ttsc 0.31.0 → 0.31.2

package/src/plugin/internal/source/buildSourcePlugin.ts

@@ -8,20 +8,21 @@ import { OwnedSynchronousProcess } from "../../../internal/OwnedSynchronousProce
 import { SourceNativeRetirement } from "../../../internal/SourceNativeRetirement";
 import { createCanonicalTempDirectory } from "../../../internal/createCanonicalTempDirectory";
 import { runHoldingLock } from "../../../internal/runHoldingLock";
-import { NativeSourcePackages } from "./NativeSourcePackages";
-import { SourcePluginWorkspace } from "./SourcePluginWorkspace";
 import { GoSourceInputs } from "./GoSourceInputs";
 import { GoToolResolution } from "./GoToolResolution";
 import type { IPluginModuleReplaceDirectory } from "./IPluginModuleReplaceDirectory";
 import type { ITtscBuildContributor } from "./ITtscBuildContributor";
 import type { ITtscSourceBuildCachePaths } from "./ITtscSourceBuildCachePaths";
+import { NativeSourcePackages } from "./NativeSourcePackages";
 import { PluginBinaryUse } from "./PluginBinaryUse";
 import { PluginBuildEnvironmentWitness } from "./PluginBuildEnvironmentWitness";
 import type { PluginBuildLockLease } from "./PluginBuildLockLease";
 import { PluginBuildLockProtocol } from "./PluginBuildLockProtocol";
+import { PluginContentIdentities } from "./PluginContentIdentities";
 import { SourceBuildCacheLayout } from "./SourceBuildCacheLayout";
 import type { SourceBuildFilesystemOperations } from "./SourceBuildFilesystemOperations";
 import { SourcePluginAdmission } from "./SourcePluginAdmission";
+import { SourcePluginWorkspace } from "./SourcePluginWorkspace";
 import { acquirePluginBuildLock } from "./acquirePluginBuildLock";
 import { computeCacheKey } from "./computeCacheKey";
 import { copiesPluginSourceEntry } from "./copiesPluginSourceEntry";
@@ -44,12 +45,12 @@ import { withGoBuildCacheLease } from "./withGoBuildCacheLease";
  * Build one Go source plugin into a cached executable.
  *
  * `opts.env` is the effective environment for this build; the caller merges
- * inherited and constructor layers using native environment-name identity so
- * a programmatic `TtscCompiler` instance
- * can pin its own Go toolchain (`TTSC_GO_BINARY`), Go build cache
- * (`TTSC_GO_CACHE_DIR`), and Go build variables (`GOFLAGS`, `CGO_*`, …) without
- * mutating the shared `process.env`. CLI callers omit it and inherit
- * `process.env`, so ambient behavior is unchanged.
+ * inherited and constructor layers using native environment-name identity so a
+ * programmatic `TtscCompiler` instance can pin its own Go toolchain
+ * (`TTSC_GO_BINARY`), Go build cache (`TTSC_GO_CACHE_DIR`), and Go build
+ * variables (`GOFLAGS`, `CGO_*`, …) without mutating the shared `process.env`.
+ * CLI callers omit it and inherit `process.env`, so ambient behavior is
+ * unchanged.
  *
  * The cache key includes source and toolchain readings. Before publication the
  * scratch inputs are compared with their recorded digests and the external
@@ -65,16 +66,16 @@ import { withGoBuildCacheLease } from "./withGoBuildCacheLease";
  * Optional loader-required package ownership enters the key. Its cold producer
  * admits the entry and linked sources through Go metadata in the actual
  * materialized workspace before compilation; legacy cache artifacts have a
- * different key. Existing binary hits trust the cache producer and key rather than rehashing
- * executable bytes. Default caches are managed locally, while explicit roots
- * retain caller-managed pruning policy. Every returned cache key registers a
- * reader token retained by this process until exit; registration shares the
- * builder/collector lease, and other consumers register independent readers.
- * Failure to establish ownership propagates. Private opt-in tracing records the
- * mandatory key-creation and pre-build witness gates and adds one diagnostic
- * observation after Go returns. That diagnostic read adds metadata work, not
- * publication permission. A discarded epoch is separately recorded when the
- * bounded build owner starts again.
+ * different key. Existing binary hits trust the cache producer and key rather
+ * than rehashing executable bytes. Default caches are managed locally, while
+ * explicit roots retain caller-managed pruning policy. Every returned cache key
+ * registers a reader token retained by this process until exit; registration
+ * shares the builder/collector lease, and other consumers register independent
+ * readers. Failure to establish ownership propagates. Private opt-in tracing
+ * records the mandatory key-creation and pre-build witness gates and adds one
+ * diagnostic observation after Go returns. That diagnostic read adds metadata
+ * work, not publication permission. A discarded epoch is separately recorded
+ * when the bounded build owner starts again.
  *
  * Explicit worker scopes check cancellation between build phases, copied source
  * entries and native commands, including reader admission and final
@@ -88,8 +89,8 @@ import { withGoBuildCacheLease } from "./withGoBuildCacheLease";
  * @evidence contracts/common.md#prohibited-implementation-shortcuts A changed witness is never overwritten or accepted. A fresh epoch takes a new toolchain reading and performs the actual build or qualified adoption; source, native and cleanup failures stay terminal. No selected SDK tool is warmed by a special command, and no foreign environment or memo is rebased. Shared Go objects retain their owner's toolID/actionID contract; same-version custom tool semantics beyond that contract are not newly guaranteed.
  * @evidence contracts/common.md#meaningful-documentation Native paragraphs explain effective environment, recorded-input comparisons and their trust/observation limits, reader registration and managed versus explicit roots; option-map comments state their reading provenance with blank member separation.
  * @evidence contracts/portability.md#os-neutral-implementation Node path/physical-cache/temp APIs preserve native identities; executable resolution and Windows command handling are isolated owners, and the binary filename explicitly follows its executable platform.
- * @evidence contracts/performance.md#efficient-algorithms At most three epochs redo native toolchain observation, key construction, materialization and guarded admission; each can run one Go build, preceded by one batched package metadata command when the loader requires ownership admission. The shared compiler reader can itself make three version observations, hence at most nine such cold observations for a persistently moving compiler and no build when its key witness fails. Full-file bytes, entries, path/sort text, contributors, external trees and witness populations drive work. Scoped cancellation is sampled between phases/entries/commands and does not bound native calls or delegated hashing. First source digest readings are reused across epochs, while each scratch is independently checked. Existing lock contention has its separate wait budget and native Go compiler work remains delegated.
- * @evidence contracts/performance.md#reuse-equivalent-work Existing binaries and concurrent builders share the version/platform/source/environment key with reader admission before return, assuming trustworthy cache producers and supplied digest maps. Fixed trimpath compilation removes disposable snapshot paths from Go object identities. Shared load readings and sequential source/toolchain comparisons reject observed changes; metadata reuse and unobserved concurrent mutation remain the underlying witnesses' limits.
+ * @evidence contracts/performance.md#efficient-algorithms At most three epochs redo native toolchain observation, key construction, materialization and guarded admission; the first can key on the load's witnessed same-directory reading instead of observing the toolchain again, and later ones always observe it. Each can run one Go build, preceded by one batched package metadata command when the loader requires ownership admission. The shared compiler reader can itself make three version observations, hence at most nine such cold observations for a persistently moving compiler and no build when its key witness fails. Full-file bytes, entries, path/sort text, contributors, external trees and witness populations drive work. Scoped cancellation is sampled between phases/entries/commands and does not bound native calls or delegated hashing. First source digest readings are reused across epochs, while each scratch is independently checked. Existing lock contention has its separate wait budget and native Go compiler work remains delegated.
+ * @evidence contracts/performance.md#reuse-equivalent-work Existing binaries and concurrent builders share the version/platform/source/environment key with reader admission before return, assuming trustworthy cache producers and supplied digest maps. The key's content digests come from the record store when their separable metadata still matches, so a new process does not read unchanged sources, SDK or compiler bytes to find an existing binary (#1722). Fixed trimpath compilation removes disposable snapshot paths from Go object identities. Shared load readings and sequential source/toolchain comparisons reject observed changes; metadata reuse and unobserved concurrent mutation remain the underlying witnesses' limits.
  * @evidence contracts/performance.md#bound-retention-and-release-resources Scratch directories and build/cache leases have finally-based cleanup, including cancellation; cancelled work admits no new post-build prune pass. Scratch removal or lease cleanup can fail, and selected synchronous child settlement does not join arbitrary descendants. Repeated commands can repeat external tool effects; only ttsc-owned failed outputs are discarded, and Go-owned object entries retain their existing lifetime. Pending binary cleanup is best-effort. Reader tokens and their process map grow with distinct physical keys until process exit. Managed pruning attempts age/LRU reclamation while protecting live, unknown and selected entries, so it is not a hard disk bound; explicit roots remain caller-managed.
  */
 export function buildSourcePlugin(opts: {
@@ -101,7 +102,10 @@ export function buildSourcePlugin(opts: {
   env?: NodeJS.ProcessEnv;
 
   /** Loader-required ownership of the entry and named linked packages. */
-  packageOwnership?: readonly { entry: string; kind: "executable" | "linked" }[];
+  packageOwnership?: readonly {
+    entry: string;
+    kind: "executable" | "linked";
+  }[];
 
   /**
    * Digests of the environment each build directory is keyed on, shared by
@@ -110,7 +114,21 @@ export function buildSourcePlugin(opts: {
    */
   environmentDigests?: Map<string, string>;
 
+  /**
+   * Witnesses of the readings in `environmentDigests` (`computeCacheKey`), so
+   * the first epoch keys on a reading package selection already took. A
+   * discarded epoch reads the toolchain again instead.
+   */
+  environmentWitnesses?: Map<string, PluginBuildEnvironmentWitness.Record>;
+
   filesystem?: Partial<SourceBuildFilesystemOperations>;
+
+  /**
+   * Record store the loader opened for this load, so its key reuses content
+   * identities across processes (#1722); a standalone build opens its own.
+   */
+  identities?: PluginContentIdentities.Store;
+
   label?: string;
   overlayDirs?: readonly string[];
   quiet?: boolean;
@@ -123,6 +141,9 @@ export function buildSourcePlugin(opts: {
    */
   sourceDigests?: Map<string, string>;
 
+  /** Pinned-tool manifest readers shared only by this loader request. */
+  goModReaders?: Map<string, SourcePluginWorkspace.GoModReader>;
+
   ttscVersion: string;
   tsgoVersion: string;
 }): string {
@@ -134,9 +155,17 @@ export function buildSourcePlugin(opts: {
   for (let attempt = 0; ; attempt += 1) {
     OwnedSynchronousProcess.checkpoint();
     const environmentDigests = new Map(opts.environmentDigests);
+    // Only the first epoch may key on a reading taken before it; a discarded
+    // epoch means the toolchain moved, so later ones read it again.
+    const environmentWitnesses =
+      opts.environmentWitnesses === undefined
+        ? undefined
+        : new Map(attempt === 0 ? opts.environmentWitnesses : []);
     try {
       const binary = buildSourcePluginAttempt(
-        opts,
+        attempt === 0
+          ? { ...opts, environmentWitnesses }
+          : { ...opts, environmentWitnesses, goModReaders: undefined },
         env,
         sourceDigests,
         environmentDigests,
@@ -146,6 +175,8 @@ export function buildSourcePlugin(opts: {
         opts.sourceDigests?.set(directory, digest);
       for (const [directory, digest] of environmentDigests)
         opts.environmentDigests?.set(directory, digest);
+      for (const [directory, witness] of environmentWitnesses ?? [])
+        opts.environmentWitnesses?.set(directory, witness);
       return binary;
     } catch (error) {
       if (
@@ -174,7 +205,9 @@ function buildSourcePluginAttempt(
 ): string {
   OwnedSynchronousProcess.checkpoint();
   const { dir, entry, source } = resolveSourceBuildTarget(opts);
-  const overlayDirs = [...(opts.overlayDirs ?? SourcePluginWorkspace.findTtscOverlayDirs())].sort();
+  const overlayDirs = [
+    ...(opts.overlayDirs ?? SourcePluginWorkspace.findTtscOverlayDirs()),
+  ].sort();
   const contributors = opts.contributors ?? [];
   const compiler = resolveGoCompiler(env);
   const goBinary = GoToolResolution.resolveGoToolForBuild(
@@ -184,8 +217,27 @@ function buildSourcePluginAttempt(
   );
   ensureExecutableGoToolchain(goBinary, compiler.bundled);
   OwnedSynchronousProcess.checkpoint();
+  const identities =
+    opts.identities ??
+    PluginContentIdentities.open({
+      projectRoot: opts.baseDir,
+      cacheDir: opts.cacheDir,
+      env,
+      sources: [
+        dir,
+        ...overlayDirs,
+        ...contributors.map((contributor) => contributor.source),
+      ],
+    });
   // The digest of every directory the key covers, as the key read it, which
   // the build proves against what it compiled.
+  const goModReader = SourcePluginWorkspace.createGoModReader(
+    goBinary,
+    opts.pluginName,
+    env,
+    opts.goModReaders,
+    identities,
+  );
   const environmentWitness: PluginBuildEnvironmentWitness.Record = new Map();
   const key = computeCacheKey({
     contributors,
@@ -194,10 +246,13 @@ function buildSourcePluginAttempt(
     entry,
     env,
     environmentWitness,
+    goModReader,
     filesystem: opts.filesystem,
     goBinary,
+    identities,
     overlayDirs,
     environmentDigests,
+    environmentWitnesses: opts.environmentWitnesses,
     sourceDigests,
     ttscVersion: opts.ttscVersion,
     tsgoVersion: opts.tsgoVersion,
@@ -317,6 +372,7 @@ function buildSourcePluginAttempt(
         env,
         environmentWitness,
         goBinary,
+        goModReader,
         normalizeGoToolPermissions: compiler.bundled,
         key,
         keyedDigests: sourceDigests,
@@ -394,7 +450,10 @@ function compileSourcePlugin(opts: {
   binaryPath: string;
   cacheDir: string;
   contributors: readonly ITtscBuildContributor[];
-  packageOwnership?: readonly { entry: string; kind: "executable" | "linked" }[];
+  packageOwnership?: readonly {
+    entry: string;
+    kind: "executable" | "linked";
+  }[];
   dir: string;
   entry: string;
   env: NodeJS.ProcessEnv;
@@ -406,6 +465,7 @@ function compileSourcePlugin(opts: {
   goBuildCacheRoot: string;
   manageGoBuildCache: boolean;
   normalizeGoToolPermissions: boolean;
+  goModReader: SourcePluginWorkspace.GoModReader;
   key: string;
 
   /** The digest of every directory the key covers, as the key read it. */
@@ -461,6 +521,7 @@ function compileSourcePlugin(opts: {
       opts.dir,
       opts.env,
       opts.goBinary,
+      opts.goModReader,
     );
     OwnedSynchronousProcess.checkpoint();
     // Every source the build would otherwise read in place, an overlay and
@@ -487,11 +548,7 @@ function compileSourcePlugin(opts: {
       opts.goBinary,
       opts.env,
     );
-    const goModReader = SourcePluginWorkspace.createGoModReader(
-      opts.goBinary,
-      opts.pluginName,
-      opts.env,
-    );
+    const goModReader = opts.goModReader;
     OwnedSynchronousProcess.checkpoint();
     if (opts.contributors.length > 0) {
       mergeContributors({
@@ -543,12 +600,20 @@ function compileSourcePlugin(opts: {
             const observations = NativeSourcePackages.read({
               cwd: scratchDir,
               entries: opts.packageOwnership.map((input) => input.entry),
-              env: GoSourceInputs.goBuildEnv(opts.goBinary, goBuildCacheRoot, opts.env),
+              env: GoSourceInputs.goBuildEnv(
+                opts.goBinary,
+                goBuildCacheRoot,
+                opts.env,
+              ),
               goBinary: opts.goBinary,
               pluginName: opts.pluginName,
             });
             opts.packageOwnership.forEach((input, index) => {
-              NativeSourcePackages.kind(observations[index]!, `${opts.pluginName} ${input.entry}`, input.kind);
+              NativeSourcePackages.kind(
+                observations[index]!,
+                `${opts.pluginName} ${input.entry}`,
+                input.kind,
+              );
             });
           }
           runGoBuild(
@@ -629,10 +694,14 @@ function compileSourcePlugin(opts: {
     taskFailure = { error };
     throw error;
   } finally {
-    SourceNativeRetirement.releaseResource(scratchDir, () => {
-      fs.rmSync(scratchDir, { recursive: true, force: true });
-      SourceNativeRetirement.forget(opts.cacheDir);
-    }, taskFailure);
+    SourceNativeRetirement.releaseResource(
+      scratchDir,
+      () => {
+        fs.rmSync(scratchDir, { recursive: true, force: true });
+        SourceNativeRetirement.forget(opts.cacheDir);
+      },
+      taskFailure,
+    );
   }
 }
 
@@ -1009,7 +1078,6 @@ function resolveSourceBuildTarget(opts: {
   return { dir: moduleRoot, entry, source };
 }
 
-
 /**
  * The path, below a build's scratch directory, of the tree holding its copies
  * of the sources outside the module.

package/src/plugin/internal/source/computeCacheKey.ts

@@ -5,10 +5,11 @@ import path from "node:path";
 import { GoToolResolution } from "./GoToolResolution";
 import type { ITtscBuildContributor } from "./ITtscBuildContributor";
 import type { PluginBuildEnvironmentWitness } from "./PluginBuildEnvironmentWitness";
+import { PluginContentIdentities } from "./PluginContentIdentities";
 import type { SourceBuildFilesystemOperations } from "./SourceBuildFilesystemOperations";
+import type { SourcePluginWorkspace } from "./SourcePluginWorkspace";
 import { hashPluginBuildEnvironment } from "./hashPluginBuildEnvironment";
 import { pluginModuleReplaceDirectories } from "./pluginModuleReplaceDirectories";
-import { pluginSourceDigest } from "./pluginSourceDigest";
 
 /**
  * Compute a 32-character lowercase key from a plugin build's SHA-256 digest.
@@ -20,8 +21,8 @@ import { pluginSourceDigest } from "./pluginSourceDigest";
  * source files. An optional required package-ownership population also frames
  * the key, separating binaries admitted by the matching cold producer from
  * legacy artifacts; requests without that authority retain their existing key.
- * Contributors are sorted by name; unique names remove input
- * order dependence, while equal-name rows retain the sort's input order.
+ * Contributors are sorted by name; unique names remove input order dependence,
+ * while equal-name rows retain the sort's input order.
  *
  * Each source directory enters the key as its digest (`pluginSourceDigest`),
  * which the transform envelope reports, with the environment below, as the
@@ -29,10 +30,12 @@ import { pluginSourceDigest } from "./pluginSourceDigest";
  * values are trusted producer readings, not revalidated content observations.
  * `sourceDigests` carries the digests one load already took: every build of the
  * load keys on one reading of each directory, and the load reports those
- * readings. The environment enters through `hashPluginBuildEnvironment`, the
- * rule that reported state takes it from too, and `environmentDigests` carries
- * the digest of each build directory's, so the load reports it without a second
- * `go env` run.
+ * readings. The environment enters as the digest of
+ * `hashPluginBuildEnvironment`, the rule that reported state takes it from too,
+ * and `environmentDigests` carries the digest of each build directory's, so the
+ * load reports it without a second `go env` run. With `environmentWitnesses`, a
+ * reading the load already took for the same directory, such as package
+ * selection's, keys the build too, and its witness joins the build's.
  *
  * The `ttsc cache` CLI and plugin build pipeline share this key computation.
  *
@@ -42,7 +45,7 @@ import { pluginSourceDigest } from "./pluginSourceDigest";
  * @evidence contracts/common.md#meaningful-documentation Native paragraphs explain input coverage and the provenance of reported digests; documented optional output maps have blank separation between members.
  * @evidence contracts/portability.md#os-neutral-implementation Native roots are resolved with Node path APIs and executable resolution; platform/architecture intentionally distinguish incompatible binary artifacts.
  * @evidence contracts/performance.md#efficient-algorithms Source digest misses enumerate/sort paths and read individual files in full, not bounded streaming chunks. Overlay/contributor ordering compares path/name text; replacement discovery can read a manifest/run Go and native containment queries. Toolchain/env hashing delegates native metadata/probes/full bytes and memo checks without an unmeasured dominant-cost ranking; JSON framing processes all version/entry/label/digest text.
- * @evidence contracts/performance.md#reuse-equivalent-work Caller-owned sourceDigests share supplied absolute-directory readings across roles without independently verifying their provenance/currentness. EnvironmentDigests receives this call's selected environment identity so reporting can avoid another probe; it does not skip environment hashing. Reuse inherits the selected population and metadata/producer premises.
+ * @evidence contracts/performance.md#reuse-equivalent-work Caller-owned sourceDigests share supplied absolute-directory readings across roles without independently verifying their provenance/currentness. A supplied record store lets a new process reuse a directory, SDK or executable digest only while its separable metadata signature matches the recorded one (#1722), so unchanged inputs are not re-read per process. EnvironmentDigests receives this call's selected environment identity so reporting can avoid another probe. A same-directory reading of the same load, with its witness, replaces a second environment probe; the witness then joins this build's, which the build compares after it ran, and a non-default byte adapter never shares. Reuse inherits the selected population and metadata/producer premises.
  *
  * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources Output maps belong to the enclosing load; this operation retains no handles or process-wide records itself.
  */
@@ -53,7 +56,10 @@ export function computeCacheKey(inputs: {
   env?: NodeJS.ProcessEnv;
 
   /** Required package ownership, admitted by the matching cold producer. */
-  packageOwnership?: readonly { entry: string; kind: "executable" | "linked" }[];
+  packageOwnership?: readonly {
+    entry: string;
+    kind: "executable" | "linked";
+  }[];
 
   /**
    * Digests of the environment each build directory is keyed on
@@ -62,6 +68,14 @@ export function computeCacheKey(inputs: {
    */
   environmentDigests?: Map<string, string>;
 
+  /**
+   * Witness of each reading in `environmentDigests` this load took, by
+   * directory. A digest with its witness stands for this call's own reading:
+   * the key takes it instead of running Go again and copies the witness into
+   * `environmentWitness`. Filled with this call's reading when it takes one.
+   */
+  environmentWitnesses?: Map<string, PluginBuildEnvironmentWitness.Record>;
+
   /**
    * Receives selected native toolchain dependencies from the environment reader
    * for later comparison under its metadata-distinguishability premise; it is
@@ -72,6 +86,15 @@ export function computeCacheKey(inputs: {
   /** Byte adapter for delegated SDK identity; plugin source digests use fs. */
   filesystem?: Partial<SourceBuildFilesystemOperations>;
   goBinary?: string;
+  goModReader?: SourcePluginWorkspace.GoModReader;
+
+  /**
+   * Record store that proves unchanged sources, overlays, contributors, GOROOT
+   * and executables from metadata in a new process (#1722). Without it every
+   * process reads their bytes.
+   */
+  identities?: PluginContentIdentities.Store;
+
   overlayDirs?: readonly string[];
 
   /**
@@ -102,69 +125,117 @@ export function computeCacheKey(inputs: {
   hash.update(JSON.stringify(["platform", process.platform, process.arch]));
   hash.update(JSON.stringify(["entry", inputs.entry]));
   if (inputs.packageOwnership !== undefined)
-    hash.update(JSON.stringify(["package-ownership", 1,
-      [...inputs.packageOwnership].sort((left, right) =>
-        left.entry < right.entry ? -1 : left.entry > right.entry ? 1 :
-          left.kind < right.kind ? -1 : left.kind > right.kind ? 1 : 0),
-    ]));
+    hash.update(
+      JSON.stringify([
+        "package-ownership",
+        1,
+        [...inputs.packageOwnership].sort((left, right) =>
+          left.entry < right.entry
+            ? -1
+            : left.entry > right.entry
+              ? 1
+              : left.kind < right.kind
+                ? -1
+                : left.kind > right.kind
+                  ? 1
+                  : 0,
+        ),
+      ]),
+    );
   // Private materialization changes native package working directories. Keep
   // binaries produced by the former absolute-ancestry layout out of this
   // layout's cache admissions, including callers with no SDK overlays.
   hash.update(JSON.stringify(["external-source-layout", 1]));
-  // The same framed values enter the key and the environment-only digest,
-  // which pluginBuildEnvironment reads for this directory.
-  const environment = crypto.createHash("sha256");
-  hashPluginBuildEnvironment(
-    {
-      update: (data: string) => {
-        hash.update(data);
-        environment.update(data);
-      },
-    },
-    goBinary,
-    inputs.dir,
-    env,
-    filesystem,
-    inputs.environmentWitness,
-  );
-  inputs.environmentDigests?.set(
-    path.resolve(inputs.dir),
-    environment.digest("hex"),
+  const overlays = [...(inputs.overlayDirs ?? [])].sort();
+  // Hash contributors in sorted-by-name order so two consumers with the
+  // same logical set produce the same key regardless of declaration order
+  // in the host's plugin descriptor.
+  const sortedContributors = [...(inputs.contributors ?? [])].sort((a, b) =>
+    a.name === b.name ? 0 : a.name < b.name ? -1 : 1,
   );
-  hashSourceDirectory(hash, "plugin", inputs.dir, inputs.sourceDigests);
+  // A store whose root lies inside a directory this key hashes would write
+  // records into that source, so such a store proves nothing here. The build
+  // rejects that cache placement (`SourcePluginAdmission`) once every source
+  // is known; replacement targets narrow the store below, before their own
+  // digests, since only Go's reading of the manifest names them.
+  let identities = PluginContentIdentities.outside(inputs.identities, [
+    inputs.dir,
+    ...overlays,
+    ...sortedContributors.map((contributor) => contributor.source),
+  ]);
+  // The key frames the environment digest pluginBuildEnvironment reports for
+  // this directory. WARNING (#1721): package selection reads that environment
+  // first in the same load; reading it again here doubled `go env` and
+  // `go version` per load. A reading taken through another byte adapter is
+  // not this one's, so only the default adapter shares it.
+  const environmentDirectory = path.resolve(inputs.dir);
+  const sharedDigest =
+    inputs.filesystem === undefined
+      ? inputs.environmentDigests?.get(environmentDirectory)
+      : undefined;
+  const sharedWitness =
+    sharedDigest === undefined
+      ? undefined
+      : inputs.environmentWitnesses?.get(environmentDirectory);
+  let environment: string;
+  if (sharedDigest !== undefined && sharedWitness !== undefined) {
+    // The build compares this witness after it ran, exactly as it would its
+    // own reading's, so a toolchain change since the reading still refuses.
+    for (const [file, state] of sharedWitness)
+      if (!inputs.environmentWitness?.has(file))
+        inputs.environmentWitness?.set(file, state);
+    environment = sharedDigest;
+  } else {
+    const witness =
+      inputs.environmentWitness ??
+      (inputs.environmentWitnesses === undefined ? undefined : new Map());
+    const reading = crypto.createHash("sha256");
+    hashPluginBuildEnvironment(
+      reading,
+      goBinary,
+      inputs.dir,
+      env,
+      filesystem,
+      witness,
+      identities,
+    );
+    environment = reading.digest("hex");
+    inputs.environmentDigests?.set(environmentDirectory, environment);
+    if (inputs.filesystem === undefined && witness !== undefined)
+      inputs.environmentWitnesses?.set(environmentDirectory, new Map(witness));
+  }
+  hash.update(JSON.stringify(["environment", environment]));
+  const directory = (label: string, root: string): void =>
+    hashSourceDirectory(hash, label, root, inputs.sourceDigests, identities);
+  directory("plugin", inputs.dir);
   // Local replacement targets outside the module supply separately keyed
   // sources. buildSourcePlugin snapshots and proves their copies before
-  // redirecting the Go replacement directives to the scratch tree.
-  for (const replacement of pluginModuleReplaceDirectories(
+  // redirecting the Go replacement directives to the scratch tree. Go reads the
+  // manifest after the plugin's digest, so an edit made meanwhile lands between
+  // that digest and the build's copy, which `requireKeyedSource` refuses.
+  const replacements = pluginModuleReplaceDirectories(
     inputs.dir,
     env,
     goBinary,
-  )) {
-    hashSourceDirectory(
-      hash,
+    inputs.goModReader,
+  );
+  identities = PluginContentIdentities.outside(
+    identities,
+    replacements.map((replacement) => replacement.directory),
+  );
+  for (const replacement of replacements) {
+    directory(
       `replace:${replacement.modulePath}${
         replacement.version === undefined ? "" : `@${replacement.version}`
       }`,
       replacement.directory,
-      inputs.sourceDigests,
     );
   }
-  for (const [index, dir] of [...(inputs.overlayDirs ?? [])].sort().entries()) {
-    hashSourceDirectory(hash, `overlay:${index}`, dir, inputs.sourceDigests);
+  for (const [index, dir] of overlays.entries()) {
+    directory(`overlay:${index}`, dir);
   }
-  // Hash contributors in sorted-by-name order so two consumers with the
-  // same logical set produce the same key regardless of declaration order
-  // in the host's plugin descriptor.
-  const sortedContributors = [...(inputs.contributors ?? [])].sort((a, b) =>
-    a.name === b.name ? 0 : a.name < b.name ? -1 : 1,
-  );
   for (const contributor of sortedContributors) {
-    hashSourceDirectory(
-      hash,
-      `contributor:${contributor.name}`,
-      contributor.source,
-      inputs.sourceDigests,
-    );
+    directory(`contributor:${contributor.name}`, contributor.source);
   }
   return hash.digest("hex").slice(0, 32);
 }
@@ -179,11 +250,14 @@ function hashSourceDirectory(
   label: string,
   root: string,
   digests: Map<string, string> | undefined,
+  identities: PluginContentIdentities.Store | undefined,
 ): void {
   const directory = path.resolve(root);
   let digest = digests?.get(directory);
   if (digest === undefined) {
-    digest = pluginSourceDigest(directory);
+    // WARNING (#1722): the load-scoped map above ends with the process. Only the
+    // record store spares a new process from reading every source byte again.
+    digest = PluginContentIdentities.sourceDirectory(identities, directory);
     digests?.set(directory, digest);
   }
   hash.update(JSON.stringify(["dir", label, digest]));