ttsc 0.31.0 → 0.31.2

package/src/plugin/internal/load/loadProjectPlugins.ts

@@ -22,13 +22,16 @@ import type { ITtscParsedProjectConfig } from "../../../structures/internal/ITts
 import { pluginDescriptorFailureReason } from "../pluginDescriptorFailureReason";
 import { pluginDescriptorProcessFailure } from "../pluginDescriptorProcessFailure";
 import { NativeSourcePackages } from "../source/NativeSourcePackages";
+import type { PluginBuildEnvironmentWitness } from "../source/PluginBuildEnvironmentWitness";
+import { PluginContentIdentities } from "../source/PluginContentIdentities";
 import { SourcePluginWorkspace } from "../source/SourcePluginWorkspace";
-import { resolvePluginGoModule } from "../source/resolvePluginGoModule";
 import { buildSourcePlugin } from "../source/buildSourcePlugin";
 import { isPathWithin } from "../source/isPathWithin";
+import { pluginBuildEnvironment } from "../source/pluginBuildEnvironment";
 import { pluginBuildVersions } from "../source/pluginBuildVersions";
 import { pluginModuleReplaceDirectories } from "../source/pluginModuleReplaceDirectories";
 import { pluginSourceState } from "../source/pluginSourceState";
+import { resolvePluginGoModule } from "../source/resolvePluginGoModule";
 import { COMMONJS_PLUGIN_DESCRIPTOR_SHIM_SOURCE } from "./COMMONJS_PLUGIN_DESCRIPTOR_SHIM_SOURCE";
 import { PLUGIN_DESCRIPTOR_SHIM_SOURCE } from "./PLUGIN_DESCRIPTOR_SHIM_SOURCE";
 import { PluginDescriptorAdmission } from "./PluginDescriptorAdmission";
@@ -61,19 +64,18 @@ import { visitImportMappedCandidates } from "./visitImportMappedCandidates";
  * under generic host manifests while preserving source-relative input layout.
  * Main proposals must agree in their full owning module; linked proposals must
  * agree inside every selected transform host. Errors or disagreement terminate
- * the load rather than changing the proposed kind.
- * Watch callers first receive structurally selected source/module/contributor
- * repair interests, before metadata can reject them. Valid records then narrow
- * those interests to the exact build directories; interests alone never admit
- * a plugin, certify a kind or supply reusable source-state proof.
- * Returns the ordered native plugins, parsed project config, recorded
- * JavaScript-host inputs and unresolved selection candidates, and the keyed
- * state of reported Go source directories supplied to the builds
- * (`pluginSources`): each plugin's module root and each contributor's source,
- * with its state (`pluginSourceState`), the sources as the build read them
- * together with the environment a build there is keyed on. Directories within
- * ttsc's installed package, including its overlays and the fallback
- * linked-plugin host, are keyed but omitted from this report under the
+ * the load rather than changing the proposed kind. Watch callers first receive
+ * structurally selected source/module/contributor repair interests, before
+ * metadata can reject them. Valid records then narrow those interests to the
+ * exact build directories; interests alone never admit a plugin, certify a kind
+ * or supply reusable source-state proof. Returns the ordered native plugins,
+ * parsed project config, recorded JavaScript-host inputs and unresolved
+ * selection candidates, and the keyed state of reported Go source directories
+ * supplied to the builds (`pluginSources`): each plugin's module root and each
+ * contributor's source, with its state (`pluginSourceState`), the sources as
+ * the build read them together with the environment a build there is keyed on.
+ * Directories within ttsc's installed package, including its overlays and the
+ * fallback linked-plugin host, are keyed but omitted from this report under the
  * installed-package/version ownership policy. That policy does not prove the
  * installation cannot be edited in place. Descriptor completeness relies on the
  * runtime recorder's status and the descriptor's explicit external-read
@@ -100,7 +102,7 @@ import { visitImportMappedCandidates } from "./visitImportMappedCandidates";
  * @evidence contracts/common.md#meaningful-documentation Native JSDoc explains result provenance, environment and path options; helper comments explain input races, conservative proof omission, fallback authority and cleanup. Member/tag spacing and separated concepts follow the documentation skill.
  * @evidence contracts/portability.md#os-neutral-implementation Native path/file-URL conversion, createRequire and hidden spawn with explicit argv/environment implement OS-neutral selection and process execution. Physical identities are preserved separately from lexical candidates; Bun-specific differences are capability decisions, not OS guesses.
  * @evidence contracts/performance.md#efficient-algorithms Input merging and conflicts use Sets/maps and sorted path populations, with path/key/value byte costs. Discovery can repeat config/manifest/candidate reads and full hashes; descriptor work includes runtime probes, full observation/JSON processing and possibly synchronous evaluation. Watch-only preliminary publication can temporarily digest/watch the full admitted module as well as its package before kind is known; callbacks delegate topology reconciliation. Load-local replacement readings serve preliminary and final publication. Package selection groups equivalent module contexts and batches entries through Go list without dependency compilation; per-load selected-tool manifest readers share overlay readings. Builds delegate source/environment hashing, copying, cold materialized ownership admission and Go execution; per-load digest maps share selected work. Composition can be quadratic in configured plugins/aliases, and native lookup/file/output bytes are not bounded by plugin count alone.
- * @evidence contracts/performance.md#reuse-equivalent-work Descriptor hits require the cache's context/environment/runtime/version identity and matching recorded projections, subject to producer declarations and sequential-observation limits. Per-load source/environment maps share directory-keyed digests and one selected transform host serves linked contributors; these identities do not certify every undeclared read or atomic filesystem stability.
+ * @evidence contracts/performance.md#reuse-equivalent-work Descriptor hits require the cache's context/environment/runtime/version identity and matching recorded projections, subject to producer declarations and sequential-observation limits. Per-load source/environment maps share directory-keyed digests between package selection and builds, and one selected transform host serves linked contributors. Across processes, the record store opened here proves unchanged sources, toolchain and runtime from separable metadata and answers equal package selections and runtime probes (#1721, #1722, #1723); a store whose root lies inside a plugin source is withdrawn before any source is proven. These identities do not certify every undeclared read or atomic filesystem stability.
  * @evidence contracts/performance.md#bound-retention-and-release-resources Finally restores injected environment locators, attempts evaluator directory removal and closes direct-evaluator diagnostic descriptors. Close/removal can fail; synchronous completion concerns the selected evaluator and does not certify arbitrary descendants are gone. Generation maps/results scale with observed data, and disk diagnostics/result/observation files have no independent byte ceiling here. Default disk pruning has its own interval/protection/failure policy; explicit roots remain caller-owned.
  */
 export function loadProjectPlugins(options: {
@@ -122,6 +124,12 @@ export function loadProjectPlugins(options: {
   /** Explicit project config, resolved from cwd. */
   file?: string;
 
+  /**
+   * Record store the caller already opened for this invocation, so its later
+   * native spawns share it; the loader opens its own when omitted.
+   */
+  identities?: PluginContentIdentities.Store;
+
   /** Observe plugin build roots before building, including failed builds. */
   onWatchInputs?: (inputs: readonly string[]) => void;
 
@@ -169,6 +177,12 @@ export function loadProjectPlugins(options: {
    */
   observationsComplete?: false;
 
+  /**
+   * Record store this load proved its inputs through, for the invocation's
+   * later native spawns (#1723); absent when the project loads no plugin.
+   */
+  identities?: PluginContentIdentities.Store;
+
   /** Check-stage entries followed by transform-stage entries in stable order. */
   nativePlugins: ITtscLoadedNativePlugin[];
 
@@ -235,91 +249,111 @@ export function loadProjectPlugins(options: {
   };
   // Where isolated descriptor evaluations keep their answers across launches
   // (`PluginDescriptorEvaluationCache`).
+  // WARNING (#1721, #1722, #1723): a warm load must prove its unchanged inputs
+  // from this store, not re-read them. Every launch is a new process, so any
+  // module-level memo of this load's work dies with it; a 27 s warm typia
+  // launch whose native build took 0.28 s is what that looked like.
+  const identities =
+    options.identities ??
+    PluginContentIdentities.open({
+      projectRoot: project.root,
+      cacheDir: options.cacheDir,
+      env: effectiveEnv,
+    });
   const descriptorCache: DescriptorCacheOptions = {
     cacheDir: options.cacheDir,
+    identities,
     version: pluginBuildVersions(project.root).ttsc,
   };
-  const loadedEntries = withPluginLoaderEnv(() =>
-    entries.map((entry) => {
-      const specifier = entry.config.transform;
-      if (typeof specifier !== "string" || specifier.length === 0) {
-        throw new Error(
-          `ttsc: plugin entry is missing a string "transform" field`,
+  const loadedEntries = withPluginLoaderEnv(
+    () =>
+      entries.map((entry) => {
+        const specifier = entry.config.transform;
+        if (typeof specifier !== "string" || specifier.length === 0) {
+          throw new Error(
+            `ttsc: plugin entry is missing a string "transform" field`,
+          );
+        }
+        const entryParent = path.join(entry.baseDir, "package.json");
+        const probedCandidates = collectModuleResolutionCandidates(
+          specifier,
+          entryParent,
+          undefined,
         );
-      }
-      const entryParent = path.join(entry.baseDir, "package.json");
-      const probedCandidates = collectModuleResolutionCandidates(
-        specifier,
-        entryParent,
-        undefined,
-      );
-      // Capture every candidate before resolution chooses the descriptor entry.
-      // A post-resolution snapshot could bless a higher-priority file created
-      // after the resolver had already selected the old entry.
-      const probedCandidateHashes = hashHostInputPaths(probedCandidates);
-      const probedCandidateRealpaths = realpathHostInputPaths(probedCandidates);
-      const request = PluginPackageResolution.resolvePluginRequest(
-        specifier,
-        entry.baseDir,
-      );
-      // Keep the candidates of the search roots up to the one the entry
-      // resolved in: the lookup never read the roots after it
-      // (`moduleResolutionBaseSelects`).
-      const read = new Set(
-        collectModuleResolutionCandidates(specifier, entryParent, request).map(
-          (candidate) => path.resolve(candidate),
-        ),
-      );
-      const entryCandidates = probedCandidates.filter((candidate) =>
-        read.has(path.resolve(candidate)),
-      );
-      const entryCandidateHashes = pickHostInputEntries(
-        probedCandidateHashes,
-        entryCandidates,
-      );
-      const entryCandidateRealpaths = pickHostInputEntries(
-        probedCandidateRealpaths,
-        entryCandidates,
-      );
-      const loaded = loadPluginEntry(
-        entry.config,
-        { ...context, plugin: entry.config },
-        request,
-        effectiveEnv,
-        descriptorCache,
-      );
-      const loadedHostInputHashes = mergeObservedHostInputHashes(
-        loaded.hostInputHashes,
-        hashHostInputPaths(Object.keys(loaded.hostInputHashes)),
-      );
-      const loadedHostInputRealpaths = mergeObservedHostInputRealpaths(
-        loaded.hostInputRealpaths,
-        realpathHostInputPaths(Object.keys(loaded.hostInputRealpaths)),
-      );
-      const hostInputHashes = mergeObservedHostInputHashes(
-        entryCandidateHashes,
-        loadedHostInputHashes,
-      );
-      const hostInputRealpaths = mergeObservedHostInputRealpaths(
-        entryCandidateRealpaths,
-        loadedHostInputRealpaths,
-      );
-      for (const input of loaded.hostInputs) {
-        const absolute = path.resolve(input);
-        if (
-          !Object.prototype.hasOwnProperty.call(loadedHostInputHashes, absolute)
-        ) {
-          delete hostInputHashes[absolute];
+        // Capture every candidate before resolution chooses the descriptor entry.
+        // A post-resolution snapshot could bless a higher-priority file created
+        // after the resolver had already selected the old entry.
+        const probedCandidateHashes = hashHostInputPaths(probedCandidates);
+        const probedCandidateRealpaths =
+          realpathHostInputPaths(probedCandidates);
+        const request = PluginPackageResolution.resolvePluginRequest(
+          specifier,
+          entry.baseDir,
+        );
+        // Keep the candidates of the search roots up to the one the entry
+        // resolved in: the lookup never read the roots after it
+        // (`moduleResolutionBaseSelects`).
+        const read = new Set(
+          collectModuleResolutionCandidates(
+            specifier,
+            entryParent,
+            request,
+          ).map((candidate) => path.resolve(candidate)),
+        );
+        const entryCandidates = probedCandidates.filter((candidate) =>
+          read.has(path.resolve(candidate)),
+        );
+        const entryCandidateHashes = pickHostInputEntries(
+          probedCandidateHashes,
+          entryCandidates,
+        );
+        const entryCandidateRealpaths = pickHostInputEntries(
+          probedCandidateRealpaths,
+          entryCandidates,
+        );
+        const loaded = loadPluginEntry(
+          entry.config,
+          { ...context, plugin: entry.config },
+          request,
+          effectiveEnv,
+          descriptorCache,
+        );
+        const loadedHostInputHashes = mergeObservedHostInputHashes(
+          loaded.hostInputHashes,
+          hashHostInputPaths(Object.keys(loaded.hostInputHashes)),
+        );
+        const loadedHostInputRealpaths = mergeObservedHostInputRealpaths(
+          loaded.hostInputRealpaths,
+          realpathHostInputPaths(Object.keys(loaded.hostInputRealpaths)),
+        );
+        const hostInputHashes = mergeObservedHostInputHashes(
+          entryCandidateHashes,
+          loadedHostInputHashes,
+        );
+        const hostInputRealpaths = mergeObservedHostInputRealpaths(
+          entryCandidateRealpaths,
+          loadedHostInputRealpaths,
+        );
+        for (const input of loaded.hostInputs) {
+          const absolute = path.resolve(input);
+          if (
+            !Object.prototype.hasOwnProperty.call(
+              loadedHostInputHashes,
+              absolute,
+            )
+          ) {
+            delete hostInputHashes[absolute];
+          }
         }
-      }
-      return {
-        ...loaded,
-        hostInputHashes,
-        hostInputRealpaths,
-        hostInputs: [...loaded.hostInputs, ...entryCandidates],
-        request,
-      };
-    }),
+        return {
+          ...loaded,
+          hostInputHashes,
+          hostInputRealpaths,
+          hostInputs: [...loaded.hostInputs, ...entryCandidates],
+          request,
+        };
+      }),
+    identities,
   );
   const plugins = composePluginSources(
     entries,
@@ -329,30 +363,68 @@ export function loadProjectPlugins(options: {
   const { ttsc: ttscVersion, tsgo: tsgoVersion } = pluginBuildVersions(
     context.projectRoot,
   );
-  const candidates = plugins.map((plugin, index) => {
-    const stage = PluginDescriptorAdmission.stage(plugin);
-    validatePluginSource(plugin);
-    const contributors = validatePluginContributors(plugin);
-    const source = resolvePluginSource(plugin.source, context.projectRoot);
-    const label = pluginLabel(plugin, entries[index]!.config, index);
-    requirePluginSource(source, label);
-    return { plugin, index, stage, contributors, source, label };
-  }).map((candidate) => ({
-    ...candidate,
-    ...resolvePluginGoModule(candidate.source, candidate.label),
-  }));
-  const watchReplacements = options.onWatchInputs === undefined
-    ? undefined
-    : new Map<string, readonly string[]>();
+  const candidates = plugins
+    .map((plugin, index) => {
+      const stage = PluginDescriptorAdmission.stage(plugin);
+      validatePluginSource(plugin);
+      const contributors = validatePluginContributors(plugin);
+      const source = resolvePluginSource(plugin.source, context.projectRoot);
+      const label = pluginLabel(plugin, entries[index]!.config, index);
+      requirePluginSource(source, label);
+      return { plugin, index, stage, contributors, source, label };
+    })
+    .map((candidate) => ({
+      ...candidate,
+      ...resolvePluginGoModule(candidate.source, candidate.label),
+    }));
+  // One reading of each source directory, shared by package selection and
+  // every build below and reported as the state the binaries were keyed on.
+  const sourceDigests = new Map<string, string>();
+  // And one reading of the environment each build directory is keyed on, which
+  // a plugin module root's state reports as it is.
+  const environmentDigests = new Map<string, string>();
+  // With the witness of each such reading, so a build of a directory package
+  // selection already read keys on that reading instead of probing Go again.
+  const environmentWitnesses = new Map<
+    string,
+    PluginBuildEnvironmentWitness.Record
+  >();
+  const readings = {
+    sources: sourceDigests,
+    environments: environmentDigests,
+    witnesses: environmentWitnesses,
+  };
+  // Records describing sources must never land inside one, so the store is
+  // admitted for source proofs only once every source of the load is known.
+  const sourceIdentities = PluginContentIdentities.outside(identities, [
+    ...candidates.flatMap((candidate) => [
+      candidate.moduleRoot,
+      candidate.packageDir,
+      ...(candidate.contributors ?? []).map((input) => input.source),
+    ]),
+    ...SourcePluginWorkspace.findTtscOverlayDirs(),
+  ]);
+  // One fixed-effective-environment load owns manifest syntax sharing from the
+  // first watch query through metadata and builds. Do not allocate this after
+  // watch projection: that silently repeats selected-Go work (#1712).
+  const packageReaders = new Map<string, SourcePluginWorkspace.GoModReader>();
+  const watchReplacements =
+    options.onWatchInputs === undefined
+      ? undefined
+      : new Map<string, readonly string[]>();
   if (options.onWatchInputs !== undefined) {
     // The prospective context reads the admitted module layout and anchors its
     // tool there before kind exists. Keep both possible final-root baselines:
     // a linked package keeps packageDir, and an executable keeps moduleRoot.
-    const interests = new Set(candidates.flatMap((candidate) => [
-      candidate.moduleRoot,
-      candidate.packageDir,
-      ...(candidate.contributors ?? []).map((input) => input.source),
-    ]).filter(reportsPluginSource));
+    const interests = new Set(
+      candidates
+        .flatMap((candidate) => [
+          candidate.moduleRoot,
+          candidate.packageDir,
+          ...(candidate.contributors ?? []).map((input) => input.source),
+        ])
+        .filter(reportsPluginSource),
+    );
     options.onWatchInputs([...interests].sort());
     const initialSize = interests.size;
     for (const candidate of candidates) {
@@ -360,77 +432,104 @@ export function loadProjectPlugins(options: {
       // activate their irrelevant module graph just to discover watch inputs.
       if (candidate.stage === "transform" && candidate.entry !== ".") continue;
       for (const directory of pluginReplacementWatchDirectories(
-        candidate.moduleRoot, effectiveEnv, watchReplacements,
-      )) if (reportsPluginSource(directory)) interests.add(directory);
+        candidate.moduleRoot,
+        effectiveEnv,
+        watchReplacements,
+        packageReaders,
+      ))
+        if (reportsPluginSource(directory)) interests.add(directory);
     }
     if (interests.size !== initialSize)
       options.onWatchInputs([...interests].sort());
   }
-  const packageReaders = new Map<string, SourcePluginWorkspace.GoModReader>();
   const proposals = NativeSourcePackages.propose(
     candidates.map((candidate) => ({
-      ...candidate, ownModule: candidate.stage !== "transform",
-    })), effectiveEnv, packageReaders,
+      ...candidate,
+      ownModule: candidate.stage !== "transform",
+    })),
+    effectiveEnv,
+    packageReaders,
+    sourceIdentities,
+    readings,
   );
-  const records = candidates.map(({ plugin, index, stage, contributors, source, packageDir }) => {
-    const { kind, moduleRoot } = resolveNativeSource(source, plugin, entries[index]!.config, index, {
-      env: effectiveEnv, observation: proposals[index]!.observation,
-    });
-    if (kind === "linked" && stage !== "transform") {
-      throw new Error(
-        `ttsc: plugin "${pluginLabel(plugin, entries[index]!.config, index)}" source is a linked Go package, but only transform-stage plugins can be linked into a compiler host`,
+  const records = candidates.map(
+    ({ plugin, index, stage, contributors, source, packageDir }) => {
+      const { kind, moduleRoot } = resolveNativeSource(
+        source,
+        plugin,
+        entries[index]!.config,
+        index,
+        {
+          env: effectiveEnv,
+          observation: proposals[index]!.observation,
+        },
       );
-    }
-    const linkedContributorName =
-      kind === "linked"
-        ? `linked_${String(index).padStart(6, "0")}`
-        : undefined;
-    const hostInputs = validatePluginHostInputs(plugin, index);
-    const pluginHostInputHashes = validatePluginHostInputHashes(
-      plugin,
-      index,
-      hostInputs,
-    );
-    const pluginHostInputRealpaths = validatePluginHostInputRealpaths(
-      plugin,
-      index,
-      hostInputs,
-    );
-    return {
-      capabilities: plugin.capabilities,
-      contributors,
-      config: entries[index]!.config,
-      kind,
-      label: pluginLabel(plugin, entries[index]!.config, index),
-      linkedContributorName,
-      name: plugin.name,
-      reportsTypeScriptDiagnostics:
-        plugin.reportsTypeScriptDiagnostics === true,
-      request: loadedEntries[index]!.request,
-      hostInputHashes: mergePluginHostInputHashes(
-        loadedEntries[index]!.hostInputHashes,
-        pluginHostInputHashes,
-        loadedEntries[index]!.hostInputs,
+      if (kind === "linked" && stage !== "transform") {
+        throw new Error(
+          `ttsc: plugin "${pluginLabel(plugin, entries[index]!.config, index)}" source is a linked Go package, but only transform-stage plugins can be linked into a compiler host`,
+        );
+      }
+      const linkedContributorName =
+        kind === "linked"
+          ? `linked_${String(index).padStart(6, "0")}`
+          : undefined;
+      const hostInputs = validatePluginHostInputs(plugin, index);
+      const pluginHostInputHashes = validatePluginHostInputHashes(
+        plugin,
+        index,
         hostInputs,
-      ),
-      hostInputRealpaths: mergePluginHostInputHashes(
-        loadedEntries[index]!.hostInputRealpaths,
-        pluginHostInputRealpaths,
-        loadedEntries[index]!.hostInputs,
+      );
+      const pluginHostInputRealpaths = validatePluginHostInputRealpaths(
+        plugin,
+        index,
         hostInputs,
-      ),
-      hostInputs: [...loadedEntries[index]!.hostInputs, ...hostInputs],
-      moduleRoot,
-      packageDir,
-      source,
-      stage,
-    };
-  });
-  const executableCandidates = candidates.filter((candidate) =>
-    records[candidate.index]!.kind === "executable" && !proposals[candidate.index]!.ownModule);
+      );
+      return {
+        capabilities: plugin.capabilities,
+        contributors,
+        config: entries[index]!.config,
+        kind,
+        label: pluginLabel(plugin, entries[index]!.config, index),
+        linkedContributorName,
+        name: plugin.name,
+        reportsTypeScriptDiagnostics:
+          plugin.reportsTypeScriptDiagnostics === true,
+        request: loadedEntries[index]!.request,
+        hostInputHashes: mergePluginHostInputHashes(
+          loadedEntries[index]!.hostInputHashes,
+          pluginHostInputHashes,
+          loadedEntries[index]!.hostInputs,
+          hostInputs,
+        ),
+        hostInputRealpaths: mergePluginHostInputHashes(
+          loadedEntries[index]!.hostInputRealpaths,
+          pluginHostInputRealpaths,
+          loadedEntries[index]!.hostInputs,
+          hostInputs,
+        ),
+        hostInputs: [...loadedEntries[index]!.hostInputs, ...hostInputs],
+        moduleRoot,
+        packageDir,
+        source,
+        stage,
+      };
+    },
+  );
+  const executableCandidates = candidates.filter(
+    (candidate) =>
+      records[candidate.index]!.kind === "executable" &&
+      !proposals[candidate.index]!.ownModule,
+  );
   // Admission can now narrow the provisional interests without restamping the
   // retained package/module baselines. Final host errors still keep these roots.
-  options.onWatchInputs?.(pluginBuildDirectories(records, effectiveEnv, watchReplacements));
+  options.onWatchInputs?.(
+    pluginBuildDirectories(
+      records,
+      effectiveEnv,
+      watchReplacements,
+      packageReaders,
+    ),
+  );
   const linkedContributors = records
     .filter((record) => record.stage === "transform")
     .flatMap((record) =>
@@ -448,66 +547,101 @@ export function loadProjectPlugins(options: {
   // a second executable host can select a genuinely different Go context.
   const admittedExecutables = new Set<string>();
   if (linkedContributors.length !== 0) {
-    const hosts = transformHosts.length === 0
-      ? [{ source: path.join(ttscPackageRoot(), "cmd", "utility-host"), label: "linked-plugin-host" }]
-      : transformHosts;
-    const contexts = new Map<string, { source: string; label: string; records: typeof transformHosts }>();
+    const hosts =
+      transformHosts.length === 0
+        ? [
+            {
+              source: path.join(ttscPackageRoot(), "cmd", "utility-host"),
+              label: "linked-plugin-host",
+            },
+          ]
+        : transformHosts;
+    const contexts = new Map<
+      string,
+      { source: string; label: string; records: typeof transformHosts }
+    >();
     for (const host of hosts) {
-      const moduleRoot = resolvePluginGoModule(host.source, host.label).moduleRoot;
+      const moduleRoot = resolvePluginGoModule(
+        host.source,
+        host.label,
+      ).moduleRoot;
       let context = contexts.get(moduleRoot);
       if (context === undefined) {
         context = { source: host.source, label: host.label, records: [] };
         contexts.set(moduleRoot, context);
       }
     }
-    for (const record of transformHosts) contexts.get(record.moduleRoot)!.records.push(record);
+    for (const record of transformHosts)
+      contexts.get(record.moduleRoot)!.records.push(record);
     for (const host of contexts.values()) {
       const moduleHosts = host.records;
       const hostEntries = moduleHosts.map((record) => ({
         entry: resolvePluginGoModule(record.source, record.label).entry,
       }));
       const observations = NativeSourcePackages.inspect({
-        source: host.source, pluginName: host.label, env: effectiveEnv,
+        source: host.source,
+        pluginName: host.label,
+        env: effectiveEnv,
         readers: packageReaders,
+        identities: sourceIdentities,
+        readings,
         packages: [
           ...hostEntries,
           ...linkedContributors.map((input) => ({
-            ...input, entry: `./contrib/${input.name}`,
+            ...input,
+            entry: `./contrib/${input.name}`,
           })),
         ],
       });
       moduleHosts.forEach((record, index) => {
-        NativeSourcePackages.kind(observations[index]!, record.label, "executable");
+        NativeSourcePackages.kind(
+          observations[index]!,
+          record.label,
+          "executable",
+        );
         admittedExecutables.add(record.source);
       });
       linkedContributors.forEach((input, index) => {
-        NativeSourcePackages.kind(observations[hostEntries.length + index]!, `${input.name} inside host ${host.label}`, "linked");
+        NativeSourcePackages.kind(
+          observations[hostEntries.length + index]!,
+          `${input.name} inside host ${host.label}`,
+          "linked",
+        );
       });
     }
   }
   // A nested main proposal still needs its actual owning manifests. Hosts
   // with linked contributors were admitted together above; other equivalent
   // entries share one standalone observation, with no repeated host copy.
-  const standaloneCandidates = executableCandidates.filter((candidate) =>
-    !admittedExecutables.has(candidate.source));
+  const standaloneCandidates = executableCandidates.filter(
+    (candidate) => !admittedExecutables.has(candidate.source),
+  );
   const executablePackages = NativeSourcePackages.ownPackages(
-    standaloneCandidates, effectiveEnv, packageReaders,
+    standaloneCandidates,
+    effectiveEnv,
+    packageReaders,
+    sourceIdentities,
+    readings,
   );
   standaloneCandidates.forEach((candidate, index) => {
-    NativeSourcePackages.kind(executablePackages[index]!, candidate.label, "executable");
+    NativeSourcePackages.kind(
+      executablePackages[index]!,
+      candidate.label,
+      "executable",
+    );
   });
   const packageOwnership = (source: string, label: string, linked: boolean) => [
-    { entry: resolvePluginGoModule(source, label).entry, kind: "executable" as const },
-    ...(linked ? linkedContributors.map((input) => ({
-      entry: `./contrib/${input.name}`, kind: "linked" as const,
-    })) : []),
+    {
+      entry: resolvePluginGoModule(source, label).entry,
+      kind: "executable" as const,
+    },
+    ...(linked
+      ? linkedContributors.map((input) => ({
+          entry: `./contrib/${input.name}`,
+          kind: "linked" as const,
+        }))
+      : []),
   ];
-  // One reading of each source directory, shared by every build below and
-  // reported as the state the binaries were keyed on.
-  const sourceDigests = new Map<string, string>();
-  // And one reading of the environment each build directory is keyed on, which
-  // a plugin module root's state reports as it is.
-  const environmentDigests = new Map<string, string>();
   const builtTransformHosts = new Map<object, string>();
   for (const record of transformHosts) {
     builtTransformHosts.set(
@@ -517,10 +651,13 @@ export function loadProjectPlugins(options: {
         cacheDir: options.cacheDir,
         contributors: mergeContributors(record.contributors, hostContributors),
         env: effectiveEnv,
+        goModReaders: packageReaders,
+        identities: sourceIdentities,
         pluginName: record.label,
         packageOwnership: packageOwnership(record.source, record.label, true),
         source: record.source,
         environmentDigests,
+        environmentWitnesses,
         sourceDigests,
         ttscVersion,
         tsgoVersion,
@@ -534,13 +671,18 @@ export function loadProjectPlugins(options: {
           cacheDir: options.cacheDir,
           contributors: linkedContributors,
           env: effectiveEnv,
+          goModReaders: packageReaders,
+          identities: sourceIdentities,
           label: "linked plugin host",
           pluginName: "linked-plugin-host",
           source: path.join(ttscPackageRoot(), "cmd", "utility-host"),
           packageOwnership: packageOwnership(
-            path.join(ttscPackageRoot(), "cmd", "utility-host"), "linked-plugin-host", true,
+            path.join(ttscPackageRoot(), "cmd", "utility-host"),
+            "linked-plugin-host",
+            true,
           ),
           environmentDigests,
+          environmentWitnesses,
           sourceDigests,
           ttscVersion,
           tsgoVersion,
@@ -561,10 +703,17 @@ export function loadProjectPlugins(options: {
               cacheDir: options.cacheDir,
               contributors: record.contributors,
               env: effectiveEnv,
+              goModReaders: packageReaders,
+              identities: sourceIdentities,
               pluginName: record.label,
-              packageOwnership: packageOwnership(record.source, record.label, false),
+              packageOwnership: packageOwnership(
+                record.source,
+                record.label,
+                false,
+              ),
               source: record.source,
               environmentDigests,
+              environmentWitnesses,
               sourceDigests,
               ttscVersion,
               tsgoVersion,
@@ -616,6 +765,7 @@ export function loadProjectPlugins(options: {
         entry.observationsComplete && declaresHostInputReads(entry.plugin),
     ),
     discoveryInputsComplete: project.configInputsComplete === true,
+    ...(identities === undefined ? {} : { identities }),
     nativePlugins: orderNativePlugins(nativePlugins),
     ...(loadedEntries.some((entry) => !entry.observationsComplete)
       ? { observationsComplete: false as const }
@@ -631,9 +781,14 @@ export function loadProjectPlugins(options: {
           pluginSourceState(directory, {
             env: effectiveEnv,
             sourceDigest,
-            ...(environmentDigests.has(directory)
-              ? { environment: environmentDigests.get(directory)! }
-              : {}),
+            environment:
+              environmentDigests.get(directory) ??
+              pluginBuildEnvironment(
+                directory,
+                effectiveEnv,
+                undefined,
+                sourceIdentities,
+              ),
           }),
         ]),
     ),
@@ -1209,7 +1364,12 @@ function loadPluginDescriptor(
     ) {
       throw error;
     }
-    const loaded = loadDescriptorViaTtsx(request, context, effectiveEnv);
+    const loaded = loadDescriptorViaTtsx(
+      request,
+      context,
+      effectiveEnv,
+      descriptorCache.identities,
+    );
     if (loaded === undefined) {
       throw error;
     }
@@ -1222,6 +1382,9 @@ interface DescriptorCacheOptions {
   /** The plugin cache directory the caller selected, if any. */
   cacheDir: string | undefined;
 
+  /** Record store that proves the evaluating runtimes from metadata (#1723). */
+  identities: PluginContentIdentities.Store | undefined;
+
   /** This ttsc build's version. */
   version: string;
 }
@@ -1271,21 +1434,28 @@ function loadCommonJsDescriptor(
     runtime,
     effectiveEnv,
     context.projectRoot,
+    descriptorCache.identities,
   );
   const node =
     !runtimeCapabilities.bun &&
     runtimeCapabilities.registerHooks &&
     runtimeCapabilities.executable !== undefined
       ? runtimeCapabilities.executable
-      : resolveNodeBinary(effectiveEnv, context.projectRoot);
+      : resolveNodeBinary(
+          effectiveEnv,
+          context.projectRoot,
+          descriptorCache.identities,
+        );
   const cacheAuthority = {
     additionalRuntime: node,
     cacheDir: descriptorCache.cacheDir,
+    identities: descriptorCache.identities,
     context,
     // Everything the child receives besides the per-evaluation output paths.
     env: {
       ...effectiveEnv,
       ...(node === undefined ? {} : { TTSC_NODE_BINARY: node }),
+      ...descriptorRecordRoot(descriptorCache.identities),
       TTSC_TTSX_BINARY: ttsx,
     },
     projectRoot: context.projectRoot,
@@ -1375,6 +1545,7 @@ function loadCommonJsDescriptor(
             // The direct evaluator may be Bun, but ttsx and native config
             // loaders require a real Node runtime with synchronous hooks.
             ...(node === undefined ? {} : { TTSC_NODE_BINARY: node }),
+            ...descriptorRecordRoot(descriptorCache.identities),
             TTSC_TTSX_BINARY: ttsx,
             TTSC_PLUGIN_CONTEXT: JSON.stringify(context),
             TTSC_PLUGIN_DESCRIPTOR_LOAD: "1",
@@ -1759,11 +1930,12 @@ function loadDescriptorViaTtsx(
   request: string,
   context: ITtscPluginFactoryContext,
   effectiveEnv: NodeJS.ProcessEnv,
+  identities: PluginContentIdentities.Store | undefined,
 ): IsolatedPluginDescriptor | undefined {
   // Binary discovery prefers the instance environment, then the ambient
   // process.env (where `withPluginLoaderEnv` injects ttsc's own node/ttsx paths
   // just before this runs), then the running interpreter.
-  const node = resolveNodeBinary(effectiveEnv, context.projectRoot);
+  const node = resolveNodeBinary(effectiveEnv, context.projectRoot, identities);
   const ttsx = effectiveEnv.TTSC_TTSX_BINARY ?? process.env.TTSC_TTSX_BINARY;
   if (node === undefined || ttsx === undefined || ttsx.length === 0) {
     return undefined;
@@ -1802,6 +1974,7 @@ function loadDescriptorViaTtsx(
         // may recurse into further descriptor loads) finds them even when the
         // instance-env snapshot predates `withPluginLoaderEnv`.
         TTSC_NODE_BINARY: node,
+        ...descriptorRecordRoot(identities),
         TTSC_TTSX_BINARY: ttsx,
         TTSC_PLUGIN_CONTEXT: JSON.stringify({
           binary: context.binary,
@@ -1886,6 +2059,20 @@ interface TtsxDescriptorResolutionRecord {
   unstable?: boolean;
 }
 
+/**
+ * The private variable that hands a descriptor evaluator the plugin cache root
+ * this load's record store selected, so the child proves the compiler it runs
+ * from that root's records instead of streaming it (#1726) and never selects a
+ * cache root of its own. Absent without a store.
+ */
+function descriptorRecordRoot(
+  identities: PluginContentIdentities.Store | undefined,
+): { TTSC_PLUGIN_RECORD_ROOT?: string } {
+  return identities === undefined
+    ? {}
+    : { TTSC_PLUGIN_RECORD_ROOT: identities.root };
+}
+
 /**
  * Expand the ttsx runtime's selected module edges into the same exact and
  * missing resolution inputs used by the direct isolated evaluator.
@@ -1957,6 +2144,15 @@ function readTtsxDescriptorInputs(
         (signatures.has(resolved) &&
           signatures.get(resolved) !== record.signature)
       ) {
+        E2ETrace.capabilityResolution(
+          "plugin-descriptor-input-signature-moved",
+          {
+            resolved,
+            first: signatures.get(resolved),
+            later:
+              typeof record.signature === "string" ? record.signature : null,
+          },
+        );
         hashes.delete(resolved);
         realpaths.delete(resolved);
         signatures.delete(resolved);
@@ -2034,10 +2230,13 @@ function errorMessage(error: unknown): string {
   return error instanceof Error ? error.message : String(error);
 }
 
-function withPluginLoaderEnv<T>(run: () => T): T {
+function withPluginLoaderEnv<T>(
+  run: () => T,
+  identities: PluginContentIdentities.Store | undefined,
+): T {
   const previousNode = process.env.TTSC_NODE_BINARY;
   const previousTtsx = process.env.TTSC_TTSX_BINARY;
-  const node = resolveNodeBinary({}, process.cwd());
+  const node = resolveNodeBinary({}, process.cwd(), identities);
   if (process.env.TTSC_NODE_BINARY === undefined && node !== undefined) {
     process.env.TTSC_NODE_BINARY = node;
   }
@@ -2136,6 +2335,7 @@ function pluginBuildDirectories(
   }[],
   env: NodeJS.ProcessEnv,
   replacements?: Map<string, readonly string[]>,
+  readers?: Map<string, SourcePluginWorkspace.GoModReader>,
 ): string[] {
   const directories = new Set<string>();
   for (const record of records) {
@@ -2146,8 +2346,12 @@ function pluginBuildDirectories(
     );
     if (record.kind === "executable") {
       for (const directory of pluginReplacementWatchDirectories(
-        record.moduleRoot, env, replacements,
-      )) directories.add(directory);
+        record.moduleRoot,
+        env,
+        replacements,
+        readers,
+      ))
+        directories.add(directory);
     }
     for (const contributor of record.contributors ?? [])
       directories.add(path.resolve(contributor.source));
@@ -2164,13 +2368,19 @@ function pluginReplacementWatchDirectories(
   moduleRoot: string,
   env: NodeJS.ProcessEnv,
   observed?: Map<string, readonly string[]>,
+  readers?: Map<string, SourcePluginWorkspace.GoModReader>,
 ): readonly string[] {
   const previous = observed?.get(moduleRoot);
   if (previous !== undefined) return previous;
   let directories: readonly string[];
   try {
-    directories = pluginModuleReplaceDirectories(moduleRoot, env)
-      .map((replacement) => replacement.directory);
+    directories = pluginModuleReplaceDirectories(
+      moduleRoot,
+      env,
+      undefined,
+      undefined,
+      readers,
+    ).map((replacement) => replacement.directory);
   } catch {
     // An unreadable manifest/tool is not valid metadata. The already observed
     // module retains its repair path; actual proposal/build refusal propagates.