@redue/cli 0.1.0-alpha.10 → 0.1.0-alpha.11

package/src/direct-run-certificate.mjs

@@ -1,40 +1,185 @@
 // A caller validates discovery, never an execution outcome. No persistent cache.
+// The direct compiler run records the answers it received (run-recorder.cjs);
+// those answers, not a separate probe, show it consumed the certified inputs.
+import fs from 'node:fs';
+import path from 'node:path';
 import {createHash} from 'node:crypto';
-import {spawnSync} from 'node:child_process';
 import {inflateSync} from 'node:zlib';
 import {fileURLToPath} from 'node:url';
 import {timing} from './decision-profile.mjs';
+import {directCompiler,directContextHash,directEnvironmentIssue,directProbeOutput,directProbeValue} from './direct-typescript.mjs';
+import {withinPath} from './path-identity.mjs';
 const hash=value=>createHash('sha256').update(value).digest('hex');
 export function directRunCertificateAllowed(selected) {
-  return process.platform==='darwin'&&selected.qualification==='npm-typescript-direct-v1'&&
+  return ['darwin','linux'].includes(process.platform)&&selected.qualification==='npm-typescript-direct-v1'&&
     selected.probes?.length===1&&
     selected.probes[0][1]===fileURLToPath(new URL('direct-typescript-probe.mjs',import.meta.url))&&
     !(process.env.VSTATE_TEST_FAULTS==='1'&&process.env.VSTATE_TEST_FULL_RUN_PROBES==='1');
 }
-export function validateDirectRunCertificate(plan,selected,snapshot) {
+// The start snapshot's discovery certificate, checked without a child process.
+// Returns what a recorded run is compared against, or null for full probes.
+export function directRunCertificate(plan,selected,snapshot,root) {
   const started=performance.now(),c=snapshot?.discoveryCertificate;
   const fallback=reason=>{timing('cli.run_certificate',started,{outcome:'fallback',reason});return null;};
   if(!directRunCertificateAllowed(selected))return fallback('unsupported');
-  if(!snapshot?.observationHealthy||!c||c.schema!==1||c.planId!==plan.id||
+  if(!snapshot?.observationHealthy||!c||c.schema!==2||c.planId!==plan.id||
     c.planId!==snapshot.planId||c.cwd!==plan.cwd||
     c.probeDefinition!==hash(JSON.stringify(selected.probes))||
     ![c.output,c.context,c.stderrHash].every(s=>typeof s==='string'&&/^[a-f0-9]{64}$/.test(s))||
     typeof c.queryData!=='string'||c.queryData.length>512*1024)
     return fallback('certificate_unavailable');
+  // The compile runs in this process's environment; the daemon's is never substituted.
+  if(directEnvironmentIssue())return fallback('environment_unsupported');
   try{
-    const queries=JSON.parse(inflateSync(Buffer.from(c.queryData,'base64'),{maxOutputLength:8*1024*1024}));
     const argv=selected.probes[0];
-    const value=hash(JSON.stringify([[argv,0,hash(c.output),c.stderrHash]]));
+    const value=directProbeValue(argv,c.output,c.stderrHash);
     if(value!==snapshot.probeHash)return fallback('probe_identity_changed');
-    // The built-in child checks the current implementation, actual caller
-    // environment, context, content, membership and previously absent queries.
-    // The daemon environment is never substituted for the caller's.
-    const out=spawnSync(argv[0],[...argv.slice(1),'--redue-validate-queries'],{
-      cwd:plan.cwd,env:process.env,timeout:10000,maxBuffer:1024*1024,
-      input:JSON.stringify({schema:1,context:c.context,queries})});
-    if(out.error||out.signal||out.status!==0||out.stdout.toString()!==c.context||
-      hash(out.stderr)!==c.stderrHash)return fallback('caller_validation_failed');
-    timing('cli.run_certificate',started,{outcome:'reused',queries:queries.length});
-    return value;
+    // Bytes were verified by the daemon's full probe; its toolchain identity
+    // check at the start and end snapshots covers later changes.
+    const compiler=directCompiler(root,{verify:false});
+    if(selected.command[1]!==compiler.entry)return fallback('command_unsupported');
+    const queries=JSON.parse(inflateSync(Buffer.from(c.queryData,'base64'),{maxOutputLength:8*1024*1024}));
+    if(!Array.isArray(queries)||!queries.length)return fallback('certificate_invalid');
+    timing('cli.run_certificate',started,{outcome:'available',queries:queries.length});
+    return {value,queries,context:c.context,compiler};
   }catch{return fallback('certificate_invalid');}
 }
+// Without a start certificate, the daemon may offer to build one from this run's
+// recording at the end checkpoint. Returns its token, or null for full probes.
+export function directRunRecording(plan,selected,snapshot,root) {
+  const token=snapshot?.recordedCertificate;
+  if(!directRunCertificateAllowed(selected)||!snapshot.observationHealthy||
+    typeof token!=='string'||!/^[0-9a-f-]{36}$/.test(token)||snapshot.planId!==plan.id||directEnvironmentIssue())
+    return null;
+  try{if(selected.command[1]!==directCompiler(root,{verify:false}).entry)return null;}catch{return null;}
+  return token;
+}
+// Answers derived from a recorded raw listing, exactly as queryAnswer computes them.
+function derived(kind,entries,options) {
+  if(entries===null)return null;
+  if(kind==='entries')return entries.map(([name,type])=>[name,type==='d'?'d':type==='l'?'l':'f']).sort();
+  const resolved=entries.flatMap(([name,type,target])=>type!=='l'?[[name,type]]:target?[[name,target]]:[]);
+  if(kind==='directories'){
+    if(entries.some(([,type,target])=>type==='l'&&!target))return null;
+    return resolved.filter(([,type])=>type==='d').map(([name])=>name).sort();
+  }
+  const suffixes=options?.extensions?.map(value=>value.toLowerCase());
+  return resolved.flatMap(([name,type])=>type==='d'?[[name,'d']]:
+    type==='f'&&(!suffixes||suffixes.some(value=>name.toLowerCase().endsWith(value)))?[[name,'f']]:[]).sort();
+}
+// What one certificate fact says about a recorded stat answer: true, false, or
+// null when it says nothing. A parent listing that does not name the path only
+// rules some answers out, so it must agree but does not count as cover.
+function statAgrees([kind,file,answer,options],target,result) {
+  if(file===target){
+    // queryAnswer reports a missing path as null, not false.
+    if(answer===null)return ['fileExists','directoryExists','readFile'].includes(kind)?result===null:null;
+    if(kind==='fileExists')return result!==null&&(result==='f')===answer;
+    if(kind==='directoryExists')return result!==null&&(result==='d')===answer;
+    if(kind==='readFile')return result==='f';
+    return null;
+  }
+  if(file!==path.dirname(target)||!Array.isArray(answer))return null;
+  const name=path.basename(target);
+  if(kind==='directories')return answer.includes(name)?result==='d':result==='d'?false:undefined;
+  if(kind==='entries'){const entry=answer.find(row=>row[0]===name);
+    return !entry?result===null:entry[1]==='l'?null:entry[1]===result;}
+  if(kind==='listing'){const entry=answer.find(row=>row[0]===name);
+    if(entry)return entry[1]===result;
+    const suffixes=options?.extensions?.map(value=>value.toLowerCase());
+    const listed=!suffixes||suffixes.some(value=>name.toLowerCase().endsWith(value));
+    return result==='d'||listed&&result==='f'?false:undefined;}
+  return null;
+}
+const withinCompiler=compiler=>file=>withinPath(file,compiler.tsRoot)||
+  file!==compiler.entry&&file.toLowerCase()===compiler.entry.toLowerCase();
+// Null when every answer the run received agrees with the certified state,
+// otherwise why not. The compiler is deterministic given its context and its
+// answers, so a run whose answers all agree computed the certified result.
+// Each answer needs at least one certificate fact about it. Paths inside the
+// compiler tree are covered by the daemon's toolchain identity instead. tsc
+// also stats a case-swapped copy of its own path to detect case sensitivity;
+// only that one stat is exempt.
+export function runRecordIssue(record,certificate) {
+  if(record?.schema!==1||!Array.isArray(record.facts))return 'record unavailable';
+  if(record.unsupported)return `unsupported ${record.unsupported}`;
+  if(record.conflict)return `answer changed during the run: ${record.conflict}`;
+  const {compiler,queries}=certificate;
+  if(record.main!==compiler.entry||!Array.isArray(record.node)||
+    directContextHash(compiler,record.node)!==certificate.context)return 'execution context changed';
+  const inCompiler=withinCompiler(compiler);
+  const facts=new Map();
+  for(const query of queries){if(!facts.has(query[1]))facts.set(query[1],[]);facts.get(query[1]).push(query);}
+  for(const [kind,file,answer] of record.facts){
+    if(inCompiler(file))continue;
+    const known=facts.get(file)||[];
+    let checks=[];
+    if(kind==='read')checks=known.filter(q=>q[0]==='readFile')
+      .map(q=>JSON.stringify(q[2])===JSON.stringify(answer));
+    else if(kind==='realpath')checks=known.filter(q=>q[0]==='realpath')
+      .map(q=>q[2]===answer);
+    else if(kind==='readdir')checks=known.filter(q=>['listing','directories','entries'].includes(q[0]))
+      .map(q=>JSON.stringify(derived(q[0],answer,q[3]))===JSON.stringify(q[2]));
+    else if(kind==='stat')checks=[...known,...(facts.get(path.dirname(file))||[])]
+      .map(q=>statAgrees(q,file,answer)).filter(value=>value!==null);
+    else return `unknown answer ${kind}`;
+    if(!checks.some(value=>value!==undefined))return `${kind} ${file} is not in the discovery certificate`;
+    if(checks.includes(false))return `${kind} ${file} differs from the discovery certificate`;
+  }
+  return null;
+}
+// Compares the record run-recorder.cjs wrote to fd 3.
+export function validateRunRecord(text,certificate) {
+  const started=performance.now();
+  let record=null;
+  try{record=JSON.parse(text);}catch{}
+  let issue;
+  try{issue=runRecordIssue(record,certificate);}catch{issue='record unreadable';}
+  timing('cli.run_recording',started,{outcome:issue?'rejected':'validated',
+    facts:record?.facts?.length||0,...(issue?{reason:issue}:{})});
+  return issue;
+}
+// A certificate for the current inputs, built from a recorded run and the
+// certificate of the last full probe, or {issue}. The run must read the same
+// files, with the same configuration, and every answer it received must be
+// covered by the old questions; only file contents may differ. The program
+// layout is then the same, so the output is rebuilt as the probe computes it.
+// Limit: a file whose role changes (a package.json newly imported as a module)
+// keeps its old role, so a later full probe can report the check STALE.
+export function recordedCertificate(text,cache,compiler) {
+  let record=null;
+  try{record=JSON.parse(text);}catch{}
+  if(record?.schema!==1||!Array.isArray(record.facts))return {issue:'record unavailable'};
+  if(!cache?.layout||!cache.queries?.length)return {issue:'no previous layout'};
+  const inCompiler=withinCompiler(compiler),reads=new Map();
+  for(const [kind,file,answer] of record.facts)if(kind==='read'&&!inCompiler(file)){
+    if(answer!==null&&typeof answer!=='string')return {issue:`read ${file} failed`};
+    reads.set(file,answer);
+  }
+  const before=new Map(cache.queries.filter(q=>q[0]==='readFile'&&!inCompiler(q[1])).map(q=>[q[1],q[2]]));
+  if(reads.size!==before.size||[...before.keys()].some(file=>!reads.has(file)))
+    return {issue:'the run read different files'};
+  if(cache.layout.configs.some(([file])=>!reads.has(file)||reads.get(file)!==before.get(file)))
+    return {issue:'configuration changed'};
+  // Lib files are in the compiler tree: their bytes are covered by its identity,
+  // but which of them the program loads must not change.
+  const libs=list=>[...new Set(list.filter(file=>inCompiler(file)&&file.endsWith('.d.ts')))].sort();
+  if(!Array.isArray(record.compilerReads)||JSON.stringify(libs(record.compilerReads))!==
+    JSON.stringify(libs(cache.queries.filter(q=>q[0]==='readFile').map(q=>q[1]))))
+    return {issue:'the run loaded different lib files'};
+  const changed=new Set([...reads].filter(([file,answer])=>before.get(file)!==answer).map(([file])=>file));
+  const queries=cache.queries.map(q=>q[0]==='readFile'&&changed.has(q[1])?[q[0],q[1],reads.get(q[1]),...q.slice(3)]:q);
+  const issue=runRecordIssue(record,{compiler,queries,context:cache.context});
+  if(issue)return {issue};
+  const files=[];
+  for(const [file,digest] of cache.layout.files){
+    if(!changed.has(file)){files.push([file,digest]);continue;}
+    let bytes;
+    try{bytes=fs.readFileSync(file);}catch{return {issue:`${file} unreadable`};}
+    // The same answer the compiler received (queryAnswer's readFile).
+    if(hash(JSON.stringify(bytes.toString('utf8')))!==reads.get(file))return {issue:`${file} changed after the run`};
+    files.push([file,hash(bytes)]);
+  }
+  const layout={...cache.layout,files};
+  return {queries,layout,output:directProbeOutput(layout),changed};
+}

package/src/direct-typescript-probe.mjs

@@ -1,13 +1,9 @@
 #!/usr/bin/env node
-import {createHash} from 'node:crypto';
-import {directProject,directInterpretation} from './direct-typescript.mjs';
+import {directProject,directInterpretation,directContextHash,directProbeOutput} from './direct-typescript.mjs';
 import {typeScriptInputFacts} from './typescript-input-facts.mjs';
 import {contextOnly,probeResult} from './probe-result.mjs';
 import {realObservedPath} from './path-identity.mjs';
-import path from 'node:path';
-import {queriesMatch} from './typescript-list.mjs';
-import {timing,mark} from './decision-profile.mjs';
-const hash=value=>createHash('sha256').update(JSON.stringify(value)).digest('hex');
+import {timing} from './decision-profile.mjs';
 try{
   const [rootArg,script]=process.argv.slice(2),root=realObservedPath(rootArg);
   // Verify all installed implementation bytes before loading compiler API/code,
@@ -17,40 +13,10 @@ try{
   timing('direct_probe.implementation',implementationStarted,{version:compiler.version});
   const context={interpretation:directInterpretation,compiler:compiler.digest,
     entry:compiler.entry,node:[realObservedPath(process.execPath),process.version]};
-  const contextHash=hash(context);
-  if(process.argv.includes('--redue-validate-queries')){
-    // Internal, process-local discovery certificate; never a verification receipt.
-    // Verify the current implementation above before queryAnswer can load its API.
-    const started=performance.now();mark('certificate.input_start');
-    // A synchronous fd-0 read can stall with spawnSync's piped input on macOS
-    // Node 22.13.0. Drain the stream without blocking its input delivery. The
-    // parent's existing deadline and the same size limit remain authoritative.
-    const chunks=[];let bytes=0;
-    for await(const chunk of process.stdin){
-      bytes+=chunk.length;if(bytes>8*1024*1024)throw Error('certificate too large');
-      chunks.push(chunk);
-    }
-    const raw=Buffer.concat(chunks).toString('utf8');mark('certificate.input_complete',{bytes});
-    const certificate=JSON.parse(raw),kinds=new Set(['readDirectory','readFile',
-      'fileExists','directoryExists','realpath','directories','entries']);
-    if(certificate.schema!==1||certificate.context!==contextHash||
-      !Array.isArray(certificate.queries)||!certificate.queries.length||
-      certificate.queries.some(q=>!Array.isArray(q)||q.length<3||q.length>4||
-        !kinds.has(q[0])||typeof q[1]!=='string'||!path.isAbsolute(q[1])||
-        q[0]==='readDirectory'&&(q[3]?.tsRoot!==compiler.tsRoot||!Array.isArray(q[3]?.args)||
-          q[3]?.argsVersion!==1||!Array.isArray(q[3]?.undefinedArguments)||
-          q[3].undefinedArguments.some(i=>!Number.isInteger(i)||i<0||i>=q[3].args.length))))
-      throw Error('certificate unavailable');
-    mark('certificate.queries_start',{queries:certificate.queries.length});
-    const matched=queriesMatch(certificate.queries);
-    mark('certificate.queries_complete',{matched});
-    timing('direct_probe.query_validation',started,{queries:certificate.queries.length,matched:matched?1:0});
-    if(!matched)throw Error('compiler queries changed');
-    process.stdout.write(contextHash);
-    process.exit(0);
-  }
+  const contextHash=directContextHash(compiler,context.node);
   if(!contextOnly(contextHash)){
-    const {queries,...inputs}=typeScriptInputFacts(root,compiler.tsRoot,compiler.entry);
-    probeResult(hash({root,script,...inputs,...context}),contextHash,queries);
+    const {queries,configs,files}=typeScriptInputFacts(root,compiler.tsRoot,compiler.entry);
+    const layout={root,script,configs,files,context};
+    probeResult(directProbeOutput(layout),contextHash,queries,layout);
   }
 }catch(e){console.error(`VSTATE_REASON:${e.code&&/^[a-z-]+$/.test(e.code)?e.code:'typescript-contract-unavailable'}`);process.exitCode=2;}

package/src/direct-typescript.mjs

@@ -15,23 +15,40 @@ const fail=code=>{throw Object.assign(Error(code),{code});};
 const hash=bytes=>createHash('sha256').update(bytes).digest('hex');
 export const directEnvironment={variables:['NODE_ENV','NODE_OPTIONS','NODE_PATH','NODE_COMPILE_CACHE','VSCODE_INSPECTOR_OPTIONS'],
   prefixes:['NODE_','DYLD_','LD_','TSGO_','TSC_','TS_ETW_'],executableIdentity:true};
+// NODE_OPTIONS flags that only size the V8 heap or pick TLS/DNS behavior; the
+// reviewed compilers open no network connections. Anything else, including any
+// code loader (--require, --import, --loader), is unclassified.
+const inertNodeOptions=[/^--max-(?:old|semi)-space-size=\d+$/,/^--use-(?:openssl|bundled|system)-ca$/,
+  /^--dns-result-order=(?:ipv4first|ipv6first|verbatim)$/];
+// One variable's effect on the direct compiler: null when it cannot change what
+// tsc reads or reports. Accepted values stay fingerprinted as NODE_ context.
+export function directVariableIssue(key,value){
+  const unsupported='direct-execution-environment-unsupported';
+  // The 5.5.2 API can require this unreviewed module during probe loading.
+  // Reject even empty/case aliases; do not mutate the caller's environment.
+  if(/^TS_ETW_MODULE_PATH$/i.test(key)||/^VSCODE_INSPECTOR_OPTIONS$/i.test(key)&&value)return unsupported;
+  if(/^NODE_/i.test(key)){
+    // Node 22.13.0 predates env-proxy initialization. This injected flag is
+    // inert there, but remains strictly fingerprinted as NODE_ context.
+    if(key==='NODE_USE_ENV_PROXY'&&value==='1'&&process.version==='v22.13.0'&&
+      !process.allowedNodeEnvironmentFlags.has('--use-env-proxy'))return null;
+    if(key==='NODE_ENV'&&['','production','test'].includes(value))return null;
+    // PEM data for TLS roots, not code.
+    if(key==='NODE_EXTRA_CA_CERTS')return null;
+    // Only bare CommonJS requires consult it; the reviewed compilers make one,
+    // source-map-support, and only under NODE_ENV=development.
+    if(key==='NODE_PATH')return null;
+    // No quotes or escapes, so Node splits the value exactly as this does.
+    if(key==='NODE_OPTIONS'&&/^[A-Za-z0-9=._ -]*$/.test(value)&&
+      value.split(' ').filter(Boolean).every(flag=>inertNodeOptions.some(re=>re.test(flag))))return null;
+    if(value!=='')return unsupported;
+  }
+  if(/^(DYLD_|LD_|TSGO_|TSC_)/i.test(key)&&value!=='')return unsupported;
+  return null;
+}
 export function directEnvironmentIssue(env=process.env){
   if(![22,24].includes(Number(process.versions.node.split('.')[0])))return 'direct-node-version-unsupported';
-  if(env.VSCODE_INSPECTOR_OPTIONS)return 'direct-execution-environment-unsupported';
-  for(const [key,value] of Object.entries(env)){
-    // The 5.5.2 API can require this unreviewed module during probe loading.
-    // Reject even empty/case aliases; do not mutate the caller's environment.
-    if(/^TS_ETW_MODULE_PATH$/i.test(key))return 'direct-execution-environment-unsupported';
-    if(/^NODE_/i.test(key)){
-      // Node 22.13.0 predates env-proxy initialization. This injected flag is
-      // inert there, but remains strictly fingerprinted as NODE_ context.
-      if(key==='NODE_USE_ENV_PROXY'&&value==='1'&&process.version==='v22.13.0'&&
-        !process.allowedNodeEnvironmentFlags.has('--use-env-proxy'))continue;
-      if(key==='NODE_ENV'&&['','production','test'].includes(value))continue;
-      if(value!=='')return 'direct-execution-environment-unsupported';
-    }
-    if(/^(DYLD_|LD_|TSGO_|TSC_)/i.test(key)&&value!=='')return 'direct-execution-environment-unsupported';
-  }
+  for(const [key,value] of Object.entries(env)){const issue=directVariableIssue(key,value);if(issue)return issue;}
   return null;
 }
 export function directCompiler(root,{verify=true}={}){
@@ -58,6 +75,22 @@ export function directCompiler(root,{verify=true}={}){
   }
   return {tsRoot,version,entry:path.join(tsRoot,spec.entry),digest:spec.digest};
 }
+// The direct probe's output: root, script, configuration and program files with
+// their byte digests, and the execution context. A recorded run rebuilds it from
+// the same layout (direct-run-certificate.mjs).
+export function directProbeOutput({root,script,configs,files,context}){
+  const named=list=>list.map(([file,digest])=>[hash(file),digest]);
+  return hash(JSON.stringify({root,script,configs:named(configs),files:named(files),...context}));
+}
+// The probe value the daemon stores for one direct probe's checkpoint output.
+export function directProbeValue(argv,output,stderrHash){
+  return hash(JSON.stringify([[argv,0,hash(output),stderrHash]]));
+}
+// The execution context a direct probe certifies and a recorded run must match.
+export function directContextHash(compiler,node){
+  return hash(JSON.stringify({interpretation:directInterpretation,compiler:compiler.digest,
+    entry:compiler.entry,node}));
+}
 export function directProject(root,script,{verify=true}={}){
   const pkg=JSON.parse(fs.readFileSync(path.join(root,'package.json')));
   if(pkg.workspaces||pkg.packageManager&&!/^npm@/.test(pkg.packageManager)||

package/src/history-worker.mjs

@@ -1,23 +1,26 @@
 // Native history is an optional acceleration. Keep its operations off the
 // control thread so a wedged native call cannot block status or shutdown.
+// Each helper serves one query; the observer starts it ahead of that query.
 import fs from 'node:fs';
 import {mark} from './decision-profile.mjs';
 mark('history.worker_loaded');
 import watcher from '@parcel/watcher';
 
-try {
-  const [root,previous,next,backend,faultFile]=process.argv.slice(2);
-  let fault;
-  try {fault=faultFile&&fs.readFileSync(faultFile,'utf8').trim();}
-  catch(e){if(e.code!=='ENOENT')throw e;}
-  if(fault==='hang')Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0);
-  if(fault==='fail')throw Error('injected history failure');
-  mark('history.snapshot_start');
-  await watcher.writeSnapshot(root,next,{backend});
-  mark('history.snapshot_complete');
-  const changes=previous?await watcher.getEventsSince(root,previous,{backend}):[];
-  mark('history.events_complete',{events:changes.length});
-  process.send({ok:true,changes});
-} catch(error) {
-  process.send({ok:false,error:error.message,code:error.code||error.name});
-}
+process.on('disconnect',()=>process.exit(0));
+process.once('message',async({root,previous,next,backend,faultFile})=>{
+  try {
+    let fault;
+    try {fault=faultFile&&fs.readFileSync(faultFile,'utf8').trim();}
+    catch(e){if(e.code!=='ENOENT')throw e;}
+    if(fault==='hang')Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0);
+    if(fault==='fail')throw Error('injected history failure');
+    mark('history.snapshot_start');
+    await watcher.writeSnapshot(root,next,{backend});
+    mark('history.snapshot_complete');
+    const changes=previous?await watcher.getEventsSince(root,previous,{backend}):[];
+    mark('history.events_complete',{events:changes.length});
+    process.send({ok:true,changes});
+  } catch(error) {
+    process.send({ok:false,error:error.message,code:error.code||error.name});
+  }
+});

package/src/observation.mjs

@@ -9,17 +9,39 @@ import {fileURLToPath} from 'node:url';
 // subscription is healthy; history may accelerate catch-up; a fresh scan is
 // the deterministic fallback. A failed history operation never updates cursor.
 const workerFile=path.join(path.dirname(fileURLToPath(import.meta.url)),'history-worker.mjs');
+// Each query runs in a fresh helper: a reused native history session can take
+// ten times longer. The next helper is forked once a query settles, so its
+// startup is off the decision path. A failed or late helper is killed.
+let spare=null,queue=Promise.resolve(),closed=false;
+// After the observer's last query no helper is kept or started.
+export function closeHistory() {closed=true;spare?.kill('SIGKILL');spare=null;}
+function startHelper() {
+  const child=fork(workerFile,[],{stdio:['ignore','ignore','ignore','ipc'],env:traceEnvironment()});
+  child.abandoned=new Set();child.on('error',()=>{});
+  child.once('exit',()=>{if(spare===child)spare=null;
+    child.reply?.({ok:false,lost:Error(`history helper exited ${child.exitCode??child.signalCode}`)});
+    for(const next of child.abandoned)try{fs.unlinkSync(next);}catch{}});
+  return child;
+}
 export function history(root,cursor,backend,deadlineMs,faultFile) {
+  const run=()=>query(root,cursor,backend,deadlineMs,faultFile);
+  const result=queue.then(run,run);queue=result.catch(()=>{});return result;
+}
+function query(root,cursor,backend,deadlineMs,faultFile) {
   const next=cursor+'.'+randomUUID()+'.next';
   return new Promise((resolve,reject)=>{
     mark('history.submit',{deadlineMs});
-    const worker=fork(workerFile,[root,fs.existsSync(cursor)?cursor:'',next,backend,
-      faultFile||''],{stdio:['ignore','ignore','ignore','ipc'],env:traceEnvironment()});
-    let settled=false,abandoned=false;
+    const worker=spare??startHelper();spare=null;
+    worker.ref();worker.channel?.ref();
+    let settled=false;
     const finish=(error,value)=>{
-      if(settled)return;settled=true;mark('history.complete',{childPid:worker.pid,outcome:error?.code||error?.name||'ok',events:value?.length});clearTimeout(timer);
+      if(settled)return;settled=true;worker.reply=null;clearTimeout(timer);
+      mark('history.complete',{childPid:worker.pid,outcome:error?.code||error?.name||'ok',events:value?.length});
+      if(error)worker.abandoned.add(next);
       worker.kill('SIGKILL');
-      if(error){abandoned=true;try{fs.unlinkSync(next);}catch{}
+      // A failed query disables history for this observer; keep no helper.
+      if(!closed&&!error){spare=startHelper();spare.unref();spare.channel?.unref();}
+      if(error){try{fs.unlinkSync(next);}catch{}
         reject(error);return;}
       try{fs.renameSync(next,cursor);resolve(value);}
       catch(e){try{fs.unlinkSync(next);}catch{}reject(e);}
@@ -28,12 +50,10 @@ export function history(root,cursor,backend,deadlineMs,faultFile) {
       const e=Error(`history query did not settle within ${deadlineMs} ms`);
       e.code='ETIMEDOUT';finish(e);
     },deadlineMs);
-    worker.on('message',message=>message.ok?finish(null,message.changes):
-      finish(Object.assign(Error(message.error),{code:message.code})));
-    worker.once('error',e=>finish(e));
-    worker.once('exit',(code,signal)=>{
-      if(abandoned)try{fs.unlinkSync(next);}catch{}
-      if(!settled)finish(Error(`history helper exited ${code??signal}`));
-    });
+    worker.reply=message=>message.lost?finish(message.lost):message.ok?finish(null,message.changes):
+      finish(Object.assign(Error(message.error),{code:message.code}));
+    worker.on('message',message=>worker.reply?.(message));
+    try{worker.send({root,previous:fs.existsSync(cursor)?cursor:'',next,backend,faultFile:faultFile||''});}
+    catch(e){finish(e);}
   });
 }

package/src/probe-result.mjs

@@ -9,11 +9,15 @@ export function contextOnly(context) {
   }
   return false;
 }
-export function probeResult(output,context,queries=null) {
+// A layout lets a recorded run rebuild the output after a content-only edit.
+export function probeResult(output,context,queries=null,layout=null) {
   if(!process.argv.includes('--redue-checkpoint')){process.stdout.write(output);return;}
   const raw=queries?JSON.stringify(queries):null;
-  let value=JSON.stringify({output,context,queryData:raw&&Buffer.byteLength(raw)<=8*1024*1024?
-    deflateSync(raw).toString('base64'):null});
+  const queryData=raw&&Buffer.byteLength(raw)<=8*1024*1024?deflateSync(raw).toString('base64'):null;
+  let value=JSON.stringify({output,context,queryData,
+    ...(layout?{layoutData:deflateSync(JSON.stringify(layout)).toString('base64')}:{})});
+  // The layout is dropped first: it only shortens the run after an edit.
+  if(Buffer.byteLength(value)>512*1024)value=JSON.stringify({output,context,queryData});
   // Optimization metadata must not overflow the ordinary probe channel.
   // Larger contracts keep the normal complete probe, without result reuse.
   if(Buffer.byteLength(value)>512*1024)value=JSON.stringify({output,context,queries:null});

package/src/run-recorder.cjs

@@ -0,0 +1,78 @@
+// Preload for a direct compiler run: node --require <this> <tsc> ... with a
+// pipe on fd 3. Records the answers the compiler received from node:fs, in the
+// terms of queryAnswer, and writes them to fd 3 at exit. It never changes an
+// answer, an output or the exit code; any failure only makes the record unusable.
+'use strict';
+const fs=require('node:fs'),path=require('node:path'),{createHash}=require('node:crypto');
+const original={readFileSync:fs.readFileSync,statSync:fs.statSync,readdirSync:fs.readdirSync,
+  realpathSync:fs.realpathSync,native:fs.realpathSync.native,writeSync:fs.writeSync,openSync:fs.openSync};
+const real=file=>(process.platform==='win32'?original.native:original.realpathSync)(file);
+const facts=new Map(),compilerReads=new Set();let unsupported=null,conflict=null,main=null,compilerRoot=null;
+try{main=real(process.argv[1]);compilerRoot=path.dirname(path.dirname(main));}
+catch{unsupported='main module unavailable';}
+const kindOf=st=>st.isFile()?'f':st.isDirectory()?'d':'o';
+const missing=error=>['ENOENT','ENOTDIR'].includes(error?.code);
+// The compiler tree (lib/<entry>/../..) is covered by the daemon's toolchain
+// identity, not by this record. tsc also stats a case-swapped copy of its own path.
+const inCompiler=full=>full===compilerRoot||full.startsWith(compilerRoot+path.sep)||
+  full!==main&&full.toLowerCase()===main.toLowerCase();
+function observe(kind,call,answer) {
+  return function(file,...rest){
+    let value,full=null;
+    // Compiler-tree reads are named only: which lib files a program loads.
+    try{if(typeof file==='string'){full=path.resolve(file);
+      if(inCompiler(full)){if(kind==='read')compilerReads.add(full);full=null;}}
+      else unsupported??=`${kind} of a non-string path`;}
+    catch{unsupported??='recorder failure';}
+    if(full===null)return call.call(this,file,...rest);
+    let recorded;
+    try{value=call.call(this,file,...rest);}
+    catch(error){recorded=missing(error)?null:{error:error?.code||'error'};note(kind,full,recorded);throw error;}
+    try{recorded=answer(value,file);}catch{unsupported??='recorder failure';return value;}
+    note(kind,full,recorded);
+    return value;
+  };
+}
+function note(kind,full,answer) {
+  try{const key=kind+'\0'+full,value=JSON.stringify(answer),seen=facts.get(key);
+    if(seen===undefined)facts.set(key,value);else if(seen!==value)conflict??=`${kind} ${full}`;}
+  catch{unsupported??='recorder failure';}
+}
+fs.readFileSync=observe('read',original.readFileSync,value=>
+  createHash('sha256').update(JSON.stringify(typeof value==='string'?value:value.toString('utf8'))).digest('hex'));
+fs.statSync=observe('stat',original.statSync,value=>value?kindOf(value):null);
+fs.readdirSync=observe('readdir',original.readdirSync,(value,dir)=>value.map(entry=>{
+  if(typeof entry==='string')return [entry,'?'];
+  if(!entry.isSymbolicLink())return [entry.name,kindOf(entry)];
+  let target=null;try{target=kindOf(original.statSync(path.join(dir,entry.name)));}catch{}
+  return [entry.name,'l',target];
+}).sort((a,b)=>a[0]<b[0]?-1:a[0]>b[0]?1:0));
+const realpath=observe('realpath',original.realpathSync,value=>value);
+realpath.native=observe('realpath',original.native,value=>value);
+fs.realpathSync=realpath;
+// readFileSync opens through fs.openSync; only a writable open is a write.
+fs.openSync=function(file,flags,...rest){
+  if(!(flags===undefined||flags==='r'||flags==='rs'||flags===fs.constants.O_RDONLY))unsupported??='openSync';
+  return original.openSync.call(this,file,flags,...rest);
+};
+// Writes, and reads this record cannot answer for, make it unusable. readSync
+// and fstatSync stay open: readFileSync reads through them.
+for(const name of ['writeFileSync','appendFileSync','mkdirSync','unlinkSync','utimesSync',
+  'renameSync','rmSync','watch','watchFile','existsSync','lstatSync','accessSync','opendirSync',
+  'readlinkSync','readFile','stat','lstat','readdir','realpath','access','exists','open','opendir',
+  'readlink','createReadStream']){
+  const call=fs[name];
+  fs[name]=Object.assign(function(...args){unsupported??=name;return call.apply(this,args);},call);
+}
+for(const name of ['readFile','stat','lstat','readdir','realpath','access','open','opendir','readlink']){
+  const call=fs.promises[name];
+  fs.promises[name]=function(...args){unsupported??=`promises.${name}`;return call.apply(this,args);};
+}
+process.on('exit',()=>{
+  try{
+    const buffer=Buffer.from(JSON.stringify({schema:1,node:[real(process.execPath),process.version],main,
+      unsupported,conflict,compilerReads:[...compilerReads],facts:[...facts].map(([key,value])=>{const at=key.indexOf('\0');
+        return [key.slice(0,at),key.slice(at+1),JSON.parse(value)];})}));
+    for(let at=0;at<buffer.length;)at+=original.writeSync(3,buffer,at,buffer.length-at);
+  }catch{}
+});

package/src/typescript-input-facts.mjs

@@ -60,6 +60,9 @@ export function typeScriptInputFacts(root,tsRoot,tsc){
     .map(file=>path.resolve(file));
   if(!files.length||files.some(file=>!within(realObservedPath(file),root)))
     fail('typescript-input-outside-repository');
-  return {configs:[...configReads].sort().map(file=>[hash(file),digestFile(file)]),
-    files:[...new Set(files)].sort().map(file=>[hash(file),digestFile(file)]),queries:captured?.queries};
+  // Every hashed configuration must also be a certified question.
+  const queries=captured?.queries&&[...configReads].every(file=>
+    captured.queries.some(([kind,read])=>kind==='readFile'&&read===file))?captured.queries:null;
+  return {configs:[...configReads].sort().map(file=>[file,digestFile(file)]),
+    files:[...new Set(files)].sort().map(file=>[file,digestFile(file)]),queries};
 }