ttsc 0.31.0 → 0.31.2

package/lib/plugin/internal/source/computeCacheKey.js

@@ -8,9 +8,9 @@ const node_crypto_1 = __importDefault(require("node:crypto"));
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const GoToolResolution_1 = require("./GoToolResolution");
+const PluginContentIdentities_1 = require("./PluginContentIdentities");
 const hashPluginBuildEnvironment_1 = require("./hashPluginBuildEnvironment");
 const pluginModuleReplaceDirectories_1 = require("./pluginModuleReplaceDirectories");
-const pluginSourceDigest_1 = require("./pluginSourceDigest");
 /**
  * Compute a 32-character lowercase key from a plugin build's SHA-256 digest.
  *
@@ -21,8 +21,8 @@ const pluginSourceDigest_1 = require("./pluginSourceDigest");
  * source files. An optional required package-ownership population also frames
  * the key, separating binaries admitted by the matching cold producer from
  * legacy artifacts; requests without that authority retain their existing key.
- * Contributors are sorted by name; unique names remove input
- * order dependence, while equal-name rows retain the sort's input order.
+ * Contributors are sorted by name; unique names remove input order dependence,
+ * while equal-name rows retain the sort's input order.
  *
  * Each source directory enters the key as its digest (`pluginSourceDigest`),
  * which the transform envelope reports, with the environment below, as the
@@ -30,10 +30,12 @@ const pluginSourceDigest_1 = require("./pluginSourceDigest");
  * values are trusted producer readings, not revalidated content observations.
  * `sourceDigests` carries the digests one load already took: every build of the
  * load keys on one reading of each directory, and the load reports those
- * readings. The environment enters through `hashPluginBuildEnvironment`, the
- * rule that reported state takes it from too, and `environmentDigests` carries
- * the digest of each build directory's, so the load reports it without a second
- * `go env` run.
+ * readings. The environment enters as the digest of
+ * `hashPluginBuildEnvironment`, the rule that reported state takes it from too,
+ * and `environmentDigests` carries the digest of each build directory's, so the
+ * load reports it without a second `go env` run. With `environmentWitnesses`, a
+ * reading the load already took for the same directory, such as package
+ * selection's, keys the build too, and its witness joins the build's.
  *
  * The `ttsc cache` CLI and plugin build pipeline share this key computation.
  *
@@ -43,7 +45,7 @@ const pluginSourceDigest_1 = require("./pluginSourceDigest");
  * @evidence contracts/common.md#meaningful-documentation Native paragraphs explain input coverage and the provenance of reported digests; documented optional output maps have blank separation between members.
  * @evidence contracts/portability.md#os-neutral-implementation Native roots are resolved with Node path APIs and executable resolution; platform/architecture intentionally distinguish incompatible binary artifacts.
  * @evidence contracts/performance.md#efficient-algorithms Source digest misses enumerate/sort paths and read individual files in full, not bounded streaming chunks. Overlay/contributor ordering compares path/name text; replacement discovery can read a manifest/run Go and native containment queries. Toolchain/env hashing delegates native metadata/probes/full bytes and memo checks without an unmeasured dominant-cost ranking; JSON framing processes all version/entry/label/digest text.
- * @evidence contracts/performance.md#reuse-equivalent-work Caller-owned sourceDigests share supplied absolute-directory readings across roles without independently verifying their provenance/currentness. EnvironmentDigests receives this call's selected environment identity so reporting can avoid another probe; it does not skip environment hashing. Reuse inherits the selected population and metadata/producer premises.
+ * @evidence contracts/performance.md#reuse-equivalent-work Caller-owned sourceDigests share supplied absolute-directory readings across roles without independently verifying their provenance/currentness. A supplied record store lets a new process reuse a directory, SDK or executable digest only while its separable metadata signature matches the recorded one (#1722), so unchanged inputs are not re-read per process. EnvironmentDigests receives this call's selected environment identity so reporting can avoid another probe. A same-directory reading of the same load, with its witness, replaces a second environment probe; the witness then joins this build's, which the build compares after it ran, and a non-default byte adapter never shares. Reuse inherits the selected population and metadata/producer premises.
  *
  * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources Output maps belong to the enclosing load; this operation retains no handles or process-wide records itself.
  */
@@ -61,51 +63,100 @@ function computeCacheKey(inputs) {
     hash.update(JSON.stringify(["platform", process.platform, process.arch]));
     hash.update(JSON.stringify(["entry", inputs.entry]));
     if (inputs.packageOwnership !== undefined)
-        hash.update(JSON.stringify(["package-ownership", 1,
-            [...inputs.packageOwnership].sort((left, right) => left.entry < right.entry ? -1 : left.entry > right.entry ? 1 :
-                left.kind < right.kind ? -1 : left.kind > right.kind ? 1 : 0),
+        hash.update(JSON.stringify([
+            "package-ownership",
+            1,
+            [...inputs.packageOwnership].sort((left, right) => left.entry < right.entry
+                ? -1
+                : left.entry > right.entry
+                    ? 1
+                    : left.kind < right.kind
+                        ? -1
+                        : left.kind > right.kind
+                            ? 1
+                            : 0),
         ]));
     // Private materialization changes native package working directories. Keep
     // binaries produced by the former absolute-ancestry layout out of this
     // layout's cache admissions, including callers with no SDK overlays.
     hash.update(JSON.stringify(["external-source-layout", 1]));
-    // The same framed values enter the key and the environment-only digest,
-    // which pluginBuildEnvironment reads for this directory.
-    const environment = node_crypto_1.default.createHash("sha256");
-    (0, hashPluginBuildEnvironment_1.hashPluginBuildEnvironment)({
-        update: (data) => {
-            hash.update(data);
-            environment.update(data);
-        },
-    }, goBinary, inputs.dir, env, filesystem, inputs.environmentWitness);
-    inputs.environmentDigests?.set(node_path_1.default.resolve(inputs.dir), environment.digest("hex"));
-    hashSourceDirectory(hash, "plugin", inputs.dir, inputs.sourceDigests);
-    // Local replacement targets outside the module supply separately keyed
-    // sources. buildSourcePlugin snapshots and proves their copies before
-    // redirecting the Go replacement directives to the scratch tree.
-    for (const replacement of (0, pluginModuleReplaceDirectories_1.pluginModuleReplaceDirectories)(inputs.dir, env, goBinary)) {
-        hashSourceDirectory(hash, `replace:${replacement.modulePath}${replacement.version === undefined ? "" : `@${replacement.version}`}`, replacement.directory, inputs.sourceDigests);
-    }
-    for (const [index, dir] of [...(inputs.overlayDirs ?? [])].sort().entries()) {
-        hashSourceDirectory(hash, `overlay:${index}`, dir, inputs.sourceDigests);
-    }
+    const overlays = [...(inputs.overlayDirs ?? [])].sort();
     // Hash contributors in sorted-by-name order so two consumers with the
     // same logical set produce the same key regardless of declaration order
     // in the host's plugin descriptor.
     const sortedContributors = [...(inputs.contributors ?? [])].sort((a, b) => a.name === b.name ? 0 : a.name < b.name ? -1 : 1);
+    // A store whose root lies inside a directory this key hashes would write
+    // records into that source, so such a store proves nothing here. The build
+    // rejects that cache placement (`SourcePluginAdmission`) once every source
+    // is known; replacement targets narrow the store below, before their own
+    // digests, since only Go's reading of the manifest names them.
+    let identities = PluginContentIdentities_1.PluginContentIdentities.outside(inputs.identities, [
+        inputs.dir,
+        ...overlays,
+        ...sortedContributors.map((contributor) => contributor.source),
+    ]);
+    // The key frames the environment digest pluginBuildEnvironment reports for
+    // this directory. WARNING (#1721): package selection reads that environment
+    // first in the same load; reading it again here doubled `go env` and
+    // `go version` per load. A reading taken through another byte adapter is
+    // not this one's, so only the default adapter shares it.
+    const environmentDirectory = node_path_1.default.resolve(inputs.dir);
+    const sharedDigest = inputs.filesystem === undefined
+        ? inputs.environmentDigests?.get(environmentDirectory)
+        : undefined;
+    const sharedWitness = sharedDigest === undefined
+        ? undefined
+        : inputs.environmentWitnesses?.get(environmentDirectory);
+    let environment;
+    if (sharedDigest !== undefined && sharedWitness !== undefined) {
+        // The build compares this witness after it ran, exactly as it would its
+        // own reading's, so a toolchain change since the reading still refuses.
+        for (const [file, state] of sharedWitness)
+            if (!inputs.environmentWitness?.has(file))
+                inputs.environmentWitness?.set(file, state);
+        environment = sharedDigest;
+    }
+    else {
+        const witness = inputs.environmentWitness ??
+            (inputs.environmentWitnesses === undefined ? undefined : new Map());
+        const reading = node_crypto_1.default.createHash("sha256");
+        (0, hashPluginBuildEnvironment_1.hashPluginBuildEnvironment)(reading, goBinary, inputs.dir, env, filesystem, witness, identities);
+        environment = reading.digest("hex");
+        inputs.environmentDigests?.set(environmentDirectory, environment);
+        if (inputs.filesystem === undefined && witness !== undefined)
+            inputs.environmentWitnesses?.set(environmentDirectory, new Map(witness));
+    }
+    hash.update(JSON.stringify(["environment", environment]));
+    const directory = (label, root) => hashSourceDirectory(hash, label, root, inputs.sourceDigests, identities);
+    directory("plugin", inputs.dir);
+    // Local replacement targets outside the module supply separately keyed
+    // sources. buildSourcePlugin snapshots and proves their copies before
+    // redirecting the Go replacement directives to the scratch tree. Go reads the
+    // manifest after the plugin's digest, so an edit made meanwhile lands between
+    // that digest and the build's copy, which `requireKeyedSource` refuses.
+    const replacements = (0, pluginModuleReplaceDirectories_1.pluginModuleReplaceDirectories)(inputs.dir, env, goBinary, inputs.goModReader);
+    identities = PluginContentIdentities_1.PluginContentIdentities.outside(identities, replacements.map((replacement) => replacement.directory));
+    for (const replacement of replacements) {
+        directory(`replace:${replacement.modulePath}${replacement.version === undefined ? "" : `@${replacement.version}`}`, replacement.directory);
+    }
+    for (const [index, dir] of overlays.entries()) {
+        directory(`overlay:${index}`, dir);
+    }
     for (const contributor of sortedContributors) {
-        hashSourceDirectory(hash, `contributor:${contributor.name}`, contributor.source, inputs.sourceDigests);
+        directory(`contributor:${contributor.name}`, contributor.source);
     }
     return hash.digest("hex").slice(0, 32);
 }
 const DEFAULT_SOURCE_BUILD_FILESYSTEM = Object.freeze({
     readFile: (location) => node_fs_1.default.readFileSync(location),
 });
-function hashSourceDirectory(hash, label, root, digests) {
+function hashSourceDirectory(hash, label, root, digests, identities) {
     const directory = node_path_1.default.resolve(root);
     let digest = digests?.get(directory);
     if (digest === undefined) {
-        digest = (0, pluginSourceDigest_1.pluginSourceDigest)(directory);
+        // WARNING (#1722): the load-scoped map above ends with the process. Only the
+        // record store spares a new process from reading every source byte again.
+        digest = PluginContentIdentities_1.PluginContentIdentities.sourceDirectory(identities, directory);
         digests?.set(directory, digest);
     }
     hash.update(JSON.stringify(["dir", label, digest]));

package/lib/plugin/internal/source/computeCacheKey.js.map

@@ -1 +1 @@
-{"version":3,"file":"computeCacheKey.js","sourceRoot":"","sources":["../../../../src/plugin/internal/source/computeCacheKey.ts"],"names":[],"mappings":";;;;;;AAAA,8DAAiC;AACjC,sDAAyB;AACzB,0DAA6B;AAE7B,yDAAsD;AAItD,6EAA0E;AAC1E,qFAAkF;AAClF,6DAA0D;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,yBAAgC,MAoC/B;IACC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACtC,MAAM,UAAU,GAAoC;QAClD,QAAQ,EACN,MAAM,CAAC,UAAU,EAAE,QAAQ,IAAI,+BAA+B,CAAC,QAAQ;KAC1E,CAAC;IACF,MAAM,QAAQ,GACZ,MAAM,CAAC,QAAQ,KAAK,SAAS;QAC3B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,mCAAgB,CAAC,qBAAqB,CACpC,MAAM,CAAC,QAAQ,EACf,GAAG,EACH,MAAM,CAAC,GAAG,CACX,CAAC;IACR,MAAM,IAAI,GAAG,qBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS;QACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,mBAAmB,EAAE,CAAC;YAChD,CAAC,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAChD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5D,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAClE,CAAC,CAAC,CAAC;IACN,2EAA2E;IAC3E,uEAAuE;IACvE,qEAAqE;IACrE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,wEAAwE;IACxE,yDAAyD;IACzD,MAAM,WAAW,GAAG,qBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAA,uDAA0B,EACxB;QACE,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;YACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAClB,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;KACF,EACD,QAAQ,EACR,MAAM,CAAC,GAAG,EACV,GAAG,EACH,UAAU,EACV,MAAM,CAAC,kBAAkB,CAC1B,CAAC;IACF,MAAM,CAAC,kBAAkB,EAAE,GAAG,CAC5B,mBAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EACxB,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAC1B,CAAC;IACF,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IACtE,uEAAuE;IACvE,sEAAsE;IACtE,iEAAiE;IACjE,KAAK,MAAM,WAAW,IAAI,IAAA,+DAA8B,EACtD,MAAM,CAAC,GAAG,EACV,GAAG,EACH,QAAQ,CACT,EAAE,CAAC;QACF,mBAAmB,CACjB,IAAI,EACJ,WAAW,WAAW,CAAC,UAAU,GAC/B,WAAW,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,OAAO,EAClE,EAAE,EACF,WAAW,CAAC,SAAS,EACrB,MAAM,CAAC,aAAa,CACrB,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5E,mBAAmB,CAAC,IAAI,EAAE,WAAW,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC3E,CAAC;IACD,sEAAsE;IACtE,wEAAwE;IACxE,mCAAmC;IACnC,MAAM,kBAAkB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACxE,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACjD,CAAC;IACF,KAAK,MAAM,WAAW,IAAI,kBAAkB,EAAE,CAAC;QAC7C,mBAAmB,CACjB,IAAI,EACJ,eAAe,WAAW,CAAC,IAAI,EAAE,EACjC,WAAW,CAAC,MAAM,EAClB,MAAM,CAAC,aAAa,CACrB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,+BAA+B,GACnC,MAAM,CAAC,MAAM,CAAC;IACZ,QAAQ,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,iBAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;CAC1D,CAAC,CAAC;AAEL,SAAS,mBAAmB,CAC1B,IAAiB,EACjB,KAAa,EACb,IAAY,EACZ,OAAwC;IAExC,MAAM,SAAS,GAAG,mBAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,MAAM,GAAG,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,GAAG,IAAA,uCAAkB,EAAC,SAAS,CAAC,CAAC;QACvC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC"}
+{"version":3,"file":"computeCacheKey.js","sourceRoot":"","sources":["../../../../src/plugin/internal/source/computeCacheKey.ts"],"names":[],"mappings":";;;;;;AAAA,8DAAiC;AACjC,sDAAyB;AACzB,0DAA6B;AAE7B,yDAAsD;AAGtD,uEAAoE;AAGpE,6EAA0E;AAC1E,qFAAkF;AAElF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,yBAAgC,MAwD/B;IACC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACtC,MAAM,UAAU,GAAoC;QAClD,QAAQ,EACN,MAAM,CAAC,UAAU,EAAE,QAAQ,IAAI,+BAA+B,CAAC,QAAQ;KAC1E,CAAC;IACF,MAAM,QAAQ,GACZ,MAAM,CAAC,QAAQ,KAAK,SAAS;QAC3B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,mCAAgB,CAAC,qBAAqB,CACpC,MAAM,CAAC,QAAQ,EACf,GAAG,EACH,MAAM,CAAC,GAAG,CACX,CAAC;IACR,MAAM,IAAI,GAAG,qBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS;QACvC,IAAI,CAAC,MAAM,CACT,IAAI,CAAC,SAAS,CAAC;YACb,mBAAmB;YACnB,CAAC;YACD,CAAC,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAChD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK;gBACtB,CAAC,CAAC,CAAC,CAAC;gBACJ,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK;oBACxB,CAAC,CAAC,CAAC;oBACH,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI;wBACtB,CAAC,CAAC,CAAC,CAAC;wBACJ,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI;4BACtB,CAAC,CAAC,CAAC;4BACH,CAAC,CAAC,CAAC,CACZ;SACF,CAAC,CACH,CAAC;IACJ,2EAA2E;IAC3E,uEAAuE;IACvE,qEAAqE;IACrE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,sEAAsE;IACtE,wEAAwE;IACxE,mCAAmC;IACnC,MAAM,kBAAkB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACxE,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACjD,CAAC;IACF,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,+DAA+D;IAC/D,IAAI,UAAU,GAAG,iDAAuB,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE;QAClE,MAAM,CAAC,GAAG;QACV,GAAG,QAAQ;QACX,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;KAC/D,CAAC,CAAC;IACH,2EAA2E;IAC3E,4EAA4E;IAC5E,qEAAqE;IACrE,yEAAyE;IACzE,yDAAyD;IACzD,MAAM,oBAAoB,GAAG,mBAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,YAAY,GAChB,MAAM,CAAC,UAAU,KAAK,SAAS;QAC7B,CAAC,CAAC,MAAM,CAAC,kBAAkB,EAAE,GAAG,CAAC,oBAAoB,CAAC;QACtD,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,aAAa,GACjB,YAAY,KAAK,SAAS;QACxB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,CAAC,oBAAoB,EAAE,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC7D,IAAI,WAAmB,CAAC;IACxB,IAAI,YAAY,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAC9D,wEAAwE;QACxE,wEAAwE;QACxE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,aAAa;YACvC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,GAAG,CAAC,IAAI,CAAC;gBACvC,MAAM,CAAC,kBAAkB,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChD,WAAW,GAAG,YAAY,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GACX,MAAM,CAAC,kBAAkB;YACzB,CAAC,MAAM,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,qBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAA,uDAA0B,EACxB,OAAO,EACP,QAAQ,EACR,MAAM,CAAC,GAAG,EACV,GAAG,EACH,UAAU,EACV,OAAO,EACP,UAAU,CACX,CAAC;QACF,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,CAAC,kBAAkB,EAAE,GAAG,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;QAClE,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;YAC1D,MAAM,CAAC,oBAAoB,EAAE,GAAG,CAAC,oBAAoB,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,IAAY,EAAQ,EAAE,CACtD,mBAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IAC3E,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,uEAAuE;IACvE,sEAAsE;IACtE,8EAA8E;IAC9E,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,YAAY,GAAG,IAAA,+DAA8B,EACjD,MAAM,CAAC,GAAG,EACV,GAAG,EACH,QAAQ,EACR,MAAM,CAAC,WAAW,CACnB,CAAC;IACF,UAAU,GAAG,iDAAuB,CAAC,OAAO,CAC1C,UAAU,EACV,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CACzD,CAAC;IACF,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,SAAS,CACP,WAAW,WAAW,CAAC,UAAU,GAC/B,WAAW,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,OAAO,EAClE,EAAE,EACF,WAAW,CAAC,SAAS,CACtB,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,SAAS,CAAC,WAAW,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;IACD,KAAK,MAAM,WAAW,IAAI,kBAAkB,EAAE,CAAC;QAC7C,SAAS,CAAC,eAAe,WAAW,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,+BAA+B,GACnC,MAAM,CAAC,MAAM,CAAC;IACZ,QAAQ,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,iBAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;CAC1D,CAAC,CAAC;AAEL,SAAS,mBAAmB,CAC1B,IAAiB,EACjB,KAAa,EACb,IAAY,EACZ,OAAwC,EACxC,UAAqD;IAErD,MAAM,SAAS,GAAG,mBAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,MAAM,GAAG,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,6EAA6E;QAC7E,0EAA0E;QAC1E,MAAM,GAAG,iDAAuB,CAAC,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACxE,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC"}

package/lib/plugin/internal/source/hashPluginBuildEnvironment.d.ts

@@ -1,4 +1,5 @@
 import { PluginBuildEnvironmentWitness } from "./PluginBuildEnvironmentWitness";
+import { PluginContentIdentities } from "./PluginContentIdentities";
 import type { SourceBuildFilesystemOperations } from "./SourceBuildFilesystemOperations";
 /**
  * Hash the environment a plugin build is keyed on into `hash`: the Go
@@ -33,15 +34,18 @@ import type { SourceBuildFilesystemOperations } from "./SourceBuildFilesystemOpe
  *   variable carries: the Go tool, the Go environment file `go env -w` writes,
  *   the executables the C toolchain commands name, and GOROOT. A consumer that
  *   keeps the reading compares their metadata before reusing it.
+ * @param identities Record store that lets a new process prove the GOROOT
+ *   corpus and executable bytes from their metadata (`PluginContentIdentities`,
+ *   #1722); without it every process reads them.
  * @evidence contracts/common.md#principled-implementation Fixed artifact flags, observed compiler bytes/version, selected reported-or-fallback build values, named command executables and selected SDK files enter the same framed identity used by source-state reporting. Fallback values and metadata-qualified reuse are explicit premises, not complete observation of arbitrary toolchain inputs.
  * @evidence contracts/common.md#clear-and-simple-design Private helpers separate compiler identity, Go-reported settings, external variables and SDK content while sharing one hash sink and optional pre-read witness.
  * @evidence contracts/common.md#prohibited-implementation-shortcuts Cache signatures include real identity/change metadata and effective invocation context; failed SDK witnessing refuses reuse rather than accepting a VERSION-only proxy.
  * @evidence contracts/common.md#meaningful-documentation Native documentation names the input classes and witness purpose; private comments explain context-sensitive compiler memoization and SDK exclusions without treating a passing check as proof.
  * @evidence contracts/portability.md#os-neutral-implementation Node path/stat/process APIs resolve native tool identities; platform-specific executable suffixes and environment lookup are isolated in GoToolResolution, and Go supplies its own effective build settings.
  * @evidence contracts/performance.md#efficient-algorithms SDK traversal sorts reached entry names and selected file paths, performs native stat/realpath/link queries and serializes topology/metadata/path text. Matching manifests share aggregate hashes; changes read full selected files via the caller adapter, retaining file buffers with population/topology data. Compiler misses capture at most three complete version/byte readings when native metadata moves during a reading; only a stable attempt enters the memo. Go env can run up to three times for its file witness, and command tokens can each perform executable searches/full reads. Environment sorting/framing and command substring parsing also process name/value/command bytes; E/D/F/B alone do not capture native lookup or text comparison costs.
- * @evidence contracts/performance.md#reuse-equivalent-work Compiler memo identity includes selected path/file metadata and invocation cwd/environment; SDK aggregate reuse requires matching complete ordered metadata/topology. Both rely on native metadata distinguishability and sequential observation premises, not independently rehashed content on each hit. Physical directories expand once per selection policy while aliases retain edges; optional caller witnesses receive reached selected dependencies.
- * @evidence contracts/performance.md#bound-retention-and-release-resources Compiler, Go-environment-path and SDK maps retain historical distinct tool/context/root keys without eviction. SDK population/topology and full individual file reads contribute transient bytes; synchronous probes delegate process/capture lifetime to their owner and do not certify arbitrary descendants are gone. No independent entry/record/file/output byte ceiling is imposed here.
+ * @evidence contracts/performance.md#reuse-equivalent-work Compiler memo identity includes selected path/file metadata and invocation cwd/environment; SDK aggregate reuse requires matching complete ordered metadata/topology. With a record store, a new process reuses the SDK aggregate and executable digests only while their signatures match the recorded ones and every stamp is separable from a freshly minted reference (#1722); `go version` and `go env` stay live because they report toolchain selection no file metadata shows. All of this relies on native metadata distinguishability and sequential observation premises. Physical directories expand once per selection policy while aliases retain edges; optional caller witnesses receive reached selected dependencies.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources Compiler, Go-environment-path and SDK maps retain historical distinct tool/context/root keys without eviction; persisted records belong to the single-file collector. SDK population/topology and full individual file reads contribute transient bytes; synchronous probes delegate process/capture lifetime to their owner and do not certify arbitrary descendants are gone. No independent entry/record/file/output byte ceiling is imposed here.
  */
 export declare function hashPluginBuildEnvironment(hash: {
     update(data: string): unknown;
-}, goBinary: string | undefined, directory: string, env: NodeJS.ProcessEnv, filesystem: SourceBuildFilesystemOperations, witness?: PluginBuildEnvironmentWitness.Record): void;
+}, goBinary: string | undefined, directory: string, env: NodeJS.ProcessEnv, filesystem: SourceBuildFilesystemOperations, witness?: PluginBuildEnvironmentWitness.Record, identities?: PluginContentIdentities.Store): void;

package/lib/plugin/internal/source/hashPluginBuildEnvironment.js

@@ -7,9 +7,11 @@ exports.hashPluginBuildEnvironment = hashPluginBuildEnvironment;
 const node_crypto_1 = __importDefault(require("node:crypto"));
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
+const GoEnvironmentReading_1 = require("./GoEnvironmentReading");
 const GoSourceInputs_1 = require("./GoSourceInputs");
 const GoToolResolution_1 = require("./GoToolResolution");
 const PluginBuildEnvironmentWitness_1 = require("./PluginBuildEnvironmentWitness");
+const PluginContentIdentities_1 = require("./PluginContentIdentities");
 const spawnGoTool_1 = require("./spawnGoTool");
 /**
  * Hash the environment a plugin build is keyed on into `hash`: the Go
@@ -44,26 +46,29 @@ const spawnGoTool_1 = require("./spawnGoTool");
  *   variable carries: the Go tool, the Go environment file `go env -w` writes,
  *   the executables the C toolchain commands name, and GOROOT. A consumer that
  *   keeps the reading compares their metadata before reusing it.
+ * @param identities Record store that lets a new process prove the GOROOT
+ *   corpus and executable bytes from their metadata (`PluginContentIdentities`,
+ *   #1722); without it every process reads them.
  * @evidence contracts/common.md#principled-implementation Fixed artifact flags, observed compiler bytes/version, selected reported-or-fallback build values, named command executables and selected SDK files enter the same framed identity used by source-state reporting. Fallback values and metadata-qualified reuse are explicit premises, not complete observation of arbitrary toolchain inputs.
  * @evidence contracts/common.md#clear-and-simple-design Private helpers separate compiler identity, Go-reported settings, external variables and SDK content while sharing one hash sink and optional pre-read witness.
  * @evidence contracts/common.md#prohibited-implementation-shortcuts Cache signatures include real identity/change metadata and effective invocation context; failed SDK witnessing refuses reuse rather than accepting a VERSION-only proxy.
  * @evidence contracts/common.md#meaningful-documentation Native documentation names the input classes and witness purpose; private comments explain context-sensitive compiler memoization and SDK exclusions without treating a passing check as proof.
  * @evidence contracts/portability.md#os-neutral-implementation Node path/stat/process APIs resolve native tool identities; platform-specific executable suffixes and environment lookup are isolated in GoToolResolution, and Go supplies its own effective build settings.
  * @evidence contracts/performance.md#efficient-algorithms SDK traversal sorts reached entry names and selected file paths, performs native stat/realpath/link queries and serializes topology/metadata/path text. Matching manifests share aggregate hashes; changes read full selected files via the caller adapter, retaining file buffers with population/topology data. Compiler misses capture at most three complete version/byte readings when native metadata moves during a reading; only a stable attempt enters the memo. Go env can run up to three times for its file witness, and command tokens can each perform executable searches/full reads. Environment sorting/framing and command substring parsing also process name/value/command bytes; E/D/F/B alone do not capture native lookup or text comparison costs.
- * @evidence contracts/performance.md#reuse-equivalent-work Compiler memo identity includes selected path/file metadata and invocation cwd/environment; SDK aggregate reuse requires matching complete ordered metadata/topology. Both rely on native metadata distinguishability and sequential observation premises, not independently rehashed content on each hit. Physical directories expand once per selection policy while aliases retain edges; optional caller witnesses receive reached selected dependencies.
- * @evidence contracts/performance.md#bound-retention-and-release-resources Compiler, Go-environment-path and SDK maps retain historical distinct tool/context/root keys without eviction. SDK population/topology and full individual file reads contribute transient bytes; synchronous probes delegate process/capture lifetime to their owner and do not certify arbitrary descendants are gone. No independent entry/record/file/output byte ceiling is imposed here.
+ * @evidence contracts/performance.md#reuse-equivalent-work Compiler memo identity includes selected path/file metadata and invocation cwd/environment; SDK aggregate reuse requires matching complete ordered metadata/topology. With a record store, a new process reuses the SDK aggregate and executable digests only while their signatures match the recorded ones and every stamp is separable from a freshly minted reference (#1722); `go version` and `go env` stay live because they report toolchain selection no file metadata shows. All of this relies on native metadata distinguishability and sequential observation premises. Physical directories expand once per selection policy while aliases retain edges; optional caller witnesses receive reached selected dependencies.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources Compiler, Go-environment-path and SDK maps retain historical distinct tool/context/root keys without eviction; persisted records belong to the single-file collector. SDK population/topology and full individual file reads contribute transient bytes; synchronous probes delegate process/capture lifetime to their owner and do not certify arbitrary descendants are gone. No independent entry/record/file/output byte ceiling is imposed here.
  */
-function hashPluginBuildEnvironment(hash, goBinary, directory, env, filesystem, witness) {
+function hashPluginBuildEnvironment(hash, goBinary, directory, env, filesystem, witness, identities) {
     // Fixed artifact policy must invalidate binaries and reported source states
     // together, including binaries cached before this policy was introduced.
     hash.update(JSON.stringify(["source-build-flags", GoSourceInputs_1.GoSourceInputs.BUILD_FLAGS]));
     if (goBinary !== undefined) {
         hash.update(JSON.stringify([
             "go",
-            resolveGoCompilerIdentity(goBinary, env, directory, witness),
+            resolveGoCompilerIdentity(goBinary, env, directory, witness, identities),
         ]));
     }
-    hashGoBuildEnvironment(hash, goBinary, directory, env, filesystem, witness);
+    hashGoBuildEnvironment(hash, goBinary, directory, env, filesystem, witness, identities);
     hashExternalGoBuildEnvironment(hash, env);
 }
 // Go build environment values that can change the produced binary or decide
@@ -154,7 +159,7 @@ const EXTERNAL_GO_BUILD_ENV_KEYS = [
 // memo key includes that context so an environment-sensitive wrapper cannot
 // lend its version result to another compiler invocation.
 const goCompilerIdentityCache = new Map();
-function resolveGoCompilerIdentity(goBinary, env = process.env, cwd = process.cwd(), witness) {
+function resolveGoCompilerIdentity(goBinary, env = process.env, cwd = process.cwd(), witness, identities) {
     const selected = GoToolResolution_1.GoToolResolution.resolveGoToolForBuild(goBinary, env, cwd, witness);
     const resolved = process.platform === "win32"
         ? resolveRealPath(selected)
@@ -182,7 +187,7 @@ function resolveGoCompilerIdentity(goBinary, env = process.env, cwd = process.cw
         const observed = new Map();
         PluginBuildEnvironmentWitness_1.PluginBuildEnvironmentWitness.add(observed, resolved);
         const memoKey = goCompilerIdentityMemoKey(goBinary, resolved, compilerEnv, cwd);
-        identity = computeGoCompilerIdentity(selected, resolved, compilerEnv, cwd);
+        identity = computeGoCompilerIdentity(selected, resolved, compilerEnv, cwd, identities);
         if (!PluginBuildEnvironmentWitness_1.PluginBuildEnvironmentWitness.holds(observed))
             continue;
         for (const [file, signature] of observed)
@@ -224,10 +229,12 @@ function goCompilerIdentityMemoKey(goBinary, resolved, env, cwd) {
         return null;
     }
 }
-function computeGoCompilerIdentity(goBinary, resolved, env, cwd) {
+function computeGoCompilerIdentity(goBinary, resolved, env, cwd, identities) {
     if (!node_fs_1.default.existsSync(resolved)) {
         return "missing";
     }
+    // `go version` stays a live probe: it answers which toolchain the effective
+    // environment selects (GOTOOLCHAIN, go.mod), which no file metadata shows.
     const version = (0, spawnGoTool_1.spawnGoTool)(goBinary, ["version"], {
         cwd,
         encoding: "utf8",
@@ -237,9 +244,16 @@ function computeGoCompilerIdentity(goBinary, resolved, env, cwd) {
     const versionText = version.error !== undefined
         ? (version.error.code ?? version.error.message)
         : `${version.status ?? 0}:${version.stdout}${version.stderr}`;
-    const binaryHash = hashFile(resolved);
+    const binaryHash = hashExecutable(resolved, identities);
     return `sha256:${binaryHash}:${versionText}`;
 }
+/**
+ * The content digest of an executable, proven from its metadata in a process
+ * that has the record store (#1722) and read in full otherwise.
+ */
+function hashExecutable(file, identities) {
+    return PluginContentIdentities_1.PluginContentIdentities.digest(identities, "executable", file, (references) => PluginContentIdentities_1.PluginContentIdentities.fileObservation(references, file), () => hashFile(file));
+}
 function resolveExecutableIdentityPath(binary, env = process.env, cwd = process.cwd(), witness) {
     const resolved = findExecutablePath(binary, env, cwd, witness);
     return resolved === null ? binary : resolveRealPath(resolved);
@@ -281,8 +295,8 @@ function hashFile(file) {
     hash.update(node_fs_1.default.readFileSync(file));
     return hash.digest("hex");
 }
-function hashGoBuildEnvironment(hash, goBinary, cwd, env, filesystem, witness) {
-    const values = resolveGoBuildEnvironment(goBinary, cwd, env, filesystem, witness);
+function hashGoBuildEnvironment(hash, goBinary, cwd, env, filesystem, witness, identities) {
+    const values = resolveGoBuildEnvironment(goBinary, cwd, env, filesystem, witness, identities);
     for (const key of GO_BUILD_ENV_KEYS) {
         const value = values.get(key);
         if (value !== undefined && value !== "") {
@@ -290,16 +304,16 @@ function hashGoBuildEnvironment(hash, goBinary, cwd, env, filesystem, witness) {
         }
     }
 }
-function resolveGoBuildEnvironment(goBinary, cwd, env, filesystem, witness) {
+function resolveGoBuildEnvironment(goBinary, cwd, env, filesystem, witness, identities) {
     const values = new Map();
     if (goBinary !== undefined) {
-        const parsed = readGoEnvironment(goBinary, cwd, env, witness);
+        const parsed = GoEnvironmentReading_1.GoEnvironmentReading.read(goBinary, cwd, env, GO_BUILD_ENV_KEYS, witness, identities);
         if (parsed !== undefined) {
             try {
                 for (const key of GO_BUILD_ENV_KEYS) {
                     const raw = parsed[key];
                     if (typeof raw === "string" && raw !== "") {
-                        values.set(key, normalizeGoBuildEnvValue(key, raw, env, filesystem, witness));
+                        values.set(key, normalizeGoBuildEnvValue(key, raw, env, filesystem, witness, identities));
                     }
                 }
             }
@@ -314,89 +328,22 @@ function resolveGoBuildEnvironment(goBinary, cwd, env, filesystem, witness) {
             continue;
         const value = env[key];
         if (value !== undefined && value !== "") {
-            values.set(key, normalizeGoBuildEnvValue(key, value, env, filesystem, witness));
+            values.set(key, normalizeGoBuildEnvValue(key, value, env, filesystem, witness, identities));
         }
     }
     return values;
 }
-/**
- * The Go environment file each Go tool and environment was last seen to name,
- * which lets a reading witness that file before `go env` reads it.
- */
-const goEnvironmentFiles = new Map();
-/**
- * Run `go env -json` for the build keys and `GOENV`, the file `go env -w`
- * writes, witnessing that file before the run reads it.
- *
- * The file decides the reading without being part of it, so only its metadata
- * is kept, and it must be taken before the read: metadata taken after would
- * describe an edit that landed between the two, and a reading of the old
- * content would pass as proven. Which file `go env` reads is known only from
- * its answer, so the file this Go tool and environment named last is witnessed
- * first, and a reading that names another is taken again with that one
- * witnessed. A file that keeps moving between runs leaves the reading
- * unwitnessable, so a kept reading or a build keyed on it never holds.
- *
- * @returns The parsed answer, or `undefined` when `go env` failed.
- */
-function readGoEnvironment(goBinary, cwd, env, witness) {
-    const memo = node_crypto_1.default.createHash("sha256").update(goBinary);
-    for (const [key, value] of Object.entries(env).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0)) {
-        if (value !== undefined)
-            memo.update(`\0${key.length}:${key}${value.length}:${value}`);
-    }
-    const memoKey = memo.digest("hex");
-    let named = goEnvironmentFiles.get(memoKey);
-    for (let attempt = 0; attempt < 3; attempt += 1) {
-        if (named !== undefined && named !== null)
-            PluginBuildEnvironmentWitness_1.PluginBuildEnvironmentWitness.add(witness, named);
-        const result = (0, spawnGoTool_1.spawnGoTool)(goBinary, ["env", "-json", ...GO_BUILD_ENV_KEYS, "GOENV"], {
-            cwd,
-            encoding: "utf8",
-            env: GoSourceInputs_1.GoSourceInputs.goBuildEnv(goBinary, undefined, env),
-            windowsHide: true,
-        });
-        if (result.error !== undefined || result.status !== 0)
-            return undefined;
-        let parsed;
-        try {
-            parsed = JSON.parse(result.stdout);
-        }
-        catch {
-            return undefined;
-        }
-        const reported = typeof parsed.GOENV === "string" &&
-            parsed.GOENV !== "" &&
-            parsed.GOENV !== "off"
-            ? parsed.GOENV
-            : null;
-        if (reported === named)
-            return parsed;
-        if (named !== undefined && named !== null)
-            witness?.delete(named);
-        named = reported;
-        goEnvironmentFiles.set(memoKey, named);
-        // No file to witness: the reading depends on none.
-        if (named === null)
-            return parsed;
-        if (witness === undefined)
-            return parsed;
-    }
-    if (named !== undefined && named !== null)
-        PluginBuildEnvironmentWitness_1.PluginBuildEnvironmentWitness.refuse(witness, named);
-    return undefined;
-}
-function normalizeGoBuildEnvValue(key, value, env, filesystem, witness) {
+function normalizeGoBuildEnvValue(key, value, env, filesystem, witness, identities) {
     if (key === "GOROOT") {
         // Root/version observations also cover a missing SDK. The complete SDK
         // manifest below witnesses contributing files and directories, including
         // nested content changes that do not move the root or VERSION metadata.
         PluginBuildEnvironmentWitness_1.PluginBuildEnvironmentWitness.add(witness, value);
         PluginBuildEnvironmentWitness_1.PluginBuildEnvironmentWitness.add(witness, node_path_1.default.join(value, "VERSION"));
-        return resolveGoRootCacheIdentity(value, filesystem, witness);
+        return resolveGoRootCacheIdentity(value, filesystem, witness, identities);
     }
     if (GO_BUILD_COMMAND_ENV_KEYS.has(key)) {
-        return `${value}\0${resolveCommandCacheIdentity(value, env, witness)}`;
+        return `${value}\0${resolveCommandCacheIdentity(value, env, witness, identities)}`;
     }
     return value;
 }
@@ -412,7 +359,7 @@ function normalizeGoBuildEnvValue(key, value, env, filesystem, witness) {
  * which the key carries beside this identity. A program a launcher finds by its
  * own means, not named in the command, is outside what the command can show.
  */
-function resolveCommandCacheIdentity(command, env, witness) {
+function resolveCommandCacheIdentity(command, env, witness, identities) {
     const tokens = splitGoCommand(command);
     if (tokens === null) {
         return `command:unterminated:${command}`;
@@ -428,7 +375,7 @@ function resolveCommandCacheIdentity(command, env, witness) {
     }
     let identity;
     try {
-        identity = `command:sha256:${hashFile(resolved)}`;
+        identity = `command:sha256:${hashExecutable(resolved, identities)}`;
     }
     catch {
         return `command:unreadable:${resolved}`;
@@ -439,7 +386,7 @@ function resolveCommandCacheIdentity(command, env, witness) {
             return;
         PluginBuildEnvironmentWitness_1.PluginBuildEnvironmentWitness.add(witness, operand);
         try {
-            identity += `;${index + 1}:sha256:${hashFile(operand)}`;
+            identity += `;${index + 1}:sha256:${hashExecutable(operand, identities)}`;
         }
         catch {
             identity += `;${index + 1}:unreadable:${operand}`;
@@ -492,14 +439,21 @@ function hashExternalGoBuildEnvironment(hash, env) {
 // GOROOT is usually stable but its selected source/tool payloads contribute to
 // every plugin key. Retain only the final aggregate
 // identity, guarded by a fresh metadata/topology manifest on every call. A
-// changed or incomplete manifest falls through to a full content read.
+// changed or incomplete manifest falls through to the record store, then to a
+// full content read.
+//
+// WARNING (#1186, #1722): this map lives only as long as the process. #1186
+// stopped at it, so every CLI launch, worker and bundler restart still read the
+// whole SDK (3,723 files, 135 MB for the bundled toolchain). The record store
+// below is what carries the identity across processes; never drop it in favor
+// of this memo alone.
 const goRootIdentityCache = new Map();
-function resolveGoRootCacheIdentity(goRoot, filesystem, witness) {
+function resolveGoRootCacheIdentity(goRoot, filesystem, witness, identities) {
     const resolved = resolveRealPath(goRoot);
     if (!node_fs_1.default.existsSync(resolved)) {
         return `missing:${goRoot}`;
     }
-    const snapshot = collectGoRootIdentitySnapshot(resolved, witness);
+    const snapshot = collectGoRootIdentitySnapshot(resolved, witness, identities?.references);
     if (!snapshot.complete)
         PluginBuildEnvironmentWitness_1.PluginBuildEnvironmentWitness.refuse(witness, resolved);
     if (snapshot.complete) {
@@ -508,15 +462,30 @@ function resolveGoRootCacheIdentity(goRoot, filesystem, witness) {
             return cached.identity;
         }
     }
-    const hash = node_crypto_1.default.createHash("sha256");
-    hash.update(JSON.stringify(snapshot.topology));
-    for (const file of snapshot.files) {
-        const relative = node_path_1.default.relative(resolved, file).split(node_path_1.default.sep).join("/");
-        const contents = filesystem.readFile(file);
-        hash.update(JSON.stringify([relative, contents.length]));
-        hash.update(contents);
-    }
-    const identity = `sha256:${hash.digest("hex")}`;
+    // The first observation is the snapshot the witness just recorded; a second
+    // one, after the content read, brackets that read for publication.
+    let observed = 0;
+    const identity = PluginContentIdentities_1.PluginContentIdentities.digest(snapshot.complete ? identities : undefined, "goroot", resolved, (references) => {
+        const current = observed++ === 0
+            ? snapshot
+            : collectGoRootIdentitySnapshot(resolved, undefined, references);
+        return current.complete
+            ? { separable: current.separable, signature: current.signature }
+            : undefined;
+    }, () => {
+        const hash = node_crypto_1.default.createHash("sha256");
+        hash.update(JSON.stringify(snapshot.topology));
+        for (const file of snapshot.files) {
+            const relative = node_path_1.default
+                .relative(resolved, file)
+                .split(node_path_1.default.sep)
+                .join("/");
+            const contents = filesystem.readFile(file);
+            hash.update(JSON.stringify([relative, contents.length]));
+            hash.update(contents);
+        }
+        return `sha256:${hash.digest("hex")}`;
+    });
     if (snapshot.complete) {
         goRootIdentityCache.set(resolved, {
             identity,
@@ -525,9 +494,9 @@ function resolveGoRootCacheIdentity(goRoot, filesystem, witness) {
     }
     return identity;
 }
-function collectGoRootIdentitySnapshot(root, witness) {
+function collectGoRootIdentitySnapshot(root, witness, references) {
     const out = [];
-    const state = { complete: true };
+    const state = { complete: true, separable: references !== undefined };
     const topology = [];
     walkGoRootIdentity(root, out, topology, state, witness);
     out.sort();
@@ -542,6 +511,9 @@ function collectGoRootIdentitySnapshot(root, witness) {
                 state.complete = false;
                 continue;
             }
+            if (references === undefined ||
+                !PluginContentIdentities_1.PluginContentIdentities.separable(references, stats))
+                state.separable = false;
             signature.update([
                 relative,
                 stats.dev,
@@ -562,6 +534,7 @@ function collectGoRootIdentitySnapshot(root, witness) {
         files: out,
         topology,
         signature: signature.digest("hex"),
+        separable: state.separable,
     };
 }
 function walkGoRootIdentity(root, out, topology, state, witness) {