@ttsc/unplugin 0.30.4 → 0.31.0

package/lib/core/transform/generation/projectWalkFailureFingerprint.js

@@ -0,0 +1,67 @@
+'use strict';
+
+var path = require('node:path');
+var toProjectKey = require('../project/toProjectKey.js');
+var hashText = require('../utils/hashText.js');
+var walkSnapshotComplete = require('../validation/walkSnapshotComplete.js');
+
+/**
+ * Hash the walk's declared-input-relevant failure shape for terminal retry
+ * comparison. File failures outside the declared keys are ignored; directory
+ * failures and unidentifiable paths remain relevant to walk completeness.
+ * Sorted failure/unstable lists make observation order irrelevant.
+ *
+ * This records producer classifications and resolved diagnostic spellings,
+ * rather than reopening paths to obtain error messages. Identity filtering
+ * shares the caller's observation transaction and may perform its native
+ * probes. A digest difference confirms a changed failure shape, not that a new
+ * generation can succeed.
+ *
+ * @evidence contracts/common.md#principled-implementation Declared keys filter only file failures with resolvable identity; completeness, directory completeness and sorted kind/path observations preserve the failure shape under hashText's digest comparison premise.
+ * @evidence contracts/common.md#clear-and-simple-design This helper produces a compact comparison fingerprint while walkSnapshotComplete owns completeness semantics and toProjectKey owns filesystem identity mapping.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Unidentifiable failed paths remain included rather than being dropped to manufacture a complete walk, and directory failures are not excused by declared-file selection.
+ * @evidence contracts/common.md#meaningful-documentation Native paragraphs explain declared filtering, conservative identity failure, order-insensitive fingerprinting and its confirmation-only role before separated acknowledgments.
+ * @evidence contracts/portability.md#os-neutral-implementation Node resolves diagnostic native paths while toProjectKey uses the supplied filesystem identity context; no protocol slash or OS-name case assumption replaces path identity.
+ * @evidence contracts/performance.md#efficient-algorithms
+ *   Copies all unstable keys and scans all failures before sorting selected
+ *   collections, preserving the borrowed snapshot's order. Set lookups retain
+ *   key-text cost; declared file failures delegate native identity resolution
+ *   and containment to the supplied transaction. Completeness may scan unstable
+ *   keys again. Selected path resolution, string comparisons, JSON encoding
+ *   and UTF-8 hashing scale with diagnostic/key text; temporary arrays and
+ *   encoded text grow with the supplied and selected populations. Sorting is
+ *   needed because failure observation order is not retry identity.
+ * @evidence contracts/performance.md#reuse-equivalent-work
+ *   File filtering reuses path and directory-capability observations through
+ *   the caller's identity transaction. The completed fingerprint is not cached
+ *   here; terminal validation stores the baseline and compares a new snapshot.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources Temporary filtered/sorted arrays transfer only a digest string; no retained cache, handle or generation lifecycle is owned here.
+ */
+function projectWalkFailureFingerprint(snapshot, declared, projectRoot, identities) {
+    const relevantUnstableFiles = declared === undefined
+        ? [...snapshot.unstableFiles]
+        : [...snapshot.unstableFiles].filter((key) => declared.has(key));
+    const relevantFailures = snapshot.walkFailures.filter((failure) => {
+        if (!failure.kind.startsWith("file-"))
+            return true;
+        if (declared === undefined)
+            return true;
+        try {
+            return declared.has(toProjectKey.toProjectKey(projectRoot, failure.path, identities));
+        }
+        catch {
+            return true;
+        }
+    });
+    return hashText.hashText(JSON.stringify({
+        complete: walkSnapshotComplete.walkSnapshotComplete(snapshot, declared),
+        directoryComplete: snapshot.directoryComplete,
+        failures: relevantFailures
+            .map((failure) => `${failure.kind}\0${path.resolve(failure.path)}`)
+            .sort(),
+        unstableFiles: relevantUnstableFiles.sort(),
+    }));
+}
+
+exports.projectWalkFailureFingerprint = projectWalkFailureFingerprint;
+//# sourceMappingURL=projectWalkFailureFingerprint.js.map

package/lib/core/transform/generation/projectWalkFailureFingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectWalkFailureFingerprint.js","sources":["../../../../src/core/transform/generation/projectWalkFailureFingerprint.ts"],"sourcesContent":[null],"names":["toProjectKey","hashText","walkSnapshotComplete"],"mappings":";;;;;;;AAQA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BG;AACG,SAAU,6BAA6B,CAC3C,QAYC,EACD,QAAyC,EACzC,WAAmB,EACnB,UAAyC,EAAA;AAEzC,IAAA,MAAM,qBAAqB,GACzB,QAAQ,KAAK;AACX,UAAE,CAAC,GAAG,QAAQ,CAAC,aAAa;UAC1B,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpE,MAAM,gBAAgB,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,OAAO,KAAI;QAChE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;AAAE,YAAA,OAAO,IAAI;QAClD,IAAI,QAAQ,KAAK,SAAS;AAAE,YAAA,OAAO,IAAI;AACvC,QAAA,IAAI;AACF,YAAA,OAAO,QAAQ,CAAC,GAAG,CAACA,yBAAY,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC1E;AAAE,QAAA,MAAM;AACN,YAAA,OAAO,IAAI;QACb;AACF,IAAA,CAAC,CAAC;AACF,IAAA,OAAOC,iBAAQ,CACb,IAAI,CAAC,SAAS,CAAC;AACb,QAAA,QAAQ,EAAEC,yCAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAClD,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;AAC7C,QAAA,QAAQ,EAAE;aACP,GAAG,CAAC,CAAC,OAAO,KAAK,CAAA,EAAG,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;AACjE,aAAA,IAAI,EAAE;AACT,QAAA,aAAa,EAAE,qBAAqB,CAAC,IAAI,EAAE;AAC5C,KAAA,CAAC,CACH;AACH;;;;"}

package/lib/core/transform/generation/projectWalkFailureFingerprint.mjs

@@ -0,0 +1,65 @@
+import path from 'node:path';
+import { toProjectKey } from '../project/toProjectKey.mjs';
+import { hashText } from '../utils/hashText.mjs';
+import { walkSnapshotComplete } from '../validation/walkSnapshotComplete.mjs';
+
+/**
+ * Hash the walk's declared-input-relevant failure shape for terminal retry
+ * comparison. File failures outside the declared keys are ignored; directory
+ * failures and unidentifiable paths remain relevant to walk completeness.
+ * Sorted failure/unstable lists make observation order irrelevant.
+ *
+ * This records producer classifications and resolved diagnostic spellings,
+ * rather than reopening paths to obtain error messages. Identity filtering
+ * shares the caller's observation transaction and may perform its native
+ * probes. A digest difference confirms a changed failure shape, not that a new
+ * generation can succeed.
+ *
+ * @evidence contracts/common.md#principled-implementation Declared keys filter only file failures with resolvable identity; completeness, directory completeness and sorted kind/path observations preserve the failure shape under hashText's digest comparison premise.
+ * @evidence contracts/common.md#clear-and-simple-design This helper produces a compact comparison fingerprint while walkSnapshotComplete owns completeness semantics and toProjectKey owns filesystem identity mapping.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Unidentifiable failed paths remain included rather than being dropped to manufacture a complete walk, and directory failures are not excused by declared-file selection.
+ * @evidence contracts/common.md#meaningful-documentation Native paragraphs explain declared filtering, conservative identity failure, order-insensitive fingerprinting and its confirmation-only role before separated acknowledgments.
+ * @evidence contracts/portability.md#os-neutral-implementation Node resolves diagnostic native paths while toProjectKey uses the supplied filesystem identity context; no protocol slash or OS-name case assumption replaces path identity.
+ * @evidence contracts/performance.md#efficient-algorithms
+ *   Copies all unstable keys and scans all failures before sorting selected
+ *   collections, preserving the borrowed snapshot's order. Set lookups retain
+ *   key-text cost; declared file failures delegate native identity resolution
+ *   and containment to the supplied transaction. Completeness may scan unstable
+ *   keys again. Selected path resolution, string comparisons, JSON encoding
+ *   and UTF-8 hashing scale with diagnostic/key text; temporary arrays and
+ *   encoded text grow with the supplied and selected populations. Sorting is
+ *   needed because failure observation order is not retry identity.
+ * @evidence contracts/performance.md#reuse-equivalent-work
+ *   File filtering reuses path and directory-capability observations through
+ *   the caller's identity transaction. The completed fingerprint is not cached
+ *   here; terminal validation stores the baseline and compares a new snapshot.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources Temporary filtered/sorted arrays transfer only a digest string; no retained cache, handle or generation lifecycle is owned here.
+ */
+function projectWalkFailureFingerprint(snapshot, declared, projectRoot, identities) {
+    const relevantUnstableFiles = declared === undefined
+        ? [...snapshot.unstableFiles]
+        : [...snapshot.unstableFiles].filter((key) => declared.has(key));
+    const relevantFailures = snapshot.walkFailures.filter((failure) => {
+        if (!failure.kind.startsWith("file-"))
+            return true;
+        if (declared === undefined)
+            return true;
+        try {
+            return declared.has(toProjectKey(projectRoot, failure.path, identities));
+        }
+        catch {
+            return true;
+        }
+    });
+    return hashText(JSON.stringify({
+        complete: walkSnapshotComplete(snapshot, declared),
+        directoryComplete: snapshot.directoryComplete,
+        failures: relevantFailures
+            .map((failure) => `${failure.kind}\0${path.resolve(failure.path)}`)
+            .sort(),
+        unstableFiles: relevantUnstableFiles.sort(),
+    }));
+}
+
+export { projectWalkFailureFingerprint };
+//# sourceMappingURL=projectWalkFailureFingerprint.mjs.map

package/lib/core/transform/generation/projectWalkFailureFingerprint.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectWalkFailureFingerprint.mjs","sources":["../../../../src/core/transform/generation/projectWalkFailureFingerprint.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;;AAQA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BG;AACG,SAAU,6BAA6B,CAC3C,QAYC,EACD,QAAyC,EACzC,WAAmB,EACnB,UAAyC,EAAA;AAEzC,IAAA,MAAM,qBAAqB,GACzB,QAAQ,KAAK;AACX,UAAE,CAAC,GAAG,QAAQ,CAAC,aAAa;UAC1B,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpE,MAAM,gBAAgB,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,OAAO,KAAI;QAChE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;AAAE,YAAA,OAAO,IAAI;QAClD,IAAI,QAAQ,KAAK,SAAS;AAAE,YAAA,OAAO,IAAI;AACvC,QAAA,IAAI;AACF,YAAA,OAAO,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC1E;AAAE,QAAA,MAAM;AACN,YAAA,OAAO,IAAI;QACb;AACF,IAAA,CAAC,CAAC;AACF,IAAA,OAAO,QAAQ,CACb,IAAI,CAAC,SAAS,CAAC;AACb,QAAA,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAClD,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;AAC7C,QAAA,QAAQ,EAAE;aACP,GAAG,CAAC,CAAC,OAAO,KAAK,CAAA,EAAG,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;AACjE,aAAA,IAAI,EAAE;AACT,QAAA,aAAa,EAAE,qBAAqB,CAAC,IAAI,EAAE;AAC5C,KAAA,CAAC,CACH;AACH;;;;"}

package/lib/core/transform/generation/projectWalkStable.d.cts

@@ -0,0 +1,68 @@
+import type { collectProjectInputSnapshot } from "../project/collectProjectInputSnapshot.cjs";
+import type { TtscProjectMutationTracker } from "../tracker/TtscProjectMutationTracker.cjs";
+/**
+ * Whether the project held still across one compile, the half of a capture's
+ * verdict that only evidence spanning the compile can decide
+ * (samchon/ttsc#1383).
+ *
+ * This predicate compares available walks and reported events rather than
+ * freezing the filesystem. With no tracker, it supplies no independent A-B-A
+ * event authority; complete generation admission also requires the compiler
+ * graph and external/host proofs in captureTransformGeneration.
+ *
+ * The walks compare recorded bytes and metadata. A healthy tracker opened
+ * before the compile can supply independent A-B-A event evidence: a producer
+ * can restore both bytes and timestamps before the second walk, but it cannot
+ * withdraw an event already recorded. This predicate accepts the records when
+ * the configuration did, both walks are complete for the declared inputs, those
+ * inputs kept their content and metadata, every directory that can hold a
+ * program input kept its membership, and the tracker saw neither a content
+ * event on a declared input nor a membership event. It reads recorded
+ * event/overflow/membership fields, not tracker failed, unverified or coverage
+ * state; supplying a tracker does not itself prove that every native mutation
+ * was delivered. Actual backend/proof authority stays with the tracker and
+ * generation-admission owners.
+ *
+ * That tracker is the only one accepted. The host-input and candidate trackers
+ * open after the compile returns, so they never saw what it read. A change in
+ * their window before the capture's own reads is visible to those reads, and a
+ * change after them stays queued as a path witness for the next delivery. Their
+ * events used to fail the attempt anyway, which turned `vitest` writing its
+ * cache under `node_modules` beside a dev server into a terminal "could not
+ * capture a reusable transform generation" error.
+ *
+ * @param props.before The project walk taken before the compile.
+ * @param props.configStable Whether the configuration held still.
+ * @param props.declared The generation's declared project inputs, or
+ *   `undefined` for an envelope that declares none, which compares the whole
+ *   walk.
+ * @param props.projectRoot The root the declared keys are relative to.
+ * @param props.snapshot The project walk taken after the compile.
+ * @param props.tracker The project tracker opened before the compile, if one
+ *   could be opened.
+ * @evidence contracts/common.md#principled-implementation Complete walks must agree on declared content, metadata and relevant directory membership, and recorded compile-time events/overflow/membership must not refute them. Independent A-B-A authority requires a healthy, relevant backend; this predicate does not check tracker health/coverage and is not an atomic filesystem freeze or full generation proof.
+ * @evidence contracts/common.md#clear-and-simple-design The verdict composes existing walk, hash, directory and event predicates without duplicating their evidence collection or tracker ownership.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Unknown declared scope compares the full walk, omitted tracker events remain conservative, and no bundler cache filename exception replaces the actual compile-window distinction.
+ * @evidence contracts/common.md#meaningful-documentation Native paragraphs explain the temporal witness boundary and narrower role of later trackers; props identify before/after observations and undefined declared scope.
+ * @evidence contracts/portability.md#os-neutral-implementation Native identity/event overlap policy stays with trackerChangedDeclaredProjectInput and the supplied filesystem observations; this predicate introduces no OS-name or separator-based case rule.
+ * @evidence contracts/performance.md#efficient-algorithms Ordered conjunction short-circuits failed proof. Reached predicates scan unstable/declared or full hash populations and both full directory populations, allocating filtered maps and a relevant-path union. Event comparison resolves D declared paths and can perform C times D native/text/identity overlap work even though normal retained C is bounded. Text bytes and delegated temporary populations remain beyond witness-count bounds; no source bytes are reread here.
+ * @evidenceExclude contracts/performance.md#reuse-equivalent-work This pure predicate consumes an already captured pair; generation capture owns observation sharing and no cross-request cache is coordinated here.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The verdict owns no tracker, retained generation or resource lifecycle; its caller owns the compared observations.
+ */
+export declare function projectWalkStable(props: {
+    /** Pre-compile walk under the primed compiler membership policy. */
+    before: ProjectWalk;
+    /** Whether the wrapper-dependent config view held through the compile. */
+    configStable: boolean;
+    /** Relevant project keys; undefined requires agreement over the whole walk. */
+    declared: ReadonlySet<string> | undefined;
+    /** Native project directory anchoring declared keys for event overlap. */
+    projectRoot: string;
+    /** Post-compile walk under the compiler-reported membership policy. */
+    snapshot: ProjectWalk;
+    /** Observer opened before compile; absence supplies no positive event proof. */
+    tracker: TtscProjectMutationTracker | undefined;
+}): boolean;
+/** The parts of a project walk the verdict compares. */
+type ProjectWalk = Pick<ReturnType<typeof collectProjectInputSnapshot>, "complete" | "directoryComplete" | "fileSignatures" | "hashes" | "projectDirectories" | "unstableFiles">;
+export {};

package/lib/core/transform/generation/projectWalkStable.d.mts

@@ -0,0 +1,68 @@
+import type { collectProjectInputSnapshot } from "../project/collectProjectInputSnapshot.mjs";
+import type { TtscProjectMutationTracker } from "../tracker/TtscProjectMutationTracker.mjs";
+/**
+ * Whether the project held still across one compile, the half of a capture's
+ * verdict that only evidence spanning the compile can decide
+ * (samchon/ttsc#1383).
+ *
+ * This predicate compares available walks and reported events rather than
+ * freezing the filesystem. With no tracker, it supplies no independent A-B-A
+ * event authority; complete generation admission also requires the compiler
+ * graph and external/host proofs in captureTransformGeneration.
+ *
+ * The walks compare recorded bytes and metadata. A healthy tracker opened
+ * before the compile can supply independent A-B-A event evidence: a producer
+ * can restore both bytes and timestamps before the second walk, but it cannot
+ * withdraw an event already recorded. This predicate accepts the records when
+ * the configuration did, both walks are complete for the declared inputs, those
+ * inputs kept their content and metadata, every directory that can hold a
+ * program input kept its membership, and the tracker saw neither a content
+ * event on a declared input nor a membership event. It reads recorded
+ * event/overflow/membership fields, not tracker failed, unverified or coverage
+ * state; supplying a tracker does not itself prove that every native mutation
+ * was delivered. Actual backend/proof authority stays with the tracker and
+ * generation-admission owners.
+ *
+ * That tracker is the only one accepted. The host-input and candidate trackers
+ * open after the compile returns, so they never saw what it read. A change in
+ * their window before the capture's own reads is visible to those reads, and a
+ * change after them stays queued as a path witness for the next delivery. Their
+ * events used to fail the attempt anyway, which turned `vitest` writing its
+ * cache under `node_modules` beside a dev server into a terminal "could not
+ * capture a reusable transform generation" error.
+ *
+ * @param props.before The project walk taken before the compile.
+ * @param props.configStable Whether the configuration held still.
+ * @param props.declared The generation's declared project inputs, or
+ *   `undefined` for an envelope that declares none, which compares the whole
+ *   walk.
+ * @param props.projectRoot The root the declared keys are relative to.
+ * @param props.snapshot The project walk taken after the compile.
+ * @param props.tracker The project tracker opened before the compile, if one
+ *   could be opened.
+ * @evidence contracts/common.md#principled-implementation Complete walks must agree on declared content, metadata and relevant directory membership, and recorded compile-time events/overflow/membership must not refute them. Independent A-B-A authority requires a healthy, relevant backend; this predicate does not check tracker health/coverage and is not an atomic filesystem freeze or full generation proof.
+ * @evidence contracts/common.md#clear-and-simple-design The verdict composes existing walk, hash, directory and event predicates without duplicating their evidence collection or tracker ownership.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Unknown declared scope compares the full walk, omitted tracker events remain conservative, and no bundler cache filename exception replaces the actual compile-window distinction.
+ * @evidence contracts/common.md#meaningful-documentation Native paragraphs explain the temporal witness boundary and narrower role of later trackers; props identify before/after observations and undefined declared scope.
+ * @evidence contracts/portability.md#os-neutral-implementation Native identity/event overlap policy stays with trackerChangedDeclaredProjectInput and the supplied filesystem observations; this predicate introduces no OS-name or separator-based case rule.
+ * @evidence contracts/performance.md#efficient-algorithms Ordered conjunction short-circuits failed proof. Reached predicates scan unstable/declared or full hash populations and both full directory populations, allocating filtered maps and a relevant-path union. Event comparison resolves D declared paths and can perform C times D native/text/identity overlap work even though normal retained C is bounded. Text bytes and delegated temporary populations remain beyond witness-count bounds; no source bytes are reread here.
+ * @evidenceExclude contracts/performance.md#reuse-equivalent-work This pure predicate consumes an already captured pair; generation capture owns observation sharing and no cross-request cache is coordinated here.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The verdict owns no tracker, retained generation or resource lifecycle; its caller owns the compared observations.
+ */
+export declare function projectWalkStable(props: {
+    /** Pre-compile walk under the primed compiler membership policy. */
+    before: ProjectWalk;
+    /** Whether the wrapper-dependent config view held through the compile. */
+    configStable: boolean;
+    /** Relevant project keys; undefined requires agreement over the whole walk. */
+    declared: ReadonlySet<string> | undefined;
+    /** Native project directory anchoring declared keys for event overlap. */
+    projectRoot: string;
+    /** Post-compile walk under the compiler-reported membership policy. */
+    snapshot: ProjectWalk;
+    /** Observer opened before compile; absence supplies no positive event proof. */
+    tracker: TtscProjectMutationTracker | undefined;
+}): boolean;
+/** The parts of a project walk the verdict compares. */
+type ProjectWalk = Pick<ReturnType<typeof collectProjectInputSnapshot>, "complete" | "directoryComplete" | "fileSignatures" | "hashes" | "projectDirectories" | "unstableFiles">;
+export {};

package/lib/core/transform/generation/projectWalkStable.d.ts

@@ -0,0 +1,68 @@
+import type { collectProjectInputSnapshot } from "../project/collectProjectInputSnapshot";
+import type { TtscProjectMutationTracker } from "../tracker/TtscProjectMutationTracker";
+/**
+ * Whether the project held still across one compile, the half of a capture's
+ * verdict that only evidence spanning the compile can decide
+ * (samchon/ttsc#1383).
+ *
+ * This predicate compares available walks and reported events rather than
+ * freezing the filesystem. With no tracker, it supplies no independent A-B-A
+ * event authority; complete generation admission also requires the compiler
+ * graph and external/host proofs in captureTransformGeneration.
+ *
+ * The walks compare recorded bytes and metadata. A healthy tracker opened
+ * before the compile can supply independent A-B-A event evidence: a producer
+ * can restore both bytes and timestamps before the second walk, but it cannot
+ * withdraw an event already recorded. This predicate accepts the records when
+ * the configuration did, both walks are complete for the declared inputs, those
+ * inputs kept their content and metadata, every directory that can hold a
+ * program input kept its membership, and the tracker saw neither a content
+ * event on a declared input nor a membership event. It reads recorded
+ * event/overflow/membership fields, not tracker failed, unverified or coverage
+ * state; supplying a tracker does not itself prove that every native mutation
+ * was delivered. Actual backend/proof authority stays with the tracker and
+ * generation-admission owners.
+ *
+ * That tracker is the only one accepted. The host-input and candidate trackers
+ * open after the compile returns, so they never saw what it read. A change in
+ * their window before the capture's own reads is visible to those reads, and a
+ * change after them stays queued as a path witness for the next delivery. Their
+ * events used to fail the attempt anyway, which turned `vitest` writing its
+ * cache under `node_modules` beside a dev server into a terminal "could not
+ * capture a reusable transform generation" error.
+ *
+ * @param props.before The project walk taken before the compile.
+ * @param props.configStable Whether the configuration held still.
+ * @param props.declared The generation's declared project inputs, or
+ *   `undefined` for an envelope that declares none, which compares the whole
+ *   walk.
+ * @param props.projectRoot The root the declared keys are relative to.
+ * @param props.snapshot The project walk taken after the compile.
+ * @param props.tracker The project tracker opened before the compile, if one
+ *   could be opened.
+ * @evidence contracts/common.md#principled-implementation Complete walks must agree on declared content, metadata and relevant directory membership, and recorded compile-time events/overflow/membership must not refute them. Independent A-B-A authority requires a healthy, relevant backend; this predicate does not check tracker health/coverage and is not an atomic filesystem freeze or full generation proof.
+ * @evidence contracts/common.md#clear-and-simple-design The verdict composes existing walk, hash, directory and event predicates without duplicating their evidence collection or tracker ownership.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Unknown declared scope compares the full walk, omitted tracker events remain conservative, and no bundler cache filename exception replaces the actual compile-window distinction.
+ * @evidence contracts/common.md#meaningful-documentation Native paragraphs explain the temporal witness boundary and narrower role of later trackers; props identify before/after observations and undefined declared scope.
+ * @evidence contracts/portability.md#os-neutral-implementation Native identity/event overlap policy stays with trackerChangedDeclaredProjectInput and the supplied filesystem observations; this predicate introduces no OS-name or separator-based case rule.
+ * @evidence contracts/performance.md#efficient-algorithms Ordered conjunction short-circuits failed proof. Reached predicates scan unstable/declared or full hash populations and both full directory populations, allocating filtered maps and a relevant-path union. Event comparison resolves D declared paths and can perform C times D native/text/identity overlap work even though normal retained C is bounded. Text bytes and delegated temporary populations remain beyond witness-count bounds; no source bytes are reread here.
+ * @evidenceExclude contracts/performance.md#reuse-equivalent-work This pure predicate consumes an already captured pair; generation capture owns observation sharing and no cross-request cache is coordinated here.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The verdict owns no tracker, retained generation or resource lifecycle; its caller owns the compared observations.
+ */
+export declare function projectWalkStable(props: {
+    /** Pre-compile walk under the primed compiler membership policy. */
+    before: ProjectWalk;
+    /** Whether the wrapper-dependent config view held through the compile. */
+    configStable: boolean;
+    /** Relevant project keys; undefined requires agreement over the whole walk. */
+    declared: ReadonlySet<string> | undefined;
+    /** Native project directory anchoring declared keys for event overlap. */
+    projectRoot: string;
+    /** Post-compile walk under the compiler-reported membership policy. */
+    snapshot: ProjectWalk;
+    /** Observer opened before compile; absence supplies no positive event proof. */
+    tracker: TtscProjectMutationTracker | undefined;
+}): boolean;
+/** The parts of a project walk the verdict compares. */
+type ProjectWalk = Pick<ReturnType<typeof collectProjectInputSnapshot>, "complete" | "directoryComplete" | "fileSignatures" | "hashes" | "projectDirectories" | "unstableFiles">;
+export {};

package/lib/core/transform/generation/projectWalkStable.js

@@ -0,0 +1,69 @@
+'use strict';
+
+var sameHashes = require('../validation/sameHashes.js');
+var sameProjectDirectories = require('../validation/sameProjectDirectories.js');
+var walkSnapshotComplete = require('../validation/walkSnapshotComplete.js');
+var trackerChangedDeclaredProjectInput = require('./trackerChangedDeclaredProjectInput.js');
+
+/**
+ * Whether the project held still across one compile, the half of a capture's
+ * verdict that only evidence spanning the compile can decide
+ * (samchon/ttsc#1383).
+ *
+ * This predicate compares available walks and reported events rather than
+ * freezing the filesystem. With no tracker, it supplies no independent A-B-A
+ * event authority; complete generation admission also requires the compiler
+ * graph and external/host proofs in captureTransformGeneration.
+ *
+ * The walks compare recorded bytes and metadata. A healthy tracker opened
+ * before the compile can supply independent A-B-A event evidence: a producer
+ * can restore both bytes and timestamps before the second walk, but it cannot
+ * withdraw an event already recorded. This predicate accepts the records when
+ * the configuration did, both walks are complete for the declared inputs, those
+ * inputs kept their content and metadata, every directory that can hold a
+ * program input kept its membership, and the tracker saw neither a content
+ * event on a declared input nor a membership event. It reads recorded
+ * event/overflow/membership fields, not tracker failed, unverified or coverage
+ * state; supplying a tracker does not itself prove that every native mutation
+ * was delivered. Actual backend/proof authority stays with the tracker and
+ * generation-admission owners.
+ *
+ * That tracker is the only one accepted. The host-input and candidate trackers
+ * open after the compile returns, so they never saw what it read. A change in
+ * their window before the capture's own reads is visible to those reads, and a
+ * change after them stays queued as a path witness for the next delivery. Their
+ * events used to fail the attempt anyway, which turned `vitest` writing its
+ * cache under `node_modules` beside a dev server into a terminal "could not
+ * capture a reusable transform generation" error.
+ *
+ * @param props.before The project walk taken before the compile.
+ * @param props.configStable Whether the configuration held still.
+ * @param props.declared The generation's declared project inputs, or
+ *   `undefined` for an envelope that declares none, which compares the whole
+ *   walk.
+ * @param props.projectRoot The root the declared keys are relative to.
+ * @param props.snapshot The project walk taken after the compile.
+ * @param props.tracker The project tracker opened before the compile, if one
+ *   could be opened.
+ * @evidence contracts/common.md#principled-implementation Complete walks must agree on declared content, metadata and relevant directory membership, and recorded compile-time events/overflow/membership must not refute them. Independent A-B-A authority requires a healthy, relevant backend; this predicate does not check tracker health/coverage and is not an atomic filesystem freeze or full generation proof.
+ * @evidence contracts/common.md#clear-and-simple-design The verdict composes existing walk, hash, directory and event predicates without duplicating their evidence collection or tracker ownership.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Unknown declared scope compares the full walk, omitted tracker events remain conservative, and no bundler cache filename exception replaces the actual compile-window distinction.
+ * @evidence contracts/common.md#meaningful-documentation Native paragraphs explain the temporal witness boundary and narrower role of later trackers; props identify before/after observations and undefined declared scope.
+ * @evidence contracts/portability.md#os-neutral-implementation Native identity/event overlap policy stays with trackerChangedDeclaredProjectInput and the supplied filesystem observations; this predicate introduces no OS-name or separator-based case rule.
+ * @evidence contracts/performance.md#efficient-algorithms Ordered conjunction short-circuits failed proof. Reached predicates scan unstable/declared or full hash populations and both full directory populations, allocating filtered maps and a relevant-path union. Event comparison resolves D declared paths and can perform C times D native/text/identity overlap work even though normal retained C is bounded. Text bytes and delegated temporary populations remain beyond witness-count bounds; no source bytes are reread here.
+ * @evidenceExclude contracts/performance.md#reuse-equivalent-work This pure predicate consumes an already captured pair; generation capture owns observation sharing and no cross-request cache is coordinated here.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The verdict owns no tracker, retained generation or resource lifecycle; its caller owns the compared observations.
+ */
+function projectWalkStable(props) {
+    return (props.configStable &&
+        walkSnapshotComplete.walkSnapshotComplete(props.before, props.declared) &&
+        walkSnapshotComplete.walkSnapshotComplete(props.snapshot, props.declared) &&
+        sameHashes.sameHashes(props.before.hashes, props.snapshot.hashes, props.declared) &&
+        sameHashes.sameHashes(props.before.fileSignatures, props.snapshot.fileSignatures, props.declared) &&
+        sameProjectDirectories.sameProjectDirectories(props.before.projectDirectories, props.snapshot.projectDirectories) &&
+        !trackerChangedDeclaredProjectInput.trackerChangedDeclaredProjectInput(props.tracker, props.declared, props.projectRoot) &&
+        props.tracker?.membershipChanged !== true);
+}
+
+exports.projectWalkStable = projectWalkStable;
+//# sourceMappingURL=projectWalkStable.js.map

package/lib/core/transform/generation/projectWalkStable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectWalkStable.js","sources":["../../../../src/core/transform/generation/projectWalkStable.ts"],"sourcesContent":[null],"names":["walkSnapshotComplete","sameHashes","sameProjectDirectories","trackerChangedDeclaredProjectInput"],"mappings":";;;;;;;AAOA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDG;AACG,SAAU,iBAAiB,CAAC,KAkBjC,EAAA;IACC,QACE,KAAK,CAAC,YAAY;QAClBA,yCAAoB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC;QAClDA,yCAAoB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC;AACpD,QAAAC,qBAAU,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC;AACtE,QAAAA,qBAAU,CACR,KAAK,CAAC,MAAM,CAAC,cAAc,EAC3B,KAAK,CAAC,QAAQ,CAAC,cAAc,EAC7B,KAAK,CAAC,QAAQ,CACf;AACD,QAAAC,6CAAsB,CACpB,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAC/B,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAClC;AACD,QAAA,CAACC,qEAAkC,CACjC,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,WAAW,CAClB;AACD,QAAA,KAAK,CAAC,OAAO,EAAE,iBAAiB,KAAK,IAAI;AAE7C;;;;"}

package/lib/core/transform/generation/projectWalkStable.mjs

@@ -0,0 +1,67 @@
+import { sameHashes } from '../validation/sameHashes.mjs';
+import { sameProjectDirectories } from '../validation/sameProjectDirectories.mjs';
+import { walkSnapshotComplete } from '../validation/walkSnapshotComplete.mjs';
+import { trackerChangedDeclaredProjectInput } from './trackerChangedDeclaredProjectInput.mjs';
+
+/**
+ * Whether the project held still across one compile, the half of a capture's
+ * verdict that only evidence spanning the compile can decide
+ * (samchon/ttsc#1383).
+ *
+ * This predicate compares available walks and reported events rather than
+ * freezing the filesystem. With no tracker, it supplies no independent A-B-A
+ * event authority; complete generation admission also requires the compiler
+ * graph and external/host proofs in captureTransformGeneration.
+ *
+ * The walks compare recorded bytes and metadata. A healthy tracker opened
+ * before the compile can supply independent A-B-A event evidence: a producer
+ * can restore both bytes and timestamps before the second walk, but it cannot
+ * withdraw an event already recorded. This predicate accepts the records when
+ * the configuration did, both walks are complete for the declared inputs, those
+ * inputs kept their content and metadata, every directory that can hold a
+ * program input kept its membership, and the tracker saw neither a content
+ * event on a declared input nor a membership event. It reads recorded
+ * event/overflow/membership fields, not tracker failed, unverified or coverage
+ * state; supplying a tracker does not itself prove that every native mutation
+ * was delivered. Actual backend/proof authority stays with the tracker and
+ * generation-admission owners.
+ *
+ * That tracker is the only one accepted. The host-input and candidate trackers
+ * open after the compile returns, so they never saw what it read. A change in
+ * their window before the capture's own reads is visible to those reads, and a
+ * change after them stays queued as a path witness for the next delivery. Their
+ * events used to fail the attempt anyway, which turned `vitest` writing its
+ * cache under `node_modules` beside a dev server into a terminal "could not
+ * capture a reusable transform generation" error.
+ *
+ * @param props.before The project walk taken before the compile.
+ * @param props.configStable Whether the configuration held still.
+ * @param props.declared The generation's declared project inputs, or
+ *   `undefined` for an envelope that declares none, which compares the whole
+ *   walk.
+ * @param props.projectRoot The root the declared keys are relative to.
+ * @param props.snapshot The project walk taken after the compile.
+ * @param props.tracker The project tracker opened before the compile, if one
+ *   could be opened.
+ * @evidence contracts/common.md#principled-implementation Complete walks must agree on declared content, metadata and relevant directory membership, and recorded compile-time events/overflow/membership must not refute them. Independent A-B-A authority requires a healthy, relevant backend; this predicate does not check tracker health/coverage and is not an atomic filesystem freeze or full generation proof.
+ * @evidence contracts/common.md#clear-and-simple-design The verdict composes existing walk, hash, directory and event predicates without duplicating their evidence collection or tracker ownership.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Unknown declared scope compares the full walk, omitted tracker events remain conservative, and no bundler cache filename exception replaces the actual compile-window distinction.
+ * @evidence contracts/common.md#meaningful-documentation Native paragraphs explain the temporal witness boundary and narrower role of later trackers; props identify before/after observations and undefined declared scope.
+ * @evidence contracts/portability.md#os-neutral-implementation Native identity/event overlap policy stays with trackerChangedDeclaredProjectInput and the supplied filesystem observations; this predicate introduces no OS-name or separator-based case rule.
+ * @evidence contracts/performance.md#efficient-algorithms Ordered conjunction short-circuits failed proof. Reached predicates scan unstable/declared or full hash populations and both full directory populations, allocating filtered maps and a relevant-path union. Event comparison resolves D declared paths and can perform C times D native/text/identity overlap work even though normal retained C is bounded. Text bytes and delegated temporary populations remain beyond witness-count bounds; no source bytes are reread here.
+ * @evidenceExclude contracts/performance.md#reuse-equivalent-work This pure predicate consumes an already captured pair; generation capture owns observation sharing and no cross-request cache is coordinated here.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The verdict owns no tracker, retained generation or resource lifecycle; its caller owns the compared observations.
+ */
+function projectWalkStable(props) {
+    return (props.configStable &&
+        walkSnapshotComplete(props.before, props.declared) &&
+        walkSnapshotComplete(props.snapshot, props.declared) &&
+        sameHashes(props.before.hashes, props.snapshot.hashes, props.declared) &&
+        sameHashes(props.before.fileSignatures, props.snapshot.fileSignatures, props.declared) &&
+        sameProjectDirectories(props.before.projectDirectories, props.snapshot.projectDirectories) &&
+        !trackerChangedDeclaredProjectInput(props.tracker, props.declared, props.projectRoot) &&
+        props.tracker?.membershipChanged !== true);
+}
+
+export { projectWalkStable };
+//# sourceMappingURL=projectWalkStable.mjs.map

package/lib/core/transform/generation/projectWalkStable.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectWalkStable.mjs","sources":["../../../../src/core/transform/generation/projectWalkStable.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;;AAOA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDG;AACG,SAAU,iBAAiB,CAAC,KAkBjC,EAAA;IACC,QACE,KAAK,CAAC,YAAY;QAClB,oBAAoB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC;QAClD,oBAAoB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC;AACpD,QAAA,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC;AACtE,QAAA,UAAU,CACR,KAAK,CAAC,MAAM,CAAC,cAAc,EAC3B,KAAK,CAAC,QAAQ,CAAC,cAAc,EAC7B,KAAK,CAAC,QAAQ,CACf;AACD,QAAA,sBAAsB,CACpB,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAC/B,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAClC;AACD,QAAA,CAAC,kCAAkC,CACjC,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,WAAW,CAClB;AACD,QAAA,KAAK,CAAC,OAAO,EAAE,iBAAiB,KAAK,IAAI;AAE7C;;;;"}

package/lib/core/transform/generation/recordGenerationProofFailure.d.cts

@@ -0,0 +1,18 @@
+import type { TtscGenerationProofFailure } from "./TtscGenerationProofFailure.cjs";
+import type { TtscGenerationProofFailures } from "./TtscGenerationProofFailures.cjs";
+/**
+ * Retain one unique proof witness without allowing diagnostics to grow freely.
+ * Duplicate identities of retained entries are ignored. Once the collection is
+ * full, new occurrences increment a saturated omitted count; dropped identities
+ * are not retained, so later repetitions of a dropped witness count again.
+ *
+ * @evidence contracts/common.md#principled-implementation A JSON tuple of domain, kind, path and detail defines witness identity, seen deduplicates retained entries and the entry bound plus saturated omitted counter represent evidence loss explicitly.
+ * @evidence contracts/common.md#clear-and-simple-design One recorder owns identity, retained bounds and omission accounting so merge and capture callers share the same aggregate policy.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts The eight-entry bound limits diagnostic storage rather than changing the proof verdict; omitted remains visible and no discarded witness is certified irrelevant.
+ * @evidence contracts/common.md#meaningful-documentation Native paragraphs state retained duplicate handling and the dropped-occurrence limitation, while the internal comment explains why seen shares the storage bound.
+ * @evidence contracts/performance.md#efficient-algorithms Identity encoding costs the witness text length and Set membership is direct; insertion touches one entry without rescanning the aggregate.
+ * @evidence contracts/performance.md#reuse-equivalent-work Retained seen keys prevent repeated insertion of the same printable witness; dropped identities intentionally are not shared because doing so would require unbounded storage.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources Entries and seen retain at most eight witnesses/keys per attempt, and omitted saturates at MAX_SAFE_INTEGER; text bytes depend on producer witness lengths rather than a claimed byte-size bound.
+ * @evidenceExclude contracts/portability.md#os-neutral-implementation Stores the path strings it is given inside a JSON identity key without parsing or comparing them as paths.
+ */
+export declare function recordGenerationProofFailure(failures: TtscGenerationProofFailures, failure: TtscGenerationProofFailure): void;

package/lib/core/transform/generation/recordGenerationProofFailure.d.mts

@@ -0,0 +1,18 @@
+import type { TtscGenerationProofFailure } from "./TtscGenerationProofFailure.mjs";
+import type { TtscGenerationProofFailures } from "./TtscGenerationProofFailures.mjs";
+/**
+ * Retain one unique proof witness without allowing diagnostics to grow freely.
+ * Duplicate identities of retained entries are ignored. Once the collection is
+ * full, new occurrences increment a saturated omitted count; dropped identities
+ * are not retained, so later repetitions of a dropped witness count again.
+ *
+ * @evidence contracts/common.md#principled-implementation A JSON tuple of domain, kind, path and detail defines witness identity, seen deduplicates retained entries and the entry bound plus saturated omitted counter represent evidence loss explicitly.
+ * @evidence contracts/common.md#clear-and-simple-design One recorder owns identity, retained bounds and omission accounting so merge and capture callers share the same aggregate policy.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts The eight-entry bound limits diagnostic storage rather than changing the proof verdict; omitted remains visible and no discarded witness is certified irrelevant.
+ * @evidence contracts/common.md#meaningful-documentation Native paragraphs state retained duplicate handling and the dropped-occurrence limitation, while the internal comment explains why seen shares the storage bound.
+ * @evidence contracts/performance.md#efficient-algorithms Identity encoding costs the witness text length and Set membership is direct; insertion touches one entry without rescanning the aggregate.
+ * @evidence contracts/performance.md#reuse-equivalent-work Retained seen keys prevent repeated insertion of the same printable witness; dropped identities intentionally are not shared because doing so would require unbounded storage.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources Entries and seen retain at most eight witnesses/keys per attempt, and omitted saturates at MAX_SAFE_INTEGER; text bytes depend on producer witness lengths rather than a claimed byte-size bound.
+ * @evidenceExclude contracts/portability.md#os-neutral-implementation Stores the path strings it is given inside a JSON identity key without parsing or comparing them as paths.
+ */
+export declare function recordGenerationProofFailure(failures: TtscGenerationProofFailures, failure: TtscGenerationProofFailure): void;

package/lib/core/transform/generation/recordGenerationProofFailure.d.ts

@@ -0,0 +1,18 @@
+import type { TtscGenerationProofFailure } from "./TtscGenerationProofFailure";
+import type { TtscGenerationProofFailures } from "./TtscGenerationProofFailures";
+/**
+ * Retain one unique proof witness without allowing diagnostics to grow freely.
+ * Duplicate identities of retained entries are ignored. Once the collection is
+ * full, new occurrences increment a saturated omitted count; dropped identities
+ * are not retained, so later repetitions of a dropped witness count again.
+ *
+ * @evidence contracts/common.md#principled-implementation A JSON tuple of domain, kind, path and detail defines witness identity, seen deduplicates retained entries and the entry bound plus saturated omitted counter represent evidence loss explicitly.
+ * @evidence contracts/common.md#clear-and-simple-design One recorder owns identity, retained bounds and omission accounting so merge and capture callers share the same aggregate policy.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts The eight-entry bound limits diagnostic storage rather than changing the proof verdict; omitted remains visible and no discarded witness is certified irrelevant.
+ * @evidence contracts/common.md#meaningful-documentation Native paragraphs state retained duplicate handling and the dropped-occurrence limitation, while the internal comment explains why seen shares the storage bound.
+ * @evidence contracts/performance.md#efficient-algorithms Identity encoding costs the witness text length and Set membership is direct; insertion touches one entry without rescanning the aggregate.
+ * @evidence contracts/performance.md#reuse-equivalent-work Retained seen keys prevent repeated insertion of the same printable witness; dropped identities intentionally are not shared because doing so would require unbounded storage.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources Entries and seen retain at most eight witnesses/keys per attempt, and omitted saturates at MAX_SAFE_INTEGER; text bytes depend on producer witness lengths rather than a claimed byte-size bound.
+ * @evidenceExclude contracts/portability.md#os-neutral-implementation Stores the path strings it is given inside a JSON identity key without parsing or comparing them as paths.
+ */
+export declare function recordGenerationProofFailure(failures: TtscGenerationProofFailures, failure: TtscGenerationProofFailure): void;

package/lib/core/transform/generation/recordGenerationProofFailure.js

@@ -0,0 +1,41 @@
+'use strict';
+
+/** Maximum witnesses printed and retained for each failed transform attempt. */
+const MAX_GENERATION_PROOF_FAILURES = 8;
+/**
+ * Retain one unique proof witness without allowing diagnostics to grow freely.
+ * Duplicate identities of retained entries are ignored. Once the collection is
+ * full, new occurrences increment a saturated omitted count; dropped identities
+ * are not retained, so later repetitions of a dropped witness count again.
+ *
+ * @evidence contracts/common.md#principled-implementation A JSON tuple of domain, kind, path and detail defines witness identity, seen deduplicates retained entries and the entry bound plus saturated omitted counter represent evidence loss explicitly.
+ * @evidence contracts/common.md#clear-and-simple-design One recorder owns identity, retained bounds and omission accounting so merge and capture callers share the same aggregate policy.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts The eight-entry bound limits diagnostic storage rather than changing the proof verdict; omitted remains visible and no discarded witness is certified irrelevant.
+ * @evidence contracts/common.md#meaningful-documentation Native paragraphs state retained duplicate handling and the dropped-occurrence limitation, while the internal comment explains why seen shares the storage bound.
+ * @evidence contracts/performance.md#efficient-algorithms Identity encoding costs the witness text length and Set membership is direct; insertion touches one entry without rescanning the aggregate.
+ * @evidence contracts/performance.md#reuse-equivalent-work Retained seen keys prevent repeated insertion of the same printable witness; dropped identities intentionally are not shared because doing so would require unbounded storage.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources Entries and seen retain at most eight witnesses/keys per attempt, and omitted saturates at MAX_SAFE_INTEGER; text bytes depend on producer witness lengths rather than a claimed byte-size bound.
+ * @evidenceExclude contracts/portability.md#os-neutral-implementation Stores the path strings it is given inside a JSON identity key without parsing or comparing them as paths.
+ */
+function recordGenerationProofFailure(failures, failure) {
+    const key = JSON.stringify([
+        failure.domain,
+        failure.kind,
+        failure.path,
+        failure.detail,
+    ]);
+    if (failures.seen.has(key))
+        return;
+    if (failures.entries.length < MAX_GENERATION_PROOF_FAILURES) {
+        // `seen` follows the same bound as `entries`: retaining every discarded
+        // identity would make a bounded diagnostic an unbounded memory sink.
+        failures.seen.add(key);
+        failures.entries.push(failure);
+    }
+    else {
+        failures.omitted = Math.min(Number.MAX_SAFE_INTEGER, failures.omitted + 1);
+    }
+}
+
+exports.recordGenerationProofFailure = recordGenerationProofFailure;
+//# sourceMappingURL=recordGenerationProofFailure.js.map

package/lib/core/transform/generation/recordGenerationProofFailure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recordGenerationProofFailure.js","sources":["../../../../src/core/transform/generation/recordGenerationProofFailure.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAGA;AACA,MAAM,6BAA6B,GAAG,CAAC;AAEvC;;;;;;;;;;;;;;AAcG;AACG,SAAU,4BAA4B,CAC1C,QAAqC,EACrC,OAAmC,EAAA;AAEnC,IAAA,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;AACzB,QAAA,OAAO,CAAC,MAAM;AACd,QAAA,OAAO,CAAC,IAAI;AACZ,QAAA,OAAO,CAAC,IAAI;AACZ,QAAA,OAAO,CAAC,MAAM;AACf,KAAA,CAAC;AACF,IAAA,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE;IAC5B,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,6BAA6B,EAAE;;;AAG3D,QAAA,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AACtB,QAAA,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;IAChC;SAAO;AACL,QAAA,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC;IAC5E;AACF;;;;"}