@ttsc/unplugin 0.30.3 → 0.31.0

package/src/core/transform/generation/selectReportedMembershipPolicy.ts

@@ -0,0 +1,44 @@
+import type { ITtscCompilerTransformation } from "ttsc";
+
+import type { ITtscProjectMembershipPolicy } from "../../tsconfig/ITtscProjectMembershipPolicy";
+
+/**
+ * Replace a capture's provisional compiler comparison rule with its report.
+ *
+ * Capture supplies an explicit priming answer before walking. An exception or
+ * an envelope without a case report leaves that same policy intact. A differing
+ * report marks the old walk for refusal; this operation neither performs the
+ * walk nor establishes that a predicted answer matched the native compiler.
+ *
+ * @evidence contracts/common.md#principled-implementation An available compiler boolean, including false, overrides the explicit priming answer; equality determines whether the capture learned a different rule. Missing reports retain the original policy identity.
+ * @evidence contracts/common.md#clear-and-simple-design One report-selection operation returns the policy and changed-rule fact; capture retains ownership of enumeration authority and proof refusal.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts No OS label or filesystem probe substitutes for a compiler report, and no report supplies missing walk evidence.
+ * @evidence contracts/common.md#meaningful-documentation Native prose states the explicit primer requirement, missing-report identity and changed-policy refusal boundary.
+ * @evidence contracts/portability.md#os-neutral-implementation The compiler's reported comparison policy wins independently of host path grammar; the explicit primer remains provisional and native prediction or probing is outside this operation.
+ * @evidence contracts/performance.md#efficient-algorithms Missing reports return the borrowed policy; an available report shallow-copies its own fields once. Work and temporary object space follow policy field count, without traversing nested specifications.
+ * @evidenceExclude contracts/performance.md#reuse-equivalent-work Selects this envelope's reported rule without retaining a memo or certifying reuse of the primed walk.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources Borrows the primer or returns a shallow policy object; capture owns retained policy and observer lifetimes, with no handle or historical state acquired here.
+ */
+export function selectReportedMembershipPolicy(
+  primed: ITtscProjectMembershipPolicy & { useCaseSensitiveFileNames: boolean },
+  result: ITtscCompilerTransformation,
+): {
+  /** Borrowed primer or reported-case overlay for this capture's validators. */
+  membershipPolicy: ITtscProjectMembershipPolicy;
+
+  /** Whether the primed walk used a different rule from this compiler report. */
+  casePolicyLearned: boolean;
+} {
+  const reported =
+    result.type === "exception"
+      ? undefined
+      : result.graph?.useCaseSensitiveFileNames;
+  return {
+    membershipPolicy:
+      reported === undefined
+        ? primed
+        : { ...primed, useCaseSensitiveFileNames: reported },
+    casePolicyLearned:
+      reported !== undefined && reported !== primed.useCaseSensitiveFileNames,
+  };
+}

package/src/core/transform/generation/selectTransformAttemptDisposition.ts

@@ -0,0 +1,150 @@
+import type { TtscAdoptionVerdict } from "../session/TtscAdoptionVerdict";
+import type { TtscGenerationProofFailures } from "./TtscGenerationProofFailures";
+import { createGenerationProofFailures } from "./createGenerationProofFailures";
+import { onlyLearnedCompileFacts } from "./onlyLearnedCompileFacts";
+
+/**
+ * Select how one completed capture spends the retry owner's budgets. Supplied
+ * facts describe the capture; this policy performs no capture or native proof.
+ *
+ * Coherent results return first. A local, lossless host-observation refusal can
+ * transfer one fresh success without reuse authority. Rejected attempts spend
+ * movement only when they neither refute a publication nor solely learn facts.
+ * Two movements or four captures stop retrying, retaining a current diagnostic
+ * rather than a terminal instability verdict when its config is not refuted.
+ *
+ * The caller owns learned dependency/case carry, terminal validation, capture
+ * disposal and result transfer. Selecting terminal does not certify a baseline
+ * or cleanup, and selecting accepted does not independently prove input facts.
+ *
+ * @evidence contracts/common.md#principled-implementation
+ *   Capture flags govern coherent acceptance before retry classification. Only
+ *   local stable successes with nonempty lossless host-unavailable failures get
+ *   fresh-only transfer; refuted publication and learned-only exemptions retain
+ *   the absolute cap, while other failures consume the movement budget.
+ * @evidence contracts/common.md#clear-and-simple-design
+ *   A pure disposition returns classification and next scalar retry state;
+ *   capture, mutable learning, validation lookup and cleanup remain caller-owned.
+ *   Accepted and fresh-only literal variants stay separate so their exclusion
+ *   leaves only dispositions carrying rejection state.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts
+ *   No native backend substitution or test injection bypasses capture. Omitted,
+ *   mixed and empty failures cannot establish the learned or fresh exemption.
+ * @evidence contracts/common.md#meaningful-documentation
+ *   Prose distinguishes acceptance, fresh transfer, bounded rejection and the
+ *   caller's actual proof/resource responsibilities without claiming execution.
+ * @evidenceExclude contracts/portability.md#os-neutral-implementation
+ *   Classifies logical result flags, opaque publication keys and failure kinds;
+ *   it interprets no native coordinate, filesystem capability or process value.
+ * @evidence contracts/performance.md#efficient-algorithms
+ *   Scalar guards precede at most two short-circuit failure scans. Work follows
+ *   supplied entry count and kind text; no dependency population is copied here.
+ * @evidenceExclude contracts/performance.md#reuse-equivalent-work
+ *   Each capture's supplied flags and budgets can differ; classification stores
+ *   no memo and grants no authority to reuse a prior capture's native proof.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources
+ *   Results borrow the supplied failure aggregate or transfer a fresh empty one.
+ *   No handle, task or historical state is retained; the caller owns attempts,
+ *   terminal baselines and rejected-capture disposal.
+ */
+export function selectTransformAttemptDisposition(props: {
+  /** Compiler envelope discriminator of this completed capture. */
+  resultType: "success" | "failure" | "exception";
+
+  /** Explicit config coherence; undefined retains the existing admission rule. */
+  configStateComplete?: boolean;
+
+  /** Reusable project success proof, required explicitly for success acceptance. */
+  projectSnapshotComplete?: boolean;
+
+  /** Capture-window stability; diagnostic acceptance rejects explicit false. */
+  projectHeldStill?: boolean;
+
+  /** Failure-envelope host observation completeness. */
+  observationsComplete?: boolean;
+
+  /** Number of producer-reported host proof failure entries. */
+  hostInputProofFailureCount: number;
+
+  /**
+   * Optional recorded proof aggregate; absent rejection starts with empty
+   * evidence.
+   */
+  failures?: TtscGenerationProofFailures;
+
+  /** Publication origin and refutation, absent for a locally compiled attempt. */
+  adopted?: TtscAdoptionVerdict;
+
+  /** Zero-based index of this capture within the current retry loop. */
+  attempt: number;
+
+  /** Movement failures counted before this capture. */
+  moved: number;
+
+  /** Exact publication payload the caller's next capture must refuse, if any. */
+  rejected?: string;
+}):
+  | {
+      kind: "accepted";
+      freshDeliveryOnly: boolean;
+    }
+  | {
+      kind: "fresh-only";
+      freshDeliveryOnly: boolean;
+    }
+  | {
+      kind: "retry" | "diagnostic" | "terminal";
+      freshDeliveryOnly: boolean;
+      failures: TtscGenerationProofFailures;
+      moved: number;
+      rejected: string | undefined;
+    } {
+  const freshDeliveryOnly =
+    props.resultType === "failure" &&
+    (props.observationsComplete === false ||
+      props.hostInputProofFailureCount !== 0);
+  if (
+    props.configStateComplete !== false &&
+    (props.resultType === "success"
+      ? props.projectSnapshotComplete === true
+      : props.projectHeldStill !== false)
+  ) {
+    return { kind: "accepted", freshDeliveryOnly };
+  }
+  const failures = props.failures ?? createGenerationProofFailures();
+  if (
+    props.resultType === "success" &&
+    props.configStateComplete === true &&
+    props.projectHeldStill === true &&
+    props.adopted === undefined &&
+    failures.omitted === 0 &&
+    failures.entries.length !== 0 &&
+    failures.entries.every(
+      (failure) =>
+        failure.domain === "host" && failure.kind === "observation-unavailable",
+    )
+  ) {
+    return { kind: "fresh-only", freshDeliveryOnly: true };
+  }
+  let moved = props.moved;
+  let rejected = props.rejected;
+  if (props.adopted?.refuted === true) rejected = props.adopted.publication;
+  else if (!onlyLearnedCompileFacts(failures)) moved += 1;
+  const last =
+    moved === TRANSFORM_MOVEMENT_ATTEMPTS ||
+    props.attempt + 1 === TRANSFORM_MOVEMENT_ATTEMPTS * 2;
+  return {
+    kind: !last
+      ? "retry"
+      : props.resultType !== "success" && props.configStateComplete !== false
+        ? "diagnostic"
+        : "terminal",
+    freshDeliveryOnly,
+    failures,
+    moved,
+    rejected,
+  };
+}
+
+/** One movement retry; learned/refuted attempts still have twice this cap. */
+const TRANSFORM_MOVEMENT_ATTEMPTS = 2;

package/src/core/transform/generation/trackerChangedDeclaredProjectInput.ts

@@ -0,0 +1,42 @@
+import path from "node:path";
+
+import { pathIsWithin } from "../filesystem/pathIsWithin";
+import type { TtscProjectMutationTracker } from "../tracker/TtscProjectMutationTracker";
+
+/**
+ * Whether compile-time events overlap a declared input, including an ancestor
+ * replacement. Unknown declared scope and dropped events conservatively count
+ * as change; no tracker means this helper has no positive event witness.
+ *
+ * @evidence contracts/common.md#principled-implementation Reported changes use the tracker's actual overlap capability when available, otherwise bidirectional containment catches input or ancestor replacement; omitted events cannot establish silence.
+ * @evidence contracts/common.md#clear-and-simple-design This predicate owns declared-scope event selection while backend event collection and path identity remain with the tracker and filesystem helpers.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Missing event identities remain conservative, and no source extension or bundler-specific path whitelist suppresses a declared-input event.
+ * @evidence contracts/common.md#meaningful-documentation Native prose explains ancestor overlap, undefined declared scope, omitted events and absent tracker meaning with separated acknowledgments.
+ * @evidence contracts/portability.md#os-neutral-implementation Declared keys are anchored through Node native paths; the tracker can supply filesystem-aware overlap, with native containment as fallback rather than a universal lowercase rule.
+ * @evidence contracts/performance.md#efficient-algorithms Empty events, omitted evidence and unknown scope return before path-list construction. Otherwise D declared spellings are copied/resolved, then up to C times D overlap comparisons short-circuit on success. Native path text and supplied tracker identity/case/realpath work contribute to each reached comparison; temporary path storage scales with D and its spelling bytes, not bounded event count alone.
+ * @evidenceExclude contracts/performance.md#reuse-equivalent-work This event predicate coordinates no cache or completed computation; the enclosing capture owns shared tracker observations.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources Tracker acquisition and closure belong to capture; this predicate retains no event history beyond its temporary declared-path array.
+ */
+export function trackerChangedDeclaredProjectInput(
+  tracker: TtscProjectMutationTracker | undefined,
+  declared: ReadonlySet<string> | undefined,
+  projectRoot: string,
+): boolean {
+  if (tracker === undefined) return false;
+  if (tracker.changesOmitted) return true;
+  if (tracker.changes.size === 0) return false;
+  if (declared === undefined) return true;
+  const inputs = [...declared].map((input) => path.resolve(projectRoot, input));
+  for (const changed of tracker.changes) {
+    if (
+      inputs.some(
+        (input) =>
+          tracker.overlaps?.(input, changed) ??
+          (pathIsWithin(input, changed) || pathIsWithin(changed, input)),
+      )
+    ) {
+      return true;
+    }
+  }
+  return false;
+}

package/src/core/transform/generation/transferCaptureClockReference.ts

@@ -0,0 +1,34 @@
+import type { TtscCachedProjectTransform } from "../cache/TtscCachedProjectTransform";
+import { TRANSFORM_CLOCK_REFERENCE_DIRECTORIES } from "../clock/TRANSFORM_CLOCK_REFERENCE_DIRECTORIES";
+
+/**
+ * Publish the successfully cleaned capture's owned clock storage to its owner.
+ *
+ * Capture calls this only after local cleanup succeeds and a generation exists.
+ * An unavailable directory registers nothing. The association lets validation
+ * refresh the same owned probe and lets generation disposal detach and remove
+ * it; registration itself proves neither a clock stamp nor native acquisition.
+ *
+ * The caller transfers a fresh generation and its owned reference directory.
+ * This operation does not replace or dispose an earlier generation's storage.
+ *
+ * @evidence contracts/common.md#principled-implementation Associates available caller-owned reference storage with the exact returned generation, after capture's cleanup gate. Missing storage remains unavailable rather than receiving a fabricated path or timestamp.
+ * @evidence contracts/common.md#clear-and-simple-design One ownership publication connects capture to existing validation and disposal consumers; minting, proof qualification and storage removal remain their separate responsibilities.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Performs the actual generation association used by production, without a test-only channel, injected compiler result or synthetic native release/acquisition receipt.
+ * @evidence contracts/common.md#meaningful-documentation Native prose states the successful-cleanup precondition, fresh ownership assumption, missing-directory behavior and limits of registration authority.
+ * @evidenceExclude contracts/portability.md#os-neutral-implementation Publishes an opaque directory coordinate supplied by its native storage owner; no path grammar, case rule, filesystem operation or OS capability is interpreted here.
+ * @evidenceExclude contracts/performance.md#efficient-algorithms One optional WeakMap assignment adds no scan, traversal or input processing strategy.
+ * @evidence contracts/performance.md#reuse-equivalent-work Existing validation consumers find this generation's same owned storage instead of inventing another probe location. They still mint and qualify fresh observations; sharing the directory grants no authority to reuse an old timestamp.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources The weak generation association holds one directory spelling per transferred owner without extending that owner's reachability. disposeCachedTransform detaches the association and attempts native removal; garbage collection alone does not remove storage, and this publication neither acquires a handle nor certifies later release.
+ */
+export function transferCaptureClockReference(
+  /** Fresh returned generation whose local cleanup has completed successfully. */
+  captured: TtscCachedProjectTransform,
+
+  /** Owned reference storage, or unavailable storage leaving no association. */
+  referenceDirectory: string | undefined,
+): void {
+  if (referenceDirectory !== undefined) {
+    TRANSFORM_CLOCK_REFERENCE_DIRECTORIES.set(captured, referenceDirectory);
+  }
+}

package/src/core/transform/generation/transformProject.ts

@@ -0,0 +1,250 @@
+import path from "node:path";
+
+import type { ResolvedTtscUnpluginOptions } from "../../options/ResolvedTtscUnpluginOptions";
+import { traceInvocation } from "../../tracing/traceInvocation";
+import type { TtscCachedProjectTransform } from "../cache/TtscCachedProjectTransform";
+import { disposeCachedTransform } from "../cache/disposeCachedTransform";
+import type { TtscTransformFilesystemOperations } from "../filesystem/TtscTransformFilesystemOperations";
+import { TRANSFORM_ADOPTED_RESULTS } from "../session/TRANSFORM_ADOPTED_RESULTS";
+import { TRANSFORM_FAILED_GENERATION_VALIDATIONS } from "./TRANSFORM_FAILED_GENERATION_VALIDATIONS";
+import { TRANSFORM_GENERATION_FAILURES } from "./TRANSFORM_GENERATION_FAILURES";
+import type { TtscGenerationProofFailures } from "./TtscGenerationProofFailures";
+import { captureTransformGeneration } from "./captureTransformGeneration";
+import { carryTransformAttemptInputs } from "./carryTransformAttemptInputs";
+import { createUnstableGenerationError } from "./createUnstableGenerationError";
+import { selectTransformAttemptDisposition } from "./selectTransformAttemptDisposition";
+
+/**
+ * Compile one whole project generation, retrying within a bound while its proof
+ * is lost to a filesystem race.
+ *
+ * A capture whose snapshot could not be proven stable is disposed and attempted
+ * again. At the movement or absolute attempt cap, a coherent diagnostic verdict
+ * is returned; otherwise a terminal `TtscUnstableGenerationError` carries the
+ * failed environment, so later deliveries replay the verdict until that
+ * environment provably changes instead of each repeating a whole-project
+ * compile.
+ *
+ * The bound is for a project that keeps moving, so it counts the failures that
+ * say the project moved: every compile here that fails its proof, and every
+ * adoption whose own window moved. An attempt that adopted another worker's
+ * compile and could not prove it failed for one of two reasons
+ * (`TtscAdoptionVerdict`, samchon/ttsc#1479). When the publication itself
+ * failed its proof on this disk, the attempt says nothing about the project
+ * moving: the attempt after it refuses that publication and compiles the same
+ * state here, or claims the state the project moved to, and it does not spend
+ * the bound, which a pool would otherwise exhaust on publications while its
+ * project moved once, and end the delivery in an unstable verdict that
+ * compiling the state resolves. When the publication held and only this
+ * worker's window moved around it, the attempt is a moved window like any
+ * compile's here, and spends the bound; its retry claims whatever state it then
+ * reads, and adopts the same publication again when the project's content never
+ * changed. Refusing it, as every failed adoption once was, compiled on a
+ * Turbopack pool a state the pool had already compiled and proven, for an event
+ * that changed nothing. The attempts are capped at twice the bound all the
+ * same, so a project that keeps moving from one published state to the next
+ * ends too.
+ *
+ * A failed compile (a `failure` or `exception` envelope) needs no proven
+ * snapshot, since its verdict is its diagnostics, but it does need the project
+ * to have held still across it. One that read a source repaired while it ran
+ * reports a state already gone, and a host that takes its dependencies when the
+ * transform returns, as Turbopack does, records the repair as the baseline and
+ * never re-runs the module. It is compiled again, and when the project moves
+ * under the retry too, the retry's own failure is returned.
+ *
+ * A plugin-reported dependency path is certified only against a witness read
+ * before the compile (samchon/ttsc#1541), and a compile learns such paths only
+ * from its own envelope. An attempt whose one failure is a dependency path it
+ * reported for the first time is retried with that path witnessed. It says
+ * nothing about the project moving, so it does not spend the bound, and the cap
+ * of twice the bound still ends a project whose dependencies never settle. The
+ * compiler's case policy is learned the same way: a walk primed with another
+ * policy is taken again under the one the compile reported
+ * (samchon/ttsc#1545).
+ *
+ * A local success whose only lost premise is explicitly unavailable host
+ * observation may qualify for its initiating delivery. The delivery coordinator
+ * additionally requires an explicitly nonwatching host with cache-withdrawal
+ * capability. It remains incomplete and cannot authorize resident, shared or
+ * persistent caching. Actual changes, conflicts and unexplained missing proof
+ * retain the stabilization gate.
+ *
+ * Enabled private tracing records each computed disposition before its state is
+ * applied. It does not supply proof when capture throws or tracing fails.
+ *
+ * @evidence contracts/common.md#principled-implementation Each capture establishes config coherence and reusable success proof or a current diagnostic verdict; a local stable success with only explicit unavailable host observations instead transfers one fresh delivery without reuse authority, while mixed mutation, missing or conflicting proof retains retry admission.
+ * @evidence contracts/common.md#clear-and-simple-design The pure attempt policy selects acceptance and retry budgets; this loop owns mutable learned facts and resource handoff, capture owns proof construction, and the shared error builder owns terminal rendering and final disposal.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Retrying follows learned dependencies/case policy or refuted publication payload rather than an endless workaround chain; only lossless producer-authorized observation unavailability can permit a local fresh answer, and it never becomes a reusable success or excuses actual mutation.
+ * @evidence contracts/common.md#meaningful-documentation Native paragraphs explain movement versus absolute budgets, failed-compile diagnostics and learned facts; separated props state delivery, tracking and inherited witness meaning.
+ * @evidence contracts/portability.md#os-neutral-implementation Each capture delegates native filesystem and compiler behavior to injected host boundaries; reported compiler case policy is carried between attempts rather than guessed from OS names.
+ * @evidence contracts/performance.md#efficient-algorithms At most four captures bound retry count, not each capture's project/config/input bytes, native walks, compiler/plugin work, observer setup or session waiting time. Each rejected attempt copies the cumulative witnessed Set and scans its external dependencies into that copy; the next capture receives a separate array of its names; supplied spellings contribute hashing/text cost. Terminal rendering visits retained attempts/witnesses, and disposal delegates observer/probe cleanup rather than making those effects constant work. Enabled tracing serializes disposition scalars and path text through the existing bounded append sink; disabled tracing skips that payload construction.
+ * @evidence contracts/performance.md#reuse-equivalent-work Learned dependency names and reported compiler case policy carry into the next capture, which takes new observations; previous witness bytes are not reused as fresh proof. The exact refuted publication payload is excluded on the next lookup; another payload under that same projected state still requires separate proof. This loop shares no cache entry itself; its caller owns generation/terminal Promise sharing and current-environment replay admission.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources Each nonterminal rejected capture is detached through the shared disposer before retry; terminal error construction does the same for the final failed capture, while diagnostic/success/fresh-only return transfers the generation to its caller. Cleanup failures do not certify native release. Up to four attempt aggregates remain, but their path/detail bytes and cumulative witnessed dependency names have no byte cap; the terminal error retains comparison data under cache-owner lifetime. Capture owns its own acquisition-failure cleanup and escaped errors.
+ */
+export async function transformProject(props: {
+  /** Adapter aliases re-stated over inherited project paths for compilation. */
+  aliasPaths: Record<string, string[]>;
+
+  /** Compiler-option overlay, preserving the underlying config semantics. */
+  compilerOptions: Record<string, unknown>;
+
+  /** Native path of the module whose delivery initiated this capture. */
+  currentFile: string;
+
+  /** Delivered module text compared against the compiler's disk observation. */
+  currentSource: string;
+
+  /**
+   * Delivery pass this compile was started for; see
+   * {@link TtscCachedProjectTransform.deliveryEpoch}.
+   */
+  deliveryEpoch?: number;
+
+  /** Host filesystem boundary for project and external-input proof. */
+  filesystem: TtscTransformFilesystemOperations;
+
+  /** Native plugin descriptors supplied to the compiler. */
+  plugins?: ResolvedTtscUnpluginOptions["plugins"];
+
+  /**
+   * Explicit common source root; omitted direct callers use the config
+   * directory.
+   */
+  projectRoot?: string;
+
+  /** Whether live membership observers may transfer to a retained generation. */
+  retainProjectMembership: boolean;
+
+  /**
+   * Whether the generation may keep watchers whose silence stands in for
+   * re-reading its inputs. False once the host or the environment declares
+   * polling (samchon/ttsc#1395); the generation then validates every delivery
+   * against its recorded state.
+   */
+  retainNotifications: boolean;
+
+  /**
+   * The pooled host session's shared compile store, when the cache shares its
+   * compiles (samchon/ttsc#1390).
+   */
+  session?: string;
+
+  /** Whether a pre-compile membership tracker should witness the capture window. */
+  trackProjectMembership: boolean;
+
+  /** Native project config selected for the whole-project transform. */
+  tsconfig: string;
+
+  /**
+   * Dependency-only paths the last generation of this cache key reported
+   * (`TRANSFORM_CACHE_DEPENDENCY_WITNESSES`), to be witnessed before the
+   * compile; see {@link TtscCachedProjectTransform.externalDependencyInputs}.
+   */
+  witnessedDependencies?: readonly string[];
+
+  /**
+   * The case policy the last generation of this cache key reported
+   * (`TRANSFORM_CACHE_CASE_POLICIES`, samchon/ttsc#1545).
+   */
+  useCaseSensitiveFileNames?: boolean;
+}): Promise<TtscCachedProjectTransform> {
+  const attemptTrace = traceInvocation();
+  const attempts: TtscGenerationProofFailures[] = [];
+  let rejected: string | undefined;
+  let moved = 0;
+  let witnessed = new Set(props.witnessedDependencies);
+  let useCaseSensitiveFileNames = props.useCaseSensitiveFileNames;
+  for (let attempt = 0; ; attempt += 1) {
+    const cached = await captureTransformGeneration({
+      ...props,
+      rejected,
+      useCaseSensitiveFileNames,
+      witnessedDependencies: [...witnessed],
+    });
+    const disposition = selectTransformAttemptDisposition({
+      resultType: cached.result.type,
+      configStateComplete: cached.configStateComplete,
+      projectSnapshotComplete: cached.projectSnapshotComplete,
+      projectHeldStill: cached.projectHeldStill,
+      observationsComplete:
+        cached.result.type === "failure"
+          ? cached.result.observationsComplete
+          : undefined,
+      hostInputProofFailureCount:
+        cached.result.type === "failure"
+          ? Object.keys(cached.result.hostInputProofFailures ?? {}).length
+          : 0,
+      failures: TRANSFORM_GENERATION_FAILURES.get(cached.result),
+      adopted: TRANSFORM_ADOPTED_RESULTS.get(cached.result),
+      attempt,
+      moved,
+      rejected,
+    });
+    attemptTrace?.("bridge-attempt-disposition", {
+      pid: process.pid,
+      cwd: cached.projectRoot,
+      data: {
+        tsconfig: props.tsconfig,
+        currentFile: props.currentFile,
+        temporaryTsconfig: cached.temporaryTsconfig,
+        scratchDirectory: cached.scratchDirectory,
+        attempt,
+        movedBefore: moved,
+        rejectedBefore: rejected ?? null,
+        kind: disposition.kind,
+        freshDeliveryOnly: disposition.freshDeliveryOnly,
+        movedAfter: "moved" in disposition ? disposition.moved : null,
+        rejectedAfter:
+          "rejected" in disposition ? (disposition.rejected ?? null) : null,
+      },
+    });
+    if (disposition.freshDeliveryOnly) {
+      // Neither incomplete diagnostic observations nor a permitted local fresh
+      // success authorizes this generation's reuse beyond its current delivery.
+      cached.freshDeliveryOnly = true;
+    }
+    if (disposition.kind === "accepted" || disposition.kind === "fresh-only") {
+      return cached;
+    }
+    attempts.push(disposition.failures);
+    const nextInputs = carryTransformAttemptInputs(
+      witnessed,
+      useCaseSensitiveFileNames,
+      cached,
+    );
+    witnessed = nextInputs.witnessed;
+    useCaseSensitiveFileNames = nextInputs.useCaseSensitiveFileNames;
+    // A publication refuted here would be found again by a retry for the same
+    // state, which therefore compiles and replaces it. A retry whose project
+    // moved to another state claims that state's publication, and adopts it:
+    // refusing it too, measured on a Turbopack pool, compiled a state another
+    // worker had just published, while the next edit was already landing. An
+    // adoption whose own window moved refutes nothing, and is counted as the
+    // compile it stood in for.
+    rejected = disposition.rejected;
+    moved = disposition.moved;
+    // A failed compile the project moved under twice still names its own
+    // diagnostics, which say more than an unstable-generation error.
+    if (disposition.kind === "diagnostic") {
+      return cached;
+    }
+    if (disposition.kind === "terminal") {
+      const validation = TRANSFORM_FAILED_GENERATION_VALIDATIONS.get(
+        cached.result,
+      );
+      if (validation === undefined) {
+        disposeCachedTransform(cached);
+        throw new Error(
+          "ttsc: failed transform generation has no retry validation baseline",
+        );
+      }
+      throw createUnstableGenerationError(
+        props.projectRoot ?? path.dirname(props.tsconfig),
+        attempts,
+        validation,
+      );
+    }
+    disposeCachedTransform(cached);
+  }
+}

package/src/core/transform/inputs/TtscInputMetadataEvidence.ts

@@ -0,0 +1,39 @@
+/**
+ * One metadata observation: its signature and whether the observed filesystem
+ * has provably moved past the link and target modification-stamp ticks.
+ *
+ * Notification authority and stamp separability answer independent reuse
+ * premises; a signature alone does not imply either. The record carries no
+ * watcher or clock-reference ownership.
+ *
+ * @evidence contracts/common.md#principled-implementation Separate signature, notification and clock facts preserve the distinctions needed to judge metadata-only or watcher-assisted validation.
+ * @evidence contracts/common.md#clear-and-simple-design Three primitive fields expose one observation without embedding the observer, cached digest or mutation-tracker lifecycle.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts The representation does not collapse a matching metadata string or silent watcher into unconditional content validity.
+ * @evidence contracts/common.md#meaningful-documentation Native prose and spaced member documentation distinguish the three premises and resource boundary, with a blank acknowledgment separator under documentation guidance.
+ * @evidence contracts/portability.md#os-neutral-implementation OS-neutral observation facts are produced from native device stamps and topology; the type does not encode one OS as a case-policy, clock or watcher capability guarantee.
+ * @evidenceExclude contracts/performance.md#efficient-algorithms
+ *   TtscInputMetadataEvidence only declares a shape; it has no computation at
+ *   runtime.
+ * @evidenceExclude contracts/performance.md#reuse-equivalent-work
+ *   TtscInputMetadataEvidence only declares a shape; it has no work to reuse
+ *   at runtime.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources
+ *   TtscInputMetadataEvidence only declares a shape; it has no handle or
+ *   retained state at runtime.
+ */
+export interface TtscInputMetadataEvidence {
+  /** The joined metadata signature of the lexical path and its link target. */
+  signature: string;
+
+  /** Whether topology permits authority from a covering directory observer. */
+  notificationAuthoritative: boolean;
+
+  /**
+   * Whether current device references separate the recorded modification ticks.
+   * Without separation, a same-length rewrite inside a stamp's own tick can
+   * leave the signature unchanged. Consumers must refresh references before
+   * proving later reuse, because clock rollback can invalidate earlier
+   * evidence.
+   */
+  separable: boolean;
+}

package/src/core/transform/inputs/compilerAccessibleEntries.ts

@@ -0,0 +1,74 @@
+import type fs from "node:fs";
+import path from "node:path";
+import type { ITtscCompilerTransformation } from "ttsc";
+
+import type { TtscTransformFilesystemOperations } from "../filesystem/TtscTransformFilesystemOperations";
+
+/**
+ * Replay the compiler's accessible child-name observation. Regular files and
+ * directories are recorded separately; links are classified by their targets.
+ * Failed reads and inaccessible links contribute no entries, as in the compiler
+ * filesystem.
+ *
+ * Names use UTF-8 byte ordering, matching Go's directory enumeration rather
+ * than JavaScript's UTF-16 ordering for supplementary Unicode characters. The
+ * supplied filesystem selects the path grammar used for linked children.
+ *
+ * @evidence contracts/common.md#principled-implementation Native entry kinds and followed link targets produce the compiler's separate directory and regular-file lists, with Go-compatible UTF-8 ordering and failed-read semantics.
+ * @evidence contracts/common.md#clear-and-simple-design One shared observer serves graph predicate replay and frozen watch baseline capture, so both obtain the same membership representation.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Inaccessible links and unsupported entry kinds remain omitted according to the compiler operation rather than inferred from names or replaced by fabricated membership.
+ * @evidence contracts/common.md#meaningful-documentation Native paragraphs specify link following, failure semantics, ordering and supplied path grammar, with prose separated from acknowledgment tags as the documentation guidance requires.
+ * @evidence contracts/portability.md#os-neutral-implementation Native kinds come from the supplied readdir and following stat operations; the supplied platform chooses win32 or posix child joining without guessing filesystem case policy from the OS.
+ * @evidence contracts/performance.md#efficient-algorithms One enumeration examines E entries and follows only links through native child resolution. Each selected name is UTF-8 encoded once; encoding and retained buffers scale with total name bytes, while two sorts perform O(E log E) comparisons whose cost follows the compared byte prefixes. Temporary arrays grow with selected names and no source content is read.
+ * @evidenceExclude contracts/performance.md#reuse-equivalent-work This observes current directory membership once; graph and baseline owners establish whether their captured result can be shared across requests.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources Entry lists and sort buffers are observation-local and the synchronous operations retain no descriptor, watcher or task.
+ */
+export function compilerAccessibleEntries(
+  directory: string,
+  filesystem: TtscTransformFilesystemOperations,
+): NonNullable<
+  ITtscCompilerTransformation.IInputObservation["accessibleEntries"]
+> {
+  const directories: string[] = [];
+  const files: string[] = [];
+  const pathApi =
+    (filesystem.platform ?? process.platform) === "win32"
+      ? path.win32
+      : path.posix;
+  let entries: fs.Dirent[];
+  try {
+    entries = filesystem.readdir(directory);
+  } catch {
+    return { directories, files };
+  }
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      directories.push(entry.name);
+      continue;
+    }
+    if (entry.isFile()) {
+      files.push(entry.name);
+      continue;
+    }
+    if (!entry.isSymbolicLink()) continue;
+    try {
+      const target = filesystem.stat(pathApi.join(directory, entry.name));
+      if (target.isDirectory()) directories.push(entry.name);
+      else if (target.isFile()) files.push(entry.name);
+    } catch {
+      // TypeScript-Go omits inaccessible and broken linked entries.
+    }
+  }
+  return {
+    directories: sortCompilerNames(directories),
+    files: sortCompilerNames(files),
+  };
+}
+
+/** Encode each name once for the compiler's bytewise lexical ordering. */
+function sortCompilerNames(names: string[]): string[] {
+  return names
+    .map((name) => ({ name, encoded: Buffer.from(name, "utf8") }))
+    .sort((left, right) => Buffer.compare(left.encoded, right.encoded))
+    .map(({ name }) => name);
+}