@ttsc/unplugin 0.30.3 → 0.31.0

package/lib/core/transform/clock/TRANSFORM_CLOCK_REFERENCE_DIRECTORIES.js

@@ -0,0 +1,7 @@
+'use strict';
+
+/** Internal retained clock-probe ownership for published generations. */
+const TRANSFORM_CLOCK_REFERENCE_DIRECTORIES = new WeakMap();
+
+exports.TRANSFORM_CLOCK_REFERENCE_DIRECTORIES = TRANSFORM_CLOCK_REFERENCE_DIRECTORIES;
+//# sourceMappingURL=TRANSFORM_CLOCK_REFERENCE_DIRECTORIES.js.map

package/lib/core/transform/clock/TRANSFORM_CLOCK_REFERENCE_DIRECTORIES.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TRANSFORM_CLOCK_REFERENCE_DIRECTORIES.js","sources":["../../../../src/core/transform/clock/TRANSFORM_CLOCK_REFERENCE_DIRECTORIES.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAEA;AACO,MAAM,qCAAqC,GAAG,IAAI,OAAO;;;;"}

package/lib/core/transform/clock/TRANSFORM_CLOCK_REFERENCE_DIRECTORIES.mjs

@@ -0,0 +1,5 @@
+/** Internal retained clock-probe ownership for published generations. */
+const TRANSFORM_CLOCK_REFERENCE_DIRECTORIES = new WeakMap();
+
+export { TRANSFORM_CLOCK_REFERENCE_DIRECTORIES };
+//# sourceMappingURL=TRANSFORM_CLOCK_REFERENCE_DIRECTORIES.mjs.map

package/lib/core/transform/clock/TRANSFORM_CLOCK_REFERENCE_DIRECTORIES.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TRANSFORM_CLOCK_REFERENCE_DIRECTORIES.mjs","sources":["../../../../src/core/transform/clock/TRANSFORM_CLOCK_REFERENCE_DIRECTORIES.ts"],"sourcesContent":[null],"names":[],"mappings":"AAEA;AACO,MAAM,qCAAqC,GAAG,IAAI,OAAO;;;;"}

package/lib/core/transform/clock/disposeFilesystemClockReference.d.cts

@@ -0,0 +1,15 @@
+/**
+ * Attempt removal of the known probe and its now-empty owned directory.
+ *
+ * @evidence contracts/common.md#principled-implementation Cleanup attempts the known probe then nonrecursive directory removal, preserving any foreign or concurrently added entry.
+ * @evidence contracts/common.md#clear-and-simple-design Two independent removal attempts target owned file/directory storage without a recursive cleanup policy.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts A failure cannot justify deleting unknown contents or leaving a rejected cleanup promise behind.
+ * @evidence contracts/common.md#meaningful-documentation The comment identifies the ownership limit, and internal comments explain independent attempts and nonrecursive preservation.
+ * @evidence contracts/portability.md#os-neutral-implementation OS-neutral cleanup uses native path joining and filesystem removal, tolerating missing or busy resources without hardcoded temporary roots.
+ * @evidence contracts/performance.md#efficient-algorithms Cleanup performs two native removal attempts with path-text joining cost, rather than scanning or recursively deleting a tree; syscall duration remains native filesystem work.
+ * @evidence contracts/performance.md#reuse-equivalent-work This is the shared disposal operation for retained generation and process clock probes, avoiding separate cleanup policies.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources Both removal failures are consumed with no retained retry task. Only an empty directory may be removed; a busy probe, permissions or foreign contents can leave residual storage after ownership cleanup. Repeated attempts preserve the same nonrecursive boundary.
+ */
+export declare function disposeFilesystemClockReference(
+/** Owned reference storage; unknown children must survive cleanup failure. */
+referenceDirectory: string): void;

package/lib/core/transform/clock/disposeFilesystemClockReference.d.mts

@@ -0,0 +1,15 @@
+/**
+ * Attempt removal of the known probe and its now-empty owned directory.
+ *
+ * @evidence contracts/common.md#principled-implementation Cleanup attempts the known probe then nonrecursive directory removal, preserving any foreign or concurrently added entry.
+ * @evidence contracts/common.md#clear-and-simple-design Two independent removal attempts target owned file/directory storage without a recursive cleanup policy.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts A failure cannot justify deleting unknown contents or leaving a rejected cleanup promise behind.
+ * @evidence contracts/common.md#meaningful-documentation The comment identifies the ownership limit, and internal comments explain independent attempts and nonrecursive preservation.
+ * @evidence contracts/portability.md#os-neutral-implementation OS-neutral cleanup uses native path joining and filesystem removal, tolerating missing or busy resources without hardcoded temporary roots.
+ * @evidence contracts/performance.md#efficient-algorithms Cleanup performs two native removal attempts with path-text joining cost, rather than scanning or recursively deleting a tree; syscall duration remains native filesystem work.
+ * @evidence contracts/performance.md#reuse-equivalent-work This is the shared disposal operation for retained generation and process clock probes, avoiding separate cleanup policies.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources Both removal failures are consumed with no retained retry task. Only an empty directory may be removed; a busy probe, permissions or foreign contents can leave residual storage after ownership cleanup. Repeated attempts preserve the same nonrecursive boundary.
+ */
+export declare function disposeFilesystemClockReference(
+/** Owned reference storage; unknown children must survive cleanup failure. */
+referenceDirectory: string): void;

package/lib/core/transform/clock/disposeFilesystemClockReference.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Attempt removal of the known probe and its now-empty owned directory.
+ *
+ * @evidence contracts/common.md#principled-implementation Cleanup attempts the known probe then nonrecursive directory removal, preserving any foreign or concurrently added entry.
+ * @evidence contracts/common.md#clear-and-simple-design Two independent removal attempts target owned file/directory storage without a recursive cleanup policy.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts A failure cannot justify deleting unknown contents or leaving a rejected cleanup promise behind.
+ * @evidence contracts/common.md#meaningful-documentation The comment identifies the ownership limit, and internal comments explain independent attempts and nonrecursive preservation.
+ * @evidence contracts/portability.md#os-neutral-implementation OS-neutral cleanup uses native path joining and filesystem removal, tolerating missing or busy resources without hardcoded temporary roots.
+ * @evidence contracts/performance.md#efficient-algorithms Cleanup performs two native removal attempts with path-text joining cost, rather than scanning or recursively deleting a tree; syscall duration remains native filesystem work.
+ * @evidence contracts/performance.md#reuse-equivalent-work This is the shared disposal operation for retained generation and process clock probes, avoiding separate cleanup policies.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources Both removal failures are consumed with no retained retry task. Only an empty directory may be removed; a busy probe, permissions or foreign contents can leave residual storage after ownership cleanup. Repeated attempts preserve the same nonrecursive boundary.
+ */
+export declare function disposeFilesystemClockReference(
+/** Owned reference storage; unknown children must survive cleanup failure. */
+referenceDirectory: string): void;

package/lib/core/transform/clock/disposeFilesystemClockReference.js

@@ -0,0 +1,41 @@
+'use strict';
+
+var fs = require('node:fs');
+var path = require('node:path');
+
+/**
+ * Attempt removal of the known probe and its now-empty owned directory.
+ *
+ * @evidence contracts/common.md#principled-implementation Cleanup attempts the known probe then nonrecursive directory removal, preserving any foreign or concurrently added entry.
+ * @evidence contracts/common.md#clear-and-simple-design Two independent removal attempts target owned file/directory storage without a recursive cleanup policy.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts A failure cannot justify deleting unknown contents or leaving a rejected cleanup promise behind.
+ * @evidence contracts/common.md#meaningful-documentation The comment identifies the ownership limit, and internal comments explain independent attempts and nonrecursive preservation.
+ * @evidence contracts/portability.md#os-neutral-implementation OS-neutral cleanup uses native path joining and filesystem removal, tolerating missing or busy resources without hardcoded temporary roots.
+ * @evidence contracts/performance.md#efficient-algorithms Cleanup performs two native removal attempts with path-text joining cost, rather than scanning or recursively deleting a tree; syscall duration remains native filesystem work.
+ * @evidence contracts/performance.md#reuse-equivalent-work This is the shared disposal operation for retained generation and process clock probes, avoiding separate cleanup policies.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources Both removal failures are consumed with no retained retry task. Only an empty directory may be removed; a busy probe, permissions or foreign contents can leave residual storage after ownership cleanup. Repeated attempts preserve the same nonrecursive boundary.
+ */
+function disposeFilesystemClockReference(
+/** Owned reference storage; unknown children must survive cleanup failure. */
+referenceDirectory) {
+    try {
+        fs.rmSync(path.join(referenceDirectory, "clock-reference"), {
+            force: true,
+        });
+    }
+    catch {
+        // The probe may already have disappeared; the directory removal below is
+        // still safe because it is deliberately non-recursive.
+    }
+    try {
+        fs.rmdirSync(referenceDirectory);
+    }
+    catch {
+        // Eviction schedules cleanup without awaiting its Promise. A foreign entry
+        // or native removal failure can leave residual storage; never remove unknown
+        // contents to make a cleanup attempt appear successful.
+    }
+}
+
+exports.disposeFilesystemClockReference = disposeFilesystemClockReference;
+//# sourceMappingURL=disposeFilesystemClockReference.js.map

package/lib/core/transform/clock/disposeFilesystemClockReference.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"disposeFilesystemClockReference.js","sources":["../../../../src/core/transform/clock/disposeFilesystemClockReference.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;;AAGA;;;;;;;;;;;AAWG;SACa,+BAA+B;AAC7C;AACA,kBAA0B,EAAA;AAE1B,IAAA,IAAI;QACF,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,EAAE;AAC1D,YAAA,KAAK,EAAE,IAAI;AACZ,SAAA,CAAC;IACJ;AAAE,IAAA,MAAM;;;IAGR;AACA,IAAA,IAAI;AACF,QAAA,EAAE,CAAC,SAAS,CAAC,kBAAkB,CAAC;IAClC;AAAE,IAAA,MAAM;;;;IAIR;AACF;;;;"}

package/lib/core/transform/clock/disposeFilesystemClockReference.mjs

@@ -0,0 +1,39 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+/**
+ * Attempt removal of the known probe and its now-empty owned directory.
+ *
+ * @evidence contracts/common.md#principled-implementation Cleanup attempts the known probe then nonrecursive directory removal, preserving any foreign or concurrently added entry.
+ * @evidence contracts/common.md#clear-and-simple-design Two independent removal attempts target owned file/directory storage without a recursive cleanup policy.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts A failure cannot justify deleting unknown contents or leaving a rejected cleanup promise behind.
+ * @evidence contracts/common.md#meaningful-documentation The comment identifies the ownership limit, and internal comments explain independent attempts and nonrecursive preservation.
+ * @evidence contracts/portability.md#os-neutral-implementation OS-neutral cleanup uses native path joining and filesystem removal, tolerating missing or busy resources without hardcoded temporary roots.
+ * @evidence contracts/performance.md#efficient-algorithms Cleanup performs two native removal attempts with path-text joining cost, rather than scanning or recursively deleting a tree; syscall duration remains native filesystem work.
+ * @evidence contracts/performance.md#reuse-equivalent-work This is the shared disposal operation for retained generation and process clock probes, avoiding separate cleanup policies.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources Both removal failures are consumed with no retained retry task. Only an empty directory may be removed; a busy probe, permissions or foreign contents can leave residual storage after ownership cleanup. Repeated attempts preserve the same nonrecursive boundary.
+ */
+function disposeFilesystemClockReference(
+/** Owned reference storage; unknown children must survive cleanup failure. */
+referenceDirectory) {
+    try {
+        fs.rmSync(path.join(referenceDirectory, "clock-reference"), {
+            force: true,
+        });
+    }
+    catch {
+        // The probe may already have disappeared; the directory removal below is
+        // still safe because it is deliberately non-recursive.
+    }
+    try {
+        fs.rmdirSync(referenceDirectory);
+    }
+    catch {
+        // Eviction schedules cleanup without awaiting its Promise. A foreign entry
+        // or native removal failure can leave residual storage; never remove unknown
+        // contents to make a cleanup attempt appear successful.
+    }
+}
+
+export { disposeFilesystemClockReference };
+//# sourceMappingURL=disposeFilesystemClockReference.mjs.map

package/lib/core/transform/clock/disposeFilesystemClockReference.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"disposeFilesystemClockReference.mjs","sources":["../../../../src/core/transform/clock/disposeFilesystemClockReference.ts"],"sourcesContent":[null],"names":[],"mappings":";;;AAGA;;;;;;;;;;;AAWG;SACa,+BAA+B;AAC7C;AACA,kBAA0B,EAAA;AAE1B,IAAA,IAAI;QACF,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,EAAE;AAC1D,YAAA,KAAK,EAAE,IAAI;AACZ,SAAA,CAAC;IACJ;AAAE,IAAA,MAAM;;;IAGR;AACA,IAAA,IAAI;AACF,QAAA,EAAE,CAAC,SAAS,CAAC,kBAAkB,CAAC;IAClC;AAAE,IAAA,MAAM;;;;IAIR;AACF;;;;"}

package/lib/core/transform/clock/filesystemClockReferences.d.cts

@@ -0,0 +1,35 @@
+import type { TtscTransformFilesystemOperations } from "../filesystem/TtscTransformFilesystemOperations.cjs";
+/**
+ * Return one observed filesystem's current clock references, creating the empty
+ * map on first use.
+ *
+ * Each entry maps a reporting device to the modification stamp the adapter's
+ * probe last minted there. `refreshFilesystemClockReference` replaces the map's
+ * contents before a validation, and `stampSeparable` reads it: an input whose
+ * stamp is strictly older than its device's reference can be trusted by
+ * signature. A device with no entry proves nothing, so its inputs keep being
+ * compared by content. The map is held per operations object; a distinct view
+ * object gets an independent table. The view owner must keep observations
+ * coherent when its backing state or methods change: object identity alone does
+ * not establish equivalent filesystem evidence.
+ *
+ * @evidence contracts/common.md#principled-implementation Device-keyed references are partitioned by observing operation object; refresh and metadata owners must maintain that view's coherence before its table can qualify a signature. Table identity alone proves no observation equivalence.
+ * @evidence contracts/common.md#clear-and-simple-design One WeakMap owns reference tables by operation identity; refresh and separability consumers retain their own write and comparison responsibilities.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts The table contains minted filesystem stamps, never a passive historical maximum or guessed process time that would hide same-tick writes.
+ * @evidence contracts/common.md#meaningful-documentation The native paragraphs explain racy-clean metadata, fresh writes, device identity, cross-volume behavior, and proof interleaving before describing the lookup.
+ * @evidence contracts/performance.md#efficient-algorithms Operation-table and device maps provide constant-time reference selection rather than rescanning inputs to infer a clock.
+ * @evidence contracts/performance.md#reuse-equivalent-work All proofs using the same operations object share its current device reference; replacement of that object creates independent evidence.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources
+ *   Weak association does not retain the operations object. Current writers
+ *   clear old entries and record at most one minted device stamp per refresh;
+ *   the returned Map can also be retained by its borrower. No native handle,
+ *   clock history or running task is acquired by table selection.
+ * @evidence contracts/portability.md#os-neutral-implementation
+ *   The table carries the observing view's bigint device/time representation;
+ *   actual probe reads and stamp comparison remain with their native owners.
+ *   A different view receives independent storage, without assuming equal OS
+ *   names or device labels establish cross-view clock equivalence.
+ */
+export declare function filesystemClockReferences(
+/** Coherent observing view partitioning native device/time authority. */
+filesystem: TtscTransformFilesystemOperations): Map<bigint, bigint>;

package/lib/core/transform/clock/filesystemClockReferences.d.mts

@@ -0,0 +1,35 @@
+import type { TtscTransformFilesystemOperations } from "../filesystem/TtscTransformFilesystemOperations.mjs";
+/**
+ * Return one observed filesystem's current clock references, creating the empty
+ * map on first use.
+ *
+ * Each entry maps a reporting device to the modification stamp the adapter's
+ * probe last minted there. `refreshFilesystemClockReference` replaces the map's
+ * contents before a validation, and `stampSeparable` reads it: an input whose
+ * stamp is strictly older than its device's reference can be trusted by
+ * signature. A device with no entry proves nothing, so its inputs keep being
+ * compared by content. The map is held per operations object; a distinct view
+ * object gets an independent table. The view owner must keep observations
+ * coherent when its backing state or methods change: object identity alone does
+ * not establish equivalent filesystem evidence.
+ *
+ * @evidence contracts/common.md#principled-implementation Device-keyed references are partitioned by observing operation object; refresh and metadata owners must maintain that view's coherence before its table can qualify a signature. Table identity alone proves no observation equivalence.
+ * @evidence contracts/common.md#clear-and-simple-design One WeakMap owns reference tables by operation identity; refresh and separability consumers retain their own write and comparison responsibilities.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts The table contains minted filesystem stamps, never a passive historical maximum or guessed process time that would hide same-tick writes.
+ * @evidence contracts/common.md#meaningful-documentation The native paragraphs explain racy-clean metadata, fresh writes, device identity, cross-volume behavior, and proof interleaving before describing the lookup.
+ * @evidence contracts/performance.md#efficient-algorithms Operation-table and device maps provide constant-time reference selection rather than rescanning inputs to infer a clock.
+ * @evidence contracts/performance.md#reuse-equivalent-work All proofs using the same operations object share its current device reference; replacement of that object creates independent evidence.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources
+ *   Weak association does not retain the operations object. Current writers
+ *   clear old entries and record at most one minted device stamp per refresh;
+ *   the returned Map can also be retained by its borrower. No native handle,
+ *   clock history or running task is acquired by table selection.
+ * @evidence contracts/portability.md#os-neutral-implementation
+ *   The table carries the observing view's bigint device/time representation;
+ *   actual probe reads and stamp comparison remain with their native owners.
+ *   A different view receives independent storage, without assuming equal OS
+ *   names or device labels establish cross-view clock equivalence.
+ */
+export declare function filesystemClockReferences(
+/** Coherent observing view partitioning native device/time authority. */
+filesystem: TtscTransformFilesystemOperations): Map<bigint, bigint>;

package/lib/core/transform/clock/filesystemClockReferences.d.ts

@@ -0,0 +1,35 @@
+import type { TtscTransformFilesystemOperations } from "../filesystem/TtscTransformFilesystemOperations";
+/**
+ * Return one observed filesystem's current clock references, creating the empty
+ * map on first use.
+ *
+ * Each entry maps a reporting device to the modification stamp the adapter's
+ * probe last minted there. `refreshFilesystemClockReference` replaces the map's
+ * contents before a validation, and `stampSeparable` reads it: an input whose
+ * stamp is strictly older than its device's reference can be trusted by
+ * signature. A device with no entry proves nothing, so its inputs keep being
+ * compared by content. The map is held per operations object; a distinct view
+ * object gets an independent table. The view owner must keep observations
+ * coherent when its backing state or methods change: object identity alone does
+ * not establish equivalent filesystem evidence.
+ *
+ * @evidence contracts/common.md#principled-implementation Device-keyed references are partitioned by observing operation object; refresh and metadata owners must maintain that view's coherence before its table can qualify a signature. Table identity alone proves no observation equivalence.
+ * @evidence contracts/common.md#clear-and-simple-design One WeakMap owns reference tables by operation identity; refresh and separability consumers retain their own write and comparison responsibilities.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts The table contains minted filesystem stamps, never a passive historical maximum or guessed process time that would hide same-tick writes.
+ * @evidence contracts/common.md#meaningful-documentation The native paragraphs explain racy-clean metadata, fresh writes, device identity, cross-volume behavior, and proof interleaving before describing the lookup.
+ * @evidence contracts/performance.md#efficient-algorithms Operation-table and device maps provide constant-time reference selection rather than rescanning inputs to infer a clock.
+ * @evidence contracts/performance.md#reuse-equivalent-work All proofs using the same operations object share its current device reference; replacement of that object creates independent evidence.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources
+ *   Weak association does not retain the operations object. Current writers
+ *   clear old entries and record at most one minted device stamp per refresh;
+ *   the returned Map can also be retained by its borrower. No native handle,
+ *   clock history or running task is acquired by table selection.
+ * @evidence contracts/portability.md#os-neutral-implementation
+ *   The table carries the observing view's bigint device/time representation;
+ *   actual probe reads and stamp comparison remain with their native owners.
+ *   A different view receives independent storage, without assuming equal OS
+ *   names or device labels establish cross-view clock equivalence.
+ */
+export declare function filesystemClockReferences(
+/** Coherent observing view partitioning native device/time authority. */
+filesystem: TtscTransformFilesystemOperations): Map<bigint, bigint>;

package/lib/core/transform/clock/filesystemClockReferences.js

@@ -0,0 +1,88 @@
+'use strict';
+
+/**
+ * The current stamp an adapter-owned probe has minted, keyed by the operations
+ * object that observes it and, inside, by reporting device.
+ *
+ * A filesystem stamps a write once per clock tick, so two same-length writes
+ * inside one tick are indistinguishable by metadata alone. A signature may
+ * therefore stand for content only while a later write is guaranteed to move
+ * it, and that guarantee needs a reference instant the observed filesystem
+ * itself produced: once some stamp on the same device is strictly newer than an
+ * input's modification stamp, that input's tick is provably over, so any later
+ * write must mint a newer stamp and move the signature. This adapts git's
+ * racily-clean index rule: both sides of the comparison come from the same
+ * reporting device, and the newer side is a write the adapter itself made.
+ *
+ * A timestamp merely observed on another input cannot advance the reference.
+ * Tools may assign modification times, and a filesystem clock can move
+ * backwards independently of the process clock. Neither a passive historical
+ * maximum nor `Date.now()` proves what stamp a write would mint now. The probe
+ * is therefore rewritten immediately before every proof that may reuse a
+ * content signature, and its previous reference is cleared before the write. A
+ * failed refresh or a different reporting device declines the optimization and
+ * retains the content comparison (samchon/ttsc#1344). A generation's capture
+ * and deliveries rewrite the probe it retains
+ * (`refreshFilesystemClockReference`); a proof that holds no generation, a
+ * failed generation's replay, a record's proof at a build start, and the
+ * observer's proof of a plugin source, mints in one probe directory the process
+ * keeps below this user's state root (`refreshProcessClockReference`). Once
+ * that directory exists, a mint rewrites the probe in place and adds or removes
+ * no entry in a directory another observer reads.
+ *
+ * Proofs share one reference per operations object and may interleave across an
+ * await. That is sound because separability is decided when an input's metadata
+ * is taken before its read (`inputMetadataEvidence`): whatever reference is
+ * current then was minted before that read, whichever proof minted it.
+ *
+ * The probe lives in an adapter-owned temporary directory outside the project.
+ * That directory may be on another volume, such as `C:` when a project lives on
+ * `D:`. Such a split-volume generation safely keeps reading content because no
+ * same-device reference exists; it never substitutes a process-clock guess or
+ * writes a probe into the user's project.
+ */
+const FILESYSTEM_CLOCK_REFERENCES = new WeakMap();
+/**
+ * Return one observed filesystem's current clock references, creating the empty
+ * map on first use.
+ *
+ * Each entry maps a reporting device to the modification stamp the adapter's
+ * probe last minted there. `refreshFilesystemClockReference` replaces the map's
+ * contents before a validation, and `stampSeparable` reads it: an input whose
+ * stamp is strictly older than its device's reference can be trusted by
+ * signature. A device with no entry proves nothing, so its inputs keep being
+ * compared by content. The map is held per operations object; a distinct view
+ * object gets an independent table. The view owner must keep observations
+ * coherent when its backing state or methods change: object identity alone does
+ * not establish equivalent filesystem evidence.
+ *
+ * @evidence contracts/common.md#principled-implementation Device-keyed references are partitioned by observing operation object; refresh and metadata owners must maintain that view's coherence before its table can qualify a signature. Table identity alone proves no observation equivalence.
+ * @evidence contracts/common.md#clear-and-simple-design One WeakMap owns reference tables by operation identity; refresh and separability consumers retain their own write and comparison responsibilities.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts The table contains minted filesystem stamps, never a passive historical maximum or guessed process time that would hide same-tick writes.
+ * @evidence contracts/common.md#meaningful-documentation The native paragraphs explain racy-clean metadata, fresh writes, device identity, cross-volume behavior, and proof interleaving before describing the lookup.
+ * @evidence contracts/performance.md#efficient-algorithms Operation-table and device maps provide constant-time reference selection rather than rescanning inputs to infer a clock.
+ * @evidence contracts/performance.md#reuse-equivalent-work All proofs using the same operations object share its current device reference; replacement of that object creates independent evidence.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources
+ *   Weak association does not retain the operations object. Current writers
+ *   clear old entries and record at most one minted device stamp per refresh;
+ *   the returned Map can also be retained by its borrower. No native handle,
+ *   clock history or running task is acquired by table selection.
+ * @evidence contracts/portability.md#os-neutral-implementation
+ *   The table carries the observing view's bigint device/time representation;
+ *   actual probe reads and stamp comparison remain with their native owners.
+ *   A different view receives independent storage, without assuming equal OS
+ *   names or device labels establish cross-view clock equivalence.
+ */
+function filesystemClockReferences(
+/** Coherent observing view partitioning native device/time authority. */
+filesystem) {
+    let references = FILESYSTEM_CLOCK_REFERENCES.get(filesystem);
+    if (references === undefined) {
+        references = new Map();
+        FILESYSTEM_CLOCK_REFERENCES.set(filesystem, references);
+    }
+    return references;
+}
+
+exports.filesystemClockReferences = filesystemClockReferences;
+//# sourceMappingURL=filesystemClockReferences.js.map

package/lib/core/transform/clock/filesystemClockReferences.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystemClockReferences.js","sources":["../../../../src/core/transform/clock/filesystemClockReferences.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCG;AACH,MAAM,2BAA2B,GAAG,IAAI,OAAO,EAG5C;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BG;SACa,yBAAyB;AACvC;AACA,UAA6C,EAAA;IAE7C,IAAI,UAAU,GAAG,2BAA2B,CAAC,GAAG,CAAC,UAAU,CAAC;AAC5D,IAAA,IAAI,UAAU,KAAK,SAAS,EAAE;AAC5B,QAAA,UAAU,GAAG,IAAI,GAAG,EAAE;AACtB,QAAA,2BAA2B,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC;IACzD;AACA,IAAA,OAAO,UAAU;AACnB;;;;"}

package/lib/core/transform/clock/filesystemClockReferences.mjs

@@ -0,0 +1,86 @@
+/**
+ * The current stamp an adapter-owned probe has minted, keyed by the operations
+ * object that observes it and, inside, by reporting device.
+ *
+ * A filesystem stamps a write once per clock tick, so two same-length writes
+ * inside one tick are indistinguishable by metadata alone. A signature may
+ * therefore stand for content only while a later write is guaranteed to move
+ * it, and that guarantee needs a reference instant the observed filesystem
+ * itself produced: once some stamp on the same device is strictly newer than an
+ * input's modification stamp, that input's tick is provably over, so any later
+ * write must mint a newer stamp and move the signature. This adapts git's
+ * racily-clean index rule: both sides of the comparison come from the same
+ * reporting device, and the newer side is a write the adapter itself made.
+ *
+ * A timestamp merely observed on another input cannot advance the reference.
+ * Tools may assign modification times, and a filesystem clock can move
+ * backwards independently of the process clock. Neither a passive historical
+ * maximum nor `Date.now()` proves what stamp a write would mint now. The probe
+ * is therefore rewritten immediately before every proof that may reuse a
+ * content signature, and its previous reference is cleared before the write. A
+ * failed refresh or a different reporting device declines the optimization and
+ * retains the content comparison (samchon/ttsc#1344). A generation's capture
+ * and deliveries rewrite the probe it retains
+ * (`refreshFilesystemClockReference`); a proof that holds no generation, a
+ * failed generation's replay, a record's proof at a build start, and the
+ * observer's proof of a plugin source, mints in one probe directory the process
+ * keeps below this user's state root (`refreshProcessClockReference`). Once
+ * that directory exists, a mint rewrites the probe in place and adds or removes
+ * no entry in a directory another observer reads.
+ *
+ * Proofs share one reference per operations object and may interleave across an
+ * await. That is sound because separability is decided when an input's metadata
+ * is taken before its read (`inputMetadataEvidence`): whatever reference is
+ * current then was minted before that read, whichever proof minted it.
+ *
+ * The probe lives in an adapter-owned temporary directory outside the project.
+ * That directory may be on another volume, such as `C:` when a project lives on
+ * `D:`. Such a split-volume generation safely keeps reading content because no
+ * same-device reference exists; it never substitutes a process-clock guess or
+ * writes a probe into the user's project.
+ */
+const FILESYSTEM_CLOCK_REFERENCES = new WeakMap();
+/**
+ * Return one observed filesystem's current clock references, creating the empty
+ * map on first use.
+ *
+ * Each entry maps a reporting device to the modification stamp the adapter's
+ * probe last minted there. `refreshFilesystemClockReference` replaces the map's
+ * contents before a validation, and `stampSeparable` reads it: an input whose
+ * stamp is strictly older than its device's reference can be trusted by
+ * signature. A device with no entry proves nothing, so its inputs keep being
+ * compared by content. The map is held per operations object; a distinct view
+ * object gets an independent table. The view owner must keep observations
+ * coherent when its backing state or methods change: object identity alone does
+ * not establish equivalent filesystem evidence.
+ *
+ * @evidence contracts/common.md#principled-implementation Device-keyed references are partitioned by observing operation object; refresh and metadata owners must maintain that view's coherence before its table can qualify a signature. Table identity alone proves no observation equivalence.
+ * @evidence contracts/common.md#clear-and-simple-design One WeakMap owns reference tables by operation identity; refresh and separability consumers retain their own write and comparison responsibilities.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts The table contains minted filesystem stamps, never a passive historical maximum or guessed process time that would hide same-tick writes.
+ * @evidence contracts/common.md#meaningful-documentation The native paragraphs explain racy-clean metadata, fresh writes, device identity, cross-volume behavior, and proof interleaving before describing the lookup.
+ * @evidence contracts/performance.md#efficient-algorithms Operation-table and device maps provide constant-time reference selection rather than rescanning inputs to infer a clock.
+ * @evidence contracts/performance.md#reuse-equivalent-work All proofs using the same operations object share its current device reference; replacement of that object creates independent evidence.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources
+ *   Weak association does not retain the operations object. Current writers
+ *   clear old entries and record at most one minted device stamp per refresh;
+ *   the returned Map can also be retained by its borrower. No native handle,
+ *   clock history or running task is acquired by table selection.
+ * @evidence contracts/portability.md#os-neutral-implementation
+ *   The table carries the observing view's bigint device/time representation;
+ *   actual probe reads and stamp comparison remain with their native owners.
+ *   A different view receives independent storage, without assuming equal OS
+ *   names or device labels establish cross-view clock equivalence.
+ */
+function filesystemClockReferences(
+/** Coherent observing view partitioning native device/time authority. */
+filesystem) {
+    let references = FILESYSTEM_CLOCK_REFERENCES.get(filesystem);
+    if (references === undefined) {
+        references = new Map();
+        FILESYSTEM_CLOCK_REFERENCES.set(filesystem, references);
+    }
+    return references;
+}
+
+export { filesystemClockReferences };
+//# sourceMappingURL=filesystemClockReferences.mjs.map

package/lib/core/transform/clock/filesystemClockReferences.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystemClockReferences.mjs","sources":["../../../../src/core/transform/clock/filesystemClockReferences.ts"],"sourcesContent":[null],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCG;AACH,MAAM,2BAA2B,GAAG,IAAI,OAAO,EAG5C;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BG;SACa,yBAAyB;AACvC;AACA,UAA6C,EAAA;IAE7C,IAAI,UAAU,GAAG,2BAA2B,CAAC,GAAG,CAAC,UAAU,CAAC;AAC5D,IAAA,IAAI,UAAU,KAAK,SAAS,EAAE;AAC5B,QAAA,UAAU,GAAG,IAAI,GAAG,EAAE;AACtB,QAAA,2BAA2B,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC;IACzD;AACA,IAAA,OAAO,UAAU;AACnB;;;;"}

package/lib/core/transform/clock/refreshFilesystemClockReference.d.cts

@@ -0,0 +1,44 @@
+import type { TtscTransformFilesystemOperations } from "../filesystem/TtscTransformFilesystemOperations.cjs";
+/**
+ * Replace every prior clock proof with one reference minted by a fresh write.
+ *
+ * The reference directory is storage the adapter already owns, deliberately
+ * outside the project root, so stamping a probe file there produces a
+ * freshly-minted "now" without touching the user's project — the analogue of
+ * git writing its index. The probe is observed through the cache-owned
+ * operations and keyed by the device those operations report, so it only ever
+ * separates stamps on the filesystem that actually minted it. When its volume
+ * differs from the inputs' volume, or the observed filesystem cannot see the
+ * probe at all, nothing is proven and content comparison continues. The write
+ * uses the native host filesystem; the supplied observing view must coherently
+ * observe that probe for its metadata to represent this mint. This function
+ * does not independently certify equivalence of a replaced view.
+ *
+ * Forcing the reference onto the inputs' volume would require writing into the
+ * user's project or an otherwise unowned neighboring directory. That is not a
+ * valid price for this optimization, so the cross-volume case degrades to more
+ * reads instead.
+ *
+ * @evidence contracts/common.md#principled-implementation Clearing old references before a fresh owned probe write prevents previous or rolled-back stamps from certifying content; only observed regular-file metadata establishes a same-device reference.
+ * @evidence contracts/common.md#clear-and-simple-design This operation mints and records one probe stamp; input metadata comparison remains in the separability consumer.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Failed writes, inaccessible probes, or another device cannot be replaced by Date.now or a historical maximum; actual content proof remains necessary.
+ * @evidence contracts/common.md#meaningful-documentation Separate native paragraphs explain owned storage, fresh-write evidence, and why cross-volume inputs require more reads.
+ * @evidence contracts/portability.md#os-neutral-implementation OS-neutral clock proof uses native owned-path writes and the observing view's bigint device/time metadata, preserving cross-volume and unavailable-probe behavior without a platform clock assumption.
+ * @evidence contracts/performance.md#efficient-algorithms
+ *   Clear the view's prior entries, then an available directory performs native
+ *   path joining, one write of process-counter text and one observed metadata
+ *   read. Costs include path/counter text and native I/O; a missing directory
+ *   skips I/O. Clearing/recording follows the current reference population,
+ *   not a scan of project inputs.
+ * @evidence contracts/performance.md#reuse-equivalent-work The existing probe path and shared per-view reference table are reused; only a newly minted stamp can authorize signature reuse.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources
+ *   Refresh clears history and retains at most one regular-file device stamp;
+ *   failure leaves an empty reference table. The single probe persists in its
+ *   generation/process-owned directory until that owner attempts cleanup;
+ *   this refresh acquires no separate handle or retry task.
+ */
+export declare function refreshFilesystemClockReference(
+/** Owned probe storage, or unavailable storage requiring reference withdrawal. */
+referenceDirectory: string | undefined, 
+/** Coherent observing view whose device/time reference will be replaced. */
+filesystem: TtscTransformFilesystemOperations): void;

package/lib/core/transform/clock/refreshFilesystemClockReference.d.mts

@@ -0,0 +1,44 @@
+import type { TtscTransformFilesystemOperations } from "../filesystem/TtscTransformFilesystemOperations.mjs";
+/**
+ * Replace every prior clock proof with one reference minted by a fresh write.
+ *
+ * The reference directory is storage the adapter already owns, deliberately
+ * outside the project root, so stamping a probe file there produces a
+ * freshly-minted "now" without touching the user's project — the analogue of
+ * git writing its index. The probe is observed through the cache-owned
+ * operations and keyed by the device those operations report, so it only ever
+ * separates stamps on the filesystem that actually minted it. When its volume
+ * differs from the inputs' volume, or the observed filesystem cannot see the
+ * probe at all, nothing is proven and content comparison continues. The write
+ * uses the native host filesystem; the supplied observing view must coherently
+ * observe that probe for its metadata to represent this mint. This function
+ * does not independently certify equivalence of a replaced view.
+ *
+ * Forcing the reference onto the inputs' volume would require writing into the
+ * user's project or an otherwise unowned neighboring directory. That is not a
+ * valid price for this optimization, so the cross-volume case degrades to more
+ * reads instead.
+ *
+ * @evidence contracts/common.md#principled-implementation Clearing old references before a fresh owned probe write prevents previous or rolled-back stamps from certifying content; only observed regular-file metadata establishes a same-device reference.
+ * @evidence contracts/common.md#clear-and-simple-design This operation mints and records one probe stamp; input metadata comparison remains in the separability consumer.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Failed writes, inaccessible probes, or another device cannot be replaced by Date.now or a historical maximum; actual content proof remains necessary.
+ * @evidence contracts/common.md#meaningful-documentation Separate native paragraphs explain owned storage, fresh-write evidence, and why cross-volume inputs require more reads.
+ * @evidence contracts/portability.md#os-neutral-implementation OS-neutral clock proof uses native owned-path writes and the observing view's bigint device/time metadata, preserving cross-volume and unavailable-probe behavior without a platform clock assumption.
+ * @evidence contracts/performance.md#efficient-algorithms
+ *   Clear the view's prior entries, then an available directory performs native
+ *   path joining, one write of process-counter text and one observed metadata
+ *   read. Costs include path/counter text and native I/O; a missing directory
+ *   skips I/O. Clearing/recording follows the current reference population,
+ *   not a scan of project inputs.
+ * @evidence contracts/performance.md#reuse-equivalent-work The existing probe path and shared per-view reference table are reused; only a newly minted stamp can authorize signature reuse.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources
+ *   Refresh clears history and retains at most one regular-file device stamp;
+ *   failure leaves an empty reference table. The single probe persists in its
+ *   generation/process-owned directory until that owner attempts cleanup;
+ *   this refresh acquires no separate handle or retry task.
+ */
+export declare function refreshFilesystemClockReference(
+/** Owned probe storage, or unavailable storage requiring reference withdrawal. */
+referenceDirectory: string | undefined, 
+/** Coherent observing view whose device/time reference will be replaced. */
+filesystem: TtscTransformFilesystemOperations): void;

package/lib/core/transform/clock/refreshFilesystemClockReference.d.ts

@@ -0,0 +1,44 @@
+import type { TtscTransformFilesystemOperations } from "../filesystem/TtscTransformFilesystemOperations";
+/**
+ * Replace every prior clock proof with one reference minted by a fresh write.
+ *
+ * The reference directory is storage the adapter already owns, deliberately
+ * outside the project root, so stamping a probe file there produces a
+ * freshly-minted "now" without touching the user's project — the analogue of
+ * git writing its index. The probe is observed through the cache-owned
+ * operations and keyed by the device those operations report, so it only ever
+ * separates stamps on the filesystem that actually minted it. When its volume
+ * differs from the inputs' volume, or the observed filesystem cannot see the
+ * probe at all, nothing is proven and content comparison continues. The write
+ * uses the native host filesystem; the supplied observing view must coherently
+ * observe that probe for its metadata to represent this mint. This function
+ * does not independently certify equivalence of a replaced view.
+ *
+ * Forcing the reference onto the inputs' volume would require writing into the
+ * user's project or an otherwise unowned neighboring directory. That is not a
+ * valid price for this optimization, so the cross-volume case degrades to more
+ * reads instead.
+ *
+ * @evidence contracts/common.md#principled-implementation Clearing old references before a fresh owned probe write prevents previous or rolled-back stamps from certifying content; only observed regular-file metadata establishes a same-device reference.
+ * @evidence contracts/common.md#clear-and-simple-design This operation mints and records one probe stamp; input metadata comparison remains in the separability consumer.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Failed writes, inaccessible probes, or another device cannot be replaced by Date.now or a historical maximum; actual content proof remains necessary.
+ * @evidence contracts/common.md#meaningful-documentation Separate native paragraphs explain owned storage, fresh-write evidence, and why cross-volume inputs require more reads.
+ * @evidence contracts/portability.md#os-neutral-implementation OS-neutral clock proof uses native owned-path writes and the observing view's bigint device/time metadata, preserving cross-volume and unavailable-probe behavior without a platform clock assumption.
+ * @evidence contracts/performance.md#efficient-algorithms
+ *   Clear the view's prior entries, then an available directory performs native
+ *   path joining, one write of process-counter text and one observed metadata
+ *   read. Costs include path/counter text and native I/O; a missing directory
+ *   skips I/O. Clearing/recording follows the current reference population,
+ *   not a scan of project inputs.
+ * @evidence contracts/performance.md#reuse-equivalent-work The existing probe path and shared per-view reference table are reused; only a newly minted stamp can authorize signature reuse.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources
+ *   Refresh clears history and retains at most one regular-file device stamp;
+ *   failure leaves an empty reference table. The single probe persists in its
+ *   generation/process-owned directory until that owner attempts cleanup;
+ *   this refresh acquires no separate handle or retry task.
+ */
+export declare function refreshFilesystemClockReference(
+/** Owned probe storage, or unavailable storage requiring reference withdrawal. */
+referenceDirectory: string | undefined, 
+/** Coherent observing view whose device/time reference will be replaced. */
+filesystem: TtscTransformFilesystemOperations): void;