/**
 * `totem doctor` — the seat-identity-binding SENSE (mmnto-ai/totem#2511).
 *
 * Tenet 9/13: this row senses, it never enforces. It carries `gateExempt: true`
 * and never emits `fail`, so no `--strict` tier can give it teeth — the
 * exemption is a property of the row (`doctor.ts` DiagnosticResult), not of the
 * tier a later change might widen.
 *
 * Four post-hoc contradiction arms are sensed:
 *
 *   (a) `from-mismatch` — an outbox dispatch whose frontmatter `from:` names a
 *       DIFFERENT seat than the directory it sits in. The dir is the
 *       registration (the mmnto-ai/totem#2141 dirs-union invariant), so the two
 *       disagreeing is an identity contradiction on its face.
 *   (b) `writing-while-excluded` — a seat whose PARSED lifecycle marker says
 *       `suspended`/`retired` yet whose outbox carries filename-stamped writes
 *       newer than the marker's `since`: declared lifecycle contradicted by
 *       observed behaviour.
 *   (c) `env-names-excluded-seat` / `env-names-unknown-seat` — `TOTEM_SELF_AGENT`
 *       naming a non-active seat, or naming no seat directory in this repo.
 *   (d) `env-ambient-scope` (win32 only; mmnto-ai/totem#2629) —
 *       `TOTEM_SELF_AGENT` present at a PERSISTENT registry scope (user or
 *       machine). A per-SEAT identity at either scope is inherited by every
 *       seat's processes on the machine — the #2629 cross-seat fallthrough
 *       root cause. Doctor-time only, never the stamp hot path; the stamp-seam
 *       counterpart (provenance + fail-closed conflict) lives in core's
 *       `senseAgentAttribution`.
 *
 * A corrupt marker degrades to `active` by core's contract
 * (`seat-lifecycle.ts` — fail open on visibility), so (b) is NEVER evaluated
 * against it: this sense refuses to build a finding on an unparsed marker.
 * The core warning (which names the marker file) is relayed instead, as its own
 * `unreadable-marker` row — a scan hole disclosed rather than a clean line that
 * hides it.
 *
 * THE HONEST LIMIT is stated in every verdict, pass included: a CONSISTENT fake
 * defeats all three arms, and that is precisely why write-time binding was
 * judged infeasible for v1 and this doctor tier is the chartered fallback.
 *
 * Core is dynamic-imported so `@mmnto/totem` stays off the CLI cold-start
 * graph, matching every other doctor check.
 */
import type { DiagnosticResult } from './doctor.js';
/** Row label, `padEnd(18)`-safe in the doctor render. */
export declare const SEAT_IDENTITY_CHECK_NAME = "Seat Identity";
/**
 * Newest-N outbox files scanned per seat, by filename sort. Dispatch basenames
 * are stamp-prefixed (`YYYY-MM-DDTHHMMZ-`), so the lexical tail IS the newest
 * tail. A bound is required — cohort outboxes grow without limit and this row
 * runs on every `totem doctor` — and whenever it bites, the verdict SAYS so
 * (never a silently partial scan).
 */
export declare const OUTBOX_SCAN_LIMIT = 200;
/**
 * The verbatim limit clause. Exported so the test pins it against drift: the
 * whole justification for shipping a doctor-tier sense instead of write-time
 * binding rides on this sentence staying true and staying said.
 */
export declare const SEAT_IDENTITY_HONEST_LIMIT = "honest limit: a CONSISTENT fake \u2014 writing from the wrong seat dir with a matching forged `from:`, the agy shape \u2014 is NOT detectable post-hoc, which is why full write-time binding was judged infeasible for v1 and this doctor tier is the chartered fallback; this check does not discharge the 2026-06-18 seat-identity precondition.";
/** The contradiction classes this row can report. */
export type SeatIdentityFindingClass = 'from-mismatch' | 'writing-while-excluded' | 'env-names-excluded-seat' | 'env-names-unknown-seat' | 'env-ambient-scope' | 'registry-scope-unreadable' | 'unreadable-marker' | 'outbox-unreadable';
export interface SeatIdentitySeams {
    /**
     * Test seam — production reads `process.env`. Injected so the env arm is
     * exercisable without mutating real env state (the `resolveSelfAgents`
     * convention).
     */
    env?: Record<string, string | undefined>;
    /** Test seam — overrides {@link OUTBOX_SCAN_LIMIT} so truncation is testable. */
    outboxScanLimit?: number;
    /** Test seam — production reads `process.platform`. Arm (d) is win32-only. */
    platform?: NodeJS.Platform;
    /**
     * Test seam — production spawns `reg query <hive> /v TOTEM_SELF_AGENT` via
     * core's `safeExec`. Implementations keep the `reg` contract this arm reads
     * through: return stdout on a hit; throw with `.status === 1` when the value
     * is absent at that hive (the healthy state).
     */
    regQuery?: (hive: string) => string;
}
/**
 * Sense seat-identity binding across every registered seat dir. Report-only:
 * `gateExempt: true` on every arm, `fail` on none, and an unexpected throw
 * lands as a warn row rather than taking `totem doctor` down (Tenet 13).
 */
export declare function checkSeatIdentity(cwd: string, seams?: SeatIdentitySeams): Promise<DiagnosticResult>;
//# sourceMappingURL=doctor-seat-identity.d.ts.map