ttsc 0.32.1 → 0.33.0

package/src/compiler/internal/build/BuildExecution.ts

@@ -116,14 +116,16 @@ export namespace BuildExecution {
    *
    * Caller-provided values override inherited defaults, except the invocation's
    * selected compiler remains authoritative. Absent per-invocation payloads
-   * remove stale inherited state rather than leaking an ancestor's project.
+   * remove stale inherited state rather than leaking an ancestor's project. The
+   * emitting-watch write policy is always cleared here and only the selected
+   * build command may arm it for its direct native child.
    *
-   * @evidence contracts/common.md#principled-implementation Environment layering preserves caller overrides while the resolved compiler wins last; per-run compiler/config/link payloads are published or cleared according to invocation ownership.
+   * @evidence contracts/common.md#principled-implementation Environment layering preserves caller overrides while the resolved compiler wins last; per-run compiler/config/link payloads are published or cleared according to invocation ownership, and the emitting-watch write policy is cleared until an authorized build child selects it.
    * @evidence contracts/common.md#clear-and-simple-design Shared environment helpers own merging and key access; runtime discovery precedes the pure composer that owns invocation payload publication.
    * @evidence contracts/common.md#prohibited-implementation-shortcuts Supported environment channels convey compiler/plugin context without patching strict sidecar parsers; clearing inherited payloads corrects ownership rather than compensating for a stale ancestor selection.
    * @evidence contracts/common.md#meaningful-documentation Native paragraphs explain config anchoring, linked sources, precedence and absent-payload effects without mixing prose into tags.
    * @evidence contracts/portability.md#os-neutral-implementation Native environment helpers normalize Windows key aliases while retaining POSIX case distinctions; node:path builds the default launcher path and binary values remain native executable selections.
-   * @evidence contracts/performance.md#efficient-algorithms Environment layering copies inherited/caller fields, and Windows channel reads/writes repeatedly scan native-equivalent key names with key-text normalization costs. Linked selection/projection/JSON adds plugin count and payload work. Ordered runtime-candidate probes are delegated before publication and remain native process costs of this call.
+   * @evidence contracts/performance.md#efficient-algorithms Environment layering copies inherited/caller fields, and Windows channel reads/writes repeatedly scan native-equivalent key names with key-text normalization costs, including one write-policy removal. Linked selection/projection/JSON adds plugin count and payload work. Ordered runtime-candidate probes are delegated before publication and remain native process costs of this call.
    *
    * @evidenceExclude contracts/performance.md#reuse-equivalent-work Fresh environment composition depends on current invocation and mutable process environment, and coordinates no persistent producer.
    * @evidence contracts/performance.md#bound-retention-and-release-resources The fresh environment and intermediate linked payload have invocation-local ownership and transfer to the spawn caller. Runtime probe acquisition/timeout/cleanup belongs to the capability owner, not a native-release guarantee made here; this function stores no child handle or global payload.
@@ -149,6 +151,9 @@ export namespace BuildExecution {
       // The invocation's resolved compiler owns the final environment layer.
       { TTSC_TSGO_BINARY: execution.tsgo.binary },
     );
+    // This opt-in belongs to an emitting watch child, never to a nested build
+    // or a host reached through an inherited process environment.
+    SidecarEnvironment.write(env, "TTSC_WATCH_WRITE_IF_CHANGED", undefined);
     return composeNativePluginEnv(
       env,
       extra,
@@ -164,9 +169,11 @@ export namespace BuildExecution {
    *
    * The caller owns the fresh environment and the selected Node executable.
    * Executable capability discovery remains at the native spawn boundary; this
-   * composer only writes protocol values and removes stale payloads.
+   * composer only writes protocol values and removes stale payloads. The
+   * invocation's opened content-identity store supplies native config-loader
+   * scratch placement, or clears an inherited store when none was opened.
    *
-   * @evidence contracts/common.md#principled-implementation The selected compiler and Node executable own their channels; config, forwarded arguments and linked transforms are published or cleared according to this invocation and explicit caller ownership.
+   * @evidence contracts/common.md#principled-implementation The selected compiler and Node executable own their channels; config, content-identity scratch root, forwarded arguments and linked transforms are published or cleared according to this invocation and explicit caller ownership.
    * @evidence contracts/common.md#clear-and-simple-design A synchronous payload composer consumes the existing merged environment, keeping native executable discovery in nativePluginEnv without copying environment layers again.
    * @evidence contracts/common.md#prohibited-implementation-shortcuts Supplied executable selections are preserved without guessing capabilities, launching a substitute producer or mutating the global environment.
    * @evidence contracts/common.md#meaningful-documentation Native prose states the required fresh layered environment, caller ownership and the separation of runtime discovery from protocol publication.
@@ -186,6 +193,11 @@ export namespace BuildExecution {
     CompilerProjectSelection.assertCurrent(execution.compilerSelection);
     SidecarEnvironment.write(env, "TTSC_NODE_BINARY", nodeBinary);
     SidecarEnvironment.write(env, "TTSC_TSGO_BINARY", execution.tsgo.binary);
+    SidecarEnvironment.write(
+      env,
+      "TTSC_NATIVE_PLUGIN_RECORD_ROOT",
+      execution.identities?.root,
+    );
     // Forwarded tsgo argv is per-invocation state this host owns, exactly like
     // the config anchor below: publish this run's payload, or drop whatever an
     // ancestor ttsc process left behind when this lane forwards nothing.
@@ -1104,7 +1116,7 @@ export namespace BuildExecution {
    * intact.
    */
   function runNativeCheckPlugins(
-    options: TtscBuildOptions,
+    options: RunBuildOptions,
     execution: ReturnType<typeof resolveExecutionContext>,
     timing: BuildTiming.BuildTiming,
   ): TtscBuildResult {
@@ -1133,7 +1145,7 @@ export namespace BuildExecution {
             "ttsc.check",
             timing,
             `ttsc check plugin ${plugin.name} time`,
-            TsgoArguments.createNativeTsgoArgs(options),
+            TsgoArguments.createNativeCheckTsgoArgs(execution, options),
           ),
         args[0],
       );
@@ -1212,7 +1224,7 @@ export namespace BuildExecution {
    * the elapsed interval also includes environment preparation, not only
    * execution of the selected plugin.
    *
-   * @evidence contracts/common.md#principled-implementation The selected plugin receives the composed invocation context, and actual exit status/output become a normalized result while native launch errors remain thrown failures.
+   * @evidence contracts/common.md#principled-implementation The selected plugin receives the composed invocation context; only an emitting watch build child receives the write-if-changed opt-in. Actual exit status/output become a normalized result while native launch errors remain thrown failures.
    * @evidence contracts/common.md#clear-and-simple-design One command boundary owns environment publication, timing and output normalization for native build and check phases.
    * @evidence contracts/common.md#prohibited-implementation-shortcuts Execution uses the loaded binary and supported protocol rather than patching its implementation or manufacturing success on launch failure.
    * @evidence contracts/common.md#meaningful-documentation Native prose distinguishes result failures, thrown launch failures and error/timing label attribution.
@@ -1226,7 +1238,7 @@ export namespace BuildExecution {
   export function runNativePluginCommand(
     plugin: ITtscLoadedNativePlugin,
     args: readonly string[],
-    options: TtscBuildOptions,
+    options: RunBuildOptions,
     execution: ReturnType<typeof resolveExecutionContext>,
     label: string,
     timing: BuildTiming.BuildTiming,
@@ -1234,9 +1246,17 @@ export namespace BuildExecution {
     tsgoArgs?: string,
   ): TtscBuildResult {
     const startedAt = process.hrtime.bigint();
+    const env = nativePluginEnv(options.env, execution, plugin, tsgoArgs);
+    if (
+      label === "ttsc.build" &&
+      options.emit !== false &&
+      options.watchWriteIfChanged === true
+    ) {
+      SidecarEnvironment.write(env, "TTSC_WATCH_WRITE_IF_CHANGED", "1");
+    }
     const res = spawnNative(plugin.binary, args, {
       cwd: execution.projectRoot,
-      env: nativePluginEnv(options.env, execution, plugin, tsgoArgs),
+      env,
       encoding: "utf8",
     });
     BuildTiming.recordTiming(timing, timingLabel, startedAt);

package/src/compiler/internal/build/ResidentCheckWatchSession.ts

@@ -20,13 +20,13 @@ import { residentCheckRequest } from "./residentCheckRequest";
 import { takeResidentCheckEntryRequest } from "./takeResidentCheckEntryRequest";
 
 /**
- * Analysis-only watch coordinator.
+ * Watch coordinator for retained project selection and analysis-only Programs.
  *
  * The selected project and compatible check-stage processes stay resident
  * across ordinary source/data edits. A config, root-set, contributor, or plugin
  * topology transition calls for a full reset before the next cycle. Emit and
- * transform lanes can pass through the coordinator, but compatibility checks
- * keep them on the established one-shot path without starting sidecars.
+ * transform lanes retain only project and plugin selection; each cycle runs a
+ * fresh one-shot build without starting resident check sidecars.
  *
  * The watch launcher must serialize cycles and use reload when invocation
  * selection or startup environment changes. A session does not independently
@@ -34,13 +34,13 @@ import { takeResidentCheckEntryRequest } from "./takeResidentCheckEntryRequest";
  * `TTSC_WATCH_DEBUG_INPUTS` reports why selection is reset and the active
  * sidecar count being retired, and distinguishes a failed resident transport.
  *
- * @evidence contracts/common.md#principled-implementation Stable invocation selection and serialized cycles let compatible analysis-only checks retain their Program; explicit reload and observed input-topology changes reset selection before another cycle. Initial capture and warm refresh await the watch owner's publication before retaining topology; warm refresh compares physical dependency identity while publishing every declared-alias update.
+ * @evidence contracts/common.md#principled-implementation Stable invocation selection and serialized cycles let compatible analysis-only checks retain their Program and emitting lanes retain only selection; explicit reload and observed input-topology changes reset selection before another cycle. Initial capture and warm refresh await the watch owner's publication before retaining topology; warm refresh compares physical dependency identity while publishing every declared-alias update.
  * @evidence contracts/common.md#clear-and-simple-design The session owns selected execution, dependency snapshot, process identities and per-entry delivery buffers while shared BuildExecution owns one-shot phase and failure policy. Initial capture wraps the existing discovery callback, and warm refresh joins discovery, comparison and watch registration without another topology owner.
  * @evidence contracts/common.md#prohibited-implementation-shortcuts Capability-aware residency retains the actual transport-failure one-shot path and distinct configured check positions. Pending or rejected registration cannot restamp topology, and unchanged physical dependencies cannot bypass declared-alias publication.
  * @evidence contracts/common.md#meaningful-documentation Native paragraphs state supported lanes, reset causes and the caller's serialization/stable-invocation premise; private capture and refresh prose distinguish committed topology, physical comparison and declared-alias publication, while run and dispose document lifecycle effects.
  * @evidence contracts/portability.md#os-neutral-implementation Native filesystem checks, cache touch helpers and child creation retain selected binary paths and delegated executable/argv/environment handling. BuildExecution owns native discovery and path normalization; initial capture forwards its snapshot without native operations and warm comparison preserves physical and declared representations.
  * @evidence contracts/performance.md#efficient-algorithms Per-cycle command planning, key serialization and buffer unions process configured checks and pending path text; sorting/comparison bytes, native cache observations, subscribed input discovery and delegated checks add work. Initial capture adds one shallow options copy and one awaited callback; warm refresh adds one native discovery, linear normalized comparison and callback, avoiding reset when topology is unchanged. Accumulated output can repeatedly copy earlier phase text.
- * @evidence contracts/performance.md#reuse-equivalent-work Process keys include binary/name/argv/compiler payload, while stable invocation context and reload guard the remaining startup inputs. Accepted snapshots serve warm topology comparison only after watch registration completes; execution reuse also requires equal physical dependency topology.
+ * @evidence contracts/performance.md#reuse-equivalent-work Process keys include binary/name/argv/compiler payload, while stable invocation context and reload guard the remaining startup inputs. Accepted snapshots serve warm topology comparison only after watch registration completes; execution reuse also requires equal physical dependency topology. Emitting cycles reuse descriptor and plugin selection, then load a fresh native Program.
  * @evidence contracts/performance.md#bound-retention-and-release-resources Initial capture closes over the session and caller for its build; warm handoff retains the previous and next snapshots until successful registration replaces the accepted population, while rejection preserves it. Reset clears active maps, execution and snapshots while retiring children and join promises remain separately retained. Unknown joins retain rejection and prevent replacement; delegated termination is not descendant settlement. Stable options bound active process keys by configured checks, but pending unique paths and repeated disposal chains have no independent historical ceiling.
  */
 export class ResidentCheckWatchSession {
@@ -67,20 +67,20 @@ export class ResidentCheckWatchSession {
    * stable until reload; callers must not run overlapping cycles.
    *
    * The first cycle, and any cycle after `change.reload`, resolves the project
-   * and plugins and starts resident check processes for compatible entries.
-   * Later cycles reuse them and forward `change` as an incremental request. A
+   * and plugins. Compatible check entries may then start resident processes;
+   * emitting entries reuse selection but rebuild their Program each cycle. A
    * resident process that fails is retired and its entry falls back to the
    * one-shot check for that cycle. Plugin and project watch handoffs complete
    * before checks begin; reused topology is republished through the same
    * completion boundary.
    *
-   * @evidence contracts/common.md#principled-implementation Compatible no-emit check-only selection uses the same diagnostic/failure policy as one-shot execution; reload, missing binaries and changed normalized dependency topology cold-resolve the next execution.
+   * @evidence contracts/common.md#principled-implementation Compatible no-emit check-only selection uses the same diagnostic/failure policy as one-shot execution; emitting selection retains its plugins but runs a fresh build, and reload, missing binaries and changed normalized dependency topology cold-resolve the next execution.
    * @evidence contracts/common.md#clear-and-simple-design The cycle separates setup/reuse, topology refresh, ordered checks and final diagnostics/timing, delegating each phase to its owning shared operation.
    * @evidence contracts/common.md#prohibited-implementation-shortcuts Failed resident transport retires that process and uses the established real check command; the fallback neither drops forwarded compiler options nor converts a nonzero check into success.
    * @evidence contracts/common.md#meaningful-documentation Native paragraphs document serialization, stable startup inputs, reload and failed-sidecar behavior instead of claiming arbitrary option changes are handled automatically.
    * @evidence contracts/portability.md#os-neutral-implementation Native binary existence and cache freshness use filesystem helpers; all commands preserve selected cwd and use native process/environment abstractions without shell interpolation.
-   * @evidence contracts/performance.md#efficient-algorithms Warm cycles avoid project/plugin re-resolution until a missing binary or changed subscribed topology resets selection. Native existence/cache touches, optional onProjectInputs discovery, command/key construction, per-entry unions/sorts, delegated host work and output normalization/merging retain their actual entry/text/byte costs.
-   * @evidence contracts/performance.md#reuse-equivalent-work Selected context and capability-supported sidecars survive only stable invocation cycles; change requests update Programs, reload/topology transitions reset them, and effectful configured entries remain separately scheduled.
+   * @evidence contracts/performance.md#efficient-algorithms Warm cycles avoid project/plugin re-resolution until a missing binary or changed subscribed topology resets selection. Emitting cycles still run whole-program native work; existence/cache touches, optional onProjectInputs discovery, command/key construction, per-entry unions/sorts, delegated host work and output normalization/merging retain their actual entry/text/byte costs.
+   * @evidence contracts/performance.md#reuse-equivalent-work Selected context and capability-supported check sidecars survive only stable invocation cycles; change requests update resident check Programs, while emitting cycles reuse selection and reload a fresh native Program. Reload/topology transitions reset selection, and effectful configured entries remain separately scheduled.
    * @evidence contracts/performance.md#bound-retention-and-release-resources The session retains active sidecars and per-entry pending changes; transport failure retires its process and awaits actual close before fallback. Reset clears active state but not unknown retiring ownership or its rejection. Unconsumed path sets have no finite bound while an earlier entry repeatedly fails; child close does not certify descendants.
    */
   public async run(
@@ -120,18 +120,6 @@ export class ResidentCheckWatchSession {
         await this.resetForRun("preparation-result");
         return BuildTiming.appendTimingOutput(prepared.result, timing);
       }
-      if (!residentCheckExecutionIsCompatible(buildOptions, execution)) {
-        await this.resetForRun("incompatible-execution");
-        return BuildTiming.appendTimingOutput(
-          BuildExecution.runPreparedBuild(
-            options,
-            timing,
-            execution,
-            buildOptions,
-          ),
-          timing,
-        );
-      }
       this.execution = execution;
     } else {
       // The session keeps running the plugin binaries it resolved without
@@ -161,6 +149,19 @@ export class ResidentCheckWatchSession {
       }
     }
 
+    // An emitting cycle still loads a fresh native Program. Only its stable
+    // project/plugin selection survives, so a source edit does not reevaluate
+    // descriptors while config, plugin, and input-topology changes reset it.
+    if (!residentCheckExecutionIsCompatible(buildOptions, execution)) {
+      return BuildTiming.appendTimingOutput(
+        BuildExecution.runPreparedBuild(options, timing, execution, {
+          ...buildOptions,
+          watchWriteIfChanged: true,
+        }),
+        timing,
+      );
+    }
+
     const checked = await this.runCheckPlugins(
       buildOptions,
       execution,

package/src/compiler/internal/build/RunBuildOptions.ts

@@ -10,7 +10,7 @@ import type {
  * only ttsc's own lanes set (ttsx's private runtime builds, single-file emit,
  * watch).
  *
- * @evidence contracts/common.md#principled-implementation Public build selection is intersected with internal lane controls, preserving optional defaults while distinguishing diagnostic gating, compiler-output isolation and watch callbacks.
+ * @evidence contracts/common.md#principled-implementation Public build selection is intersected with internal lane controls, preserving optional defaults while distinguishing diagnostic gating, compiler-output isolation, emitting-watch output policy and watch callbacks.
  * @evidence contracts/common.md#clear-and-simple-design Lane-specific decisions are explicit options on the shared build boundary rather than hidden global switches or duplicated compiler APIs.
  * @evidence contracts/common.md#prohibited-implementation-shortcuts Internal controls express supported runtime/watch requirements; source-map and inferred-root exceptions are documented lane policies, not test-specific escape flags.
  * @evidence contracts/common.md#meaningful-documentation Native member paragraphs explain ownership, optional-state effects and the rootDir premise, with blank lines separating documented properties.
@@ -118,6 +118,14 @@ export type RunBuildOptions = TtscBuildOptions & {
    */
   privateEmitRootDir?: string;
 
+  /**
+   * Allow the native driver used by an emitting watch transform host to leave
+   * byte-identical regular outputs in place. Only the watch coordinator sets
+   * this for a one-shot emit cycle; other builds and check commands clear the
+   * corresponding child environment channel.
+   */
+  watchWriteIfChanged?: boolean;
+
   /**
    * Receives selected native-plugin source roots after the project resolves.
    * The watch launcher uses these roots to invalidate a sidecar when its Go

package/src/compiler/internal/build/TsgoArguments.ts

@@ -220,6 +220,28 @@ export namespace TsgoArguments {
     );
   }
 
+  /**
+   * Give a check host the same private source layout as the emitting pass.
+   * Although the host checks without emitting, an injected output directory
+   * changes TypeScript-Go's inferred root during Program creation. Keep the
+   * diagnostic build-information destination separate from emitted state.
+   *
+   * @evidence contracts/common.md#principled-implementation Private runtime root policy is shared by check and emit hosts while a user's declared root retains precedence.
+   * @evidence contracts/common.md#clear-and-simple-design The existing root selector and native payload composer own the two independent decisions.
+   * @evidence contracts/common.md#prohibited-implementation-shortcuts The shipped driver consumes ordinary compiler arguments; no host flag or compiler extension is introduced.
+   * @evidence contracts/common.md#meaningful-documentation Native prose explains why a no-emit host still needs the private layout root.
+   * @evidence contracts/portability.md#os-neutral-implementation The selected native root spelling crosses the JSON argument channel without shell interpolation.
+   * @evidence contracts/performance.md#efficient-algorithms A fixed root argument pair precedes existing argument filtering and serialization.
+   * @evidenceExclude contracts/performance.md#reuse-equivalent-work The payload belongs to one invocation and retains no result.
+   * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources Only a returned string transfers to the spawn owner.
+   */
+  export function createNativeCheckTsgoArgs(
+    execution: ReturnType<typeof BuildExecution.resolveExecutionContext>,
+    options: RunBuildOptions,
+  ): string | undefined {
+    return createNativeTsgoArgs(options, pinnedRootDirArgs(execution, options));
+  }
+
   /**
    * Forward the tsgo flags ttsc did not recognize to a native sidecar as one
    * JSON-encoded payload. The sidecar replays them through tsgo's own option

package/src/compiler/internal/captureProcessOutput.ts

@@ -2,7 +2,9 @@ import fs from "node:fs";
 import path from "node:path";
 
 import { createCanonicalTempDirectory } from "../../internal/createCanonicalTempDirectory";
+import { selectedRecordIdentityTempParent } from "../../plugin/internal/source/selectedRecordIdentityTempParent";
 import type { CapturedProcessOutput } from "./CapturedProcessOutput";
+import { SidecarEnvironment } from "./sharedHost/SidecarEnvironment";
 
 /**
  * Acquire two private files and descriptors for a child's output.
@@ -12,26 +14,38 @@ import type { CapturedProcessOutput } from "./CapturedProcessOutput";
  * string limits; file capture does not make output unbounded.
  *
  * The directory is per-call, so ordinary concurrent captures use separate
- * destinations. This is not held-directory protection against namespace
- * mutation. Descriptor acquisition failures attempt rollback; cleanup failures
- * are suppressed, and the temp creator can leave an unclaimed postflight
- * allocation. The caller owns the returned capture and must dispose it after
- * reading; read failures propagate, while disposal is idempotent and cleanup is
- * best effort.
+ * destinations. A descriptor child with a selected record root captures below
+ * its existing identities directory, keeping a project-root TEMP from changing
+ * the missing-input proof during evaluation. Other callers use system TEMP.
  *
- * @evidence contracts/common.md#principled-implementation Precreated files receive exact child stream bytes through inherited descriptors; decoding happens on read, and I/O errors cannot masquerade as empty successful output.
- * @evidence contracts/common.md#clear-and-simple-design One capture owns two descriptors and their private directory. Acquisition rollback and disposal share cleanup helpers, leaving consumers responsible for a finally boundary.
- * @evidence contracts/common.md#prohibited-implementation-shortcuts Supported Node filesystem and descriptor APIs capture diagnostics without foreign mutation, expected-output substitution or an arbitrary output ceiling.
- * @evidence contracts/common.md#meaningful-documentation Separate purpose, limits and ownership paragraphs follow the documentation skill and explain actual failure effects rather than claiming unlimited output.
- * @evidence contracts/portability.md#os-neutral-implementation Canonical temporary-directory ownership and path.join represent native paths; Node manages native descriptors. Removal remains best effort because inherited Windows handles may keep files live.
- * @evidence contracts/performance.md#efficient-algorithms Two streams require a fixed number of filesystem calls, including delegated canonical-parent/child observations and native creation/open work. Parent/path text and native lookup are not constant-cost; reading B bytes and optional decoding allocate complete raw/output text in O(B) storage. No output-byte quota is imposed by this capture owner.
+ * This is not held-directory protection against namespace mutation. Descriptor
+ * acquisition failures attempt rollback; cleanup failures are suppressed, and
+ * the temp creator can leave an unclaimed postflight allocation. The caller
+ * owns the returned capture and must dispose it after reading; read failures
+ * propagate, while disposal is idempotent and cleanup is best effort.
+ *
+ * @evidence contracts/common.md#principled-implementation Precreated files receive exact child stream bytes through inherited descriptors; a descriptor load uses only its preexisting, canonical selected identities directory, while other captures retain system TEMP. Decoding happens on read, and I/O errors cannot masquerade as empty successful output.
+ * @evidence contracts/common.md#clear-and-simple-design One capture owns two descriptors and their private directory. The shared record-parent selector checks the descriptor's existing cache before allocation; acquisition rollback and disposal share cleanup helpers.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Supported Node filesystem and descriptor APIs capture diagnostics without foreign mutation, expected-output substitution or an arbitrary output ceiling; an absent or invalid private root does not invent a cache.
+ * @evidence contracts/common.md#meaningful-documentation Separate purpose, placement, limits and ownership paragraphs explain the descriptor-only placement and actual failure effects rather than claiming unlimited output.
+ * @evidence contracts/portability.md#os-neutral-implementation The shared selector confirms an ordinary physical identities child through native realpath and link-preserving stat; canonical temporary-directory ownership and path.join represent native paths. Removal remains best effort because inherited Windows handles may keep files live.
+ * @evidence contracts/performance.md#efficient-algorithms Descriptor selection adds a fixed number of native path observations before the fixed capture filesystem calls. Parent/path text and native lookup are not constant-cost; reading B bytes and optional decoding allocate complete raw/output text in O(B) storage. No output-byte quota is imposed by this capture owner.
  *
  * @evidenceExclude contracts/performance.md#reuse-equivalent-work Each child requires independent effectful output destinations; sharing prior captures would mix bytes and ownership rather than reuse equivalent work.
  *
  * @evidence contracts/performance.md#bound-retention-and-release-resources One accepted directory and two descriptors transfer to the capture until disposal. Acquisition rollback/disposal attempt close/removal; errors are suppressed, so closure and file reclamation can remain unconfirmed. Disposal marks itself consumed before cleanup and does not retry; caller-reachable capture closures retain path/state references until discarded. Output bytes are uncapped here.
  */
-export function captureProcessOutput(): CapturedProcessOutput {
-  const directory = createCanonicalTempDirectory("ttsc-spawn-");
+export function captureProcessOutput(
+  env: NodeJS.ProcessEnv = process.env,
+): CapturedProcessOutput {
+  const recordRoot =
+    env.TTSC_PLUGIN_DESCRIPTOR_LOAD === "1"
+      ? SidecarEnvironment.read(env, "TTSC_PLUGIN_RECORD_ROOT")
+      : undefined;
+  const directory = createCanonicalTempDirectory(
+    "ttsc-spawn-",
+    selectedRecordIdentityTempParent(recordRoot),
+  );
   const stdoutPath = path.join(directory, "stdout");
   const stderrPath = path.join(directory, "stderr");
   let stdoutFd: number;

package/src/compiler/internal/startResidentTransform.ts

@@ -121,7 +121,8 @@ export function startResidentTransform(
  * tsconfig) so config-file discovery walks the real project instead of the
  * wrapper's temp-dir ancestry, and forwards linked transform plugins via
  * `TTSC_LINKED_PLUGINS_JSON`. The load's record store proves the Node runtime
- * from metadata instead of streaming it again (#1723).
+ * from metadata instead of streaming it again (#1723), and supplies the
+ * invocation-owned native config-loader scratch root when available.
  */
 function residentEnv(
   context: ITtscCompilerContext,
@@ -146,6 +147,11 @@ function residentEnv(
   );
   const node = resolveNodeBinary(env, projectRoot, identities);
   SidecarEnvironment.write(env, "TTSC_NODE_BINARY", node);
+  SidecarEnvironment.write(
+    env,
+    "TTSC_NATIVE_PLUGIN_RECORD_ROOT",
+    identities?.root,
+  );
   // The anchor is per-invocation state owned by this host: when this run
   // declared none (and the caller's env does not name one), drop any value
   // inherited from an ancestor ttsc process so a nested build never

package/src/compiler/internal/transformProjectInMemory.ts

@@ -820,7 +820,10 @@ function serializeNativePlugins(
  * instead of the wrapper's temp-dir ancestry. For transform plugins, also
  * passes `TTSC_LINKED_PLUGINS_JSON` when linked sources are present. The load's
  * record store proves the Node runtime from metadata instead of streaming it
- * before every spawn of every generation (#1723).
+ * before every spawn of every generation (#1723). Its preexisting identity
+ * directory is offered to native config loaders as scratch storage on the
+ * project's volume; a nested ttsx descriptor load does not inherit the
+ * descriptor-only record-root channel.
  */
 function nativePluginEnv(
   options: ITtscCompilerContext,
@@ -846,6 +849,11 @@ function nativePluginEnv(
   );
   const node = resolveNodeBinary(env, projectRoot, identities);
   SidecarEnvironment.write(env, "TTSC_NODE_BINARY", node);
+  SidecarEnvironment.write(
+    env,
+    "TTSC_NATIVE_PLUGIN_RECORD_ROOT",
+    identities?.root,
+  );
   // The anchor is per-invocation state owned by this host: when this run
   // declared none (and the caller's env does not name one), drop any value
   // inherited from an ancestor ttsc process so a nested build never

package/src/launcher/internal/runtime/PluginDescriptorInputReport.ts

@@ -0,0 +1,100 @@
+import fs from "node:fs";
+
+import { PluginDescriptorInputObservation } from "./PluginDescriptorInputObservation";
+
+/**
+ * Own the isolated evaluator's ordered NDJSON report until its final snapshot.
+ * One append descriptor is shared across records for the same destination. A
+ * changed destination closes the previous one, and any open, write or close
+ * failure permanently invalidates observation completeness.
+ *
+ * @evidence contracts/common.md#principled-implementation The in-memory envelope receives ordered records before synchronous file writes; finalization closes the report before the shim snapshots completeness, and every I/O refusal invalidates that proof.
+ * @evidence contracts/common.md#clear-and-simple-design One namespace owns report append, path switch and final close while the runtime hooks own input observation.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts The writer uses its own Node descriptor without replacing application filesystem functions or inferring missing input proof.
+ * @evidence contracts/common.md#meaningful-documentation This comment states destination identity, finalization order and failure meaning.
+ * @evidence contracts/portability.md#os-neutral-implementation Native output paths are passed to Node's file APIs and UTF-8 Buffer offsets count bytes on every host.
+ * @evidence contracts/performance.md#efficient-algorithms A batch joins and encodes once; partial writes resume at the unwritten byte offset, without reopening for every observed input.
+ * @evidence contracts/performance.md#reuse-equivalent-work Consecutive records for the same output reuse its open descriptor; a changed path closes the prior report before opening another.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources At most one descriptor is retained per process, from first write through finalization, destination change, write failure or process exit; failed close is never retried blindly and invalidates the proof.
+ */
+export namespace PluginDescriptorInputReport {
+  /**
+   * Append observations in order, invalidating proof if the report fails.
+   *
+   * @evidence contracts/common.md#principled-implementation The envelope records each supplied line first; any missing output, open failure, incomplete write or close refusal invalidates its completion bit.
+   * @evidence contracts/common.md#clear-and-simple-design One append operation owns the current output descriptor and serialized batch.
+   * @evidence contracts/common.md#prohibited-implementation-shortcuts Writes use this module's own descriptor, with no application method replacement or invented input record.
+   * @evidence contracts/common.md#meaningful-documentation The comment states ordering and failure effects.
+   * @evidence contracts/portability.md#os-neutral-implementation Node opens the native path and Buffer offsets count UTF-8 bytes independently of host character width.
+   * @evidence contracts/performance.md#efficient-algorithms Each batch joins and encodes once, then retries only the unwritten suffix after a partial write.
+   * @evidence contracts/performance.md#reuse-equivalent-work The same destination reuses its open descriptor across all batches in the evaluator; path changes close it first.
+   * @evidence contracts/performance.md#bound-retention-and-release-resources One descriptor stays owned until finish, path switch, error or process exit, and a failed write closes it immediately.
+   */
+  export function append(lines: readonly string[]): void {
+    if (lines.length === 0) return;
+    if (process.env.TTSC_PLUGIN_DESCRIPTOR_INPUTS_ACTIVE !== "1") return;
+    PluginDescriptorInputObservation.record(lines);
+    const out = process.env.TTSC_PLUGIN_DESCRIPTOR_INPUTS_OUT;
+    if (out === undefined || out.length === 0) {
+      PluginDescriptorInputObservation.invalidate();
+      return;
+    }
+    try {
+      if (report?.out !== out) close();
+      if (report === undefined) {
+        report = { fd: fs.openSync(out, "a"), out };
+        if (!exitRegistered) {
+          process.on("exit", close);
+          exitRegistered = true;
+        }
+      }
+      const bytes = Buffer.from(lines.join(""), "utf8");
+      for (let offset = 0; offset < bytes.length; ) {
+        const written = fs.writeSync(
+          report.fd,
+          bytes,
+          offset,
+          bytes.length - offset,
+        );
+        if (written === 0)
+          throw new Error("descriptor input report made no progress");
+        offset += written;
+      }
+    } catch {
+      PluginDescriptorInputObservation.invalidate();
+      close();
+    }
+  }
+
+  /**
+   * Close the report and suspend recording before the final snapshot.
+   *
+   * @evidence contracts/common.md#principled-implementation The shim calls this after descriptor serialization so a close failure is included in the later completeness snapshot.
+   * @evidence contracts/common.md#clear-and-simple-design One final transition joins report closure and input recording suspension.
+   * @evidence contracts/common.md#prohibited-implementation-shortcuts Only the owned descriptor and protocol flag are changed, without treating a failed close as success.
+   * @evidence contracts/common.md#meaningful-documentation The comment names closure, recording suspension and snapshot order.
+   * @evidence contracts/portability.md#os-neutral-implementation The helper delegates native descriptor closure to Node and changes a process-local string flag only.
+   * @evidenceExclude contracts/performance.md#efficient-algorithms One close and flag assignment are independent of report size.
+   * @evidenceExclude contracts/performance.md#reuse-equivalent-work Effectful finalization cannot share another evaluator's close.
+   * @evidence contracts/performance.md#bound-retention-and-release-resources Finalization releases the active descriptor, and repeating it after ownership clears is harmless.
+   */
+  export function finish(): void {
+    close();
+    process.env.TTSC_PLUGIN_DESCRIPTOR_INPUTS_ACTIVE = "0";
+  }
+}
+
+let report: { fd: number; out: string } | undefined;
+let exitRegistered = false;
+
+/** Clear uncertain ownership before closing the current report. */
+function close(): void {
+  const current = report;
+  report = undefined;
+  if (current === undefined) return;
+  try {
+    fs.closeSync(current.fd);
+  } catch {
+    PluginDescriptorInputObservation.invalidate();
+  }
+}