ttsc 0.31.0 → 0.31.2

package/src/plugin/internal/source/hashPluginBuildEnvironment.ts

@@ -2,9 +2,11 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 
+import { GoEnvironmentReading } from "./GoEnvironmentReading";
 import { GoSourceInputs } from "./GoSourceInputs";
 import { GoToolResolution } from "./GoToolResolution";
 import { PluginBuildEnvironmentWitness } from "./PluginBuildEnvironmentWitness";
+import { PluginContentIdentities } from "./PluginContentIdentities";
 import type { SourceBuildFilesystemOperations } from "./SourceBuildFilesystemOperations";
 import { spawnGoTool } from "./spawnGoTool";
 
@@ -41,14 +43,17 @@ import { spawnGoTool } from "./spawnGoTool";
  *   variable carries: the Go tool, the Go environment file `go env -w` writes,
  *   the executables the C toolchain commands name, and GOROOT. A consumer that
  *   keeps the reading compares their metadata before reusing it.
+ * @param identities Record store that lets a new process prove the GOROOT
+ *   corpus and executable bytes from their metadata (`PluginContentIdentities`,
+ *   #1722); without it every process reads them.
  * @evidence contracts/common.md#principled-implementation Fixed artifact flags, observed compiler bytes/version, selected reported-or-fallback build values, named command executables and selected SDK files enter the same framed identity used by source-state reporting. Fallback values and metadata-qualified reuse are explicit premises, not complete observation of arbitrary toolchain inputs.
  * @evidence contracts/common.md#clear-and-simple-design Private helpers separate compiler identity, Go-reported settings, external variables and SDK content while sharing one hash sink and optional pre-read witness.
  * @evidence contracts/common.md#prohibited-implementation-shortcuts Cache signatures include real identity/change metadata and effective invocation context; failed SDK witnessing refuses reuse rather than accepting a VERSION-only proxy.
  * @evidence contracts/common.md#meaningful-documentation Native documentation names the input classes and witness purpose; private comments explain context-sensitive compiler memoization and SDK exclusions without treating a passing check as proof.
  * @evidence contracts/portability.md#os-neutral-implementation Node path/stat/process APIs resolve native tool identities; platform-specific executable suffixes and environment lookup are isolated in GoToolResolution, and Go supplies its own effective build settings.
  * @evidence contracts/performance.md#efficient-algorithms SDK traversal sorts reached entry names and selected file paths, performs native stat/realpath/link queries and serializes topology/metadata/path text. Matching manifests share aggregate hashes; changes read full selected files via the caller adapter, retaining file buffers with population/topology data. Compiler misses capture at most three complete version/byte readings when native metadata moves during a reading; only a stable attempt enters the memo. Go env can run up to three times for its file witness, and command tokens can each perform executable searches/full reads. Environment sorting/framing and command substring parsing also process name/value/command bytes; E/D/F/B alone do not capture native lookup or text comparison costs.
- * @evidence contracts/performance.md#reuse-equivalent-work Compiler memo identity includes selected path/file metadata and invocation cwd/environment; SDK aggregate reuse requires matching complete ordered metadata/topology. Both rely on native metadata distinguishability and sequential observation premises, not independently rehashed content on each hit. Physical directories expand once per selection policy while aliases retain edges; optional caller witnesses receive reached selected dependencies.
- * @evidence contracts/performance.md#bound-retention-and-release-resources Compiler, Go-environment-path and SDK maps retain historical distinct tool/context/root keys without eviction. SDK population/topology and full individual file reads contribute transient bytes; synchronous probes delegate process/capture lifetime to their owner and do not certify arbitrary descendants are gone. No independent entry/record/file/output byte ceiling is imposed here.
+ * @evidence contracts/performance.md#reuse-equivalent-work Compiler memo identity includes selected path/file metadata and invocation cwd/environment; SDK aggregate reuse requires matching complete ordered metadata/topology. With a record store, a new process reuses the SDK aggregate and executable digests only while their signatures match the recorded ones and every stamp is separable from a freshly minted reference (#1722); `go version` and `go env` stay live because they report toolchain selection no file metadata shows. All of this relies on native metadata distinguishability and sequential observation premises. Physical directories expand once per selection policy while aliases retain edges; optional caller witnesses receive reached selected dependencies.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources Compiler, Go-environment-path and SDK maps retain historical distinct tool/context/root keys without eviction; persisted records belong to the single-file collector. SDK population/topology and full individual file reads contribute transient bytes; synchronous probes delegate process/capture lifetime to their owner and do not certify arbitrary descendants are gone. No independent entry/record/file/output byte ceiling is imposed here.
  */
 export function hashPluginBuildEnvironment(
   hash: { update(data: string): unknown },
@@ -57,6 +62,7 @@ export function hashPluginBuildEnvironment(
   env: NodeJS.ProcessEnv,
   filesystem: SourceBuildFilesystemOperations,
   witness?: PluginBuildEnvironmentWitness.Record,
+  identities?: PluginContentIdentities.Store,
 ): void {
   // Fixed artifact policy must invalidate binaries and reported source states
   // together, including binaries cached before this policy was introduced.
@@ -67,11 +73,25 @@ export function hashPluginBuildEnvironment(
     hash.update(
       JSON.stringify([
         "go",
-        resolveGoCompilerIdentity(goBinary, env, directory, witness),
+        resolveGoCompilerIdentity(
+          goBinary,
+          env,
+          directory,
+          witness,
+          identities,
+        ),
       ]),
     );
   }
-  hashGoBuildEnvironment(hash, goBinary, directory, env, filesystem, witness);
+  hashGoBuildEnvironment(
+    hash,
+    goBinary,
+    directory,
+    env,
+    filesystem,
+    witness,
+    identities,
+  );
   hashExternalGoBuildEnvironment(hash, env);
 }
 
@@ -172,6 +192,7 @@ function resolveGoCompilerIdentity(
   env: NodeJS.ProcessEnv = process.env,
   cwd: string = process.cwd(),
   witness?: PluginBuildEnvironmentWitness.Record,
+  identities?: PluginContentIdentities.Store,
 ): string {
   const selected = GoToolResolution.resolveGoToolForBuild(
     goBinary,
@@ -216,7 +237,13 @@ function resolveGoCompilerIdentity(
       compilerEnv,
       cwd,
     );
-    identity = computeGoCompilerIdentity(selected, resolved, compilerEnv, cwd);
+    identity = computeGoCompilerIdentity(
+      selected,
+      resolved,
+      compilerEnv,
+      cwd,
+      identities,
+    );
     if (!PluginBuildEnvironmentWitness.holds(observed)) continue;
     for (const [file, signature] of observed)
       if (witness !== undefined && !witness.has(file))
@@ -268,10 +295,13 @@ function computeGoCompilerIdentity(
   resolved: string,
   env: NodeJS.ProcessEnv,
   cwd: string,
+  identities: PluginContentIdentities.Store | undefined,
 ): string {
   if (!fs.existsSync(resolved)) {
     return "missing";
   }
+  // `go version` stays a live probe: it answers which toolchain the effective
+  // environment selects (GOTOOLCHAIN, go.mod), which no file metadata shows.
   const version = spawnGoTool(goBinary, ["version"], {
     cwd,
     encoding: "utf8",
@@ -282,10 +312,27 @@ function computeGoCompilerIdentity(
     version.error !== undefined
       ? ((version.error as NodeJS.ErrnoException).code ?? version.error.message)
       : `${version.status ?? 0}:${version.stdout}${version.stderr}`;
-  const binaryHash = hashFile(resolved);
+  const binaryHash = hashExecutable(resolved, identities);
   return `sha256:${binaryHash}:${versionText}`;
 }
 
+/**
+ * The content digest of an executable, proven from its metadata in a process
+ * that has the record store (#1722) and read in full otherwise.
+ */
+function hashExecutable(
+  file: string,
+  identities: PluginContentIdentities.Store | undefined,
+): string {
+  return PluginContentIdentities.digest(
+    identities,
+    "executable",
+    file,
+    (references) => PluginContentIdentities.fileObservation(references, file),
+    () => hashFile(file),
+  );
+}
+
 function resolveExecutableIdentityPath(
   binary: string,
   env: NodeJS.ProcessEnv = process.env,
@@ -351,7 +398,8 @@ function hashGoBuildEnvironment(
   cwd: string,
   env: NodeJS.ProcessEnv,
   filesystem: SourceBuildFilesystemOperations,
-  witness?: PluginBuildEnvironmentWitness.Record,
+  witness: PluginBuildEnvironmentWitness.Record | undefined,
+  identities: PluginContentIdentities.Store | undefined,
 ): void {
   const values = resolveGoBuildEnvironment(
     goBinary,
@@ -359,6 +407,7 @@ function hashGoBuildEnvironment(
     env,
     filesystem,
     witness,
+    identities,
   );
   for (const key of GO_BUILD_ENV_KEYS) {
     const value = values.get(key);
@@ -373,11 +422,19 @@ function resolveGoBuildEnvironment(
   cwd: string,
   env: NodeJS.ProcessEnv,
   filesystem: SourceBuildFilesystemOperations,
-  witness?: PluginBuildEnvironmentWitness.Record,
+  witness: PluginBuildEnvironmentWitness.Record | undefined,
+  identities: PluginContentIdentities.Store | undefined,
 ): Map<string, string> {
   const values = new Map<string, string>();
   if (goBinary !== undefined) {
-    const parsed = readGoEnvironment(goBinary, cwd, env, witness);
+    const parsed = GoEnvironmentReading.read(
+      goBinary,
+      cwd,
+      env,
+      GO_BUILD_ENV_KEYS,
+      witness,
+      identities,
+    );
     if (parsed !== undefined) {
       try {
         for (const key of GO_BUILD_ENV_KEYS) {
@@ -385,7 +442,14 @@ function resolveGoBuildEnvironment(
           if (typeof raw === "string" && raw !== "") {
             values.set(
               key,
-              normalizeGoBuildEnvValue(key, raw, env, filesystem, witness),
+              normalizeGoBuildEnvValue(
+                key,
+                raw,
+                env,
+                filesystem,
+                witness,
+                identities,
+              ),
             );
           }
         }
@@ -401,94 +465,27 @@ function resolveGoBuildEnvironment(
     if (value !== undefined && value !== "") {
       values.set(
         key,
-        normalizeGoBuildEnvValue(key, value, env, filesystem, witness),
+        normalizeGoBuildEnvValue(
+          key,
+          value,
+          env,
+          filesystem,
+          witness,
+          identities,
+        ),
       );
     }
   }
   return values;
 }
 
-/**
- * The Go environment file each Go tool and environment was last seen to name,
- * which lets a reading witness that file before `go env` reads it.
- */
-const goEnvironmentFiles = new Map<string, string | null>();
-
-/**
- * Run `go env -json` for the build keys and `GOENV`, the file `go env -w`
- * writes, witnessing that file before the run reads it.
- *
- * The file decides the reading without being part of it, so only its metadata
- * is kept, and it must be taken before the read: metadata taken after would
- * describe an edit that landed between the two, and a reading of the old
- * content would pass as proven. Which file `go env` reads is known only from
- * its answer, so the file this Go tool and environment named last is witnessed
- * first, and a reading that names another is taken again with that one
- * witnessed. A file that keeps moving between runs leaves the reading
- * unwitnessable, so a kept reading or a build keyed on it never holds.
- *
- * @returns The parsed answer, or `undefined` when `go env` failed.
- */
-function readGoEnvironment(
-  goBinary: string,
-  cwd: string,
-  env: NodeJS.ProcessEnv,
-  witness: PluginBuildEnvironmentWitness.Record | undefined,
-): Record<string, unknown> | undefined {
-  const memo = crypto.createHash("sha256").update(goBinary);
-  for (const [key, value] of Object.entries(env).sort(([left], [right]) =>
-    left < right ? -1 : left > right ? 1 : 0,
-  )) {
-    if (value !== undefined)
-      memo.update(`\0${key.length}:${key}${value.length}:${value}`);
-  }
-  const memoKey = memo.digest("hex");
-  let named = goEnvironmentFiles.get(memoKey);
-  for (let attempt = 0; attempt < 3; attempt += 1) {
-    if (named !== undefined && named !== null)
-      PluginBuildEnvironmentWitness.add(witness, named);
-    const result = spawnGoTool(
-      goBinary,
-      ["env", "-json", ...GO_BUILD_ENV_KEYS, "GOENV"],
-      {
-        cwd,
-        encoding: "utf8",
-        env: GoSourceInputs.goBuildEnv(goBinary, undefined, env),
-        windowsHide: true,
-      },
-    );
-    if (result.error !== undefined || result.status !== 0) return undefined;
-    let parsed: Record<string, unknown>;
-    try {
-      parsed = JSON.parse(result.stdout) as Record<string, unknown>;
-    } catch {
-      return undefined;
-    }
-    const reported =
-      typeof parsed.GOENV === "string" &&
-      parsed.GOENV !== "" &&
-      parsed.GOENV !== "off"
-        ? parsed.GOENV
-        : null;
-    if (reported === named) return parsed;
-    if (named !== undefined && named !== null) witness?.delete(named);
-    named = reported;
-    goEnvironmentFiles.set(memoKey, named);
-    // No file to witness: the reading depends on none.
-    if (named === null) return parsed;
-    if (witness === undefined) return parsed;
-  }
-  if (named !== undefined && named !== null)
-    PluginBuildEnvironmentWitness.refuse(witness, named);
-  return undefined;
-}
-
 function normalizeGoBuildEnvValue(
   key: string,
   value: string,
   env: NodeJS.ProcessEnv,
   filesystem: SourceBuildFilesystemOperations,
-  witness?: PluginBuildEnvironmentWitness.Record,
+  witness: PluginBuildEnvironmentWitness.Record | undefined,
+  identities: PluginContentIdentities.Store | undefined,
 ): string {
   if (key === "GOROOT") {
     // Root/version observations also cover a missing SDK. The complete SDK
@@ -496,10 +493,15 @@ function normalizeGoBuildEnvValue(
     // nested content changes that do not move the root or VERSION metadata.
     PluginBuildEnvironmentWitness.add(witness, value);
     PluginBuildEnvironmentWitness.add(witness, path.join(value, "VERSION"));
-    return resolveGoRootCacheIdentity(value, filesystem, witness);
+    return resolveGoRootCacheIdentity(value, filesystem, witness, identities);
   }
   if (GO_BUILD_COMMAND_ENV_KEYS.has(key)) {
-    return `${value}\0${resolveCommandCacheIdentity(value, env, witness)}`;
+    return `${value}\0${resolveCommandCacheIdentity(
+      value,
+      env,
+      witness,
+      identities,
+    )}`;
   }
   return value;
 }
@@ -519,7 +521,8 @@ function normalizeGoBuildEnvValue(
 function resolveCommandCacheIdentity(
   command: string,
   env: NodeJS.ProcessEnv,
-  witness?: PluginBuildEnvironmentWitness.Record,
+  witness: PluginBuildEnvironmentWitness.Record | undefined,
+  identities: PluginContentIdentities.Store | undefined,
 ): string {
   const tokens = splitGoCommand(command);
   if (tokens === null) {
@@ -541,7 +544,7 @@ function resolveCommandCacheIdentity(
   }
   let identity: string;
   try {
-    identity = `command:sha256:${hashFile(resolved)}`;
+    identity = `command:sha256:${hashExecutable(resolved, identities)}`;
   } catch {
     return `command:unreadable:${resolved}`;
   }
@@ -555,7 +558,7 @@ function resolveCommandCacheIdentity(
     if (!GoToolResolution.isExecutableFile(operand)) return;
     PluginBuildEnvironmentWitness.add(witness, operand);
     try {
-      identity += `;${index + 1}:sha256:${hashFile(operand)}`;
+      identity += `;${index + 1}:sha256:${hashExecutable(operand, identities)}`;
     } catch {
       identity += `;${index + 1}:unreadable:${operand}`;
     }
@@ -612,6 +615,9 @@ interface GoRootIdentitySnapshot {
   files: string[];
   topology: string[];
   signature: string;
+
+  /** Whether every file stamp precedes its device's minted reference. */
+  separable: boolean;
 }
 
 interface GoRootIdentityCacheEntry {
@@ -622,19 +628,31 @@ interface GoRootIdentityCacheEntry {
 // GOROOT is usually stable but its selected source/tool payloads contribute to
 // every plugin key. Retain only the final aggregate
 // identity, guarded by a fresh metadata/topology manifest on every call. A
-// changed or incomplete manifest falls through to a full content read.
+// changed or incomplete manifest falls through to the record store, then to a
+// full content read.
+//
+// WARNING (#1186, #1722): this map lives only as long as the process. #1186
+// stopped at it, so every CLI launch, worker and bundler restart still read the
+// whole SDK (3,723 files, 135 MB for the bundled toolchain). The record store
+// below is what carries the identity across processes; never drop it in favor
+// of this memo alone.
 const goRootIdentityCache = new Map<string, GoRootIdentityCacheEntry>();
 
 function resolveGoRootCacheIdentity(
   goRoot: string,
   filesystem: SourceBuildFilesystemOperations,
-  witness?: PluginBuildEnvironmentWitness.Record,
+  witness: PluginBuildEnvironmentWitness.Record | undefined,
+  identities: PluginContentIdentities.Store | undefined,
 ): string {
   const resolved = resolveRealPath(goRoot);
   if (!fs.existsSync(resolved)) {
     return `missing:${goRoot}`;
   }
-  const snapshot = collectGoRootIdentitySnapshot(resolved, witness);
+  const snapshot = collectGoRootIdentitySnapshot(
+    resolved,
+    witness,
+    identities?.references,
+  );
   if (!snapshot.complete)
     PluginBuildEnvironmentWitness.refuse(witness, resolved);
   if (snapshot.complete) {
@@ -643,15 +661,37 @@ function resolveGoRootCacheIdentity(
       return cached.identity;
     }
   }
-  const hash = crypto.createHash("sha256");
-  hash.update(JSON.stringify(snapshot.topology));
-  for (const file of snapshot.files) {
-    const relative = path.relative(resolved, file).split(path.sep).join("/");
-    const contents = filesystem.readFile(file);
-    hash.update(JSON.stringify([relative, contents.length]));
-    hash.update(contents);
-  }
-  const identity = `sha256:${hash.digest("hex")}`;
+  // The first observation is the snapshot the witness just recorded; a second
+  // one, after the content read, brackets that read for publication.
+  let observed = 0;
+  const identity = PluginContentIdentities.digest(
+    snapshot.complete ? identities : undefined,
+    "goroot",
+    resolved,
+    (references) => {
+      const current =
+        observed++ === 0
+          ? snapshot
+          : collectGoRootIdentitySnapshot(resolved, undefined, references);
+      return current.complete
+        ? { separable: current.separable, signature: current.signature }
+        : undefined;
+    },
+    () => {
+      const hash = crypto.createHash("sha256");
+      hash.update(JSON.stringify(snapshot.topology));
+      for (const file of snapshot.files) {
+        const relative = path
+          .relative(resolved, file)
+          .split(path.sep)
+          .join("/");
+        const contents = filesystem.readFile(file);
+        hash.update(JSON.stringify([relative, contents.length]));
+        hash.update(contents);
+      }
+      return `sha256:${hash.digest("hex")}`;
+    },
+  );
   if (snapshot.complete) {
     goRootIdentityCache.set(resolved, {
       identity,
@@ -664,9 +704,10 @@ function resolveGoRootCacheIdentity(
 function collectGoRootIdentitySnapshot(
   root: string,
   witness?: PluginBuildEnvironmentWitness.Record,
+  references?: ReadonlyMap<bigint, bigint>,
 ): GoRootIdentitySnapshot {
   const out: string[] = [];
-  const state = { complete: true };
+  const state = { complete: true, separable: references !== undefined };
   const topology: string[] = [];
   walkGoRootIdentity(root, out, topology, state, witness);
   out.sort();
@@ -681,6 +722,11 @@ function collectGoRootIdentitySnapshot(
         state.complete = false;
         continue;
       }
+      if (
+        references === undefined ||
+        !PluginContentIdentities.separable(references, stats)
+      )
+        state.separable = false;
       signature.update(
         [
           relative,
@@ -702,6 +748,7 @@ function collectGoRootIdentitySnapshot(
     files: out,
     topology,
     signature: signature.digest("hex"),
+    separable: state.separable,
   };
 }
 

package/src/plugin/internal/source/pluginBuildEnvironment.ts

@@ -3,6 +3,7 @@ import fs from "node:fs";
 
 import { GoToolResolution } from "./GoToolResolution";
 import type { PluginBuildEnvironmentWitness } from "./PluginBuildEnvironmentWitness";
+import type { PluginContentIdentities } from "./PluginContentIdentities";
 import { hashPluginBuildEnvironment } from "./hashPluginBuildEnvironment";
 import { resolveGoCompiler } from "./resolveGoCompiler";
 
@@ -19,12 +20,16 @@ import { resolveGoCompiler } from "./resolveGoCompiler";
  * GOROOT metadata. Witnessing a newly selected environment file can repeat the
  * probe to observe it before reading. Compiler identity reuses a
  * metadata-and-context memo; a changed SDK manifest rehashes all contributing
- * content rather than only edited files.
+ * content rather than only edited files. A supplied record store lets a new
+ * process take the SDK and executable digests from records instead of their
+ * bytes, while `go env` and `go version` still run.
  *
  * @param directory The directory a build runs `go` in.
  * @param env The effective environment, `process.env` by default.
  * @param witness Receives the paths the reading depends on and no variable
  *   carries (`hashPluginBuildEnvironment`).
+ * @param identities Record store that lets a new process prove the SDK and
+ *   executables from metadata (#1722).
  * @evidence contracts/common.md#principled-implementation The digest uses the same resolved compiler and environment serializer as the binary key, so reported toolchain state denotes the inputs actually used by the build.
  * @evidence contracts/common.md#clear-and-simple-design Compiler selection, executable resolution and hashing each stay with their owning helper; this function only composes one environment reading.
  * @evidence contracts/common.md#prohibited-implementation-shortcuts The result comes from real Go/environment inputs, not a fixed compiler version or a caller-specific substitute.
@@ -32,13 +37,14 @@ import { resolveGoCompiler } from "./resolveGoCompiler";
  * @evidence contracts/portability.md#os-neutral-implementation Executable identity is resolved before probing, and Node filesystem/process boundaries implement native spelling rather than assuming Windows or POSIX paths are interchangeable.
  * @evidence contracts/performance.md#efficient-algorithms The wrapper resolves the compiler/tool under the supplied environment before delegating full environment hashing. Native resolution/probes, SDK metadata/name/path sorting and changed-manifest full content reads contribute cost; the final hash output is fixed-width but streamed identity/input text and full-file buffers are not. No independent duplicate source-directory digest scan is added here.
  *
- * @evidenceExclude contracts/performance.md#reuse-equivalent-work This is the fresh-reading boundary required by builds; processPluginBuildEnvironment owns reuse when a consumer permits it.
+ * @evidence contracts/performance.md#reuse-equivalent-work This is the fresh-reading boundary required by builds: the Go probes run on every call. Content digests of the SDK and executables are shared across processes only through the supplied record store's separable-signature proof; processPluginBuildEnvironment owns reuse of the whole reading when a consumer permits it.
  * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources Its digest and filesystem adapter are call-local; retained compiler/content memo ownership belongs to the hasher.
  */
 export function pluginBuildEnvironment(
   directory: string,
   env: NodeJS.ProcessEnv = process.env,
   witness?: PluginBuildEnvironmentWitness.Record,
+  identities?: PluginContentIdentities.Store,
 ): string {
   const goBinary = GoToolResolution.resolveGoToolForBuild(
     resolveGoCompiler(env).binary,
@@ -54,6 +60,7 @@ export function pluginBuildEnvironment(
     env,
     { readFile: (location) => fs.readFileSync(location) },
     witness,
+    identities,
   );
   return hash.digest("hex");
 }

package/src/plugin/internal/source/pluginBuildEnvironmentWorker.ts

@@ -2,24 +2,40 @@ import { parentPort } from "node:worker_threads";
 
 import { serializeCompilerError } from "../../../internal/serializeCompilerError";
 import { PluginBuildEnvironmentWitness } from "./PluginBuildEnvironmentWitness";
+import { PluginContentIdentities } from "./PluginContentIdentities";
 import { pluginBuildEnvironment } from "./pluginBuildEnvironment";
 
 /**
  * Observe one requested native toolchain environment on the exclusive worker.
  * Explicit environment values reach every Go/toolchain reader; no caller
  * process globals are written. Only actual readings and pre-read witnesses
- * cross the worker boundary, and failures retain their real error details.
+ * cross the worker boundary, and failures retain their real error details. A
+ * request that names its project lets this isolate prove the SDK and the
+ * executables from the plugin cache's records instead of their bytes (#1722).
  */
 parentPort?.on(
   "message",
-  (request: { directory: string; env: NodeJS.ProcessEnv }) => {
+  (request: {
+    directory: string;
+    env: NodeJS.ProcessEnv;
+    projectRoot?: string;
+  }) => {
     try {
       const witness: PluginBuildEnvironmentWitness.Record = new Map();
+      const identities =
+        request.projectRoot === undefined
+          ? undefined
+          : PluginContentIdentities.open({
+              projectRoot: request.projectRoot,
+              env: request.env,
+              sources: [request.directory],
+            });
       parentPort!.postMessage({
         environment: pluginBuildEnvironment(
           request.directory,
           request.env,
           witness,
+          identities,
         ),
         witness,
       });

package/src/plugin/internal/source/pluginBuildVersions.ts

@@ -2,6 +2,8 @@ import fs from "node:fs";
 import { createRequire } from "node:module";
 import path from "node:path";
 
+import { ttscPackageVersion } from "./ttscPackageVersion";
+
 /**
  * Package-version labels used by plugin build keys (`computeCacheKey`) and
  * persisted transform identities. These are metadata inputs, not a measurement
@@ -21,42 +23,19 @@ import path from "node:path";
  * @param projectRoot The project base used to resolve
  *   `typescript/package.json`.
  * @evidence contracts/common.md#principled-implementation Package-version labels supply the same metadata tuple used by plugin keys; absent/unreadable metadata receives the documented unknown/default label rather than an executable identity certificate.
- * @evidence contracts/common.md#clear-and-simple-design Host-version and project-version readers are separate because one installation is stable within the process while project resolution varies per call.
+ * @evidence contracts/common.md#clear-and-simple-design The host label comes from its own owner (`ttscPackageVersion`), which a reader needing only that label calls without this function's project resolution; the project-version reader is separate because project resolution varies per call.
  * @evidence contracts/common.md#prohibited-implementation-shortcuts Node package resolution determines the actual project dependency; no particular project or fixture version is embedded.
  * @evidence contracts/common.md#meaningful-documentation Native prose explains persisted-output consumers, metadata fallbacks and the process-stable host premise without claiming that version labels establish executable or output equivalence.
  * @evidence contracts/portability.md#os-neutral-implementation Node createRequire and path APIs locate package metadata using native module resolution without manual separator or case normalization.
  * @evidence contracts/performance.md#efficient-algorithms Each call performs project package resolution and, when successful, reads/parses its manifest bytes; module search/path work and metadata size are not fixed by one logical manifest lookup. The host manifest is attempted only on the first invocation, including native path and JSON costs.
  * @evidence contracts/performance.md#reuse-equivalent-work All callers share the host installation's process-stable version; the project compiler version is resolved afresh so different project roots do not share a false identity.
- * @evidence contracts/performance.md#bound-retention-and-release-resources This helper retains one host-version label for the process lifetime, whose text follows its manifest value rather than a fixed byte limit; the helper's retained label count is independent of project count. Native module-resolution caches belong to Node, and synchronous file reads leave no persistent descriptor here.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources The host-version owner retains one label for the process lifetime, whose text follows its manifest value rather than a fixed byte limit; the retained label count is independent of project count. Native module-resolution caches belong to Node, and synchronous file reads leave no persistent descriptor here.
  */
 export function pluginBuildVersions(projectRoot: string): {
   tsgo: string;
   ttsc: string;
 } {
-  return { tsgo: readTsgoVersion(projectRoot), ttsc: readTtscVersion() };
-}
-
-let cachedTtscVersion: string | null = null;
-
-function readTtscVersion(): string {
-  if (cachedTtscVersion !== null) return cachedTtscVersion;
-  try {
-    const file = path.resolve(
-      __dirname,
-      "..",
-      "..",
-      "..",
-      "..",
-      "package.json",
-    );
-    const pkg = JSON.parse(fs.readFileSync(file, "utf8")) as {
-      version?: string;
-    };
-    cachedTtscVersion = pkg.version ?? "0.0.0";
-  } catch {
-    cachedTtscVersion = "0.0.0";
-  }
-  return cachedTtscVersion;
+  return { tsgo: readTsgoVersion(projectRoot), ttsc: ttscPackageVersion() };
 }
 
 function readTsgoVersion(projectRoot: string): string {