@redue/cli 0.1.0-alpha.3 → 0.1.0-alpha.31

package/src/daemon.mjs

@@ -1,4 +1,4 @@
-import {inflateSync} from 'node:zlib';
+import {inflateSync,deflateSync} from 'node:zlib';
 import fs from 'node:fs';
 import path from 'node:path';
 import net from 'node:net';
@@ -8,16 +8,24 @@ import {Worker} from 'node:worker_threads';
 import {fileURLToPath} from 'node:url';
 import {subscribe,hasHistory,backend} from './platform-observation.mjs';
 import {controlEndpoint} from './control-endpoint.mjs';
-import {observedRelative,withinPath,realObservedPath} from './path-identity.mjs';
+import {observedRelative,withinPath,realObservedPath,racyWindowMs} from './path-identity.mjs';
 import micromatch from './glob.mjs';
 import {sha} from './plan.mjs';
-import {InputIndex} from './index.mjs';
+import {InputIndex,dehydrateIndex} from './index.mjs';
 import {permittedRoots} from './installed-inputs.mjs';
 import {assertOwnedStatePlacement} from './owned-state.mjs';
 import {atomicJson,readReceipts,readReceiptSnapshot,receiptRevision} from './state-store.mjs';
-import {history} from './observation.mjs';
-import {inputKey} from './decision-validation.mjs';
-import {timing} from './decision-profile.mjs';
+import {history,closeHistory} from './observation.mjs';
+import {inputKey,planGuard,toolchainKey} from './decision-validation.mjs';
+import {queriesHold,runFactReason as runFactChanged} from './typescript-list.mjs';
+import {nextProbeHint,probeDeadline,probeFloorMs} from './probe-deadline.mjs';
+import {statusSummary} from './cached-state.mjs';
+import {directProject,directProbeValue} from './direct-typescript.mjs';
+import {npmCacheDir} from './npm-integrity.mjs';
+import {runFromArgv} from './typescript-invocation.mjs';
+import {buildInfoPath,recordedCertificate} from './direct-run-certificate.mjs';
+import {timing,mark,traceBase,traceContext,traceScope,traceEnvironment,traceId} from './decision-profile.mjs';
+import {isSandboxed,sandboxChange,visibleChange as sandboxVisibleChange} from './sandbox.mjs';
 
 const configFile=path.resolve(process.argv[2]);
 const config=JSON.parse(fs.readFileSync(configFile));
@@ -31,6 +39,7 @@ const endpoint=controlEndpoint(state),socket=endpoint.address,
 fs.mkdirSync(lock); // Existing lock requires operator inspection; never steal it.
 fs.writeFileSync(path.join(lock,'pid'),String(process.pid),{mode:0o600});
 const generation=randomUUID(), startedAt=Date.now();
+traceBase({generation,work:'startup'});
 let index, receipts={}, watcher, healthy=false, reason='initial reconciliation', stopping=false;
 let receiptStateError=null;
 let receiptStateRevision=null;
@@ -44,6 +53,9 @@ let pending=new Set(), pendingChecks=new Set(), flushTimer, planDirty=false, pla
 let decisionRequests=0;
 let decisionSequence=0;
 let inputEventSerial=new Map();
+// The last input-event paths per check, with their serials, so a test run can
+// show that every event during it was one of its own outputs.
+const inputEventPaths=new Map(),eventPathLimit=10000;
 let diagnosticInputEvents=0;
 let synchronizing=null;
 let installedRecheck=null;
@@ -52,7 +64,9 @@ let identityChanged=false;
 let identityGapKey=null;
 let triggerHashes=new Map();
 let candidateDescendants=new Map();
-let workspacePatterns=(()=>{const w=JSON.parse(fs.readFileSync(path.join(root,'package.json'))).workspaces;
+// A Python project may have no package.json.
+let workspacePatterns=(()=>{let w;try{w=JSON.parse(fs.readFileSync(path.join(root,'package.json'))).workspaces;}
+  catch(e){if(e.code==='ENOENT')return [];throw e;}
   return Array.isArray(w)?w:w?.packages||[];})();
 let planningWorker=null;
 let validatedPlan=null;
@@ -110,62 +124,162 @@ function persistedPlan(bundle) {
       return [name,safe];
     }))};
 }
-function probe(row,allowReuse=false) {
+// Continuity for in-process certificate reuse: every observed change is applied.
+// macOS needs its history cursor; Linux has the synchronize barrier in catchUp.
+// Windows reconciles content at each decision and keeps its own reuse path.
+function continuityBarrier() {
+  return process.platform!=='win32'&&(process.platform!=='darwin'||hasHistory&&!historyDisabled)&&
+    healthy&&watcher&&!planning&&!recovering&&!planDirty&&!index?.unavailable&&
+    !pending.size&&!pendingChecks.size&&!external.size&&verifyRoot();
+}
+// The basis a full direct probe is checked against: plan guard, observation
+// continuity, and the compiler tree and Node identity taken before the probe.
+function certificateBasis(row) {
+  const argv=row.plan.probes[0],compiler=directProject(argv[2],runFromArgv(argv.slice(3)),{verify:false});
+  return {guard:planGuard(index.bundle),gaps:metrics.gaps,
+    compiler:JSON.stringify([compiler.tsRoot,compiler.entry,compiler.digest]),
+    toolchain:toolchainKey(compiler.tsRoot,argv[0])};
+}
+// Returns null after reusing the last full probe, otherwise why a full probe is needed.
+function reuseCertificate(row,key,allowReuse,forceFull,checked) {
+  const started=performance.now(),cache=row.probeCache;
+  if(forceFull)return 'forced_full_reference';
+  if(!allowReuse||!continuityBarrier())return 'continuity_unavailable';
+  if(row.plan.unresolved.length)return 'coverage_unresolved';
+  if(!cache?.queries?.length)return 'no_validated_result';
+  if(cache.input!==key)return 'inputs_changed';
+  if(cache.gaps!==metrics.gaps)return 'observation_gap';
+  let reason=null;
+  try{const basis=checked.basis=certificateBasis(row);
+    if(basis.guard!==cache.guard){planDirty=true;reason='plan_guard_changed';}
+    else if(basis.compiler!==cache.compiler||basis.toolchain!==cache.toolchain)reason='toolchain_changed';
+    else if(!queriesHold(cache.queries,cache.identities))reason='compiler_queries_changed';}
+  catch{reason='validation_unavailable';}
+  timing('daemon.probe_validation',started,{outcome:reason?'changed_or_unavailable':'reused',
+    reason:reason||'content_and_context_unchanged',queries:cache.queries.length});
+  if(reason)return reason;
+  row.probeHash=cache.hash;row.probeAt=Date.now();row.probeError=null;
+  metrics.probeReuses=(metrics.probeReuses||0)+1;
+  return null;
+}
+// The current full-probe deadline for a check; see probe-deadline.mjs. Hints
+// are kept per check name, so a plan rebuild (each Windows decision) keeps them.
+const probeHints=new Map();
+function fullProbeDeadline(row) {
+  const run=receipts[row.plan.name]?.invocation;
+  return probeDeadline({floor:probeFloorMs(row.plan.qualification),hint:probeHints.get(row.plan.name),
+    runMs:run?.status==='exited'?run.durationMs:0});
+}
+function probe(row,allowReuse=false,{launch=true}={}) {
   const started=performance.now();
   const supported=new Map([
     ['typescript-noemit-v1','typescript-contract-probe.mjs'],
+    ['npm-typescript-direct-v1','direct-typescript-probe.mjs'],
     ['yarn-workspace-tsc-v1','yarn-workspace-typecheck-probe.mjs'],
     ['pnpm-tsc-v1','pnpm-typecheck-probe.mjs']]);
   const expected=supported.get(row.plan.qualification);
-  const cacheable=process.platform==='win32'&&row.plan.probes.length===1&&expected&&
+  const builtIn=row.plan.probes.length===1&&expected&&
     row.plan.probes[0][1]===fileURLToPath(new URL(expected,import.meta.url));
+  const inProcess=builtIn&&process.platform!=='win32'&&row.plan.qualification==='npm-typescript-direct-v1';
+  const cacheable=builtIn&&(process.platform==='win32'||inProcess);
   const key=inputKey(row);
-  if(cacheable&&allowReuse&&row.probeCache?.input===key){
+  const forceFull=process.env.VSTATE_TEST_FAULTS==='1'&&process.env.VSTATE_TEST_FULL_PROBES==='1';
+  let fullReason=null;const checked={};
+  if(inProcess){
+    fullReason=reuseCertificate(row,key,allowReuse,forceFull,checked);
+    if(!fullReason)return;
+  }
+  // Idle revalidation never launches a process. An unconfirmed result expires.
+  if(!launch&&row.plan.probes.length)return;
+  if(process.platform==='win32'&&cacheable&&allowReuse&&!forceFull&&row.probeCache?.input===key){
     const argv=row.plan.probes[0];
+    mark('daemon.probe_launch',{mode:'certificate',deadlineMs:10000});
     const out=spawnSync(argv[0],[...argv.slice(1),'--redue-context'],{
-      cwd:row.plan.cwd,timeout:10000,maxBuffer:1024*1024,stdio:['ignore','pipe','pipe']});
-    if(!out.error&&!out.signal&&out.status===0&&
-      out.stdout.toString()===row.probeCache.context){
+      cwd:row.plan.cwd,timeout:10000,maxBuffer:1024*1024,env:traceEnvironment(),stdio:['ignore','pipe','pipe']});
+    mark('daemon.probe_complete',{mode:'certificate',childPid:out.pid,exit:out.status,signal:out.signal,code:out.error?.code});
+    metrics.probeContextProcesses=(metrics.probeContextProcesses||0)+1;
+    if(!out.error&&!out.signal&&out.status===0&&out.stdout.toString()===row.probeCache.context){
       row.probeHash=row.probeCache.hash;row.probeAt=Date.now();row.probeError=null;
       metrics.probeReuses=(metrics.probeReuses||0)+1;
       timing('daemon.probe_context_validation',started,{outcome:'reused',reason:'content_and_context_unchanged'});
       return;
     }
+    fullReason='context_or_compiler_queries_changed';
     timing('daemon.probe_context_validation',started,{outcome:'changed_or_unavailable'});
   }
-  timing('daemon.probe_reason',started,{reason:!cacheable?'generic_probe':
-    !row.probeCache?'no_validated_result':row.probeCache.input!==key?'inputs_changed':'context_changed'});
+  fullReason??=forceFull?'forced_full_reference':!cacheable?'generic_probe':
+    !row.probeCache?'no_validated_result':row.probeCache.input!==key?'inputs_changed':'context_changed';
+  if(row.plan.probes.length){
+    timing('daemon.probe_reason',started,{reason:fullReason});
+    metrics.fullProbeReasons??={};metrics.fullProbeReasons[fullReason]=(metrics.fullProbeReasons[fullReason]||0)+1;
+    metrics.fullProbes=(metrics.fullProbes||0)+1;
+  }
+  // A failed or incomplete full probe must not leave an older certificate usable.
+  let basis=checked.basis||null;
+  if(inProcess){
+    if(!basis)try{basis=certificateBasis(row);}catch{}
+    if(row.probeCache?.guard&&basis&&basis.guard!==row.probeCache.guard)planDirty=true;
+    row.probeCache=null;
+  }
   const values=[];let checkpoint=null;
+  // The slowest of this check's probes sets the hint for all of them.
+  const deadline=fullProbeDeadline(row);let hint=0;
+  const learn=()=>{if(hint)probeHints.set(row.plan.name,hint);};
   for(const argv of row.plan.probes) {
-    // Supported TypeScript probes perform bounded input/toolchain hashing.
-    // Native NTFS runs have exceeded the generic 5 s cap under load, despite
-    // completing normally and with the duplicated work already removed.
-    const timeout=row.plan.qualification==='pnpm-tsc-v1'||
-      (process.platform==='win32'&&['typescript-noemit-v1','yarn-workspace-tsc-v1']
-        .includes(row.plan.qualification))?10000:5000;
-    const out=spawnSync(argv[0],[...argv.slice(1),...(cacheable?['--redue-checkpoint']:[])],{cwd:row.plan.cwd,
-      timeout,maxBuffer:1024*1024,stdio:['ignore','pipe','pipe']});
+    const timeout=deadline,launched=performance.now();
+    mark('daemon.probe_launch',{mode:'full',reason:fullReason,deadlineMs:timeout});
+    // A built-in probe gets its deadline, so its inner compiler calls share it.
+    const out=spawnSync(argv[0],[...argv.slice(1),...(cacheable?['--redue-checkpoint']:[]),
+      ...(builtIn?[`--redue-deadline=${timeout}`]:[])],{cwd:row.plan.cwd,
+      timeout,maxBuffer:1024*1024,stdio:['ignore','pipe','pipe'],env:traceEnvironment()});
+    mark('daemon.probe_complete',{mode:'full',childPid:out.pid,exit:out.status,signal:out.signal,code:out.error?.code});
+    const timedOut=out.error?.code==='ETIMEDOUT';
+    if(!out.error||timedOut)hint=Math.max(hint,nextProbeHint({durationMs:performance.now()-launched,deadlineMs:timeout,timedOut}));
     if(out.error||out.signal||out.status!==0) {
+      learn();
       if(!row.probeError){row.revision++;row.lastReason='declared state probe became unavailable';}
       row.probeHash=null;row.probeAt=0;
-      const code=['typescript-noemit-v1','yarn-workspace-tsc-v1','pnpm-tsc-v1']
+      const code=['typescript-noemit-v1','npm-typescript-direct-v1','yarn-workspace-tsc-v1','pnpm-tsc-v1']
         .includes(row.plan.qualification)?
         /VSTATE_REASON:([a-z-]+)/.exec(out.stderr?.toString()||'')?.[1]:null;
       const explanations={
+        'direct-typescript-implementation-unreviewed':'installed TypeScript files differ from the reviewed compiler or from the tarball package-lock.json names',
+        'direct-typescript-version-unsupported':'direct compiler recipe supports TypeScript 5.x and 6.0',
+        'direct-typescript-lockfile-source-unsupported':'package-lock.json installs TypeScript from somewhere other than the registry\'s typescript package (an alias, a file or a git source)',
+        'npm-shrinkwrap-unsupported':'npm-shrinkwrap.json is not read; the reviewed TypeScript releases still qualify',
+        'direct-typescript-lockfile-integrity-missing':'package-lock.json records no integrity for the installed TypeScript',
+        'direct-typescript-lockfile-version-differs':'installed TypeScript version differs from package-lock.json; run npm ci',
+        'npm-lockfile-unreadable':'package-lock.json cannot be read',
+        'npm-lockfile-integrity-unsupported':'package-lock.json records TypeScript integrity with neither sha512 nor sha1',
+        'npm-tarball-uncached':`the TypeScript tarball package-lock.json names is not in npm's cache (${npmCacheDir(root)}); run npm ci or npm cache add`,
+        'npm-tarball-corrupt':"npm's cached TypeScript tarball does not match its integrity",
+        'npm-tarball-invalid':"npm's cached TypeScript tarball cannot be read",
+        'npm-tarball-link-unsupported':"npm's cached TypeScript tarball holds links",
+        'direct-execution-environment-unsupported':'direct compiler rejects development helpers, Node cache/preloads, and unreviewed runtime overrides',
+        'direct-node-version-unsupported':'direct compiler recipe supports Node 22 and 24',
+        'npm-launcher-unobserved-inputs':'npm launcher uses unobserved notifier inputs; execution is recording-only',
         'typecheck-script-changed':'typecheck script or lifecycle changed; rerun init or review it',
         'execution-environment-unsupported':'Node/npm preload or configuration environment is unsupported',
         'typescript-executable-changed':'local TypeScript executable changed or is missing',
         'typescript-config-unavailable':'TypeScript configuration cannot be resolved',
         'typescript-config-graph-unsupported':'TypeScript configuration extends, references, or uses compiler features outside this contract',
-        'typescript-incremental-unsupported':'TypeScript incremental or composite compilation needs explicit review',
+        'typescript-incremental-unsupported':'TypeScript composite compilation needs explicit review',
+        'typescript-buildinfo-outside-repository':'TypeScript incremental build-info file is outside the observed repository',
+        'typescript-incremental-unsound':'TypeScript assumeChangesOnlyAffectDirectDependencies makes an incremental result depend on build history',
+        'typescript-buildinfo-name-unsupported':'TypeScript build-info file needs a plain name ending in .tsbuildinfo',
+        'typescript-project-reference-consumed':'TypeScript program uses files of a referenced project, which plain tsc does not build',
         'typescript-config-outside-repository':'TypeScript configuration extends outside the observed repository',
         'typescript-plugin-unsupported':'TypeScript compiler plugin needs explicit review',
         'typescript-input-list-unavailable':'TypeScript input listing did not complete',
         'typescript-input-outside-repository':'TypeScript consumes files outside the observed repository',
+        'typescript-vite-cache-consumed':'TypeScript asks about node_modules/.vite or lists node_modules; Vitest rewrites files there and this recipe does not observe them',
         'npm-installation-layout-unsupported':'npm executable or installation layout is unsupported',
         'npm-installation-unobservable':'npm installation contains unobservable entries',
         'npm-configuration-unsupported':'npm script configuration needs review',
         'typescript-contract-unavailable':'TypeScript applicability probe could not establish inputs',
+        'npm-proxy-version-unsupported':'npm proxy context is reviewed only for npm 10.9.2',
+        'npm-proxy-context-ambiguous':'conflicting npm proxy environment keys require resolution',
+        'npm-proxy-value-unsupported':'npm proxy environment contains an unsupported value',
         'workspace-execution-environment-unsupported':'Yarn/Node launcher environment override needs review',
         'yarn-toolchain-unavailable':'pinned Yarn version or executable is unavailable',
         'yarn-distribution-unobservable':'Corepack Yarn distribution cannot be inspected',
@@ -173,7 +287,7 @@ function probe(row,allowReuse=false) {
         'workspace-typecheck-contract-unavailable':'workspace TypeScript applicability probe could not establish inputs'
         ,'pnpm-execution-environment-unsupported':'pnpm or Node launcher environment override needs review'
         ,'pnpm-distribution-unobservable':'pnpm executable contents cannot be observed'
-        ,'pnpm-version-mismatch':'pnpm executable differs from the pinned version'
+        ,'pnpm-version-mismatch':'pnpm executable differs from the installed version'
         ,'typescript-input-outside-pnpm-contract':'TypeScript reads outside the selected workspace, linked outputs, or installed inputs'
         ,'pnpm-input-coverage-unavailable':'pnpm installed-input coverage became unavailable; inspect check details'
         ,'pnpm-typecheck-contract-unavailable':'pnpm TypeScript input contract could not be established'
@@ -187,18 +301,26 @@ function probe(row,allowReuse=false) {
       try{checkpoint=JSON.parse(out.stdout);
         checkpoint.queries=checkpoint.queryData?JSON.parse(inflateSync(
           Buffer.from(checkpoint.queryData,'base64'),{maxOutputLength:8*1024*1024})):null;
+        // Optional: without a layout, a run after an edit falls back to a full probe.
+        try{checkpoint.layout=checkpoint.layoutData?JSON.parse(inflateSync(
+          Buffer.from(checkpoint.layoutData,'base64'),{maxOutputLength:8*1024*1024})):null;}
+        catch{checkpoint.layout=null;}
         if(!/^[a-f0-9]{64}$/.test(checkpoint.output)||!/^[a-f0-9]{64}$/.test(checkpoint.context))
           throw Error('invalid supported probe checkpoint');}
       catch{row.probeHash=null;row.probeAt=0;row.probeError='probe checkpoint unavailable';return;}
     }
     values.push([argv,out.status,sha(cacheable?checkpoint.output:out.stdout),sha(out.stderr)]);
   }
+  learn();
   const value=sha(JSON.stringify(values));
   if((row.probeHash!==null&&row.probeHash!==value)||row.probeError){
     row.revision++;row.lastReason='declared state probe changed or recovered';}
   row.probeHash=value;row.probeAt=Date.now();row.probeError=null;
-  if(checkpoint)row.probeCache=checkpoint.queries?{input:key,context:checkpoint.context,
-    hash:value,queries:checkpoint.queries}:null;
+  if(checkpoint)row.probeCache=checkpoint.queries&&(!inProcess||basis)?{input:key,context:checkpoint.context,
+    hash:value,queries:checkpoint.queries,...(inProcess?{schema:1,...basis,
+      identities:new Map(),
+      output:checkpoint.output,queryData:checkpoint.queryData,layout:checkpoint.layout,
+      stderrHash:values[0][3]}: {})}:null;
   timing('daemon.probe',started,{outcome:'ok',commands:values.length,
     reusable:row.probeCache?1:0,queries:row.probeCache?.queries.length||0});
 }
@@ -226,6 +348,18 @@ function describeChangedInput(plan,file) {
     .map(mapping=>mapping.logical).slice(0,2);
   return file+' changed'+(matches.length?` (installed via ${matches.join(', ')})`:'');
 }
+// A run that hid the checkout's git-ignored entries (sandbox@2), and maybe
+// documentation files (sandbox@3, the receipt's sandbox.docs): the first
+// changed input it could see (sandbox.mjs's visibleChange), or null; once
+// per receipt and pair of fingerprints.
+const hiddenRun=r=>Array.isArray(r?.sandbox?.hidden)&&Boolean(r.files);
+function visibleChange(row,r,name) {
+  const key=(r.invocation?.runId||'')+'\0'+r.fingerprint+'\0'+combinedSummary(name).fingerprint;
+  if(row.visibleKey!==key){const current=combinedFiles(name);
+    row.visibleKey=key;row.visibleChange=sandboxVisibleChange(root,r.sandbox.hidden,r.files,current,[...Object.keys(r.files),...Object.keys(current)],
+      {docs:Array.isArray(r.sandbox.docs)?r.sandbox.docs:null});}
+  return row.visibleChange;
+}
 function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=false) {
   if(!index)return [];
   return [...index.checks].map(([name,row])=>{
@@ -233,7 +367,10 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
     const item={name,result,freshness:'UNVERIFIED',reason:'no receipt',changed_inputs:[],
       plan_id:row.plan.id,observed_at:lastObservation,
       invocation:r?.invocation||null,target_provenance:r?.target||null,
-      coverage_at_run:r?.coverage||null,declared_inputs_match:null,reuse_eligible:false};
+      ...(r?.verificationRecipe?{verification_recipe:r.verificationRecipe}:{}),
+      ...(r?.recipe?{recipe:r.recipe}:{}),
+      coverage_at_run:r?.coverage||null,declared_inputs_match:null,reuse_eligible:false,
+      ...(r?.runFacts?.length?{run_facts:r.runFacts.length}:{})};
     if(receiptStateError){item.reason=receiptStateError;return item;}
     if(!healthy||planning||recovering||index.unavailable){item.reason=
       (planning||recovering)?'input observation reconciliation pending':
@@ -243,8 +380,9 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
       return item;}
     if(pendingChecks.has(name)){item.reason='filesystem change pending content inspection';return item;}
     if(r&&r.planId) item.declared_inputs_match=r.planId===row.plan.id&&
-      r.fingerprint===combinedSummary(name).fingerprint;
-    if(r&&r.fingerprintVersion!==1){item.reason='receipt uses earlier input-resolution format';return item;}
+      (r.fingerprint===combinedSummary(name).fingerprint||hiddenRun(r)&&visibleChange(row,r,name)===null);
+    if(r&&!(r.fingerprintVersion===1||r.fingerprintVersion===2&&Array.isArray(r.runFacts))){
+      item.reason='receipt uses earlier input-resolution format';return item;}
     if(row.plan.unresolved.length){
       const checkpoint=item.declared_inputs_match===false?
         r.planId!==row.plan.id?'; observed input plan changed':
@@ -253,7 +391,13 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
       item.reason='input coverage unresolved: '+row.plan.unresolved.join('; ')+checkpoint+probeIssue;
       return item;
     }
-    if(row.probeError||!row.probeAt||Date.now()-row.probeAt>10000){item.reason=row.probeError||'state probe observation expired';return item;}
+    if(row.probeError){item.reason=row.probeError;return item;}
+    // The plan leaves out the build-info file it saw at start; the probe sees the current one.
+    if(row.probeCache?.layout&&(row.probeCache.layout.buildInfo||null)!==(row.plan.buildInfo||null)){
+      item.reason='the incremental build-info setting changed after the observer started; restart the observer';return item;}
+    // An expired probe or missing execution context cannot confirm CURRENT, but
+    // observed input content that already differs from the receipt is STALE.
+    let unconfirmed=!row.probeAt||Date.now()-row.probeAt>10000?'state probe observation expired':null;
     if(row.plan.synchronizedInstalledRead&&!synchronizedInstalled){
       item.reason='installed inputs require a synchronized content read';return item;}
     if(process.platform==='win32'&&!synchronizedFilesystem){
@@ -266,15 +410,21 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
       item.reason=`target execution ${r.target?.status||'unavailable'}`;return item;}
     if(r.target.status==='failed'&&result!=='FAIL'){
       item.reason='target failure conflicts with outer invocation outcome';return item;}
-    if(!r.stable){item.reason='inputs changed during execution or observation gap';return item;}
+    if(!r.stable){const issues=r.checkpoint?.issues?.length?` (${r.checkpoint.issues.join('; ')})`:'';
+      // A sandboxed run that could not start, whose result the sandbox changed, or whose rerun outside it did not finish, says so alone.
+      const sandbox=r.checkpoint?.issues?.length&&r.checkpoint.issues.every(issue=>/^the (?:sandbox changed|run was not sandboxed|run outside the sandbox|network supervisor)/.test(issue));
+      item.reason=sandbox?r.checkpoint.issues.join('; '):`inputs changed during execution or observation gap${issues}`;return item;}
     const names=[...(row.plan.environment.variables||[]),
       ...(row.plan.environment.prefixes||[]).map(prefix=>
         `__vstate_env_prefix_${prefix.toLowerCase()}__`),
       ...(row.plan.environment.pathExecutables||[]).map(name=>
         `__vstate_path_executable_${name}__`),
       ...(row.plan.environment.executableIdentity?['__vstate_node_identity__']:[])];
-    if(names.length&&!contextHashes?.[name]){
-      item.reason='execution environment context not supplied';return item;}
+    // A sandboxed run's variables, toolchain, PATH directories and places
+    // (sandbox.mjs): every entry either side has, and the first change named.
+    const sandboxChanged=isSandboxed(row.plan.qualification)&&contextHashes?.[name]?
+      sandboxChange(r?.environmentHashes,contextHashes[name]):null;
+    if(names.length&&!contextHashes?.[name])unconfirmed??='execution environment context not supplied';
     item.freshness='STALE';
     if(r.planId!==row.plan.id){
       const before=new Map((r.resolutionLinks||[]).map(link=>[link.path,link.targetHash]));
@@ -282,10 +432,21 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
       item.reason=changed?`installed input link changed: ${changed.path}`:'input plan changed';
       if(changed)item.changed_inputs=[changed.path];
     }
-    else if(names.some(key=>contextHashes[name]?.[key]!==r.environmentHashes?.[key]))
+    else if(sandboxChanged)item.reason=sandboxChanged;
+    else if(contextHashes?.[name]&&names.some(key=>contextHashes[name][key]!==r.environmentHashes?.[key]))
       item.reason='declared execution environment changed';
-    else if(r.fingerprint!==combinedSummary(name).fingerprint) {
+    // Every variable a test run read directly must have the same value. The
+    // caller compares them and names the list it used; another list confirms nothing.
+    else if(r.environmentReads&&contextHashes?.[name]&&
+      (contextHashes[name].__redue_env_reads__!==sha(JSON.stringify(r.environmentReads))||contextHashes[name].__redue_env_changed__)){
+      if(contextHashes[name].__redue_env_reads__!==sha(JSON.stringify(r.environmentReads))){
+        item.freshness='UNVERIFIED';item.reason='environment variables the last run read were not compared';}
+      else item.reason=`environment variable ${contextHashes[name].__redue_env_changed__} differs from the last run`;
+    }
+    else if(r.fingerprint!==combinedSummary(name).fingerprint&&!(hiddenRun(r)&&visibleChange(row,r,name)===null)) {
       const key=r.fingerprint+'\0'+combinedSummary(name).fingerprint;
+      if(row.staleReasonKey!==key&&hiddenRun(r)){
+        row.staleInputs=[visibleChange(row,r,name)];row.staleReason=describeChangedInput(row.plan,row.staleInputs[0]);row.staleReasonKey=key;}
       if(row.staleReasonKey!==key){
         let changed=row.lastReason;row.staleInputs=[];
         const candidate=changed?.endsWith(' changed')?changed.slice(0,-8):null;
@@ -297,30 +458,98 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
             if(r.files[f]!==current[f]){changed=describeChangedInput(row.plan,f);row.staleInputs=[f];break;}
         }
         row.staleReason=changed||
-          (['typescript-noemit-v1','yarn-workspace-tsc-v1','pnpm-tsc-v1']
+          (['typescript-noemit-v1','npm-typescript-direct-v1','yarn-workspace-tsc-v1','pnpm-tsc-v1']
             .includes(row.plan.qualification)?
             'TypeScript input set, generated file, or toolchain context changed':
             'declared input content or membership changed');
         row.staleReasonKey=key;
       }
       item.reason=row.staleReason;item.changed_inputs=row.staleInputs||[];
+      if(unconfirmed&&!(r.files&&row.staleInputs?.length)){item.freshness='UNVERIFIED';
+        item.reason=unconfirmed;item.changed_inputs=[];}
+    } else if(unconfirmed){item.freshness='UNVERIFIED';item.reason=unconfirmed;
+    // Lookups the run made outside the certificate are asked again for every
+    // answer, cached or synchronized, before it can say CURRENT.
+    // A direct run recorded before run facts may have made lookups no probe
+    // asks; only Windows, which never records direct runs, keeps reusing them.
+    } else if(r.fingerprintVersion===1&&r.verificationRecipe==='npm-direct-typescript@1'&&process.platform!=='win32'){
+      item.freshness='UNVERIFIED';item.reason='receipt predates run facts; run the check again';
+    } else if(r.runFacts&&(item.reason=runFactReason(r.runFacts))){item.changed_inputs=[];
+    // A recorded test run that used something REDUE does not observe, or
+    // whose result differed from an earlier run on the same inputs.
+    } else if(r.guardIssues?.length){item.freshness='UNVERIFIED';
+      item.reason=`the run used inputs REDUE does not observe: ${r.guardIssues.slice(0,3).join('; ')}`+
+        (r.guardIssues.length>3?`; and ${r.guardIssues.length-3} more`:'');
+    } else if(r.nondeterministic){item.freshness='UNVERIFIED';item.reason='runs on these exact inputs had different results';
     } else {item.freshness='CURRENT';item.reason=result==='FAIL'?'last command failed':'declared inputs match';
       item.reuse_eligible=result==='PASS';}
     return item;
   });
 }
+// Null when every run fact in a receipt answers as it did during the run.
+function runFactReason(facts) {
+  const started=performance.now(),reason=runFactChanged(facts);
+  timing('daemon.run_facts',started,{facts:facts.length,changed:reason?1:0});
+  return reason;
+}
+// The indexed inputs already differ from the latest receipt, so no probe result
+// can make this check CURRENT. A sync answers STALE without a full probe. A run
+// probes, or builds the certificate from its recording (adopt), and a revert
+// makes the inputs match and probes again.
+function knownStale(name,row) {
+  const r=receipts[name];
+  if(!r?.files||r.planId!==row.plan.id||row.probeError||pendingChecks.has(name)||
+    row.probeCache?.input===inputKey(row))return false;
+  const current=combinedFiles(name),files=Object.keys(current);
+  return files.length!==Object.keys(r.files).length||files.some(file=>r.files[file]!==current[file]);
+}
+// A run can rebuild a certificate that no longer applies only because indexed
+// inputs changed: same plan guard, compiler, toolchain and observation.
+function adoptable(row) {
+  const cache=row.probeCache;
+  if(process.platform==='win32'||row.plan.qualification!=='npm-typescript-direct-v1'||
+    row.plan.unresolved.length||row.probeError||cache?.schema!==1||!cache.layout||!cache.queries?.length||
+    cache.input===inputKey(row)||cache.gaps!==metrics.gaps||!continuityBarrier())return false;
+  try{const basis=certificateBasis(row);
+    return basis.guard===cache.guard&&basis.compiler===cache.compiler&&basis.toolchain===cache.toolchain;}
+  catch{return false;}
+}
+// The end checkpoint of a run that started without a certificate. Its recorded
+// answers become the candidate certificate when nothing observed changed during
+// the run. The probe that follows validates it, or runs in full as before.
+function adopt(name,row,token) {
+  const started=performance.now(),pending=row.adoption,file=path.join(state,`run-record-${token}.json`);
+  row.adoption=null;
+  let text=null;
+  try{text=fs.readFileSync(file,'utf8');}catch{}
+  const done=issue=>{timing('daemon.recorded_certificate',started,{outcome:issue?'rejected':'accepted',
+    ...(issue?{reason:issue}:{})});return issue;};
+  if(!pending||pending.token!==token||text===null)return done('recording unavailable');
+  if(inputEventSerial.get(name)!==pending.serial||metrics.gaps!==pending.gaps||inputKey(row)!==pending.input||
+    row.probeCache!==pending.cache||row.probeHash!==null)
+    return done('inputs or certificate changed during the run');
+  const cache=pending.cache,argv=row.plan.probes[0];
+  let result;
+  try{result=recordedCertificate(text,cache,directProject(argv[2],runFromArgv(argv.slice(3)),{verify:false}),buildInfoPath(row.plan));}
+  catch{return done('recording unreadable');}
+  if(result.issue)return done(result.issue);
+  const identities=new Map(cache.identities);
+  for(const changed of result.changed)identities.delete(changed);
+  row.probeCache={...cache,hash:directProbeValue(argv,result.output,cache.stderrHash),
+    queries:result.queries,identities,output:result.output,layout:result.layout,input:pending.input,recorded:token,
+    queryData:deflateSync(JSON.stringify(result.queries)).toString('base64')};
+  metrics.recordedCertificates=(metrics.recordedCertificates||0)+1;
+  return done(null);
+}
 function status(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=false) {
   // Reload notifications accelerate visibility but are not required for it: a
   // wrapper may persist its outcome even when its control connection is denied.
   refreshReceipts();
-  const checks=rows(contextHashes,synchronizedInstalled,synchronizedFilesystem), current=checks.filter(r=>r.freshness==='CURRENT'&&r.result==='PASS').length,
-    failed=checks.filter(r=>r.freshness==='CURRENT'&&r.result==='FAIL').length,
-    observedFailed=checks.filter(r=>r.result==='FAIL').length,
-    stale=checks.filter(r=>r.freshness==='STALE').length,
-    unverified=checks.filter(r=>r.freshness==='UNVERIFIED').length||(!checks.length?1:0);
-  const stateName=failed?'failed':unverified?'unverified':stale?'stale':'current';
-  const now=Date.now();return {schema:1,receipt_revision:receiptStateRevision,state:stateName,current,failed,observed_failed:observedFailed,
-    stale,unverified,checks,
+  const checks=rows(contextHashes,synchronizedInstalled,synchronizedFilesystem);
+  // A decision may run every check's probes in turn: callers wait for all of them.
+  const probing=[...(index?.checks.values()||[])].filter(row=>row.plan.probes.length);
+  const now=Date.now();return {schema:1,receipt_revision:receiptStateRevision,...statusSummary(checks),checks,
+    ...(probing.length?{probe_deadline_ms:probing.reduce((sum,row)=>sum+fullProbeDeadline(row)*row.plan.probes.length,0)}:{}),
     observation:{healthy:healthy&&!planning&&!recovering&&!index?.unavailable,
       generation,observed_at:lastObservation,
       events:(index?.eventCount||0)+[...external.values()].reduce((n,e)=>n+(e.index?.eventCount||0),0),
@@ -355,16 +584,10 @@ function hydrate(bundle,saved) {
   }
   next.eventCount=saved.eventCount;next.rehashedFiles=saved.rehashedFiles;
   next.rehashedBytes=saved.rehashedBytes;next.profile=saved.profile;
+  next.racy=new Map(saved.racy||[]);
   return next;
 }
-function dehydrate(value) {
-  return {files:[...value.files],
-    aliasDependencies:[...value.aliasDependencies].map(([name,refs])=>[name,[...refs]]),
-    rows:[...value.checks].map(([name,row])=>({name,files:[...row.files],
-      sum:row.sum.toString('hex'),revision:row.revision,lastReason:row.lastReason})),
-    eventCount:value.eventCount,rehashedFiles:value.rehashedFiles,
-    rehashedBytes:value.rehashedBytes,profile:value.profile};
-}
+const dehydrate=dehydrateIndex;
 function retainIndex() {
   if(!index||!healthy||planning||pending.size||planDirty||historyDisabled||
     !fs.existsSync(snapshotPath))return;
@@ -384,7 +607,7 @@ function buildInWorker(forceCold=false,reuse=null) {
   return new Promise((resolve,reject)=>{
     const workerStarted=performance.now();
     const file=path.join(path.dirname(fileURLToPath(import.meta.url)),'plan-worker.mjs');
-    const worker=new Worker(file,{workerData:{config:configFile,state,forceCold,reuse,
+    const worker=new Worker(file,{workerData:{config:configFile,state,forceCold,reuse,diagnostic:traceContext(),
       reconcileFaultFile:process.env.VSTATE_TEST_RECONCILE_FAULT_FILE}});
     planningWorker=worker;let settled=false;
     const deadline=setTimeout(()=>{
@@ -409,7 +632,7 @@ function buildInWorker(forceCold=false,reuse=null) {
       reject(Error(`input-plan worker exited ${code}`));}});
   });
 }
-async function refreshPlan({forceCold=false,reuse=false}={}) {
+async function refreshPlan({forceCold=false,reuse=false,skip=null}={}) {
   if(planning||stopping)return;
   const totalStarted=performance.now();
   const previousProbes=new Map([...(index?.checks||[])].map(([name,row])=>[name,row.probeCache]));
@@ -492,7 +715,8 @@ async function refreshPlan({forceCold=false,reuse=false}={}) {
     atomic(path.join(state,'plans-v1.json'),persistedPlan(bundle));
     metrics.lastPlanPersistenceMs=performance.now()-persistenceStarted;
     const probeStarted=performance.now();
-    for(const row of index.checks.values())probe(row,built.planReused);
+    if(skip)refreshReceipts();
+    for(const [name,row] of index.checks)if(!skip?.(name,row))probe(row,built.planReused);
     timing('daemon.plan_probes',probeStarted,{checks:index.checks.size});
     lastObservation=Date.now();
     event(built.planReused?'plan_validated':'plan_rebuilt',{checks:Object.keys(bundle.plans),workspace_count:bundle.workspaceCount});
@@ -588,14 +812,25 @@ function pnpmTopologyChanged(type,rel) {
     return stat.isDirectory()||stat.isSymbolicLink();}
   catch(e){return e.code==='ENOENT';}
 }
-function markInputEvent(name,rel,type) {
+function markInputEvent(name,rel,type,replay) {
   pendingChecks.add(name);
-  inputEventSerial.set(name,(inputEventSerial.get(name)||0)+1);
+  // macOS delivers each edit twice: live, and again from history replay. The
+  // live copy can arrive late, inside a later run. With history, count only the
+  // replay copy: the history cursor places it in the right interval.
+  if(!hasHistory||historyDisabled||replay){
+    const serial=(inputEventSerial.get(name)||0)+1;
+    inputEventSerial.set(name,serial);
+    // Kept only for recorded test and script checks and sandboxed ones; trimmed in batches.
+    if(['npm-tests-direct-v1','node-script-v1'].includes(index?.checks.get(name)?.plan.qualification)||isSandboxed(index?.checks.get(name)?.plan.qualification)){
+      const list=inputEventPaths.get(name)||[];list.push([serial,rel]);
+      if(list.length>2*eventPathLimit)list.splice(0,list.length-eventPathLimit);inputEventPaths.set(name,list);
+    }
+  }
   // Disposable public CI only. Never enabled for normal/local repositories.
   if(process.env.REDUE_PUBLIC_INPUT_TRACE==='1'&&rel&&diagnosticInputEvents++<5000)
-    event('public_input_notification',{path:rel,type:type||'unknown',planning});
+    event('public_input_notification',{path:rel,type:type||'unknown',planning,replay});
 }
-function notification(type,filename) {
+function notification(type,filename,replay=false) {
   metrics.notifications++;
   metrics.lastNotificationAt=Date.now();
   if(!filename){observationGap('unnamed_event');return;}
@@ -603,7 +838,7 @@ function notification(type,filename) {
   if(rel==='.git'||rel.startsWith('.git/'))return;
   if(planning) {
     if(index)for(const name of index.candidates(rel))
-      if(index.matches(index.checks.get(name),rel))markInputEvent(name,rel,type);
+      if(index.matches(index.checks.get(name),rel))markInputEvent(name,rel,type,replay);
     pending.add(rel);metrics.maxQueue=Math.max(metrics.maxQueue,pending.size);
     if(planTrigger(rel)||candidateDescendants.has(rel)||pnpmTopologyChanged(type,rel))
       planDirty=true;
@@ -627,9 +862,9 @@ function notification(type,filename) {
   pending.add(rel);metrics.maxQueue=Math.max(metrics.maxQueue,pending.size);
   if(index) {
     for(const name of index.candidates(rel))
-      if(index.matches(index.checks.get(name),rel))markInputEvent(name,rel,type);
+      if(index.matches(index.checks.get(name),rel))markInputEvent(name,rel,type,replay);
     for(const [prefix,names] of index.prefixes)
-      if(prefix.startsWith(rel+'/'))for(const name of names)markInputEvent(name,rel,type);
+      if(prefix.startsWith(rel+'/'))for(const name of names)markInputEvent(name,rel,type,replay);
   }
   if(pending.size>50000){healthy=false;reason='observation backlog overflow';metrics.gaps++;
     event('observation_gap',{classification:'backlog_overflow'});publish();
@@ -638,23 +873,23 @@ function notification(type,filename) {
   if(planDirty){healthy=false;reason='input plan possibly changed';}
   if(planDirty||pendingChecks.size)publish();
 }
-function externalNotification(entry,type,filename) {
+function externalNotification(entry,type,filename,replay=false) {
   metrics.notifications++;
   metrics.lastNotificationAt=Date.now();
   if(!filename){externalGap(entry,'unnamed_event');return;}
   const rel=filename.toString().split(path.sep).join('/');
   const absolute=path.join(entry.root,rel);
   if(planning&&entry.index)for(const name of entry.index.candidates(rel))
-    if(entry.index.matches(entry.index.checks.get(name),rel))markInputEvent(name,rel,type);
+    if(entry.index.matches(entry.index.checks.get(name),rel))markInputEvent(name,`external:${entry.root}:${rel}`,type,replay);
   if(planTrigger(absolute)&&triggerChanged(absolute))planDirty=true;
   if(candidateTriggerChanged(absolute))planDirty=true;
   entry.pending.add(rel);metrics.maxQueue=Math.max(metrics.maxQueue,
     pending.size+[...external.values()].reduce((n,e)=>n+e.pending.size,0));
   if(entry.index) {
     for(const name of entry.index.candidates(rel))
-      if(entry.index.matches(entry.index.checks.get(name),rel))markInputEvent(name,rel,type);
+      if(entry.index.matches(entry.index.checks.get(name),rel))markInputEvent(name,`external:${entry.root}:${rel}`,type,replay);
     for(const [prefix,names] of entry.index.prefixes)
-      if(prefix.startsWith(rel+'/'))for(const name of names)markInputEvent(name,rel,type);
+      if(prefix.startsWith(rel+'/'))for(const name of names)markInputEvent(name,`external:${entry.root}:${rel}`,type,replay);
   }
   if(planDirty){healthy=false;reason='input plan possibly changed';}
   publish();clearTimeout(flushTimer);flushTimer=setTimeout(flush,60);
@@ -672,7 +907,8 @@ function observationGap(classification,error) {
   // Once continuity is uncertain, a cursor is no longer authority. Do not
   // retry native history in this observer generation after reconciliation.
   historyDisabled=true;
-  healthy=false;reason=`observation unavailable: ${classification}; deterministic reconciliation pending`;
+  const cause=error?.message?` (${error.message})`:'';
+  healthy=false;reason=`observation unavailable: ${classification}${cause}; deterministic reconciliation pending`;
   metrics.gaps++;
   event('observation_gap',{classification,error_code:error?.code||null});publish();
   // One bounded attempt per gap; a later independent gap may try again.
@@ -758,14 +994,14 @@ async function catchUp() {
     lastObservation=Date.now();return;
   }
   if(historyDisabled)return;
-  if(synchronizing)return synchronizing;
+  if(synchronizing){mark('daemon.catch_up_join');return synchronizing;}
   synchronizing=(async()=>{
     if(!verifyRoot())throw Error('checkout identity changed');
     if(!watcher)throw Error('subscription unavailable');
     if(!fs.existsSync(snapshotPath))throw Error('historical cursor missing');
     {
       const changes=await queryHistory(root,snapshotPath,'root replay');
-      for(const change of changes)notification(change.type,path.relative(root,change.path));
+      for(const change of changes)notification(change.type,path.relative(root,change.path),true);
       if(!planning&&(flushTimer||pending.size||planDirty))flush();
       for(const entry of external.values())if(entry.index) {
         try{
@@ -775,7 +1011,7 @@ async function catchUp() {
           if(!entry.watcher||!fs.existsSync(entry.snapshot))throw Error('external cursor unavailable');
           const changes=await queryHistory(entry.root,entry.snapshot,'external replay');
           for(const change of changes)externalNotification(entry,change.type,
-            path.relative(entry.root,change.path));
+            path.relative(entry.root,change.path),true);
         }catch(e){if(e.code==='ETIMEDOUT')throw e;
           externalGap(entry,'historical_replay_failed',e);}
       }
@@ -789,7 +1025,8 @@ async function catchUp() {
 function respond(client,value) {
   if(client.destroyed){event('control_reply_unavailable',{classification:'client_destroyed'});return;}
   try{const payload=JSON.stringify(value)+'\n';
-    client.end(payload);client.vstateReplied=true;
+    mark('server.response_constructed',{bytes:payload.length});
+    client.end(payload,()=>mark('server.response_delivered'));client.vstateReplied=true;
     if(process.env.VSTATE_DEBUG_CONTROL==='1')event('control_reply_sent',{bytes:payload.length});}
   catch(e){event('control_reply_unavailable',{classification:e.name||'serialization_error'});
     if(!client.destroyed)client.end('{"error":"control response unavailable"}\n');}
@@ -807,10 +1044,11 @@ async function request(message) {
   if(message.action==='sync'||message.action==='snapshot'||message.action==='prelaunch') {
     const totalStarted=performance.now();
     const decision=++decisionSequence;
+    mark('server.decision_start',{decision,pending:pending.size,planDirty,planning,recovering,healthy,historyDisabled,decisionRequests,historyDeadlineMs,reconciliationDeadlineMs});
     timing('daemon.decision_reason',totalStarted,{decision,action:message.action,
       plan:process.platform==='win32'?'validate_dependencies_before_reuse':'existing_plan',
-      probe:'reuse_only_with_identical_content_and_context',installed:'current_content_required',
-      phase:metrics.planPhase||'initializing',pending:pending.size,
+      probe:'reuse_only_with_identical_content_and_context',installed:'current_identity_required',
+      planPhase:metrics.planPhase||'initializing',pending:pending.size,
       notifications:metrics.notifications,planRebuilds:metrics.planRebuilds});
     if(process.platform==='win32'&&process.env.VSTATE_TEST_FAULTS==='1'&&
       process.env.VSTATE_TEST_WINDOWS_GAP_FILE&&
@@ -825,9 +1063,17 @@ async function request(message) {
     // has been disabled: a recovered subscription may still have queued events.
     const needsContentReconciliation=process.platform==='win32'||(hasHistory&&historyDisabled);
     if(needsContentReconciliation&&message.action!=='prelaunch'){
-      const started=performance.now();await refreshPlan({forceCold:true,reuse:true});
+      // Windows probes inside the reconciliation, so a known-STALE sync skips it there.
+      const started=performance.now();
+      await refreshPlan({forceCold:true,reuse:true,skip:message.action==='sync'?knownStale:null});
       timing('daemon.request_content_validation',started,{healthy:healthy?1:0});}
-    if(healthy)try{const started=performance.now();await catchUp();
+    // Without synchronized installed reads, the continuity barrier runs once,
+    // after probing: in-process validation reads the live filesystem, and the
+    // barrier then applies every change before the response is computed.
+    const deferBarrier=process.platform!=='win32'&&!needsContentReconciliation&&
+      message.action!=='prelaunch'&&index&&healthy&&!planning&&![...index.checks].some(([name,row])=>
+        row.plan.synchronizedInstalledRead&&(!message.name||message.name===name));
+    if(healthy&&!deferBarrier)try{const started=performance.now();await catchUp();
       timing('daemon.request_catch_up',started);}catch(e){observationGap('historical_query',e);}
     if(flushTimer||pending.size||planDirty||[...external.values()].some(e=>e.pending.size))flush();
     let synchronizedInstalled=false;
@@ -862,10 +1108,66 @@ async function request(message) {
       }catch(e){installedRecheck=null;observationGap('installed_recheck',e);}
     }
     const probeStarted=performance.now();
-    if(index&&healthy&&!validatedColdIndex&&message.action!=='prelaunch')
-      for(const row of index.checks.values())probe(row);
+    // A run's start checkpoint skips the full probe when its recording can
+    // replace the certificate; the end checkpoint offers that recording.
+    let adoptIntent=false,recorded;const adopting=new Set();
+    if(index&&healthy&&!validatedColdIndex&&message.action!=='prelaunch'){
+      const continuous=continuityBarrier(),probed=index,gaps=metrics.gaps,decided=Date.now();
+      const selected=[...index.checks].filter(([name])=>!message.name||message.name===name);
+      if(message.action==='snapshot'&&typeof message.adopt==='string'&&/^[0-9a-f-]{36}$/.test(message.adopt)){
+        const row=index.checks.get(message.name);
+        recorded=row?adopt(message.name,row,message.adopt):'recording unavailable';
+      }
+      adoptIntent=message.action==='snapshot'&&message.runCertificate===1&&!message.adopt&&continuous;
+      const keys=new Map(selected.map(([name,row])=>[name,inputKey(row)]));
+      const skip=message.action==='sync'?knownStale:()=>false;
+      if(message.action==='sync')refreshReceipts();
+      // With a deferred barrier, validate in-process first and launch any full
+      // probe only after the barrier, so a queued edit costs one probe, not two.
+      for(const [name,row] of selected)if(!skip(name,row))probe(row,continuous,{launch:!deferBarrier&&!adoptIntent});
+      if(continuous&&process.env.VSTATE_TEST_FAULTS==='1'&&process.env.VSTATE_TEST_MAC_PROBE_SIGNAL){
+        fs.writeFileSync(process.env.VSTATE_TEST_MAC_PROBE_SIGNAL,'validated');
+        await new Promise(resolve=>setTimeout(resolve,200));
+      }
+      // Validation and probes block JS event delivery. Finish with a continuity
+      // barrier so queued edits/gaps cannot be published using the pre-probe index.
+      if(continuous||deferBarrier)try{const started=performance.now();
+        await catchUp();if(planDirty||pending.size||flushTimer)flush();
+        timing('daemon.request_catch_up',started,{after:'probes'});
+        // Rows not yet confirmed, or whose inputs moved meanwhile, are probed
+        // from the barrier, as an undeferred decision would have done.
+        // Decided once, after the barrier. The start probe value is already out
+        // of date; clearing it means whichever probe comes next sets the value
+        // for this unchanged interval without counting as a change during the run.
+        if(adoptIntent&&index===probed&&healthy&&!planning)for(const [name,row] of selected)
+          if(row.probeAt<decided&&adoptable(row)){
+            adopting.add(name);row.probeHash=null;
+            row.adoption={token:randomUUID(),serial:inputEventSerial.get(name)||0,gaps:metrics.gaps,
+              input:inputKey(row),cache:row.probeCache};
+          }
+        const rest=index===probed&&healthy&&!planning?selected.filter(([name,row])=>!skip(name,row)&&
+          !adopting.has(name)&&(row.probeAt<decided||metrics.gaps!==gaps||inputKey(row)!==keys.get(name))):[];
+        const launched=metrics.fullProbes||0;
+        for(const [,row] of rest)probe(row,continuityBarrier());
+        if(continuous&&(metrics.fullProbes||0)>launched){await catchUp();if(planDirty||pending.size||flushTimer)flush();}
+      }catch(e){observationGap('post_probe_history',e);}
+    }
     timing('daemon.request_probes',probeStarted,{checks:index?.checks.size||0});
     lastObservation=Date.now();publish();
+    // A run checkpoint never holds an installed identity from the racy window:
+    // a same-size write in the same timestamp tick would keep it. Wait the
+    // window out (at most 2 s), record those files again, and mark the
+    // checkpoint unusable if one is still inside it.
+    let racy=false;
+    if(message.action==='snapshot'||message.action==='prelaunch'){
+      const names=message.name?[message.name]:null;
+      const indexes=()=>[index,...[...external.values()].map(e=>e.index)].filter(Boolean);
+      const wait=Math.min(racyWindowMs,Math.max(0,...indexes().map(i=>i.racyUntil(names)))-Date.now());
+      if(wait>0){metrics.racyWaits=(metrics.racyWaits||0)+1;await new Promise(resolve=>setTimeout(resolve,wait+5));}
+      for(const i of indexes())i.settleRacy();
+      racy=indexes().some(i=>i.racyUntil(names)>Date.now());
+      if(racy)metrics.racyCheckpoints=(metrics.racyCheckpoints||0)+1;
+    }
     const applicabilityStarted=performance.now();
     const data=status(message.contextHashes,synchronizedInstalled,
       process.platform==='win32'&&healthy&&!planning&&!planDirty);
@@ -875,8 +1177,43 @@ async function request(message) {
           data.snapshots[name]={...combinedSummary(name),files:combinedFiles(name),
           planGeneration:row.plan.id,
             inputEventSerial:inputEventSerial.get(name)||0,
-            probeHash:row.probeHash,
-            observationHealthy:healthy&&!planning&&!recovering&&applicableExternal(name).every(e=>e.healthy)};
+            // Complete only when the oldest kept event follows the given serial.
+            ...(Number.isSafeInteger(message.sinceSerial)?(()=>{const list=inputEventPaths.get(name)||[],
+              since=message.sinceSerial,later=list.filter(([serial])=>serial>since);
+              return {inputEventPaths:later.map(([,rel])=>rel),
+                inputEventPathsComplete:(inputEventSerial.get(name)||0)-since===later.length};})():{}),
+            probeHash:row.probeHash,inputKey:inputKey(row),observationGaps:metrics.gaps,
+            observationHealthy:healthy&&!planning&&!recovering&&!racy&&applicableExternal(name).every(e=>e.healthy)};
+      // Export only a currently guarded, check-specific discovery certificate.
+      // The caller compares it with the answers its own compile received. Schema 2
+      // certifies the realpath of every directory readDirectory visits. The
+      // snapshot stays the start of the observed interval, including validation.
+      if(message.runCertificate===1&&continuityBarrier()){
+        const row=index?.checks.get(message.name),cache=row?.probeCache;
+        // Also after an accepted recording: the caller compares its record with
+        // this certificate and finds its run facts with it.
+        if(row?.plan.qualification==='npm-typescript-direct-v1'&&
+          !row.plan.unresolved.length&&cache?.schema===1&&cache.input===inputKey(row)&&
+          cache.hash===row.probeHash&&cache.guard===planGuard(index.bundle)&&
+          cache.output&&cache.queryData&&data.snapshots[message.name])
+          data.snapshots[message.name].discoveryCertificate={schema:2,planId:row.plan.id,
+            cwd:row.plan.cwd,probeDefinition:sha(JSON.stringify(row.plan.probes)),
+            context:cache.context,output:cache.output,stderrHash:cache.stderrHash,
+            queryData:cache.queryData};
+      }
+      // For a run checked by full probes: the last probe's questions, only to
+      // find the run's lookups outside them. Never evidence for reuse.
+      if(message.runFacts===1&&data.snapshots[message.name]){
+        const row=index?.checks.get(message.name),cache=row?.probeCache;
+        if(row?.plan.qualification==='npm-typescript-direct-v1'&&cache?.queryData&&
+          typeof cache.context==='string'&&cache.input===inputKey(row)&&cache.hash===row.probeHash&&
+          cache.guard===planGuard(index.bundle))
+          data.snapshots[message.name].probeQuestions={context:cache.context,queryData:cache.queryData};
+      }
+      const row=index?.checks.get(message.name);
+      if(adopting.has(message.name)&&row?.adoption&&data.snapshots[message.name])
+        data.snapshots[message.name].recordedCertificate=row.adoption.token;
+      if(typeof recorded==='string'&&data.snapshots[message.name])data.snapshots[message.name].recordingIssue=recorded;
     }
     timing('daemon.request_applicability',applicabilityStarted,{checks:data.checks.length});
     timing('daemon.request_total',totalStarted,{action:message.action,
@@ -900,7 +1237,7 @@ async function shutdown() {
         healthy=true;retainIndex();healthy=false;}
     } catch(e){event('index_retention_unavailable',{classification:e.name||'Error'});}
   }
-  planningWorker?.terminate().catch(()=>{});
+  closeHistory();planningWorker?.terminate().catch(()=>{});
   clearInterval(heartbeat);clearInterval(probeTimer);clearTimeout(recoveryTimer);
   watcher?.unsubscribe().catch(()=>{});server.close();
   for(const entry of external.values()){
@@ -918,15 +1255,19 @@ const server=net.createServer(client=>{
     event('control_reply_unavailable',{classification:handled?'closed_without_reply':
       'closed_before_request',request_bytes:text.length});});
   client.on('data',d=>{
-    if(handled)return;text+=d;if(text.length>4096){event('control_request_rejected',
+    // A sync request carries each check's context digests, about 1.5 KB per
+    // check; 1 MiB leaves room for hundreds of checks.
+    if(handled)return;text+=d;if(text.length>1024*1024){event('control_request_rejected',
       {classification:'request_too_large',request_bytes:text.length});client.destroy();return;}
     if(!text.includes('\n'))return;handled=true;
     try{const message=JSON.parse(text);
       const decision=message.action==='sync'||message.action==='snapshot';
       if(decision)decisionRequests++;
-      Promise.resolve(request(message)).then(v=>respond(client,v))
-        .catch(e=>respond(client,{error:e.message}))
-        .finally(()=>{if(decision)decisionRequests--;});}
+      traceScope({request:message.diagnostic?.request||traceId(),work:'request'},()=>{
+        mark('server.request_received',{activeDecisions:decisionRequests});
+        Promise.resolve(request(message)).then(v=>respond(client,v))
+          .catch(e=>respond(client,{error:e.message}))
+          .finally(()=>{mark('server.request_complete');if(decision)decisionRequests--;});});}
     catch(e){respond(client,{error:e.message});}
   });
 });
@@ -986,15 +1327,23 @@ const heartbeat=setInterval(()=>{
   }
   publish();
 },1000);
-const probeTimer=setInterval(async()=>{
+// Idle revalidation keeps probe results fresh for cached status without
+// launching a process: certificates are replayed in-process, and one that no
+// longer holds expires so the next decision runs the full probe. macOS history
+// replay would fork, so cached status there relies on live notifications.
+const probeTimer=setInterval(()=>traceScope({request:traceId(),work:'periodic'},async()=>{
+  mark('server.periodic_start',{pending:pending.size,planDirty,planning,decisionRequests});
   // Windows cached reads are conservatively UNVERIFIED until a full decision
-  // reconciliation. Periodic synchronous probes cannot strengthen that cache,
-  // but can block control requests behind several seconds of child work.
+  // reconciliation, so idle revalidation cannot strengthen them.
   if(process.platform==='win32')return;
-  if(healthy&&index&&!planning&&!decisionRequests){
-  try{await catchUp();for(const row of index.checks.values())probe(row);publish();}
-  catch(e){observationGap('periodic_query',e);}
-}},5000);
+  if(healthy&&index&&!planning&&!recovering&&!decisionRequests){
+    try{if(!hasHistory)await catchUp();}catch(e){observationGap('periodic_query',e);}
+    if(healthy&&index&&!planning&&!recovering)
+      for(const row of index.checks.values())probe(row,true,{launch:false});
+    if(planDirty)flush();else publish();
+  }
+  mark('server.periodic_complete');
+}),5000);
 process.on('uncaughtExceptionMonitor',error=>{
   try{event('observer_uncaught_exception',{pid:process.pid,code:error.code||null,
     message:error.message,stack:error.stack});}catch{}