ttsc 0.31.1 → 0.31.2

package/src/plugin/internal/source/PluginLoadAnswers.ts

@@ -0,0 +1,151 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+
+import { E2ETrace } from "../../../internal/E2ETrace";
+import type { PluginContentIdentities } from "./PluginContentIdentities";
+import { SourceBuildCacheLayout } from "./SourceBuildCacheLayout";
+import { recordCacheFileUse } from "./recordCacheFileUse";
+
+/**
+ * Answers a plugin load computed from inputs it could identify by content, kept
+ * in the plugin cache root under that identity so a later process with equal
+ * inputs reads the answer instead of computing it again.
+ *
+ * WARNING (#1721, #1723): the key is the whole proof. A caller must fold into
+ * `identity` every input that can change the answer, as content identities
+ * (`PluginContentIdentities`) or the authoritative live probe results, never a
+ * path, a timestamp or a value it merely expects to be stable. An answer is
+ * written only after the computation succeeded on inputs the caller proved
+ * unchanged around it; a failed or unproved computation is never recorded,
+ * since a later process could not tell it from a current one.
+ *
+ * Entries are single files published by rename, aged out by the single-file
+ * collector and removed by `ttsc clean`. Their identity includes the format tag
+ * and the ttsc version, so another release never reads them.
+ *
+ * @evidence contracts/common.md#principled-implementation The content-addressed key carries every caller-declared input identity; reads accept only a matching format, version and kind, and writes are refused for unproved computations by the caller contract.
+ * @evidence contracts/common.md#clear-and-simple-design One owner stores and loads opaque answers; callers own key composition, validation of the answer shape and the decision to record.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts No answer is guessed; a missing, corrupt or foreign entry is a miss and the caller computes.
+ * @evidence contracts/common.md#meaningful-documentation Native paragraphs state the key contract that prevents stale answers, the recording rule and the storage lifetime.
+ * @evidence contracts/portability.md#os-neutral-implementation Native path joins and same-directory rename publication; keys are hashed text, independent of path dialect.
+ * @evidenceExclude contracts/performance.md#efficient-algorithms Members state their own costs.
+ * @evidenceExclude contracts/performance.md#reuse-equivalent-work Members define reuse through the caller's identity.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources Members state retention; the namespace holds no state.
+ */
+export namespace PluginLoadAnswers {
+  /**
+   * The answer recorded for `identity`, or `undefined` when none is.
+   *
+   * @param store The opened store, or `undefined` for no persistence.
+   * @param kind Answer family; families never share entries.
+   * @param identity Every input identity the answer depends on.
+   * @evidence contracts/common.md#principled-implementation An entry is returned only for the same format, version, kind and identity hash; the caller validates the value's shape.
+   * @evidence contracts/common.md#clear-and-simple-design One lookup returns an opaque value or undefined.
+   * @evidence contracts/common.md#prohibited-implementation-shortcuts Unreadable or foreign entries are misses.
+   * @evidence contracts/common.md#meaningful-documentation Parameters describe the identity contract.
+   * @evidence contracts/portability.md#os-neutral-implementation Native path join and file read.
+   * @evidence contracts/performance.md#efficient-algorithms Hashes the serialized identity and reads one small file; a hit refreshes its use time.
+   * @evidence contracts/performance.md#reuse-equivalent-work Processes share an answer only for an identical serialized identity under the same version.
+   * @evidence contracts/performance.md#bound-retention-and-release-resources Nothing is retained in memory; the collector owns entry lifetime.
+   */
+  export function read(
+    store: PluginContentIdentities.Store | undefined,
+    kind: string,
+    identity: unknown,
+  ): unknown {
+    if (store === undefined) return undefined;
+    const file = answerFile(store, kind, identity);
+    try {
+      const entry = JSON.parse(
+        fs.readFileSync(file, "utf8"),
+      ) as Partial<IEntry>;
+      if (
+        entry.format !== FORMAT ||
+        entry.version !== store.version ||
+        entry.kind !== kind ||
+        !Object.prototype.hasOwnProperty.call(entry, "value")
+      )
+        return undefined;
+      recordCacheFileUse(file);
+      E2ETrace.capabilityResolution("plugin-load-answer", {
+        kind,
+        outcome: "reused",
+      });
+      return entry.value;
+    } catch {
+      return undefined;
+    }
+  }
+
+  /**
+   * Record `value` as the answer for `identity`. Failures are ignored: the
+   * answer just computed stands, and the next process computes it again.
+   *
+   * @param store The opened store, or `undefined` for no persistence.
+   * @param kind Answer family.
+   * @param identity Every input identity the answer depends on.
+   * @param value JSON-serializable answer the caller proved for `identity`.
+   * @evidence contracts/common.md#principled-implementation Publication happens only when the caller decided the computation was proven; the entry records the same identity framing that read checks.
+   * @evidence contracts/common.md#clear-and-simple-design One atomic publication through the shared metadata writer.
+   * @evidence contracts/common.md#prohibited-implementation-shortcuts A failed write never fails the load or fabricates an entry.
+   * @evidence contracts/common.md#meaningful-documentation Native prose states failure behavior.
+   * @evidence contracts/portability.md#os-neutral-implementation Same-directory staging and rename through the shared writer.
+   * @evidence contracts/performance.md#efficient-algorithms Serializes the identity and value once and writes one small file.
+   * @evidenceExclude contracts/performance.md#reuse-equivalent-work Publication creates the reusable entry; read owns reuse.
+   * @evidence contracts/performance.md#bound-retention-and-release-resources One file per identity, removed by the single-file collector or `ttsc clean`; staging cleanup belongs to the shared writer.
+   */
+  export function write(
+    store: PluginContentIdentities.Store | undefined,
+    kind: string,
+    identity: unknown,
+    value: unknown,
+  ): void {
+    if (store === undefined) return;
+    const file = answerFile(store, kind, identity);
+    try {
+      fs.mkdirSync(path.dirname(file), { recursive: true });
+      SourceBuildCacheLayout.replaceCacheMetadataFile(
+        file,
+        JSON.stringify({
+          format: FORMAT,
+          version: store.version,
+          kind,
+          value,
+        } satisfies IEntry),
+      );
+      E2ETrace.capabilityResolution("plugin-load-answer", {
+        kind,
+        outcome: "recorded",
+      });
+    } catch {
+      // The answer just computed stands; only its reuse is lost.
+    }
+  }
+
+  /** Entry format tag; move it when the entry shape changes. */
+  const FORMAT = "ttsc-plugin-load-answer-v1";
+
+  interface IEntry {
+    format: string;
+    version: string;
+    kind: string;
+    value: unknown;
+  }
+
+  function answerFile(
+    store: PluginContentIdentities.Store,
+    kind: string,
+    identity: unknown,
+  ): string {
+    const key = crypto
+      .createHash("sha256")
+      .update(JSON.stringify([FORMAT, store.version, kind, identity]))
+      .digest("hex");
+    return path.join(
+      store.root,
+      SourceBuildCacheLayout.ANSWER_CACHE_DIRNAME,
+      `${key}.json`,
+    );
+  }
+}

package/src/plugin/internal/source/SourceBuildCacheLayout.ts

@@ -53,6 +53,18 @@ export namespace SourceBuildCacheLayout {
   /** Directory of the capability-resolution answers inside the cache root. */
   export const CAPABILITY_CACHE_DIRNAME = "capabilities";
 
+  /**
+   * Directory of the content identities a plugin load proves from metadata
+   * (`PluginContentIdentities`) inside the cache root.
+   */
+  export const IDENTITY_CACHE_DIRNAME = "identities";
+
+  /**
+   * Directory of the plugin-load answers keyed by those identities, such as Go
+   * package selections and runtime capabilities (`PluginLoadAnswers`).
+   */
+  export const ANSWER_CACHE_DIRNAME = "answers";
+
   /** Directory of the ttsx runtime inside the cache root. */
   export const RUNTIME_CACHE_DIRNAME = "ttsx";
 
@@ -72,6 +84,8 @@ export namespace SourceBuildCacheLayout {
   export const CACHE_FILE_DIRNAMES: readonly string[] = [
     DESCRIPTOR_CACHE_DIRNAME,
     CAPABILITY_CACHE_DIRNAME,
+    IDENTITY_CACHE_DIRNAME,
+    ANSWER_CACHE_DIRNAME,
     ORPHAN_CACHE_DIRNAME,
   ];
 

package/src/plugin/internal/source/SourcePluginWorkspace.ts

@@ -6,6 +6,7 @@ import { OwnedSynchronousProcess } from "../../../internal/OwnedSynchronousProce
 import { GoEnvironmentReading } from "./GoEnvironmentReading";
 import { GoSourceInputs } from "./GoSourceInputs";
 import { PluginBuildEnvironmentWitness } from "./PluginBuildEnvironmentWitness";
+import type { PluginContentIdentities } from "./PluginContentIdentities";
 import { SourcePluginAdmission } from "./SourcePluginAdmission";
 import { copiesPluginSourceEntry } from "./copiesPluginSourceEntry";
 import { formatGoWorkPath } from "./formatGoWorkPath";
@@ -238,7 +239,9 @@ export namespace SourcePluginWorkspace {
    * registry shares native reader state from the first watch query onward; its
    * owner must keep one fixed effective environment and discard it on retry.
    * Caller views share that native state and syntax, while each default
-   * diagnostic label remains with its current caller.
+   * diagnostic label remains with its current caller. An optional record store
+   * only carries the Go environment-file discovery hint across processes; it
+   * never carries a parse.
    *
    * @evidence contracts/common.md#principled-implementation Actual go mod edit JSON determines module/replacement identities; current bytes, selected/dispatched-tool metadata and Go's environment-file witness qualify reuse under the existing metadata-distinguishability premise. Environment values are copied at reader creation. Missing go.mod returns the existing empty module observation, and moving tool/manifest inputs cannot publish a parsed record.
    * @evidence contracts/common.md#clear-and-simple-design One factory acquires load-owned native reader state by selected tool; a thin caller view forwards its diagnostic label without duplicating the byte-content map. Current reads and post-parse byte/tool comparisons qualify insertion.
@@ -254,6 +257,7 @@ export namespace SourcePluginWorkspace {
     pluginName: string,
     env: NodeJS.ProcessEnv,
     readers?: Map<string, GoModReader>,
+    identities?: PluginContentIdentities.Store,
   ): GoModReader {
     const existing = readers?.get(goBinary);
     if (existing !== undefined)
@@ -315,6 +319,7 @@ export namespace SourcePluginWorkspace {
                   environment,
                   ["GOROOT"],
                   witness,
+                  identities,
                 )
               : undefined;
           if (

package/src/plugin/internal/source/buildSourcePlugin.ts

@@ -18,6 +18,7 @@ import { PluginBinaryUse } from "./PluginBinaryUse";
 import { PluginBuildEnvironmentWitness } from "./PluginBuildEnvironmentWitness";
 import type { PluginBuildLockLease } from "./PluginBuildLockLease";
 import { PluginBuildLockProtocol } from "./PluginBuildLockProtocol";
+import { PluginContentIdentities } from "./PluginContentIdentities";
 import { SourceBuildCacheLayout } from "./SourceBuildCacheLayout";
 import type { SourceBuildFilesystemOperations } from "./SourceBuildFilesystemOperations";
 import { SourcePluginAdmission } from "./SourcePluginAdmission";
@@ -88,8 +89,8 @@ import { withGoBuildCacheLease } from "./withGoBuildCacheLease";
  * @evidence contracts/common.md#prohibited-implementation-shortcuts A changed witness is never overwritten or accepted. A fresh epoch takes a new toolchain reading and performs the actual build or qualified adoption; source, native and cleanup failures stay terminal. No selected SDK tool is warmed by a special command, and no foreign environment or memo is rebased. Shared Go objects retain their owner's toolID/actionID contract; same-version custom tool semantics beyond that contract are not newly guaranteed.
  * @evidence contracts/common.md#meaningful-documentation Native paragraphs explain effective environment, recorded-input comparisons and their trust/observation limits, reader registration and managed versus explicit roots; option-map comments state their reading provenance with blank member separation.
  * @evidence contracts/portability.md#os-neutral-implementation Node path/physical-cache/temp APIs preserve native identities; executable resolution and Windows command handling are isolated owners, and the binary filename explicitly follows its executable platform.
- * @evidence contracts/performance.md#efficient-algorithms At most three epochs redo native toolchain observation, key construction, materialization and guarded admission; each can run one Go build, preceded by one batched package metadata command when the loader requires ownership admission. The shared compiler reader can itself make three version observations, hence at most nine such cold observations for a persistently moving compiler and no build when its key witness fails. Full-file bytes, entries, path/sort text, contributors, external trees and witness populations drive work. Scoped cancellation is sampled between phases/entries/commands and does not bound native calls or delegated hashing. First source digest readings are reused across epochs, while each scratch is independently checked. Existing lock contention has its separate wait budget and native Go compiler work remains delegated.
- * @evidence contracts/performance.md#reuse-equivalent-work Existing binaries and concurrent builders share the version/platform/source/environment key with reader admission before return, assuming trustworthy cache producers and supplied digest maps. Fixed trimpath compilation removes disposable snapshot paths from Go object identities. Shared load readings and sequential source/toolchain comparisons reject observed changes; metadata reuse and unobserved concurrent mutation remain the underlying witnesses' limits.
+ * @evidence contracts/performance.md#efficient-algorithms At most three epochs redo native toolchain observation, key construction, materialization and guarded admission; the first can key on the load's witnessed same-directory reading instead of observing the toolchain again, and later ones always observe it. Each can run one Go build, preceded by one batched package metadata command when the loader requires ownership admission. The shared compiler reader can itself make three version observations, hence at most nine such cold observations for a persistently moving compiler and no build when its key witness fails. Full-file bytes, entries, path/sort text, contributors, external trees and witness populations drive work. Scoped cancellation is sampled between phases/entries/commands and does not bound native calls or delegated hashing. First source digest readings are reused across epochs, while each scratch is independently checked. Existing lock contention has its separate wait budget and native Go compiler work remains delegated.
+ * @evidence contracts/performance.md#reuse-equivalent-work Existing binaries and concurrent builders share the version/platform/source/environment key with reader admission before return, assuming trustworthy cache producers and supplied digest maps. The key's content digests come from the record store when their separable metadata still matches, so a new process does not read unchanged sources, SDK or compiler bytes to find an existing binary (#1722). Fixed trimpath compilation removes disposable snapshot paths from Go object identities. Shared load readings and sequential source/toolchain comparisons reject observed changes; metadata reuse and unobserved concurrent mutation remain the underlying witnesses' limits.
  * @evidence contracts/performance.md#bound-retention-and-release-resources Scratch directories and build/cache leases have finally-based cleanup, including cancellation; cancelled work admits no new post-build prune pass. Scratch removal or lease cleanup can fail, and selected synchronous child settlement does not join arbitrary descendants. Repeated commands can repeat external tool effects; only ttsc-owned failed outputs are discarded, and Go-owned object entries retain their existing lifetime. Pending binary cleanup is best-effort. Reader tokens and their process map grow with distinct physical keys until process exit. Managed pruning attempts age/LRU reclamation while protecting live, unknown and selected entries, so it is not a hard disk bound; explicit roots remain caller-managed.
  */
 export function buildSourcePlugin(opts: {
@@ -113,7 +114,21 @@ export function buildSourcePlugin(opts: {
    */
   environmentDigests?: Map<string, string>;
 
+  /**
+   * Witnesses of the readings in `environmentDigests` (`computeCacheKey`), so
+   * the first epoch keys on a reading package selection already took. A
+   * discarded epoch reads the toolchain again instead.
+   */
+  environmentWitnesses?: Map<string, PluginBuildEnvironmentWitness.Record>;
+
   filesystem?: Partial<SourceBuildFilesystemOperations>;
+
+  /**
+   * Record store the loader opened for this load, so its key reuses content
+   * identities across processes (#1722); a standalone build opens its own.
+   */
+  identities?: PluginContentIdentities.Store;
+
   label?: string;
   overlayDirs?: readonly string[];
   quiet?: boolean;
@@ -140,9 +155,17 @@ export function buildSourcePlugin(opts: {
   for (let attempt = 0; ; attempt += 1) {
     OwnedSynchronousProcess.checkpoint();
     const environmentDigests = new Map(opts.environmentDigests);
+    // Only the first epoch may key on a reading taken before it; a discarded
+    // epoch means the toolchain moved, so later ones read it again.
+    const environmentWitnesses =
+      opts.environmentWitnesses === undefined
+        ? undefined
+        : new Map(attempt === 0 ? opts.environmentWitnesses : []);
     try {
       const binary = buildSourcePluginAttempt(
-        attempt === 0 ? opts : { ...opts, goModReaders: undefined },
+        attempt === 0
+          ? { ...opts, environmentWitnesses }
+          : { ...opts, environmentWitnesses, goModReaders: undefined },
         env,
         sourceDigests,
         environmentDigests,
@@ -152,6 +175,8 @@ export function buildSourcePlugin(opts: {
         opts.sourceDigests?.set(directory, digest);
       for (const [directory, digest] of environmentDigests)
         opts.environmentDigests?.set(directory, digest);
+      for (const [directory, witness] of environmentWitnesses ?? [])
+        opts.environmentWitnesses?.set(directory, witness);
       return binary;
     } catch (error) {
       if (
@@ -192,6 +217,18 @@ function buildSourcePluginAttempt(
   );
   ensureExecutableGoToolchain(goBinary, compiler.bundled);
   OwnedSynchronousProcess.checkpoint();
+  const identities =
+    opts.identities ??
+    PluginContentIdentities.open({
+      projectRoot: opts.baseDir,
+      cacheDir: opts.cacheDir,
+      env,
+      sources: [
+        dir,
+        ...overlayDirs,
+        ...contributors.map((contributor) => contributor.source),
+      ],
+    });
   // The digest of every directory the key covers, as the key read it, which
   // the build proves against what it compiled.
   const goModReader = SourcePluginWorkspace.createGoModReader(
@@ -199,6 +236,7 @@ function buildSourcePluginAttempt(
     opts.pluginName,
     env,
     opts.goModReaders,
+    identities,
   );
   const environmentWitness: PluginBuildEnvironmentWitness.Record = new Map();
   const key = computeCacheKey({
@@ -211,8 +249,10 @@ function buildSourcePluginAttempt(
     goModReader,
     filesystem: opts.filesystem,
     goBinary,
+    identities,
     overlayDirs,
     environmentDigests,
+    environmentWitnesses: opts.environmentWitnesses,
     sourceDigests,
     ttscVersion: opts.ttscVersion,
     tsgoVersion: opts.tsgoVersion,

package/src/plugin/internal/source/computeCacheKey.ts

@@ -5,11 +5,11 @@ import path from "node:path";
 import { GoToolResolution } from "./GoToolResolution";
 import type { ITtscBuildContributor } from "./ITtscBuildContributor";
 import type { PluginBuildEnvironmentWitness } from "./PluginBuildEnvironmentWitness";
+import { PluginContentIdentities } from "./PluginContentIdentities";
 import type { SourceBuildFilesystemOperations } from "./SourceBuildFilesystemOperations";
 import type { SourcePluginWorkspace } from "./SourcePluginWorkspace";
 import { hashPluginBuildEnvironment } from "./hashPluginBuildEnvironment";
 import { pluginModuleReplaceDirectories } from "./pluginModuleReplaceDirectories";
-import { pluginSourceDigest } from "./pluginSourceDigest";
 
 /**
  * Compute a 32-character lowercase key from a plugin build's SHA-256 digest.
@@ -30,10 +30,12 @@ import { pluginSourceDigest } from "./pluginSourceDigest";
  * values are trusted producer readings, not revalidated content observations.
  * `sourceDigests` carries the digests one load already took: every build of the
  * load keys on one reading of each directory, and the load reports those
- * readings. The environment enters through `hashPluginBuildEnvironment`, the
- * rule that reported state takes it from too, and `environmentDigests` carries
- * the digest of each build directory's, so the load reports it without a second
- * `go env` run.
+ * readings. The environment enters as the digest of
+ * `hashPluginBuildEnvironment`, the rule that reported state takes it from too,
+ * and `environmentDigests` carries the digest of each build directory's, so the
+ * load reports it without a second `go env` run. With `environmentWitnesses`, a
+ * reading the load already took for the same directory, such as package
+ * selection's, keys the build too, and its witness joins the build's.
  *
  * The `ttsc cache` CLI and plugin build pipeline share this key computation.
  *
@@ -43,7 +45,7 @@ import { pluginSourceDigest } from "./pluginSourceDigest";
  * @evidence contracts/common.md#meaningful-documentation Native paragraphs explain input coverage and the provenance of reported digests; documented optional output maps have blank separation between members.
  * @evidence contracts/portability.md#os-neutral-implementation Native roots are resolved with Node path APIs and executable resolution; platform/architecture intentionally distinguish incompatible binary artifacts.
  * @evidence contracts/performance.md#efficient-algorithms Source digest misses enumerate/sort paths and read individual files in full, not bounded streaming chunks. Overlay/contributor ordering compares path/name text; replacement discovery can read a manifest/run Go and native containment queries. Toolchain/env hashing delegates native metadata/probes/full bytes and memo checks without an unmeasured dominant-cost ranking; JSON framing processes all version/entry/label/digest text.
- * @evidence contracts/performance.md#reuse-equivalent-work Caller-owned sourceDigests share supplied absolute-directory readings across roles without independently verifying their provenance/currentness. EnvironmentDigests receives this call's selected environment identity so reporting can avoid another probe; it does not skip environment hashing. Reuse inherits the selected population and metadata/producer premises.
+ * @evidence contracts/performance.md#reuse-equivalent-work Caller-owned sourceDigests share supplied absolute-directory readings across roles without independently verifying their provenance/currentness. A supplied record store lets a new process reuse a directory, SDK or executable digest only while its separable metadata signature matches the recorded one (#1722), so unchanged inputs are not re-read per process. EnvironmentDigests receives this call's selected environment identity so reporting can avoid another probe. A same-directory reading of the same load, with its witness, replaces a second environment probe; the witness then joins this build's, which the build compares after it ran, and a non-default byte adapter never shares. Reuse inherits the selected population and metadata/producer premises.
  *
  * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources Output maps belong to the enclosing load; this operation retains no handles or process-wide records itself.
  */
@@ -66,6 +68,14 @@ export function computeCacheKey(inputs: {
    */
   environmentDigests?: Map<string, string>;
 
+  /**
+   * Witness of each reading in `environmentDigests` this load took, by
+   * directory. A digest with its witness stands for this call's own reading:
+   * the key takes it instead of running Go again and copies the witness into
+   * `environmentWitness`. Filled with this call's reading when it takes one.
+   */
+  environmentWitnesses?: Map<string, PluginBuildEnvironmentWitness.Record>;
+
   /**
    * Receives selected native toolchain dependencies from the environment reader
    * for later comparison under its metadata-distinguishability premise; it is
@@ -77,6 +87,14 @@ export function computeCacheKey(inputs: {
   filesystem?: Partial<SourceBuildFilesystemOperations>;
   goBinary?: string;
   goModReader?: SourcePluginWorkspace.GoModReader;
+
+  /**
+   * Record store that proves unchanged sources, overlays, contributors, GOROOT
+   * and executables from metadata in a new process (#1722). Without it every
+   * process reads their bytes.
+   */
+  identities?: PluginContentIdentities.Store;
+
   overlayDirs?: readonly string[];
 
   /**
@@ -128,61 +146,96 @@ export function computeCacheKey(inputs: {
   // binaries produced by the former absolute-ancestry layout out of this
   // layout's cache admissions, including callers with no SDK overlays.
   hash.update(JSON.stringify(["external-source-layout", 1]));
-  // The same framed values enter the key and the environment-only digest,
-  // which pluginBuildEnvironment reads for this directory.
-  const environment = crypto.createHash("sha256");
-  hashPluginBuildEnvironment(
-    {
-      update: (data: string) => {
-        hash.update(data);
-        environment.update(data);
-      },
-    },
-    goBinary,
-    inputs.dir,
-    env,
-    filesystem,
-    inputs.environmentWitness,
-  );
-  inputs.environmentDigests?.set(
-    path.resolve(inputs.dir),
-    environment.digest("hex"),
+  const overlays = [...(inputs.overlayDirs ?? [])].sort();
+  // Hash contributors in sorted-by-name order so two consumers with the
+  // same logical set produce the same key regardless of declaration order
+  // in the host's plugin descriptor.
+  const sortedContributors = [...(inputs.contributors ?? [])].sort((a, b) =>
+    a.name === b.name ? 0 : a.name < b.name ? -1 : 1,
   );
-  hashSourceDirectory(hash, "plugin", inputs.dir, inputs.sourceDigests);
+  // A store whose root lies inside a directory this key hashes would write
+  // records into that source, so such a store proves nothing here. The build
+  // rejects that cache placement (`SourcePluginAdmission`) once every source
+  // is known; replacement targets narrow the store below, before their own
+  // digests, since only Go's reading of the manifest names them.
+  let identities = PluginContentIdentities.outside(inputs.identities, [
+    inputs.dir,
+    ...overlays,
+    ...sortedContributors.map((contributor) => contributor.source),
+  ]);
+  // The key frames the environment digest pluginBuildEnvironment reports for
+  // this directory. WARNING (#1721): package selection reads that environment
+  // first in the same load; reading it again here doubled `go env` and
+  // `go version` per load. A reading taken through another byte adapter is
+  // not this one's, so only the default adapter shares it.
+  const environmentDirectory = path.resolve(inputs.dir);
+  const sharedDigest =
+    inputs.filesystem === undefined
+      ? inputs.environmentDigests?.get(environmentDirectory)
+      : undefined;
+  const sharedWitness =
+    sharedDigest === undefined
+      ? undefined
+      : inputs.environmentWitnesses?.get(environmentDirectory);
+  let environment: string;
+  if (sharedDigest !== undefined && sharedWitness !== undefined) {
+    // The build compares this witness after it ran, exactly as it would its
+    // own reading's, so a toolchain change since the reading still refuses.
+    for (const [file, state] of sharedWitness)
+      if (!inputs.environmentWitness?.has(file))
+        inputs.environmentWitness?.set(file, state);
+    environment = sharedDigest;
+  } else {
+    const witness =
+      inputs.environmentWitness ??
+      (inputs.environmentWitnesses === undefined ? undefined : new Map());
+    const reading = crypto.createHash("sha256");
+    hashPluginBuildEnvironment(
+      reading,
+      goBinary,
+      inputs.dir,
+      env,
+      filesystem,
+      witness,
+      identities,
+    );
+    environment = reading.digest("hex");
+    inputs.environmentDigests?.set(environmentDirectory, environment);
+    if (inputs.filesystem === undefined && witness !== undefined)
+      inputs.environmentWitnesses?.set(environmentDirectory, new Map(witness));
+  }
+  hash.update(JSON.stringify(["environment", environment]));
+  const directory = (label: string, root: string): void =>
+    hashSourceDirectory(hash, label, root, inputs.sourceDigests, identities);
+  directory("plugin", inputs.dir);
   // Local replacement targets outside the module supply separately keyed
   // sources. buildSourcePlugin snapshots and proves their copies before
-  // redirecting the Go replacement directives to the scratch tree.
-  for (const replacement of pluginModuleReplaceDirectories(
+  // redirecting the Go replacement directives to the scratch tree. Go reads the
+  // manifest after the plugin's digest, so an edit made meanwhile lands between
+  // that digest and the build's copy, which `requireKeyedSource` refuses.
+  const replacements = pluginModuleReplaceDirectories(
     inputs.dir,
     env,
     goBinary,
     inputs.goModReader,
-  )) {
-    hashSourceDirectory(
-      hash,
+  );
+  identities = PluginContentIdentities.outside(
+    identities,
+    replacements.map((replacement) => replacement.directory),
+  );
+  for (const replacement of replacements) {
+    directory(
       `replace:${replacement.modulePath}${
         replacement.version === undefined ? "" : `@${replacement.version}`
       }`,
       replacement.directory,
-      inputs.sourceDigests,
     );
   }
-  for (const [index, dir] of [...(inputs.overlayDirs ?? [])].sort().entries()) {
-    hashSourceDirectory(hash, `overlay:${index}`, dir, inputs.sourceDigests);
+  for (const [index, dir] of overlays.entries()) {
+    directory(`overlay:${index}`, dir);
   }
-  // Hash contributors in sorted-by-name order so two consumers with the
-  // same logical set produce the same key regardless of declaration order
-  // in the host's plugin descriptor.
-  const sortedContributors = [...(inputs.contributors ?? [])].sort((a, b) =>
-    a.name === b.name ? 0 : a.name < b.name ? -1 : 1,
-  );
   for (const contributor of sortedContributors) {
-    hashSourceDirectory(
-      hash,
-      `contributor:${contributor.name}`,
-      contributor.source,
-      inputs.sourceDigests,
-    );
+    directory(`contributor:${contributor.name}`, contributor.source);
   }
   return hash.digest("hex").slice(0, 32);
 }
@@ -197,11 +250,14 @@ function hashSourceDirectory(
   label: string,
   root: string,
   digests: Map<string, string> | undefined,
+  identities: PluginContentIdentities.Store | undefined,
 ): void {
   const directory = path.resolve(root);
   let digest = digests?.get(directory);
   if (digest === undefined) {
-    digest = pluginSourceDigest(directory);
+    // WARNING (#1722): the load-scoped map above ends with the process. Only the
+    // record store spares a new process from reading every source byte again.
+    digest = PluginContentIdentities.sourceDirectory(identities, directory);
     digests?.set(directory, digest);
   }
   hash.update(JSON.stringify(["dir", label, digest]));