@ttsc/unplugin 0.31.0 → 0.31.1

package/src/core/observer/createInputObserver.ts

@@ -217,11 +217,12 @@ export function createInputObserver(
   let poller: { close(): void } | undefined;
   let flushTimer: NodeJS.Timeout | undefined;
 
-  // Windows and macOS run every native observer in the isolated watch broker:
-  // Windows so an abort in Node's fs-event backend cannot take the host process
-  // down with it (samchon/ttsc#1411), and macOS so each scope is its own
-  // FSEventStream, whose dropped events are reported instead of lost
-  // (samchon/ttsc#1418, samchon/ttsc#1425).
+  // Windows uses ttsc's native completion-port helper, excluding access-only
+  // notifications without opening Node fs-event handles (samchon/ttsc#1719).
+  // Do not restore fs.watch here: reads can invalidate an unchanged generation,
+  // and deleting a watched temporary tree can abort Node (samchon/ttsc#1411).
+  // macOS keeps each scope in its own brokered FSEventStream, whose dropped
+  // events are reported instead of lost (samchon/ttsc#1418, samchon/ttsc#1425).
   const open =
     operations.watch ??
     (process.platform === "win32" || process.platform === "darwin"

package/src/core/observer/openIsolatedRecursiveWatch.ts

@@ -7,18 +7,17 @@ import { openBrokeredWatch } from "../transform/tracker/broker/openBrokeredWatch
  * Open one recursive observer inside the transform core's isolated watch broker
  * instead of the host process.
  *
- * On Windows, Node's fs-event backend can abort the process that owns a watch,
- * for instance with `Assertion failed: !_wcsnicmp(filename, dir, dirlen)` in
- * `src\win\fs-event.c` (samchon/ttsc#1411). On macOS, libuv serves every
- * directory watch of a loop through one FSEventStream and re-creates it
- * whenever any watch opens or closes, losing the events in between
- * (samchon/ttsc#1418), where the broker opens one stream per watch. The
- * observer's scopes get the isolation the transform core's trackers have,
- * through the same registration (`openBrokeredWatch`) with a sink of their own
- * that forwards events (samchon/ttsc#1485). Attributed events reach `listener`
- * with a joined caller-directory path; unattributed events use null. A failed
- * registration reaches `onError`, which hands the scope's entries to the
- * bounded poll.
+ * On Windows, ttsc's direct native helper excludes access-only notifications
+ * and reports actual mutation, loss and failure through the same broker sink.
+ * On macOS, libuv serves every directory watch of a loop through one
+ * FSEventStream and re-creates it whenever any watch opens or closes, losing
+ * the events in between (samchon/ttsc#1418), where the broker opens one stream
+ * per watch. The observer's scopes get the isolation the transform core's
+ * trackers have, through the same registration (`openBrokeredWatch`) with a
+ * sink of their own that forwards events (samchon/ttsc#1485). Attributed events
+ * reach `listener` with a joined caller-directory path; unattributed events use
+ * null. A failed registration reaches `onError`, which hands the scope's
+ * entries to the bounded poll.
  *
  * Registration completes asynchronously, and FSEvents can later drop events
  * (samchon/ttsc#1425). Until the broker confirms the watch, and whenever it

package/src/core/transform/cache/TtscCachedProjectTransform.ts

@@ -232,12 +232,22 @@ export interface TtscCachedProjectTransform {
 
   /**
    * A locally admitted answer with incomplete host observations cannot be
-   * retained for resident, shared or persistent reuse. Successful answers need
-   * only explicit unavailable observations; diagnostic admission keeps its
-   * existing current-verdict policy. This flag never grants admission itself.
+   * retained for shared or persistent reuse. A separately admitted coherent
+   * local success may share first deliveries only in its explicit nonwatching
+   * pass (passDeliveryOnly). Successful answers need only explicit unavailable
+   * observations; diagnostic admission keeps its existing current-verdict
+   * policy. This flag never grants admission itself.
    */
   freshDeliveryOnly?: boolean;
 
+  /**
+   * Coherent local success whose only missing authority is host observation.
+   * WARNING (#1713): this grants neither persistent nor pooled reuse. The
+   * common proof owner requires an explicit nonwatching pass, a recorded
+   * source, first delivery and actual host-cache withdrawal on every delivery.
+   */
+  passDeliveryOnly?: boolean;
+
   /** Absolute path to the directory that owns the tsconfig. */
   projectRoot: string;
 

package/src/core/transform/cache/selectCachedGenerationAction.ts

@@ -1,5 +1,6 @@
 import { envelopeDerivation } from "../envelope/envelopeDerivation";
 import { isVolatileFile } from "../envelope/isVolatileFile";
+import type { TtscGenerationProof } from "../validation/TtscGenerationProof";
 import { matchesCachedSource } from "../validation/matchesCachedSource";
 import type { TtscCachedProjectTransform } from "./TtscCachedProjectTransform";
 import type { TtscTransformCache } from "./TtscTransformCache";
@@ -42,6 +43,7 @@ export function selectCachedGenerationAction(props: {
   generation: Promise<TtscCachedProjectTransform>;
   key: string;
   source: string;
+  proof?: TtscGenerationProof.Transaction;
 }): "serve" | "retry" | "capture" {
   if (
     !isVolatileFile(envelopeDerivation(props.cached), {
@@ -49,7 +51,13 @@ export function selectCachedGenerationAction(props: {
       projectRoot: props.cached.projectRoot,
       result: props.cached.result,
     }) &&
-    matchesCachedSource(props.cached, props.file, props.source, props.epoch)
+    matchesCachedSource(
+      props.cached,
+      props.file,
+      props.source,
+      props.epoch,
+      props.proof,
+    )
   ) {
     return "serve";
   }

package/src/core/transform/deliverCachedTransform.ts

@@ -0,0 +1,97 @@
+import type { TtscCachedProjectTransform } from "./cache/TtscCachedProjectTransform";
+import type { TtscTransformCache } from "./cache/TtscTransformCache";
+import { evictGeneration } from "./cache/evictGeneration";
+import { selectOrEvict } from "./cache/selectOrEvict";
+import { reportMissingProgramOutput } from "./diagnostics/reportMissingProgramOutput";
+import { reportSuccessDiagnostics } from "./diagnostics/reportSuccessDiagnostics";
+import { TtscMissingProgramOutputError } from "./errors/TtscMissingProgramOutputError";
+import { createTransformResult } from "./utils/createTransformResult";
+import { TtscGenerationProof } from "./validation/TtscGenerationProof";
+import { markCachedSourceServed } from "./validation/markCachedSourceServed";
+import type { TtscTransformHooks } from "./watch/TtscTransformHooks";
+import type { TtscWatchSelection } from "./watch/TtscWatchSelection";
+import { notifyFailedGenerationInputs } from "./watch/notifyFailedGenerationInputs";
+import { notifyVolatileDelivery } from "./watch/notifyVolatileDelivery";
+import { notifyWatchInputs } from "./watch/notifyWatchInputs";
+
+/**
+ * Deliver both captured and reused generations through one failure boundary.
+ *
+ * WARNING (#1713): host capabilities and callbacks apply to every delivery,
+ * including cache hits. Incomplete local results must never survive a failed
+ * handoff or acquire a persistent record. Stable ordinary generations retain
+ * their existing callback-failure recovery policy.
+ *
+ * A missing program output is an admitted absence: notify the same selection
+ * inputs and return control to the host. Compile failure retains its existing
+ * terminal policy through selectOrEvict and reports repair inputs.
+ *
+ * @evidence contracts/common.md#principled-implementation Captured and reused results share lifecycle admission, output selection, diagnostics and host handoff; incomplete ownership is evicted on any failed delivery effect, while missing output remains a host fallthrough.
+ * @evidence contracts/common.md#clear-and-simple-design One synchronous boundary removes duplicate initial/cache-hit delivery paths and their divergent callback and cleanup rules.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Missing outputs never manufacture transformed bytes or reusable observation authority; incomplete handoff failure cannot leave an owner for a sibling.
+ * @evidence contracts/common.md#meaningful-documentation Native prose states per-delivery capability, callback failure, missing-output and compile-failure responsibilities.
+ * @evidence contracts/portability.md#os-neutral-implementation Native identities and host spellings remain delegated to the generation's existing output/watch owners.
+ * @evidence contracts/performance.md#efficient-algorithms Selection uses generation indexes; diagnostics, output/map work and current host callbacks remain necessary per delivery. Watch input and record derivation retain their owning population costs.
+ * @evidence contracts/performance.md#reuse-equivalent-work Initial and reused answers share the exact same operation, while generation-owned indexes and the pass-qualified compiled result retain their separate validity premises.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources Fresh-only admission releases capture resources; failed incomplete delivery evicts only its exact Promise. Ordinary selection/terminal and host lifecycle owners retain their established resource policy.
+ */
+export function deliverCachedTransform(props: {
+  cache: TtscTransformCache | undefined;
+  cached: TtscCachedProjectTransform;
+  generation: Promise<TtscCachedProjectTransform>;
+  key: string;
+  epoch: number | undefined;
+  file: string;
+  source: string;
+  hooks: TtscTransformHooks | undefined;
+  selection: TtscWatchSelection;
+}) {
+  const {
+    cache,
+    cached,
+    generation,
+    key,
+    epoch,
+    file,
+    source,
+    hooks,
+    selection,
+  } = props;
+  try {
+    TtscGenerationProof.admitFreshOnly(
+      cached,
+      cache,
+      key,
+      generation,
+      epoch,
+      hooks,
+    );
+    reportSuccessDiagnostics(cached, epoch);
+    let output;
+    try {
+      output = selectOrEvict(cache, key, generation, epoch, {
+        file,
+        projectRoot: cached.projectRoot,
+        result: cached.result,
+        tsconfig: cached.tsconfig,
+      });
+    } catch (error) {
+      if (!(error instanceof TtscMissingProgramOutputError)) {
+        notifyFailedGenerationInputs(hooks, cached, file, selection);
+        throw error;
+      }
+      reportMissingProgramOutput(cached, error, epoch);
+      notifyWatchInputs(hooks, cached, file, selection);
+      markCachedSourceServed(cached, file);
+      return undefined;
+    }
+    notifyWatchInputs(hooks, cached, file, selection);
+    markCachedSourceServed(cached, file);
+    notifyVolatileDelivery(hooks, cached, file);
+    return createTransformResult(file, source, output);
+  } catch (error) {
+    if (cached.freshDeliveryOnly === true)
+      evictGeneration(cache, key, generation);
+    throw error;
+  }
+}

package/src/core/transform/envelope/selectDeclaredProjectInputKeys.ts

@@ -26,8 +26,8 @@ import { isTransformScratchInput } from "../tsconfig/isTransformScratchInput";
  *   Visits each reported occurrence in graph endpoints/globals/configs,
  *   candidates, host inputs and dependency arrays. Native resolve, scratch
  *   checks, project-key identity/ancestor/case observations and text hashing
- *   precede each own-key membership test; duplicate declarations still pay
- *   those queries, with native answers shared by the supplied context. Entry
+ *   precede each own-key membership test after lexical deduplication; repeated
+ *   declarations pay resolution but no repeated native classification. Entry
  *   arrays from Object.entries/Object.values follow producer populations,
  *   while the returned set cannot exceed keys present in the project snapshot.
  * @evidenceExclude contracts/performance.md#reuse-equivalent-work
@@ -49,9 +49,12 @@ export function selectDeclaredProjectInputKeys(props: {
   }
   const graph = props.result.graph;
   const keys = new Set<string>();
+  const seen = new Set<string>();
   const add = (entry: unknown): void => {
     if (typeof entry !== "string" || entry.length === 0) return;
     const absolute = path.resolve(props.projectRoot, entry);
+    if (seen.has(absolute)) return;
+    seen.add(absolute);
     if (isTransformScratchInput(absolute, props.scratchDirectory)) return;
     const key = toProjectKey(props.projectRoot, absolute, props.identities);
     if (Object.prototype.hasOwnProperty.call(props.projectInputHashes, key)) {

package/src/core/transform/envelope/selectExternalInputPaths.ts

@@ -36,17 +36,15 @@ import { envelopeGraphIndexes } from "./envelopeGraphIndexes";
  * @evidence contracts/performance.md#efficient-algorithms
  *   Cold graph index construction precedes separate scans of output, graph,
  *   candidate, dependency and host lists, followed by every collected member's
- *   filter pass. Duplicate occurrences still pay path/identity and candidate
- *   observations before seen rejection; rejected walk members are not added to
- *   seen. Native path/ancestor/case, existence and walk policy/component checks
+ *   filter pass. Lexical deduplication precedes native identity/candidate/walk
+ *   observations, including rejected members; distinct aliases stay separate. Native path/ancestor/case, existence and walk policy/component checks
  *   add costs to list/key text. Collected members, candidate/seen sets and
  *   output allocate population-sized storage; final string sorting adds output
  *   comparison work.
  * @evidence contracts/performance.md#reuse-equivalent-work
  *   Generation state shares completed graph parsing, while this call's native
  *   identity context reuses its qualified path observations. The sets dedupe
- *   emitted lexical names and mark candidate membership; they do not suppress
- *   every repeated classification. Supplied filesystem, producer-derived state
+ *   every lexical classification and mark candidate membership. Supplied filesystem, producer-derived state
  *   and membership policy must represent the same stable generation view.
  * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources
  *   Its collections are local to the call and released on return; only the
@@ -144,6 +142,10 @@ export function selectExternalInputPaths(props: {
     }
     const absolute = path.resolve(props.projectRoot, member);
     const spelling = path.resolve(absolute);
+    // Classify each lexical address once, including rejected walk members.
+    // Physical aliases remain distinct so retargeting is still observable.
+    if (seen.has(spelling)) continue;
+    seen.add(spelling);
     const identity = pathIdentityKey(absolute, identities);
     const observation = graphIndexes.inputObservations.get(spelling);
     const missingCandidate =
@@ -153,7 +155,6 @@ export function selectExternalInputPaths(props: {
     if (
       identity === excluded ||
       isTransformScratchInput(absolute, props.scratchDirectory) ||
-      seen.has(spelling) ||
       (!missingCandidate &&
         isProjectWalkPath(
           props.projectRoot,
@@ -167,7 +168,6 @@ export function selectExternalInputPaths(props: {
     }
     // Preserve distinct lexical aliases even when they currently select the
     // same physical file. A later retarget must validate the alias itself.
-    seen.add(spelling);
     output.push(absolute);
   }
   output.sort();

package/src/core/transform/filesystem/TtscTransformFilesystemOperations.ts

@@ -198,23 +198,26 @@ export interface TtscTransformFilesystemOperations {
    * Open one directory's change notification, or throw when the observed
    * filesystem cannot provide one.
    *
-   * Left undefined, generations watch the host filesystem: in process on Linux,
-   * and through an isolated broker process on Windows and macOS. An embedder
-   * observing another filesystem supplies its own; a generation whose watch
-   * cannot be opened keeps validating from recorded state instead of losing its
-   * cache.
+   * Left undefined, generations watch the host filesystem through the native
+   * Linux helper, the native Windows completion-port helper, or the macOS
+   * FSEvents broker. An embedder observing another filesystem supplies its own;
+   * a generation whose watch cannot be opened keeps validating from recorded
+   * state instead of losing its cache.
    *
-   * Supplying one replaces the broker as well, so an embedder that wraps Node's
-   * own `fs.watch` gives up what the broker provides: on Windows, containing
-   * the native abort Node's fs-event backend can raise when a watched temporary
-   * tree is deleted, and on macOS, one FSEventStream per watch whose dropped
-   * events are reported rather than lost silently.
+   * Supplying one bypasses these native owners. Wrapping Node's `fs.watch`
+   * reintroduces Windows access-only notifications that invalidate unchanged
+   * inputs, and the native abort its fs-event backend can raise when a watched
+   * temporary tree is deleted. It also gives up explicit notification-loss
+   * reporting from the Linux helper and macOS's per-watch FSEventStream.
+   * Preserve mutation and loss reporting when implementing this capability;
+   * timestamps or identical current bytes cannot discard an actual A-B-A
+   * event.
    *
    * @evidence contracts/common.md#principled-implementation The watch capability reports actual directory changes and failure; its absence or failure cannot certify silence as unchanged inputs.
    * @evidence contracts/common.md#clear-and-simple-design One optional native operation exposes observation and a close handle, leaving broker selection and retained-generation proof in their owners.
    * @evidence contracts/common.md#prohibited-implementation-shortcuts Injected watches are explicit capabilities rather than patched fs methods, and errors require recorded-state validation instead of synthetic live coverage.
-   * @evidence contracts/common.md#meaningful-documentation The native paragraphs explain absent overrides, failed watches, broker bypass, and the Windows/macOS capability lost when wrapping fs.watch directly.
-   * @evidence contracts/portability.md#os-neutral-implementation OS-neutral watching requires the observed filesystem's capability and accounts for backend-specific abort isolation and dropped-stream reporting rather than assuming recursive notifications are interchangeable.
+   * @evidence contracts/common.md#meaningful-documentation The native paragraphs explain default owners, failed watches, explicit override authority, access-only noise, native aborts and mutation/loss reporting that a direct fs.watch wrapper cannot supply.
+   * @evidence contracts/portability.md#os-neutral-implementation OS-neutral watching requires the observed filesystem's capability and accounts for native Windows mutation filtering and Linux/macOS loss reporting rather than assuming recursive notifications are interchangeable.
    * @evidenceExclude contracts/performance.md#efficient-algorithms
    *   Only the signature of watch is declared here; the cost belongs to its
    *   implementation.

package/src/core/transform/generation/selectTransformAttemptDisposition.ts

@@ -8,7 +8,9 @@ import { onlyLearnedCompileFacts } from "./onlyLearnedCompileFacts";
  * facts describe the capture; this policy performs no capture or native proof.
  *
  * Coherent results return first. A local, lossless host-observation refusal can
- * transfer one fresh success without reuse authority. Rejected attempts spend
+ * transfer an incomplete local success. TtscGenerationProof owns any sharing of
+ * its first module deliveries inside an explicit nonwatching pass; this policy
+ * grants no independent native or persistent proof. Rejected attempts spend
  * movement only when they neither refute a publication nor solely learn facts.
  * Two movements or four captures stop retrying, retaining a current diagnostic
  * rather than a terminal instability verdict when its config is not refuted.

package/src/core/transform/generation/transformProject.ts

@@ -64,18 +64,20 @@ import { selectTransformAttemptDisposition } from "./selectTransformAttemptDispo
  * (samchon/ttsc#1545).
  *
  * A local success whose only lost premise is explicitly unavailable host
- * observation may qualify for its initiating delivery. The delivery coordinator
- * additionally requires an explicitly nonwatching host with cache-withdrawal
- * capability. It remains incomplete and cannot authorize resident, shared or
- * persistent caching. Actual changes, conflicts and unexplained missing proof
- * retain the stabilization gate.
+ * observation may qualify for local delivery. TtscGenerationProof additionally
+ * requires an explicitly nonwatching host and actual cache withdrawal for every
+ * delivery. It alone can share recorded first-module baselines inside the same
+ * explicit pass. This incomplete result cannot authorize ordinary resident
+ * reuse, a persistent project record or shared publication; repeated modules
+ * and later passes recapture. Actual changes, conflicts and unexplained missing
+ * proof retain the stabilization gate.
  *
  * Enabled private tracing records each computed disposition before its state is
  * applied. It does not supply proof when capture throws or tracing fails.
  *
- * @evidence contracts/common.md#principled-implementation Each capture establishes config coherence and reusable success proof or a current diagnostic verdict; a local stable success with only explicit unavailable host observations instead transfers one fresh delivery without reuse authority, while mixed mutation, missing or conflicting proof retains retry admission.
+ * @evidence contracts/common.md#principled-implementation Each capture establishes config coherence and reusable success proof or a current diagnostic verdict; a local stable success with only explicit unavailable host observations instead transfers an incomplete local result whose bounded first deliveries require the common nonwatching pass owner, while mixed mutation, missing or conflicting proof retains retry admission.
  * @evidence contracts/common.md#clear-and-simple-design The pure attempt policy selects acceptance and retry budgets; this loop owns mutable learned facts and resource handoff, capture owns proof construction, and the shared error builder owns terminal rendering and final disposal.
- * @evidence contracts/common.md#prohibited-implementation-shortcuts Retrying follows learned dependencies/case policy or refuted publication payload rather than an endless workaround chain; only lossless producer-authorized observation unavailability can permit a local fresh answer, and it never becomes a reusable success or excuses actual mutation.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Retrying follows learned dependencies/case policy or refuted publication payload rather than an endless workaround chain; only lossless producer-authorized observation unavailability can permit a local fresh answer, and it never becomes complete or persistent/shared success proof or excuses actual mutation.
  * @evidence contracts/common.md#meaningful-documentation Native paragraphs explain movement versus absolute budgets, failed-compile diagnostics and learned facts; separated props state delivery, tracking and inherited witness meaning.
  * @evidence contracts/portability.md#os-neutral-implementation Each capture delegates native filesystem and compiler behavior to injected host boundaries; reported compiler case policy is carried between attempts rather than guessed from OS names.
  * @evidence contracts/performance.md#efficient-algorithms At most four captures bound retry count, not each capture's project/config/input bytes, native walks, compiler/plugin work, observer setup or session waiting time. Each rejected attempt copies the cumulative witnessed Set and scans its external dependencies into that copy; the next capture receives a separate array of its names; supplied spellings contribute hashing/text cost. Terminal rendering visits retained attempts/witnesses, and disposal delegates observer/probe cleanup rather than making those effects constant work. Enabled tracing serializes disposition scalars and path text through the existing bounded append sink; disabled tracing skips that payload construction.
@@ -200,10 +202,12 @@ export async function transformProject(props: {
       },
     });
     if (disposition.freshDeliveryOnly) {
-      // Neither incomplete diagnostic observations nor a permitted local fresh
-      // success authorizes this generation's reuse beyond its current delivery.
+      // Missing observations never authorize persistent or shared reuse. A
+      // coherent fresh-only local success may separately earn bounded first
+      // deliveries through the common nonwatching pass owner (#1713).
       cached.freshDeliveryOnly = true;
     }
+    if (disposition.kind === "fresh-only") cached.passDeliveryOnly = true;
     if (disposition.kind === "accepted" || disposition.kind === "fresh-only") {
       return cached;
     }

package/src/core/transform/inputs/preparePluginBuildEnvironments.ts

@@ -12,23 +12,30 @@ import { pluginSourceHolds } from "./pluginSourceHolds";
 const asyncResults = new WeakSet<object>();
 
 /**
- * Prepare actual plugin toolchain authority before synchronous input proofs.
+ * Qualify actual plugin toolchain authority before synchronous input proofs.
  * Cold Go/environment/SDK work stays off the host thread. A mismatch requests
  * one fresh native environment reading; observation failure remains unavailable
  * and the following admission or replay validator retains its failure policy. A
  * resident generation can reuse its exact proven source state while healthy
  * notifications and the still-qualified environment witness both hold. Native
- * environment preparation remains mandatory; source events cannot prove it.
+ * environment authority remains mandatory; source events cannot prove it.
+ *
+ * WARNING (#1712): yield before observing queued source changes, then qualify
+ * all current readings in one synchronous batch. Missing readings require an
+ * await and a fresh batch afterward. Source comparisons may request native
+ * refreshes; the caller must establish another current proof after those
+ * awaits. Never preserve a positive batch across an await or replay the SDK
+ * witness independently for every plugin and nested validator.
  *
  * @param cached Optional resident generation whose existing source-state and
  *   environment witness may qualify source reuse. Other preparation owners
  *   retain direct source comparison.
- * @evidence contracts/common.md#principled-implementation Every reported plugin directory prepares its actual current environment. The same result's matching manifest state can share source proof only with a healthy exact-source tracker and the environment under which that tree was proven. Otherwise this operation compares source state once and a mismatch refreshes environment authority for the following owning validator to compare again; failed preparation cannot qualify an input.
+ * @evidence contracts/common.md#principled-implementation Every reported plugin directory qualifies current environment authority; only missing readings require asynchronous preparation. The same result's matching manifest state can share source proof only with a healthy exact-source tracker and the environment under which that tree was proven. Otherwise this operation compares source state once and a mismatch refreshes environment authority for the following owning validator to compare again; failed preparation cannot qualify an input.
  * @evidence contracts/common.md#clear-and-simple-design One async boundary precedes existing synchronous generation, delivery and terminal proofs.
  * @evidence contracts/common.md#prohibited-implementation-shortcuts Missing observations stay unproved; reported binary state never substitutes for native environment preparation or source comparison.
  * @evidence contracts/common.md#meaningful-documentation Native prose identifies off-thread work, mismatch refresh and preserved downstream failure ownership.
  * @evidence contracts/portability.md#os-neutral-implementation The same native toolchain/environment reader and caller filesystem source digest qualify each directory without platform guesses.
- * @evidence contracts/performance.md#efficient-algorithms The envelope selector builds its directory map once per result, and preparation visits each reported directory once. Environment requests build keys from effective variables and qualify native dependencies. A qualified source witness avoids enumeration; other source comparisons enumerate and sort files, check metadata and hash bytes when the digest cannot be reused. A mismatch requests one environment refresh rather than a second source comparison here.
+ * @evidence contracts/performance.md#efficient-algorithms The envelope selector indexes directories once per result. Linear directory passes batch-qualify current readings, prepare missing authority, compare source state and refresh mismatches. Each synchronous batch hashes variables once and shares distinct native dependencies; any preparation await requires another current batch. A qualified source witness avoids enumeration; other source comparisons enumerate and sort files, check metadata and hash bytes when the digest cannot be reused. A mismatch requests one environment refresh rather than a second source comparison here.
  * @evidence contracts/performance.md#reuse-equivalent-work The environment owner shares equivalent in-flight requests and still-qualified readings. Resident source proof is reused only for the exact result and manifest digest, unchanged qualified environment and currently healthy covered source notifications; absent, dirty, replaced or unavailable witnesses retain direct proof. No epoch or quiet watcher alone authorizes reuse, and subsequent admission still owns its current validation.
  * @evidence contracts/performance.md#bound-retention-and-release-resources This module records asynchronous execution ownership in a WeakSet before preparation, including failures, so disposed results are not retained. Requests and worker lifetimes remain with the environment owner; this sequential operation awaits each request and acquires no native observer or independent cancellation handle.
  */
@@ -38,10 +45,30 @@ export async function preparePluginBuildEnvironments(
   cached?: TtscCachedProjectTransform,
 ): Promise<void> {
   asyncResults.add(result);
-  for (const [directory, state] of selectPluginSourceInputs(result)) {
+  const sources = selectPluginSourceInputs(result);
+  // Preserve the async preparation boundary even for warm environments.
+  // Events queued by the caller before awaiting preparation must participate
+  // in the source witness below. Observe the batch after this yield, never
+  // carry a positive environment observation across it (#1712).
+  await Promise.resolve();
+  const current = PluginBuildEnvironmentReadings.cachedAll(sources.keys());
+  let awaited = false;
+  for (const directory of sources.keys()) {
+    if (current.get(directory) !== undefined) continue;
+    awaited = true;
     try {
       await PluginBuildEnvironmentReadings.prepare(directory);
-      const environment = PluginBuildEnvironmentReadings.cached(directory);
+    } catch {
+      // Keep unavailable authority for admission rather than cold fallback.
+    }
+  }
+  const environments = awaited
+    ? PluginBuildEnvironmentReadings.cachedAll(sources.keys())
+    : current;
+  const refresh: string[] = [];
+  for (const [directory, state] of sources) {
+    try {
+      const environment = environments.get(directory);
       if (
         cached?.result === result &&
         cached.hostInputValidation?.trees.get(directory) === state &&
@@ -56,12 +83,19 @@ export async function preparePluginBuildEnvironments(
           environment,
         })
       )
-        await PluginBuildEnvironmentReadings.prepare(directory, true);
+        refresh.push(directory);
     } catch {
       // Admission and terminal recovery interpret unavailable proof in their
       // own domain; this boundary never upgrades it to a successful reading.
     }
   }
+  for (const directory of refresh) {
+    try {
+      await PluginBuildEnvironmentReadings.prepare(directory, true);
+    } catch {
+      // Synchronous admission requalifies after this asynchronous window.
+    }
+  }
 }
 
 /**

package/src/core/transform/tracker/broker/WatchBroker.ts

@@ -6,10 +6,11 @@ import type { WatchBrokerRegistration } from "./WatchBrokerRegistration";
  * The live state of the isolated watch process.
  *
  * The broker multiplexes every Windows and macOS watch of the process over one
- * IPC channel, a tracker's and an input observer's scope's alike. Registrations
- * and drains are counted so the channel is referenced only while a reply is
- * outstanding, and each registration keeps the sink its messages go to and the
- * spelling map that translates the child's canonical paths back to its own.
+ * ordered transport, a tracker's and an input observer's scope's alike. Windows
+ * uses the native helper's stdio; macOS uses Node IPC. Registrations and drains
+ * are counted so the channel is referenced only while a reply is outstanding,
+ * and each registration keeps the sink its messages go to and the spelling map
+ * that translates the child's canonical paths back to its own.
  *
  * @evidence contracts/common.md#principled-implementation
  *   Registration and request ids distinguish multiplexed owners; drain scopes
@@ -38,6 +39,16 @@ export interface WatchBroker {
   /** The isolated watch process; unreferenced whenever no reply is outstanding. */
   child: ChildProcess;
 
+  /**
+   * Native stdio transport on Windows; absent for the macOS IPC broker and
+   * explicit test transports.
+   */
+  transport?: {
+    send(message: unknown): boolean;
+    reference(active: boolean): void;
+    close(): void;
+  };
+
   /**
    * Round-trips awaiting the child's reply, by request id, each released with
    * whether the child answered it.

package/src/core/transform/tracker/broker/WatchBrokerTransport.ts

@@ -0,0 +1,82 @@
+import type { WatchBroker } from "./WatchBroker";
+
+/**
+ * Common lifecycle seam for the native Windows stdio broker and macOS IPC.
+ *
+ * The transport owns framing and demand references only. Ordered native
+ * notifications and per-registration readiness remain backend responsibilities;
+ * a successful send cannot certify coverage or cache reuse.
+ *
+ * @evidence contracts/common.md#principled-implementation One transport seam preserves explicit failure and reference ownership for both supported broker backends.
+ * @evidence contracts/common.md#clear-and-simple-design Callers express send, demand and retirement through this namespace instead of duplicating platform checks or modifying a ChildProcess.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Supported child streams and IPC APIs are used without replacing runtime methods.
+ * @evidence contracts/common.md#meaningful-documentation Native prose separates transport completion from native watch authority.
+ * @evidence contracts/portability.md#os-neutral-implementation Native selection stays at broker startup; all tracker and observer consumers share these operations.
+ * @evidenceExclude contracts/performance.md#efficient-algorithms Member operations own their delegated cost.
+ * @evidenceExclude contracts/performance.md#reuse-equivalent-work The broker owner selects transport and sharing lifetime.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources This namespace itself retains no transport registry.
+ */
+export namespace WatchBrokerTransport {
+  /**
+   * Queue a message on the selected transport. False refuses delivery; true
+   * only means queued, with actual acknowledgment or failure still
+   * outstanding.
+   *
+   * @evidence contracts/common.md#principled-implementation Native and IPC transports preserve separate queue acceptance and observed backend replies.
+   * @evidence contracts/common.md#clear-and-simple-design One selection delegates framing to the startup-owned transport.
+   * @evidence contracts/common.md#prohibited-implementation-shortcuts No queue result is upgraded into readiness or a native drain.
+   * @evidence contracts/common.md#meaningful-documentation Native prose states the limited meaning of the returned boolean.
+   * @evidence contracts/portability.md#os-neutral-implementation Explicit stdio capability takes precedence over optional IPC.
+   * @evidence contracts/performance.md#efficient-algorithms Transport selection is fixed work; JSON framing, message bytes and pipe backpressure belong to the selected sender.
+   * @evidenceExclude contracts/performance.md#reuse-equivalent-work Sending an effect does not own computation reuse.
+   * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The selected sender and request owner retain queued bytes and outstanding acknowledgment state.
+   */
+  export function send(broker: WatchBroker, message: unknown): boolean {
+    return broker.transport === undefined
+      ? broker.child.send?.(message as object) === true
+      : broker.transport.send(message);
+  }
+
+  /**
+   * Keep the selected reply channel live exactly while caller demand exists.
+   * Counts belong to registration/drain owners; native references are flags.
+   *
+   * @evidence contracts/common.md#principled-implementation Outstanding requests retain both process and reply channel, preventing host exit before acknowledgment.
+   * @evidence contracts/common.md#clear-and-simple-design One operation applies the caller's aggregated demand to either transport.
+   * @evidence contracts/common.md#prohibited-implementation-shortcuts Optional Bun IPC methods are used as capabilities without installing replacements.
+   * @evidence contracts/common.md#meaningful-documentation Native prose identifies count ownership and flag semantics.
+   * @evidence contracts/portability.md#os-neutral-implementation Optional IPC methods and a selected native pipe capability express runtime differences.
+   * @evidenceExclude contracts/performance.md#efficient-algorithms Reference toggling selects no data-processing algorithm.
+   * @evidenceExclude contracts/performance.md#reuse-equivalent-work This effect owns no shared computation.
+   * @evidence contracts/performance.md#bound-retention-and-release-resources The caller supplies aggregate demand; removing the last demand unreferences process and reply channel without asserting native termination.
+   */
+  export function reference(broker: WatchBroker, active: boolean): void {
+    if (broker.transport !== undefined) broker.transport.reference(active);
+    else if (active) {
+      broker.child.ref();
+      broker.child.channel?.ref?.();
+    } else {
+      broker.child.unref();
+      broker.child.channel?.unref?.();
+    }
+  }
+
+  /**
+   * End this broker's request stream. The last-registration owner separately
+   * attempts process termination; closing a channel is not proof of child
+   * exit.
+   *
+   * @evidence contracts/common.md#principled-implementation Channel retirement is distinct from process exit and native resource closure.
+   * @evidence contracts/common.md#clear-and-simple-design Startup-owned transport closes its request stream without platform checks in consumers.
+   * @evidence contracts/common.md#prohibited-implementation-shortcuts Supported end/disconnect operations preserve native ownership without synthetic exit acknowledgment.
+   * @evidence contracts/common.md#meaningful-documentation Native prose identifies the independent termination attempt and limited closure meaning.
+   * @evidence contracts/portability.md#os-neutral-implementation Selected stream closure and optional IPC disconnection keep platform details behind the transport seam.
+   * @evidenceExclude contracts/performance.md#efficient-algorithms Closing one channel selects no processing algorithm.
+   * @evidenceExclude contracts/performance.md#reuse-equivalent-work Retirement owns no computation reuse.
+   * @evidence contracts/performance.md#bound-retention-and-release-resources The selected transport ends its input; process kill and actual native cleanup remain the broker and backend's responsibilities.
+   */
+  export function close(broker: WatchBroker): void {
+    if (broker.transport !== undefined) broker.transport.close();
+    else broker.child.disconnect?.();
+  }
+}