@redue/cli 0.1.0-alpha.11 → 0.1.0-alpha.13

package/src/daemon.mjs

@@ -8,18 +8,20 @@ import {Worker} from 'node:worker_threads';
 import {fileURLToPath} from 'node:url';
 import {subscribe,hasHistory,backend} from './platform-observation.mjs';
 import {controlEndpoint} from './control-endpoint.mjs';
-import {observedRelative,withinPath,realObservedPath} from './path-identity.mjs';
+import {observedRelative,withinPath,realObservedPath,racyWindowMs} from './path-identity.mjs';
 import micromatch from './glob.mjs';
 import {sha} from './plan.mjs';
-import {InputIndex} from './index.mjs';
+import {InputIndex,dehydrateIndex} from './index.mjs';
 import {permittedRoots} from './installed-inputs.mjs';
 import {assertOwnedStatePlacement} from './owned-state.mjs';
 import {atomicJson,readReceipts,readReceiptSnapshot,receiptRevision} from './state-store.mjs';
 import {history,closeHistory} from './observation.mjs';
 import {inputKey,planGuard,toolchainKey} from './decision-validation.mjs';
-import {queriesHold} from './typescript-list.mjs';
-import {directProject,directProbeValue} from './direct-typescript.mjs';
-import {recordedCertificate} from './direct-run-certificate.mjs';
+import {queriesHold,runFactReason as runFactChanged} from './typescript-list.mjs';
+import {nextProbeHint,probeDeadline,probeFloorMs} from './probe-deadline.mjs';
+import {statusSummary} from './cached-state.mjs';
+import {directProject,directProbeValue,reviewedTypeScriptVersions} from './direct-typescript.mjs';
+import {buildInfoPath,recordedCertificate} from './direct-run-certificate.mjs';
 import {timing,mark,traceBase,traceContext,traceScope,traceEnvironment,traceId} from './decision-profile.mjs';
 
 const configFile=path.resolve(process.argv[2]);
@@ -152,6 +154,14 @@ function reuseCertificate(row,key,allowReuse,forceFull,checked) {
   metrics.probeReuses=(metrics.probeReuses||0)+1;
   return null;
 }
+// The current full-probe deadline for a check; see probe-deadline.mjs. Hints
+// are kept per check name, so a plan rebuild (each Windows decision) keeps them.
+const probeHints=new Map();
+function fullProbeDeadline(row) {
+  const run=receipts[row.plan.name]?.invocation;
+  return probeDeadline({floor:probeFloorMs(row.plan.qualification),hint:probeHints.get(row.plan.name),
+    runMs:run?.status==='exited'?run.durationMs:0});
+}
 function probe(row,allowReuse=false,{launch=true}={}) {
   const started=performance.now();
   const supported=new Map([
@@ -204,18 +214,21 @@ function probe(row,allowReuse=false,{launch=true}={}) {
     row.probeCache=null;
   }
   const values=[];let checkpoint=null;
+  // The slowest of this check's probes sets the hint for all of them.
+  const deadline=fullProbeDeadline(row);let hint=0;
+  const learn=()=>{if(hint)probeHints.set(row.plan.name,hint);};
   for(const argv of row.plan.probes) {
-    // Supported TypeScript probes perform bounded input/toolchain hashing.
-    // Native NTFS runs have exceeded the generic 5 s cap under load, despite
-    // completing normally and with the duplicated work already removed.
-    const timeout=row.plan.qualification==='pnpm-tsc-v1'||
-      (process.platform==='win32'&&['typescript-noemit-v1','npm-typescript-direct-v1','yarn-workspace-tsc-v1']
-        .includes(row.plan.qualification))?10000:5000;
+    const timeout=deadline,launched=performance.now();
     mark('daemon.probe_launch',{mode:'full',reason:fullReason,deadlineMs:timeout});
-    const out=spawnSync(argv[0],[...argv.slice(1),...(cacheable?['--redue-checkpoint']:[])],{cwd:row.plan.cwd,
+    // A built-in probe gets its deadline, so its inner compiler calls share it.
+    const out=spawnSync(argv[0],[...argv.slice(1),...(cacheable?['--redue-checkpoint']:[]),
+      ...(builtIn?[`--redue-deadline=${timeout}`]:[])],{cwd:row.plan.cwd,
       timeout,maxBuffer:1024*1024,stdio:['ignore','pipe','pipe'],env:traceEnvironment()});
     mark('daemon.probe_complete',{mode:'full',childPid:out.pid,exit:out.status,signal:out.signal,code:out.error?.code});
+    const timedOut=out.error?.code==='ETIMEDOUT';
+    if(!out.error||timedOut)hint=Math.max(hint,nextProbeHint({durationMs:performance.now()-launched,deadlineMs:timeout,timedOut}));
     if(out.error||out.signal||out.status!==0) {
+      learn();
       if(!row.probeError){row.revision++;row.lastReason='declared state probe became unavailable';}
       row.probeHash=null;row.probeAt=0;
       const code=['typescript-noemit-v1','npm-typescript-direct-v1','yarn-workspace-tsc-v1','pnpm-tsc-v1']
@@ -223,7 +236,7 @@ function probe(row,allowReuse=false,{launch=true}={}) {
         /VSTATE_REASON:([a-z-]+)/.exec(out.stderr?.toString()||'')?.[1]:null;
       const explanations={
         'direct-typescript-implementation-unreviewed':'installed TypeScript bytes or membership differ from the reviewed compiler',
-        'direct-typescript-version-unsupported':'direct compiler recipe supports reviewed TypeScript 5.5.2, 5.6.3 and 5.9.3 only',
+        'direct-typescript-version-unsupported':`direct compiler recipe supports reviewed TypeScript ${reviewedTypeScriptVersions.join(', ')} only`,
         'direct-execution-environment-unsupported':'direct compiler rejects development helpers, Node cache/preloads, and unreviewed runtime overrides',
         'direct-node-version-unsupported':'direct compiler recipe supports Node 22 and 24',
         'npm-launcher-unobserved-inputs':'npm launcher uses unobserved notifier inputs; execution is recording-only',
@@ -232,7 +245,11 @@ function probe(row,allowReuse=false,{launch=true}={}) {
         'typescript-executable-changed':'local TypeScript executable changed or is missing',
         'typescript-config-unavailable':'TypeScript configuration cannot be resolved',
         'typescript-config-graph-unsupported':'TypeScript configuration extends, references, or uses compiler features outside this contract',
-        'typescript-incremental-unsupported':'TypeScript incremental or composite compilation needs explicit review',
+        'typescript-incremental-unsupported':'TypeScript composite compilation needs explicit review',
+        'typescript-buildinfo-outside-repository':'TypeScript incremental build-info file is outside the observed repository',
+        'typescript-incremental-unsound':'TypeScript assumeChangesOnlyAffectDirectDependencies makes an incremental result depend on build history',
+        'typescript-buildinfo-name-unsupported':'TypeScript build-info file needs a plain name ending in .tsbuildinfo',
+        'typescript-project-reference-consumed':'TypeScript program uses files of a referenced project, which plain tsc does not build',
         'typescript-config-outside-repository':'TypeScript configuration extends outside the observed repository',
         'typescript-plugin-unsupported':'TypeScript compiler plugin needs explicit review',
         'typescript-input-list-unavailable':'TypeScript input listing did not complete',
@@ -275,6 +292,7 @@ function probe(row,allowReuse=false,{launch=true}={}) {
     }
     values.push([argv,out.status,sha(cacheable?checkpoint.output:out.stdout),sha(out.stderr)]);
   }
+  learn();
   const value=sha(JSON.stringify(values));
   if((row.probeHash!==null&&row.probeHash!==value)||row.probeError){
     row.revision++;row.lastReason='declared state probe changed or recovered';}
@@ -319,7 +337,8 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
       plan_id:row.plan.id,observed_at:lastObservation,
       invocation:r?.invocation||null,target_provenance:r?.target||null,
       ...(r?.verificationRecipe?{verification_recipe:r.verificationRecipe}:{}),
-      coverage_at_run:r?.coverage||null,declared_inputs_match:null,reuse_eligible:false};
+      coverage_at_run:r?.coverage||null,declared_inputs_match:null,reuse_eligible:false,
+      ...(r?.runFacts?.length?{run_facts:r.runFacts.length}:{})};
     if(receiptStateError){item.reason=receiptStateError;return item;}
     if(!healthy||planning||recovering||index.unavailable){item.reason=
       (planning||recovering)?'input observation reconciliation pending':
@@ -330,7 +349,8 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
     if(pendingChecks.has(name)){item.reason='filesystem change pending content inspection';return item;}
     if(r&&r.planId) item.declared_inputs_match=r.planId===row.plan.id&&
       r.fingerprint===combinedSummary(name).fingerprint;
-    if(r&&r.fingerprintVersion!==1){item.reason='receipt uses earlier input-resolution format';return item;}
+    if(r&&!(r.fingerprintVersion===1||r.fingerprintVersion===2&&Array.isArray(r.runFacts))){
+      item.reason='receipt uses earlier input-resolution format';return item;}
     if(row.plan.unresolved.length){
       const checkpoint=item.declared_inputs_match===false?
         r.planId!==row.plan.id?'; observed input plan changed':
@@ -340,6 +360,9 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
       return item;
     }
     if(row.probeError){item.reason=row.probeError;return item;}
+    // The plan leaves out the build-info file it saw at start; the probe sees the current one.
+    if(row.probeCache?.layout&&(row.probeCache.layout.buildInfo||null)!==(row.plan.buildInfo||null)){
+      item.reason='the incremental build-info setting changed after the observer started; restart the observer';return item;}
     // An expired probe or missing execution context cannot confirm CURRENT, but
     // observed input content that already differs from the receipt is STALE.
     let unconfirmed=!row.probeAt||Date.now()-row.probeAt>10000?'state probe observation expired':null;
@@ -396,11 +419,24 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
       if(unconfirmed&&!(r.files&&row.staleInputs?.length)){item.freshness='UNVERIFIED';
         item.reason=unconfirmed;item.changed_inputs=[];}
     } else if(unconfirmed){item.freshness='UNVERIFIED';item.reason=unconfirmed;
+    // Lookups the run made outside the certificate are asked again for every
+    // answer, cached or synchronized, before it can say CURRENT.
+    // A direct run recorded before run facts may have made lookups no probe
+    // asks; only Windows, which never records direct runs, keeps reusing them.
+    } else if(r.fingerprintVersion===1&&r.verificationRecipe==='npm-direct-typescript@1'&&process.platform!=='win32'){
+      item.freshness='UNVERIFIED';item.reason='receipt predates run facts; run the check again';
+    } else if(r.runFacts&&(item.reason=runFactReason(r.runFacts))){item.changed_inputs=[];
     } else {item.freshness='CURRENT';item.reason=result==='FAIL'?'last command failed':'declared inputs match';
       item.reuse_eligible=result==='PASS';}
     return item;
   });
 }
+// Null when every run fact in a receipt answers as it did during the run.
+function runFactReason(facts) {
+  const started=performance.now(),reason=runFactChanged(facts);
+  timing('daemon.run_facts',started,{facts:facts.length,changed:reason?1:0});
+  return reason;
+}
 // The indexed inputs already differ from the latest receipt, so no probe result
 // can make this check CURRENT. A sync answers STALE without a full probe. A run
 // probes, or builds the certificate from its recording (adopt), and a revert
@@ -439,7 +475,7 @@ function adopt(name,row,token) {
     return done('inputs or certificate changed during the run');
   const cache=pending.cache,argv=row.plan.probes[0];
   let result;
-  try{result=recordedCertificate(text,cache,directProject(argv[2],argv[3],{verify:false}));}
+  try{result=recordedCertificate(text,cache,directProject(argv[2],argv[3],{verify:false}),buildInfoPath(row.plan));}
   catch{return done('recording unreadable');}
   if(result.issue)return done(result.issue);
   const identities=new Map(cache.identities);
@@ -454,14 +490,11 @@ function status(contextHashes,synchronizedInstalled=false,synchronizedFilesystem
   // Reload notifications accelerate visibility but are not required for it: a
   // wrapper may persist its outcome even when its control connection is denied.
   refreshReceipts();
-  const checks=rows(contextHashes,synchronizedInstalled,synchronizedFilesystem), current=checks.filter(r=>r.freshness==='CURRENT'&&r.result==='PASS').length,
-    failed=checks.filter(r=>r.freshness==='CURRENT'&&r.result==='FAIL').length,
-    observedFailed=checks.filter(r=>r.result==='FAIL').length,
-    stale=checks.filter(r=>r.freshness==='STALE').length,
-    unverified=checks.filter(r=>r.freshness==='UNVERIFIED').length||(!checks.length?1:0);
-  const stateName=failed?'failed':unverified?'unverified':stale?'stale':'current';
-  const now=Date.now();return {schema:1,receipt_revision:receiptStateRevision,state:stateName,current,failed,observed_failed:observedFailed,
-    stale,unverified,checks,
+  const checks=rows(contextHashes,synchronizedInstalled,synchronizedFilesystem);
+  // A decision may run every check's probes in turn: callers wait for all of them.
+  const probing=[...(index?.checks.values()||[])].filter(row=>row.plan.probes.length);
+  const now=Date.now();return {schema:1,receipt_revision:receiptStateRevision,...statusSummary(checks),checks,
+    ...(probing.length?{probe_deadline_ms:probing.reduce((sum,row)=>sum+fullProbeDeadline(row)*row.plan.probes.length,0)}:{}),
     observation:{healthy:healthy&&!planning&&!recovering&&!index?.unavailable,
       generation,observed_at:lastObservation,
       events:(index?.eventCount||0)+[...external.values()].reduce((n,e)=>n+(e.index?.eventCount||0),0),
@@ -496,16 +529,10 @@ function hydrate(bundle,saved) {
   }
   next.eventCount=saved.eventCount;next.rehashedFiles=saved.rehashedFiles;
   next.rehashedBytes=saved.rehashedBytes;next.profile=saved.profile;
+  next.racy=new Map(saved.racy||[]);
   return next;
 }
-function dehydrate(value) {
-  return {files:[...value.files],
-    aliasDependencies:[...value.aliasDependencies].map(([name,refs])=>[name,[...refs]]),
-    rows:[...value.checks].map(([name,row])=>({name,files:[...row.files],
-      sum:row.sum.toString('hex'),revision:row.revision,lastReason:row.lastReason})),
-    eventCount:value.eventCount,rehashedFiles:value.rehashedFiles,
-    rehashedBytes:value.rehashedBytes,profile:value.profile};
-}
+const dehydrate=dehydrateIndex;
 function retainIndex() {
   if(!index||!healthy||planning||pending.size||planDirty||historyDisabled||
     !fs.existsSync(snapshotPath))return;
@@ -958,7 +985,7 @@ async function request(message) {
     mark('server.decision_start',{decision,pending:pending.size,planDirty,planning,recovering,healthy,historyDisabled,decisionRequests,historyDeadlineMs,reconciliationDeadlineMs});
     timing('daemon.decision_reason',totalStarted,{decision,action:message.action,
       plan:process.platform==='win32'?'validate_dependencies_before_reuse':'existing_plan',
-      probe:'reuse_only_with_identical_content_and_context',installed:'current_content_required',
+      probe:'reuse_only_with_identical_content_and_context',installed:'current_identity_required',
       planPhase:metrics.planPhase||'initializing',pending:pending.size,
       notifications:metrics.notifications,planRebuilds:metrics.planRebuilds});
     if(process.platform==='win32'&&process.env.VSTATE_TEST_FAULTS==='1'&&
@@ -1065,6 +1092,20 @@ async function request(message) {
     }
     timing('daemon.request_probes',probeStarted,{checks:index?.checks.size||0});
     lastObservation=Date.now();publish();
+    // A run checkpoint never holds an installed identity from the racy window:
+    // a same-size write in the same timestamp tick would keep it. Wait the
+    // window out (at most 2 s), record those files again, and mark the
+    // checkpoint unusable if one is still inside it.
+    let racy=false;
+    if(message.action==='snapshot'||message.action==='prelaunch'){
+      const names=message.name?[message.name]:null;
+      const indexes=()=>[index,...[...external.values()].map(e=>e.index)].filter(Boolean);
+      const wait=Math.min(racyWindowMs,Math.max(0,...indexes().map(i=>i.racyUntil(names)))-Date.now());
+      if(wait>0){metrics.racyWaits=(metrics.racyWaits||0)+1;await new Promise(resolve=>setTimeout(resolve,wait+5));}
+      for(const i of indexes())i.settleRacy();
+      racy=indexes().some(i=>i.racyUntil(names)>Date.now());
+      if(racy)metrics.racyCheckpoints=(metrics.racyCheckpoints||0)+1;
+    }
     const applicabilityStarted=performance.now();
     const data=status(message.contextHashes,synchronizedInstalled,
       process.platform==='win32'&&healthy&&!planning&&!planDirty);
@@ -1075,18 +1116,16 @@ async function request(message) {
           planGeneration:row.plan.id,
             inputEventSerial:inputEventSerial.get(name)||0,
             probeHash:row.probeHash,inputKey:inputKey(row),observationGaps:metrics.gaps,
-            observationHealthy:healthy&&!planning&&!recovering&&applicableExternal(name).every(e=>e.healthy)};
+            observationHealthy:healthy&&!planning&&!recovering&&!racy&&applicableExternal(name).every(e=>e.healthy)};
       // Export only a currently guarded, check-specific discovery certificate.
       // The caller compares it with the answers its own compile received. Schema 2
       // certifies the realpath of every directory readDirectory visits. The
       // snapshot stays the start of the observed interval, including validation.
       if(message.runCertificate===1&&continuityBarrier()){
         const row=index?.checks.get(message.name),cache=row?.probeCache;
-        // The daemon checked the recording against the certificate it then validated.
-        if(recorded===null&&cache?.recorded===message.adopt&&cache.hash===row.probeHash&&
-          cache.input===inputKey(row)&&data.snapshots[message.name])
-          data.snapshots[message.name].recordingAccepted=true;
-        else if(row?.plan.qualification==='npm-typescript-direct-v1'&&
+        // Also after an accepted recording: the caller compares its record with
+        // this certificate and finds its run facts with it.
+        if(row?.plan.qualification==='npm-typescript-direct-v1'&&
           !row.plan.unresolved.length&&cache?.schema===1&&cache.input===inputKey(row)&&
           cache.hash===row.probeHash&&cache.guard===planGuard(index.bundle)&&
           cache.output&&cache.queryData&&data.snapshots[message.name])
@@ -1095,6 +1134,15 @@ async function request(message) {
             context:cache.context,output:cache.output,stderrHash:cache.stderrHash,
             queryData:cache.queryData};
       }
+      // For a run checked by full probes: the last probe's questions, only to
+      // find the run's lookups outside them. Never evidence for reuse.
+      if(message.runFacts===1&&data.snapshots[message.name]){
+        const row=index?.checks.get(message.name),cache=row?.probeCache;
+        if(row?.plan.qualification==='npm-typescript-direct-v1'&&cache?.queryData&&
+          typeof cache.context==='string'&&cache.input===inputKey(row)&&cache.hash===row.probeHash&&
+          cache.guard===planGuard(index.bundle))
+          data.snapshots[message.name].probeQuestions={context:cache.context,queryData:cache.queryData};
+      }
       const row=index?.checks.get(message.name);
       if(adopting.has(message.name)&&row?.adoption&&data.snapshots[message.name])
         data.snapshots[message.name].recordedCertificate=row.adoption.token;

package/src/declared-plan.mjs

@@ -5,6 +5,7 @@ import path from 'node:path';
 import {createHash} from 'node:crypto';
 import {permittedRoots,resolveDeclaredInstalled} from './installed-inputs.mjs';
 import {qualifyTypeScript} from './typescript-qualification.mjs';
+import {directBuildInfo} from './direct-typescript.mjs';
 import {yarnWorkspaceTypecheckInputs} from './yarn-workspace-inputs.mjs';
 import {pnpmTypecheckInputs} from './pnpm-inputs.mjs';
 import {observedRelative,withinPath,realObservedPath} from './path-identity.mjs';
@@ -16,6 +17,8 @@ const safePattern=value=>{
   const raw=value.startsWith('!')?value.slice(1):value;
   if(!raw||path.isAbsolute(raw)||raw.split(/[\\/]/).includes('..'))
     throw Error(`unsafe repository-relative input pattern: ${value}`);
+  // The observer never watches .git directories; excluding one is fine.
+  if(raw===value&&raw.split(/[\\/]/).includes('.git'))throw Error(`input pattern names a .git directory, which is not observed: ${value}`);
   return value;
 };
 
@@ -65,14 +68,22 @@ export function discoverDeclared(config) {
       catch(e){workspaceIssue=e.message;}
     }
     timing('plan.workspace_inputs',workspaceStarted,{available:workspace?1:0});
+    // An incremental direct check writes its build-info file during each run.
+    // It is compiler state, not an input, so the plan leaves it out. Read when
+    // the plan is built: a later change to it needs an observer restart, and
+    // until then the run reports the unexpected write and is not reusable.
+    let buildInfo=null;
+    if(selected.qualification==='npm-typescript-direct-v1')
+      try{buildInfo=directBuildInfo(root,selected.script);}catch{}
+    const excluded=buildInfo?['!'+buildInfo]:[];
     const installedStarted=performance.now();
     const installed=resolveDeclaredInstalled(root,
-      [...(selected.installedInputs||[]),...(workspace?.installed||[])],allowedRoots);
+      [...(selected.installedInputs||[]),...(workspace?.installed||[]),...excluded],allowedRoots);
     timing('plan.installed_resolution',installedStarted,{mappings:installed.mappings.length});
     const automatic=qualifyTypeScript(root,selected,
       {workspace,issue:workspaceIssue});
     const sourcePatterns=[...new Set([...selected.inputs,...(workspace?.source||[]),
-      ...(workspace?.generated||[])])].sort();
+      ...(workspace?.generated||[]),...excluded])].sort();
     const additivePatterns=[...new Set([...(selected.generatedInputs||[]),
       ...installed.internalPatterns])].sort();
     const unresolved=[...installed.unresolved,...(automatic?.issues||[]),
@@ -113,6 +124,7 @@ export function discoverDeclared(config) {
       installedMappings:installed.mappings,effectiveEnvironmentGlobs:{},
       probes:selected.probes||[],environment:selected.environment||{},
       qualification:selected.qualification||null,
+      ...(buildInfo?{buildInfo}:{}),
       executionProvenance:'declared-command',
       unresolved:[...new Set(unresolved)].sort()};
     plan.resolutionCandidates=workspace?.resolutionCandidates||[];

package/src/direct-run-certificate.mjs

@@ -10,12 +10,20 @@ import {timing} from './decision-profile.mjs';
 import {directCompiler,directContextHash,directEnvironmentIssue,directProbeOutput,directProbeValue} from './direct-typescript.mjs';
 import {withinPath} from './path-identity.mjs';
 const hash=value=>createHash('sha256').update(value).digest('hex');
-export function directRunCertificateAllowed(selected) {
+// Whether a direct run is recorded at all: on macOS and Linux, always, so its
+// run facts are known even when full probes check it.
+export function directRunRecordable(selected) {
   return ['darwin','linux'].includes(process.platform)&&selected.qualification==='npm-typescript-direct-v1'&&
     selected.probes?.length===1&&
-    selected.probes[0][1]===fileURLToPath(new URL('direct-typescript-probe.mjs',import.meta.url))&&
+    selected.probes[0][1]===fileURLToPath(new URL('direct-typescript-probe.mjs',import.meta.url));
+}
+// Whether a recorded run may replace the probes (tests can force full probes).
+export function directRunCertificateAllowed(selected) {
+  return directRunRecordable(selected)&&
     !(process.env.VSTATE_TEST_FAULTS==='1'&&process.env.VSTATE_TEST_FULL_RUN_PROBES==='1');
 }
+// The incremental build-info file the plan leaves out of the inputs, if any.
+export const buildInfoPath=plan=>typeof plan?.buildInfo==='string'?path.join(plan.root,plan.buildInfo):null;
 // The start snapshot's discovery certificate, checked without a child process.
 // Returns what a recorded run is compared against, or null for full probes.
 export function directRunCertificate(plan,selected,snapshot,root) {
@@ -26,7 +34,7 @@ export function directRunCertificate(plan,selected,snapshot,root) {
     c.planId!==snapshot.planId||c.cwd!==plan.cwd||
     c.probeDefinition!==hash(JSON.stringify(selected.probes))||
     ![c.output,c.context,c.stderrHash].every(s=>typeof s==='string'&&/^[a-f0-9]{64}$/.test(s))||
-    typeof c.queryData!=='string'||c.queryData.length>512*1024)
+    typeof c.queryData!=='string'||c.queryData.length>1024*1024)
     return fallback('certificate_unavailable');
   // The compile runs in this process's environment; the daemon's is never substituted.
   if(directEnvironmentIssue())return fallback('environment_unsupported');
@@ -41,9 +49,21 @@ export function directRunCertificate(plan,selected,snapshot,root) {
     const queries=JSON.parse(inflateSync(Buffer.from(c.queryData,'base64'),{maxOutputLength:8*1024*1024}));
     if(!Array.isArray(queries)||!queries.length)return fallback('certificate_invalid');
     timing('cli.run_certificate',started,{outcome:'available',queries:queries.length});
-    return {value,queries,context:c.context,compiler};
+    return {value,queries,context:c.context,compiler,buildInfo:buildInfoPath(plan)};
   }catch{return fallback('certificate_invalid');}
 }
+// The last probe's questions, sent for a run checked by full probes. They only
+// show which of the run's lookups are run facts; the full probes, not these,
+// establish the result.
+export function probeQuestions(plan,selected,snapshot,root) {
+  const q=snapshot?.probeQuestions;
+  if(!directRunRecordable(selected)||typeof q?.queryData!=='string'||
+    q.queryData.length>1024*1024||typeof q.context!=='string')return null;
+  try{const queries=JSON.parse(inflateSync(Buffer.from(q.queryData,'base64'),{maxOutputLength:8*1024*1024}));
+    if(!Array.isArray(queries)||!queries.length)return null;
+    return {queries,context:q.context,compiler:directCompiler(root,{verify:false}),buildInfo:buildInfoPath(plan)};}
+  catch{return null;}
+}
 // Without a start certificate, the daemon may offer to build one from this run's
 // recording at the end checkpoint. Returns its token, or null for full probes.
 export function directRunRecording(plan,selected,snapshot,root) {
@@ -93,6 +113,18 @@ function statAgrees([kind,file,answer,options],target,result) {
 }
 const withinCompiler=compiler=>file=>withinPath(file,compiler.tsRoot)||
   file!==compiler.entry&&file.toLowerCase()===compiler.entry.toLowerCase();
+// The certificate question that asks again what a run's stat, realpath or
+// package.json read answered, in queryAnswer's terms; null when it cannot be asked again.
+function runFact(kind,file,answer) {
+  if(kind==='stat')return answer===null||answer==='f'?['fileExists',file,answer&&true]:
+    answer==='d'?['directoryExists',file,true]:null;
+  if(kind==='realpath')return answer===null||typeof answer==='string'?['realpath',file,answer]:null;
+  // Declaration checks read the package.json of each dependency they resolve.
+  // Its content hash is asked again like any other run fact; other reads are not.
+  if(kind==='read'&&path.basename(file)==='package.json')
+    return answer===null||typeof answer==='string'?['readFile',file,answer]:null;
+  return null;
+}
 // Null when every answer the run received agrees with the certified state,
 // otherwise why not. The compiler is deterministic given its context and its
 // answers, so a run whose answers all agree computed the certified result.
@@ -100,17 +132,36 @@ const withinCompiler=compiler=>file=>withinPath(file,compiler.tsRoot)||
 // compiler tree are covered by the daemon's toolchain identity instead. tsc
 // also stats a case-swapped copy of its own path to detect case sensitivity;
 // only that one stat is exempt.
-export function runRecordIssue(record,certificate) {
+// With a `facts` array, a stat or realpath the probe never asked about is
+// added to it instead (declaration diagnostics resolve module paths that
+// building the program does not), as is a read of a package.json. The receipt
+// keeps those run facts, and status asks them again before every CURRENT
+// answer. Any other uncovered read, and any directory listing, is an issue.
+// The record's facts without the build-info file an incremental run reads and
+// writes, or {issue} when the run wrote anything else. That file is compiler
+// state, not an input. A directory tsc created for it was missing when tsc
+// checked it, so that check goes too; every other check stays.
+export function withoutBuildInfo(facts,buildInfo) {
+  const created=new Set(facts.filter(([kind])=>kind==='mkdir').map(([,file])=>file));
+  for(const [kind,file] of facts){
+    if(kind==='write'&&file!==buildInfo)return {issue:`the compiler wrote ${file}`};
+    if(kind==='mkdir'&&!buildInfo?.startsWith(file+path.sep))return {issue:`the compiler created ${file}`};
+  }
+  return {facts:facts.filter(([kind,file])=>kind!=='write'&&kind!=='mkdir'&&file!==buildInfo&&
+    !(kind==='stat'&&created.has(file)))};
+}
+export function runRecordIssue(record,certificate,runFacts=null) {
   if(record?.schema!==1||!Array.isArray(record.facts))return 'record unavailable';
   if(record.unsupported)return `unsupported ${record.unsupported}`;
   if(record.conflict)return `answer changed during the run: ${record.conflict}`;
-  const {compiler,queries}=certificate;
+  const {compiler,queries}=certificate,kept=withoutBuildInfo(record.facts,certificate.buildInfo||null);
+  if(kept.issue)return kept.issue;
   if(record.main!==compiler.entry||!Array.isArray(record.node)||
     directContextHash(compiler,record.node)!==certificate.context)return 'execution context changed';
   const inCompiler=withinCompiler(compiler);
   const facts=new Map();
   for(const query of queries){if(!facts.has(query[1]))facts.set(query[1],[]);facts.get(query[1]).push(query);}
-  for(const [kind,file,answer] of record.facts){
+  for(const [kind,file,answer] of kept.facts){
     if(inCompiler(file))continue;
     const known=facts.get(file)||[];
     let checks=[];
@@ -123,40 +174,54 @@ export function runRecordIssue(record,certificate) {
     else if(kind==='stat')checks=[...known,...(facts.get(path.dirname(file))||[])]
       .map(q=>statAgrees(q,file,answer)).filter(value=>value!==null);
     else return `unknown answer ${kind}`;
-    if(!checks.some(value=>value!==undefined))return `${kind} ${file} is not in the discovery certificate`;
+    if(!checks.some(value=>value!==undefined)){
+      const fact=runFacts&&runFact(kind,file,answer);
+      if(fact){runFacts.push(fact);continue;}
+      return `${kind} ${file} is not in the discovery certificate`;
+    }
     if(checks.includes(false))return `${kind} ${file} differs from the discovery certificate`;
+    // Covered only by a listing of its directory: a later probe may keep the
+    // same program while that listing changes, so the run's own lookup stays
+    // a run fact.
+    if(kind==='stat'&&runFacts&&!known.length){const fact=runFact(kind,file,answer);if(fact)runFacts.push(fact);}
   }
   return null;
 }
-// Compares the record run-recorder.cjs wrote to fd 3.
-export function validateRunRecord(text,certificate) {
+// Compares the record run-recorder.cjs wrote to fd 3. Run facts go to `facts`.
+export function validateRunRecord(text,certificate,facts=[]) {
   const started=performance.now();
   let record=null;
   try{record=JSON.parse(text);}catch{}
   let issue;
-  try{issue=runRecordIssue(record,certificate);}catch{issue='record unreadable';}
+  try{issue=runRecordIssue(record,certificate,facts);}catch{issue='record unreadable';}
   timing('cli.run_recording',started,{outcome:issue?'rejected':'validated',
-    facts:record?.facts?.length||0,...(issue?{reason:issue}:{})});
+    facts:record?.facts?.length||0,runFacts:facts.length,...(issue?{reason:issue}:{})});
   return issue;
 }
 // A certificate for the current inputs, built from a recorded run and the
 // certificate of the last full probe, or {issue}. The run must read the same
 // files, with the same configuration, and every answer it received must be
-// covered by the old questions; only file contents may differ. The program
+// covered by the old questions or be a run fact; only file contents may differ.
+// Run facts stay out of this certificate: the receipt keeps them, and status
+// asks them again for every answer. The program
 // layout is then the same, so the output is rebuilt as the probe computes it.
 // Limit: a file whose role changes (a package.json newly imported as a module)
 // keeps its old role, so a later full probe can report the check STALE.
-export function recordedCertificate(text,cache,compiler) {
+export function recordedCertificate(text,cache,compiler,buildInfo=null) {
   let record=null;
   try{record=JSON.parse(text);}catch{}
   if(record?.schema!==1||!Array.isArray(record.facts))return {issue:'record unavailable'};
   if(!cache?.layout||!cache.queries?.length)return {issue:'no previous layout'};
+  const kept=withoutBuildInfo(record.facts,buildInfo);
+  if(kept.issue)return {issue:kept.issue};
   const inCompiler=withinCompiler(compiler),reads=new Map();
-  for(const [kind,file,answer] of record.facts)if(kind==='read'&&!inCompiler(file)){
+  const before=new Map(cache.queries.filter(q=>q[0]==='readFile'&&!inCompiler(q[1])).map(q=>[q[1],q[2]]));
+  for(const [kind,file,answer] of kept.facts)if(kind==='read'&&!inCompiler(file)){
     if(answer!==null&&typeof answer!=='string')return {issue:`read ${file} failed`};
+    // A package.json only declaration checks read is a run fact, not a program read.
+    if(!before.has(file)&&path.basename(file)==='package.json')continue;
     reads.set(file,answer);
   }
-  const before=new Map(cache.queries.filter(q=>q[0]==='readFile'&&!inCompiler(q[1])).map(q=>[q[1],q[2]]));
   if(reads.size!==before.size||[...before.keys()].some(file=>!reads.has(file)))
     return {issue:'the run read different files'};
   if(cache.layout.configs.some(([file])=>!reads.has(file)||reads.get(file)!==before.get(file)))
@@ -169,7 +234,9 @@ export function recordedCertificate(text,cache,compiler) {
     return {issue:'the run loaded different lib files'};
   const changed=new Set([...reads].filter(([file,answer])=>before.get(file)!==answer).map(([file])=>file));
   const queries=cache.queries.map(q=>q[0]==='readFile'&&changed.has(q[1])?[q[0],q[1],reads.get(q[1]),...q.slice(3)]:q);
-  const issue=runRecordIssue(record,{compiler,queries,context:cache.context});
+  // Run facts belong to the receipt, which the caller builds; they do not
+  // change the program layout.
+  const issue=runRecordIssue({...record,facts:kept.facts},{compiler,queries,context:cache.context},[]);
   if(issue)return {issue};
   const files=[];
   for(const [file,digest] of cache.layout.files){

package/src/direct-typescript-probe.mjs

@@ -15,8 +15,8 @@ try{
     entry:compiler.entry,node:[realObservedPath(process.execPath),process.version]};
   const contextHash=directContextHash(compiler,context.node);
   if(!contextOnly(contextHash)){
-    const {queries,configs,files}=typeScriptInputFacts(root,compiler.tsRoot,compiler.entry);
-    const layout={root,script,configs,files,context};
+    const {queries,configs,files,buildInfo}=typeScriptInputFacts(root,compiler.tsRoot,compiler.entry);
+    const layout={root,script,configs,files,context,...(buildInfo?{buildInfo}:{})};
     probeResult(directProbeOutput(layout),contextHash,queries,layout);
   }
 }catch(e){console.error(`VSTATE_REASON:${e.code&&/^[a-z-]+$/.test(e.code)?e.code:'typescript-contract-unavailable'}`);process.exitCode=2;}

package/src/direct-typescript.mjs

@@ -10,7 +10,10 @@ const reviewed={
   '5.5.2':{entry:'lib/tsc.js',digest:'953b4844b5f6edc745be844b6c367c227b59029b73c4182f508f90cc47e21816'},
   '5.6.3':{entry:'lib/tsc.js',digest:'e674b5dc4dac50f6e91be30094aeea983a1f340231717e62b0b6199ae3049eb2'},
   '5.9.3':{entry:'lib/_tsc.js',digest:'d1b32e75475710fdc85102b1365254d84ceb192d3639d962c53fe1355ce274ca'},
+  '6.0.2':{entry:'lib/_tsc.js',digest:'273e16620fe23362e085980d6dd822e1315d81ba792221c9b6008755fdafccdd'},
+  '6.0.3':{entry:'lib/_tsc.js',digest:'e0a6519f0d0a90125b7fd3bdbbcf700e167656beb3baf8aca8ed8bc037494537'},
 };
+export const reviewedTypeScriptVersions=Object.keys(reviewed);
 const fail=code=>{throw Object.assign(Error(code),{code});};
 const hash=bytes=>createHash('sha256').update(bytes).digest('hex');
 export const directEnvironment={variables:['NODE_ENV','NODE_OPTIONS','NODE_PATH','NODE_COMPILE_CACHE','VSCODE_INSPECTOR_OPTIONS'],
@@ -78,9 +81,35 @@ export function directCompiler(root,{verify=true}={}){
 // The direct probe's output: root, script, configuration and program files with
 // their byte digests, and the execution context. A recorded run rebuilds it from
 // the same layout (direct-run-certificate.mjs).
-export function directProbeOutput({root,script,configs,files,context}){
+export function directProbeOutput({root,script,configs,files,context,buildInfo}){
   const named=list=>list.map(([file,digest])=>[hash(file),digest]);
-  return hash(JSON.stringify({root,script,configs:named(configs),files:named(files),...context}));
+  return hash(JSON.stringify({root,script,configs:named(configs),files:named(files),...context,
+    ...(buildInfo?{buildInfo}:{})}));
+}
+// The build-info file an incremental root config makes tsc read and write,
+// as {file} relative to the root, {} when not incremental, or {issue}. The
+// probe and the plan both use this rule. It must be inside the checkout, end
+// in .tsbuildinfo (the only write the run recorder allows) and contain no glob
+// characters (the plan excludes it with a pattern). An option that makes the
+// result depend on the build-info history is refused.
+export function buildInfoFor(ts,options,root) {
+  if(!options?.incremental)return {};
+  if(options.assumeChangesOnlyAffectDirectDependencies)return {issue:'typescript-incremental-unsound'};
+  const file=ts.getTsBuildInfoEmitOutputFilePath?.(options);
+  if(!file||!withinPath(path.resolve(file),root))return {issue:'typescript-buildinfo-outside-repository'};
+  const relative=path.relative(root,path.resolve(file)).split(path.sep).join('/');
+  if(!relative.endsWith('.tsbuildinfo')||/[*?[\]{}()!+@,]/.test(relative))return {issue:'typescript-buildinfo-name-unsupported'};
+  return {file:relative};
+}
+// The plan's build-info file, or null. The compiler is loaded only when the
+// root config sets incremental or extends another config.
+export function directBuildInfo(root,script) {
+  const config=path.join(root,'tsconfig.json');
+  let raw;try{raw=fs.readFileSync(config,'utf8');}catch{return null;}
+  if(!/"(?:incremental|extends)"\s*:/.test(raw))return null;
+  const compiler=directProject(root,script,{verify:false}),ts=createRequire(import.meta.url)(compiler.tsRoot);
+  const parsed=ts.getParsedCommandLineOfConfigFile(config,{},{...ts.sys,onUnRecoverableConfigFileDiagnostic(){}});
+  return parsed?.options?.composite?null:buildInfoFor(ts,parsed?.options,root).file??null;
 }
 // The probe value the daemon stores for one direct probe's checkpoint output.
 export function directProbeValue(argv,output,stderrHash){