@ttsc/unplugin 0.34.1 → 0.34.3

package/README.md

@@ -346,6 +346,7 @@ const options: TtscUnpluginOptions = {
 
 - `project`: path to the `tsconfig.json` used by the bundler. When omitted, each file starts from its nearest `tsconfig.json`. A solution config that admits no files itself, one with `"files": []` and `references` such as the create-vite `react-ts` template's, is followed to the first referenced project that admits the file.
 - `compilerOptions`: temporary override layered on the selected project config.
+- `runExternalCode`: invocation-scoped permission for TypeScript 7.1 content mappers; see the [bundler guide](https://ttsc.dev/docs/setup/unplugin/).
 - `plugins`: direct `ttsc` plugin list override, or `false` to disable plugins.
 
 #### Path Aliases

package/lib/api.js

@@ -20,6 +20,8 @@ var collectProjectInputHashes = require('./core/transform/project/collectProject
 var collectProjectInputHashSnapshot = require('./core/transform/project/collectProjectInputHashSnapshot.js');
 var isProjectWalkPath = require('./core/transform/project/isProjectWalkPath.js');
 var transformTtsc = require('./core/transform/transformTtsc.js');
+var compilerEnvironmentIdentity = require('./core/transform/tsconfig/compilerEnvironmentIdentity.js');
+var resolveCompilerEnvironment = require('./core/transform/tsconfig/resolveCompilerEnvironment.js');
 var captureWatchInputBaseline = require('./core/transform/watch/captureWatchInputBaseline.js');
 var captureWatchInputFileBaseline = require('./core/transform/watch/captureWatchInputFileBaseline.js');
 var isWatchInputKeyBaseline = require('./core/transform/watch/isWatchInputKeyBaseline.js');
@@ -56,6 +58,8 @@ exports.collectProjectInputHashes = collectProjectInputHashes.collectProjectInpu
 exports.collectProjectInputHashSnapshot = collectProjectInputHashSnapshot.collectProjectInputHashSnapshot;
 exports.isProjectWalkPath = isProjectWalkPath.isProjectWalkPath;
 exports.transformTtsc = transformTtsc.transformTtsc;
+exports.compilerEnvironmentIdentity = compilerEnvironmentIdentity.compilerEnvironmentIdentity;
+exports.resolveCompilerEnvironment = resolveCompilerEnvironment.resolveCompilerEnvironment;
 exports.captureWatchInputBaseline = captureWatchInputBaseline.captureWatchInputBaseline;
 exports.captureWatchInputFileBaseline = captureWatchInputFileBaseline.captureWatchInputFileBaseline;
 exports.isWatchInputKeyBaseline = isWatchInputKeyBaseline.isWatchInputKeyBaseline;

package/lib/api.js.map

@@ -1 +1 @@
-{"version":3,"file":"api.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"api.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/lib/api.mjs

@@ -18,6 +18,8 @@ export { collectProjectInputHashes } from './core/transform/project/collectProje
 export { collectProjectInputHashSnapshot } from './core/transform/project/collectProjectInputHashSnapshot.mjs';
 export { isProjectWalkPath } from './core/transform/project/isProjectWalkPath.mjs';
 export { transformTtsc } from './core/transform/transformTtsc.mjs';
+export { compilerEnvironmentIdentity } from './core/transform/tsconfig/compilerEnvironmentIdentity.mjs';
+export { resolveCompilerEnvironment } from './core/transform/tsconfig/resolveCompilerEnvironment.mjs';
 export { captureWatchInputBaseline } from './core/transform/watch/captureWatchInputBaseline.mjs';
 export { captureWatchInputFileBaseline } from './core/transform/watch/captureWatchInputFileBaseline.mjs';
 export { isWatchInputKeyBaseline } from './core/transform/watch/isWatchInputKeyBaseline.mjs';

package/lib/api.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"api.mjs","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"api.mjs","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/lib/core/bridge/TtscProjectRecord.d.cts

@@ -1,3 +1,4 @@
+import type { TtscCompilerArgumentsWitness } from "../transform/tsconfig/TtscCompilerArgumentsWitness.cjs";
 import type { TtscWatchInputEvidence } from "../transform/watch/TtscWatchInputEvidence.cjs";
 import type { ITtscProjectMembershipPolicy } from "../tsconfig/ITtscProjectMembershipPolicy.cjs";
 /**
@@ -19,7 +20,7 @@ import type { ITtscProjectMembershipPolicy } from "../tsconfig/ITtscProjectMembe
  * (`refreshProjectRecordFiles`).
  *
  * @evidence contracts/common.md#principled-implementation
- *   Input evidence and separate membership policy express the generation's
+ *   The optional captured invocation, input evidence and separate membership policy express the generation's
  *   file/predicate and root-population dependencies; signal changes record bytes
  *   without claiming that an observer already owns a new generation.
  * @evidence contracts/common.md#clear-and-simple-design
@@ -48,6 +49,8 @@ import type { ITtscProjectMembershipPolicy } from "../tsconfig/ITtscProjectMembe
  *   and independently imposes no population or byte bound.
  */
 export interface TtscProjectRecord {
+    /** Captured invocation; older records without it require a fresh delivery. */
+    compilerArguments?: TtscCompilerArgumentsWitness;
     /**
      * The paths the generation's plugins reported as dependencies outside the
      * project walk (`TtscCachedProjectTransform.externalDependencyInputs`),

package/lib/core/bridge/TtscProjectRecord.d.mts

@@ -1,3 +1,4 @@
+import type { TtscCompilerArgumentsWitness } from "../transform/tsconfig/TtscCompilerArgumentsWitness.mjs";
 import type { TtscWatchInputEvidence } from "../transform/watch/TtscWatchInputEvidence.mjs";
 import type { ITtscProjectMembershipPolicy } from "../tsconfig/ITtscProjectMembershipPolicy.mjs";
 /**
@@ -19,7 +20,7 @@ import type { ITtscProjectMembershipPolicy } from "../tsconfig/ITtscProjectMembe
  * (`refreshProjectRecordFiles`).
  *
  * @evidence contracts/common.md#principled-implementation
- *   Input evidence and separate membership policy express the generation's
+ *   The optional captured invocation, input evidence and separate membership policy express the generation's
  *   file/predicate and root-population dependencies; signal changes record bytes
  *   without claiming that an observer already owns a new generation.
  * @evidence contracts/common.md#clear-and-simple-design
@@ -48,6 +49,8 @@ import type { ITtscProjectMembershipPolicy } from "../tsconfig/ITtscProjectMembe
  *   and independently imposes no population or byte bound.
  */
 export interface TtscProjectRecord {
+    /** Captured invocation; older records without it require a fresh delivery. */
+    compilerArguments?: TtscCompilerArgumentsWitness;
     /**
      * The paths the generation's plugins reported as dependencies outside the
      * project walk (`TtscCachedProjectTransform.externalDependencyInputs`),

package/lib/core/bridge/TtscProjectRecord.d.ts

@@ -1,3 +1,4 @@
+import type { TtscCompilerArgumentsWitness } from "../transform/tsconfig/TtscCompilerArgumentsWitness";
 import type { TtscWatchInputEvidence } from "../transform/watch/TtscWatchInputEvidence";
 import type { ITtscProjectMembershipPolicy } from "../tsconfig/ITtscProjectMembershipPolicy";
 /**
@@ -19,7 +20,7 @@ import type { ITtscProjectMembershipPolicy } from "../tsconfig/ITtscProjectMembe
  * (`refreshProjectRecordFiles`).
  *
  * @evidence contracts/common.md#principled-implementation
- *   Input evidence and separate membership policy express the generation's
+ *   The optional captured invocation, input evidence and separate membership policy express the generation's
  *   file/predicate and root-population dependencies; signal changes record bytes
  *   without claiming that an observer already owns a new generation.
  * @evidence contracts/common.md#clear-and-simple-design
@@ -48,6 +49,8 @@ import type { ITtscProjectMembershipPolicy } from "../tsconfig/ITtscProjectMembe
  *   and independently imposes no population or byte bound.
  */
 export interface TtscProjectRecord {
+    /** Captured invocation; older records without it require a fresh delivery. */
+    compilerArguments?: TtscCompilerArgumentsWitness;
     /**
      * The paths the generation's plugins reported as dependencies outside the
      * project walk (`TtscCachedProjectTransform.externalDependencyInputs`),

package/lib/core/bridge/projectRecordArgumentsMatch.d.cts

@@ -0,0 +1,18 @@
+import type { TtscProjectRecord } from "./TtscProjectRecord.cjs";
+/**
+ * Require a record's captured invocation to match the current host context.
+ *
+ * A supplied identity describes the active adapter's explicit override too.
+ * Generic detached readers instead replay the recorded override against current
+ * inheritance. Older records lack that authority and require a new delivery.
+ *
+ * @evidence contracts/common.md#principled-implementation Recorded effective arguments must match the active context or a current derivation using the recorded override; absent witnesses never certify unknown prior arguments.
+ * @evidence contracts/common.md#clear-and-simple-design One predicate serves detached proof and watching bridge admission before filesystem evidence can authorize host cache restoration.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Malformed inherited transport declines reuse rather than restoring a result compiled under different permission.
+ * @evidence contracts/common.md#meaningful-documentation Native prose states active versus generic comparison and legacy migration.
+ * @evidence contracts/portability.md#os-neutral-implementation The shared environment owner applies native Windows name selection and preserves argv/cwd spelling without platform guesses.
+ * @evidence contracts/performance.md#efficient-algorithms An active digest requires scalar comparison; generic replay additionally snapshots environment keys and encodes/hashes argument bytes through existing owners.
+ * @evidenceExclude contracts/performance.md#reuse-equivalent-work Current inheritance is observed on each generic proof; no prior environment verdict is retained.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources Only call-local environment/encoding data is allocated; the record owner retains the witness.
+ */
+export declare function projectRecordArgumentsMatch(record: TtscProjectRecord, currentIdentity?: string): boolean;

package/lib/core/bridge/projectRecordArgumentsMatch.d.mts

@@ -0,0 +1,18 @@
+import type { TtscProjectRecord } from "./TtscProjectRecord.mjs";
+/**
+ * Require a record's captured invocation to match the current host context.
+ *
+ * A supplied identity describes the active adapter's explicit override too.
+ * Generic detached readers instead replay the recorded override against current
+ * inheritance. Older records lack that authority and require a new delivery.
+ *
+ * @evidence contracts/common.md#principled-implementation Recorded effective arguments must match the active context or a current derivation using the recorded override; absent witnesses never certify unknown prior arguments.
+ * @evidence contracts/common.md#clear-and-simple-design One predicate serves detached proof and watching bridge admission before filesystem evidence can authorize host cache restoration.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Malformed inherited transport declines reuse rather than restoring a result compiled under different permission.
+ * @evidence contracts/common.md#meaningful-documentation Native prose states active versus generic comparison and legacy migration.
+ * @evidence contracts/portability.md#os-neutral-implementation The shared environment owner applies native Windows name selection and preserves argv/cwd spelling without platform guesses.
+ * @evidence contracts/performance.md#efficient-algorithms An active digest requires scalar comparison; generic replay additionally snapshots environment keys and encodes/hashes argument bytes through existing owners.
+ * @evidenceExclude contracts/performance.md#reuse-equivalent-work Current inheritance is observed on each generic proof; no prior environment verdict is retained.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources Only call-local environment/encoding data is allocated; the record owner retains the witness.
+ */
+export declare function projectRecordArgumentsMatch(record: TtscProjectRecord, currentIdentity?: string): boolean;

package/lib/core/bridge/projectRecordArgumentsMatch.d.ts

@@ -0,0 +1,18 @@
+import type { TtscProjectRecord } from "./TtscProjectRecord";
+/**
+ * Require a record's captured invocation to match the current host context.
+ *
+ * A supplied identity describes the active adapter's explicit override too.
+ * Generic detached readers instead replay the recorded override against current
+ * inheritance. Older records lack that authority and require a new delivery.
+ *
+ * @evidence contracts/common.md#principled-implementation Recorded effective arguments must match the active context or a current derivation using the recorded override; absent witnesses never certify unknown prior arguments.
+ * @evidence contracts/common.md#clear-and-simple-design One predicate serves detached proof and watching bridge admission before filesystem evidence can authorize host cache restoration.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Malformed inherited transport declines reuse rather than restoring a result compiled under different permission.
+ * @evidence contracts/common.md#meaningful-documentation Native prose states active versus generic comparison and legacy migration.
+ * @evidence contracts/portability.md#os-neutral-implementation The shared environment owner applies native Windows name selection and preserves argv/cwd spelling without platform guesses.
+ * @evidence contracts/performance.md#efficient-algorithms An active digest requires scalar comparison; generic replay additionally snapshots environment keys and encodes/hashes argument bytes through existing owners.
+ * @evidenceExclude contracts/performance.md#reuse-equivalent-work Current inheritance is observed on each generic proof; no prior environment verdict is retained.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources Only call-local environment/encoding data is allocated; the record owner retains the witness.
+ */
+export declare function projectRecordArgumentsMatch(record: TtscProjectRecord, currentIdentity?: string): boolean;

package/lib/core/bridge/projectRecordArgumentsMatch.js

@@ -0,0 +1,36 @@
+'use strict';
+
+var captureCompilerArguments = require('../transform/tsconfig/captureCompilerArguments.js');
+var resolveCompilerEnvironment = require('../transform/tsconfig/resolveCompilerEnvironment.js');
+
+/**
+ * Require a record's captured invocation to match the current host context.
+ *
+ * A supplied identity describes the active adapter's explicit override too.
+ * Generic detached readers instead replay the recorded override against current
+ * inheritance. Older records lack that authority and require a new delivery.
+ *
+ * @evidence contracts/common.md#principled-implementation Recorded effective arguments must match the active context or a current derivation using the recorded override; absent witnesses never certify unknown prior arguments.
+ * @evidence contracts/common.md#clear-and-simple-design One predicate serves detached proof and watching bridge admission before filesystem evidence can authorize host cache restoration.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Malformed inherited transport declines reuse rather than restoring a result compiled under different permission.
+ * @evidence contracts/common.md#meaningful-documentation Native prose states active versus generic comparison and legacy migration.
+ * @evidence contracts/portability.md#os-neutral-implementation The shared environment owner applies native Windows name selection and preserves argv/cwd spelling without platform guesses.
+ * @evidence contracts/performance.md#efficient-algorithms An active digest requires scalar comparison; generic replay additionally snapshots environment keys and encodes/hashes argument bytes through existing owners.
+ * @evidenceExclude contracts/performance.md#reuse-equivalent-work Current inheritance is observed on each generic proof; no prior environment verdict is retained.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources Only call-local environment/encoding data is allocated; the record owner retains the witness.
+ */
+function projectRecordArgumentsMatch(record, currentIdentity) {
+    if (record.compilerArguments === undefined)
+        return false;
+    try {
+        return (record.compilerArguments.identity ===
+            (currentIdentity ??
+                captureCompilerArguments.captureCompilerArguments(resolveCompilerEnvironment.resolveCompilerEnvironment(record.compilerArguments.runExternalCode)).identity));
+    }
+    catch {
+        return false;
+    }
+}
+
+exports.projectRecordArgumentsMatch = projectRecordArgumentsMatch;
+//# sourceMappingURL=projectRecordArgumentsMatch.js.map

package/lib/core/bridge/projectRecordArgumentsMatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectRecordArgumentsMatch.js","sources":["../../../src/core/bridge/projectRecordArgumentsMatch.ts"],"sourcesContent":[null],"names":["captureCompilerArguments","resolveCompilerEnvironment"],"mappings":";;;;;AAIA;;;;;;;;;;;;;;;AAeG;AACG,SAAU,2BAA2B,CACzC,MAAyB,EACzB,eAAwB,EAAA;AAExB,IAAA,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS;AAAE,QAAA,OAAO,KAAK;AACxD,IAAA,IAAI;AACF,QAAA,QACE,MAAM,CAAC,iBAAiB,CAAC,QAAQ;AACjC,aAAC,eAAe;AACd,gBAAAA,iDAAwB,CACtBC,qDAA0B,CAAC,MAAM,CAAC,iBAAiB,CAAC,eAAe,CAAC,CACrE,CAAC,QAAQ,CAAC;IAEjB;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,KAAK;IACd;AACF;;;;"}

package/lib/core/bridge/projectRecordArgumentsMatch.mjs

@@ -0,0 +1,34 @@
+import { captureCompilerArguments } from '../transform/tsconfig/captureCompilerArguments.mjs';
+import { resolveCompilerEnvironment } from '../transform/tsconfig/resolveCompilerEnvironment.mjs';
+
+/**
+ * Require a record's captured invocation to match the current host context.
+ *
+ * A supplied identity describes the active adapter's explicit override too.
+ * Generic detached readers instead replay the recorded override against current
+ * inheritance. Older records lack that authority and require a new delivery.
+ *
+ * @evidence contracts/common.md#principled-implementation Recorded effective arguments must match the active context or a current derivation using the recorded override; absent witnesses never certify unknown prior arguments.
+ * @evidence contracts/common.md#clear-and-simple-design One predicate serves detached proof and watching bridge admission before filesystem evidence can authorize host cache restoration.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Malformed inherited transport declines reuse rather than restoring a result compiled under different permission.
+ * @evidence contracts/common.md#meaningful-documentation Native prose states active versus generic comparison and legacy migration.
+ * @evidence contracts/portability.md#os-neutral-implementation The shared environment owner applies native Windows name selection and preserves argv/cwd spelling without platform guesses.
+ * @evidence contracts/performance.md#efficient-algorithms An active digest requires scalar comparison; generic replay additionally snapshots environment keys and encodes/hashes argument bytes through existing owners.
+ * @evidenceExclude contracts/performance.md#reuse-equivalent-work Current inheritance is observed on each generic proof; no prior environment verdict is retained.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources Only call-local environment/encoding data is allocated; the record owner retains the witness.
+ */
+function projectRecordArgumentsMatch(record, currentIdentity) {
+    if (record.compilerArguments === undefined)
+        return false;
+    try {
+        return (record.compilerArguments.identity ===
+            (currentIdentity ??
+                captureCompilerArguments(resolveCompilerEnvironment(record.compilerArguments.runExternalCode)).identity));
+    }
+    catch {
+        return false;
+    }
+}
+
+export { projectRecordArgumentsMatch };
+//# sourceMappingURL=projectRecordArgumentsMatch.mjs.map

package/lib/core/bridge/projectRecordArgumentsMatch.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectRecordArgumentsMatch.mjs","sources":["../../../src/core/bridge/projectRecordArgumentsMatch.ts"],"sourcesContent":[null],"names":[],"mappings":";;;AAIA;;;;;;;;;;;;;;;AAeG;AACG,SAAU,2BAA2B,CACzC,MAAyB,EACzB,eAAwB,EAAA;AAExB,IAAA,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS;AAAE,QAAA,OAAO,KAAK;AACxD,IAAA,IAAI;AACF,QAAA,QACE,MAAM,CAAC,iBAAiB,CAAC,QAAQ;AACjC,aAAC,eAAe;AACd,gBAAA,wBAAwB,CACtB,0BAA0B,CAAC,MAAM,CAAC,iBAAiB,CAAC,eAAe,CAAC,CACrE,CAAC,QAAQ,CAAC;IAEjB;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,KAAK;IACd;AACF;;;;"}

package/lib/core/bridge/projectRecordMoved.d.cts

@@ -1,24 +1,26 @@
 import type { TtscTransformFilesystemOperations } from "../transform/filesystem/TtscTransformFilesystemOperations.cjs";
 import type { TtscProjectRecord } from "./TtscProjectRecord.cjs";
 /**
- * The first recorded input or membership state that current replay cannot
- * establish as unchanged, or nothing when all recorded checks hold. This is the
- * proof a build start makes of a record (`refreshProjectRecordFiles`),
+ * The first invocation, recorded input or membership state that current replay
+ * cannot establish as unchanged, or nothing when all recorded checks hold. This
+ * is the proof a build start makes of a record (`refreshProjectRecordFiles`),
  * separable from the move it follows with, so a harness or a maintainer can ask
  * the same question of a record without moving it.
  *
- * Each recorded input is proven against the disk the way a delivery proves a
- * generation (`watchInputEvidenceMatchesDisk`), and the walk is run again under
- * the recorded policy and its digest compared (`membershipRecordDigest`). A
- * plugin source is proven by the metadata of its files where that metadata
- * holds (`pluginSourceFilesDigest`), which stands for their bytes only against
- * a clock reference minted since any rollback, so the proof mints one first, as
- * a delivery does. It holds no generation, so the reference is minted in the
+ * The captured invocation must match the active context before each recorded
+ * input is proven against the disk the way a delivery proves a generation
+ * (`watchInputEvidenceMatchesDisk`), and the walk is run again under the
+ * recorded policy and its digest compared (`membershipRecordDigest`). A plugin
+ * source is proven by the metadata of its files where that metadata holds
+ * (`pluginSourceFilesDigest`), which stands for their bytes only against a
+ * clock reference minted since any rollback, so the proof mints one first, as a
+ * delivery does. It holds no generation, so the reference is minted in the
  * probe directory this process keeps (`refreshProcessClockReference`).
  *
  * @returns The tsconfig when it is gone, which a build start answers by
  *   removing the record rather than moving it, the first input whose state
- *   moved, the project root when the root files did, or `undefined`.
+ *   moved, the project root when invocation or root membership differs, or
+ *   `undefined`.
  * @evidence contracts/common.md#principled-implementation
  *   Each codec is re-proved against the same filesystem view and membership is
  *   re-walked under the stored policy. A fresh process clock reference prevents
@@ -47,4 +49,4 @@ import type { TtscProjectRecord } from "./TtscProjectRecord.cjs";
  *   than treating prior successful replay or watcher silence as present validity.
  * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The proof owns no independent cache or watcher; its returned mismatch is caller-owned and the process-clock service owns the native reference lifecycle.
  */
-export declare function projectRecordMoved(record: TtscProjectRecord, filesystem?: TtscTransformFilesystemOperations): string | undefined;
+export declare function projectRecordMoved(record: TtscProjectRecord, filesystem?: TtscTransformFilesystemOperations, compilerArgumentsIdentity?: string): string | undefined;

package/lib/core/bridge/projectRecordMoved.d.mts

@@ -1,24 +1,26 @@
 import type { TtscTransformFilesystemOperations } from "../transform/filesystem/TtscTransformFilesystemOperations.mjs";
 import type { TtscProjectRecord } from "./TtscProjectRecord.mjs";
 /**
- * The first recorded input or membership state that current replay cannot
- * establish as unchanged, or nothing when all recorded checks hold. This is the
- * proof a build start makes of a record (`refreshProjectRecordFiles`),
+ * The first invocation, recorded input or membership state that current replay
+ * cannot establish as unchanged, or nothing when all recorded checks hold. This
+ * is the proof a build start makes of a record (`refreshProjectRecordFiles`),
  * separable from the move it follows with, so a harness or a maintainer can ask
  * the same question of a record without moving it.
  *
- * Each recorded input is proven against the disk the way a delivery proves a
- * generation (`watchInputEvidenceMatchesDisk`), and the walk is run again under
- * the recorded policy and its digest compared (`membershipRecordDigest`). A
- * plugin source is proven by the metadata of its files where that metadata
- * holds (`pluginSourceFilesDigest`), which stands for their bytes only against
- * a clock reference minted since any rollback, so the proof mints one first, as
- * a delivery does. It holds no generation, so the reference is minted in the
+ * The captured invocation must match the active context before each recorded
+ * input is proven against the disk the way a delivery proves a generation
+ * (`watchInputEvidenceMatchesDisk`), and the walk is run again under the
+ * recorded policy and its digest compared (`membershipRecordDigest`). A plugin
+ * source is proven by the metadata of its files where that metadata holds
+ * (`pluginSourceFilesDigest`), which stands for their bytes only against a
+ * clock reference minted since any rollback, so the proof mints one first, as a
+ * delivery does. It holds no generation, so the reference is minted in the
  * probe directory this process keeps (`refreshProcessClockReference`).
  *
  * @returns The tsconfig when it is gone, which a build start answers by
  *   removing the record rather than moving it, the first input whose state
- *   moved, the project root when the root files did, or `undefined`.
+ *   moved, the project root when invocation or root membership differs, or
+ *   `undefined`.
  * @evidence contracts/common.md#principled-implementation
  *   Each codec is re-proved against the same filesystem view and membership is
  *   re-walked under the stored policy. A fresh process clock reference prevents
@@ -47,4 +49,4 @@ import type { TtscProjectRecord } from "./TtscProjectRecord.mjs";
  *   than treating prior successful replay or watcher silence as present validity.
  * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The proof owns no independent cache or watcher; its returned mismatch is caller-owned and the process-clock service owns the native reference lifecycle.
  */
-export declare function projectRecordMoved(record: TtscProjectRecord, filesystem?: TtscTransformFilesystemOperations): string | undefined;
+export declare function projectRecordMoved(record: TtscProjectRecord, filesystem?: TtscTransformFilesystemOperations, compilerArgumentsIdentity?: string): string | undefined;

package/lib/core/bridge/projectRecordMoved.d.ts

@@ -1,24 +1,26 @@
 import type { TtscTransformFilesystemOperations } from "../transform/filesystem/TtscTransformFilesystemOperations";
 import type { TtscProjectRecord } from "./TtscProjectRecord";
 /**
- * The first recorded input or membership state that current replay cannot
- * establish as unchanged, or nothing when all recorded checks hold. This is the
- * proof a build start makes of a record (`refreshProjectRecordFiles`),
+ * The first invocation, recorded input or membership state that current replay
+ * cannot establish as unchanged, or nothing when all recorded checks hold. This
+ * is the proof a build start makes of a record (`refreshProjectRecordFiles`),
  * separable from the move it follows with, so a harness or a maintainer can ask
  * the same question of a record without moving it.
  *
- * Each recorded input is proven against the disk the way a delivery proves a
- * generation (`watchInputEvidenceMatchesDisk`), and the walk is run again under
- * the recorded policy and its digest compared (`membershipRecordDigest`). A
- * plugin source is proven by the metadata of its files where that metadata
- * holds (`pluginSourceFilesDigest`), which stands for their bytes only against
- * a clock reference minted since any rollback, so the proof mints one first, as
- * a delivery does. It holds no generation, so the reference is minted in the
+ * The captured invocation must match the active context before each recorded
+ * input is proven against the disk the way a delivery proves a generation
+ * (`watchInputEvidenceMatchesDisk`), and the walk is run again under the
+ * recorded policy and its digest compared (`membershipRecordDigest`). A plugin
+ * source is proven by the metadata of its files where that metadata holds
+ * (`pluginSourceFilesDigest`), which stands for their bytes only against a
+ * clock reference minted since any rollback, so the proof mints one first, as a
+ * delivery does. It holds no generation, so the reference is minted in the
  * probe directory this process keeps (`refreshProcessClockReference`).
  *
  * @returns The tsconfig when it is gone, which a build start answers by
  *   removing the record rather than moving it, the first input whose state
- *   moved, the project root when the root files did, or `undefined`.
+ *   moved, the project root when invocation or root membership differs, or
+ *   `undefined`.
  * @evidence contracts/common.md#principled-implementation
  *   Each codec is re-proved against the same filesystem view and membership is
  *   re-walked under the stored policy. A fresh process clock reference prevents
@@ -47,4 +49,4 @@ import type { TtscProjectRecord } from "./TtscProjectRecord";
  *   than treating prior successful replay or watcher silence as present validity.
  * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The proof owns no independent cache or watcher; its returned mismatch is caller-owned and the process-clock service owns the native reference lifecycle.
  */
-export declare function projectRecordMoved(record: TtscProjectRecord, filesystem?: TtscTransformFilesystemOperations): string | undefined;
+export declare function projectRecordMoved(record: TtscProjectRecord, filesystem?: TtscTransformFilesystemOperations, compilerArgumentsIdentity?: string): string | undefined;

package/lib/core/bridge/projectRecordMoved.js

@@ -5,26 +5,29 @@ var DEFAULT_FILESYSTEM_OPERATIONS = require('../transform/filesystem/DEFAULT_FIL
 var walkProjectInputs = require('../transform/project/walkProjectInputs.js');
 var watchInputEvidenceMatchesDisk = require('../transform/watch/watchInputEvidenceMatchesDisk.js');
 var membershipRecordDigest = require('./membershipRecordDigest.js');
+var projectRecordArgumentsMatch = require('./projectRecordArgumentsMatch.js');
 
 /**
- * The first recorded input or membership state that current replay cannot
- * establish as unchanged, or nothing when all recorded checks hold. This is the
- * proof a build start makes of a record (`refreshProjectRecordFiles`),
+ * The first invocation, recorded input or membership state that current replay
+ * cannot establish as unchanged, or nothing when all recorded checks hold. This
+ * is the proof a build start makes of a record (`refreshProjectRecordFiles`),
  * separable from the move it follows with, so a harness or a maintainer can ask
  * the same question of a record without moving it.
  *
- * Each recorded input is proven against the disk the way a delivery proves a
- * generation (`watchInputEvidenceMatchesDisk`), and the walk is run again under
- * the recorded policy and its digest compared (`membershipRecordDigest`). A
- * plugin source is proven by the metadata of its files where that metadata
- * holds (`pluginSourceFilesDigest`), which stands for their bytes only against
- * a clock reference minted since any rollback, so the proof mints one first, as
- * a delivery does. It holds no generation, so the reference is minted in the
+ * The captured invocation must match the active context before each recorded
+ * input is proven against the disk the way a delivery proves a generation
+ * (`watchInputEvidenceMatchesDisk`), and the walk is run again under the
+ * recorded policy and its digest compared (`membershipRecordDigest`). A plugin
+ * source is proven by the metadata of its files where that metadata holds
+ * (`pluginSourceFilesDigest`), which stands for their bytes only against a
+ * clock reference minted since any rollback, so the proof mints one first, as a
+ * delivery does. It holds no generation, so the reference is minted in the
  * probe directory this process keeps (`refreshProcessClockReference`).
  *
  * @returns The tsconfig when it is gone, which a build start answers by
  *   removing the record rather than moving it, the first input whose state
- *   moved, the project root when the root files did, or `undefined`.
+ *   moved, the project root when invocation or root membership differs, or
+ *   `undefined`.
  * @evidence contracts/common.md#principled-implementation
  *   Each codec is re-proved against the same filesystem view and membership is
  *   re-walked under the stored policy. A fresh process clock reference prevents
@@ -53,9 +56,11 @@ var membershipRecordDigest = require('./membershipRecordDigest.js');
  *   than treating prior successful replay or watcher silence as present validity.
  * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The proof owns no independent cache or watcher; its returned mismatch is caller-owned and the process-clock service owns the native reference lifecycle.
  */
-function projectRecordMoved(record, filesystem = DEFAULT_FILESYSTEM_OPERATIONS.DEFAULT_FILESYSTEM_OPERATIONS) {
+function projectRecordMoved(record, filesystem = DEFAULT_FILESYSTEM_OPERATIONS.DEFAULT_FILESYSTEM_OPERATIONS, compilerArgumentsIdentity) {
     if (!filesystem.exists(record.tsconfig))
         return record.tsconfig;
+    if (!projectRecordArgumentsMatch.projectRecordArgumentsMatch(record, compilerArgumentsIdentity))
+        return record.root;
     refreshProcessClockReference.refreshProcessClockReference(record.root, filesystem);
     for (const [input, evidence] of Object.entries(record.inputs)) {
         if (evidence === null || typeof evidence !== "object")

package/lib/core/bridge/projectRecordMoved.js.map

@@ -1 +1 @@
-{"version":3,"file":"projectRecordMoved.js","sources":["../../../src/core/bridge/projectRecordMoved.ts"],"sourcesContent":[null],"names":["DEFAULT_FILESYSTEM_OPERATIONS","refreshProcessClockReference","watchInputEvidenceMatchesDisk","walkProjectInputs","membershipRecordDigest"],"mappings":";;;;;;;;AAQA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8CG;SACa,kBAAkB,CAChC,MAAyB,EACzB,aAAgDA,2DAA6B,EAAA;IAE7E,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC,QAAQ;AAC/D,IAAAC,yDAA4B,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC;AACrD,IAAA,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;AAC7D,QAAA,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ;AAAE,YAAA,OAAO,KAAK;AACnE,QAAA,IACE,CAACC,2DAA6B,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC;AAExE,YAAA,OAAO,KAAK;IAChB;AACA,IAAA,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;AAAE,QAAA,OAAO,SAAS;AAChD,IAAA,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU;AACpC,IAAA,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAGC,mCAAiB,CACjD,MAAM,CAAC,IAAI,EACX,UAAU,EACV,MAAM,CACP;AACD,IAAA,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI;AACjC,IAAA,OAAOC,6CAAsB,CAAC,MAAM,EAAE,WAAW,CAAC;QAChD,MAAM,CAAC,UAAU,CAAC;AAClB,UAAE;AACF,UAAE,MAAM,CAAC,IAAI;AACjB;;;;"}
+{"version":3,"file":"projectRecordMoved.js","sources":["../../../src/core/bridge/projectRecordMoved.ts"],"sourcesContent":[null],"names":["DEFAULT_FILESYSTEM_OPERATIONS","projectRecordArgumentsMatch","refreshProcessClockReference","watchInputEvidenceMatchesDisk","walkProjectInputs","membershipRecordDigest"],"mappings":";;;;;;;;;AASA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDG;AACG,SAAU,kBAAkB,CAChC,MAAyB,EACzB,UAAA,GAAgDA,2DAA6B,EAC7E,yBAAkC,EAAA;IAElC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC,QAAQ;AAC/D,IAAA,IAAI,CAACC,uDAA2B,CAAC,MAAM,EAAE,yBAAyB,CAAC;QACjE,OAAO,MAAM,CAAC,IAAI;AACpB,IAAAC,yDAA4B,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC;AACrD,IAAA,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;AAC7D,QAAA,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ;AAAE,YAAA,OAAO,KAAK;AACnE,QAAA,IACE,CAACC,2DAA6B,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC;AAExE,YAAA,OAAO,KAAK;IAChB;AACA,IAAA,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;AAAE,QAAA,OAAO,SAAS;AAChD,IAAA,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU;AACpC,IAAA,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAGC,mCAAiB,CACjD,MAAM,CAAC,IAAI,EACX,UAAU,EACV,MAAM,CACP;AACD,IAAA,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI;AACjC,IAAA,OAAOC,6CAAsB,CAAC,MAAM,EAAE,WAAW,CAAC;QAChD,MAAM,CAAC,UAAU,CAAC;AAClB,UAAE;AACF,UAAE,MAAM,CAAC,IAAI;AACjB;;;;"}

package/lib/core/bridge/projectRecordMoved.mjs

@@ -3,26 +3,29 @@ import { DEFAULT_FILESYSTEM_OPERATIONS } from '../transform/filesystem/DEFAULT_F
 import { walkProjectInputs } from '../transform/project/walkProjectInputs.mjs';
 import { watchInputEvidenceMatchesDisk } from '../transform/watch/watchInputEvidenceMatchesDisk.mjs';
 import { membershipRecordDigest } from './membershipRecordDigest.mjs';
+import { projectRecordArgumentsMatch } from './projectRecordArgumentsMatch.mjs';
 
 /**
- * The first recorded input or membership state that current replay cannot
- * establish as unchanged, or nothing when all recorded checks hold. This is the
- * proof a build start makes of a record (`refreshProjectRecordFiles`),
+ * The first invocation, recorded input or membership state that current replay
+ * cannot establish as unchanged, or nothing when all recorded checks hold. This
+ * is the proof a build start makes of a record (`refreshProjectRecordFiles`),
  * separable from the move it follows with, so a harness or a maintainer can ask
  * the same question of a record without moving it.
  *
- * Each recorded input is proven against the disk the way a delivery proves a
- * generation (`watchInputEvidenceMatchesDisk`), and the walk is run again under
- * the recorded policy and its digest compared (`membershipRecordDigest`). A
- * plugin source is proven by the metadata of its files where that metadata
- * holds (`pluginSourceFilesDigest`), which stands for their bytes only against
- * a clock reference minted since any rollback, so the proof mints one first, as
- * a delivery does. It holds no generation, so the reference is minted in the
+ * The captured invocation must match the active context before each recorded
+ * input is proven against the disk the way a delivery proves a generation
+ * (`watchInputEvidenceMatchesDisk`), and the walk is run again under the
+ * recorded policy and its digest compared (`membershipRecordDigest`). A plugin
+ * source is proven by the metadata of its files where that metadata holds
+ * (`pluginSourceFilesDigest`), which stands for their bytes only against a
+ * clock reference minted since any rollback, so the proof mints one first, as a
+ * delivery does. It holds no generation, so the reference is minted in the
  * probe directory this process keeps (`refreshProcessClockReference`).
  *
  * @returns The tsconfig when it is gone, which a build start answers by
  *   removing the record rather than moving it, the first input whose state
- *   moved, the project root when the root files did, or `undefined`.
+ *   moved, the project root when invocation or root membership differs, or
+ *   `undefined`.
  * @evidence contracts/common.md#principled-implementation
  *   Each codec is re-proved against the same filesystem view and membership is
  *   re-walked under the stored policy. A fresh process clock reference prevents
@@ -51,9 +54,11 @@ import { membershipRecordDigest } from './membershipRecordDigest.mjs';
  *   than treating prior successful replay or watcher silence as present validity.
  * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The proof owns no independent cache or watcher; its returned mismatch is caller-owned and the process-clock service owns the native reference lifecycle.
  */
-function projectRecordMoved(record, filesystem = DEFAULT_FILESYSTEM_OPERATIONS) {
+function projectRecordMoved(record, filesystem = DEFAULT_FILESYSTEM_OPERATIONS, compilerArgumentsIdentity) {
     if (!filesystem.exists(record.tsconfig))
         return record.tsconfig;
+    if (!projectRecordArgumentsMatch(record, compilerArgumentsIdentity))
+        return record.root;
     refreshProcessClockReference(record.root, filesystem);
     for (const [input, evidence] of Object.entries(record.inputs)) {
         if (evidence === null || typeof evidence !== "object")

package/lib/core/bridge/projectRecordMoved.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"projectRecordMoved.mjs","sources":["../../../src/core/bridge/projectRecordMoved.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;;;AAQA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8CG;SACa,kBAAkB,CAChC,MAAyB,EACzB,aAAgD,6BAA6B,EAAA;IAE7E,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC,QAAQ;AAC/D,IAAA,4BAA4B,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC;AACrD,IAAA,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;AAC7D,QAAA,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ;AAAE,YAAA,OAAO,KAAK;AACnE,QAAA,IACE,CAAC,6BAA6B,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC;AAExE,YAAA,OAAO,KAAK;IAChB;AACA,IAAA,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;AAAE,QAAA,OAAO,SAAS;AAChD,IAAA,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU;AACpC,IAAA,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,iBAAiB,CACjD,MAAM,CAAC,IAAI,EACX,UAAU,EACV,MAAM,CACP;AACD,IAAA,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI;AACjC,IAAA,OAAO,sBAAsB,CAAC,MAAM,EAAE,WAAW,CAAC;QAChD,MAAM,CAAC,UAAU,CAAC;AAClB,UAAE;AACF,UAAE,MAAM,CAAC,IAAI;AACjB;;;;"}
+{"version":3,"file":"projectRecordMoved.mjs","sources":["../../../src/core/bridge/projectRecordMoved.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;;;;AASA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDG;AACG,SAAU,kBAAkB,CAChC,MAAyB,EACzB,UAAA,GAAgD,6BAA6B,EAC7E,yBAAkC,EAAA;IAElC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC,QAAQ;AAC/D,IAAA,IAAI,CAAC,2BAA2B,CAAC,MAAM,EAAE,yBAAyB,CAAC;QACjE,OAAO,MAAM,CAAC,IAAI;AACpB,IAAA,4BAA4B,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC;AACrD,IAAA,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;AAC7D,QAAA,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ;AAAE,YAAA,OAAO,KAAK;AACnE,QAAA,IACE,CAAC,6BAA6B,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC;AAExE,YAAA,OAAO,KAAK;IAChB;AACA,IAAA,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;AAAE,QAAA,OAAO,SAAS;AAChD,IAAA,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU;AACpC,IAAA,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,iBAAiB,CACjD,MAAM,CAAC,IAAI,EACX,UAAU,EACV,MAAM,CACP;AACD,IAAA,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI;AACjC,IAAA,OAAO,sBAAsB,CAAC,MAAM,EAAE,WAAW,CAAC;QAChD,MAAM,CAAC,UAAU,CAAC;AAClB,UAAE;AACF,UAAE,MAAM,CAAC,IAAI;AACjB;;;;"}

package/lib/core/bridge/readProjectRecordFile.d.cts

@@ -6,9 +6,10 @@ import type { TtscProjectRecord } from "./TtscProjectRecord.cjs";
  * run over it (`refreshProjectRecordFiles`), and the next generation's delivery
  * writes it whole.
  *
- * Validate consumed input codecs and membership policy before exposing the
- * parsed record. A JSON object header alone does not establish that observers
- * can safely interpret its nested evidence.
+ * Validate the optional invocation witness, consumed input codecs and
+ * membership policy before exposing the parsed record. A JSON object header
+ * alone does not establish that observers can safely interpret its nested
+ * evidence.
  *
  * @evidence contracts/common.md#principled-implementation Structural guards validate the record, every consumed input codec and membership policy; predicate proof uses the existing producer-schema normalizer rather than inventing missing observations.
  * @evidence contracts/common.md#clear-and-simple-design This disk boundary owns untrusted JSON parsing and small schema predicates; filesystem replay and state-change decisions remain with the existing record consumers.

package/lib/core/bridge/readProjectRecordFile.d.mts

@@ -6,9 +6,10 @@ import type { TtscProjectRecord } from "./TtscProjectRecord.mjs";
  * run over it (`refreshProjectRecordFiles`), and the next generation's delivery
  * writes it whole.
  *
- * Validate consumed input codecs and membership policy before exposing the
- * parsed record. A JSON object header alone does not establish that observers
- * can safely interpret its nested evidence.
+ * Validate the optional invocation witness, consumed input codecs and
+ * membership policy before exposing the parsed record. A JSON object header
+ * alone does not establish that observers can safely interpret its nested
+ * evidence.
  *
  * @evidence contracts/common.md#principled-implementation Structural guards validate the record, every consumed input codec and membership policy; predicate proof uses the existing producer-schema normalizer rather than inventing missing observations.
  * @evidence contracts/common.md#clear-and-simple-design This disk boundary owns untrusted JSON parsing and small schema predicates; filesystem replay and state-change decisions remain with the existing record consumers.

package/lib/core/bridge/readProjectRecordFile.d.ts

@@ -6,9 +6,10 @@ import type { TtscProjectRecord } from "./TtscProjectRecord";
  * run over it (`refreshProjectRecordFiles`), and the next generation's delivery
  * writes it whole.
  *
- * Validate consumed input codecs and membership policy before exposing the
- * parsed record. A JSON object header alone does not establish that observers
- * can safely interpret its nested evidence.
+ * Validate the optional invocation witness, consumed input codecs and
+ * membership policy before exposing the parsed record. A JSON object header
+ * alone does not establish that observers can safely interpret its nested
+ * evidence.
  *
  * @evidence contracts/common.md#principled-implementation Structural guards validate the record, every consumed input codec and membership policy; predicate proof uses the existing producer-schema normalizer rather than inventing missing observations.
  * @evidence contracts/common.md#clear-and-simple-design This disk boundary owns untrusted JSON parsing and small schema predicates; filesystem replay and state-change decisions remain with the existing record consumers.