@redue/cli 0.1.0-alpha.11 → 0.1.0-alpha.13

package/src/index.mjs

@@ -5,7 +5,7 @@ import {createHash} from 'node:crypto';
 import micromatch from './glob.mjs';
 import {sha} from './plan.mjs';
 import {resolveLinks} from './installed-inputs.mjs';
-import {validInputRelative} from './path-identity.mjs';
+import {validInputRelative,identityFields,racyUntil} from './path-identity.mjs';
 
 const tracked = root => [...new Set(execFileSync('git',
   ['ls-files','--cached','--others','--exclude-standard','-z'],
@@ -35,37 +35,43 @@ const pathPrefixes = rel => {
   return prefixes;
 };
 
+// An installed file is observed by identity, not content: every write changes
+// ctime, so its entry changes without reading the whole installation. The
+// compiler's own reads are content-checked by its probe and certificate. A file
+// changed within the racy window could still be rewritten in the same timestamp
+// tick at the same size; such files are tracked in `racy`, and the daemon waits
+// the window out and records them again before it writes a run checkpoint.
+const identity=st=>identityFields.map(key=>String(st[key])).join(':');
 function fileHash(root, rel,installed=false,before=fs.lstatSync(path.join(root,rel),
   {bigint:true})) {
   const file=path.join(root, rel);
-  let value,references=[],bytes=Number(before.size);
+  let value,references=[],bytes=installed?0:Number(before.size),racy=0;
   if(before.isSymbolicLink()){
     const resolution=resolveLinks(file,root,[],true);
     if(!resolution.physical)throw Error(`symlink input target observation unavailable: ${rel}: ${resolution.reason}`);
     const target=fs.statSync(resolution.physical,{bigint:true});
     if(!target.isFile())throw Error(`directory input symlink unsupported: ${rel}`);
-    value='link:'+JSON.stringify(resolution.links)+':'+target.mode+':'+
-      (installed&&target.nlink>1?target.nlink+':':'')+
-      hashRegular(resolution.physical).hash;
+    if(installed)racy=racyUntil(target);else bytes=Number(target.size);
+    value='link:'+JSON.stringify(resolution.links)+':'+(installed?'stat:'+identity(target):
+      target.mode+':'+hashRegular(resolution.physical).hash);
     references=[...new Set([...resolution.links.map(link=>path.relative(root,link.path)
       .split(path.sep).join('/')),path.relative(root,resolution.physical)
       .split(path.sep).join('/')])];
-    bytes=Number(target.size);
     const targetAfter=fs.statSync(resolution.physical,{bigint:true});
-    for(const key of ['dev','ino','mode','nlink','size','mtimeNs','ctimeNs'])
+    for(const key of identityFields)
       if(target[key]!==targetAfter[key])throw Error(`input changed during inspection: ${rel}`);
     const resolutionAfter=resolveLinks(file,root,[],true);
     if(resolutionAfter.physical!==resolution.physical||
       JSON.stringify(resolutionAfter.links)!==JSON.stringify(resolution.links))
       throw Error(`input link changed during inspection: ${rel}`);
   }
-  else if(before.isFile()) value='file:'+before.mode+':'+
-    (installed&&before.nlink>1?before.nlink+':':'')+hashRegular(file).hash;
+  else if(before.isFile()&&installed){value='stat:'+identity(before);racy=racyUntil(before);}
+  else if(before.isFile()) value='file:'+before.mode+':'+hashRegular(file).hash;
   else throw Error(`non-file input: ${rel}`);
   const after=fs.lstatSync(file,{bigint:true});
-  for(const key of ['dev','ino','mode','nlink','size','mtimeNs','ctimeNs'])
+  for(const key of identityFields)
     if(before[key]!==after[key]) throw Error(`input changed during inspection: ${rel}`);
-  return {hash:sha(value),references,bytes};
+  return {hash:sha(value),references,bytes,racy};
 }
 const readBuffer=Buffer.allocUnsafe(65536);
 function hashRegular(file) {
@@ -81,6 +87,7 @@ export class InputIndex {
     const matcherStarted=performance.now();
     this.bundle=bundle; this.root=bundle.root; this.files=new Map(); this.members=new Map();
     this.symlinkRefs=new Map();this.aliasDependencies=new Map();
+    this.racy=new Map();
     this.trackGit=options.trackGit!==false;
     this.installedRoots=[...new Set(Object.values(bundle.plans).flatMap(plan=>
       plan.installedPhysicalRoots||[]))];
@@ -149,6 +156,17 @@ export class InputIndex {
     }
     return {files,bytes,durationMs:performance.now()-started};
   }
+  // When the racy window of the named checks' installed members ends (0: none).
+  racyUntil(names=null) {
+    let until=0;
+    for(const [rel,time] of this.racy)
+      if(!names||[...this.members.get(rel)||[]].some(name=>names.includes(name)))until=Math.max(until,time);
+    return until;
+  }
+  // Records again every installed file whose racy window has passed.
+  settleRacy() {
+    for(const [rel,time] of [...this.racy])if(time<=Date.now())this.record(rel,rel+' changed');
+  }
   summary(name) { const row=this.checks.get(name); return {fingerprint:this.fingerprint(name),
     revision:row.revision,planId:row.plan.id,files:row.files.size,probeAt:row.probeAt}; }
   record(rel, changeReason=rel+' changed', observedStat=null) {
@@ -182,6 +200,7 @@ export class InputIndex {
       }
     }
     const oldNames=this.members.get(rel)||new Set(), newNames=new Set(fresh===undefined?[]:matched);
+    if(inspection?.racy>Date.now()&&newNames.size)this.racy.set(rel,inspection.racy);else this.racy.delete(rel);
     if(old===fresh && oldNames.size===newNames.size && [...oldNames].every(n=>newNames.has(n))) return false;
     for(const name of new Set([...oldNames,...newNames])) {
       const row=this.checks.get(name);
@@ -304,3 +323,14 @@ export class InputIndex {
     return out;
   }
 }
+
+// The index state a worker sends and a restart retains; hydrate() in daemon.mjs
+// reads it back.
+export function dehydrateIndex(value) {
+  return {files:[...value.files],
+    aliasDependencies:[...value.aliasDependencies].map(([name,refs])=>[name,[...refs]]),
+    rows:[...value.checks].map(([name,row])=>({name,files:[...row.files],
+      sum:row.sum.toString('hex'),revision:row.revision,lastReason:row.lastReason})),
+    eventCount:value.eventCount,rehashedFiles:value.rehashedFiles,
+    rehashedBytes:value.rehashedBytes,profile:value.profile,racy:[...value.racy]};
+}

package/src/linux-inotify.py

@@ -73,10 +73,18 @@ def main(root):
     file_paths = {}
     intentional_removals = set()
 
+    # No input lies in a .git directory (config refuses such patterns and the
+    # index skips them), so none is watched: git creates object directories
+    # there on most commits, and each would be an observation gap.
+    def in_git(target):
+        return '.git' in os.path.relpath(target, root).split(os.sep)
+
     def add_tree(folder):
         stack = [folder]
         while stack:
             current = stack.pop()
+            if in_git(current):
+                continue
             wd = libc.inotify_add_watch(fd, os.fsencode(current), MASK)
             if wd < 0:
                 raise OSError(ctypes.get_errno(), 'inotify_add_watch failed')
@@ -119,6 +127,8 @@ def main(root):
                     emit('gap', reason='inotify_watch_unknown')
                     return False
                 target = os.path.join(parent, os.fsdecode(raw)) if raw else parent
+                if in_git(target):
+                    continue
                 if mask & (IN_UNMOUNT | IN_DELETE_SELF | IN_MOVE_SELF | IN_IGNORED):
                     emit('gap', reason='inotify_watch_lost')
                     return False

package/src/path-identity.mjs

@@ -41,3 +41,11 @@ export function validInputRelative(rel,platform=process.platform) {
     rel.includes('\\')))return false;
   return true;
 }
+
+// File identity fields. Any write changes ctime, but timestamps tick in
+// milliseconds: a file changed within the racy window could be rewritten in the
+// same tick at the same size without changing them (git's racy rule).
+export const identityFields=['dev','ino','mode','nlink','size','mtimeNs','ctimeNs'];
+export const racyWindowMs=2000;
+// ctime, which no ordinary tool can set ahead, ends the window.
+export const racyUntil=st=>Number(st.ctimeNs/1000000n)+racyWindowMs;

package/src/plan-worker.mjs

@@ -3,7 +3,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import {createHash} from 'node:crypto';
 import {discover} from './plan.mjs';
-import {InputIndex} from './index.mjs';
+import {InputIndex,dehydrateIndex} from './index.mjs';
 import {directProject,directQualification} from './direct-typescript.mjs';
 import {queriesMatch} from './typescript-list.mjs';
 import {planGuard,inputKey} from './decision-validation.mjs';
@@ -113,26 +113,14 @@ try {
     const outside=new InputIndex({root:boundary,plans},{trackGit:false,includeInstalled:true});
     outside.coldScan();
     if(outside.unavailable)throw Error(outside.unavailable);
-    external[boundary]={files:[...outside.files],
-      aliasDependencies:[...outside.aliasDependencies].map(([name,refs])=>[name,[...refs]]),
-      rows:[...outside.checks]
-      .map(([name,row])=>({name,files:[...row.files],sum:row.sum.toString('hex'),
-        revision:row.revision,lastReason:row.lastReason})),
-      eventCount:outside.eventCount,rehashedFiles:outside.rehashedFiles,
-      rehashedBytes:outside.rehashedBytes,profile:outside.profile};
+    external[boundary]=dehydrateIndex(outside);
   }
   timing('worker.total',totalStarted,{mode:'cold',files:index.files.size});
   parentPort.postMessage({ok:true,bundle,discoveryMs,indexingMs,guard,planReused,
     inputKeys:Object.fromEntries([...index.checks].map(([name,row])=>[name,inputKey(row)])),
     restartMode:'cold-index',
     external,
-    index:{files:[...index.files],
-      aliasDependencies:[...index.aliasDependencies].map(([name,refs])=>[name,[...refs]]),
-      rows:[...index.checks].map(([name,row])=>({
-      name,files:[...row.files],sum:row.sum.toString('hex'),revision:row.revision,
-      lastReason:row.lastReason})),
-    eventCount:index.eventCount,rehashedFiles:index.rehashedFiles,
-    rehashedBytes:index.rehashedBytes,profile:index.profile}});
+    index:dehydrateIndex(index)});
   }
 } catch(error) {
   parentPort.postMessage({ok:false,error:error?.message||String(error),

package/src/pnpm-inputs.mjs

@@ -1,6 +1,7 @@
 // Pinned pnpm 12 node-modules installation provider. The engine sees only
 // repository-relative input sets and resolution relationships, never pnpm
 // virtual-store names as semantic identities.
+import {probeTimeLeft} from './probe-deadline.mjs';
 import {compilerFiles} from './typescript-list.mjs';
 import fs from 'node:fs';
 import path from 'node:path';
@@ -96,7 +97,7 @@ export function pnpmWorkspacePackages(root,patterns){
   const files=execFileSync('git',['ls-files','--cached','--others','--exclude-standard',
     '-z','--',':(glob)**/package.json'],{cwd:root,
     env:{...process.env,GIT_OPTIONAL_LOCKS:'0'},maxBuffer:32*1024*1024,
-    timeout:5000}).toString().split('\0').filter(Boolean);
+    timeout:probeTimeLeft(5000)}).toString().split('\0').filter(Boolean);
   for(const file of files){
     const dir=path.posix.dirname(file);
     if(dir==='.'||dir.split('/').includes('node_modules')||
@@ -202,7 +203,7 @@ function listedTypeScriptFiles(root,selected,tsc){
     {cwd:path.join(root,selected.dir),env:process.env,encoding:'utf8',
       // The native NTFS public workspace takes 3-5 s to list ~770 inputs;
       // 5 s sometimes expired despite bounded, progressing compiler work.
-      timeout:10000,maxBuffer:32*1024*1024,stdio:['ignore','pipe','pipe']});
+      timeout:probeTimeLeft(10000),maxBuffer:32*1024*1024,stdio:['ignore','pipe','pipe']});
   if(out.error||out.signal||out.status!==0)
     throw Error('TypeScript input listing is unavailable');
   const files=out.stdout.trim().split(/\r?\n/).filter(Boolean)

package/src/probe-deadline.mjs

@@ -0,0 +1,37 @@
+// How long a full probe may run before it is killed and the check stays
+// UNVERIFIED. It grows with the project: the larger of the hint from earlier
+// probes (twice the last successful one, or twice the deadline that last timed
+// out) and the last completed run, between the platform floor and a ceiling.
+import {fileURLToPath} from 'node:url';
+export const probeCeilingMs=process.env.VSTATE_TEST_FAULTS==='1'&&
+  Number(process.env.VSTATE_TEST_PROBE_CEILING_MS)||60000;
+// Supported TypeScript probes perform bounded input/toolchain hashing.
+// Native NTFS runs have exceeded the generic 5 s cap under load, despite
+// completing normally and with the duplicated work already removed.
+export const probeFloorMs=qualification=>qualification==='pnpm-tsc-v1'||
+  (process.platform==='win32'&&['typescript-noemit-v1','npm-typescript-direct-v1','yarn-workspace-tsc-v1']
+    .includes(qualification))?10000:5000;
+// REDUE's own probes, which accept --redue-deadline; a user's probe never gets it.
+const builtIn=new Set(['typescript-contract-probe.mjs','direct-typescript-probe.mjs',
+  'yarn-workspace-typecheck-probe.mjs','pnpm-typecheck-probe.mjs'].map(name=>fileURLToPath(new URL(name,import.meta.url))));
+export const builtInProbe=argv=>builtIn.has(argv?.[1]);
+// A deadline read from status.json, as a whole number of milliseconds no
+// longer than a decision could need (0 when absent or unusable).
+export function publishedDeadline(value) {
+  return Number.isFinite(value)&&value>0?Math.min(Math.round(value),10*60*1000):0;
+}
+export function probeDeadline({floor,hint=0,runMs=0,ceiling=probeCeilingMs}) {
+  const finite=value=>Number.isFinite(value)&&value>0?value:0;
+  return Math.round(Math.min(ceiling,Math.max(floor,finite(hint),finite(runMs))));
+}
+// The hint the next probe starts from.
+export function nextProbeHint({durationMs,deadlineMs,timedOut}) {
+  return 2*(timedOut?deadlineMs:durationMs);
+}
+// Inside a probe process: what is left of the deadline its caller passed with
+// --redue-deadline=MS, or the fallback when none was passed. An inner call
+// always ends before its parent is killed, so it never outlives the probe.
+export function probeTimeLeft(fallback) {
+  const deadline=Number(/^--redue-deadline=(\d+)$/.exec(process.argv.find(arg=>arg.startsWith('--redue-deadline='))||'')?.[1]);
+  return deadline?Math.max(1,Math.round(deadline-performance.now()-250)):fallback;
+}

package/src/run-recorder.cjs

@@ -51,13 +51,26 @@ const realpath=observe('realpath',original.realpathSync,value=>value);
 realpath.native=observe('realpath',original.native,value=>value);
 fs.realpathSync=realpath;
 // readFileSync opens through fs.openSync; only a writable open is a write.
+// The one write a direct run may make is its build-info file (incremental);
+// it is recorded, and the caller checks it is the configured one.
+const buildInfo=file=>typeof file==='string'&&file.endsWith('.tsbuildinfo');
 fs.openSync=function(file,flags,...rest){
-  if(!(flags===undefined||flags==='r'||flags==='rs'||flags===fs.constants.O_RDONLY))unsupported??='openSync';
+  if(!(flags===undefined||flags==='r'||flags==='rs'||flags===fs.constants.O_RDONLY)){
+    if(flags==='w'&&buildInfo(file))note('write',path.resolve(file),null);
+    else unsupported??='openSync';
+  }
   return original.openSync.call(this,file,flags,...rest);
 };
+// tsc creates the build-info directory one level at a time; each is recorded.
+const mkdirSync=fs.mkdirSync;
+fs.mkdirSync=function(file,options,...rest){
+  if(typeof file==='string'&&options===undefined)note('mkdir',path.resolve(file),null);
+  else unsupported??='mkdirSync';
+  return mkdirSync.call(this,file,options,...rest);
+};
 // Writes, and reads this record cannot answer for, make it unusable. readSync
 // and fstatSync stay open: readFileSync reads through them.
-for(const name of ['writeFileSync','appendFileSync','mkdirSync','unlinkSync','utimesSync',
+for(const name of ['writeFileSync','appendFileSync','unlinkSync','utimesSync',
   'renameSync','rmSync','watch','watchFile','existsSync','lstatSync','accessSync','opendirSync',
   'readlinkSync','readFile','stat','lstat','readdir','realpath','access','exists','open','opendir',
   'readlink','createReadStream']){

package/src/typescript-input-facts.mjs

@@ -2,18 +2,21 @@
 import fs from 'node:fs';import path from 'node:path';import {createHash} from 'node:crypto';
 import {createRequire} from 'node:module';import {spawnSync} from 'node:child_process';
 import {compilerFiles} from './typescript-list.mjs';
+import {buildInfoFor} from './direct-typescript.mjs';
+import {probeTimeLeft} from './probe-deadline.mjs';
 import {withinPath as within,realObservedPath} from './path-identity.mjs';
 import {timing} from './decision-profile.mjs';
 const require=createRequire(import.meta.url),hash=value=>createHash('sha256').update(value).digest('hex');
 const digestFile=file=>hash(fs.readFileSync(file));
 const fail=code=>{throw Object.assign(Error(code),{code});};
 export function typeScriptInputFacts(root,tsRoot,tsc){
-  const configReads=new Set(),visited=new Set();
+  const configReads=new Set(),visited=new Set(),referenced=[];
+  let buildInfo=null;
   let ts;try{ts=require(tsRoot);}catch{}
   if(typeof ts?.getParsedCommandLineOfConfigFile==='function'){
     const host={...ts.sys,readFile(file){configReads.add(path.resolve(file));
       return ts.sys.readFile(file);},onUnRecoverableConfigFileDiagnostic(){}};
-    const parseConfig=file=>{
+    const parseConfig=(file,top=false)=>{
       const absolute=path.resolve(file);
       if(!within(absolute,root))fail('typescript-config-outside-repository');
       if(visited.has(absolute))return;visited.add(absolute);
@@ -21,13 +24,20 @@ export function typeScriptInputFacts(root,tsRoot,tsc){
       const parsed=ts.getParsedCommandLineOfConfigFile(absolute,{},host);
       if(!parsed||parsed.errors?.length)fail('typescript-config-unavailable');
       if(parsed.options?.plugins?.length)fail('typescript-plugin-unsupported');
-      if(parsed.options?.incremental||parsed.options?.composite)
-        fail('typescript-incremental-unsupported');
+      // Plain tsc reads a referenced config but never builds it, so only the
+      // root config's build settings matter. An incremental root reads and
+      // writes one build-info file, which must be inside the checkout.
+      if(top){
+        if(parsed.options?.composite)fail('typescript-incremental-unsupported');
+        const found=buildInfoFor(ts,parsed.options,root);
+        if(found.issue)fail(found.issue);
+        buildInfo=found.file||null;
+      }else referenced.push(parsed);
       for(const reference of parsed.projectReferences||[])
         parseConfig(reference.path.endsWith('.json')?reference.path:
           path.join(reference.path,'tsconfig.json'));
     };
-    parseConfig(path.join(root,'tsconfig.json'));
+    parseConfig(path.join(root,'tsconfig.json'),true);
   }else{
     // TypeScript 7's native compiler does not expose the previous config API.
     // Its CLI reports the effective config; restrict this path to one direct
@@ -36,7 +46,7 @@ export function typeScriptInputFacts(root,tsRoot,tsc){
     if(/"(?:extends|references|plugins|incremental|composite)"\s*:/.test(raw))
       fail('typescript-config-graph-unsupported');
     const shown=spawnSync(process.execPath,[tsc,'--showConfig'],{cwd:root,
-      env:process.env,encoding:'utf8',timeout:4000,maxBuffer:16*1024*1024,
+      env:process.env,encoding:'utf8',timeout:probeTimeLeft(4000),maxBuffer:16*1024*1024,
       stdio:['ignore','pipe','pipe']});
     if(shown.error||shown.signal||shown.status!==0)fail('typescript-config-unavailable');
     const effective=JSON.parse(shown.stdout);
@@ -50,7 +60,7 @@ export function typeScriptInputFacts(root,tsRoot,tsc){
   const listingStarted=performance.now();
   const captured=process.argv.includes('--redue-checkpoint')?compilerFiles(tsRoot,root):null;
   const listed=captured?{status:0,stdout:captured.files.join('\n')}:spawnSync(process.execPath,[tsc,'--noEmit','--listFilesOnly'],
-    {cwd:root,env:process.env,encoding:'utf8',timeout:process.platform==='win32'?10000:4000,
+    {cwd:root,env:process.env,encoding:'utf8',timeout:probeTimeLeft(process.platform==='win32'?10000:4000),
       maxBuffer:16*1024*1024,
       stdio:['ignore','pipe','pipe']});
   timing('typescript_contract.list_files',listingStarted,{status:listed.status??null,
@@ -60,9 +70,23 @@ export function typeScriptInputFacts(root,tsRoot,tsc){
     .map(file=>path.resolve(file));
   if(!files.length||files.some(file=>!within(realObservedPath(file),root)))
     fail('typescript-input-outside-repository');
+  // A program that uses a referenced project's sources or outputs depends on
+  // that project's build, which plain tsc does not run. tsc redirects only
+  // TypeScript sources; a shared .d.ts or .json is an ordinary input.
+  const declaration=/\.d\.[cm]?ts$|\.json$/;
+  const sources=new Set(),outputs=new Set(),outDirs=[];
+  for(const parsed of referenced){
+    const dirs=[parsed.options.outDir,parsed.options.declarationDir].filter(Boolean).map(dir=>path.resolve(dir));
+    outDirs.push(...dirs);
+    for(const file of parsed.fileNames.map(name=>path.resolve(name)))if(!declaration.test(file)){
+      sources.add(file);if(!dirs.length)outputs.add(file.replace(/\.[cm]?tsx?$/,ext=>ext.replace(/tsx?$/,'d.ts')));}
+  }
+  if(files.some(file=>sources.has(file)||outputs.has(file)||outDirs.some(dir=>within(file,dir))))
+    fail('typescript-project-reference-consumed');
   // Every hashed configuration must also be a certified question.
   const queries=captured?.queries&&[...configReads].every(file=>
     captured.queries.some(([kind,read])=>kind==='readFile'&&read===file))?captured.queries:null;
   return {configs:[...configReads].sort().map(file=>[file,digestFile(file)]),
-    files:[...new Set(files)].sort().map(file=>[file,digestFile(file)]),queries};
+    files:[...new Set(files)].sort().map(file=>[file,digestFile(file)]),queries,
+    ...(buildInfo?{buildInfo}:{})};
 }

package/src/typescript-list.mjs

@@ -5,6 +5,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import {createHash} from 'node:crypto';
 import {createRequire} from 'node:module';
+import {identityFields,racyUntil} from './path-identity.mjs';
 const require=createRequire(import.meta.url);
 const hash=value=>createHash('sha256').update(JSON.stringify(value)).digest('hex');
 export function queryAnswer(kind,file,options) {
@@ -38,6 +39,24 @@ export function queryAnswer(kind,file,options) {
     throw Error('unknown compiler filesystem question');
   }catch(error){if(['ENOENT','ENOTDIR'].includes(error.code))return null;throw error;}
 }
+// Null when every run fact answers as it did during the run, otherwise the
+// first path that does not. Asked in-process; nothing is launched.
+export function runFactChange(facts) {
+  if(!Array.isArray(facts))return 'an unreadable run fact';
+  for(const fact of facts){
+    if(!Array.isArray(fact)||!['fileExists','directoryExists','realpath','readFile'].includes(fact[0])||
+      typeof fact[1]!=='string')return 'an unreadable run fact';
+    const [kind,file,answer]=fact;
+    let now;try{now=queryAnswer(kind,file);}catch{return file;}
+    if(now!==answer)return file;
+  }
+  return null;
+}
+// Why a receipt's run facts no longer hold, or null when they all do.
+export function runFactReason(facts) {
+  const changed=runFactChange(facts);
+  return changed&&`a lookup the last run made answers differently now: ${changed}`;
+}
 export function queriesMatch(queries) {
   if(!queries?.length)return false;
   return queries.every(([kind,file,answer,options])=>
@@ -92,13 +111,15 @@ export function compilerFiles(tsRoot,cwd) {
       ['readDirectory',full,[...result].sort(),options]);
     return result;
   };
+  const realpath=file=>{remember('realpath',file);return ts.sys.realpath(file);};
+  // `extends` of a package config resolves through realpath too.
   const parsed=ts.getParsedCommandLineOfConfigFile(path.join(cwd,'tsconfig.json'),{},
-    {...ts.sys,readFile,fileExists,directoryExists,getDirectories,readDirectory,
+    {...ts.sys,readFile,fileExists,directoryExists,getDirectories,readDirectory,realpath,
       onUnRecoverableConfigFileDiagnostic(){}});
   if(!parsed||parsed.errors?.length)throw Error('TypeScript configuration unavailable');
   const host=ts.createCompilerHost(parsed.options);
   Object.assign(host,{readFile,fileExists,directoryExists,getDirectories,readDirectory,
-    realpath(file){remember('realpath',file);return ts.sys.realpath(file);},
+    realpath,
     getSourceFile(file,languageVersion,onError){
       const text=readFile(file);return text===undefined?undefined:
         ts.createSourceFile(file,text,languageVersion);
@@ -109,9 +130,9 @@ export function compilerFiles(tsRoot,cwd) {
   // Stable answers are necessary even at first capture; a concurrent edit
   // cannot become the basis for a reusable discovery result.
   const facts=[...queries.values()];
-  // A certificate must cover every program file; references parse further
-  // configurations outside this host and are not certified.
-  const complete=!parsed.projectReferences?.length&&files.every(file=>queries.has('readFile\0'+file));
+  // A certificate must cover every program file. Referenced configurations
+  // are parsed through this host, so their reads and listings are certified.
+  const complete=files.every(file=>queries.has('readFile\0'+file));
   return {files,queries:complete&&queriesMatch(facts)?facts:null};
 }
 // Identity of a read file and, for a link, of its target. Writes through any
@@ -119,8 +140,8 @@ export function compilerFiles(tsRoot,cwd) {
 // coarse timestamp cannot hide a second write in the same tick (git's racy rule).
 export function fileIdentity(file,now=Date.now()) {
   try{const link=fs.lstatSync(file,{bigint:true}),target=link.isSymbolicLink()?fs.statSync(file,{bigint:true}):link;
-    if(Number(link.ctimeNs/1000000n)>=now-2000||Number(target.ctimeNs/1000000n)>=now-2000)return null;
-    const fields=st=>['dev','ino','mode','nlink','size','mtimeNs','ctimeNs'].map(key=>String(st[key]));
+    if(racyUntil(link)>=now||racyUntil(target)>=now)return null;
+    const fields=st=>identityFields.map(key=>String(st[key]));
     return JSON.stringify([fields(target),target===link?null:[fs.realpathSync(file),...fields(link)]]);}
   catch(error){if(['ENOENT','ENOTDIR'].includes(error.code))return null;throw error;}
 }

package/src/yarn-workspace-typecheck-probe.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 // Read-only applicability probe. Its output is one digest or a fixed reason;
 // source, configuration, environment values, and command output are not logged.
+import {probeTimeLeft} from './probe-deadline.mjs';
 import {compilerFiles} from './typescript-list.mjs';
 import {contextOnly,probeResult} from './probe-result.mjs';
 import fs from 'node:fs';
@@ -79,7 +80,7 @@ try{
   const tsc=yarnLocalTsc(root);
   const captured=process.argv.includes('--redue-checkpoint')?compilerFiles(path.join(root,'node_modules/typescript'),cwd):null;
   const listed=captured?{status:0,stdout:captured.files.join('\n')}:spawnSync(process.execPath,[tsc,'-p','.','--listFilesOnly'],
-    {cwd,env:process.env,encoding:'utf8',timeout:4000,maxBuffer:16*1024*1024,
+    {cwd,env:process.env,encoding:'utf8',timeout:probeTimeLeft(4000),maxBuffer:16*1024*1024,
       stdio:['ignore','pipe','pipe']});
   if(listed.error||listed.signal||listed.status!==0)fail('typescript-input-list-unavailable');
   const inputs=listed.stdout.trim().split(/\r?\n/).filter(Boolean)