ttsc 0.31.3 → 0.31.5

package/lib/plugin/internal/source/PluginBuildLockOwner.d.ts

@@ -92,15 +92,16 @@ export declare namespace PluginBuildLockOwner {
      * process with its id exists. A holder on another host, or one whose id is
      * alive (possibly reused), is not proven gone.
      *
-     * Only ESRCH proves absence. Permission errors, invalid probe arguments and
-     * other failures remain inconclusive and must not authorize reclamation.
+     * Only ESRCH, or a Linux zombie that exited but was never collected, proves
+     * absence. Permission errors, invalid probe arguments and other failures
+     * remain inconclusive and must not authorize reclamation.
      *
-     * @evidence contracts/common.md#principled-implementation Signal zero checks existence without terminating the process; same-host ESRCH establishes absence, while success or any other error does not.
-     * @evidence contracts/common.md#clear-and-simple-design Host comparison and one native probe express the proof boundary directly, without a second process-discovery mechanism.
+     * @evidence contracts/common.md#principled-implementation probeLocalProcess checks existence without terminating the process; same-host ESRCH or an uncollected zombie establishes absence, while presence or any other error does not.
+     * @evidence contracts/common.md#clear-and-simple-design Host comparison and the shared probe express the proof boundary directly, without a second process-discovery mechanism.
      * @evidence contracts/common.md#prohibited-implementation-shortcuts Unexpected probe failures are not converted to a dead-owner special case or hidden behind retries.
-     * @evidence contracts/common.md#meaningful-documentation Native paragraphs distinguish PID reuse, remote owners and each inconclusive failure class before the tags.
-     * @evidence contracts/portability.md#os-neutral-implementation os.hostname and Node's platform-independent signal-zero probe preserve native host scope; only the explicit no-such-process code authorizes absence.
-     * @evidence contracts/performance.md#efficient-algorithms A hostname comparison and one process-existence syscall avoid enumerating native processes; string comparison costs grow only with hostname length.
+     * @evidence contracts/common.md#meaningful-documentation Native paragraphs distinguish PID reuse, remote owners, uncollected zombies and each inconclusive failure class before the tags.
+     * @evidence contracts/portability.md#os-neutral-implementation os.hostname and Node's platform-independent signal-zero probe preserve native host scope; only the explicit no-such-process code, or Linux's own zombie state, authorizes absence.
+     * @evidence contracts/performance.md#efficient-algorithms A hostname comparison and one process-existence syscall, plus one /proc read on Linux, avoid enumerating native processes; string comparison costs grow only with hostname length.
      *
      * @evidenceExclude contracts/performance.md#reuse-equivalent-work Liveness is a time-sensitive observation; a previously absent or present PID cannot be cached as proof for a later reclamation.
      * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The query owns no retained handle or running task and returns only its immediate proof decision.

package/lib/plugin/internal/source/PluginBuildLockOwner.js

@@ -7,6 +7,7 @@ exports.PluginBuildLockOwner = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
+const probeLocalProcess_1 = require("../../../internal/probeLocalProcess");
 const PluginBuildLockProtocol_1 = require("./PluginBuildLockProtocol");
 /**
  * The holder a plugin build lock generation records, and what can be proven
@@ -115,15 +116,16 @@ var PluginBuildLockOwner;
      * process with its id exists. A holder on another host, or one whose id is
      * alive (possibly reused), is not proven gone.
      *
-     * Only ESRCH proves absence. Permission errors, invalid probe arguments and
-     * other failures remain inconclusive and must not authorize reclamation.
+     * Only ESRCH, or a Linux zombie that exited but was never collected, proves
+     * absence. Permission errors, invalid probe arguments and other failures
+     * remain inconclusive and must not authorize reclamation.
      *
-     * @evidence contracts/common.md#principled-implementation Signal zero checks existence without terminating the process; same-host ESRCH establishes absence, while success or any other error does not.
-     * @evidence contracts/common.md#clear-and-simple-design Host comparison and one native probe express the proof boundary directly, without a second process-discovery mechanism.
+     * @evidence contracts/common.md#principled-implementation probeLocalProcess checks existence without terminating the process; same-host ESRCH or an uncollected zombie establishes absence, while presence or any other error does not.
+     * @evidence contracts/common.md#clear-and-simple-design Host comparison and the shared probe express the proof boundary directly, without a second process-discovery mechanism.
      * @evidence contracts/common.md#prohibited-implementation-shortcuts Unexpected probe failures are not converted to a dead-owner special case or hidden behind retries.
-     * @evidence contracts/common.md#meaningful-documentation Native paragraphs distinguish PID reuse, remote owners and each inconclusive failure class before the tags.
-     * @evidence contracts/portability.md#os-neutral-implementation os.hostname and Node's platform-independent signal-zero probe preserve native host scope; only the explicit no-such-process code authorizes absence.
-     * @evidence contracts/performance.md#efficient-algorithms A hostname comparison and one process-existence syscall avoid enumerating native processes; string comparison costs grow only with hostname length.
+     * @evidence contracts/common.md#meaningful-documentation Native paragraphs distinguish PID reuse, remote owners, uncollected zombies and each inconclusive failure class before the tags.
+     * @evidence contracts/portability.md#os-neutral-implementation os.hostname and Node's platform-independent signal-zero probe preserve native host scope; only the explicit no-such-process code, or Linux's own zombie state, authorizes absence.
+     * @evidence contracts/performance.md#efficient-algorithms A hostname comparison and one process-existence syscall, plus one /proc read on Linux, avoid enumerating native processes; string comparison costs grow only with hostname length.
      *
      * @evidenceExclude contracts/performance.md#reuse-equivalent-work Liveness is a time-sensitive observation; a previously absent or present PID cannot be cached as proof for a later reclamation.
      * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The query owns no retained handle or running task and returns only its immediate proof decision.
@@ -131,13 +133,7 @@ var PluginBuildLockOwner;
     function gone(owner) {
         if (owner.hostname.toLowerCase() !== node_os_1.default.hostname().toLowerCase())
             return false;
-        try {
-            process.kill(owner.pid, 0);
-            return false;
-        }
-        catch (error) {
-            return error.code === "ESRCH";
-        }
+        return (0, probeLocalProcess_1.probeLocalProcess)(owner.pid).result === "absent";
     }
     PluginBuildLockOwner.gone = gone;
     /**

package/lib/plugin/internal/source/PluginBuildLockOwner.js.map

@@ -1 +1 @@
-{"version":3,"file":"PluginBuildLockOwner.js","sourceRoot":"","sources":["../../../../src/plugin/internal/source/PluginBuildLockOwner.ts"],"names":[],"mappings":";;;;;;AAAA,sDAAyB;AACzB,sDAAyB;AACzB,0DAA6B;AAE7B,uEAAoE;AAEpE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,IAAiB,oBAAoB,CAsMpC;AAtMD,WAAiB,oBAAoB;IAoCnC;;;;;;;;;;;;;;;;;;OAkBG;IACH,SAAgB,IAAI,CAAC,aAAqB;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,iBAAE,CAAC,YAAY,CACb,mBAAI,CAAC,IAAI,CACP,aAAa,EACb,iDAAuB,CAAC,4BAA4B,CACrD,EACD,MAAM,CACP,CACyB,CAAC;YAC7B,IACE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;gBACnC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC;gBAC7B,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;gBAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,EACf,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,SAAS,EACP,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;gBACrE,UAAU,EAAE,iDAAuB,CAAC,2BAA2B,CAC7D,MAAM,CAAC,UAAU,CAClB;oBACC,CAAC,CAAC,MAAM,CAAC,UAAU;oBACnB,CAAC,CAAC,SAAS;gBACb,eAAe,EAAE,iDAAuB,CAAC,2BAA2B,CAClE,MAAM,CAAC,eAAe,CACvB;oBACC,CAAC,CAAC,MAAM,CAAC,eAAe;oBACxB,CAAC,CAAC,SAAS;aACd,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAtCe,qBAAA,IAAI,OAsCnB,CAAA;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,SAAgB,YAAY,CAC1B,aAAqB,EACrB,UAAkB;QAElB,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;QAClC,IACE,KAAK,KAAK,IAAI;YACd,KAAK,CAAC,UAAU,KAAK,UAAU;YAC/B,KAAK,CAAC,eAAe,KAAK,SAAS,EACnC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACH,OAAO,CACL,iBAAE;iBACC,YAAY,CACX,mBAAI,CAAC,IAAI,CACP,aAAa,EACb,iDAAuB,CAAC,iCAAiC,CAC1D,EACD,MAAM,CACP;iBACA,IAAI,EAAE,KAAK,UAAU;gBACxB,iBAAE,CAAC,YAAY,CACb,mBAAI,CAAC,IAAI,CACP,aAAa,EACb,iDAAuB,CAAC,iCAAiC,CAC1D,EACD,MAAM,CACP,KAAK,GAAG,KAAK,CAAC,eAAe,IAAI,CACnC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAlCe,qBAAA,YAAY,eAkC3B,CAAA;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,SAAgB,IAAI,CAAC,KAAc;QACjC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,iBAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;YAC9D,OAAO,KAAK,CAAC;QACf,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;QAC3D,CAAC;IACH,CAAC;IATe,qBAAA,IAAI,OASnB,CAAA;IAED;;;;;;;;;;;;;;;OAeG;IACH,SAAgB,QAAQ,CAAC,KAAc;QACrC,MAAM,OAAO,GACX,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,CAAC,SAAS,EAAE,CAAC;QACxE,OAAO,OAAO,KAAK,CAAC,GAAG,OAAO,KAAK,CAAC,QAAQ,GAAG,OAAO,EAAE,CAAC;IAC3D,CAAC;IAJe,qBAAA,QAAQ,WAIvB,CAAA;AACH,CAAC,EAtMgB,oBAAoB,aAApB,oBAAoB,GAApB,oBAAoB,QAsMpC"}
+{"version":3,"file":"PluginBuildLockOwner.js","sourceRoot":"","sources":["../../../../src/plugin/internal/source/PluginBuildLockOwner.ts"],"names":[],"mappings":";;;;;;AAAA,sDAAyB;AACzB,sDAAyB;AACzB,0DAA6B;AAE7B,2EAAwE;AACxE,uEAAoE;AAEpE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,IAAiB,oBAAoB,CAkMpC;AAlMD,WAAiB,oBAAoB;IAoCnC;;;;;;;;;;;;;;;;;;OAkBG;IACH,SAAgB,IAAI,CAAC,aAAqB;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,iBAAE,CAAC,YAAY,CACb,mBAAI,CAAC,IAAI,CACP,aAAa,EACb,iDAAuB,CAAC,4BAA4B,CACrD,EACD,MAAM,CACP,CACyB,CAAC;YAC7B,IACE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;gBACnC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC;gBAC7B,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;gBAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,EACf,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,SAAS,EACP,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;gBACrE,UAAU,EAAE,iDAAuB,CAAC,2BAA2B,CAC7D,MAAM,CAAC,UAAU,CAClB;oBACC,CAAC,CAAC,MAAM,CAAC,UAAU;oBACnB,CAAC,CAAC,SAAS;gBACb,eAAe,EAAE,iDAAuB,CAAC,2BAA2B,CAClE,MAAM,CAAC,eAAe,CACvB;oBACC,CAAC,CAAC,MAAM,CAAC,eAAe;oBACxB,CAAC,CAAC,SAAS;aACd,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAtCe,qBAAA,IAAI,OAsCnB,CAAA;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,SAAgB,YAAY,CAC1B,aAAqB,EACrB,UAAkB;QAElB,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;QAClC,IACE,KAAK,KAAK,IAAI;YACd,KAAK,CAAC,UAAU,KAAK,UAAU;YAC/B,KAAK,CAAC,eAAe,KAAK,SAAS,EACnC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACH,OAAO,CACL,iBAAE;iBACC,YAAY,CACX,mBAAI,CAAC,IAAI,CACP,aAAa,EACb,iDAAuB,CAAC,iCAAiC,CAC1D,EACD,MAAM,CACP;iBACA,IAAI,EAAE,KAAK,UAAU;gBACxB,iBAAE,CAAC,YAAY,CACb,mBAAI,CAAC,IAAI,CACP,aAAa,EACb,iDAAuB,CAAC,iCAAiC,CAC1D,EACD,MAAM,CACP,KAAK,GAAG,KAAK,CAAC,eAAe,IAAI,CACnC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAlCe,qBAAA,YAAY,eAkC3B,CAAA;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,SAAgB,IAAI,CAAC,KAAc;QACjC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,iBAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;YAC9D,OAAO,KAAK,CAAC;QACf,OAAO,IAAA,qCAAiB,EAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC;IAC1D,CAAC;IAJe,qBAAA,IAAI,OAInB,CAAA;IAED;;;;;;;;;;;;;;;OAeG;IACH,SAAgB,QAAQ,CAAC,KAAc;QACrC,MAAM,OAAO,GACX,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,CAAC,SAAS,EAAE,CAAC;QACxE,OAAO,OAAO,KAAK,CAAC,GAAG,OAAO,KAAK,CAAC,QAAQ,GAAG,OAAO,EAAE,CAAC;IAC3D,CAAC;IAJe,qBAAA,QAAQ,WAIvB,CAAA;AACH,CAAC,EAlMgB,oBAAoB,aAApB,oBAAoB,GAApB,oBAAoB,QAkMpC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ttsc",
-  "version": "0.31.3",
+  "version": "0.31.5",
   "description": "General-purpose TypeScript-Go compiler, runtime, plugin host, and LSP host.",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -61,13 +61,13 @@
   },
   "optionalDependencies": {
     "fsevents": "^2.3.3",
-    "@ttsc/linux-arm": "0.31.3",
-    "@ttsc/linux-x64": "0.31.3",
-    "@ttsc/linux-arm64": "0.31.3",
-    "@ttsc/darwin-arm64": "0.31.3",
-    "@ttsc/darwin-x64": "0.31.3",
-    "@ttsc/win32-x64": "0.31.3",
-    "@ttsc/win32-arm64": "0.31.3"
+    "@ttsc/linux-arm": "0.31.5",
+    "@ttsc/linux-x64": "0.31.5",
+    "@ttsc/linux-arm64": "0.31.5",
+    "@ttsc/darwin-x64": "0.31.5",
+    "@ttsc/win32-x64": "0.31.5",
+    "@ttsc/darwin-arm64": "0.31.5",
+    "@ttsc/win32-arm64": "0.31.5"
   },
   "sideEffects": [
     "./lib/register.js",

package/src/compiler/internal/build/BuildExecution.ts

@@ -195,10 +195,16 @@ export namespace BuildExecution {
         compilerArgsCwd !== execution.projectRoot &&
         JSON.parse(tsgoArgs).length !== 0
       ) {
-        if (plugin?.capabilities?.compilerArgsCwd !== true)
-          throw new Error(
-            `ttsc: native host ${plugin?.name ?? "(unselected)"} does not support separate compiler argument cwd`,
-          );
+        // WARNING: NEVER reject a host here for not declaring
+        // `compilerArgsCwd`. Every native host, a plugin library's own
+        // executable such as typia's among them, is built against this
+        // installed ttsc's driver (the build replaces
+        // github.com/samchon/ttsc/packages/ttsc with it), and that driver's
+        // LoadProgram reads this variable beside TTSC_TSGO_ARGS itself. A host
+        // that bypasses that fallback ignores the forwarded arguments as a
+        // whole, so nothing can resolve against the wrong directory. Libraries
+        // published before the capability existed cannot declare it, and
+        // rejecting them broke them outright.
         SidecarEnvironment.write(env, TSGO_ARGS_CWD_ENV, compilerArgsCwd);
       } else {
         SidecarEnvironment.write(env, TSGO_ARGS_CWD_ENV, undefined);
@@ -673,12 +679,39 @@ export namespace BuildExecution {
         TsgoArguments.createNativeBuildTsgoArgs(execution, options),
       );
     if (options.forceEmitProvenance !== true) return run();
-    if (host.capabilities?.emitProvenance !== true) {
-      throw new Error(
-        `ttsc: selected native compiler host ${host.name ?? host.binary} does not support required emit provenance`,
-      );
-    }
-    return captureNativeEmitProvenance(run);
+    if (host.capabilities?.emitProvenance === true)
+      return captureNativeEmitProvenance(run);
+    // WARNING: NEVER reject a compiler host for lacking `emitProvenance`.
+    //
+    // Plugin libraries such as typia ship their own Go executable host with its
+    // own argv parser, built against whatever ttsc release the user installed.
+    // They cannot accept `--emit-provenance-json`, and they will not declare a
+    // capability added after they were published. Throwing "does not support
+    // required emit provenance" here broke every such library under ttsx and
+    // every other provenance-requiring caller at once. A new ttsc requirement
+    // must never turn into a hard failure for a host that predates it.
+    //
+    // Run the host unchanged and observe its ownership from outside instead:
+    // the selected tsgo answers the read-only configuration and source-list
+    // probes for the same tsconfig, and the outputs whose metadata moved across
+    // the run are the host's writes. Layouts those probes cannot cover leave
+    // ownership unknown, which the caller reports, exactly as for plain tsgo.
+    return runExternalEmitProvenance({
+      args: TsgoArguments.createTsgoBuildArgs(execution, options, {
+        listEmittedFiles: false,
+      }),
+      binary: execution.tsgo.binary,
+      cwd: execution.compilerSelection.compilerArgsCwd,
+      env: compilerEnv(options.env),
+      run: () => {
+        const result = run();
+        return {
+          completedNormally: result.processCompletedNormally === true,
+          result,
+        };
+      },
+      writes: "observed",
+    });
   }
 
   /**

package/src/compiler/internal/build/runExternalEmitProvenance.ts

@@ -37,6 +37,12 @@ import { PassthroughFlags } from "./PassthroughFlags";
  * supported upstream naming subset; this adapter does not certify arbitrary
  * compiler behavior.
  *
+ * A foreign compiler host that cannot report its writes, a plugin library's own
+ * executable built before ttsc required provenance, is observed instead: the
+ * selected tsgo answers the same read-only probes, the host runs unchanged, and
+ * its writes are the predicted outputs whose metadata moved across the run.
+ * Requiring provenance must never reject such a host outright.
+ *
  * Normally reported ownerless outputs carry their actual failed proof boundary
  * in emittedSourceProofFailures. These explanations preserve compiler streams
  * and status; they do not replace missing ownership with a successful claim.
@@ -63,6 +69,16 @@ export function runExternalEmitProvenance(options: {
   /** Same child environment used by the emitting command. */
   env: NodeJS.ProcessEnv;
 
+  /**
+   * How the emitting command's writes are known. `reported` (the default) reads
+   * the producer's own `TSFILE:` rows. `observed` serves a foreign compiler
+   * host that cannot report them, a plugin library's own executable such as
+   * typia's: `binary` and `args` then only drive the read-only probes, the
+   * callback runs that host unchanged, and a write is a predicted output whose
+   * metadata moved across the run.
+   */
+  writes?: "reported" | "observed";
+
   /**
    * Execute the single emitting command, preserving raw output and whether the
    * child exited normally rather than being killed during reporting.
@@ -79,15 +95,22 @@ export function runExternalEmitProvenance(options: {
   const probe = prepareProbe(options, (reason) => {
     refusal = reason;
   });
+  const observed = options.writes === "observed";
+  const outputsBefore =
+    observed && probe !== undefined
+      ? observePredictedOutputs(probe)
+      : undefined;
   const { result, completedNormally } = options.run(
-    probe === undefined
+    probe === undefined || observed
       ? options.args
       : [...options.args, "--listFiles", "true", "--listEmittedFiles", "true"],
   );
   const lines = result.stdout.split(/\r?\n/);
   const sourceLines = new Set(probe?.files);
   const stdout =
-    probe === undefined || probe.config.compilerOptions.listFiles === true
+    probe === undefined ||
+    observed ||
+    probe.config.compilerOptions.listFiles === true
       ? result.stdout
       : result.stdout
           .split(/(?<=\n)/)
@@ -100,7 +123,12 @@ export function runExternalEmitProvenance(options: {
       emittedSourceProofFailures: undefined,
       stdout,
     };
-  const written = writtenJavaScript(result.stdout, options.cwd);
+  const written =
+    outputsBefore !== undefined
+      ? movedOutputs(outputsBefore)
+      : observed
+        ? []
+        : writtenJavaScript(result.stdout, options.cwd);
   const emittedSources: Record<string, readonly string[]> = Object.create(null);
   const emittedSourceProofFailures: Record<string, string> =
     Object.create(null);
@@ -115,7 +143,11 @@ export function runExternalEmitProvenance(options: {
     };
   }
 
-  const listed = compilerSourceList(lines, options.cwd);
+  // An observed host lists nothing; it compiles the same selected tsconfig, and
+  // the source observations below still prove that selection held still.
+  const listed = observed
+    ? probe.files
+    : compilerSourceList(lines, options.cwd);
   const sameSelection = JSON.stringify(listed) === JSON.stringify(probe.files);
 
   let stable = sameSelection;
@@ -554,6 +586,54 @@ function createOutputPrediction(
   };
 }
 
+/**
+ * Every output the selected sources predict, with its metadata before an
+ * observed host runs.
+ */
+function observePredictedOutputs(probe: {
+  base: string;
+  config: { compilerOptions: Record<string, unknown> };
+  files: readonly string[];
+}): Map<string, string> {
+  const predict = createOutputPrediction(probe.config, probe.base);
+  const outputs = new Map<string, string>();
+  for (const source of probe.files)
+    for (const output of predict(source))
+      outputs.set(output, outputObservation(output));
+  return outputs;
+}
+
+/**
+ * The predicted outputs an observed host wrote: present now, with metadata
+ * other than before. A rewrite inside one clock tick at the same size and inode
+ * stays invisible, which is why a host that can report its writes must declare
+ * `emitProvenance` instead.
+ */
+function movedOutputs(before: ReadonlyMap<string, string>): string[] {
+  const written: string[] = [];
+  for (const [output, observation] of before) {
+    const after = outputObservation(output);
+    if (after !== "missing" && after !== observation) written.push(output);
+  }
+  return written;
+}
+
+/** Device, inode, size and both clocks of one output, or `missing`. */
+function outputObservation(file: string): string {
+  try {
+    const stats = fs.lstatSync(file, { bigint: true });
+    return [
+      stats.dev,
+      stats.ino,
+      stats.size,
+      stats.mtimeNs,
+      stats.ctimeNs,
+    ].join(":");
+  } catch {
+    return "missing";
+  }
+}
+
 /** The writer's TSFILE report, rather than existing files, establishes writes. */
 function writtenJavaScript(stdout: string, cwd: string): string[] {
   const outputs = new Set<string>();

package/src/internal/E2ETrace.ts

@@ -62,6 +62,7 @@ export namespace E2ETrace {
           owner?: { hostname: string; pid: number };
           result: string;
           errorCode?: string;
+          state?: string;
         },
       ) => void)
     | undefined {
@@ -86,6 +87,7 @@ export namespace E2ETrace {
           owner?: { hostname: string; pid: number };
           result: string;
           errorCode?: string;
+          state?: string;
         },
       ): void => {
         try {

package/src/internal/probeLocalProcess.ts

@@ -0,0 +1,61 @@
+import fs from "node:fs";
+
+/**
+ * Observe whether process `pid` on this host is still running.
+ *
+ * Signal zero answers whether the kernel still holds a process with that id.
+ * Only `ESRCH` proves absence; `EPERM` and other failures remain unknown. On
+ * Linux a successful probe can still name a zombie: a process that has exited
+ * and holds its id only until its parent collects its status. A parent that
+ * never collects, such as a container's PID 1 that is not an init or a
+ * subreaper that collects only when its own command ends, keeps the zombie
+ * indefinitely, so its `/proc` status reports it absent too. A leader whose own
+ * thread exited also reads as a zombie while its other threads run, so the
+ * zombie must be the process's last thread. Its id cannot be reused while the
+ * zombie holds it, so this never names a live process absent. An absent answer
+ * carries its evidence: ESRCH, the /proc read's code when collection raced it,
+ * or the zombie's state, so a diagnostic reader can check which one held.
+ *
+ * @evidence contracts/common.md#principled-implementation ESRCH, or a Linux /proc status of zombie or dead with no other thread, proves the process exited; success with any other status is presence, and every other failure stays unknown.
+ * @evidence contracts/common.md#clear-and-simple-design One probe gives the ttsx run, dependency-lock and plugin-lock owners the same exit decision.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts The native signal-zero probe and the kernel's own process status decide; no PID list, timeout or error-to-absent fallback substitutes for them.
+ * @evidence contracts/common.md#meaningful-documentation The paragraph explains why a zombie answers signal zero, which parents leave one behind, why a zombie leader with running threads is not one, and why its id cannot name a live process.
+ * @evidence contracts/portability.md#os-neutral-implementation Node's signal-zero probe works on every platform; only Linux exposes zombies through /proc, and elsewhere the probe's answer stands.
+ * @evidence contracts/performance.md#efficient-algorithms One syscall, plus one small /proc read on Linux when the process exists.
+ * @evidenceExclude contracts/performance.md#reuse-equivalent-work Process state is a current observation and is never cached as proof for a later decision.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The probe retains no handle; the status text becomes reclaimable on return.
+ */
+export function probeLocalProcess(pid: number): {
+  result: "present" | "absent" | "unknown";
+  errorCode?: string;
+
+  /** The Linux /proc state that proved an exited process absent. */
+  state?: string;
+} {
+  try {
+    process.kill(pid, 0);
+  } catch (error) {
+    const code = (error as NodeJS.ErrnoException | null)?.code;
+    return { result: code === "ESRCH" ? "absent" : "unknown", errorCode: code };
+  }
+  if (process.platform !== "linux") return { result: "present" };
+  let status: string;
+  try {
+    status = fs.readFileSync(`/proc/${pid}/status`, "utf8");
+  } catch (error) {
+    const code = (error as NodeJS.ErrnoException | null)?.code;
+    // The process was collected between the probe and the read.
+    if (code === "ENOENT" || code === "ESRCH")
+      return { result: "absent", errorCode: code };
+    return { result: "unknown", errorCode: code };
+  }
+  // A leader whose own thread exited reads as a zombie while its other threads
+  // still run; only a zombie that is the process's last thread has exited.
+  const state = /^State:\s*(\S)/m.exec(status)?.[1];
+  const threads = /^Threads:\s*(\d+)/m.exec(status)?.[1];
+  // The state travels with an absent answer: signal zero succeeded, so it is the
+  // only evidence of the exit a diagnostic reader can check.
+  return (state === "Z" || state === "X") && threads === "1"
+    ? { result: "absent", state }
+    : { result: "present" };
+}

package/src/launcher/internal/runtime/ProcessOwnedDirectory.ts

@@ -53,6 +53,9 @@ export namespace ProcessOwnedDirectory {
 
     /** Native code already caught by the operation, if it supplied one. */
     errorCode?: string;
+
+    /** The Linux /proc state that proved an exited owner absent. */
+    state?: string;
   }
 
   /**
@@ -192,12 +195,13 @@ export namespace ProcessOwnedDirectory {
           owner,
           observe === undefined
             ? undefined
-            : (result, errorCode) =>
+            : (result, errorCode, state) =>
                 report(observe, {
                   record: name,
                   owner,
                   result,
                   ...(errorCode === undefined ? {} : { errorCode }),
+                  ...(state === undefined ? {} : { state }),
                 }),
         )
       )

package/src/launcher/internal/runtime/isLocalProcessGone.ts

@@ -1,15 +1,17 @@
 import os from "node:os";
 
+import { probeLocalProcess } from "../../../internal/probeLocalProcess";
+
 /**
  * Whether the process an owner record names has certainly exited: it ran on
  * this host, and no process with its pid is alive.
  *
  * A record from another host proves nothing, because its pid names a process
  * this machine cannot see, so it is never reported gone. An `EPERM` from the
- * probe does not establish absence, so it counts as alive. Only `ESRCH` proves
- * absence; other probe failures remain unknown. A recycled pid makes the answer
- * err toward "alive": a caller that reclaims on "gone" never takes a live
- * owner's state.
+ * probe does not establish absence, so it counts as alive. Only `ESRCH`, or a
+ * Linux zombie that has exited but was never collected, proves absence; other
+ * probe failures remain unknown. A recycled pid makes the answer err toward
+ * "alive": a caller that reclaims on "gone" never takes a live owner's state.
  *
  * Callers supply a validated positive process id, not a process-group selector.
  * Hostname comparison is a host-label convention, not machine authentication:
@@ -18,13 +20,13 @@ import os from "node:os";
  * An optional diagnostic receives this same observation without another probe;
  * a diagnostic failure cannot change the ownership decision.
  *
- * @evidence contracts/common.md#principled-implementation Reclamation requires both the recorded local hostname and ESRCH from the native pid probe; permission, invalid-pid and unknown failures cannot establish that an owner is gone.
- * @evidence contracts/common.md#clear-and-simple-design One conservative predicate supplies the same owner-liveness decision to lock recovery and directory sweeping.
- * @evidence contracts/common.md#prohibited-implementation-shortcuts Native process existence is queried through process.kill(pid, 0); no fixture pid or broad error-to-dead fallback substitutes for ownership evidence.
- * @evidence contracts/common.md#meaningful-documentation The native explanation distinguishes a remote host, a denied or unknown probe and pid recycling, stating why ambiguity protects a live owner's state.
+ * @evidence contracts/common.md#principled-implementation Reclamation requires both the recorded local hostname and probeLocalProcess's absence proof, ESRCH or an uncollected Linux zombie; permission, invalid-pid and unknown failures cannot establish that an owner is gone.
+ * @evidence contracts/common.md#clear-and-simple-design One conservative predicate supplies the same owner-liveness decision to lock recovery and directory sweeping, and shares its probe with plugin build locks.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Native process existence is queried through process.kill(pid, 0) and the kernel's /proc state; no fixture pid or broad error-to-dead fallback substitutes for ownership evidence.
+ * @evidence contracts/common.md#meaningful-documentation The native explanation distinguishes a remote host, a denied or unknown probe, an uncollected zombie and pid recycling, stating why ambiguity protects a live owner's state.
  * @evidence contracts/portability.md#os-neutral-implementation Node exposes the host's process-existence probe and portable error codes; hostname comparison scopes pid identity to this host without assuming POSIX signals can terminate Windows processes.
  * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources This observation retains no handle, historical state or cache; temporary lowercase hostname strings become reclaimable after return.
- * @evidence contracts/performance.md#efficient-algorithms Native hostname lookup and two lowercase string constructions/comparison process host-label text before at most one native pid probe; the fixed probe count is not a fixed text or operating-system cost.
+ * @evidence contracts/performance.md#efficient-algorithms Native hostname lookup and two lowercase string constructions/comparison process host-label text before at most one native pid probe and, on Linux, one /proc state read; the fixed probe count is not a fixed text or operating-system cost.
  * @evidenceExclude contracts/performance.md#reuse-equivalent-work Host labels and native process existence are current observations; this predicate coordinates no cross-call cache or reusable liveness proof.
  */
 export function isLocalProcessGone(
@@ -38,14 +40,16 @@ export function isLocalProcessGone(
   observe?: (
     result: "remote" | "present" | "absent" | "unknown",
     errorCode?: string,
+    state?: string,
   ) => void,
 ): boolean {
   const report = (
     result: "remote" | "present" | "absent" | "unknown",
     errorCode?: string,
+    state?: string,
   ): void => {
     try {
-      observe?.(result, errorCode);
+      observe?.(result, errorCode, state);
     } catch {
       // Diagnostics own no policy.
     }
@@ -54,14 +58,7 @@ export function isLocalProcessGone(
     report("remote");
     return false;
   }
-  try {
-    process.kill(owner.pid, 0);
-    report("present");
-    return false;
-  } catch (error) {
-    const code = (error as NodeJS.ErrnoException | null)?.code;
-    const absent = code === "ESRCH";
-    report(absent ? "absent" : "unknown", code);
-    return absent;
-  }
+  const { result, errorCode, state } = probeLocalProcess(owner.pid);
+  report(result, errorCode, state);
+  return result === "absent";
 }

package/src/launcher/internal/watch/FseventsStreams.ts

@@ -1,4 +1,5 @@
 import { EventEmitter } from "node:events";
+import fs from "node:fs";
 import path from "node:path";
 
 import type { DirectoryWatcher } from "./DirectoryWatcher";
@@ -116,6 +117,7 @@ export class FseventsStreams {
     const displaced = [...(this.descendants.get(directory) ?? [])];
     const stream: Stream = {
       active: true,
+      openedAt: Date.now(),
       root: directory,
       stop: () => undefined,
       watches: new Map(),
@@ -209,6 +211,9 @@ type Watch = {
 
 type Stream = {
   active: boolean;
+
+  /** When the stream opened; nothing born before it was created in it. */
+  openedAt: number;
   root: string;
   stop: () => unknown;
   watches: Map<string, Set<Watch>>;
@@ -218,6 +223,8 @@ type Stream = {
 const GAP = 0x1 | 0x2 | 0x4 | 0x8 | 0x20 | 0x40 | 0x80;
 const MODIFIED = 0x400 | 0x1000 | 0x2000 | 0x4000 | 0x8000;
 const RENAMED = 0x100 | 0x200 | 0x800;
+const CREATED = 0x100;
+const MOVED = 0x200 | 0x800;
 
 function addWatch(stream: Stream, watch: Watch): void {
   const watches = stream.watches.get(watch.directory) ?? new Set<Watch>();
@@ -248,6 +255,21 @@ function deliver(stream: Stream, file: string, flags: number): void {
     deliverGap(stream);
     return;
   }
+  // FSEvents keeps ItemCreated on later writes to a path it saw created, so a
+  // plain edit of a file older than this stream arrived as a rename. An object
+  // born before the stream opened was not created in it; its other flags
+  // decide. A removal or a rename keeps the event structural.
+  if (
+    (flags & CREATED) !== 0 &&
+    (flags & MOVED) === 0 &&
+    (flags & MODIFIED) !== 0
+  ) {
+    try {
+      if (fs.lstatSync(target).birthtimeMs < stream.openedAt) flags &= ~CREATED;
+    } catch {
+      // A path gone by now keeps its creation flag.
+    }
+  }
   const event =
     (flags & MODIFIED) !== 0 && (flags & RENAMED) === 0 ? "change" : "rename";
   const deliveries: Array<{ name: string; watch: Watch }> = [];

package/src/plugin/internal/load/loadProjectPlugins.ts

@@ -529,17 +529,16 @@ export function loadProjectPlugins(options: {
       records[candidate.index]!.kind === "executable" &&
       !proposals[candidate.index]!.ownModule,
   );
+  const buildDirectories = pluginBuildDirectories(
+    records,
+    effectiveEnv,
+    watchReplacements,
+    packageReaders,
+  );
   // Admission can now narrow the provisional interests without restamping the
   // retained package/module baselines. Final host errors still keep these roots.
-  options.onWatchInputs?.(
-    pluginBuildDirectories(
-      records,
-      effectiveEnv,
-      watchReplacements,
-      packageReaders,
-    ),
-    sourceIdentities,
-  );
+  options.onWatchInputs?.(buildDirectories, sourceIdentities);
+  const keyedDirectories = new Set(buildDirectories);
   const linkedContributors = records
     .filter((record) => record.stage === "transform")
     .flatMap((record) =>
@@ -737,8 +736,10 @@ export function loadProjectPlugins(options: {
       binary,
       // This fallback is compiled from our utility-host, whose actual writer
       // publishes provenance and supports a separate compiler argument cwd.
-      // A separately selected executable host must opt
-      // in itself; a linked library cannot certify that foreign host.
+      // A separately selected executable host must opt in itself; a linked
+      // library cannot certify that foreign host. An undeclared capability
+      // only withholds the optional protocol: build execution still runs such
+      // a host and observes it from outside, never rejecting it.
       capabilities:
         record.stage === "transform" &&
         record.kind === "linked" &&
@@ -781,10 +782,12 @@ export function loadProjectPlugins(options: {
       ? { observationsComplete: false as const }
       : {}),
     // The directories the watch inputs named before the builds, as the builds
-    // read them.
+    // read them. Package selection shares these readings and also reads a
+    // linked plugin's module root, which no build keys on, so only the build
+    // directories are reported.
     pluginSources: Object.fromEntries(
       [...sourceDigests]
-        .filter(([directory]) => reportsPluginSource(directory))
+        .filter(([directory]) => keyedDirectories.has(directory))
         .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
         .map(([directory, sourceDigest]) => [
           directory,

package/src/plugin/internal/source/GoBuildCacheCoordination.ts

@@ -322,6 +322,9 @@ export namespace GoBuildCacheCoordination {
     // the child process required for `go build`. The fallback inherits only the
     // low standard descriptors and checks its parent PID. An IPC channel would
     // allocate another high descriptor and recreate Darwin's spawn EBADF limit.
+    // A dead parent that nobody collects stays a zombie and still answers
+    // signal zero, but POSIX reparents the heartbeat when its parent exits, so
+    // a changed parent id ends it as well; Windows never reparents.
     const ready = `${file}.heartbeat-${crypto.randomBytes(16).toString("hex")}`;
     let heartbeatChild: ReturnType<typeof spawn> | undefined;
     try {
@@ -334,7 +337,7 @@ export namespace GoBuildCacheCoordination {
           "const parent = Number(process.argv[3]);",
           "const ready = process.argv[4];",
           "const timer = setInterval(() => {",
-          "  try { process.kill(parent, 0); } catch { clearInterval(timer); process.exit(0); }",
+          "  try { if (process.ppid !== parent) throw 0; process.kill(parent, 0); } catch { clearInterval(timer); process.exit(0); }",
           "  try {",
           '    if (JSON.parse(fs.readFileSync(file, "utf8")).status === "complete") {',
           "      clearInterval(timer); process.exit(0);",