema/execution-lanes";
 import type { ServiceConfig } from "./config-types.js";
 import type { StoreBackend } from "./plugins/store-backend.js";
 import type { SqlEngineFacts } from "./plugins/sql-driver.js";
 import { type SqlEngineCapability } from "./sql-engine-posture.js";
+import { type MountRow, type MountTable } from "./mountinfo.js";
 /**
  * 降级词闭集(**按后端族**,不按失败发生在哪一步):
  *  · `local_unwritable` —— **缺省推导**的 local 文件店在**空 / 不存在**的数据根上构造期失败(mkdir / 权限 / 只读挂载 / 磁盘满)。
@@ -30,28 +17,137 @@ export type StoreDegradedReason = (typeof STORE_DEGRADED_REASONS)[number];
 /** 降级臂按后端族定词(穷举 switch:词表加员 ⇒ 编译红)。只有缺省推导的 `local` 走得到降级臂;`mysql` / `pg` / `memory` 走到这里 = 装配缺陷,响亮抛。 */
 export declare function storeDegradedReasonFor(declared: StoreBackendWord): StoreDegradedReason;
 /**
- * `/health.sessionBackend` 与 `listening` 日志 `session` 位的**唯一读法**:装配后的 `config.sessionBackend`(`memory` | `tidb`;`tidb` = 「后端自己的 durable 店」的泛指标签)
- * + 装配出的后端 kind ⇒ 对运维说人话的有效店 —— `durable(pg)` / `durable(mysql)` / `durable(local)` / `memory`。`sessionBackend` 缺 backend 的 `tidb`
- * 不替它编一个后端名(那是装配缺陷,`createSessionStore` 会先拒)。部署侧的 smoke(`deploy/sema-up/lib/health.sh`)按这一形读同一位。
+ * `/health.sessionBackend` 与 `listening` 日志 `session` 位的**唯一读法**:装配后的 `config.sessionBackend`(`memory` | `tidb`;`tidb` = 「后端自己的店」的泛指标签)
+ * + 装配出的后端 kind ⇒ 会话店落在哪种后端上 —— `pg` / `mysql` / `local` / `memory`。**只说种类,不说持久**:持久性是另一个读数(`/health.store.durability`,
+ * 与 caps 同一只装配值)。`sessionBackend` 缺 backend 的 `tidb` 不替它编一个后端名(那是装配缺陷,`createSessionStore` 会先拒)。
  */
 export declare function sessionStoreLabelOf(sessionBackend: ServiceConfig["sessionBackend"], backendKind: StoreBackend["kind"] | undefined): string;
-/** 装配值(纯数据;`boot/stores.ts` 铸一次,gauge / `/health` / caps 三面同读)。 */
+/** 持久性三态(闭集;wire 词)。`unknown` = 判不出(证据缺 / 读不懂 / 介质形不在规则表里),从不折成 `durable`。 */
+export declare const STORE_DURABILITIES: readonly ["durable", "ephemeral", "unknown"];
+export type StoreDurability = (typeof STORE_DURABILITIES)[number];
+/** 三根(闭集;诊断面 `storeDurability.roots[].root` 的词)。 */
+export declare const STORE_ROOTS: readonly ["data", "sealed_key", "memory"];
+export type StoreRoot = (typeof STORE_ROOTS)[number];
+/**
+ * 判定依据词(闭集;诊断面 `roots[].rule` 的词)—— 每一根的判定是哪一条规则给的。三态由 {@link durabilityOfRule} 的穷举 switch 从它派生(加词 ⇒ 编译红,
+ * 由人显式判它属于哪一态)。
+ */
+export declare const STORE_DURABILITY_RULES: readonly ["backend_memory", "backend_sql", "fs_volatile", "k8s_empty_dir", "k8s_persistent_volume", "network_fs", "block_device", "unrecognized_mount", "mount_unresolved", "mountinfo_unreadable", "mountinfo_malformed", "path_unresolvable", "not_linux"];
+export type StoreDurabilityRule = (typeof STORE_DURABILITY_RULES)[number];
+/** 规则词 → 三态(穷举 switch)。 */
+export declare function durabilityOfRule(rule: StoreDurabilityRule): StoreDurability;
+/** 规则表里的词(挂载形那一半)。 */
+type StoreMountRule = Extract<StoreDurabilityRule, "fs_volatile" | "k8s_empty_dir" | "k8s_persistent_volume" | "network_fs" | "block_device">;
+/**
+ * 挂载形的规则表(闭集常量表,先中先判;一行都不中 ⇒ `unrecognized_mount` = `unknown`)。读的是走路径看见的那一只挂载:
+ *  · `fs_volatile` —— fs 类型 `overlay` / `tmpfs` / `ramfs`(容器根的可写层、内存盘):随容器 / Pod 删;
+ *  · `k8s_empty_dir` —— 根路径含 `kubernetes.io~empty-dir`(磁盘介质的 emptyDir;内存介质的是 tmpfs,上一行已中):随 Pod 删;
+ *  · `k8s_persistent_volume` —— 根路径含 `kubernetes.io~csi` / `kubernetes.io~local-volume`(PV 经 kubelet 挂进来);
+ *  · `network_fs` —— `nfs*` / `cifs` / `ceph` / `glusterfs` / `9p`(`9p` 挂在 `/` 上是沙箱运行时的容器根,不算);
+ *  · `block_device` —— 挂载源是块设备(`/dev/…`)且**整只文件系统**挂上来(根路径 `/`):虚机 / 裸机的盘、块形 PV。
+ *    绑定挂载一只子目录(根路径不是 `/`:hostPath、docker 卷 / 绑定、btrfs 子卷)不中这一行 —— 那只目录跟着谁走看不出来,归 `unknown`。
+ */
+export declare const STORE_MOUNT_RULES: readonly {
+    readonly rule: StoreMountRule;
+    readonly holds: (m: MountRow) => boolean;
+}[];
+/** 一只挂载按规则表判出的依据词。 */
+export declare function classifyStoreMount(m: MountRow): StoreDurabilityRule;
+/** 一根的判定(逐根明细的形;诊断面 `storeDurability.roots[]` 原样出)。 */
+export interface StoreRootDurability {
+    readonly root: StoreRoot;
+    /** 判的那条物理路径(符号链接已展平);SQL / memory 后端的数据根没有路径 ⇒ `null`。 */
+    readonly path: string | null;
+    /** 走那条路径看见的那一只挂载(判不出 ⇒ 三格 `null`)。 */
+    readonly mountPoint: string | null;
+    readonly mountSource: string | null;
+    readonly fsType: string | null;
+    readonly rule: StoreDurabilityRule;
+    readonly verdict: StoreDurability;
+}
+/** 一根的判定去掉根名(取证时还不知道它排在哪一行)。 */
+export type StoreRootReading = Omit<StoreRootDurability, "root">;
+/** 挂载表这一份证据的读数。 */
+export type MountTableReading = {
+    readonly kind: "read";
+    readonly table: MountTable;
+} | {
+    readonly kind: "unreadable";
+} | {
+    readonly kind: "not_linux";
+};
+/** 一条物理路径落在什么介质上(纯函数)。挂载表里有读不懂的行 ⇒ 不判(看见的那一只可能正是被读丢的那一行)。 */
+export declare function judgeStoreRootPath(physicalPath: string, reading: MountTableReading): StoreRootReading;
+/** 最弱律:`ephemeral` < `unknown` < `durable`;空表 ⇒ `unknown`(没有证据永不答 `durable`)。 */
+export declare function weakestDurability(verdicts: readonly StoreDurability[]): StoreDurability;
+/**
+ * 数据根上**有没有东西**(开店之前读;开店本身会建根、落锁,读晚了恒答「有」)。两个调用点:起服第 2 段段首的取证(`store_fresh_start` 的判据),
+ * 与 `openStoreBackendWithFallback` 的降级判据。不存在(`ENOENT`)/ 路径上有一段不是目录(`ENOTDIR`)⇒ 没有;空目录 ⇒ 没有;有任何条目 ⇒ 有。
+ * 读不出(`EACCES` 等)⇒ 判不了 ⇒ 按「有」答(fail-closed:判不了的那一形不许把它当空根降级,也不许说「本次在空店上初始化」)。
+ */
+export declare function localDataRootHoldsData(root: string): boolean;
+/** 起服证据(纯数据;第 2 段段首铸一次,随开店带到第 3 段)。 */
+export interface StoreEvidence {
+    /** 第 2 段写任何东西之前,数据根上有没有东西({@link localDataRootHoldsData})。 */
+    readonly dataRootHeldData: boolean;
+    /** 数据根的介质(只在装配出 local 后端时进判定;别的后端按后端规则判)。 */
+    readonly dataRoot: StoreRootReading;
+    readonly sealedKey: StoreRootReading;
+    /** file 记忆根:`MEMORY_ENGINE_BACKEND=file` 时取证;进不进判定看引擎真接没接线(`buildStorePosture` 的 `memoryRootWired`)。 */
+    readonly memory?: StoreRootReading;
+}
+/** 取证要判的三条路径(按各自属主解析好的配置路径;`boot/store-evidence.ts` 递)。 */
+export interface StoreEvidencePaths {
+    readonly dataRoot: string;
+    readonly sealedKeyDir: string;
+    readonly memoryRoot: string | undefined;
+}
+/** 取证的宿主座:`canonical` 由调用方给(符号链接展平的那一只生产实现在 `memory-scope.ts`);其余缺席 = 本进程实测。 */
+export interface StoreEvidenceHost {
+    readonly canonical: (p: string) => string;
+    /** 挂载表全文;`null` = 本平台没有 procfs 挂载表。缺席 = {@link readProcessMountinfo}。 */
+    readonly mountinfo?: () => Promise<string | null>;
+    /** 缺席 = {@link localDataRootHoldsData}。 */
+    readonly holdsData?: (root: string) => boolean;
+}
+/**
+ * 起服证据:挂载表读一次,三条路径各展平成物理路径、各判一次;数据根空不空读一次。读不到 / 读不懂 / 路径展不平 / 找不到看见的那一只挂载 ⇒ 那几根判 `unknown`
+ * + 登记 F 类 fail-open(只影响自报)。
+ */
+export declare function captureStoreEvidence(paths: StoreEvidencePaths, host: StoreEvidenceHost): Promise<StoreEvidence>;
+/** 装配值(纯数据;`boot/stores.ts` 铸一次,gauge / `/health` / caps / 诊断 / 布线审计同读)。 */
 export interface StorePosture {
     readonly declared: StoreBackendWord;
     readonly backend: StoreBackendWord;
     readonly degradedReason?: StoreDegradedReason;
+    /** 三根取最弱({@link weakestDurability})。 */
+    readonly durability: StoreDurability;
+    /** 逐根明细:恒以数据根开头;有起服证据时再接封签钥匙目录与(接线时的)file 记忆根。 */
+    readonly roots: readonly StoreRootDurability[];
 }
-/** `build*`(纯数据)。`assembled` = 装配出的 `StoreBackend.kind`;缺席 = 没装出后端 ⇒ `memory`。 */
+/**
+ * `build*`(纯数据)。`assembled` = 装配出的 `StoreBackend.kind`;缺席 = 没装出后端 ⇒ `memory`。`evidence` 缺席 = 这个宿主没有起服证据(测试夹具 / 桩):
+ * 只判数据根、且只按后端规则判(local 无证据即抛)。`memoryRootWired` = file 记忆引擎在本部署上真接了线(配了才算;没接线的记忆根不进最弱律)。
+ */
 export declare function buildStorePosture(a: {
     readonly declared: StoreBackendWord;
     readonly assembled: StoreBackend["kind"] | undefined;
     readonly degradedReason: StoreDegradedReason | undefined;
+    readonly evidence: StoreEvidence | undefined;
+    readonly memoryRootWired: boolean;
 }): StorePosture;
+/** 读面桩的诚实下限(没有装配值的宿主:声明 = 配置词,后端 = memory ⇒ `ephemeral`)。caps 与 `/health` 同调这一只。 */
+export declare function unwiredStorePosture(declared: StoreBackendWord): StorePosture;
+/**
+ * 起服账本一行 `store_fresh_start` 的字段(present-iff 装配出 local 后端 ∧ 第 2 段之前数据根上什么都没有)。只断言「本次起服在空店上初始化」+ 三根判定 ——
+ * **不**声称首启:首启、丢卷、挂错卷三者只看空不空分不开(分辨要店外的记录)。
+ */
+export declare function buildStoreFreshStartLine(posture: StorePosture, evidence: StoreEvidence): Readonly<Record<string, unknown>> | undefined;
 /** caps `store` 的形。 */
 export interface StoreCapability {
     readonly declared: StoreBackendWord;
     readonly backend: StoreBackendWord;
-    readonly durable: boolean;
+    readonly durability: StoreDurability;
     readonly degradedReason?: StoreDegradedReason;
     /** 7.105.0 及以前的顶层 `sql` 对象,原样搬入(`{engine, isolation, txnMode}`)。present-iff `backend ∈ {mysql, pg}` ∧ 驱动此刻给得出
      *  回读复核过的事实 —— 最近一次连接初始化被拒([ref] ④)时驱动交 `null`,本键随之缺席(此前是顶层 `sql:null`)。 */
@@ -59,4 +155,24 @@ export interface StoreCapability {
 }
 /** 装配值 → caps 投影(纯函数)。 */
 export declare function projectStoreCapability(posture: StorePosture, sqlFacts: SqlEngineFacts | null | undefined): StoreCapability;
+/** `/health.store` 的形(恒在场):与 caps `store.durability` 同一只装配值、同一拍铸。 */
+export interface HealthStoreSection {
+    readonly durability: StoreDurability;
+}
+export declare function projectHealthStoreSection(posture: StorePosture): HealthStoreSection;
+/** `GET /v1/diagnostics/wiring` 的 `storeDurability` 段(运维面):三态 + 逐根明细。 */
+export interface StoreDurabilityWiring {
+    readonly durability: StoreDurability;
+    readonly roots: readonly StoreRootDurability[];
+}
+export declare function projectStoreDurabilityWiring(posture: StorePosture): StoreDurabilityWiring;
+/** 一根的人读形(布线审计的拒句 / warn 行逐根列):`<根> <路径> (<fs 类型> <挂载源> at <挂载点>) ⇒ <三态> [<依据>]`。 */
+export declare function describeStoreRoot(r: StoreRootDurability): string;
+/** 布线审计拒启那一句的机器码(起服 fatal 标题 `[config.store_not_durable]`)。 */
+export declare const STORE_NOT_DURABLE_CODE = "config.store_not_durable";
+/** 起服布线审计因会话店落在易失介质上拒启时的抛出物:`code` = {@link STORE_NOT_DURABLE_CODE}(`boot/fatal-exit.ts` 把带码异常写成 `Error [<码>]: …` 标题)。 */
+export declare class StoreNotDurableError extends Error {
+    readonly code = "config.store_not_durable";
+}
+export {};
 //# sourceMappingURL=store-posture.d.ts.map