@redue/cli 0.1.0-alpha.12 → 0.1.0-alpha.14

package/src/cli.mjs

@@ -1,8 +1,10 @@
 #!/usr/bin/env node
+import {builtInProbe,probeFloorMs,publishedDeadline} from './probe-deadline.mjs';
 import fs from 'node:fs';
 import {directQualification,directInterpretation,observedNpmContext} from './direct-typescript.mjs';
 import {directRunCertificateAllowed,directRunCertificate,directRunRecordable,directRunRecording,probeQuestions,validateRunRecord} from './direct-run-certificate.mjs';
 import {runFactChange} from './typescript-list.mjs';
+import {changedFiles,coverageReadable,gitIgnored,recordedEnvironment,testProject,testEnvironmentIssue,testGuardConfig,testRunGuard,testsInterpretation,testsQualification} from './test-direct.mjs';
 import path from 'node:path';
 import net from 'node:net';
 import os from 'node:os';
@@ -18,7 +20,7 @@ import {createHash,randomUUID} from 'node:crypto';
 import {assertOwnedStatePlacement} from './owned-state.mjs';
 import {permittedRoots} from './installed-inputs.mjs';
 import {acquireRunLock,inspectRunLock,recoverRunLock} from './run-lock.mjs';
-import {atomicJson,commitReceipt,receiptRevision} from './state-store.mjs';
+import {atomicJson,commitReceipt,readReceipts,receiptRevision} from './state-store.mjs';
 import {timing,profiling,mark,traceContext} from './decision-profile.mjs';
 import {readCachedStatus,unavailableCached} from './cached-state.mjs';
 import {renderRun} from './presentation.mjs';
@@ -43,7 +45,14 @@ timing('cli.config_resolution',configStarted);
 // A native Windows decision reconciles declared contents instead of trusting
 // watcher history. The measured 6k-file pnpm workspace can legitimately need
 // more than the former 15 s default; uncertainty still wins on expiry.
-const decisionDeadlineMs=process.platform==='win32'?30000:15000;
+// A decision can include a full probe, whose deadline the observer publishes.
+// Read when a wait starts, so a deadline the previous decision raised counts.
+const decisionBaseMs=process.platform==='win32'?30000:15000;
+function publishedProbeDeadline() {
+  try{return publishedDeadline(JSON.parse(fs.readFileSync(path.join(state,'status.json'),'utf8')).probe_deadline_ms);}
+  catch{return 0;}
+}
+const decisionDeadline=()=>Math.max(decisionBaseMs,publishedProbeDeadline()+10000);
 const digest=value=>createHash('sha256').update(value).digest('hex');
 function nodeIdentity() {const real=fs.realpathSync(process.execPath),st=fs.statSync(real,{bigint:true});
   return digest(JSON.stringify([real,process.version,...['dev','ino','mode','size','mtimeNs','ctimeNs']
@@ -55,7 +64,13 @@ function pathExecutableIdentity(name) {
   catch{}
   return digest('<unavailable>');
 }
-function contextHashes() {return Object.fromEntries(config.checks.map(check=>[
+// The variables each test check's last run read directly (see testRunGuard).
+const readsFile=path.join(state,'environment-reads-v1.json');
+function environmentReads() {
+  try{const value=JSON.parse(fs.readFileSync(readsFile,'utf8'));return value?.schema===1&&value.checks||{};}catch{return {};}
+}
+function contextHashes() {const reads=config.checks.some(check=>check.qualification===testsQualification)?environmentReads():{};
+  return Object.fromEntries(config.checks.map(check=>[
   check.name,Object.fromEntries([...(check.environment?.variables||[])
     .map(key=>[key,digest(process.env[key]??'<unset>')]),
     ...(check.environment?.prefixes||[]).map(prefix=>[
@@ -65,15 +80,20 @@ function contextHashes() {return Object.fromEntries(config.checks.map(check=>[
           .sort(([a],[b])=>a.localeCompare(b))))]),
     ...(check.environment?.pathExecutables||[]).map(name=>[
       `__vstate_path_executable_${name}__`,pathExecutableIdentity(name)]),
-    ...(check.environment?.executableIdentity?[['__vstate_node_identity__',nodeIdentity()]]:[])])]));}
+    ...(check.environment?.executableIdentity?[['__vstate_node_identity__',nodeIdentity()]]:[]),
+    // The variables the last test run read directly, compared here: which
+    // list was compared, and the first variable whose value now differs.
+    // Control requests are small, so the values stay out of them.
+    ...(reads[check.name]?[['__redue_env_reads__',digest(JSON.stringify(reads[check.name]))],
+      ['__redue_env_changed__',Object.keys(reads[check.name]).find(key=>
+        (process.env[key]===undefined?'<unset>':digest(process.env[key]))!==reads[check.name][key])||'']]:[])])]));}
 function probeHash(plan) {
   const started=performance.now();
   const values=[];
+  // The observer's current deadline, so a large project's probe is not cut short.
+  const timeout=Math.max(probeFloorMs(plan.qualification),publishedProbeDeadline());
   for(const argv of plan.probes||[]) {
-    const timeout=plan.qualification==='pnpm-tsc-v1'||
-      (process.platform==='win32'&&['typescript-noemit-v1','npm-typescript-direct-v1','yarn-workspace-tsc-v1']
-        .includes(plan.qualification))?10000:5000;
-    const out=spawnSync(argv[0],argv.slice(1),{cwd:plan.cwd,
+    const out=spawnSync(argv[0],[...argv.slice(1),...(builtInProbe(argv)?[`--redue-deadline=${timeout}`]:[])],{cwd:plan.cwd,
       timeout,maxBuffer:1024*1024,stdio:['ignore','pipe','pipe'],env:process.env});
     if(out.error||out.signal||out.status!==0){
       timing('cli.probe',started,{outcome:out.error?.code||out.signal||out.status||'error',
@@ -210,7 +230,7 @@ async function execute() {
     const observedContext=selected.qualification===directQualification?{interpretation:directInterpretation,npmProxyDigest:observedNpmContext()}:null;
     timing('cli.context_before',contextStarted);
     const
-      captureTimeout=Number(process.env.VSTATE_CAPTURE_TIMEOUT_MS||decisionDeadlineMs);
+      captureTimeout=Number(process.env.VSTATE_CAPTURE_TIMEOUT_MS||decisionDeadline());
     let before=null,after=null;
     // Expensive state probes can take seconds. Keep the filesystem checkpoint
     // adjacent to process launch so a late notification from earlier work
@@ -251,6 +271,19 @@ async function execute() {
     const recorded=directRunRecordable(selected)&&!unobservedDirectRun;
     const launched=recorded?[command[0],'--require',path.join(here,'run-recorder.cjs'),
       ...command.slice(1)]:command;
+    // A test run's processes record what the guard checks (test-recorder.cjs).
+    const testRun=selected.qualification===testsQualification&&['darwin','linux'].includes(process.platform);
+    let testRecord=null,launchEnv=process.env;
+    if(testRun){
+      const environmentIssue=testEnvironmentIssue();
+      if(environmentIssue)captureIssues.push(environmentIssue);
+      testRecord=path.join(state,`test-record-${runId}`);
+      fs.mkdirSync(testRecord,{mode:0o700});
+      const guardFile=path.join(testRecord,'guard.json');
+      fs.writeFileSync(guardFile,JSON.stringify(testGuardConfig(testRecord,root)),{mode:0o600});
+      launchEnv=recordedEnvironment(guardFile);
+    }
+    let runnerPid=null;
     const record=[];
     // A Windows full reconciliation may finish while queued watcher callbacks
     // are still arriving. Fold callbacks delivered before process launch into
@@ -274,11 +307,11 @@ async function execute() {
       try{runLock.phase('launching');
         const launch=windowsLaunch(launched);
         child=spawn(launch.file,launch.args,{cwd:plan.cwd,
-        stdio:recorded?['inherit','inherit','inherit','pipe']:'inherit',env:process.env,
+        stdio:recorded?['inherit','inherit','inherit','pipe']:'inherit',env:launchEnv,
         detached:process.platform==='linux',...launch.options});
         child.stdio[3]?.on('data',chunk=>record.push(chunk));}
       catch(e){resolve({status:'start_failed',exitCode:null,signal:null,errorCode:e.code||e.name});return;}
-      activeChild=child;runLock.phase('running',child.pid??null);
+      activeChild=child;runnerPid=child.pid??null;runLock.phase('running',child.pid??null);
       mark('cli.child_started',{childPid:child.pid});
       if(requestedSignal)forward(requestedSignal);
       child.on('error',e=>{spawnError=e.code||e.name;});
@@ -319,18 +352,44 @@ async function execute() {
       if(issue)captureIssues.push(`compiler inputs differ from discovery certificate (${issue})`);
       probeAfter=certificate.value;
     }else if(!unobservedDirectRun&&!recording)probeAfter=probeHash(probePlan);
+    let guard=null;
+    if(testRecord){
+      let coverage=null;try{coverage=coverageReadable(root,testProject(root,selected.script));}catch{}
+      guard=testRunGuard(testRecord,{root,sourcePatterns:plan.sourcePatterns||plan.patterns,files:snap?.files,
+        runner:runnerPid,environment:selected.environment||{},coverage});
+      runFacts=guard.runFacts;
+      fs.rmSync(testRecord,{recursive:true,force:true});
+    }
     // The daemon reads the recording from owned state; control requests are small.
     const recordFile=recording&&path.join(state,`run-record-${recording}.json`);
     if(recordFile)try{fs.writeFileSync(recordFile,recordText,{mode:0o600});}catch{}
     const endSnapshotStarted=performance.now();
     if(!unobservedDirectRun){
       try{after=await call({action:'snapshot',name,contextHashes:contextHashes(),
-        ...(recording?{runCertificate:1,adopt:recording}:recorded&&!certificate?{runCertificate:1,runFacts:1}:{})},captureTimeout);}
+        ...(testRun&&Number.isSafeInteger(snap?.inputEventSerial)?{sinceSerial:snap.inputEventSerial}:{}),
+        ...(recording?{runCertificate:1,adopt:recording}:recorded&&!certificate?{runCertificate:1,runFacts:1}:{})},
+        // The start checkpoint's probe may have raised the deadline.
+        Number(process.env.VSTATE_CAPTURE_TIMEOUT_MS||decisionDeadline()));}
       catch{captureIssues.push('end observation unavailable');}
       finally{if(recordFile)fs.rmSync(recordFile,{force:true});}
       timing('cli.end_checkpoint',endSnapshotStarted,{available:after?.snapshots?.[name]?1:0});
     }
     const end=after?.snapshots?.[name];
+    // A test run's own outputs: git-ignored files it created without reading
+    // what was there (test/tmp). When they are the only observed change, the
+    // run is kept with the end checkpoint, which includes them.
+    let outputs=null;
+    let eventsExplained=false;
+    if(guard&&snap&&end&&snap.planId===end.planId&&snap.probeHash===end.probeHash&&snap.observationHealthy&&end.observationHealthy&&
+      (snap.inputEventSerial===end.inputEventSerial||end.inputEventPathsComplete===true)){
+      // A directory event is not an input change; a change to its files shows
+      // in the end checkpoint's file map, which is compared too. A link is kept.
+      const directory=rel=>{try{return fs.lstatSync(path.join(root,rel)).isDirectory();}catch{return false;}};
+      const changed=changedFiles(snap.files,end.files),events=(end.inputEventPaths||[]).filter(rel=>!directory(rel));
+      const touched=[...new Set([...changed,...events])].sort();
+      const ignored=touched.length&&touched.every(guard.isOutput)?gitIgnored(root,touched):new Set();
+      if(touched.every(file=>ignored.has(file))){eventsExplained=true;if(changed.length)outputs=changed;}
+    }
     // The end certificate, recorded or probed, must cover what this compile received.
     // With no input event, gap or content change in between, it also holds at the start.
     // A run checked by full probes is compared with it too, for its run facts.
@@ -361,16 +420,32 @@ async function execute() {
       captureIssues.push('observer generation changed during execution');
     if(snap?.planGeneration!==end?.planGeneration)
       captureIssues.push('input plan rebuilt during execution');
-    if(snap?.inputEventSerial!==end?.inputEventSerial)
+    if(snap?.inputEventSerial!==end?.inputEventSerial&&!eventsExplained)
       captureIssues.push('declared input event occurred during execution');
     // A recorded certificate changes only the probe part of the fingerprint.
-    if(!snap||!end||snap.planId!==end.planId||(recording?snap.inputKey!==end.inputKey:snap.fingerprint!==end.fingerprint)||
-      snap.revision!==end.revision)captureIssues.push('declared inputs changed or were not observed');
+    if(!outputs&&(!snap||!end||snap.planId!==end.planId||(recording?snap.inputKey!==end.inputKey:snap.fingerprint!==end.fingerprint)||
+      snap.revision!==end.revision))captureIssues.push('declared inputs changed or were not observed');
     const stable=captureIssues.length===0;
+    // Two runs on the same inputs, environment and plan that disagree make the
+    // check nondeterministic until its inputs change.
+    let nondeterministic=false;
+    const declared=hashes=>Object.entries(hashes||{}).filter(([key])=>!key.startsWith('__redue_env_'));
+    if(testRun&&stable&&result){
+      const prior=readReceipts(state).checks[name];
+      // A difference explained by inputs REDUE did not observe proves nothing.
+      nondeterministic=Boolean(!guard?.issues.length&&prior?.stable&&!prior.guardIssues?.length&&prior.result&&prior.planId===(snap?.planId??plan.id)&&
+        prior.fingerprint===((recording||outputs?end:snap)?.fingerprint??null)&&
+        JSON.stringify(declared(prior.environmentHashes))===JSON.stringify(declared(environmentBefore))&&
+        JSON.stringify(prior.runFacts||[])===JSON.stringify([...runFacts].sort())&&
+        JSON.stringify(prior.environmentReads||{})===JSON.stringify(guard?.environmentReads||{})&&
+        (prior.result!==result||prior.nondeterministic===true));
+    }
     // A recorded run's receipt carries its run facts, even none; observers that
     // predate run facts do not reuse version 2.
-    const receipt={result,invocation,target,stable,fingerprintVersion:recorded?2:1,
-      ...(recorded?{runFacts}:{}),
+    const receipt={result,invocation,target,stable,fingerprintVersion:recorded||testRun?2:1,
+      ...(recorded||testRun?{runFacts}:{}),
+      ...(testRun?{verificationRecipe:testsInterpretation,guardIssues:guard?.issues||['the run record is unavailable'],
+        environmentReads:guard?.environmentReads||{},...(nondeterministic?{nondeterministic}:{})}:{}),
       resolutionLinks:plan.resolutionLinks||[],
       coverage:{qualified:plan.unresolved.length===0,unresolved:plan.unresolved},
       checkpoint:{status:stable?'stable':'unavailable_or_changed',issues:captureIssues,
@@ -378,13 +453,14 @@ async function execute() {
         ...(process.env.REDUE_PUBLIC_INPUT_TRACE==='1'?{
           startInputEventSerial:snap?.inputEventSerial??null,
           endInputEventSerial:end?.inputEventSerial??null}: {})},
-      planId:snap?.planId??plan.id,fingerprint:(recording?end:snap)?.fingerprint??null,
+      planId:snap?.planId??plan.id,fingerprint:(recording||outputs?end:snap)?.fingerprint??null,
       provider:plan.provider,environmentHashes:environmentBefore,
       ...(observedContext?{observedContext,verificationRecipe:directInterpretation}:{}),
-      files:snap?.files??null,observerGeneration:before?.observation?.generation??null,
+      files:(outputs?end:snap)?.files??null,observerGeneration:before?.observation?.generation??null,
       startRevision:snap?.revision??null,endRevision:end?.revision??null};
     const persistenceStarted=performance.now();
     commitReceipt(state,name,receipt);
+    if(testRun){const reads=environmentReads();reads[name]=receipt.environmentReads;atomicJson(readsFile,{schema:1,checks:reads});}
     timing('cli.receipt_persistence',persistenceStarted);
     const reloadStarted=performance.now();
     try{await call({action:'reload'});}catch{/* receipt revisions invalidate older status even when reload IPC is unavailable */}
@@ -489,7 +565,7 @@ async function main(){
         observedNpmDigest:observedNpmContext(),proxyShapes});
     }
     let value;try{value=await decisionCall({action:'sync',contextHashes:contextHashes()},
-      Number(process.env.VSTATE_SYNC_TIMEOUT_MS||decisionDeadlineMs));
+      Number(process.env.VSTATE_SYNC_TIMEOUT_MS||decisionDeadline()));
       // A client upgrade can encounter an older running observer. Its successful
       // control response does not establish that it evaluated the latest receipt.
       if(value.receipt_revision===null){

package/src/daemon.mjs

@@ -18,6 +18,7 @@ import {atomicJson,readReceipts,readReceiptSnapshot,receiptRevision} from './sta
 import {history,closeHistory} from './observation.mjs';
 import {inputKey,planGuard,toolchainKey} from './decision-validation.mjs';
 import {queriesHold,runFactReason as runFactChanged} from './typescript-list.mjs';
+import {nextProbeHint,probeDeadline,probeFloorMs} from './probe-deadline.mjs';
 import {statusSummary} from './cached-state.mjs';
 import {directProject,directProbeValue,reviewedTypeScriptVersions} from './direct-typescript.mjs';
 import {buildInfoPath,recordedCertificate} from './direct-run-certificate.mjs';
@@ -49,6 +50,9 @@ let pending=new Set(), pendingChecks=new Set(), flushTimer, planDirty=false, pla
 let decisionRequests=0;
 let decisionSequence=0;
 let inputEventSerial=new Map();
+// The last input-event paths per check, with their serials, so a test run can
+// show that every event during it was one of its own outputs.
+const inputEventPaths=new Map(),eventPathLimit=10000;
 let diagnosticInputEvents=0;
 let synchronizing=null;
 let installedRecheck=null;
@@ -153,6 +157,14 @@ function reuseCertificate(row,key,allowReuse,forceFull,checked) {
   metrics.probeReuses=(metrics.probeReuses||0)+1;
   return null;
 }
+// The current full-probe deadline for a check; see probe-deadline.mjs. Hints
+// are kept per check name, so a plan rebuild (each Windows decision) keeps them.
+const probeHints=new Map();
+function fullProbeDeadline(row) {
+  const run=receipts[row.plan.name]?.invocation;
+  return probeDeadline({floor:probeFloorMs(row.plan.qualification),hint:probeHints.get(row.plan.name),
+    runMs:run?.status==='exited'?run.durationMs:0});
+}
 function probe(row,allowReuse=false,{launch=true}={}) {
   const started=performance.now();
   const supported=new Map([
@@ -205,18 +217,21 @@ function probe(row,allowReuse=false,{launch=true}={}) {
     row.probeCache=null;
   }
   const values=[];let checkpoint=null;
+  // The slowest of this check's probes sets the hint for all of them.
+  const deadline=fullProbeDeadline(row);let hint=0;
+  const learn=()=>{if(hint)probeHints.set(row.plan.name,hint);};
   for(const argv of row.plan.probes) {
-    // Supported TypeScript probes perform bounded input/toolchain hashing.
-    // Native NTFS runs have exceeded the generic 5 s cap under load, despite
-    // completing normally and with the duplicated work already removed.
-    const timeout=row.plan.qualification==='pnpm-tsc-v1'||
-      (process.platform==='win32'&&['typescript-noemit-v1','npm-typescript-direct-v1','yarn-workspace-tsc-v1']
-        .includes(row.plan.qualification))?10000:5000;
+    const timeout=deadline,launched=performance.now();
     mark('daemon.probe_launch',{mode:'full',reason:fullReason,deadlineMs:timeout});
-    const out=spawnSync(argv[0],[...argv.slice(1),...(cacheable?['--redue-checkpoint']:[])],{cwd:row.plan.cwd,
+    // A built-in probe gets its deadline, so its inner compiler calls share it.
+    const out=spawnSync(argv[0],[...argv.slice(1),...(cacheable?['--redue-checkpoint']:[]),
+      ...(builtIn?[`--redue-deadline=${timeout}`]:[])],{cwd:row.plan.cwd,
       timeout,maxBuffer:1024*1024,stdio:['ignore','pipe','pipe'],env:traceEnvironment()});
     mark('daemon.probe_complete',{mode:'full',childPid:out.pid,exit:out.status,signal:out.signal,code:out.error?.code});
+    const timedOut=out.error?.code==='ETIMEDOUT';
+    if(!out.error||timedOut)hint=Math.max(hint,nextProbeHint({durationMs:performance.now()-launched,deadlineMs:timeout,timedOut}));
     if(out.error||out.signal||out.status!==0) {
+      learn();
       if(!row.probeError){row.revision++;row.lastReason='declared state probe became unavailable';}
       row.probeHash=null;row.probeAt=0;
       const code=['typescript-noemit-v1','npm-typescript-direct-v1','yarn-workspace-tsc-v1','pnpm-tsc-v1']
@@ -280,6 +295,7 @@ function probe(row,allowReuse=false,{launch=true}={}) {
     }
     values.push([argv,out.status,sha(cacheable?checkpoint.output:out.stdout),sha(out.stderr)]);
   }
+  learn();
   const value=sha(JSON.stringify(values));
   if((row.probeHash!==null&&row.probeHash!==value)||row.probeError){
     row.revision++;row.lastReason='declared state probe changed or recovered';}
@@ -383,6 +399,14 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
     }
     else if(contextHashes?.[name]&&names.some(key=>contextHashes[name][key]!==r.environmentHashes?.[key]))
       item.reason='declared execution environment changed';
+    // Every variable a test run read directly must have the same value. The
+    // caller compares them and names the list it used; another list confirms nothing.
+    else if(r.environmentReads&&contextHashes?.[name]&&
+      (contextHashes[name].__redue_env_reads__!==sha(JSON.stringify(r.environmentReads))||contextHashes[name].__redue_env_changed__)){
+      if(contextHashes[name].__redue_env_reads__!==sha(JSON.stringify(r.environmentReads))){
+        item.freshness='UNVERIFIED';item.reason='environment variables the last run read were not compared';}
+      else item.reason=`environment variable ${contextHashes[name].__redue_env_changed__} differs from the last run`;
+    }
     else if(r.fingerprint!==combinedSummary(name).fingerprint) {
       const key=r.fingerprint+'\0'+combinedSummary(name).fingerprint;
       if(row.staleReasonKey!==key){
@@ -413,6 +437,12 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
     } else if(r.fingerprintVersion===1&&r.verificationRecipe==='npm-direct-typescript@1'&&process.platform!=='win32'){
       item.freshness='UNVERIFIED';item.reason='receipt predates run facts; run the check again';
     } else if(r.runFacts&&(item.reason=runFactReason(r.runFacts))){item.changed_inputs=[];
+    // A recorded test run that used something REDUE does not observe, or
+    // whose result differed from an earlier run on the same inputs.
+    } else if(r.guardIssues?.length){item.freshness='UNVERIFIED';
+      item.reason=`the run used inputs REDUE does not observe: ${r.guardIssues.slice(0,3).join('; ')}`+
+        (r.guardIssues.length>3?`; and ${r.guardIssues.length-3} more`:'');
+    } else if(r.nondeterministic){item.freshness='UNVERIFIED';item.reason='runs on these exact inputs had different results';
     } else {item.freshness='CURRENT';item.reason=result==='FAIL'?'last command failed':'declared inputs match';
       item.reuse_eligible=result==='PASS';}
     return item;
@@ -478,7 +508,10 @@ function status(contextHashes,synchronizedInstalled=false,synchronizedFilesystem
   // wrapper may persist its outcome even when its control connection is denied.
   refreshReceipts();
   const checks=rows(contextHashes,synchronizedInstalled,synchronizedFilesystem);
+  // A decision may run every check's probes in turn: callers wait for all of them.
+  const probing=[...(index?.checks.values()||[])].filter(row=>row.plan.probes.length);
   const now=Date.now();return {schema:1,receipt_revision:receiptStateRevision,...statusSummary(checks),checks,
+    ...(probing.length?{probe_deadline_ms:probing.reduce((sum,row)=>sum+fullProbeDeadline(row)*row.plan.probes.length,0)}:{}),
     observation:{healthy:healthy&&!planning&&!recovering&&!index?.unavailable,
       generation,observed_at:lastObservation,
       events:(index?.eventCount||0)+[...external.values()].reduce((n,e)=>n+(e.index?.eventCount||0),0),
@@ -746,8 +779,15 @@ function markInputEvent(name,rel,type,replay) {
   // macOS delivers each edit twice: live, and again from history replay. The
   // live copy can arrive late, inside a later run. With history, count only the
   // replay copy: the history cursor places it in the right interval.
-  if(!hasHistory||historyDisabled||replay)
-    inputEventSerial.set(name,(inputEventSerial.get(name)||0)+1);
+  if(!hasHistory||historyDisabled||replay){
+    const serial=(inputEventSerial.get(name)||0)+1;
+    inputEventSerial.set(name,serial);
+    // Kept only for test checks; trimmed in batches.
+    if(index?.checks.get(name)?.plan.qualification==='npm-tests-direct-v1'){
+      const list=inputEventPaths.get(name)||[];list.push([serial,rel]);
+      if(list.length>2*eventPathLimit)list.splice(0,list.length-eventPathLimit);inputEventPaths.set(name,list);
+    }
+  }
   // Disposable public CI only. Never enabled for normal/local repositories.
   if(process.env.REDUE_PUBLIC_INPUT_TRACE==='1'&&rel&&diagnosticInputEvents++<5000)
     event('public_input_notification',{path:rel,type:type||'unknown',planning,replay});
@@ -802,16 +842,16 @@ function externalNotification(entry,type,filename,replay=false) {
   const rel=filename.toString().split(path.sep).join('/');
   const absolute=path.join(entry.root,rel);
   if(planning&&entry.index)for(const name of entry.index.candidates(rel))
-    if(entry.index.matches(entry.index.checks.get(name),rel))markInputEvent(name,rel,type,replay);
+    if(entry.index.matches(entry.index.checks.get(name),rel))markInputEvent(name,`external:${entry.root}:${rel}`,type,replay);
   if(planTrigger(absolute)&&triggerChanged(absolute))planDirty=true;
   if(candidateTriggerChanged(absolute))planDirty=true;
   entry.pending.add(rel);metrics.maxQueue=Math.max(metrics.maxQueue,
     pending.size+[...external.values()].reduce((n,e)=>n+e.pending.size,0));
   if(entry.index) {
     for(const name of entry.index.candidates(rel))
-      if(entry.index.matches(entry.index.checks.get(name),rel))markInputEvent(name,rel,type,replay);
+      if(entry.index.matches(entry.index.checks.get(name),rel))markInputEvent(name,`external:${entry.root}:${rel}`,type,replay);
     for(const [prefix,names] of entry.index.prefixes)
-      if(prefix.startsWith(rel+'/'))for(const name of names)markInputEvent(name,rel,type,replay);
+      if(prefix.startsWith(rel+'/'))for(const name of names)markInputEvent(name,`external:${entry.root}:${rel}`,type,replay);
   }
   if(planDirty){healthy=false;reason='input plan possibly changed';}
   publish();clearTimeout(flushTimer);flushTimer=setTimeout(flush,60);
@@ -1099,6 +1139,11 @@ async function request(message) {
           data.snapshots[name]={...combinedSummary(name),files:combinedFiles(name),
           planGeneration:row.plan.id,
             inputEventSerial:inputEventSerial.get(name)||0,
+            // Complete only when the oldest kept event follows the given serial.
+            ...(Number.isSafeInteger(message.sinceSerial)?(()=>{const list=inputEventPaths.get(name)||[],
+              since=message.sinceSerial,later=list.filter(([serial])=>serial>since);
+              return {inputEventPaths:later.map(([,rel])=>rel),
+                inputEventPathsComplete:(inputEventSerial.get(name)||0)-since===later.length};})():{}),
             probeHash:row.probeHash,inputKey:inputKey(row),observationGaps:metrics.gaps,
             observationHealthy:healthy&&!planning&&!recovering&&!racy&&applicableExternal(name).every(e=>e.healthy)};
       // Export only a currently guarded, check-specific discovery certificate.

package/src/declared-plan.mjs

@@ -6,6 +6,7 @@ import {createHash} from 'node:crypto';
 import {permittedRoots,resolveDeclaredInstalled} from './installed-inputs.mjs';
 import {qualifyTypeScript} from './typescript-qualification.mjs';
 import {directBuildInfo} from './direct-typescript.mjs';
+import {qualifyTests,testsQualification} from './test-direct.mjs';
 import {yarnWorkspaceTypecheckInputs} from './yarn-workspace-inputs.mjs';
 import {pnpmTypecheckInputs} from './pnpm-inputs.mjs';
 import {observedRelative,withinPath,realObservedPath} from './path-identity.mjs';
@@ -80,8 +81,8 @@ export function discoverDeclared(config) {
     const installed=resolveDeclaredInstalled(root,
       [...(selected.installedInputs||[]),...(workspace?.installed||[]),...excluded],allowedRoots);
     timing('plan.installed_resolution',installedStarted,{mappings:installed.mappings.length});
-    const automatic=qualifyTypeScript(root,selected,
-      {workspace,issue:workspaceIssue});
+    const automatic=selected.qualification===testsQualification?qualifyTests(root,selected):
+      qualifyTypeScript(root,selected,{workspace,issue:workspaceIssue});
     const sourcePatterns=[...new Set([...selected.inputs,...(workspace?.source||[]),
       ...(workspace?.generated||[]),...excluded])].sort();
     const additivePatterns=[...new Set([...(selected.generatedInputs||[]),

package/src/direct-run-certificate.mjs

@@ -115,7 +115,7 @@ const withinCompiler=compiler=>file=>withinPath(file,compiler.tsRoot)||
   file!==compiler.entry&&file.toLowerCase()===compiler.entry.toLowerCase();
 // The certificate question that asks again what a run's stat, realpath or
 // package.json read answered, in queryAnswer's terms; null when it cannot be asked again.
-function runFact(kind,file,answer) {
+export function runFact(kind,file,answer) {
   if(kind==='stat')return answer===null||answer==='f'?['fileExists',file,answer&&true]:
     answer==='d'?['directoryExists',file,true]:null;
   if(kind==='realpath')return answer===null||typeof answer==='string'?['realpath',file,answer]:null;

package/src/installed-inputs.mjs

@@ -99,7 +99,9 @@ export function resolveDeclaredInstalled(root,patterns,allowed=[]) {
     else {if(!external.has(boundary))external.set(boundary,new Set());
       external.get(boundary).add(mapped);}
     if(!negative)roots.add(resolved.physical);
-    result.mappings.push({logical:pattern,physical:resolved.physical,root:boundary,
+    // An exclusion maps to the same pattern whether or not its path exists, so
+    // the plan stays the same when a run creates it (a runner cache).
+    if(!negative)result.mappings.push({logical:pattern,physical:resolved.physical,root:boundary,
       links:resolved.links.map(link=>link.path)});
   }
   result.internalPatterns=[...internal].sort();

package/src/linux-inotify.py

@@ -87,12 +87,21 @@ def main(root):
                 continue
             wd = libc.inotify_add_watch(fd, os.fsencode(current), MASK)
             if wd < 0:
-                raise OSError(ctypes.get_errno(), 'inotify_add_watch failed')
+                error = ctypes.get_errno()
+                # A new directory deleted before its watch: nothing to watch,
+                # and its parent reports the deletion.
+                if current != root and error in (errno.ENOENT, errno.ENOTDIR):
+                    continue
+                raise OSError(error, 'inotify_add_watch failed')
             watches[wd] = current
-            with os.scandir(current) as entries:
-                for entry in entries:
-                    if entry.is_dir(follow_symlinks=False):
-                        stack.append(entry.path)
+            try:
+                with os.scandir(current) as entries:
+                    for entry in entries:
+                        if entry.is_dir(follow_symlinks=False):
+                            stack.append(entry.path)
+            except (FileNotFoundError, NotADirectoryError):
+                if current == root:
+                    raise
 
     def drain():
         while True:
@@ -129,6 +138,13 @@ def main(root):
                 target = os.path.join(parent, os.fsdecode(raw)) if raw else parent
                 if in_git(target):
                     continue
+                if mask & IN_DELETE_SELF and parent != root:
+                    # A watched directory was deleted: its IN_IGNORED follows
+                    # and is expected. The engine rescans the path.
+                    del watches[wd]
+                    intentional_removals.add(wd)
+                    emit('event', type='delete', path=parent)
+                    continue
                 if mask & (IN_UNMOUNT | IN_DELETE_SELF | IN_MOVE_SELF | IN_IGNORED):
                     emit('gap', reason='inotify_watch_lost')
                     return False
@@ -138,11 +154,14 @@ def main(root):
                     except OSError as error:
                         emit('gap', reason='inotify_watch_add_failed', errno=error.errno)
                         return False
-                    # Contents can appear before their new directory receives
-                    # a watch. The engine reconciles instead of guessing.
-                    emit('gap', reason='inotify_new_directory')
-                    return False
-                if (mask & IN_ISDIR) and (mask & (IN_DELETE | IN_MOVED_FROM)):
+                    # Contents can appear before the new directory has its
+                    # watch. The watches exist now, so later changes raise
+                    # events; the engine rescans the directory on this event
+                    # and finds what came before.
+                    emit('event', type='create', path=target)
+                    continue
+                # A moved-away directory keeps watches under its old paths.
+                if (mask & IN_ISDIR) and (mask & IN_MOVED_FROM):
                     emit('gap', reason='inotify_directory_removed')
                     return False
                 event = ('delete' if mask & (IN_DELETE | IN_MOVED_FROM) else

package/src/node-onboarding.mjs

@@ -1,4 +1,5 @@
 import {directProject,directQualification} from './direct-typescript.mjs';
+import {testProject,testRecipeScript,testCheckInputs,testsQualification} from './test-direct.mjs';
 import fs from 'node:fs';
 import path from 'node:path';
 import {spawnSync} from 'node:child_process';
@@ -161,7 +162,7 @@ function workspaceManifests(root,patterns) {
   return matched.map(file=>({file,pkg:readJson(path.join(root,file))}));
 }
 export function discoverNodeProject(root,{recipe=null}={}) {
-  if(recipe&&recipe!=='typescript-direct')throw Error('unknown recipe; use typescript-direct');
+  if(recipe&&!['typescript-direct','tests-direct'].includes(recipe))throw Error('unknown recipe; use typescript-direct or tests-direct');
   root=realObservedPath(root);
   const packageFile=path.join(root,'package.json');
   if(!exists(packageFile))throw Error('run init from a repository containing package.json');
@@ -197,6 +198,19 @@ export function discoverNodeProject(root,{recipe=null}={}) {
           reason:`explicit local TypeScript ${compiler.version} compilation; npm launcher/lifecycle scripts are not executed; package.json stays unchanged`};
       }catch(e){classification={level:'recording',reason:`Direct recipe unavailable (${e.code||e.message}); original npm script retained, without bypassing required behavior`};}
     }
+    if(recipe==='tests-direct'&&kind==='test'){
+      try{
+        if(pm.name!=='npm'||workspaces||observationIssue||pm.issue)throw Error('test recipe requires a supported single-package npm checkout');
+        const chosen=testRecipeScript(scripts);
+        if(chosen.ambiguous)throw Error(`several scripts run Vitest or Jest directly (${chosen.ambiguous.join(', ')})`);
+        if(!chosen.script)throw Error(chosen.issue||'no script runs Vitest or Jest directly');
+        const project=testProject(root,chosen.script);
+        Object.assign(check,{script:chosen.script,command:['@node',`@test-runner:${project.runner}`,...project.args],cwd:'.',
+          ...testCheckInputs(project)});
+        classification={level:'ready',qualification:testsQualification,
+          reason:`explicit local ${project.runner} ${project.version} run of script ${JSON.stringify(chosen.script)}; the whole checkout is its input; npm and lifecycle scripts are not executed`};
+      }catch(e){classification={level:'recording',reason:`Test recipe unavailable (${e.code||e.message}); original npm script retained`};}
+    }
     if(pm.name==='pnpm'&&kind==='typecheck'&&!workspaces&&!pm.issue&&
       /^(?:tsc --noEmit|tsc -p (?:\.|tsconfig\.json)(?: --noEmit)?)$/.test(scripts[script].trim())){
       try{const contract=pnpmTypecheckInputs(root,'.',script);

package/src/pnpm-inputs.mjs

@@ -1,6 +1,7 @@
 // Pinned pnpm 12 node-modules installation provider. The engine sees only
 // repository-relative input sets and resolution relationships, never pnpm
 // virtual-store names as semantic identities.
+import {probeTimeLeft} from './probe-deadline.mjs';
 import {compilerFiles} from './typescript-list.mjs';
 import fs from 'node:fs';
 import path from 'node:path';
@@ -96,7 +97,7 @@ export function pnpmWorkspacePackages(root,patterns){
   const files=execFileSync('git',['ls-files','--cached','--others','--exclude-standard',
     '-z','--',':(glob)**/package.json'],{cwd:root,
     env:{...process.env,GIT_OPTIONAL_LOCKS:'0'},maxBuffer:32*1024*1024,
-    timeout:5000}).toString().split('\0').filter(Boolean);
+    timeout:probeTimeLeft(5000)}).toString().split('\0').filter(Boolean);
   for(const file of files){
     const dir=path.posix.dirname(file);
     if(dir==='.'||dir.split('/').includes('node_modules')||
@@ -202,7 +203,7 @@ function listedTypeScriptFiles(root,selected,tsc){
     {cwd:path.join(root,selected.dir),env:process.env,encoding:'utf8',
       // The native NTFS public workspace takes 3-5 s to list ~770 inputs;
       // 5 s sometimes expired despite bounded, progressing compiler work.
-      timeout:10000,maxBuffer:32*1024*1024,stdio:['ignore','pipe','pipe']});
+      timeout:probeTimeLeft(10000),maxBuffer:32*1024*1024,stdio:['ignore','pipe','pipe']});
   if(out.error||out.signal||out.status!==0)
     throw Error('TypeScript input listing is unavailable');
   const files=out.stdout.trim().split(/\r?\n/).filter(Boolean)

package/src/probe-deadline.mjs

@@ -0,0 +1,37 @@
+// How long a full probe may run before it is killed and the check stays
+// UNVERIFIED. It grows with the project: the larger of the hint from earlier
+// probes (twice the last successful one, or twice the deadline that last timed
+// out) and the last completed run, between the platform floor and a ceiling.
+import {fileURLToPath} from 'node:url';
+export const probeCeilingMs=process.env.VSTATE_TEST_FAULTS==='1'&&
+  Number(process.env.VSTATE_TEST_PROBE_CEILING_MS)||60000;
+// Supported TypeScript probes perform bounded input/toolchain hashing.
+// Native NTFS runs have exceeded the generic 5 s cap under load, despite
+// completing normally and with the duplicated work already removed.
+export const probeFloorMs=qualification=>qualification==='pnpm-tsc-v1'||
+  (process.platform==='win32'&&['typescript-noemit-v1','npm-typescript-direct-v1','yarn-workspace-tsc-v1']
+    .includes(qualification))?10000:5000;
+// REDUE's own probes, which accept --redue-deadline; a user's probe never gets it.
+const builtIn=new Set(['typescript-contract-probe.mjs','direct-typescript-probe.mjs',
+  'yarn-workspace-typecheck-probe.mjs','pnpm-typecheck-probe.mjs'].map(name=>fileURLToPath(new URL(name,import.meta.url))));
+export const builtInProbe=argv=>builtIn.has(argv?.[1]);
+// A deadline read from status.json, as a whole number of milliseconds no
+// longer than a decision could need (0 when absent or unusable).
+export function publishedDeadline(value) {
+  return Number.isFinite(value)&&value>0?Math.min(Math.round(value),10*60*1000):0;
+}
+export function probeDeadline({floor,hint=0,runMs=0,ceiling=probeCeilingMs}) {
+  const finite=value=>Number.isFinite(value)&&value>0?value:0;
+  return Math.round(Math.min(ceiling,Math.max(floor,finite(hint),finite(runMs))));
+}
+// The hint the next probe starts from.
+export function nextProbeHint({durationMs,deadlineMs,timedOut}) {
+  return 2*(timedOut?deadlineMs:durationMs);
+}
+// Inside a probe process: what is left of the deadline its caller passed with
+// --redue-deadline=MS, or the fallback when none was passed. An inner call
+// always ends before its parent is killed, so it never outlives the probe.
+export function probeTimeLeft(fallback) {
+  const deadline=Number(/^--redue-deadline=(\d+)$/.exec(process.argv.find(arg=>arg.startsWith('--redue-deadline='))||'')?.[1]);
+  return deadline?Math.max(1,Math.round(deadline-performance.now()-250)):fallback;
+}