ttsc 0.31.2 → 0.31.4

package/src/launcher/internal/runtime/isLocalProcessGone.ts

@@ -1,15 +1,17 @@
 import os from "node:os";
 
+import { probeLocalProcess } from "../../../internal/probeLocalProcess";
+
 /**
  * Whether the process an owner record names has certainly exited: it ran on
  * this host, and no process with its pid is alive.
  *
  * A record from another host proves nothing, because its pid names a process
  * this machine cannot see, so it is never reported gone. An `EPERM` from the
- * probe does not establish absence, so it counts as alive. Only `ESRCH` proves
- * absence; other probe failures remain unknown. A recycled pid makes the answer
- * err toward "alive": a caller that reclaims on "gone" never takes a live
- * owner's state.
+ * probe does not establish absence, so it counts as alive. Only `ESRCH`, or a
+ * Linux zombie that has exited but was never collected, proves absence; other
+ * probe failures remain unknown. A recycled pid makes the answer err toward
+ * "alive": a caller that reclaims on "gone" never takes a live owner's state.
  *
  * Callers supply a validated positive process id, not a process-group selector.
  * Hostname comparison is a host-label convention, not machine authentication:
@@ -18,13 +20,13 @@ import os from "node:os";
  * An optional diagnostic receives this same observation without another probe;
  * a diagnostic failure cannot change the ownership decision.
  *
- * @evidence contracts/common.md#principled-implementation Reclamation requires both the recorded local hostname and ESRCH from the native pid probe; permission, invalid-pid and unknown failures cannot establish that an owner is gone.
- * @evidence contracts/common.md#clear-and-simple-design One conservative predicate supplies the same owner-liveness decision to lock recovery and directory sweeping.
- * @evidence contracts/common.md#prohibited-implementation-shortcuts Native process existence is queried through process.kill(pid, 0); no fixture pid or broad error-to-dead fallback substitutes for ownership evidence.
- * @evidence contracts/common.md#meaningful-documentation The native explanation distinguishes a remote host, a denied or unknown probe and pid recycling, stating why ambiguity protects a live owner's state.
+ * @evidence contracts/common.md#principled-implementation Reclamation requires both the recorded local hostname and probeLocalProcess's absence proof, ESRCH or an uncollected Linux zombie; permission, invalid-pid and unknown failures cannot establish that an owner is gone.
+ * @evidence contracts/common.md#clear-and-simple-design One conservative predicate supplies the same owner-liveness decision to lock recovery and directory sweeping, and shares its probe with plugin build locks.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Native process existence is queried through process.kill(pid, 0) and the kernel's /proc state; no fixture pid or broad error-to-dead fallback substitutes for ownership evidence.
+ * @evidence contracts/common.md#meaningful-documentation The native explanation distinguishes a remote host, a denied or unknown probe, an uncollected zombie and pid recycling, stating why ambiguity protects a live owner's state.
  * @evidence contracts/portability.md#os-neutral-implementation Node exposes the host's process-existence probe and portable error codes; hostname comparison scopes pid identity to this host without assuming POSIX signals can terminate Windows processes.
  * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources This observation retains no handle, historical state or cache; temporary lowercase hostname strings become reclaimable after return.
- * @evidence contracts/performance.md#efficient-algorithms Native hostname lookup and two lowercase string constructions/comparison process host-label text before at most one native pid probe; the fixed probe count is not a fixed text or operating-system cost.
+ * @evidence contracts/performance.md#efficient-algorithms Native hostname lookup and two lowercase string constructions/comparison process host-label text before at most one native pid probe and, on Linux, one /proc state read; the fixed probe count is not a fixed text or operating-system cost.
  * @evidenceExclude contracts/performance.md#reuse-equivalent-work Host labels and native process existence are current observations; this predicate coordinates no cross-call cache or reusable liveness proof.
  */
 export function isLocalProcessGone(
@@ -54,14 +56,7 @@ export function isLocalProcessGone(
     report("remote");
     return false;
   }
-  try {
-    process.kill(owner.pid, 0);
-    report("present");
-    return false;
-  } catch (error) {
-    const code = (error as NodeJS.ErrnoException | null)?.code;
-    const absent = code === "ESRCH";
-    report(absent ? "absent" : "unknown", code);
-    return absent;
-  }
+  const { result, errorCode } = probeLocalProcess(owner.pid);
+  report(result, errorCode);
+  return result === "absent";
 }

package/src/launcher/internal/watch/WatchTopology.ts

@@ -14,9 +14,9 @@ import { type ProjectInputPathIdentityContext } from "../../../internal/pathIden
 import { createProjectInputPathIdentityContext } from "../../../internal/pathIdentity/createProjectInputPathIdentityContext";
 import { isProjectInputPathIdentityWithin } from "../../../internal/pathIdentity/isProjectInputPathIdentityWithin";
 import { resolveProjectInputPath } from "../../../internal/pathIdentity/resolveProjectInputPath";
+import { PluginContentIdentities } from "../../../plugin/internal/source/PluginContentIdentities";
 import { collectPluginSourceDirectories } from "../../../plugin/internal/source/collectPluginSourceDirectories";
 import { pluginSourceCovers } from "../../../plugin/internal/source/pluginSourceCovers";
-import { pluginSourceDigest } from "../../../plugin/internal/source/pluginSourceDigest";
 import { prunesPluginSourceDirectory } from "../../../plugin/internal/source/prunesPluginSourceDirectory";
 import type { ITtscParsedProjectConfig } from "../../../structures/internal/ITtscParsedProjectConfig";
 import type { ITtscProjectInputSnapshot } from "../../../structures/internal/ITtscProjectInputSnapshot";
@@ -84,6 +84,13 @@ export class WatchTopology {
    */
   private pluginInputStates = new Map<string, string>();
 
+  /**
+   * The record store of the latest plugin load that reported the inputs, which
+   * proves their states from the plugin cache's records (#1728). Absent before
+   * a load reports one, or when it opened none; the states are read then.
+   */
+  private pluginInputIdentities: PluginContentIdentities.Store | undefined;
+
   /**
    * The plugin inputs notifications named since the last decision, by path key,
    * each with the locations noted for it (`notePluginNotification`).
@@ -331,17 +338,33 @@ export class WatchTopology {
    * observation. This does not freeze the source tree or prove every transient
    * edit was seen.
    *
+   * WARNING (#1728): take each baseline through the reporting load's record
+   * store (`identities`), never by reading the sources again. The load proves
+   * the same directories from the plugin cache's records a moment later, and a
+   * content read here cost every watch session start 0.3-0.6 s for typia's Go
+   * module. The store proves only a digest whose metadata still holds and is
+   * separable from its reference, so the baseline is the digest a content read
+   * would return at this moment.
+   *
+   * @param inputs Plugin source directories and files the load reported.
+   * @param identities The reporting load's record store, if it opened one.
    * @evidence contracts/common.md#principled-implementation Published plugin inputs define the source corpus, and retaining existing pre-build baselines keeps unreported edits visible.
    * @evidence contracts/common.md#clear-and-simple-design Deduplication, baseline retention and compiler/watch reconciliation remain ordered phases.
    * @evidence contracts/common.md#prohibited-implementation-shortcuts The actual plugin source digest applies its owning source-selection and pruning policy; named plugins or fixture output do not replace observed input state.
    * @evidence contracts/common.md#meaningful-documentation Native prose explains baseline timing and why existing inputs are not restamped following the documentation skill.
    * @evidence contracts/portability.md#os-neutral-implementation Native path resolution and canonical backend registration govern source trees; lexical keys preserve declarations and unknown names, folding ASCII only under measured insensitive parents rather than an OS-derived rule.
-   * @evidence contracts/performance.md#efficient-algorithms Input/path keys deduplicate with text and native case/ancestor work; only newly admitted inputs compute initial source digests. Those reads scan the selected pruned corpus, then refresh(false) also pays project/compiler listing, directory traversal and watcher reconciliation; fixed publication count does not bound delegated bytes or backend work.
-   * @evidence contracts/performance.md#reuse-equivalent-work Unchanged ordered input sets return immediately; existing inputs reuse their recorded digest until actual notification processing establishes changed consumed state.
+   * @evidence contracts/performance.md#efficient-algorithms Input/path keys deduplicate with text and native case/ancestor work; only newly admitted inputs compute initial source digests, each proven from the selected files' metadata when the load's records hold and read from the selected pruned corpus otherwise; refresh(false) also pays project/compiler listing, directory traversal and watcher reconciliation; fixed publication count does not bound delegated bytes or backend work.
+   * @evidence contracts/performance.md#reuse-equivalent-work Unchanged ordered input sets return immediately; existing inputs reuse their recorded digest until actual notification processing establishes changed consumed state; a new input's digest is the one the load recorded while its metadata holds.
    * @evidence contracts/performance.md#bound-retention-and-release-resources Publications replace input/digest populations and case-observation caches without a population cap; synchronization attempts obsolete watcher closure. Native/supplied closure has its own lifetime and can throw; owner close does not prove every backend has stopped or every retained snapshot byte was released.
    */
-  public setExtraInputs(inputs: readonly string[]): void {
+  public setExtraInputs(
+    inputs: readonly string[],
+    identities?: PluginContentIdentities.Store,
+  ): void {
     this.beginLexicalTransaction();
+    // The latest load's store also serves later notifications; its references
+    // only grow older, which can make fewer stamps separable but never more.
+    this.pluginInputIdentities = identities;
     const next = uniqueExistingPaths(inputs, this.lexicalIdentities);
     if (arraysEqual(this.extraInputs, next)) return;
     this.extraInputs = next;
@@ -354,7 +377,8 @@ export class WatchTopology {
       const key = this.pathKey(input);
       states.set(
         key,
-        this.pluginInputStates.get(key) ?? pluginInputState(input),
+        this.pluginInputStates.get(key) ??
+          pluginInputState(input, this.pluginInputIdentities),
       );
     }
     this.pluginInputStates = states;
@@ -1664,7 +1688,7 @@ export class WatchTopology {
       const key = this.pathKey(input);
       const locations = pending.get(key);
       if (locations === undefined) continue;
-      const state = pluginInputState(input);
+      const state = pluginInputState(input, this.pluginInputIdentities);
       if (this.pluginInputStates.get(key) === state) continue;
       this.pluginInputStates.set(key, state);
       for (const location of locations) {
@@ -2739,12 +2763,17 @@ function isRecord(value: unknown): value is Record<string, unknown> {
  * What a plugin build keys a plugin input on: the digest of the files its build
  * reads from a source directory (`pluginSourceDigest`), or a file's bytes. An
  * input that cannot be read has a state of its own, so the change that made it
- * unreadable is reported and the build names the failure.
+ * unreadable is reported and the build names the failure. A directory's digest
+ * comes from the load's record store while the selected files' metadata holds
+ * there (#1728), and from the files otherwise.
  */
-function pluginInputState(input: string): string {
+function pluginInputState(
+  input: string,
+  identities: PluginContentIdentities.Store | undefined,
+): string {
   try {
     return WatchPaths.isDirectory(input)
-      ? `directory:${pluginSourceDigest(input)}`
+      ? `directory:${PluginContentIdentities.sourceDirectory(identities, input)}`
       : `file:${fingerprintProjectInputFile(input)}`;
   } catch (error) {
     return `unreadable:${error instanceof Error ? error.message : String(error)}`;

package/src/plugin/internal/load/loadProjectPlugins.ts

@@ -130,8 +130,14 @@ export function loadProjectPlugins(options: {
    */
   identities?: PluginContentIdentities.Store;
 
-  /** Observe plugin build roots before building, including failed builds. */
-  onWatchInputs?: (inputs: readonly string[]) => void;
+  /**
+   * Observe plugin build roots before building, including failed builds, with
+   * the record store that proves their states (#1728).
+   */
+  onWatchInputs?: (
+    inputs: readonly string[],
+    identities?: PluginContentIdentities.Store,
+  ) => void;
 
   /** Caller-selected anchor for plugin-owned configuration discovery. */
   pluginConfigDir?: string;
@@ -425,7 +431,10 @@ export function loadProjectPlugins(options: {
         ])
         .filter(reportsPluginSource),
     );
-    options.onWatchInputs([...interests].sort());
+    // WARNING (#1728): hand the watch owner this load's store with the roots.
+    // It baselines each root before any build reads it; without the store it
+    // read every source the load proves from records a moment later.
+    options.onWatchInputs([...interests].sort(), sourceIdentities);
     const initialSize = interests.size;
     for (const candidate of candidates) {
       // Nested source-only proposals replace the outer root manifests. Do not
@@ -440,7 +449,7 @@ export function loadProjectPlugins(options: {
         if (reportsPluginSource(directory)) interests.add(directory);
     }
     if (interests.size !== initialSize)
-      options.onWatchInputs([...interests].sort());
+      options.onWatchInputs([...interests].sort(), sourceIdentities);
   }
   const proposals = NativeSourcePackages.propose(
     candidates.map((candidate) => ({
@@ -520,16 +529,16 @@ export function loadProjectPlugins(options: {
       records[candidate.index]!.kind === "executable" &&
       !proposals[candidate.index]!.ownModule,
   );
+  const buildDirectories = pluginBuildDirectories(
+    records,
+    effectiveEnv,
+    watchReplacements,
+    packageReaders,
+  );
   // Admission can now narrow the provisional interests without restamping the
   // retained package/module baselines. Final host errors still keep these roots.
-  options.onWatchInputs?.(
-    pluginBuildDirectories(
-      records,
-      effectiveEnv,
-      watchReplacements,
-      packageReaders,
-    ),
-  );
+  options.onWatchInputs?.(buildDirectories, sourceIdentities);
+  const keyedDirectories = new Set(buildDirectories);
   const linkedContributors = records
     .filter((record) => record.stage === "transform")
     .flatMap((record) =>
@@ -771,10 +780,12 @@ export function loadProjectPlugins(options: {
       ? { observationsComplete: false as const }
       : {}),
     // The directories the watch inputs named before the builds, as the builds
-    // read them.
+    // read them. Package selection shares these readings and also reads a
+    // linked plugin's module root, which no build keys on, so only the build
+    // directories are reported.
     pluginSources: Object.fromEntries(
       [...sourceDigests]
-        .filter(([directory]) => reportsPluginSource(directory))
+        .filter(([directory]) => keyedDirectories.has(directory))
         .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
         .map(([directory, sourceDigest]) => [
           directory,

package/src/plugin/internal/source/GoBuildCacheCoordination.ts

@@ -322,6 +322,9 @@ export namespace GoBuildCacheCoordination {
     // the child process required for `go build`. The fallback inherits only the
     // low standard descriptors and checks its parent PID. An IPC channel would
     // allocate another high descriptor and recreate Darwin's spawn EBADF limit.
+    // A dead parent that nobody collects stays a zombie and still answers
+    // signal zero, but POSIX reparents the heartbeat when its parent exits, so
+    // a changed parent id ends it as well; Windows never reparents.
     const ready = `${file}.heartbeat-${crypto.randomBytes(16).toString("hex")}`;
     let heartbeatChild: ReturnType<typeof spawn> | undefined;
     try {
@@ -334,7 +337,7 @@ export namespace GoBuildCacheCoordination {
           "const parent = Number(process.argv[3]);",
           "const ready = process.argv[4];",
           "const timer = setInterval(() => {",
-          "  try { process.kill(parent, 0); } catch { clearInterval(timer); process.exit(0); }",
+          "  try { if (process.ppid !== parent) throw 0; process.kill(parent, 0); } catch { clearInterval(timer); process.exit(0); }",
           "  try {",
           '    if (JSON.parse(fs.readFileSync(file, "utf8")).status === "complete") {',
           "      clearInterval(timer); process.exit(0);",

package/src/plugin/internal/source/PluginBuildLockOwner.ts

@@ -2,6 +2,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
+import { probeLocalProcess } from "../../../internal/probeLocalProcess";
 import { PluginBuildLockProtocol } from "./PluginBuildLockProtocol";
 
 /**
@@ -177,15 +178,16 @@ export namespace PluginBuildLockOwner {
    * process with its id exists. A holder on another host, or one whose id is
    * alive (possibly reused), is not proven gone.
    *
-   * Only ESRCH proves absence. Permission errors, invalid probe arguments and
-   * other failures remain inconclusive and must not authorize reclamation.
+   * Only ESRCH, or a Linux zombie that exited but was never collected, proves
+   * absence. Permission errors, invalid probe arguments and other failures
+   * remain inconclusive and must not authorize reclamation.
    *
-   * @evidence contracts/common.md#principled-implementation Signal zero checks existence without terminating the process; same-host ESRCH establishes absence, while success or any other error does not.
-   * @evidence contracts/common.md#clear-and-simple-design Host comparison and one native probe express the proof boundary directly, without a second process-discovery mechanism.
+   * @evidence contracts/common.md#principled-implementation probeLocalProcess checks existence without terminating the process; same-host ESRCH or an uncollected zombie establishes absence, while presence or any other error does not.
+   * @evidence contracts/common.md#clear-and-simple-design Host comparison and the shared probe express the proof boundary directly, without a second process-discovery mechanism.
    * @evidence contracts/common.md#prohibited-implementation-shortcuts Unexpected probe failures are not converted to a dead-owner special case or hidden behind retries.
-   * @evidence contracts/common.md#meaningful-documentation Native paragraphs distinguish PID reuse, remote owners and each inconclusive failure class before the tags.
-   * @evidence contracts/portability.md#os-neutral-implementation os.hostname and Node's platform-independent signal-zero probe preserve native host scope; only the explicit no-such-process code authorizes absence.
-   * @evidence contracts/performance.md#efficient-algorithms A hostname comparison and one process-existence syscall avoid enumerating native processes; string comparison costs grow only with hostname length.
+   * @evidence contracts/common.md#meaningful-documentation Native paragraphs distinguish PID reuse, remote owners, uncollected zombies and each inconclusive failure class before the tags.
+   * @evidence contracts/portability.md#os-neutral-implementation os.hostname and Node's platform-independent signal-zero probe preserve native host scope; only the explicit no-such-process code, or Linux's own zombie state, authorizes absence.
+   * @evidence contracts/performance.md#efficient-algorithms A hostname comparison and one process-existence syscall, plus one /proc read on Linux, avoid enumerating native processes; string comparison costs grow only with hostname length.
    *
    * @evidenceExclude contracts/performance.md#reuse-equivalent-work Liveness is a time-sensitive observation; a previously absent or present PID cannot be cached as proof for a later reclamation.
    * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The query owns no retained handle or running task and returns only its immediate proof decision.
@@ -193,12 +195,7 @@ export namespace PluginBuildLockOwner {
   export function gone(owner: IRecord): boolean {
     if (owner.hostname.toLowerCase() !== os.hostname().toLowerCase())
       return false;
-    try {
-      process.kill(owner.pid, 0);
-      return false;
-    } catch (error) {
-      return (error as NodeJS.ErrnoException).code === "ESRCH";
-    }
+    return probeLocalProcess(owner.pid).result === "absent";
   }
 
   /**

package/src/plugin/internal/source/SourcePluginWorkspace.ts

@@ -1,12 +1,15 @@
+import crypto from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
 import { OwnedSynchronousProcess } from "../../../internal/OwnedSynchronousProcess";
+import { runtimeExecutableIdentity } from "../../../internal/runtimeExecutableIdentity";
 import { GoEnvironmentReading } from "./GoEnvironmentReading";
 import { GoSourceInputs } from "./GoSourceInputs";
 import { PluginBuildEnvironmentWitness } from "./PluginBuildEnvironmentWitness";
-import type { PluginContentIdentities } from "./PluginContentIdentities";
+import { PluginContentIdentities } from "./PluginContentIdentities";
+import { PluginLoadAnswers } from "./PluginLoadAnswers";
 import { SourcePluginAdmission } from "./SourcePluginAdmission";
 import { copiesPluginSourceEntry } from "./copiesPluginSourceEntry";
 import { formatGoWorkPath } from "./formatGoWorkPath";
@@ -239,9 +242,17 @@ export namespace SourcePluginWorkspace {
    * registry shares native reader state from the first watch query onward; its
    * owner must keep one fixed effective environment and discard it on retry.
    * Caller views share that native state and syntax, while each default
-   * diagnostic label remains with its current caller. An optional record store
-   * only carries the Go environment-file discovery hint across processes; it
-   * never carries a parse.
+   * diagnostic label remains with its current caller.
+   *
+   * An optional record store carries the Go environment-file discovery hint
+   * across processes, and the parse of identical bytes by the same Go command
+   * (#1729): every launch otherwise ran `go mod edit -json` on an unchanged
+   * `go.mod`. A recorded parse is keyed by the manifest bytes, the content
+   * identities of the launcher and of the `GOROOT/bin/go` the live `go env
+   * -json GOROOT` reports, the `GOENV` file's bytes, and every `GO*`/`CGO_*`
+   * variable the command receives. It is consulted and written only under the
+   * same qualified tool witness that admits in-load sharing, so the live
+   * witness query still runs on every load.
    *
    * @evidence contracts/common.md#principled-implementation Actual go mod edit JSON determines module/replacement identities; current bytes, selected/dispatched-tool metadata and Go's environment-file witness qualify reuse under the existing metadata-distinguishability premise. Environment values are copied at reader creation. Missing go.mod returns the existing empty module observation, and moving tool/manifest inputs cannot publish a parsed record.
    * @evidence contracts/common.md#clear-and-simple-design One factory acquires load-owned native reader state by selected tool; a thin caller view forwards its diagnostic label without duplicating the byte-content map. Current reads and post-parse byte/tool comparisons qualify insertion.
@@ -249,7 +260,7 @@ export namespace SourcePluginWorkspace {
    * @evidence contracts/common.md#meaningful-documentation Native prose states this operation's authority and delegated boundaries; fields retain separate native comments.
    * @evidence contracts/portability.md#os-neutral-implementation Native path resolution and temporary cwd avoid deep Windows working-directory limits; the selected tool handles manifest syntax.
    * @evidence contracts/performance.md#efficient-algorithms Reader acquisition performs a selected-tool registry lookup; every nonmissing read qualifies tool/environment metadata and reads current manifest bytes. A cold or stale witness first observes the selected launcher; an unavailable or nonfile launcher skips optional environment acquisition and permits only the actual uncached parse attempt. An observed file lends its same pre-read stat to the witness before acquiring current Go values and GOENV evidence through the common reader, without a GOROOT walk. Only complete native GOENV/GOROOT locations qualify syntax sharing; a dispatched tool is witnessed before parsing. Unavailable native environment acquisition disables syntax sharing while preserving actual parse success or failure. Each distinct byte string that earns stable successful syntax in that tool epoch runs Go mod edit and complete JSON parsing once, then rechecks bytes/tool metadata before caching; copied manifests share that parse. Failed queries remain uncached and report the current caller's diagnostic label.
-   * @evidence contracts/performance.md#reuse-equivalent-work The caller may share this reader only within one load and the same pinned tool/effective environment; parsed syntax is not cross-load or native containment authority. Caller views share native state while preserving failure attribution; diagnostic labels are not syntax cache inputs.
+   * @evidence contracts/performance.md#reuse-equivalent-work The caller may share this reader only within one load and the same pinned tool/effective environment; parsed syntax is never native containment authority. Across loads only a parse recorded under the content identities of the bytes, both Go executables, the GOENV file and the Go variables is reused, and only under a qualified live tool witness. Caller views share native state while preserving failure attribution; diagnostic labels are not syntax cache inputs.
    * @evidence contracts/performance.md#bound-retention-and-release-resources The map retains distinct manifest bytes and parsed syntax for its caller's load/build lifetime; process/output capture cleanup remains delegated.
    */
   export function createGoModReader(
@@ -279,6 +290,9 @@ export namespace SourcePluginWorkspace {
     const cache = new Map<string, GoModInfo>();
     const environment = { ...env };
     let toolWitness: PluginBuildEnvironmentWitness.Record | undefined;
+    // The tool part of a recorded parse's identity, formed with each qualified
+    // witness; undefined without a store or a provable tool.
+    let toolIdentity: unknown;
     const reader: GoModReader = {
       read(dir, diagnosticPlugin = pluginName) {
         OwnedSynchronousProcess.checkpoint();
@@ -343,6 +357,16 @@ export namespace SourcePluginWorkspace {
             complete && PluginBuildEnvironmentWitness.holds(witness)
               ? witness
               : undefined;
+          toolIdentity =
+            toolWitness === undefined || identities === undefined
+              ? undefined
+              : goModToolIdentity(
+                  goBinary,
+                  observed!.GOROOT as string,
+                  observed!.GOENV as string,
+                  environment,
+                  identities,
+                );
         }
         // UTF-8 decoding is lossy for malformed input. Only identical bytes
         // can share Go syntax, even when Go serializes two inputs identically.
@@ -351,6 +375,26 @@ export namespace SourcePluginWorkspace {
         if (cached !== undefined) {
           return cached;
         }
+        // WARNING (#1729): a new process asks the record store before running
+        // Go on bytes this exact command already parsed. Never key this on a
+        // path or on the reader's metadata witness alone.
+        const answer =
+          toolIdentity === undefined
+            ? undefined
+            : [
+                toolIdentity,
+                crypto.createHash("sha256").update(bytes).digest("hex"),
+              ];
+        const recalled =
+          answer === undefined
+            ? undefined
+            : recallGoModInfo(
+                PluginLoadAnswers.read(identities, GO_MOD_SYNTAX, answer),
+              );
+        if (recalled !== undefined) {
+          cache.set(byteKey, recalled);
+          return recalled;
+        }
         const info = readGoModInfo(
           resolved,
           goBinary,
@@ -370,7 +414,14 @@ export namespace SourcePluginWorkspace {
           );
         // An unavailable environment observation can still execute a fresh Go
         // parse, but it cannot authorize sharing that result on another call.
-        if (toolWitness !== undefined) cache.set(byteKey, info);
+        if (toolWitness !== undefined) {
+          cache.set(byteKey, info);
+          if (answer !== undefined)
+            PluginLoadAnswers.write(identities, GO_MOD_SYNTAX, answer, {
+              modulePath: info.modulePath,
+              directives: info.directives,
+            });
+        }
         return info;
       },
     };
@@ -450,6 +501,124 @@ export namespace SourcePluginWorkspace {
     };
   }
 
+  /** Answer family of `go mod edit -json` parses (`PluginLoadAnswers`). */
+  const GO_MOD_SYNTAX = "go-mod-syntax";
+
+  /**
+   * Everything besides the manifest bytes that decides how `go mod edit -json`
+   * parses them, by content: the launcher, the `GOROOT/bin/go` the live query
+   * reported, the `GOENV` file that can select another toolchain, and the Go
+   * variables the command receives. `undefined` when an executable cannot be
+   * identified or the file cannot be read, so the parse runs.
+   */
+  function goModToolIdentity(
+    goBinary: string,
+    goRoot: string,
+    goEnv: string,
+    env: NodeJS.ProcessEnv,
+    identities: PluginContentIdentities.Store,
+  ): unknown {
+    const dispatchedPath = path.join(
+      goRoot,
+      "bin",
+      process.platform === "win32" ? "go.exe" : "go",
+    );
+    // Only an executable the store can prove from metadata may key the record:
+    // streaming both executables on a device without a reference would cost
+    // more than the parse it replaces.
+    if (
+      !provableFromMetadata(goBinary, identities) ||
+      !provableFromMetadata(dispatchedPath, identities)
+    )
+      return undefined;
+    const launcher = runtimeExecutableIdentity(goBinary, identities);
+    const dispatched = runtimeExecutableIdentity(dispatchedPath, identities);
+    if (launcher === undefined || dispatched === undefined) return undefined;
+    let goEnvFile: string | null;
+    if (goEnv === "off") goEnvFile = "off";
+    else
+      try {
+        goEnvFile = crypto
+          .createHash("sha256")
+          .update(fs.readFileSync(goEnv))
+          .digest("hex");
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code !== "ENOENT")
+          return undefined;
+        goEnvFile = null;
+      }
+    return [
+      1,
+      launcher,
+      goRoot,
+      dispatched,
+      goEnv,
+      goEnvFile,
+      Object.entries(GoSourceInputs.goBuildEnv(goBinary, undefined, env))
+        .filter(
+          (entry): entry is [string, string] =>
+            entry[1] !== undefined && /^(GO|CGO_)/i.test(entry[0]),
+        )
+        .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0)),
+    ];
+  }
+
+  /**
+   * Whether the file's stamp is separable from the store's reference on its
+   * device, the precondition for proving its bytes from a record.
+   */
+  function provableFromMetadata(
+    file: string,
+    identities: PluginContentIdentities.Store,
+  ): boolean {
+    try {
+      return PluginContentIdentities.separable(
+        identities.references,
+        fs.statSync(file, { bigint: true }),
+      );
+    } catch {
+      return false;
+    }
+  }
+
+  /**
+   * A recorded parse in the shape `readGoModInfo` returns, or `undefined` when
+   * the record does not have it.
+   */
+  function recallGoModInfo(value: unknown): GoModInfo | undefined {
+    if (typeof value !== "object" || value === null) return undefined;
+    const record = value as { modulePath?: unknown; directives?: unknown };
+    if (
+      (record.modulePath !== null && typeof record.modulePath !== "string") ||
+      !Array.isArray(record.directives) ||
+      !record.directives.every(isReplaceDirective)
+    )
+      return undefined;
+    const directives = record.directives as NonNullable<GoModJson["Replace"]>;
+    return {
+      modulePath: record.modulePath,
+      directives,
+      replacements: directives
+        .map(jsonReplacementToGoModReplacement)
+        .filter((replacement) => replacement !== null),
+    };
+  }
+
+  function isReplaceDirective(value: unknown): boolean {
+    if (typeof value !== "object" || value === null) return false;
+    const directive = value as Record<string, unknown>;
+    return [directive.Old, directive.New].every(
+      (side) =>
+        side === undefined ||
+        (typeof side === "object" &&
+          side !== null &&
+          ["Path", "Version"].every((key) => {
+            const field = (side as Record<string, unknown>)[key];
+            return field === undefined || typeof field === "string";
+          })),
+    );
+  }
+
   function jsonReplacementToGoModReplacement(
     replacement: NonNullable<GoModJson["Replace"]>[number],
   ): GoModReplacement | null {

package/src/structures/internal/TtscSingleFileEmitOptions.ts

@@ -1,3 +1,4 @@
+import type { PluginContentIdentities } from "../../plugin/internal/source/PluginContentIdentities";
 import type { ITtscProjectInputSnapshot } from "./ITtscProjectInputSnapshot";
 import type { TtscCommonOptions } from "./TtscCommonOptions";
 
@@ -39,6 +40,9 @@ export interface TtscSingleFileEmitOptions extends TtscCommonOptions {
  * Executable modules, linked source roots, contributors and external local
  * module replacements can be reported. ttsc's own package sources are omitted;
  * this notification is not the complete compiler or project-rule input graph.
+ * The reporting load also hands over its record store, if it opened one, so the
+ * owner proves each root's state from the plugin cache's records instead of
+ * reading the sources the load is about to prove (#1728).
  *
  * @evidence contracts/common.md#principled-implementation Readonly roots describe the actual native-plugin sources whose later edits need observation.
  * @evidence contracts/common.md#clear-and-simple-design A void notification leaves watcher construction and lifetime with the invocation owner.
@@ -49,7 +53,10 @@ export interface TtscSingleFileEmitOptions extends TtscCommonOptions {
  * @evidenceExclude contracts/performance.md#efficient-algorithms A type declaration chooses no processing strategy.
  * @evidenceExclude contracts/performance.md#reuse-equivalent-work A type declaration computes nothing, so there is no work to share.
  */
-export type TtscPluginSourceInputsHandler = (inputs: readonly string[]) => void;
+export type TtscPluginSourceInputsHandler = (
+  inputs: readonly string[],
+  identities?: PluginContentIdentities.Store,
+) => void;
 
 /**
  * Receive the discovered project-rule filesystem topology for the watch owner.