@ttsc/unplugin 0.31.3 → 0.31.5

package/lib/core/transform/tracker/verifyGenerationLocations.mjs

@@ -0,0 +1,52 @@
+/**
+ * Recheck every watched directory's identity against the one its tracker opened
+ * on, returning what the check read.
+ *
+ * A watch that now observes a replaced directory has nothing left to say about
+ * the new one, so its tracker gives up its authority before anything reads it.
+ * The trackers share what they read, so a directory they all watch, the project
+ * root above all, costs one metadata call per delivery rather than one per
+ * tracker. The returned readings belong to the synchronous admission that ran
+ * the check: a validator in it that must know whether one of these directories
+ * is still a directory reads the answer here instead of stating it again
+ * (samchon/ttsc#1735). The map assumes the callbacks share a coherent
+ * filesystem view; it is not an atomic snapshot.
+ *
+ * @evidence contracts/common.md#principled-implementation
+ *   Each verifier compares followed device and file ids with the opened ones,
+ *   and a mismatch or unreadable location withdraws its tracker.
+ * @evidence contracts/common.md#clear-and-simple-design
+ *   One three-tracker list drives every verifier through one delivery-local
+ *   identity map, which is also the result.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts
+ *   A replaced watched directory withdraws authority; lexical spelling never
+ *   proves a directory unchanged.
+ * @evidence contracts/common.md#meaningful-documentation
+ *   Native prose explains withdrawal, sharing and the result's synchronous
+ *   lifetime under the documentation skill.
+ * @evidence contracts/portability.md#os-neutral-implementation
+ *   Identities are the filesystem's own physical identities, followed through
+ *   links, with no platform case rule.
+ * @evidence contracts/performance.md#efficient-algorithms
+ *   Three tracker slots are visited; existing verifiers scan their retained
+ *   watched locations, sharing one metadata read per exact directory spelling.
+ * @evidence contracts/performance.md#reuse-equivalent-work
+ *   The map is created for each admission and handed to that admission's
+ *   validators, never retained across deliveries.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources
+ *   The caller's synchronous transaction owns the map, which retains queried
+ *   directory and identity text only until that transaction ends.
+ */
+function verifyGenerationLocations(cached) {
+    const seen = new Map();
+    for (const tracker of [
+        cached.projectMutationTracker,
+        cached.hostInputMutationTracker,
+        cached.candidateMutationTracker,
+    ])
+        tracker?.verifyLocations?.(seen);
+    return seen;
+}
+
+export { verifyGenerationLocations };
+//# sourceMappingURL=verifyGenerationLocations.mjs.map

package/lib/core/transform/tracker/verifyGenerationLocations.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyGenerationLocations.mjs","sources":["../../../../src/core/transform/tracker/verifyGenerationLocations.ts"],"sourcesContent":[null],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCG;AACG,SAAU,yBAAyB,CACvC,MAAkC,EAAA;AAElC,IAAA,MAAM,IAAI,GAAG,IAAI,GAAG,EAA8B;IAClD,KAAK,MAAM,OAAO,IAAI;AACpB,QAAA,MAAM,CAAC,sBAAsB;AAC7B,QAAA,MAAM,CAAC,wBAAwB;AAC/B,QAAA,MAAM,CAAC,wBAAwB;AAChC,KAAA;AACC,QAAA,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC;AAClC,IAAA,OAAO,IAAI;AACb;;;;"}

package/lib/core/transform/utils/isZombieProcess.d.cts

@@ -0,0 +1,26 @@
+/**
+ * Whether process `pid` has exited and only waits for its parent to collect its
+ * status.
+ *
+ * Signal zero still reaches such a zombie, so a liveness probe built on it
+ * alone counts the process alive. A parent that never collects, such as a
+ * container's PID 1 that is not an init or a subreaper that collects only when
+ * its own command ends, keeps the zombie indefinitely, and the locks and
+ * directories it owned would never be reclaimed. Only Linux exposes the state,
+ * through `/proc`; elsewhere, and whenever it cannot be read, this answers
+ * `false` so the caller's existing probe decides. A leader whose own thread
+ * exited also reads as a zombie while its other threads run, so the zombie must
+ * be the process's last thread. A zombie keeps its id until collected, so this
+ * never names a live process.
+ *
+ * @param pid A positive process id that signal zero just found.
+ * @evidence contracts/common.md#principled-implementation The kernel's own process status, zombie or dead with no other thread, establishes the exit; any unreadable or other status leaves the caller's signal-zero answer standing.
+ * @evidence contracts/common.md#clear-and-simple-design One predicate serves the shared-compile lock, session-owner and watch-probe owners alike.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts No PID list, timeout or error-to-exited fallback substitutes for the kernel status.
+ * @evidence contracts/common.md#meaningful-documentation The paragraph explains why signal zero misses a zombie, which parents leave one behind, why a zombie leader with running threads is not one and why its id cannot name a live process.
+ * @evidence contracts/portability.md#os-neutral-implementation Only Linux exposes zombies through /proc; other platforms keep their probe's answer.
+ * @evidence contracts/performance.md#efficient-algorithms One small /proc read on Linux, nothing elsewhere.
+ * @evidenceExclude contracts/performance.md#reuse-equivalent-work Process state is a current observation and is never cached.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The read retains no handle; the status text becomes reclaimable on return.
+ */
+export declare function isZombieProcess(pid: number): boolean;

package/lib/core/transform/utils/isZombieProcess.d.mts

@@ -0,0 +1,26 @@
+/**
+ * Whether process `pid` has exited and only waits for its parent to collect its
+ * status.
+ *
+ * Signal zero still reaches such a zombie, so a liveness probe built on it
+ * alone counts the process alive. A parent that never collects, such as a
+ * container's PID 1 that is not an init or a subreaper that collects only when
+ * its own command ends, keeps the zombie indefinitely, and the locks and
+ * directories it owned would never be reclaimed. Only Linux exposes the state,
+ * through `/proc`; elsewhere, and whenever it cannot be read, this answers
+ * `false` so the caller's existing probe decides. A leader whose own thread
+ * exited also reads as a zombie while its other threads run, so the zombie must
+ * be the process's last thread. A zombie keeps its id until collected, so this
+ * never names a live process.
+ *
+ * @param pid A positive process id that signal zero just found.
+ * @evidence contracts/common.md#principled-implementation The kernel's own process status, zombie or dead with no other thread, establishes the exit; any unreadable or other status leaves the caller's signal-zero answer standing.
+ * @evidence contracts/common.md#clear-and-simple-design One predicate serves the shared-compile lock, session-owner and watch-probe owners alike.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts No PID list, timeout or error-to-exited fallback substitutes for the kernel status.
+ * @evidence contracts/common.md#meaningful-documentation The paragraph explains why signal zero misses a zombie, which parents leave one behind, why a zombie leader with running threads is not one and why its id cannot name a live process.
+ * @evidence contracts/portability.md#os-neutral-implementation Only Linux exposes zombies through /proc; other platforms keep their probe's answer.
+ * @evidence contracts/performance.md#efficient-algorithms One small /proc read on Linux, nothing elsewhere.
+ * @evidenceExclude contracts/performance.md#reuse-equivalent-work Process state is a current observation and is never cached.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The read retains no handle; the status text becomes reclaimable on return.
+ */
+export declare function isZombieProcess(pid: number): boolean;

package/lib/core/transform/utils/isZombieProcess.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Whether process `pid` has exited and only waits for its parent to collect its
+ * status.
+ *
+ * Signal zero still reaches such a zombie, so a liveness probe built on it
+ * alone counts the process alive. A parent that never collects, such as a
+ * container's PID 1 that is not an init or a subreaper that collects only when
+ * its own command ends, keeps the zombie indefinitely, and the locks and
+ * directories it owned would never be reclaimed. Only Linux exposes the state,
+ * through `/proc`; elsewhere, and whenever it cannot be read, this answers
+ * `false` so the caller's existing probe decides. A leader whose own thread
+ * exited also reads as a zombie while its other threads run, so the zombie must
+ * be the process's last thread. A zombie keeps its id until collected, so this
+ * never names a live process.
+ *
+ * @param pid A positive process id that signal zero just found.
+ * @evidence contracts/common.md#principled-implementation The kernel's own process status, zombie or dead with no other thread, establishes the exit; any unreadable or other status leaves the caller's signal-zero answer standing.
+ * @evidence contracts/common.md#clear-and-simple-design One predicate serves the shared-compile lock, session-owner and watch-probe owners alike.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts No PID list, timeout or error-to-exited fallback substitutes for the kernel status.
+ * @evidence contracts/common.md#meaningful-documentation The paragraph explains why signal zero misses a zombie, which parents leave one behind, why a zombie leader with running threads is not one and why its id cannot name a live process.
+ * @evidence contracts/portability.md#os-neutral-implementation Only Linux exposes zombies through /proc; other platforms keep their probe's answer.
+ * @evidence contracts/performance.md#efficient-algorithms One small /proc read on Linux, nothing elsewhere.
+ * @evidenceExclude contracts/performance.md#reuse-equivalent-work Process state is a current observation and is never cached.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The read retains no handle; the status text becomes reclaimable on return.
+ */
+export declare function isZombieProcess(pid: number): boolean;

package/lib/core/transform/utils/isZombieProcess.js

@@ -0,0 +1,46 @@
+'use strict';
+
+var fs = require('node:fs');
+
+/**
+ * Whether process `pid` has exited and only waits for its parent to collect its
+ * status.
+ *
+ * Signal zero still reaches such a zombie, so a liveness probe built on it
+ * alone counts the process alive. A parent that never collects, such as a
+ * container's PID 1 that is not an init or a subreaper that collects only when
+ * its own command ends, keeps the zombie indefinitely, and the locks and
+ * directories it owned would never be reclaimed. Only Linux exposes the state,
+ * through `/proc`; elsewhere, and whenever it cannot be read, this answers
+ * `false` so the caller's existing probe decides. A leader whose own thread
+ * exited also reads as a zombie while its other threads run, so the zombie must
+ * be the process's last thread. A zombie keeps its id until collected, so this
+ * never names a live process.
+ *
+ * @param pid A positive process id that signal zero just found.
+ * @evidence contracts/common.md#principled-implementation The kernel's own process status, zombie or dead with no other thread, establishes the exit; any unreadable or other status leaves the caller's signal-zero answer standing.
+ * @evidence contracts/common.md#clear-and-simple-design One predicate serves the shared-compile lock, session-owner and watch-probe owners alike.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts No PID list, timeout or error-to-exited fallback substitutes for the kernel status.
+ * @evidence contracts/common.md#meaningful-documentation The paragraph explains why signal zero misses a zombie, which parents leave one behind, why a zombie leader with running threads is not one and why its id cannot name a live process.
+ * @evidence contracts/portability.md#os-neutral-implementation Only Linux exposes zombies through /proc; other platforms keep their probe's answer.
+ * @evidence contracts/performance.md#efficient-algorithms One small /proc read on Linux, nothing elsewhere.
+ * @evidenceExclude contracts/performance.md#reuse-equivalent-work Process state is a current observation and is never cached.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The read retains no handle; the status text becomes reclaimable on return.
+ */
+function isZombieProcess(pid) {
+    if (process.platform !== "linux")
+        return false;
+    let status;
+    try {
+        status = fs.readFileSync(`/proc/${pid}/status`, "utf8");
+    }
+    catch {
+        return false;
+    }
+    const state = /^State:\s*(\S)/m.exec(status)?.[1];
+    const threads = /^Threads:\s*(\d+)/m.exec(status)?.[1];
+    return (state === "Z" || state === "X") && threads === "1";
+}
+
+exports.isZombieProcess = isZombieProcess;
+//# sourceMappingURL=isZombieProcess.js.map

package/lib/core/transform/utils/isZombieProcess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"isZombieProcess.js","sources":["../../../../src/core/transform/utils/isZombieProcess.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;AAEA;;;;;;;;;;;;;;;;;;;;;;;;AAwBG;AACG,SAAU,eAAe,CAAC,GAAW,EAAA;AACzC,IAAA,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;AAAE,QAAA,OAAO,KAAK;AAC9C,IAAA,IAAI,MAAc;AAClB,IAAA,IAAI;QACF,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,CAAA,MAAA,EAAS,GAAG,CAAA,OAAA,CAAS,EAAE,MAAM,CAAC;IACzD;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,KAAK;IACd;AACA,IAAA,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACjD,IAAA,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACtD,IAAA,OAAO,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,KAAK,OAAO,KAAK,GAAG;AAC5D;;;;"}

package/lib/core/transform/utils/isZombieProcess.mjs

@@ -0,0 +1,44 @@
+import fs from 'node:fs';
+
+/**
+ * Whether process `pid` has exited and only waits for its parent to collect its
+ * status.
+ *
+ * Signal zero still reaches such a zombie, so a liveness probe built on it
+ * alone counts the process alive. A parent that never collects, such as a
+ * container's PID 1 that is not an init or a subreaper that collects only when
+ * its own command ends, keeps the zombie indefinitely, and the locks and
+ * directories it owned would never be reclaimed. Only Linux exposes the state,
+ * through `/proc`; elsewhere, and whenever it cannot be read, this answers
+ * `false` so the caller's existing probe decides. A leader whose own thread
+ * exited also reads as a zombie while its other threads run, so the zombie must
+ * be the process's last thread. A zombie keeps its id until collected, so this
+ * never names a live process.
+ *
+ * @param pid A positive process id that signal zero just found.
+ * @evidence contracts/common.md#principled-implementation The kernel's own process status, zombie or dead with no other thread, establishes the exit; any unreadable or other status leaves the caller's signal-zero answer standing.
+ * @evidence contracts/common.md#clear-and-simple-design One predicate serves the shared-compile lock, session-owner and watch-probe owners alike.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts No PID list, timeout or error-to-exited fallback substitutes for the kernel status.
+ * @evidence contracts/common.md#meaningful-documentation The paragraph explains why signal zero misses a zombie, which parents leave one behind, why a zombie leader with running threads is not one and why its id cannot name a live process.
+ * @evidence contracts/portability.md#os-neutral-implementation Only Linux exposes zombies through /proc; other platforms keep their probe's answer.
+ * @evidence contracts/performance.md#efficient-algorithms One small /proc read on Linux, nothing elsewhere.
+ * @evidenceExclude contracts/performance.md#reuse-equivalent-work Process state is a current observation and is never cached.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The read retains no handle; the status text becomes reclaimable on return.
+ */
+function isZombieProcess(pid) {
+    if (process.platform !== "linux")
+        return false;
+    let status;
+    try {
+        status = fs.readFileSync(`/proc/${pid}/status`, "utf8");
+    }
+    catch {
+        return false;
+    }
+    const state = /^State:\s*(\S)/m.exec(status)?.[1];
+    const threads = /^Threads:\s*(\d+)/m.exec(status)?.[1];
+    return (state === "Z" || state === "X") && threads === "1";
+}
+
+export { isZombieProcess };
+//# sourceMappingURL=isZombieProcess.mjs.map

package/lib/core/transform/utils/isZombieProcess.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"isZombieProcess.mjs","sources":["../../../../src/core/transform/utils/isZombieProcess.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAEA;;;;;;;;;;;;;;;;;;;;;;;;AAwBG;AACG,SAAU,eAAe,CAAC,GAAW,EAAA;AACzC,IAAA,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;AAAE,QAAA,OAAO,KAAK;AAC9C,IAAA,IAAI,MAAc;AAClB,IAAA,IAAI;QACF,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,CAAA,MAAA,EAAS,GAAG,CAAA,OAAA,CAAS,EAAE,MAAM,CAAC;IACzD;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,KAAK;IACd;AACA,IAAA,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACjD,IAAA,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACtD,IAAA,OAAO,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,KAAK,OAAO,KAAK,GAAG;AAC5D;;;;"}

package/lib/core/transform/validation/TtscGenerationProof.d.cts

@@ -43,6 +43,12 @@ export declare namespace TtscGenerationProof {
         readonly environments?: ReadonlyMap<string, string | undefined>;
         /** Current native predicate verdict, unbuilt until its first gate. */
         nativePredicates?: boolean;
+        /**
+         * Identities this admission's location verification read, by watched
+         * directory, absent when it ran none. An identity proves its directory is
+         * one now; an absent or undefined entry proves nothing.
+         */
+        readonly locations?: ReadonlyMap<string, string | undefined>;
     }
     /**
      * Prepare native authority only when this delivery needs a new input proof.
@@ -60,15 +66,17 @@ export declare namespace TtscGenerationProof {
     function prepare(cached: TtscCachedProjectTransform, file: string, epoch: number | undefined): Promise<void>;
     /**
      * Start fresh synchronous observation after notification and preparation
-     * awaits, sharing actual SDK queries and native predicate replay locally.
+     * awaits, sharing actual SDK queries and native predicate replay locally. A
+     * persistent delivery also rechecks its trackers' watched directories here
+     * and keeps what that read for the validators that follow.
      *
-     * @evidence contracts/common.md#principled-implementation Current environments are batch-qualified after asynchronous work; a qualified pass needs no redundant native environment observation.
+     * @evidence contracts/common.md#principled-implementation Current environments are batch-qualified after asynchronous work, and a persistent delivery's watched directories are rechecked after it; a qualified pass needs no redundant native environment observation.
      * @evidence contracts/common.md#clear-and-simple-design One constructor binds observations to their exact generation.
      * @evidence contracts/common.md#prohibited-implementation-shortcuts No current verdict is retained across deliveries or asynchronous boundaries.
      * @evidence contracts/common.md#meaningful-documentation Native prose identifies the mandatory ordering and synchronous lifetime.
      * @evidence contracts/portability.md#os-neutral-implementation Native observation remains with the environment witness owner and actual generation path identity.
-     * @evidence contracts/performance.md#efficient-algorithms Plugin selection is generation-indexed; one batch shares variable hashing and distinct SDK metadata queries.
-     * @evidence contracts/performance.md#reuse-equivalent-work Only the following synchronous validators borrow this batch; pass sharing uses its independent first-delivery contract.
+     * @evidence contracts/performance.md#efficient-algorithms Plugin selection is generation-indexed; one batch shares variable hashing and distinct SDK metadata queries, and location verification reads each watched directory once.
+     * @evidence contracts/performance.md#reuse-equivalent-work Only the following synchronous validators borrow this batch and the location identities; pass sharing uses its independent first-delivery contract.
      * @evidence contracts/performance.md#bound-retention-and-release-resources The caller releases the transaction at the end of synchronous admission; no registry or native handle is acquired.
      */
     function create(cached: TtscCachedProjectTransform, file: string, epoch: number | undefined): Transaction;

package/lib/core/transform/validation/TtscGenerationProof.d.mts

@@ -43,6 +43,12 @@ export declare namespace TtscGenerationProof {
         readonly environments?: ReadonlyMap<string, string | undefined>;
         /** Current native predicate verdict, unbuilt until its first gate. */
         nativePredicates?: boolean;
+        /**
+         * Identities this admission's location verification read, by watched
+         * directory, absent when it ran none. An identity proves its directory is
+         * one now; an absent or undefined entry proves nothing.
+         */
+        readonly locations?: ReadonlyMap<string, string | undefined>;
     }
     /**
      * Prepare native authority only when this delivery needs a new input proof.
@@ -60,15 +66,17 @@ export declare namespace TtscGenerationProof {
     function prepare(cached: TtscCachedProjectTransform, file: string, epoch: number | undefined): Promise<void>;
     /**
      * Start fresh synchronous observation after notification and preparation
-     * awaits, sharing actual SDK queries and native predicate replay locally.
+     * awaits, sharing actual SDK queries and native predicate replay locally. A
+     * persistent delivery also rechecks its trackers' watched directories here
+     * and keeps what that read for the validators that follow.
      *
-     * @evidence contracts/common.md#principled-implementation Current environments are batch-qualified after asynchronous work; a qualified pass needs no redundant native environment observation.
+     * @evidence contracts/common.md#principled-implementation Current environments are batch-qualified after asynchronous work, and a persistent delivery's watched directories are rechecked after it; a qualified pass needs no redundant native environment observation.
      * @evidence contracts/common.md#clear-and-simple-design One constructor binds observations to their exact generation.
      * @evidence contracts/common.md#prohibited-implementation-shortcuts No current verdict is retained across deliveries or asynchronous boundaries.
      * @evidence contracts/common.md#meaningful-documentation Native prose identifies the mandatory ordering and synchronous lifetime.
      * @evidence contracts/portability.md#os-neutral-implementation Native observation remains with the environment witness owner and actual generation path identity.
-     * @evidence contracts/performance.md#efficient-algorithms Plugin selection is generation-indexed; one batch shares variable hashing and distinct SDK metadata queries.
-     * @evidence contracts/performance.md#reuse-equivalent-work Only the following synchronous validators borrow this batch; pass sharing uses its independent first-delivery contract.
+     * @evidence contracts/performance.md#efficient-algorithms Plugin selection is generation-indexed; one batch shares variable hashing and distinct SDK metadata queries, and location verification reads each watched directory once.
+     * @evidence contracts/performance.md#reuse-equivalent-work Only the following synchronous validators borrow this batch and the location identities; pass sharing uses its independent first-delivery contract.
      * @evidence contracts/performance.md#bound-retention-and-release-resources The caller releases the transaction at the end of synchronous admission; no registry or native handle is acquired.
      */
     function create(cached: TtscCachedProjectTransform, file: string, epoch: number | undefined): Transaction;

package/lib/core/transform/validation/TtscGenerationProof.d.ts

@@ -43,6 +43,12 @@ export declare namespace TtscGenerationProof {
         readonly environments?: ReadonlyMap<string, string | undefined>;
         /** Current native predicate verdict, unbuilt until its first gate. */
         nativePredicates?: boolean;
+        /**
+         * Identities this admission's location verification read, by watched
+         * directory, absent when it ran none. An identity proves its directory is
+         * one now; an absent or undefined entry proves nothing.
+         */
+        readonly locations?: ReadonlyMap<string, string | undefined>;
     }
     /**
      * Prepare native authority only when this delivery needs a new input proof.
@@ -60,15 +66,17 @@ export declare namespace TtscGenerationProof {
     function prepare(cached: TtscCachedProjectTransform, file: string, epoch: number | undefined): Promise<void>;
     /**
      * Start fresh synchronous observation after notification and preparation
-     * awaits, sharing actual SDK queries and native predicate replay locally.
+     * awaits, sharing actual SDK queries and native predicate replay locally. A
+     * persistent delivery also rechecks its trackers' watched directories here
+     * and keeps what that read for the validators that follow.
      *
-     * @evidence contracts/common.md#principled-implementation Current environments are batch-qualified after asynchronous work; a qualified pass needs no redundant native environment observation.
+     * @evidence contracts/common.md#principled-implementation Current environments are batch-qualified after asynchronous work, and a persistent delivery's watched directories are rechecked after it; a qualified pass needs no redundant native environment observation.
      * @evidence contracts/common.md#clear-and-simple-design One constructor binds observations to their exact generation.
      * @evidence contracts/common.md#prohibited-implementation-shortcuts No current verdict is retained across deliveries or asynchronous boundaries.
      * @evidence contracts/common.md#meaningful-documentation Native prose identifies the mandatory ordering and synchronous lifetime.
      * @evidence contracts/portability.md#os-neutral-implementation Native observation remains with the environment witness owner and actual generation path identity.
-     * @evidence contracts/performance.md#efficient-algorithms Plugin selection is generation-indexed; one batch shares variable hashing and distinct SDK metadata queries.
-     * @evidence contracts/performance.md#reuse-equivalent-work Only the following synchronous validators borrow this batch; pass sharing uses its independent first-delivery contract.
+     * @evidence contracts/performance.md#efficient-algorithms Plugin selection is generation-indexed; one batch shares variable hashing and distinct SDK metadata queries, and location verification reads each watched directory once.
+     * @evidence contracts/performance.md#reuse-equivalent-work Only the following synchronous validators borrow this batch and the location identities; pass sharing uses its independent first-delivery contract.
      * @evidence contracts/performance.md#bound-retention-and-release-resources The caller releases the transaction at the end of synchronous admission; no registry or native handle is acquired.
      */
     function create(cached: TtscCachedProjectTransform, file: string, epoch: number | undefined): Transaction;

package/lib/core/transform/validation/TtscGenerationProof.js

@@ -9,6 +9,7 @@ var selectPluginSourceInputs = require('../envelope/selectPluginSourceInputs.js'
 var pathIdentityKey = require('../filesystem/pathIdentityKey.js');
 var preparePluginBuildEnvironments = require('../inputs/preparePluginBuildEnvironments.js');
 var toProjectKey = require('../project/toProjectKey.js');
+var verifyGenerationLocations = require('../tracker/verifyGenerationLocations.js');
 
 /**
  * The shared ownership boundary for generation reuse in every adapter.
@@ -53,20 +54,28 @@ exports.TtscGenerationProof = void 0;
     TtscGenerationProof.prepare = prepare;
     /**
      * Start fresh synchronous observation after notification and preparation
-     * awaits, sharing actual SDK queries and native predicate replay locally.
+     * awaits, sharing actual SDK queries and native predicate replay locally. A
+     * persistent delivery also rechecks its trackers' watched directories here
+     * and keeps what that read for the validators that follow.
      *
-     * @evidence contracts/common.md#principled-implementation Current environments are batch-qualified after asynchronous work; a qualified pass needs no redundant native environment observation.
+     * @evidence contracts/common.md#principled-implementation Current environments are batch-qualified after asynchronous work, and a persistent delivery's watched directories are rechecked after it; a qualified pass needs no redundant native environment observation.
      * @evidence contracts/common.md#clear-and-simple-design One constructor binds observations to their exact generation.
      * @evidence contracts/common.md#prohibited-implementation-shortcuts No current verdict is retained across deliveries or asynchronous boundaries.
      * @evidence contracts/common.md#meaningful-documentation Native prose identifies the mandatory ordering and synchronous lifetime.
      * @evidence contracts/portability.md#os-neutral-implementation Native observation remains with the environment witness owner and actual generation path identity.
-     * @evidence contracts/performance.md#efficient-algorithms Plugin selection is generation-indexed; one batch shares variable hashing and distinct SDK metadata queries.
-     * @evidence contracts/performance.md#reuse-equivalent-work Only the following synchronous validators borrow this batch; pass sharing uses its independent first-delivery contract.
+     * @evidence contracts/performance.md#efficient-algorithms Plugin selection is generation-indexed; one batch shares variable hashing and distinct SDK metadata queries, and location verification reads each watched directory once.
+     * @evidence contracts/performance.md#reuse-equivalent-work Only the following synchronous validators borrow this batch and the location identities; pass sharing uses its independent first-delivery contract.
      * @evidence contracts/performance.md#bound-retention-and-release-resources The caller releases the transaction at the end of synchronous admission; no registry or native handle is acquired.
      */
     function create(cached, file, epoch) {
         return {
             cached,
+            // A persistent delivery rechecks its watched directories here, after
+            // its last await, so a directory replaced while it prepared withdraws
+            // its tracker before admission reads it.
+            ...(epoch === undefined
+                ? { locations: verifyGenerationLocations.verifyGenerationLocations(cached) }
+                : {}),
             ...(sharesPass(cached, file, epoch)
                 ? {}
                 : {

package/lib/core/transform/validation/TtscGenerationProof.js.map

@@ -1 +1 @@
-{"version":3,"file":"TtscGenerationProof.js","sources":["../../../../src/core/transform/validation/TtscGenerationProof.ts"],"sourcesContent":[null],"names":["TtscGenerationProof","preparePluginBuildEnvironments","resultFilesystem","PluginBuildEnvironmentReadings","selectPluginSourceInputs","envelopeDerivation","pathIdentityKey","toProjectKey","disposeCachedTransform","evictGeneration"],"mappings":";;;;;;;;;;;;AAcA;;;;;;;;;;;;;;;;;;;;AAoBG;AACcA;AAAjB,CAAA,UAAiB,mBAAmB,EAAA;AAyBlC;;;;;;;;;;;;AAYG;AACI,IAAA,eAAe,OAAO,CAC3B,MAAkC,EAClC,IAAY,EACZ,KAAyB,EAAA;QAEzB,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC;AAClC,YAAA,MAAMC,6DAA8B,CAClC,MAAM,CAAC,MAAM,EACbC,iCAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,EAC/B,MAAM,CACP;IACL;AAXsB,IAAA,mBAAA,CAAA,OAAO,UAW5B;AAED;;;;;;;;;;;;AAYG;AACH,IAAA,SAAgB,MAAM,CACpB,MAAkC,EAClC,IAAY,EACZ,KAAyB,EAAA;QAEzB,OAAO;YACL,MAAM;YACN,IAAI,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK;AAChC,kBAAE;AACF,kBAAE;AACE,oBAAA,YAAY,EAAEC,2CAA8B,CAAC,SAAS,CACpDC,iDAAwB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAC/C;iBACF,CAAC;SACP;IACH;AAfgB,IAAA,mBAAA,CAAA,MAAM,SAerB;AAED;;;;;;;;;;;;AAYG;AACH,IAAA,SAAgB,UAAU,CACxB,MAAkC,EAClC,IAAY,EACZ,KAAyB,EAAA;QAEzB,IACE,KAAK,KAAK,SAAS;YACnB,MAAM,CAAC,aAAa,KAAK,KAAK;AAC9B,aAAC,MAAM,CAAC,uBAAuB,KAAK,IAAI;AACtC,gBAAA,MAAM,CAAC,gBAAgB,KAAK,IAAI,CAAC;aAClC,MAAM,CAAC,iBAAiB,KAAK,IAAI,IAAI,MAAM,CAAC,gBAAgB,KAAK,IAAI,CAAC;AAEvE,YAAA,OAAO,KAAK;QACd,MAAM,UAAU,GAAGC,qCAAkB,CAAC,MAAM,CAAC,CAAC,eAAe;QAC7D,MAAM,QAAQ,GAAGC,+BAAe,CAAC,IAAI,EAAE,UAAU,CAAC;AAClD,QAAA,IAAI,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC;AAAE,YAAA,OAAO,KAAK;AACnD,QAAA,MAAM,GAAG,GAAGC,yBAAY,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,UAAU,CAAC;QAC9D,QACE,MAAM,CAAC,YAAY,GAAG,QAAQ,CAAC,KAAK,SAAS;YAC7C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC;YACtC,MAAM,CAAC,mBAAmB,GAAG,QAAQ,CAAC,KAAK,SAAS;IAExD;AAtBgB,IAAA,mBAAA,CAAA,UAAU,aAsBzB;AAED;;;;;;;;;;;;;;AAcG;AACH,IAAA,SAAgB,cAAc,CAC5B,MAAkC,EAClC,KAAqC,EACrC,GAAW,EACX,UAA+C,EAC/C,KAAyB,EACzB,KAAqC,EAAA;AAErC,QAAA,IAAI,MAAM,CAAC,iBAAiB,KAAK,IAAI;YAAE;AACvC,QAAA,MAAM,UAAU,GACd,KAAK,EAAE,QAAQ,KAAK,KAAK;YACzB,KAAK,CAAC,YAAY,KAAK,SAAS;AAChC,aAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS;AACpC,gBAAA,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC;QACrC,MAAM,MAAM,GACV,UAAU;AACV,YAAA,KAAK,KAAK,SAAS;YACnB,MAAM,CAAC,aAAa,KAAK,KAAK;AAC9B,YAAA,MAAM,CAAC,gBAAgB,KAAK,IAAI;QAClCC,6CAAsB,CAAC,MAAM,CAAC;AAC9B,QAAA,IAAI,CAAC,MAAM;AAAE,YAAAC,+BAAe,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC;QACpD,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU;AACjD,YAAA,MAAM,IAAI,KAAK,CACb,iOAAiO,CAClO;AACH,QAAA,IAAI;AACF,YAAA,KAAK,EAAE,YAAY,IAAI;QACzB;QAAE,OAAO,KAAK,EAAE;AACd,YAAAA,+BAAe,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC;AACvC,YAAA,MAAM,KAAK;QACb;IACF;AA/BgB,IAAA,mBAAA,CAAA,cAAc,iBA+B7B;AACH,CAAC,EArKgBT,2BAAmB,KAAnBA,2BAAmB,GAAA,EAAA,CAAA,CAAA;;"}
+{"version":3,"file":"TtscGenerationProof.js","sources":["../../../../src/core/transform/validation/TtscGenerationProof.ts"],"sourcesContent":[null],"names":["TtscGenerationProof","preparePluginBuildEnvironments","resultFilesystem","verifyGenerationLocations","PluginBuildEnvironmentReadings","selectPluginSourceInputs","envelopeDerivation","pathIdentityKey","toProjectKey","disposeCachedTransform","evictGeneration"],"mappings":";;;;;;;;;;;;;AAeA;;;;;;;;;;;;;;;;;;;;AAoBG;AACcA;AAAjB,CAAA,UAAiB,mBAAmB,EAAA;AAgClC;;;;;;;;;;;;AAYG;AACI,IAAA,eAAe,OAAO,CAC3B,MAAkC,EAClC,IAAY,EACZ,KAAyB,EAAA;QAEzB,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC;AAClC,YAAA,MAAMC,6DAA8B,CAClC,MAAM,CAAC,MAAM,EACbC,iCAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,EAC/B,MAAM,CACP;IACL;AAXsB,IAAA,mBAAA,CAAA,OAAO,UAW5B;AAED;;;;;;;;;;;;;;AAcG;AACH,IAAA,SAAgB,MAAM,CACpB,MAAkC,EAClC,IAAY,EACZ,KAAyB,EAAA;QAEzB,OAAO;YACL,MAAM;;;;YAIN,IAAI,KAAK,KAAK;kBACV,EAAE,SAAS,EAAEC,mDAAyB,CAAC,MAAM,CAAC;kBAC9C,EAAE,CAAC;YACP,IAAI,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK;AAChC,kBAAE;AACF,kBAAE;AACE,oBAAA,YAAY,EAAEC,2CAA8B,CAAC,SAAS,CACpDC,iDAAwB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAC/C;iBACF,CAAC;SACP;IACH;AArBgB,IAAA,mBAAA,CAAA,MAAM,SAqBrB;AAED;;;;;;;;;;;;AAYG;AACH,IAAA,SAAgB,UAAU,CACxB,MAAkC,EAClC,IAAY,EACZ,KAAyB,EAAA;QAEzB,IACE,KAAK,KAAK,SAAS;YACnB,MAAM,CAAC,aAAa,KAAK,KAAK;AAC9B,aAAC,MAAM,CAAC,uBAAuB,KAAK,IAAI;AACtC,gBAAA,MAAM,CAAC,gBAAgB,KAAK,IAAI,CAAC;aAClC,MAAM,CAAC,iBAAiB,KAAK,IAAI,IAAI,MAAM,CAAC,gBAAgB,KAAK,IAAI,CAAC;AAEvE,YAAA,OAAO,KAAK;QACd,MAAM,UAAU,GAAGC,qCAAkB,CAAC,MAAM,CAAC,CAAC,eAAe;QAC7D,MAAM,QAAQ,GAAGC,+BAAe,CAAC,IAAI,EAAE,UAAU,CAAC;AAClD,QAAA,IAAI,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC;AAAE,YAAA,OAAO,KAAK;AACnD,QAAA,MAAM,GAAG,GAAGC,yBAAY,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,UAAU,CAAC;QAC9D,QACE,MAAM,CAAC,YAAY,GAAG,QAAQ,CAAC,KAAK,SAAS;YAC7C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC;YACtC,MAAM,CAAC,mBAAmB,GAAG,QAAQ,CAAC,KAAK,SAAS;IAExD;AAtBgB,IAAA,mBAAA,CAAA,UAAU,aAsBzB;AAED;;;;;;;;;;;;;;AAcG;AACH,IAAA,SAAgB,cAAc,CAC5B,MAAkC,EAClC,KAAqC,EACrC,GAAW,EACX,UAA+C,EAC/C,KAAyB,EACzB,KAAqC,EAAA;AAErC,QAAA,IAAI,MAAM,CAAC,iBAAiB,KAAK,IAAI;YAAE;AACvC,QAAA,MAAM,UAAU,GACd,KAAK,EAAE,QAAQ,KAAK,KAAK;YACzB,KAAK,CAAC,YAAY,KAAK,SAAS;AAChC,aAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS;AACpC,gBAAA,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC;QACrC,MAAM,MAAM,GACV,UAAU;AACV,YAAA,KAAK,KAAK,SAAS;YACnB,MAAM,CAAC,aAAa,KAAK,KAAK;AAC9B,YAAA,MAAM,CAAC,gBAAgB,KAAK,IAAI;QAClCC,6CAAsB,CAAC,MAAM,CAAC;AAC9B,QAAA,IAAI,CAAC,MAAM;AAAE,YAAAC,+BAAe,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC;QACpD,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU;AACjD,YAAA,MAAM,IAAI,KAAK,CACb,iOAAiO,CAClO;AACH,QAAA,IAAI;AACF,YAAA,KAAK,EAAE,YAAY,IAAI;QACzB;QAAE,OAAO,KAAK,EAAE;AACd,YAAAA,+BAAe,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC;AACvC,YAAA,MAAM,KAAK;QACb;IACF;AA/BgB,IAAA,mBAAA,CAAA,cAAc,iBA+B7B;AACH,CAAC,EApLgBV,2BAAmB,KAAnBA,2BAAmB,GAAA,EAAA,CAAA,CAAA;;"}

package/lib/core/transform/validation/TtscGenerationProof.mjs

@@ -7,6 +7,7 @@ import { selectPluginSourceInputs } from '../envelope/selectPluginSourceInputs.m
 import { pathIdentityKey } from '../filesystem/pathIdentityKey.mjs';
 import { preparePluginBuildEnvironments } from '../inputs/preparePluginBuildEnvironments.mjs';
 import { toProjectKey } from '../project/toProjectKey.mjs';
+import { verifyGenerationLocations } from '../tracker/verifyGenerationLocations.mjs';
 
 /**
  * The shared ownership boundary for generation reuse in every adapter.
@@ -51,20 +52,28 @@ var TtscGenerationProof;
     TtscGenerationProof.prepare = prepare;
     /**
      * Start fresh synchronous observation after notification and preparation
-     * awaits, sharing actual SDK queries and native predicate replay locally.
+     * awaits, sharing actual SDK queries and native predicate replay locally. A
+     * persistent delivery also rechecks its trackers' watched directories here
+     * and keeps what that read for the validators that follow.
      *
-     * @evidence contracts/common.md#principled-implementation Current environments are batch-qualified after asynchronous work; a qualified pass needs no redundant native environment observation.
+     * @evidence contracts/common.md#principled-implementation Current environments are batch-qualified after asynchronous work, and a persistent delivery's watched directories are rechecked after it; a qualified pass needs no redundant native environment observation.
      * @evidence contracts/common.md#clear-and-simple-design One constructor binds observations to their exact generation.
      * @evidence contracts/common.md#prohibited-implementation-shortcuts No current verdict is retained across deliveries or asynchronous boundaries.
      * @evidence contracts/common.md#meaningful-documentation Native prose identifies the mandatory ordering and synchronous lifetime.
      * @evidence contracts/portability.md#os-neutral-implementation Native observation remains with the environment witness owner and actual generation path identity.
-     * @evidence contracts/performance.md#efficient-algorithms Plugin selection is generation-indexed; one batch shares variable hashing and distinct SDK metadata queries.
-     * @evidence contracts/performance.md#reuse-equivalent-work Only the following synchronous validators borrow this batch; pass sharing uses its independent first-delivery contract.
+     * @evidence contracts/performance.md#efficient-algorithms Plugin selection is generation-indexed; one batch shares variable hashing and distinct SDK metadata queries, and location verification reads each watched directory once.
+     * @evidence contracts/performance.md#reuse-equivalent-work Only the following synchronous validators borrow this batch and the location identities; pass sharing uses its independent first-delivery contract.
      * @evidence contracts/performance.md#bound-retention-and-release-resources The caller releases the transaction at the end of synchronous admission; no registry or native handle is acquired.
      */
     function create(cached, file, epoch) {
         return {
             cached,
+            // A persistent delivery rechecks its watched directories here, after
+            // its last await, so a directory replaced while it prepared withdraws
+            // its tracker before admission reads it.
+            ...(epoch === undefined
+                ? { locations: verifyGenerationLocations(cached) }
+                : {}),
             ...(sharesPass(cached, file, epoch)
                 ? {}
                 : {

package/lib/core/transform/validation/TtscGenerationProof.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"TtscGenerationProof.mjs","sources":["../../../../src/core/transform/validation/TtscGenerationProof.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;;;;;;;AAcA;;;;;;;;;;;;;;;;;;;;AAoBG;AACG,IAAW;AAAjB,CAAA,UAAiB,mBAAmB,EAAA;AAyBlC;;;;;;;;;;;;AAYG;AACI,IAAA,eAAe,OAAO,CAC3B,MAAkC,EAClC,IAAY,EACZ,KAAyB,EAAA;QAEzB,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC;AAClC,YAAA,MAAM,8BAA8B,CAClC,MAAM,CAAC,MAAM,EACb,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,EAC/B,MAAM,CACP;IACL;AAXsB,IAAA,mBAAA,CAAA,OAAO,UAW5B;AAED;;;;;;;;;;;;AAYG;AACH,IAAA,SAAgB,MAAM,CACpB,MAAkC,EAClC,IAAY,EACZ,KAAyB,EAAA;QAEzB,OAAO;YACL,MAAM;YACN,IAAI,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK;AAChC,kBAAE;AACF,kBAAE;AACE,oBAAA,YAAY,EAAE,8BAA8B,CAAC,SAAS,CACpD,wBAAwB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAC/C;iBACF,CAAC;SACP;IACH;AAfgB,IAAA,mBAAA,CAAA,MAAM,SAerB;AAED;;;;;;;;;;;;AAYG;AACH,IAAA,SAAgB,UAAU,CACxB,MAAkC,EAClC,IAAY,EACZ,KAAyB,EAAA;QAEzB,IACE,KAAK,KAAK,SAAS;YACnB,MAAM,CAAC,aAAa,KAAK,KAAK;AAC9B,aAAC,MAAM,CAAC,uBAAuB,KAAK,IAAI;AACtC,gBAAA,MAAM,CAAC,gBAAgB,KAAK,IAAI,CAAC;aAClC,MAAM,CAAC,iBAAiB,KAAK,IAAI,IAAI,MAAM,CAAC,gBAAgB,KAAK,IAAI,CAAC;AAEvE,YAAA,OAAO,KAAK;QACd,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,eAAe;QAC7D,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,UAAU,CAAC;AAClD,QAAA,IAAI,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC;AAAE,YAAA,OAAO,KAAK;AACnD,QAAA,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,UAAU,CAAC;QAC9D,QACE,MAAM,CAAC,YAAY,GAAG,QAAQ,CAAC,KAAK,SAAS;YAC7C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC;YACtC,MAAM,CAAC,mBAAmB,GAAG,QAAQ,CAAC,KAAK,SAAS;IAExD;AAtBgB,IAAA,mBAAA,CAAA,UAAU,aAsBzB;AAED;;;;;;;;;;;;;;AAcG;AACH,IAAA,SAAgB,cAAc,CAC5B,MAAkC,EAClC,KAAqC,EACrC,GAAW,EACX,UAA+C,EAC/C,KAAyB,EACzB,KAAqC,EAAA;AAErC,QAAA,IAAI,MAAM,CAAC,iBAAiB,KAAK,IAAI;YAAE;AACvC,QAAA,MAAM,UAAU,GACd,KAAK,EAAE,QAAQ,KAAK,KAAK;YACzB,KAAK,CAAC,YAAY,KAAK,SAAS;AAChC,aAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS;AACpC,gBAAA,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC;QACrC,MAAM,MAAM,GACV,UAAU;AACV,YAAA,KAAK,KAAK,SAAS;YACnB,MAAM,CAAC,aAAa,KAAK,KAAK;AAC9B,YAAA,MAAM,CAAC,gBAAgB,KAAK,IAAI;QAClC,sBAAsB,CAAC,MAAM,CAAC;AAC9B,QAAA,IAAI,CAAC,MAAM;AAAE,YAAA,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC;QACpD,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU;AACjD,YAAA,MAAM,IAAI,KAAK,CACb,iOAAiO,CAClO;AACH,QAAA,IAAI;AACF,YAAA,KAAK,EAAE,YAAY,IAAI;QACzB;QAAE,OAAO,KAAK,EAAE;AACd,YAAA,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC;AACvC,YAAA,MAAM,KAAK;QACb;IACF;AA/BgB,IAAA,mBAAA,CAAA,cAAc,iBA+B7B;AACH,CAAC,EArKgB,mBAAmB,KAAnB,mBAAmB,GAAA,EAAA,CAAA,CAAA;;;;"}
+{"version":3,"file":"TtscGenerationProof.mjs","sources":["../../../../src/core/transform/validation/TtscGenerationProof.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;;;;;;;;AAeA;;;;;;;;;;;;;;;;;;;;AAoBG;AACG,IAAW;AAAjB,CAAA,UAAiB,mBAAmB,EAAA;AAgClC;;;;;;;;;;;;AAYG;AACI,IAAA,eAAe,OAAO,CAC3B,MAAkC,EAClC,IAAY,EACZ,KAAyB,EAAA;QAEzB,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC;AAClC,YAAA,MAAM,8BAA8B,CAClC,MAAM,CAAC,MAAM,EACb,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,EAC/B,MAAM,CACP;IACL;AAXsB,IAAA,mBAAA,CAAA,OAAO,UAW5B;AAED;;;;;;;;;;;;;;AAcG;AACH,IAAA,SAAgB,MAAM,CACpB,MAAkC,EAClC,IAAY,EACZ,KAAyB,EAAA;QAEzB,OAAO;YACL,MAAM;;;;YAIN,IAAI,KAAK,KAAK;kBACV,EAAE,SAAS,EAAE,yBAAyB,CAAC,MAAM,CAAC;kBAC9C,EAAE,CAAC;YACP,IAAI,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK;AAChC,kBAAE;AACF,kBAAE;AACE,oBAAA,YAAY,EAAE,8BAA8B,CAAC,SAAS,CACpD,wBAAwB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAC/C;iBACF,CAAC;SACP;IACH;AArBgB,IAAA,mBAAA,CAAA,MAAM,SAqBrB;AAED;;;;;;;;;;;;AAYG;AACH,IAAA,SAAgB,UAAU,CACxB,MAAkC,EAClC,IAAY,EACZ,KAAyB,EAAA;QAEzB,IACE,KAAK,KAAK,SAAS;YACnB,MAAM,CAAC,aAAa,KAAK,KAAK;AAC9B,aAAC,MAAM,CAAC,uBAAuB,KAAK,IAAI;AACtC,gBAAA,MAAM,CAAC,gBAAgB,KAAK,IAAI,CAAC;aAClC,MAAM,CAAC,iBAAiB,KAAK,IAAI,IAAI,MAAM,CAAC,gBAAgB,KAAK,IAAI,CAAC;AAEvE,YAAA,OAAO,KAAK;QACd,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,eAAe;QAC7D,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,UAAU,CAAC;AAClD,QAAA,IAAI,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC;AAAE,YAAA,OAAO,KAAK;AACnD,QAAA,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,UAAU,CAAC;QAC9D,QACE,MAAM,CAAC,YAAY,GAAG,QAAQ,CAAC,KAAK,SAAS;YAC7C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC;YACtC,MAAM,CAAC,mBAAmB,GAAG,QAAQ,CAAC,KAAK,SAAS;IAExD;AAtBgB,IAAA,mBAAA,CAAA,UAAU,aAsBzB;AAED;;;;;;;;;;;;;;AAcG;AACH,IAAA,SAAgB,cAAc,CAC5B,MAAkC,EAClC,KAAqC,EACrC,GAAW,EACX,UAA+C,EAC/C,KAAyB,EACzB,KAAqC,EAAA;AAErC,QAAA,IAAI,MAAM,CAAC,iBAAiB,KAAK,IAAI;YAAE;AACvC,QAAA,MAAM,UAAU,GACd,KAAK,EAAE,QAAQ,KAAK,KAAK;YACzB,KAAK,CAAC,YAAY,KAAK,SAAS;AAChC,aAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS;AACpC,gBAAA,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC;QACrC,MAAM,MAAM,GACV,UAAU;AACV,YAAA,KAAK,KAAK,SAAS;YACnB,MAAM,CAAC,aAAa,KAAK,KAAK;AAC9B,YAAA,MAAM,CAAC,gBAAgB,KAAK,IAAI;QAClC,sBAAsB,CAAC,MAAM,CAAC;AAC9B,QAAA,IAAI,CAAC,MAAM;AAAE,YAAA,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC;QACpD,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU;AACjD,YAAA,MAAM,IAAI,KAAK,CACb,iOAAiO,CAClO;AACH,QAAA,IAAI;AACF,YAAA,KAAK,EAAE,YAAY,IAAI;QACzB;QAAE,OAAO,KAAK,EAAE;AACd,YAAA,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC;AACvC,YAAA,MAAM,KAAK;QACb;IACF;AA/BgB,IAAA,mBAAA,CAAA,cAAc,iBA+B7B;AACH,CAAC,EApLgB,mBAAmB,KAAnB,mBAAmB,GAAA,EAAA,CAAA,CAAA;;;;"}

package/lib/core/transform/validation/matchesCachedExternalInputs.d.cts

@@ -8,7 +8,7 @@ import type { TtscCachedProjectTransform } from "../cache/TtscCachedProjectTrans
  * The caller adopts those signatures only once every input is proven unchanged,
  * so a signature never outlives the content comparison that justified it.
  *
- * @evidence contracts/common.md#principled-implementation Each lexical spelling replays its predicates or owning content codec; only stable separable metadata can replace that comparison, so aliases cannot answer for one another.
+ * @evidence contracts/common.md#principled-implementation Each lexical spelling replays its predicates or owning content codec and resolves its own physical file; only stable separable metadata can replace that comparison, so aliases cannot answer for one another. Spellings resolving to one physical file now share that file's content read, which the codecs hash by content alone.
  * @evidence contracts/common.md#clear-and-simple-design One pass returns the aggregate verdict and earned signatures, leaving all-or-nothing adoption to its caller.
  * @evidence contracts/common.md#prohibited-implementation-shortcuts Recorded missing states and absent hash keys remain distinct from successful content proof; newer reads do not rewrite the authoritative recorded hashes.
  * @evidence contracts/common.md#meaningful-documentation Native paragraphs distinguish mixed codecs, clock-qualified reuse and caller-owned signature adoption before tags.
@@ -22,7 +22,7 @@ import type { TtscCachedProjectTransform } from "../cache/TtscCachedProjectTrans
  *   failures/listings, then recaptures metadata for earned signatures.
  *   Earned signature storage grows with successful observed spellings; legacy
  *   fallback also materializes the recorded hash key array.
- * @evidence contracts/performance.md#reuse-equivalent-work The generation's unchanged separable signatures share prior content validation; changed metadata or clock ordering requires replay, and adopted signatures come only from a completely successful caller verdict.
+ * @evidence contracts/performance.md#reuse-equivalent-work The generation's unchanged separable signatures share prior content validation; changed metadata or clock ordering requires replay, read once per codec and physical file in this pass, and adopted signatures come only from a completely successful caller verdict.
  */
 export declare function matchesCachedExternalInputs(
 /** Generation recording lexical inputs, distinct codecs and earned signatures. */

package/lib/core/transform/validation/matchesCachedExternalInputs.d.mts

@@ -8,7 +8,7 @@ import type { TtscCachedProjectTransform } from "../cache/TtscCachedProjectTrans
  * The caller adopts those signatures only once every input is proven unchanged,
  * so a signature never outlives the content comparison that justified it.
  *
- * @evidence contracts/common.md#principled-implementation Each lexical spelling replays its predicates or owning content codec; only stable separable metadata can replace that comparison, so aliases cannot answer for one another.
+ * @evidence contracts/common.md#principled-implementation Each lexical spelling replays its predicates or owning content codec and resolves its own physical file; only stable separable metadata can replace that comparison, so aliases cannot answer for one another. Spellings resolving to one physical file now share that file's content read, which the codecs hash by content alone.
  * @evidence contracts/common.md#clear-and-simple-design One pass returns the aggregate verdict and earned signatures, leaving all-or-nothing adoption to its caller.
  * @evidence contracts/common.md#prohibited-implementation-shortcuts Recorded missing states and absent hash keys remain distinct from successful content proof; newer reads do not rewrite the authoritative recorded hashes.
  * @evidence contracts/common.md#meaningful-documentation Native paragraphs distinguish mixed codecs, clock-qualified reuse and caller-owned signature adoption before tags.
@@ -22,7 +22,7 @@ import type { TtscCachedProjectTransform } from "../cache/TtscCachedProjectTrans
  *   failures/listings, then recaptures metadata for earned signatures.
  *   Earned signature storage grows with successful observed spellings; legacy
  *   fallback also materializes the recorded hash key array.
- * @evidence contracts/performance.md#reuse-equivalent-work The generation's unchanged separable signatures share prior content validation; changed metadata or clock ordering requires replay, and adopted signatures come only from a completely successful caller verdict.
+ * @evidence contracts/performance.md#reuse-equivalent-work The generation's unchanged separable signatures share prior content validation; changed metadata or clock ordering requires replay, read once per codec and physical file in this pass, and adopted signatures come only from a completely successful caller verdict.
  */
 export declare function matchesCachedExternalInputs(
 /** Generation recording lexical inputs, distinct codecs and earned signatures. */

package/lib/core/transform/validation/matchesCachedExternalInputs.d.ts

@@ -8,7 +8,7 @@ import type { TtscCachedProjectTransform } from "../cache/TtscCachedProjectTrans
  * The caller adopts those signatures only once every input is proven unchanged,
  * so a signature never outlives the content comparison that justified it.
  *
- * @evidence contracts/common.md#principled-implementation Each lexical spelling replays its predicates or owning content codec; only stable separable metadata can replace that comparison, so aliases cannot answer for one another.
+ * @evidence contracts/common.md#principled-implementation Each lexical spelling replays its predicates or owning content codec and resolves its own physical file; only stable separable metadata can replace that comparison, so aliases cannot answer for one another. Spellings resolving to one physical file now share that file's content read, which the codecs hash by content alone.
  * @evidence contracts/common.md#clear-and-simple-design One pass returns the aggregate verdict and earned signatures, leaving all-or-nothing adoption to its caller.
  * @evidence contracts/common.md#prohibited-implementation-shortcuts Recorded missing states and absent hash keys remain distinct from successful content proof; newer reads do not rewrite the authoritative recorded hashes.
  * @evidence contracts/common.md#meaningful-documentation Native paragraphs distinguish mixed codecs, clock-qualified reuse and caller-owned signature adoption before tags.
@@ -22,7 +22,7 @@ import type { TtscCachedProjectTransform } from "../cache/TtscCachedProjectTrans
  *   failures/listings, then recaptures metadata for earned signatures.
  *   Earned signature storage grows with successful observed spellings; legacy
  *   fallback also materializes the recorded hash key array.
- * @evidence contracts/performance.md#reuse-equivalent-work The generation's unchanged separable signatures share prior content validation; changed metadata or clock ordering requires replay, and adopted signatures come only from a completely successful caller verdict.
+ * @evidence contracts/performance.md#reuse-equivalent-work The generation's unchanged separable signatures share prior content validation; changed metadata or clock ordering requires replay, read once per codec and physical file in this pass, and adopted signatures come only from a completely successful caller verdict.
  */
 export declare function matchesCachedExternalInputs(
 /** Generation recording lexical inputs, distinct codecs and earned signatures. */

package/lib/core/transform/validation/matchesCachedExternalInputs.js

@@ -5,6 +5,7 @@ var resultFilesystem = require('../cache/resultFilesystem.js');
 var derivationIdentity = require('../envelope/derivationIdentity.js');
 var envelopeDerivation = require('../envelope/envelopeDerivation.js');
 var graphInputStateHash = require('../inputs/graphInputStateHash.js');
+var hostInputRealpath = require('../inputs/hostInputRealpath.js');
 var hostInputStateHash = require('../inputs/hostInputStateHash.js');
 var inputMetadataEvidence = require('../inputs/inputMetadataEvidence.js');
 var inputMetadataSignature = require('../inputs/inputMetadataSignature.js');
@@ -20,7 +21,7 @@ var MISSING_INPUT_STATE = require('./MISSING_INPUT_STATE.js');
  * The caller adopts those signatures only once every input is proven unchanged,
  * so a signature never outlives the content comparison that justified it.
  *
- * @evidence contracts/common.md#principled-implementation Each lexical spelling replays its predicates or owning content codec; only stable separable metadata can replace that comparison, so aliases cannot answer for one another.
+ * @evidence contracts/common.md#principled-implementation Each lexical spelling replays its predicates or owning content codec and resolves its own physical file; only stable separable metadata can replace that comparison, so aliases cannot answer for one another. Spellings resolving to one physical file now share that file's content read, which the codecs hash by content alone.
  * @evidence contracts/common.md#clear-and-simple-design One pass returns the aggregate verdict and earned signatures, leaving all-or-nothing adoption to its caller.
  * @evidence contracts/common.md#prohibited-implementation-shortcuts Recorded missing states and absent hash keys remain distinct from successful content proof; newer reads do not rewrite the authoritative recorded hashes.
  * @evidence contracts/common.md#meaningful-documentation Native paragraphs distinguish mixed codecs, clock-qualified reuse and caller-owned signature adoption before tags.
@@ -34,7 +35,7 @@ var MISSING_INPUT_STATE = require('./MISSING_INPUT_STATE.js');
  *   failures/listings, then recaptures metadata for earned signatures.
  *   Earned signature storage grows with successful observed spellings; legacy
  *   fallback also materializes the recorded hash key array.
- * @evidence contracts/performance.md#reuse-equivalent-work The generation's unchanged separable signatures share prior content validation; changed metadata or clock ordering requires replay, and adopted signatures come only from a completely successful caller verdict.
+ * @evidence contracts/performance.md#reuse-equivalent-work The generation's unchanged separable signatures share prior content validation; changed metadata or clock ordering requires replay, read once per codec and physical file in this pass, and adopted signatures come only from a completely successful caller verdict.
  */
 function matchesCachedExternalInputs(
 /** Generation recording lexical inputs, distinct codecs and earned signatures. */
@@ -46,6 +47,8 @@ cached) {
     const filesystem = resultFilesystem.resultFilesystem(cached.result);
     const recordedHashes = cached.externalInputHashes ?? {};
     const recordedSignatures = cached.externalInputSignatures ?? {};
+    // Content hashes this pass read, by codec and current physical file.
+    const sharedReads = new Map();
     // Compare each spelling against the recorded state under its own name. Two
     // spellings share one identity exactly when they selected one physical file
     // at generation time, which is the state a retarget ends, so neither may
@@ -87,9 +90,27 @@ cached) {
             before.signature === recordedSignatures[spelling]) {
             continue;
         }
-        const hash = Object.prototype.hasOwnProperty.call(graphRealpaths, identity)
-            ? graphInputStateHash.graphInputStateHash(file, filesystem)
-            : hostInputStateHash.hostInputStateHash(file, filesystem);
+        // Each spelling resolves on its own and the first one resolving to a
+        // physical file reads it through its own spelling, as the filesystem view
+        // answers; a later spelling resolving to that file now reuses the read,
+        // since the codecs hash content alone. A metadata-only change otherwise
+        // read an alias and its target twice in one delivery.
+        const graph = Object.prototype.hasOwnProperty.call(graphRealpaths, identity);
+        const physical = hostInputRealpath.hostInputRealpath(file, filesystem);
+        const shared = physical === null
+            ? undefined
+            : `${graph ? "graph" : "host"}\0${physical}`;
+        let hash;
+        if (shared !== undefined && sharedReads.has(shared)) {
+            hash = sharedReads.get(shared);
+        }
+        else {
+            hash = graph
+                ? graphInputStateHash.graphInputStateHash(file, filesystem)
+                : hostInputStateHash.hostInputStateHash(file, filesystem);
+            if (shared !== undefined)
+                sharedReads.set(shared, hash);
+        }
         const after = inputMetadataSignature.inputMetadataSignature(file, filesystem);
         if (!Object.prototype.hasOwnProperty.call(recordedHashes, identity) ||
             recordedHashes[identity] !== (hash ?? MISSING_INPUT_STATE.MISSING_INPUT_STATE)) {