@ttsc/unplugin 0.31.0 → 0.31.1

package/src/core/transform/validation/TtscGenerationProof.ts

@@ -0,0 +1,201 @@
+import { PluginBuildEnvironmentReadings } from "ttsc/plugin-source";
+
+import type { TtscCachedProjectTransform } from "../cache/TtscCachedProjectTransform";
+import type { TtscTransformCache } from "../cache/TtscTransformCache";
+import { disposeCachedTransform } from "../cache/disposeCachedTransform";
+import { evictGeneration } from "../cache/evictGeneration";
+import { resultFilesystem } from "../cache/resultFilesystem";
+import { envelopeDerivation } from "../envelope/envelopeDerivation";
+import { selectPluginSourceInputs } from "../envelope/selectPluginSourceInputs";
+import { pathIdentityKey } from "../filesystem/pathIdentityKey";
+import { preparePluginBuildEnvironments } from "../inputs/preparePluginBuildEnvironments";
+import { toProjectKey } from "../project/toProjectKey";
+import type { TtscTransformHooks } from "../watch/TtscTransformHooks";
+
+/**
+ * The shared ownership boundary for generation reuse in every adapter.
+ *
+ * WARNING (#1712, #1713): a module, a synchronous input-proof transaction, a
+ * delivery pass, and a persistent generation have different lifetimes. Keep
+ * those distinctions here. Do not add native preparation before every module,
+ * keep positive toolchain checks for a whole process, or make Bun's adapter
+ * invent its own cache policy. A proven pass shares its first deliveries;
+ * persistent/repeated deliveries require new current observations. Incomplete
+ * observations can share a coherent local result only inside an explicitly
+ * nonwatching pass with actual host-cache withdrawal, never a record or pool.
+ *
+ * @evidence contracts/common.md#principled-implementation Explicit pass identity, source baseline and first-delivery membership delimit sharing; synchronous transactions independently qualify current native inputs and incomplete local outputs retain stricter lifecycle admission.
+ * @evidence contracts/common.md#clear-and-simple-design One core owner supplies the same preparation, pass and fresh-only policies to every adapter instead of separate host-specific caches.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Missing observation never becomes complete snapshot authority; watching, persistent, repeated and unknown boundaries cannot borrow an incomplete pass result.
+ * @evidence contracts/common.md#meaningful-documentation Native context names the four lifetimes and warns against the specific performance and stale-cache regressions they prevent.
+ * @evidenceExclude contracts/portability.md#os-neutral-implementation Members delegate native observations to the generation's filesystem and the native environment owner.
+ * @evidenceExclude contracts/performance.md#efficient-algorithms Members own baseline lookup, batch qualification and admission.
+ * @evidenceExclude contracts/performance.md#reuse-equivalent-work Members establish the distinct sharing boundaries.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The namespace owns no registry; transactions and generations have explicit callers.
+ */
+export namespace TtscGenerationProof {
+  /**
+   * One synchronous admission after all asynchronous preparation has settled.
+   * Never retain this object in a generation or use it after an await.
+   *
+   * @evidence contracts/common.md#principled-implementation The exact cached owner prevents a proof of another result from supplying authority; optional native verdict is earned only by this synchronous transaction.
+   * @evidence contracts/common.md#clear-and-simple-design One transaction carries environment observations and the shared native predicate verdict.
+   * @evidence contracts/common.md#prohibited-implementation-shortcuts Absent environment or predicate proof remains absent, never implied success.
+   * @evidence contracts/common.md#meaningful-documentation Prose states the no-await lifetime and members distinguish owner, environment and predicate authority.
+   * @evidenceExclude contracts/portability.md#os-neutral-implementation Native identity is retained by the referenced generation, not inferred by this carrier.
+   * @evidenceExclude contracts/performance.md#efficient-algorithms This carrier executes no computation.
+   * @evidenceExclude contracts/performance.md#reuse-equivalent-work The creating operation and validators own sharing decisions.
+   * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The synchronous caller owns this handle-free carrier.
+   */
+  export interface Transaction {
+    /** Exact generation being synchronously admitted. */
+    readonly cached: TtscCachedProjectTransform;
+
+    /** Current batch, absent when the pass already owns this input proof. */
+    readonly environments?: ReadonlyMap<string, string | undefined>;
+
+    /** Current native predicate verdict, unbuilt until its first gate. */
+    nativePredicates?: boolean;
+  }
+
+  /**
+   * Prepare native authority only when this delivery needs a new input proof.
+   * The caller must create its synchronous transaction after awaiting this.
+   *
+   * @evidence contracts/common.md#principled-implementation A qualified first-delivery pass already owns environment proof; all other requests prepare actual authority before synchronous admission.
+   * @evidence contracts/common.md#clear-and-simple-design One branch delegates native preparation rather than repeating it in adapters.
+   * @evidence contracts/common.md#prohibited-implementation-shortcuts Only the existing explicit pass contract permits skipping preparation; no watcher silence or process lifetime substitutes for it.
+   * @evidence contracts/common.md#meaningful-documentation Prose states preparation versus transaction ordering.
+   * @evidence contracts/portability.md#os-neutral-implementation Preparation uses the actual generation filesystem and native toolchain reader.
+   * @evidence contracts/performance.md#efficient-algorithms Qualified first deliveries perform baseline/identity lookups; other deliveries delegate one preparation per unique plugin directory.
+   * @evidence contracts/performance.md#reuse-equivalent-work The pass shares its existing first-delivery proof; persistent and repeated deliveries establish new native authority.
+   * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources Native requests belong to their environment owner; no transaction survives this await.
+   */
+  export async function prepare(
+    cached: TtscCachedProjectTransform,
+    file: string,
+    epoch: number | undefined,
+  ): Promise<void> {
+    if (!sharesPass(cached, file, epoch))
+      await preparePluginBuildEnvironments(
+        cached.result,
+        resultFilesystem(cached.result),
+        cached,
+      );
+  }
+
+  /**
+   * Start fresh synchronous observation after notification and preparation
+   * awaits, sharing actual SDK queries and native predicate replay locally.
+   *
+   * @evidence contracts/common.md#principled-implementation Current environments are batch-qualified after asynchronous work; a qualified pass needs no redundant native environment observation.
+   * @evidence contracts/common.md#clear-and-simple-design One constructor binds observations to their exact generation.
+   * @evidence contracts/common.md#prohibited-implementation-shortcuts No current verdict is retained across deliveries or asynchronous boundaries.
+   * @evidence contracts/common.md#meaningful-documentation Native prose identifies the mandatory ordering and synchronous lifetime.
+   * @evidence contracts/portability.md#os-neutral-implementation Native observation remains with the environment witness owner and actual generation path identity.
+   * @evidence contracts/performance.md#efficient-algorithms Plugin selection is generation-indexed; one batch shares variable hashing and distinct SDK metadata queries.
+   * @evidence contracts/performance.md#reuse-equivalent-work Only the following synchronous validators borrow this batch; pass sharing uses its independent first-delivery contract.
+   * @evidence contracts/performance.md#bound-retention-and-release-resources The caller releases the transaction at the end of synchronous admission; no registry or native handle is acquired.
+   */
+  export function create(
+    cached: TtscCachedProjectTransform,
+    file: string,
+    epoch: number | undefined,
+  ): Transaction {
+    return {
+      cached,
+      ...(sharesPass(cached, file, epoch)
+        ? {}
+        : {
+            environments: PluginBuildEnvironmentReadings.cachedAll(
+              selectPluginSourceInputs(cached.result).keys(),
+            ),
+          }),
+    };
+  }
+
+  /**
+   * Whether this module's first delivery belongs to this generation's proven
+   * pass. A missing source baseline cannot acquire this permission.
+   *
+   * @evidence contracts/common.md#principled-implementation Epoch equality, coherent snapshot or admitted local-pass state, a recorded source and an unserved identity are all required.
+   * @evidence contracts/common.md#clear-and-simple-design One predicate is shared by async preparation and synchronous source validation.
+   * @evidence contracts/common.md#prohibited-implementation-shortcuts An incomplete ordinary generation or absent module baseline cannot earn pass reuse.
+   * @evidence contracts/common.md#meaningful-documentation Prose states the first-delivery and baseline restrictions.
+   * @evidence contracts/portability.md#os-neutral-implementation Baselines use the generation's actual identity and compiler project-key policy.
+   * @evidence contracts/performance.md#efficient-algorithms Baseline and served-set lookup avoid full input population traversal.
+   * @evidence contracts/performance.md#reuse-equivalent-work Only first deliveries in the same explicitly declared pass share its proof; repeated and later-pass requests do not.
+   * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The predicate borrows generation state without retaining another owner.
+   */
+  export function sharesPass(
+    cached: TtscCachedProjectTransform,
+    file: string,
+    epoch: number | undefined,
+  ): boolean {
+    if (
+      epoch === undefined ||
+      cached.deliveryEpoch !== epoch ||
+      (cached.projectSnapshotComplete !== true &&
+        cached.passDeliveryOnly !== true) ||
+      (cached.freshDeliveryOnly === true && cached.passDeliveryOnly !== true)
+    )
+      return false;
+    const identities = envelopeDerivation(cached).identityContext;
+    const identity = pathIdentityKey(file, identities);
+    if (cached.servedFiles?.has(identity)) return false;
+    const key = toProjectKey(cached.projectRoot, file, identities);
+    return (
+      cached.sourceHashes?.[identity] !== undefined ||
+      Object.hasOwn(cached.inputHashes, key) ||
+      cached.externalInputHashes?.[identity] !== undefined
+    );
+  }
+
+  /**
+   * Admit and notify a fresh-only local delivery. A coherent pass-only success
+   * can keep its result inside this pass after releasing capture resources;
+   * every other fresh-only answer is detached before notifying the host.
+   * Callback failure always evicts the incomplete owner.
+   *
+   * @evidence contracts/common.md#principled-implementation Explicit nonwatching, consistent project lifecycle and cache-withdrawal capability are required on every successful incomplete delivery; retention additionally needs the compile's exact pass-only epoch.
+   * @evidence contracts/common.md#clear-and-simple-design One owner handles initial and cached fresh-only admission, resource release and host notification.
+   * @evidence contracts/common.md#prohibited-implementation-shortcuts Incomplete output never acquires a persistent record or publication, and failed/unknown/watching capability cannot leave a reusable owner.
+   * @evidence contracts/common.md#meaningful-documentation Native paragraphs distinguish local pass retention, resource release and callback failure effects.
+   * @evidenceExclude contracts/portability.md#os-neutral-implementation This lifecycle operation delegates native resource release to the generation disposer.
+   * @evidence contracts/performance.md#efficient-algorithms Identity/epoch checks and one callback add no input scan; resource disposal visits the fixed tracker population.
+   * @evidence contracts/performance.md#reuse-equivalent-work Only coherent locally admitted output in its exact nonwatching pass survives; a later pass or repeated module must obtain another result.
+   * @evidence contracts/performance.md#bound-retention-and-release-resources Capture resources are released even when local output is kept; rejection and callback failure detach the owning Promise, and the cache lifecycle bounds retained result lifetime.
+   */
+  export function admitFreshOnly(
+    cached: TtscCachedProjectTransform,
+    cache: TtscTransformCache | undefined,
+    key: string,
+    generation: Promise<TtscCachedProjectTransform>,
+    epoch: number | undefined,
+    hooks: TtscTransformHooks | undefined,
+  ): void {
+    if (cached.freshDeliveryOnly !== true) return;
+    const authorized =
+      hooks?.watching === false &&
+      hooks.markVolatile !== undefined &&
+      (hooks.project?.watching === undefined ||
+        hooks.project.watching === false);
+    const retain =
+      authorized &&
+      epoch !== undefined &&
+      cached.deliveryEpoch === epoch &&
+      cached.passDeliveryOnly === true;
+    disposeCachedTransform(cached);
+    if (!retain) evictGeneration(cache, key, generation);
+    if (cached.result.type === "success" && !authorized)
+      throw new Error(
+        "@ttsc/unplugin: plugin input observation is unavailable; fresh output requires an explicitly nonwatching host with supported cache withdrawal. Watching, unknown or contradictory lifecycles cannot safely observe its changes.",
+      );
+    try {
+      hooks?.markVolatile?.();
+    } catch (error) {
+      evictGeneration(cache, key, generation);
+      throw error;
+    }
+  }
+}

package/src/core/transform/validation/matchesCachedSource.ts

@@ -10,6 +10,7 @@ import { pathIdentityKey } from "../filesystem/pathIdentityKey";
 import { hostInputStateHash } from "../inputs/hostInputStateHash";
 import { toProjectKey } from "../project/toProjectKey";
 import { hashText } from "../utils/hashText";
+import { TtscGenerationProof } from "./TtscGenerationProof";
 import { matchesCompleteInputSnapshot } from "./matchesCompleteInputSnapshot";
 import { matchesNarrowPersistentInputs } from "./matchesNarrowPersistentInputs";
 import { nativeInputPredicatesHold } from "./nativeInputPredicatesHold";
@@ -24,17 +25,19 @@ import { notificationsProveProgramUnchanged } from "./notificationsProveProgramU
  * no source comparison. A cache with a delivery epoch can use that comparison
  * alone for a stable generation's first delivery of each module in the current
  * pass, once the pass's own first delivery has proven the whole generation
- * still matches the filesystem. An incomplete generation may not take this
- * shortcut: otherwise a sibling output captured during a filesystem race could
- * still be served once. Later graph-bearing requests validate the file's
- * derived input set and project membership. A failed result is a diagnostic of
- * the whole loaded program, so its repair cannot be proved by one delivered
- * output's dependency closure. Failed and graph-free envelopes conservatively
- * validate the complete project and out-of-walk snapshots, reusing qualified
- * signatures. A mismatch rejects this generation for the delivery; its caller
- * chooses replacement or capture. Delivered text that differs while the disk
- * still holds the bytes the generation compiled is not one: it is reported and
- * served, since the compile read the disk (samchon/ttsc#1394).
+ * still matches the filesystem. Incomplete generations cannot claim complete
+ * proof. A coherent local success admitted only because its observer was
+ * unavailable may share first deliveries in its exact nonwatching pass through
+ * TtscGenerationProof; it cannot cross passes or earn persistent authority.
+ * Later graph-bearing requests validate the file's derived input set and
+ * project membership. A failed result is a diagnostic of the whole loaded
+ * program, so its repair cannot be proved by one delivered output's dependency
+ * closure. Failed and graph-free envelopes conservatively validate the complete
+ * project and out-of-walk snapshots, reusing qualified signatures. A mismatch
+ * rejects this generation for the delivery; its caller chooses replacement or
+ * capture. Delivered text that differs while the disk still holds the bytes the
+ * generation compiled is not one: it is reported and served, since the compile
+ * read the disk (samchon/ttsc#1394).
  *
  * Its place in the adapter's invalidation model, and the units beside it, are
  * mapped in the maintainer page
@@ -42,7 +45,7 @@ import { notificationsProveProgramUnchanged } from "./notificationsProveProgramU
  *
  * @evidence contracts/common.md#principled-implementation Delivered source, generation completeness, pass identity and notification authority choose between first-delivery proof, derived-input validation and complete snapshots; divergent editor text never substitutes for compiler disk inputs.
  * @evidence contracts/common.md#clear-and-simple-design This admission boundary chooses the required proof while dedicated validators own membership, universal inputs and content comparisons.
- * @evidence contracts/common.md#prohibited-implementation-shortcuts An incomplete generation cannot earn a first-delivery shortcut; inherited object members cannot invent a project baseline, and losing watcher proof falls back to recorded-state validation.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts An incomplete generation cannot claim complete snapshot authority; only separately admitted coherent local success can share first deliveries of its exact nonwatching pass; inherited object members cannot invent a project baseline, and losing watcher proof falls back to recorded-state validation.
  * @evidence contracts/common.md#meaningful-documentation Separate native paragraphs explain disk-versus-delivered authority, epoch qualification, fallback and related maintainer guidance before tags.
  * @evidence contracts/portability.md#os-neutral-implementation Project membership and path identity use recorded compiler case policy and injected native operations; OS names do not certify case sensitivity or watcher capabilities.
  * @evidence contracts/performance.md#bound-retention-and-release-resources
@@ -52,13 +55,13 @@ import { notificationsProveProgramUnchanged } from "./notificationsProveProgramU
  *   while validators replace current signature/directory witnesses. No new
  *   independent handle or historical epoch collection is acquired here.
  * @evidence contracts/performance.md#efficient-algorithms Every admission first replays all generation-owned typed config predicates; this mandatory cost includes native queries, file bytes or directory membership independently of watcher/epoch qualification.
- *   Fresh-only rejection precedes native identity work. Baseline-bearing paths
+ *   Unsupported fresh-only rejection precedes source baseline work. Baseline-bearing paths
  *   hash delivered text and divergent paths read/hash host bytes; unrelated
  *   absent outputs can return before that hash after an initial K-output index.
  *   Epoch-qualified first checkpoints share the complete proof. Other paths
  *   pay derived-input or complete project/external/universal proof costs,
  *   including path/byte populations, native observations and clock refresh.
- * @evidence contracts/performance.md#reuse-equivalent-work Typed config predicate replay is not cached by this coordinator and remains mandatory even when the following existing shortcut shares other proof.  A complete generation earns one whole-snapshot proof per new delivery epoch; later first deliveries share it, while repeated or persistent deliveries revalidate their authoritative dependency scope.
+ * @evidence contracts/performance.md#reuse-equivalent-work Typed config predicate replay remains mandatory for every delivery and shares only the current synchronous transaction with nested validators; immutable membership is indexed separately.  A complete generation earns one whole-snapshot proof per new delivery epoch; later first deliveries share it, while repeated or persistent deliveries revalidate their authoritative dependency scope.
  */
 export function matchesCachedSource(
   /** Generation retaining recorded baselines and distinct proof authority. */
@@ -69,9 +72,11 @@ export function matchesCachedSource(
   source: string,
   /** Current host pass, or undefined for persistent input validation. */
   epoch: number | undefined,
+  proof?: TtscGenerationProof.Transaction,
 ): boolean {
-  if (!nativeInputPredicatesHold(cached)) return false;
-  if (cached.freshDeliveryOnly === true) return false;
+  if (!nativeInputPredicatesHold(cached, proof)) return false;
+  const pass = TtscGenerationProof.sharesPass(cached, file, epoch);
+  if (cached.freshDeliveryOnly === true && !pass) return false;
   const identities = envelopeDerivation(cached).identityContext;
   const currentKey = toProjectKey(cached.projectRoot, file, identities);
   const identity = pathIdentityKey(file, identities);
@@ -102,7 +107,7 @@ export function matchesCachedSource(
     if (!outputs.has(identity)) {
       // While the watchers prove the program unchanged, the module is still
       // outside it, and no walk is needed to say so (samchon/ttsc#1398).
-      if (notificationsProveProgramUnchanged(cached)) {
+      if (notificationsProveProgramUnchanged(cached, proof)) {
         return true;
       }
       // Root discovery deliberately never hashed this unrelated module. Its
@@ -113,7 +118,7 @@ export function matchesCachedSource(
         TRANSFORM_CLOCK_REFERENCE_DIRECTORIES.get(cached),
         resultFilesystem(cached.result),
       );
-      return matchesCompleteInputSnapshot(cached);
+      return matchesCompleteInputSnapshot(cached, proof);
     }
   }
   if (expected !== hashText(source)) {
@@ -130,6 +135,7 @@ export function matchesCachedSource(
     }
     reportDivergentDelivery(cached, file);
   }
+  if (pass) return true;
   if (epoch !== undefined && cached.projectSnapshotComplete === true) {
     if (cached.deliveryEpoch !== epoch) {
       // The pass's first delivery. The generation was settled against an
@@ -142,7 +148,7 @@ export function matchesCachedSource(
         TRANSFORM_CLOCK_REFERENCE_DIRECTORIES.get(cached),
         resultFilesystem(cached.result),
       );
-      if (!matchesCompleteInputSnapshot(cached)) {
+      if (!matchesCompleteInputSnapshot(cached, proof)) {
         return false;
       }
       cached.deliveryEpoch = epoch;
@@ -165,7 +171,7 @@ export function matchesCachedSource(
     cached.projectMutationTracker !== undefined &&
     cached.hostInputMutationTracker !== undefined
   ) {
-    const narrow = matchesNarrowPersistentInputs(cached, file);
+    const narrow = matchesNarrowPersistentInputs(cached, file, proof);
     if (narrow !== undefined) {
       return narrow;
     }
@@ -173,5 +179,5 @@ export function matchesCachedSource(
     // produced. Losing the proof is not evidence of a change, so fall through
     // to the snapshot the entry still carries.
   }
-  return matchesCompleteInputSnapshot(cached);
+  return matchesCompleteInputSnapshot(cached, proof);
 }

package/src/core/transform/validation/matchesCompleteInputSnapshot.ts

@@ -3,6 +3,7 @@ import { resultFilesystem } from "../cache/resultFilesystem";
 import { declaredProjectInputKeys } from "../envelope/declaredProjectInputKeys";
 import { envelopeDerivation } from "../envelope/envelopeDerivation";
 import { collectProjectInputSnapshot } from "../project/collectProjectInputSnapshot";
+import type { TtscGenerationProof } from "./TtscGenerationProof";
 import { matchesCachedExternalInputs } from "./matchesCachedExternalInputs";
 import { matchesExternalInputRealpaths } from "./matchesExternalInputRealpaths";
 import { matchesUniversalHostInputEntries } from "./matchesUniversalHostInputEntries";
@@ -43,7 +44,7 @@ import { walkSnapshotComplete } from "./walkSnapshotComplete";
  *   target scans, signature entry materialization/adoption and native identity
  *   work add population/path/digit costs; unresolved content and predicate
  *   replay add bytes/listings. Early rejection skips subsequent domains.
- * @evidence contracts/performance.md#reuse-equivalent-work Typed config predicate replay is not cached by this coordinator and remains mandatory even when the following existing shortcut shares other proof.  Qualified separable signatures avoid repeated content reads under the caller's refreshed clock. Successful aggregate proof adopts earned project/external signatures and clears unverified flags; it neither clears recorded changes/failed flags nor makes later quiet notifications sufficient without their other admission conditions.
+ * @evidence contracts/performance.md#reuse-equivalent-work Typed config predicates remain mandatory on every delivery. An exact-generation synchronous transaction may share their current replay across nested validators, but no pass or notification shortcut authorizes a later delivery to skip them.  Qualified separable signatures avoid repeated content reads under the caller's refreshed clock. Successful aggregate proof adopts earned project/external signatures and clears unverified flags; it neither clears recorded changes/failed flags nor makes later quiet notifications sufficient without their other admission conditions.
  */
 export function matchesCompleteInputSnapshot(
   /**
@@ -51,8 +52,9 @@ export function matchesCompleteInputSnapshot(
    * proof.
    */
   cached: TtscCachedProjectTransform,
+  proof?: TtscGenerationProof.Transaction,
 ): boolean {
-  if (!nativeInputPredicatesHold(cached)) return false;
+  if (!nativeInputPredicatesHold(cached, proof)) return false;
   if (
     cached.projectSnapshotComplete !== true ||
     cached.projectDirectories === undefined
@@ -72,7 +74,7 @@ export function matchesCompleteInputSnapshot(
     hostValidation === undefined ||
     !matchesUniversalHostInputEntries(cached, hostValidation) ||
     !matchesUniversalHostInputProbes(cached, hostValidation) ||
-    !matchesUniversalHostInputTrees(cached, hostValidation)
+    !matchesUniversalHostInputTrees(cached, hostValidation, proof)
   ) {
     return false;
   }

package/src/core/transform/validation/matchesNarrowPersistentInputs.ts

@@ -5,6 +5,7 @@ import { envelopeDerivation } from "../envelope/envelopeDerivation";
 import { selectWatchInputs } from "../envelope/selectWatchInputs";
 import { notificationsProveMembership } from "../tracker/notificationsProveMembership";
 import { reportsMembershipChange } from "../tracker/reportsMembershipChange";
+import type { TtscGenerationProof } from "./TtscGenerationProof";
 import { matchesProvenInput } from "./matchesProvenInput";
 import { matchesUniversalHostInputs } from "./matchesUniversalHostInputs";
 
@@ -49,6 +50,7 @@ export function matchesNarrowPersistentInputs(
   cached: TtscCachedProjectTransform,
   /** Delivered file spelling selecting this envelope's dependency closure. */
   file: string,
+  proof?: TtscGenerationProof.Transaction,
 ): boolean | undefined {
   if (reportsMembershipChange(cached)) {
     return false;
@@ -61,7 +63,7 @@ export function matchesNarrowPersistentInputs(
   if (hostValidation === undefined) {
     return undefined;
   }
-  if (!matchesUniversalHostInputs(cached, hostValidation)) {
+  if (!matchesUniversalHostInputs(cached, hostValidation, proof)) {
     return false;
   }
   const inputs = selectWatchInputs({

package/src/core/transform/validation/matchesUniversalHostInputTrees.ts

@@ -7,6 +7,7 @@ import type { TtscCachedProjectTransform } from "../cache/TtscCachedProjectTrans
 import { resultFilesystem } from "../cache/resultFilesystem";
 import { pluginSourceHolds } from "../inputs/pluginSourceHolds";
 import { usesPreparedPluginBuildEnvironments } from "../inputs/preparePluginBuildEnvironments";
+import type { TtscGenerationProof } from "./TtscGenerationProof";
 import type { TtscHostInputValidation } from "./TtscHostInputValidation";
 import { trackerProvesInputUnchanged } from "./trackerProvesInputUnchanged";
 
@@ -41,19 +42,22 @@ import { trackerProvesInputUnchanged } from "./trackerProvesInputUnchanged";
  * @evidence contracts/common.md#meaningful-documentation Native paragraphs distinguish source notification, environment authority and metadata-qualified digest reuse before param tags.
  * @evidence contracts/portability.md#os-neutral-implementation Supported plugin-source APIs and capability-qualified native trackers own source/toolchain observation without OS-wide watcher assumptions.
  * @evidence contracts/performance.md#bound-retention-and-release-resources One environment witness per current manifest tree is replaced in place; no delivery history is retained.
- * @evidence contracts/performance.md#efficient-algorithms Each tree first pays the shared environment reader's variable-key construction and native dependency qualification. Qualified silent sources avoid enumeration; other trees enumerate and sort the selected file population, inspect metadata and hash source bytes whenever population, metadata or clock evidence cannot qualify reuse. The synchronous owner can also refresh native environment authority after a mismatch.
+ * @evidence contracts/performance.md#efficient-algorithms An exact-generation synchronous transaction supplies one current batched environment qualification; otherwise each tree pays the shared environment reader's variable-key construction and native dependency qualification. Qualified silent sources avoid enumeration; other trees enumerate and sort the selected file population, inspect metadata and hash source bytes whenever population, metadata or clock evidence cannot qualify reuse. The synchronous owner can also refresh native environment authority after a mismatch.
  * @evidence contracts/performance.md#reuse-equivalent-work Generation environment witnesses and the owning digest cache share prior proof only while source and toolchain identities remain valid.
  */
 export function matchesUniversalHostInputTrees(
   cached: TtscCachedProjectTransform,
   validation: TtscHostInputValidation,
+  proof?: TtscGenerationProof.Transaction,
 ): boolean {
   for (const [directory, digest] of validation.trees) {
     // Read before any proof, so the environment recorded below is one the
     // proof saw or older, never a newer one it did not prove.
     const prepared = usesPreparedPluginBuildEnvironments(cached.result);
     const environment = prepared
-      ? PluginBuildEnvironmentReadings.cached(directory)
+      ? proof?.cached === cached && proof.environments !== undefined
+        ? proof.environments.get(directory)
+        : PluginBuildEnvironmentReadings.cached(directory)
       : processPluginBuildEnvironment(directory);
     if (environment === undefined) return false;
     if (

package/src/core/transform/validation/matchesUniversalHostInputs.ts

@@ -1,4 +1,5 @@
 import type { TtscCachedProjectTransform } from "../cache/TtscCachedProjectTransform";
+import type { TtscGenerationProof } from "./TtscGenerationProof";
 import type { TtscHostInputValidation } from "./TtscHostInputValidation";
 import { matchesUniversalHostInputEntries } from "./matchesUniversalHostInputEntries";
 import { matchesUniversalHostInputProbes } from "./matchesUniversalHostInputProbes";
@@ -29,13 +30,14 @@ import { trackerProvesInputUnchanged } from "./trackerProvesInputUnchanged";
  * @evidence contracts/portability.md#os-neutral-implementation Filesystem-aware validators use actual tracker delivery capability and exact lexical coverage rather than platform-wide assumptions.
  * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The coordinator borrows generation manifests and trackers without retaining a result or acquiring a handle.
  * @evidence contracts/performance.md#efficient-algorithms Every admission first replays all generation-owned typed config predicates; this mandatory cost includes native queries, file bytes or directory membership independently of watcher/epoch qualification.  The coverage scan stops at the first unproved input. Each coverage query checks overlapping unproven scopes and sampled events with native path comparisons; fallback adds unresolved bytes, native candidate probes and plugin tree enumeration. Mandatory environment qualification pays its owning dependency and environment-key costs on either route.
- * @evidence contracts/performance.md#reuse-equivalent-work Typed config predicate replay is not cached by this coordinator and remains mandatory even when the following existing shortcut shares other proof.  Shared manifests and qualified silent sources avoid repeated content reads only while the owning tree validator also proves unchanged build environment.
+ * @evidence contracts/performance.md#reuse-equivalent-work Typed config predicates remain mandatory on every delivery. An exact-generation synchronous transaction may share their current replay across nested validators, but no pass or notification shortcut authorizes a later delivery to skip them.  Shared manifests and qualified silent sources avoid repeated content reads only while the owning tree validator also proves unchanged build environment.
  */
 export function matchesUniversalHostInputs(
   cached: TtscCachedProjectTransform,
   validation: TtscHostInputValidation,
+  proof?: TtscGenerationProof.Transaction,
 ): boolean {
-  if (!nativeInputPredicatesHold(cached)) return false;
+  if (!nativeInputPredicatesHold(cached, proof)) return false;
   let notificationsProveAll = true;
   for (const input of validation.covered) {
     if (!trackerProvesInputUnchanged(cached.hostInputMutationTracker, input)) {
@@ -44,10 +46,10 @@ export function matchesUniversalHostInputs(
     }
   }
   if (notificationsProveAll)
-    return matchesUniversalHostInputTrees(cached, validation);
+    return matchesUniversalHostInputTrees(cached, validation, proof);
   return (
     matchesUniversalHostInputEntries(cached, validation) &&
     matchesUniversalHostInputProbes(cached, validation) &&
-    matchesUniversalHostInputTrees(cached, validation)
+    matchesUniversalHostInputTrees(cached, validation, proof)
   );
 }

package/src/core/transform/validation/nativeInputPredicatesHold.ts

@@ -1,9 +1,19 @@
 import path from "node:path";
+import type { ITtscCompilerTransformation } from "ttsc";
 
 import type { TtscCachedProjectTransform } from "../cache/TtscCachedProjectTransform";
 import { resultFilesystem } from "../cache/resultFilesystem";
 import { envelopeDerivation } from "../envelope/envelopeDerivation";
 import { nativeInputPredicateMatches } from "../inputs/nativeInputPredicateMatches";
+import type { TtscGenerationProof } from "./TtscGenerationProof";
+
+// Weakly owned by immutable observation membership, never by current verdict.
+// Keeping this separate from native path derivation also preserves the empty
+// predicate gate's promise to perform no native identity observations.
+const predicateInputs = new WeakMap<
+  object,
+  Array<[string, ITtscCompilerTransformation.IInputObservation]>
+>();
 
 /**
  * Validate every generation-owned native config predicate before cache reuse.
@@ -16,25 +26,37 @@ import { nativeInputPredicateMatches } from "../inputs/nativeInputPredicateMatch
  * @evidence contracts/common.md#prohibited-implementation-shortcuts Metadata and notification shortcuts cannot omit typed config predicates or repair an unstable producer witness.
  * @evidence contracts/common.md#meaningful-documentation The comment identifies generation ownership and the admission shortcuts that must retain this gate.
  * @evidence contracts/portability.md#os-neutral-implementation Relative names are resolved against the recorded project with the filesystem view's path dialect; native identity and encoding belong to the replay operation.
- * @evidence contracts/performance.md#efficient-algorithms The initial observation scan detects whether native replay is required without resolving a root or performing filesystem queries. Nonempty populations add a second linear traversal plus native replay and path-byte costs, stopping at the first refusal; empty and legacy-only populations require no replay context.
- * @evidenceExclude contracts/performance.md#reuse-equivalent-work This admission gate stores no separate cache and checks the recorded generation supplied by its caller.
- * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources Per-call enumeration owns no handle or watcher; the cached envelope owns retained predicates.
+ * @evidence contracts/performance.md#efficient-algorithms Immutable observation membership is indexed once, including an empty population. Each new synchronous admission replays only indexed native predicates and stops at the first refusal; nested validators share its verdict without another scan or native query. Empty populations require no native replay context.
+ * @evidence contracts/performance.md#reuse-equivalent-work A weak observation index shares immutable membership. Current verdicts belong only to an exact-owner synchronous transaction, never the next delivery or an await.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The weak index follows immutable observation lifetime; synchronous verdicts and native queries acquire no handle or history.
  */
 export function nativeInputPredicatesHold(
   cached: TtscCachedProjectTransform,
+  proof?: TtscGenerationProof.Transaction,
 ): boolean {
   if (cached.result.type === "exception") return false;
-  const observations = cached.result.graph?.inputObservations ?? {};
-  if (
-    !Object.values(observations).some(
-      (observation) => (observation.nativePredicates?.length ?? 0) !== 0,
-    )
-  )
-    return true;
+  if (proof?.cached === cached && proof.nativePredicates !== undefined)
+    return proof.nativePredicates;
+  // Membership is immutable generation data. A positive native verdict is
+  // current observation: share it only with nested synchronous validators,
+  // never the next delivery, pass or await (#1714).
+  const finish = (matches: boolean): boolean => {
+    if (proof?.cached === cached) proof.nativePredicates = matches;
+    return matches;
+  };
+  const observations = cached.result.graph?.inputObservations;
+  if (observations === undefined) return finish(true);
+  let inputs = predicateInputs.get(observations);
+  if (inputs === undefined) {
+    inputs = Object.entries(observations).filter(
+      ([, observation]) => (observation.nativePredicates?.length ?? 0) !== 0,
+    );
+    predicateInputs.set(observations, inputs);
+  }
+  if (inputs.length === 0) return finish(true);
   const filesystem = resultFilesystem(cached.result);
   const identities = envelopeDerivation(cached).identityContext;
-  for (const [name, observation] of Object.entries(observations)) {
-    if ((observation.nativePredicates?.length ?? 0) === 0) continue;
+  for (const [name, observation] of inputs) {
     const file = (
       (filesystem.platform ?? process.platform) === "win32"
         ? path.win32
@@ -42,7 +64,7 @@ export function nativeInputPredicatesHold(
     ).resolve(cached.projectRoot, name);
     for (const predicate of observation.nativePredicates ?? [])
       if (!nativeInputPredicateMatches(file, predicate, filesystem, identities))
-        return false;
+        return finish(false);
   }
-  return true;
+  return finish(true);
 }

package/src/core/transform/validation/notificationsProveProgramUnchanged.ts

@@ -4,6 +4,7 @@ import { TRANSFORM_CLOCK_REFERENCE_DIRECTORIES } from "../clock/TRANSFORM_CLOCK_
 import { refreshFilesystemClockReference } from "../clock/refreshFilesystemClockReference";
 import { isProjectWalkPath } from "../project/isProjectWalkPath";
 import { notificationsProveMembership } from "../tracker/notificationsProveMembership";
+import type { TtscGenerationProof } from "./TtscGenerationProof";
 import { matchesUniversalHostInputs } from "./matchesUniversalHostInputs";
 
 /**
@@ -42,6 +43,7 @@ export function notificationsProveProgramUnchanged(
    * proof.
    */
   cached: TtscCachedProjectTransform,
+  proof?: TtscGenerationProof.Transaction,
 ): boolean {
   if (!notificationsProveMembership(cached)) return false;
   for (const tracker of [
@@ -88,5 +90,5 @@ export function notificationsProveProgramUnchanged(
     TRANSFORM_CLOCK_REFERENCE_DIRECTORIES.get(cached),
     resultFilesystem(cached.result),
   );
-  return matchesUniversalHostInputs(cached, cached.hostInputValidation);
+  return matchesUniversalHostInputs(cached, cached.hostInputValidation, proof);
 }

package/src/core/transform/watch/notifyWatchInputs.ts

@@ -64,6 +64,9 @@ export function notifyWatchInputs(
   // so no persistent cache may keep it.
   if (
     hooks.project !== undefined &&
+    // Common delivery already withdrew this host cache. Incomplete local
+    // output cannot write a record, so avoid a second withdrawal callback.
+    cached.freshDeliveryOnly !== true &&
     !notifyProjectRecord(
       hooks.project,
       cached,

package/src/core/turbopack/turbopack.ts

@@ -171,6 +171,7 @@ export function turbopack(
   }
   const hooks: TtscTransformHooks = {
     exactPath: true,
+    watching,
     ...(addDependency === undefined
       ? {}
       : {
@@ -186,7 +187,7 @@ export function turbopack(
             toolDirectory,
             // Turbopack takes no record outside its root, so a watching worker
             // refuses a module it could hand none (samchon/ttsc#1480).
-            watching: bridge !== undefined,
+            watching,
           },
         }),
     ...(bindings.markVolatile === undefined