@ttsc/unplugin 0.31.0 → 0.31.2

package/src/core/transform/generation/transformProject.ts

@@ -64,18 +64,20 @@ import { selectTransformAttemptDisposition } from "./selectTransformAttemptDispo
  * (samchon/ttsc#1545).
  *
  * A local success whose only lost premise is explicitly unavailable host
- * observation may qualify for its initiating delivery. The delivery coordinator
- * additionally requires an explicitly nonwatching host with cache-withdrawal
- * capability. It remains incomplete and cannot authorize resident, shared or
- * persistent caching. Actual changes, conflicts and unexplained missing proof
- * retain the stabilization gate.
+ * observation may qualify for local delivery. TtscGenerationProof additionally
+ * requires an explicitly nonwatching host and actual cache withdrawal for every
+ * delivery. It alone can share recorded first-module baselines inside the same
+ * explicit pass. This incomplete result cannot authorize ordinary resident
+ * reuse, a persistent project record or shared publication; repeated modules
+ * and later passes recapture. Actual changes, conflicts and unexplained missing
+ * proof retain the stabilization gate.
  *
  * Enabled private tracing records each computed disposition before its state is
  * applied. It does not supply proof when capture throws or tracing fails.
  *
- * @evidence contracts/common.md#principled-implementation Each capture establishes config coherence and reusable success proof or a current diagnostic verdict; a local stable success with only explicit unavailable host observations instead transfers one fresh delivery without reuse authority, while mixed mutation, missing or conflicting proof retains retry admission.
+ * @evidence contracts/common.md#principled-implementation Each capture establishes config coherence and reusable success proof or a current diagnostic verdict; a local stable success with only explicit unavailable host observations instead transfers an incomplete local result whose bounded first deliveries require the common nonwatching pass owner, while mixed mutation, missing or conflicting proof retains retry admission.
  * @evidence contracts/common.md#clear-and-simple-design The pure attempt policy selects acceptance and retry budgets; this loop owns mutable learned facts and resource handoff, capture owns proof construction, and the shared error builder owns terminal rendering and final disposal.
- * @evidence contracts/common.md#prohibited-implementation-shortcuts Retrying follows learned dependencies/case policy or refuted publication payload rather than an endless workaround chain; only lossless producer-authorized observation unavailability can permit a local fresh answer, and it never becomes a reusable success or excuses actual mutation.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Retrying follows learned dependencies/case policy or refuted publication payload rather than an endless workaround chain; only lossless producer-authorized observation unavailability can permit a local fresh answer, and it never becomes complete or persistent/shared success proof or excuses actual mutation.
  * @evidence contracts/common.md#meaningful-documentation Native paragraphs explain movement versus absolute budgets, failed-compile diagnostics and learned facts; separated props state delivery, tracking and inherited witness meaning.
  * @evidence contracts/portability.md#os-neutral-implementation Each capture delegates native filesystem and compiler behavior to injected host boundaries; reported compiler case policy is carried between attempts rather than guessed from OS names.
  * @evidence contracts/performance.md#efficient-algorithms At most four captures bound retry count, not each capture's project/config/input bytes, native walks, compiler/plugin work, observer setup or session waiting time. Each rejected attempt copies the cumulative witnessed Set and scans its external dependencies into that copy; the next capture receives a separate array of its names; supplied spellings contribute hashing/text cost. Terminal rendering visits retained attempts/witnesses, and disposal delegates observer/probe cleanup rather than making those effects constant work. Enabled tracing serializes disposition scalars and path text through the existing bounded append sink; disabled tracing skips that payload construction.
@@ -200,10 +202,12 @@ export async function transformProject(props: {
       },
     });
     if (disposition.freshDeliveryOnly) {
-      // Neither incomplete diagnostic observations nor a permitted local fresh
-      // success authorizes this generation's reuse beyond its current delivery.
+      // Missing observations never authorize persistent or shared reuse. A
+      // coherent fresh-only local success may separately earn bounded first
+      // deliveries through the common nonwatching pass owner (#1713).
       cached.freshDeliveryOnly = true;
     }
+    if (disposition.kind === "fresh-only") cached.passDeliveryOnly = true;
     if (disposition.kind === "accepted" || disposition.kind === "fresh-only") {
       return cached;
     }

package/src/core/transform/inputs/pluginSourceFilesDigest.ts

@@ -1,7 +1,7 @@
 import path from "node:path";
 import {
-  pluginSourceDigest,
   pluginSourceFilesSignature,
+  provenPluginSourceDigest,
 } from "ttsc/plugin-source";
 
 import { DEFAULT_FILESYSTEM_OPERATIONS } from "../filesystem/DEFAULT_FILESYSTEM_OPERATIONS";
@@ -24,9 +24,15 @@ import { inputMetadataEvidence } from "./inputMetadataEvidence";
  * historical-directory eviction or owner partition and can grow with distinct
  * directory spellings.
  *
- * @param directory The source directory.
+ * @param directory The source directory. WARNING (samchon/ttsc#1725): the map
+ *   below ends with the process, and every bundler worker or restart is a new
+ *   one, so each first proof read every plugin source byte again (0.35 s for
+ *   typia's Go module). A caller that names its project takes a miss's digest
+ *   from that project's plugin cache records, which the load that reported the
+ *   state wrote.
  * @param filesystem The operations whose clock reference the caller refreshed
  *   (`refreshFilesystemClockReference`), which decides separability.
+ * @param projectRoot Project whose plugin cache root holds the records.
  * @throws When a listed file cannot be read, as `pluginSourceDigest` does.
  * @evidence contracts/common.md#principled-implementation The build's exact file selector signs names and metadata around a fresh byte digest; matching separable signatures permit reuse only under the same native source-tree and refreshed-clock premises.
  * @evidence contracts/common.md#clear-and-simple-design This coordinator owns the directory digest entry while ttsc owns selection and byte hashing and inputMetadataEvidence owns stamp interpretation.
@@ -34,12 +40,13 @@ import { inputMetadataEvidence } from "./inputMetadataEvidence";
  * @evidence contracts/common.md#meaningful-documentation Native paragraphs explain population invalidation, before/after proof, fresh clock ordering, native-view assumptions and unbounded retained entries, with separated tags following documentation guidance.
  * @evidence contracts/portability.md#os-neutral-implementation OS-neutral native source paths use Node resolution and ttsc's native selector; injected metadata must observe those paths. A different filesystem view or path dialect is not supported by the native enumeration/read calls here.
  * @evidence contracts/performance.md#efficient-algorithms Reuse still enumerates and stats F files; a miss performs two metadata walks and one O(B) byte digest. Selection sorts its population, and temporary storage follows the file list and largest file buffer.
- * @evidence contracts/performance.md#reuse-equivalent-work All calls share DIGESTS by resolved directory spelling; current separable metadata must match the signature recorded around the producer read. The key does not partition filesystem owners, so sharing assumes one native source view.
+ * @evidence contracts/performance.md#reuse-equivalent-work All calls share DIGESTS by resolved directory spelling; current separable metadata must match the signature recorded around the producer read. The key does not partition filesystem owners, so sharing assumes one native source view. A miss of a caller naming its project takes the digest the load recorded in that project's plugin cache, across processes.
  * @evidence contracts/performance.md#bound-retention-and-release-resources DIGESTS is module-owned and retains one digest/signature per encountered key until failed stabilization deletes that key or the process ends; no historical-directory bound or explicit teardown currently exists.
  */
 export function pluginSourceFilesDigest(
   directory: string,
   filesystem: TtscTransformFilesystemOperations = DEFAULT_FILESYSTEM_OPERATIONS,
+  projectRoot?: string,
 ): string {
   const key = path.resolve(directory);
   /**
@@ -56,7 +63,7 @@ export function pluginSourceFilesDigest(
   ) {
     return known.digest;
   }
-  const digest = pluginSourceDigest(key);
+  const digest = provenPluginSourceDigest(key, projectRoot);
   const after = pluginSourceFilesSignature(key, evidence);
   if (
     before !== undefined &&

package/src/core/transform/inputs/pluginSourceHolds.ts

@@ -26,13 +26,15 @@ import { pluginSourceFilesDigest } from "./pluginSourceFilesDigest";
  * @param state The state the envelope, a record, or a capture recorded.
  * @param filesystem The operations whose clock reference the caller refreshed.
  * @param prepared Optional already-qualified native environment authority.
+ * @param projectRoot Project whose plugin cache records prove the sources and
+ *   the SDK in a new process (samchon/ttsc#1725).
  * @evidence contracts/common.md#principled-implementation Source-state equality uses ttsc's build-key composition. Synchronous clients retain mismatch-triggered environment refresh; async clients supply current native authority and own fresh preparation separately. Unavailable source or prepared environment rejects proof.
  * @evidence contracts/common.md#clear-and-simple-design This adapter supplies a proven source digest to the shared state comparator, keeping environment composition and refresh in ttsc's owner.
  * @evidence contracts/common.md#prohibited-implementation-shortcuts The fresh environment comparison corrects an actual stale environment witness; unreadable source is not hidden by expected state exceptions or perpetual compensating retries.
  * @evidence contracts/common.md#meaningful-documentation Native paragraphs explain source versus environment proof, failure semantics and refreshed-clock parameters, followed by separated tags under documentation guidance.
  * @evidence contracts/portability.md#os-neutral-implementation OS-neutral source/environment comparison uses the build's native boundaries. Injected metadata must describe that same native source tree; arbitrary foreign-filesystem views are not established by this adapter.
  * @evidence contracts/performance.md#efficient-algorithms One proven source digest serves either the supplied-environment comparison or both synchronous environment comparisons; file work is delegated to the digest owner.
- * @evidence contracts/performance.md#reuse-equivalent-work Metadata-proven source digests and current native environment witnesses qualify reuse; async preparation and synchronous mismatch refresh remain distinct owning paths.
+ * @evidence contracts/performance.md#reuse-equivalent-work Metadata-proven source digests and current native environment witnesses qualify reuse; async preparation and synchronous mismatch refresh remain distinct owning paths. A named project lets the source and SDK readings come from its plugin cache records across processes.
  * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources This comparison acquires no retained source cache or native handle; digest storage and process-environment retention have separate owners.
  */
 export function pluginSourceHolds(
@@ -40,9 +42,14 @@ export function pluginSourceHolds(
   state: string,
   filesystem: TtscTransformFilesystemOperations = DEFAULT_FILESYSTEM_OPERATIONS,
   prepared?: { environment: string | undefined },
+  projectRoot?: string,
 ): boolean {
   try {
-    const sourceDigest = pluginSourceFilesDigest(directory, filesystem);
+    const sourceDigest = pluginSourceFilesDigest(
+      directory,
+      filesystem,
+      projectRoot,
+    );
     if (prepared !== undefined)
       return (
         prepared.environment !== undefined &&
@@ -51,7 +58,10 @@ export function pluginSourceHolds(
           sourceDigest,
         }) === state
       );
-    return pluginSourceStateHolds(directory, state, { sourceDigest });
+    return pluginSourceStateHolds(directory, state, {
+      projectRoot,
+      sourceDigest,
+    });
   } catch {
     return false;
   }

package/src/core/transform/inputs/pluginSourceState.ts

@@ -21,6 +21,8 @@ import * as pluginSource from "ttsc/plugin-source";
  *
  * @param directory The source directory, as the envelope names it.
  * @param prepared Optional current environment prepared by the async owner.
+ * @param projectRoot Project whose plugin cache records prove the sources and
+ *   the SDK in a new process (samchon/ttsc#1725).
  * @evidence contracts/common.md#principled-implementation The shared pluginSourceState composition combines source digest and build environment exactly as binary keys do, and an observation error preserves null rather than a plausible state.
  * @evidence contracts/common.md#clear-and-simple-design Capture delegates state composition to ttsc while proof callers use pluginSourceHolds for mismatch refresh; the two roles are explicit without duplicate key logic.
  * @evidence contracts/common.md#prohibited-implementation-shortcuts Missing observations cannot become hardcoded state or equal a recorded valid state through an exception branch.
@@ -33,13 +35,17 @@ import * as pluginSource from "ttsc/plugin-source";
 export function pluginSourceState(
   directory: string,
   prepared?: { environment: string | undefined },
+  projectRoot?: string,
 ): string | null {
   try {
     if (prepared !== undefined)
       return prepared.environment === undefined
         ? null
-        : pluginSource.pluginSourceState(directory, prepared);
-    return pluginSource.pluginSourceState(directory);
+        : pluginSource.pluginSourceState(directory, {
+            environment: prepared.environment,
+            projectRoot,
+          });
+    return pluginSource.pluginSourceState(directory, { projectRoot });
   } catch {
     return null;
   }

package/src/core/transform/inputs/preparePluginBuildEnvironments.ts

@@ -12,23 +12,36 @@ import { pluginSourceHolds } from "./pluginSourceHolds";
 const asyncResults = new WeakSet<object>();
 
 /**
- * Prepare actual plugin toolchain authority before synchronous input proofs.
+ * Qualify actual plugin toolchain authority before synchronous input proofs.
  * Cold Go/environment/SDK work stays off the host thread. A mismatch requests
  * one fresh native environment reading; observation failure remains unavailable
  * and the following admission or replay validator retains its failure policy. A
  * resident generation can reuse its exact proven source state while healthy
  * notifications and the still-qualified environment witness both hold. Native
- * environment preparation remains mandatory; source events cannot prove it.
+ * environment authority remains mandatory; source events cannot prove it.
+ *
+ * WARNING (#1712): yield before observing queued source changes, then qualify
+ * all current readings in one synchronous batch. Missing readings require an
+ * await and a fresh batch afterward. Source comparisons may request native
+ * refreshes; the caller must establish another current proof after those
+ * awaits. Never preserve a positive batch across an await or replay the SDK
+ * witness independently for every plugin and nested validator.
+ *
+ * The project root reaches ttsc's environment worker, so that isolate proves
+ * the Go SDK and executables from the plugin cache's records instead of reading
+ * 135 MB of SDK once per bundler or runtime process (samchon/ttsc#1722).
  *
  * @param cached Optional resident generation whose existing source-state and
  *   environment witness may qualify source reuse. Other preparation owners
  *   retain direct source comparison.
- * @evidence contracts/common.md#principled-implementation Every reported plugin directory prepares its actual current environment. The same result's matching manifest state can share source proof only with a healthy exact-source tracker and the environment under which that tree was proven. Otherwise this operation compares source state once and a mismatch refreshes environment authority for the following owning validator to compare again; failed preparation cannot qualify an input.
+ * @param projectRoot Project whose plugin cache holds those records; the
+ *   resident generation's own root when omitted.
+ * @evidence contracts/common.md#principled-implementation Every reported plugin directory qualifies current environment authority; only missing readings require asynchronous preparation. The same result's matching manifest state can share source proof only with a healthy exact-source tracker and the environment under which that tree was proven. Otherwise this operation compares source state once and a mismatch refreshes environment authority for the following owning validator to compare again; failed preparation cannot qualify an input.
  * @evidence contracts/common.md#clear-and-simple-design One async boundary precedes existing synchronous generation, delivery and terminal proofs.
  * @evidence contracts/common.md#prohibited-implementation-shortcuts Missing observations stay unproved; reported binary state never substitutes for native environment preparation or source comparison.
  * @evidence contracts/common.md#meaningful-documentation Native prose identifies off-thread work, mismatch refresh and preserved downstream failure ownership.
  * @evidence contracts/portability.md#os-neutral-implementation The same native toolchain/environment reader and caller filesystem source digest qualify each directory without platform guesses.
- * @evidence contracts/performance.md#efficient-algorithms The envelope selector builds its directory map once per result, and preparation visits each reported directory once. Environment requests build keys from effective variables and qualify native dependencies. A qualified source witness avoids enumeration; other source comparisons enumerate and sort files, check metadata and hash bytes when the digest cannot be reused. A mismatch requests one environment refresh rather than a second source comparison here.
+ * @evidence contracts/performance.md#efficient-algorithms The envelope selector indexes directories once per result. Linear directory passes batch-qualify current readings, prepare missing authority, compare source state and refresh mismatches. Each synchronous batch hashes variables once and shares distinct native dependencies; any preparation await requires another current batch. A qualified source witness avoids enumeration; other source comparisons enumerate and sort files, check metadata and hash bytes when the digest cannot be reused. A mismatch requests one environment refresh rather than a second source comparison here.
  * @evidence contracts/performance.md#reuse-equivalent-work The environment owner shares equivalent in-flight requests and still-qualified readings. Resident source proof is reused only for the exact result and manifest digest, unchanged qualified environment and currently healthy covered source notifications; absent, dirty, replaced or unavailable witnesses retain direct proof. No epoch or quiet watcher alone authorizes reuse, and subsequent admission still owns its current validation.
  * @evidence contracts/performance.md#bound-retention-and-release-resources This module records asynchronous execution ownership in a WeakSet before preparation, including failures, so disposed results are not retained. Requests and worker lifetimes remain with the environment owner; this sequential operation awaits each request and acquires no native observer or independent cancellation handle.
  */
@@ -36,12 +49,37 @@ export async function preparePluginBuildEnvironments(
   result: TtscCachedProjectTransform["result"],
   filesystem: TtscTransformFilesystemOperations,
   cached?: TtscCachedProjectTransform,
+  projectRoot: string | undefined = cached?.projectRoot,
 ): Promise<void> {
   asyncResults.add(result);
-  for (const [directory, state] of selectPluginSourceInputs(result)) {
+  const sources = selectPluginSourceInputs(result);
+  // Preserve the async preparation boundary even for warm environments.
+  // Events queued by the caller before awaiting preparation must participate
+  // in the source witness below. Observe the batch after this yield, never
+  // carry a positive environment observation across it (#1712).
+  await Promise.resolve();
+  const current = PluginBuildEnvironmentReadings.cachedAll(sources.keys());
+  let awaited = false;
+  for (const directory of sources.keys()) {
+    if (current.get(directory) !== undefined) continue;
+    awaited = true;
+    try {
+      await PluginBuildEnvironmentReadings.prepare(
+        directory,
+        false,
+        projectRoot,
+      );
+    } catch {
+      // Keep unavailable authority for admission rather than cold fallback.
+    }
+  }
+  const environments = awaited
+    ? PluginBuildEnvironmentReadings.cachedAll(sources.keys())
+    : current;
+  const refresh: string[] = [];
+  for (const [directory, state] of sources) {
     try {
-      await PluginBuildEnvironmentReadings.prepare(directory);
-      const environment = PluginBuildEnvironmentReadings.cached(directory);
+      const environment = environments.get(directory);
       if (
         cached?.result === result &&
         cached.hostInputValidation?.trees.get(directory) === state &&
@@ -52,16 +90,31 @@ export async function preparePluginBuildEnvironments(
       )
         continue;
       if (
-        !pluginSourceHolds(directory, state, filesystem, {
-          environment,
-        })
+        !pluginSourceHolds(
+          directory,
+          state,
+          filesystem,
+          { environment },
+          projectRoot,
+        )
       )
-        await PluginBuildEnvironmentReadings.prepare(directory, true);
+        refresh.push(directory);
     } catch {
       // Admission and terminal recovery interpret unavailable proof in their
       // own domain; this boundary never upgrades it to a successful reading.
     }
   }
+  for (const directory of refresh) {
+    try {
+      await PluginBuildEnvironmentReadings.prepare(
+        directory,
+        true,
+        projectRoot,
+      );
+    } catch {
+      // Synchronous admission requalifies after this asynchronous window.
+    }
+  }
 }
 
 /**

package/src/core/transform/tracker/broker/WatchBroker.ts

@@ -6,10 +6,11 @@ import type { WatchBrokerRegistration } from "./WatchBrokerRegistration";
  * The live state of the isolated watch process.
  *
  * The broker multiplexes every Windows and macOS watch of the process over one
- * IPC channel, a tracker's and an input observer's scope's alike. Registrations
- * and drains are counted so the channel is referenced only while a reply is
- * outstanding, and each registration keeps the sink its messages go to and the
- * spelling map that translates the child's canonical paths back to its own.
+ * ordered transport, a tracker's and an input observer's scope's alike. Windows
+ * uses the native helper's stdio; macOS uses Node IPC. Registrations and drains
+ * are counted so the channel is referenced only while a reply is outstanding,
+ * and each registration keeps the sink its messages go to and the spelling map
+ * that translates the child's canonical paths back to its own.
  *
  * @evidence contracts/common.md#principled-implementation
  *   Registration and request ids distinguish multiplexed owners; drain scopes
@@ -38,6 +39,16 @@ export interface WatchBroker {
   /** The isolated watch process; unreferenced whenever no reply is outstanding. */
   child: ChildProcess;
 
+  /**
+   * Native stdio transport on Windows; absent for the macOS IPC broker and
+   * explicit test transports.
+   */
+  transport?: {
+    send(message: unknown): boolean;
+    reference(active: boolean): void;
+    close(): void;
+  };
+
   /**
    * Round-trips awaiting the child's reply, by request id, each released with
    * whether the child answered it.

package/src/core/transform/tracker/broker/WatchBrokerTransport.ts

@@ -0,0 +1,82 @@
+import type { WatchBroker } from "./WatchBroker";
+
+/**
+ * Common lifecycle seam for the native Windows stdio broker and macOS IPC.
+ *
+ * The transport owns framing and demand references only. Ordered native
+ * notifications and per-registration readiness remain backend responsibilities;
+ * a successful send cannot certify coverage or cache reuse.
+ *
+ * @evidence contracts/common.md#principled-implementation One transport seam preserves explicit failure and reference ownership for both supported broker backends.
+ * @evidence contracts/common.md#clear-and-simple-design Callers express send, demand and retirement through this namespace instead of duplicating platform checks or modifying a ChildProcess.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Supported child streams and IPC APIs are used without replacing runtime methods.
+ * @evidence contracts/common.md#meaningful-documentation Native prose separates transport completion from native watch authority.
+ * @evidence contracts/portability.md#os-neutral-implementation Native selection stays at broker startup; all tracker and observer consumers share these operations.
+ * @evidenceExclude contracts/performance.md#efficient-algorithms Member operations own their delegated cost.
+ * @evidenceExclude contracts/performance.md#reuse-equivalent-work The broker owner selects transport and sharing lifetime.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources This namespace itself retains no transport registry.
+ */
+export namespace WatchBrokerTransport {
+  /**
+   * Queue a message on the selected transport. False refuses delivery; true
+   * only means queued, with actual acknowledgment or failure still
+   * outstanding.
+   *
+   * @evidence contracts/common.md#principled-implementation Native and IPC transports preserve separate queue acceptance and observed backend replies.
+   * @evidence contracts/common.md#clear-and-simple-design One selection delegates framing to the startup-owned transport.
+   * @evidence contracts/common.md#prohibited-implementation-shortcuts No queue result is upgraded into readiness or a native drain.
+   * @evidence contracts/common.md#meaningful-documentation Native prose states the limited meaning of the returned boolean.
+   * @evidence contracts/portability.md#os-neutral-implementation Explicit stdio capability takes precedence over optional IPC.
+   * @evidence contracts/performance.md#efficient-algorithms Transport selection is fixed work; JSON framing, message bytes and pipe backpressure belong to the selected sender.
+   * @evidenceExclude contracts/performance.md#reuse-equivalent-work Sending an effect does not own computation reuse.
+   * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The selected sender and request owner retain queued bytes and outstanding acknowledgment state.
+   */
+  export function send(broker: WatchBroker, message: unknown): boolean {
+    return broker.transport === undefined
+      ? broker.child.send?.(message as object) === true
+      : broker.transport.send(message);
+  }
+
+  /**
+   * Keep the selected reply channel live exactly while caller demand exists.
+   * Counts belong to registration/drain owners; native references are flags.
+   *
+   * @evidence contracts/common.md#principled-implementation Outstanding requests retain both process and reply channel, preventing host exit before acknowledgment.
+   * @evidence contracts/common.md#clear-and-simple-design One operation applies the caller's aggregated demand to either transport.
+   * @evidence contracts/common.md#prohibited-implementation-shortcuts Optional Bun IPC methods are used as capabilities without installing replacements.
+   * @evidence contracts/common.md#meaningful-documentation Native prose identifies count ownership and flag semantics.
+   * @evidence contracts/portability.md#os-neutral-implementation Optional IPC methods and a selected native pipe capability express runtime differences.
+   * @evidenceExclude contracts/performance.md#efficient-algorithms Reference toggling selects no data-processing algorithm.
+   * @evidenceExclude contracts/performance.md#reuse-equivalent-work This effect owns no shared computation.
+   * @evidence contracts/performance.md#bound-retention-and-release-resources The caller supplies aggregate demand; removing the last demand unreferences process and reply channel without asserting native termination.
+   */
+  export function reference(broker: WatchBroker, active: boolean): void {
+    if (broker.transport !== undefined) broker.transport.reference(active);
+    else if (active) {
+      broker.child.ref();
+      broker.child.channel?.ref?.();
+    } else {
+      broker.child.unref();
+      broker.child.channel?.unref?.();
+    }
+  }
+
+  /**
+   * End this broker's request stream. The last-registration owner separately
+   * attempts process termination; closing a channel is not proof of child
+   * exit.
+   *
+   * @evidence contracts/common.md#principled-implementation Channel retirement is distinct from process exit and native resource closure.
+   * @evidence contracts/common.md#clear-and-simple-design Startup-owned transport closes its request stream without platform checks in consumers.
+   * @evidence contracts/common.md#prohibited-implementation-shortcuts Supported end/disconnect operations preserve native ownership without synthetic exit acknowledgment.
+   * @evidence contracts/common.md#meaningful-documentation Native prose identifies the independent termination attempt and limited closure meaning.
+   * @evidence contracts/portability.md#os-neutral-implementation Selected stream closure and optional IPC disconnection keep platform details behind the transport seam.
+   * @evidenceExclude contracts/performance.md#efficient-algorithms Closing one channel selects no processing algorithm.
+   * @evidenceExclude contracts/performance.md#reuse-equivalent-work Retirement owns no computation reuse.
+   * @evidence contracts/performance.md#bound-retention-and-release-resources The selected transport ends its input; process kill and actual native cleanup remain the broker and backend's responsibilities.
+   */
+  export function close(broker: WatchBroker): void {
+    if (broker.transport !== undefined) broker.transport.close();
+    else broker.child.disconnect?.();
+  }
+}

package/src/core/transform/tracker/broker/drainWatchBroker.ts

@@ -1,16 +1,17 @@
 import { WATCH_PROBE_TIMEOUT_MS } from "./WATCH_PROBE_TIMEOUT_MS";
 import type { WatchBroker } from "./WatchBroker";
+import { WatchBrokerTransport } from "./WatchBrokerTransport";
 
 /**
  * Ask the watch broker to acknowledge, and resolve with whether it did.
  *
- * The child answers after two turns of its own loop, so a watch callback it had
- * already queued has run, and the ordered IPC channel puts every message it
- * sent before the reply ahead of the reply. That is the same proof an
- * in-process watcher gets from a macrotask turn, rather than the fixed wait
- * this replaces, which guessed at the crossing (samchon/ttsc#1272). On macOS
- * the child answers once each stream it can prove has delivered a probe, which
- * takes the service's latency (samchon/ttsc#1453).
+ * Windows answers after consuming currently queued native completions to an
+ * observed empty port. macOS answers once each provable stream has delivered a
+ * probe, including the service's latency (#1453). Ordered transport applies
+ * every preceding event before the reply. These are current backend frontiers,
+ * not atomic timestamp classification of concurrent writes. The optional direct
+ * fs.watch program retains its explicit two-turn frontier for protocol tests;
+ * it does not supply Windows production proof (#1719).
  *
  * A broker that never answers must not hold a delivery, so the wait gives up
  * after a threshold of twice the probe timeout: the child itself gives up on a
@@ -50,7 +51,7 @@ import type { WatchBroker } from "./WatchBroker";
  *   Native paragraphs and parameters explain ordering, coverage, sharing and
  *   false deadlines under the documentation skill.
  * @evidence contracts/portability.md#os-neutral-implementation
- *   OS-neutral host delivery delegates Windows loop ordering and macOS stream
+ *   OS-neutral host delivery delegates Windows completion-port drainage and macOS stream
  *   probing to the native broker rather than applying one universal timing guess.
  * @evidence contracts/performance.md#efficient-algorithms
  *   A covering memo query uses fixed identity/id lookup. New requests copy all N
@@ -123,8 +124,7 @@ function startWatchBrokerDrain(
       broker.drainScopes?.delete(id);
       broker.pendingDrains -= 1;
       if (broker.pendingDrains === 0 && broker.pendingRegistrations === 0) {
-        broker.child.unref();
-        broker.child.channel?.unref?.();
+        WatchBrokerTransport.reference(broker, false);
       }
       resolve(answered);
     };
@@ -134,12 +134,11 @@ function startWatchBrokerDrain(
     // the reference the loop can empty while a delivery waits here, and the
     // process exits mid-build with nothing to report.
     broker.pendingDrains += 1;
-    broker.child.ref();
-    broker.child.channel?.ref?.();
+    WatchBrokerTransport.reference(broker, true);
     const timer = setTimeout(() => release(false), timeout);
     broker.drains.set(id, release);
     (broker.drainScopes ??= new Map()).set(id, scope);
-    if (broker.child.send?.({ id, op: "drain" }) !== true) {
+    if (WatchBrokerTransport.send(broker, { id, op: "drain" }) !== true) {
       release(false);
     }
   });

package/src/core/transform/tracker/broker/getWatchBroker.ts

@@ -1,3 +1,6 @@
+import readline from "node:readline";
+import { resolveBinary } from "ttsc/binary";
+
 import { traceProcessSpawn } from "../../../tracing/traceProcessSpawn";
 import { WATCH_BROKER } from "./WATCH_BROKER";
 import type { WatchBroker } from "./WatchBroker";
@@ -13,11 +16,11 @@ import { watchBrokerSource } from "./watchBrokerSource";
  * caller-supplied watch capabilities can bypass it. Isolation has a reason on
  * each native backend:
  *
- * - Node's Windows fs-event backend can hit a native assertion that aborts the
- *   whole process when a watched temporary tree is deleted. In the child that
- *   crash becomes an ordinary exit that fails the affected trackers, and those
- *   generations fall back to proving themselves from recorded state instead of
- *   taking the host down.
+ * - Windows runs ttsc's native completion-port helper directly. Its directory
+ *   filter excludes access-time notifications: reads must not masquerade as
+ *   writes (#1719). Actual writes, metadata changes, native loss and failed
+ *   coverage remain observable; equal bytes cannot erase an A-B-A event. No
+ *   Node fs-event handle is opened in the host or an intermediate process.
  * - On macOS, libuv serves every directory watch of one event loop through a
  *   single FSEventStream and re-creates it whenever any watch in that loop
  *   opens or closes, losing the events in between (samchon/ttsc#1418), and it
@@ -26,10 +29,11 @@ import { watchBrokerSource } from "./watchBrokerSource";
  *   passes each drop on as a gap (samchon/ttsc#1425); see
  *   {@link watchBrokerSource}.
  *
- * Registration/drain owners unreference the child and IPC channel after their
+ * Registration/drain owners unreference the child and its transport after their
  * outstanding acknowledgments finish; startup itself returns a referenced
- * child. Last-registration closure attempts disconnection and termination. This
- * accessor has no independent shutdown deadline or exit wait.
+ * child. Last-registration closure ends the request stream and attempts
+ * termination. This accessor has no independent shutdown deadline or exit
+ * wait.
  *
  * @evidence contracts/common.md#principled-implementation
  *   Native watches run in a protocol child. Error/exit dispatch reports failure
@@ -45,13 +49,15 @@ import { watchBrokerSource } from "./watchBrokerSource";
  *   Native platform-reason list and lifecycle paragraph explain isolation and
  *   process ownership under the documentation skill.
  * @evidence contracts/portability.md#os-neutral-implementation
- *   OS-neutral startup uses this process's executable and argument-array spawn;
- *   native FSEvents loading and platform differences remain in this boundary.
+ *   Windows resolves the same ttsc binary as its compiler owner and uses the
+ *   native __watch command; macOS uses this runtime and supported FSEvents.
+ *   Argument-array spawn, hidden Windows processes and ordered transport stay
+ *   inside this boundary.
  * @evidence contracts/performance.md#efficient-algorithms
- *   A current-holder read is fixed work. Cold startup includes optional native
- *   module resolution/warning, child source construction and native process/IPC
- *   creation; resolution/path/source bytes and process startup cost do not
- *   vanish into one spawn call. Failure visits R registrations and D drain
+ *   A current-holder read is fixed work. Windows cold startup resolves the ttsc
+ *   binary and opens native protocol pipes; macOS resolves the optional binding,
+ *   reports missing capability and constructs its child program and IPC channel.
+ *   Resolution/path/source bytes and native process startup cost remain real. Failure visits R registrations and D drain
  *   callbacks, whose native/reference/sink work remains delegated; it does not
  *   enumerate watched source trees.
  *   Enabled private tracing serializes the actual executable/source argv and
@@ -63,7 +69,7 @@ import { watchBrokerSource } from "./watchBrokerSource";
  *   a health certificate; binding installation changes are not re-resolved
  *   while it remains current, and sink exceptions can interrupt failure handling.
  * @evidence contracts/performance.md#bound-retention-and-release-resources
- *   One current module holder retains a child and registration/drain maps;
+ *   One current module holder retains a direct child and registration/drain maps;
  *   those populations and caller-retained retired brokers have no cap here.
  *   Request owners manage references/timers, and last closure attempts native
  *   disconnection/kill rather than proving exit. Completed failure routing
@@ -77,11 +83,17 @@ export function getWatchBroker(): WatchBroker {
   const fsevents =
     process.platform === "darwin" ? fseventsBindingPath() : undefined;
   if (fsevents === null) warnMissingFseventsBinding();
+  const native = process.platform === "win32";
+  const binary = native ? resolveBinary() : process.execPath;
+  if (binary === null)
+    throw new Error("No ttsc native watch helper is available");
   const child = traceProcessSpawn(
-    process.execPath,
-    ["-e", watchBrokerSource(fsevents)],
+    binary,
+    native ? ["__watch"] : ["-e", watchBrokerSource(fsevents)],
     {
-      stdio: ["ignore", "ignore", "ignore", "ipc"],
+      stdio: native
+        ? ["pipe", "pipe", "ignore"]
+        : ["ignore", "ignore", "ignore", "ipc"],
       windowsHide: true,
     },
   );
@@ -110,6 +122,65 @@ export function getWatchBroker(): WatchBroker {
       WATCH_BROKER.current = undefined;
     }
   };
+  if (native) {
+    // All Windows registrations share one direct native child. No Node watcher,
+    // nested child, global runtime patch, or access-time system change is needed.
+    const input = child.stdin;
+    const output = child.stdout;
+    if (input === null || output === null) {
+      child.kill();
+      throw new Error("The native watch helper has no protocol pipes");
+    }
+    broker.transport = {
+      send(message) {
+        if (input.destroyed || input.writableEnded) return false;
+        // write(false) means buffered backpressure, not refusal. The callback
+        // reports a real transport failure to every still-live registration.
+        input.write(JSON.stringify(message) + "\n", (error) => {
+          if (error !== null && error !== undefined) {
+            fail();
+            child.kill();
+          }
+        });
+        return true;
+      },
+      reference(active) {
+        const pipe = output as typeof output & {
+          ref?: () => void;
+          unref?: () => void;
+        };
+        if (active) {
+          child.ref();
+          pipe.ref?.();
+        } else {
+          child.unref();
+          pipe.unref?.();
+        }
+      },
+      close() {
+        input.end();
+      },
+    };
+    const lost = (): void => {
+      fail();
+      child.kill();
+    };
+    input.on("error", lost);
+    output.on("error", lost);
+    output.on("end", lost);
+    readline
+      .createInterface({ input: output, crlfDelay: Infinity })
+      .on("line", (line) => {
+        let message: unknown;
+        try {
+          message = JSON.parse(line) as unknown;
+        } catch {
+          lost();
+          return;
+        }
+        routeWatchBrokerMessage(broker, message);
+      });
+  }
   child.on("error", fail);
   child.on("exit", fail);
   child.on("message", (message: unknown) =>