ttsc 0.33.0-next.1 → 0.33.0

package/driver/configloaderscratch/canonical_directory_other.go

@@ -0,0 +1,34 @@
+//go:build !windows
+
+package configloaderscratch
+
+import (
+  "os"
+  "path/filepath"
+)
+
+// canonicalDirectory resolves the existing directory on non-Windows hosts.
+func canonicalDirectory(path string) (string, error) {
+  return filepath.EvalSymlinks(path)
+}
+
+// containsDirectory compares opened filesystem identities so case-only aliases
+// on a case-insensitive POSIX volume cannot hide an ancestor relationship.
+func containsDirectory(base, child string) (bool, error) {
+  baseInfo, err := os.Stat(base)
+  if err != nil {
+    return false, err
+  }
+  for current := filepath.Clean(child); ; current = filepath.Dir(current) {
+    info, err := os.Stat(current)
+    if err != nil {
+      return false, err
+    }
+    if os.SameFile(baseInfo, info) {
+      return true, nil
+    }
+    if parent := filepath.Dir(current); parent == current {
+      return false, nil
+    }
+  }
+}

package/driver/configloaderscratch/canonical_directory_windows.go

@@ -0,0 +1,60 @@
+//go:build windows
+
+package configloaderscratch
+
+import (
+  "path/filepath"
+  "strings"
+
+  "golang.org/x/sys/windows"
+)
+
+// canonicalDirectory returns the opened directory's final filesystem path,
+// including through NTFS junction ancestors that EvalSymlinks can leave intact.
+func canonicalDirectory(path string) (string, error) {
+  pointer, err := windows.UTF16PtrFromString(path)
+  if err != nil {
+    return "", err
+  }
+  handle, err := windows.CreateFile(
+    pointer,
+    windows.FILE_READ_ATTRIBUTES,
+    windows.FILE_SHARE_READ|windows.FILE_SHARE_WRITE|windows.FILE_SHARE_DELETE,
+    nil,
+    windows.OPEN_EXISTING,
+    windows.FILE_FLAG_BACKUP_SEMANTICS,
+    0,
+  )
+  if err != nil {
+    return "", err
+  }
+  defer windows.CloseHandle(handle)
+
+  buffer := make([]uint16, windows.MAX_PATH)
+  for {
+    length, err := windows.GetFinalPathNameByHandle(handle, &buffer[0], uint32(len(buffer)), 0)
+    if err != nil {
+      return "", err
+    }
+    if length < uint32(len(buffer)) {
+      resolved := windows.UTF16ToString(buffer[:length])
+      if strings.HasPrefix(resolved, `\\?\UNC\`) {
+        resolved = `\\` + strings.TrimPrefix(resolved, `\\?\UNC\`)
+      } else {
+        resolved = strings.TrimPrefix(resolved, `\\?\`)
+      }
+      return filepath.Clean(resolved), nil
+    }
+    buffer = make([]uint16, length+1)
+  }
+}
+
+// containsDirectory compares Windows path spelling after final-path resolution.
+func containsDirectory(base, child string) (bool, error) {
+  relative, err := filepath.Rel(base, child)
+  if err != nil {
+    return false, err
+  }
+  return relative == "." ||
+    (relative != ".." && !strings.HasPrefix(relative, ".."+string(filepath.Separator)) && !filepath.IsAbs(relative)), nil
+}

package/driver/configloaderscratch/identity_temp_base.go

@@ -0,0 +1,81 @@
+package configloaderscratch
+
+import (
+  "os"
+  "path/filepath"
+  "strings"
+)
+
+// IdentityTempBase selects the existing identities directory in the current
+// invocation's record store when Windows TEMP is on another drive or TEMP
+// contains the config directory. The directory must be an ordinary direct child
+// on the config's lexical drive when one exists, and it cannot contain the config
+// directory. Scratch changes only the existing identities directory's entries, even when that
+// directory is below the config directory. An empty result preserves the
+// loader's existing placement.
+//
+// @evidence contracts/common.md#principled-implementation The selected record store already owns its identities child before plugin evaluation; resolved directory identities, child metadata, Windows lexical drive comparison, and ancestry checks ensure identities is not the config directory or its ancestor. Scratch changes only identities entries, not the config directory's direct entries or metadata.
+// @evidence contracts/common.md#clear-and-simple-design This selector only chooses an optional base; each loader retains its own historical TEMP fallback and creation/cleanup lifetime.
+// @evidence contracts/common.md#prohibited-implementation-shortcuts The caller supplies its selected store root, and each path premise is checked on disk rather than inferred from a package or operating-system name.
+// @evidence contracts/common.md#meaningful-documentation The comment states the store's ownership, required directory relationship, and empty-result meaning.
+// @evidence contracts/portability.md#os-neutral-implementation IsAbs accepts POSIX absolute paths despite their empty VolumeName; EvalSymlinks and SameFile resolve POSIX links and case aliases. On Windows, VolumeName keeps TypeScript-Go drive spelling and opened directory handles resolve junctions. Unavailable directories fail closed; no URL form or process argument is used.
+// @evidence contracts/performance.md#efficient-algorithms Windows uses at most four directory opens and constant path operations; POSIX compares directory identities along at most two bounded ancestor walks. Neither scans directory contents or source bytes.
+// @evidenceExclude contracts/performance.md#reuse-equivalent-work The store and its links may change between config loads, so each call observes current metadata.
+// @evidenceExclude contracts/performance.md#bound-retention-and-release-resources Metadata operations close within their calls; this selector retains no handle, directory, or task, while its caller owns temporary creation and removal.
+func IdentityTempBase(location, systemTemp, recordRoot string) string {
+  if recordRoot == "" || !filepath.IsAbs(recordRoot) {
+    return ""
+  }
+  if !filepath.IsAbs(location) {
+    return ""
+  }
+  volume := filepath.VolumeName(location)
+  configDir := filepath.Dir(location)
+  physicalConfigDir, err := canonicalDirectory(configDir)
+  if err != nil {
+    return ""
+  }
+  if strings.EqualFold(filepath.VolumeName(systemTemp), volume) {
+    lexicalContains := false
+    if volume != "" {
+      lexicalContains, err = containsDirectory(systemTemp, configDir)
+      if err != nil {
+        return ""
+      }
+    }
+    if !lexicalContains {
+      physicalTemp, err := canonicalDirectory(systemTemp)
+      if err != nil {
+        return ""
+      }
+      physicalContains, err := containsDirectory(physicalTemp, physicalConfigDir)
+      if err != nil || !physicalContains {
+        return ""
+      }
+    }
+  }
+  physicalRoot, err := canonicalDirectory(recordRoot)
+  if err != nil {
+    return ""
+  }
+  identity := filepath.Join(recordRoot, "identities")
+  entry, err := os.Lstat(identity)
+  if err != nil || !entry.IsDir() || entry.Mode()&os.ModeSymlink != 0 {
+    return ""
+  }
+  if _, err := os.Readlink(identity); err == nil {
+    return ""
+  }
+  physicalIdentity, err := canonicalDirectory(identity)
+  if err != nil || filepath.Dir(physicalIdentity) != physicalRoot ||
+    !strings.EqualFold(filepath.VolumeName(physicalIdentity), volume) {
+    return ""
+  }
+  if strings.EqualFold(filepath.VolumeName(physicalIdentity), filepath.VolumeName(physicalConfigDir)) {
+    contained, err := containsDirectory(physicalIdentity, physicalConfigDir)
+    if err != nil || contained {
+      return ""
+    }
+  }
+  return physicalIdentity
+}

package/driver/configloaderscratch/identity_temp_base_posix_test.go

@@ -0,0 +1,124 @@
+//go:build !windows
+
+package configloaderscratch
+
+import (
+  "os"
+  "path/filepath"
+  "strings"
+  "testing"
+)
+
+// TestIdentityTempBaseKeepsPOSIXConfigRootStable verifies an existing record
+// store receives loader scratch when TMPDIR contains the config directory.
+//
+// 1. Create a project and a separate record store with an ordinary identities child.
+// 2. Select identities for ancestor TMPDIR, then create and remove scratch without changing the project directory.
+// 3. Preserve independent TMPDIR and relative-config behavior, and reject linked or ancestor identities.
+//
+// @evidence contracts/testing.md#behavioral-verification The selector returns an existing identities child for ancestor TMPDIR, and actual MkdirTemp/RemoveAll there leaves the project timestamp and cache contents unchanged; unsupported layouts return no preference.
+// @evidence contracts/testing.md#independent-expectations The authored sibling directories, before/after project stat, and empty identity listing independently establish placement and cleanup instead of deriving them from the selector.
+// @evidence contracts/testing.md#distinguishing-cases Ancestor, symlinked ancestor, and available case-only ancestor TMPDIR select identities; independent TMPDIR, relative config, missing or linked identity, and an identity ancestor of the config keep the existing fallback.
+// @evidence contracts/testing.md#execution-ownership This named Go unit exercises the portable selector and filesystem directly without launching a compiler, config evaluator, or native plugin.
+func TestIdentityTempBaseKeepsPOSIXConfigRootStable(t *testing.T) {
+  root := t.TempDir()
+  project := filepath.Join(root, "project")
+  recordRoot := filepath.Join(root, "cache")
+  identity := filepath.Join(recordRoot, "identities")
+  for _, dir := range []string{project, identity} {
+    if err := os.MkdirAll(dir, 0o755); err != nil {
+      t.Fatal(err)
+    }
+  }
+  config := filepath.Join(project, "banner.config.ts")
+  want, err := filepath.EvalSymlinks(identity)
+  if err != nil {
+    t.Fatal(err)
+  }
+  if got := IdentityTempBase(config, project, recordRoot); got != want {
+    t.Fatalf("ancestor TMPDIR selected %q, want %q", got, want)
+  }
+  before, err := os.Stat(project)
+  if err != nil {
+    t.Fatal(err)
+  }
+  scratch, err := os.MkdirTemp(want, "ttsc-banner-config-")
+  if err != nil {
+    t.Fatal(err)
+  }
+  t.Cleanup(func() {
+    if err := os.RemoveAll(scratch); err != nil {
+      t.Errorf("remove identity scratch: %v", err)
+    }
+  })
+  if err := os.RemoveAll(scratch); err != nil {
+    t.Fatal(err)
+  }
+  after, err := os.Stat(project)
+  if err != nil {
+    t.Fatal(err)
+  }
+  if !before.ModTime().Equal(after.ModTime()) {
+    t.Fatalf("project directory timestamp changed: %v -> %v", before.ModTime(), after.ModTime())
+  }
+  entries, err := os.ReadDir(identity)
+  if err != nil || len(entries) != 0 {
+    t.Fatalf("identity scratch remains: %v, %v", entries, err)
+  }
+  separateTemp := filepath.Join(root, "separate-temp")
+  if err := os.Mkdir(separateTemp, 0o755); err != nil {
+    t.Fatal(err)
+  }
+  if got := IdentityTempBase(config, separateTemp, recordRoot); got != "" {
+    t.Fatalf("independent TMPDIR selected identities: %q", got)
+  }
+  if got := IdentityTempBase("banner.config.ts", project, recordRoot); got != "" {
+    t.Fatalf("relative config selected identities: %q", got)
+  }
+  linkedTemp := filepath.Join(root, "linked-temp")
+  if err := os.Symlink(project, linkedTemp); err != nil {
+    t.Fatal(err)
+  }
+  if got := IdentityTempBase(config, linkedTemp, recordRoot); got != want {
+    t.Fatalf("linked ancestor TMPDIR selected %q, want %q", got, want)
+  }
+  linkedRoot := filepath.Join(root, "linked-cache")
+  if err := os.Symlink(recordRoot, linkedRoot); err != nil {
+    t.Fatal(err)
+  }
+  if got := IdentityTempBase(config, project, linkedRoot); got != want {
+    t.Fatalf("linked store root selected %q, want %q", got, want)
+  }
+  missingRoot := filepath.Join(root, "missing-cache")
+  if got := IdentityTempBase(config, project, missingRoot); got != "" {
+    t.Fatalf("missing store selected identities: %q", got)
+  }
+  linkedIdentityRoot := filepath.Join(root, "linked-identity-cache")
+  if err := os.Mkdir(linkedIdentityRoot, 0o755); err != nil {
+    t.Fatal(err)
+  }
+  if err := os.Symlink(identity, filepath.Join(linkedIdentityRoot, "identities")); err != nil {
+    t.Fatal(err)
+  }
+  if got := IdentityTempBase(config, project, linkedIdentityRoot); got != "" {
+    t.Fatalf("linked identity child selected: %q", got)
+  }
+  nested := filepath.Join(identity, "nested")
+  if err := os.Mkdir(nested, 0o755); err != nil {
+    t.Fatal(err)
+  }
+  if got := IdentityTempBase(filepath.Join(nested, "banner.config.ts"), project, recordRoot); got != "" {
+    t.Fatalf("identity ancestor of config selected: %q", got)
+  }
+  alternateCase := strings.ToUpper(project)
+  projectInfo, projectErr := os.Stat(project)
+  aliasInfo, aliasErr := os.Stat(alternateCase)
+  if projectErr == nil && aliasErr == nil && os.SameFile(projectInfo, aliasInfo) {
+    if got := IdentityTempBase(config, alternateCase, recordRoot); got != want {
+      t.Fatalf("case-only ancestor TMPDIR selected %q, want %q", got, want)
+    }
+    if got := IdentityTempBase(filepath.Join(strings.ToUpper(identity), "nested", "banner.config.ts"), project, recordRoot); got != "" {
+      t.Fatalf("case-only identity ancestor selected: %q", got)
+    }
+  }
+}

package/driver/configloaderscratch/identity_temp_base_windows_test.go

@@ -0,0 +1,156 @@
+package configloaderscratch
+
+import (
+  "os"
+  "os/exec"
+  "path/filepath"
+  "strings"
+  "testing"
+)
+
+// TestIdentityTempBaseUsesOnlyAnExistingOrdinaryChild verifies the shared
+// loader selector accepts an owned sibling directory and same-drive junction
+// ancestors while rejecting linked children, missing stores, and ancestors.
+//
+// 1. Create an ordinary project and record-store sibling, then select its preexisting identities child.
+// 2. Accept same-drive cache/config junctions and ancestor TEMP, but preserve independent same-drive TEMP.
+// 3. Accept lexical-volume identities for a cross-drive config junction and reject a physical-volume store.
+// 4. Create and remove a scratch child under the selected base and check the project directory stays fixed.
+//
+// @evidence contracts/testing.md#behavioral-verification Calls the shared selector on real Windows directories and junctions, then performs temporary creation and removal at its selected base; unsupported layouts return no preferred base and the project directory's timestamp stays unchanged.
+// @evidence contracts/testing.md#independent-expectations The authored sibling, missing child, linked child, same-drive junction and ancestor layouts define valid and invalid paths before the selector runs; the project stat and empty identities listing independently detect root churn and scratch residue.
+// @evidence contracts/testing.md#distinguishing-cases Same-drive cache/config junctions and ancestor TEMP contrast with a cross-drive config junction, independent same-volume TEMP, missing and linked identities, and a config inside identities; callers separately test legacy fallback creation.
+// @evidence contracts/testing.md#execution-ownership This named Go unit calls the shared filesystem selector directly; cmd only creates junction fixtures, and no compiler, config evaluator, or native plugin runs.
+func TestIdentityTempBaseUsesOnlyAnExistingOrdinaryChild(t *testing.T) {
+  root := t.TempDir()
+  project := filepath.Join(root, "project")
+  recordRoot := filepath.Join(root, "cache")
+  identity := filepath.Join(recordRoot, "identities")
+  for _, dir := range []string{project, identity} {
+    if err := os.MkdirAll(dir, 0o755); err != nil {
+      t.Fatal(err)
+    }
+  }
+  config := filepath.Join(project, "banner.config.ts")
+  otherTemp := `Z:\ttsc-test-temp`
+  if strings.EqualFold(filepath.VolumeName(root), "Z:") {
+    otherTemp = `Y:\ttsc-test-temp`
+  }
+  physicalIdentity, err := filepath.EvalSymlinks(identity)
+  if err != nil {
+    t.Fatal(err)
+  }
+  if got := IdentityTempBase(config, otherTemp, recordRoot); got != physicalIdentity {
+    t.Fatalf("identity base mismatch: %q != %q", got, physicalIdentity)
+  }
+  separateTemp := filepath.Join(root, "separate-temp")
+  if err := os.Mkdir(separateTemp, 0o755); err != nil {
+    t.Fatal(err)
+  }
+  if got := IdentityTempBase(config, separateTemp, recordRoot); got != "" {
+    t.Fatalf("independent same-volume TEMP selected identities: %q", got)
+  }
+  for _, ancestorTemp := range []string{project, root} {
+    if got := IdentityTempBase(config, ancestorTemp, recordRoot); got != physicalIdentity {
+      t.Fatalf("ancestor TEMP did not select identities: %q", got)
+    }
+  }
+  if got := IdentityTempBase(config, otherTemp, filepath.Join(root, "missing")); got != "" {
+    t.Fatalf("missing store selected identities: %q", got)
+  }
+  before, err := os.Stat(project)
+  if err != nil {
+    t.Fatal(err)
+  }
+  scratch, err := os.MkdirTemp(physicalIdentity, "ttsc-config-loader-")
+  if err != nil {
+    t.Fatal(err)
+  }
+  t.Cleanup(func() {
+    if err := os.RemoveAll(scratch); err != nil {
+      t.Errorf("remove identity scratch: %v", err)
+    }
+  })
+  if err := os.RemoveAll(scratch); err != nil {
+    t.Fatal(err)
+  }
+  after, err := os.Stat(project)
+  if err != nil {
+    t.Fatal(err)
+  }
+  if !before.ModTime().Equal(after.ModTime()) {
+    t.Fatalf("project directory timestamp changed: %v -> %v", before.ModTime(), after.ModTime())
+  }
+  entries, err := os.ReadDir(identity)
+  if err != nil || len(entries) != 0 {
+    t.Fatalf("identity scratch remains: %v, %v", entries, err)
+  }
+  linkedRoot := filepath.Join(root, "linked-cache")
+  if out, err := exec.Command("cmd", "/c", "mklink", "/J", linkedRoot, recordRoot).CombinedOutput(); err != nil {
+    t.Fatalf("cache-root junction failed: %v: %s", err, out)
+  }
+  if got := IdentityTempBase(config, otherTemp, linkedRoot); got != physicalIdentity {
+    t.Fatalf("same-drive linked root did not select canonical identities: %q", got)
+  }
+  linkedProject := filepath.Join(root, "linked-project")
+  if out, err := exec.Command("cmd", "/c", "mklink", "/J", linkedProject, project).CombinedOutput(); err != nil {
+    t.Fatalf("project junction failed: %v: %s", err, out)
+  }
+  if got := IdentityTempBase(filepath.Join(linkedProject, "banner.config.ts"), otherTemp, recordRoot); got != physicalIdentity {
+    t.Fatalf("same-drive linked config did not select canonical identities: %q", got)
+  }
+  linkedTemp := filepath.Join(root, "linked-temp")
+  if out, err := exec.Command("cmd", "/c", "mklink", "/J", linkedTemp, project).CombinedOutput(); err != nil {
+    t.Fatalf("TEMP junction failed: %v: %s", err, out)
+  }
+  if got := IdentityTempBase(config, linkedTemp, recordRoot); got != physicalIdentity {
+    t.Fatalf("physical ancestor TEMP did not select identities: %q", got)
+  }
+  linkedIdentityRoot := filepath.Join(root, "linked-identity-cache")
+  if err := os.Mkdir(linkedIdentityRoot, 0o755); err != nil {
+    t.Fatal(err)
+  }
+  if out, err := exec.Command("cmd", "/c", "mklink", "/J", filepath.Join(linkedIdentityRoot, "identities"), identity).CombinedOutput(); err != nil {
+    t.Fatalf("identity junction failed: %v: %s", err, out)
+  }
+  if got := IdentityTempBase(config, otherTemp, linkedIdentityRoot); got != "" {
+    t.Fatalf("linked identities selected: %q", got)
+  }
+  nested := filepath.Join(identity, "nested")
+  if err := os.Mkdir(nested, 0o755); err != nil {
+    t.Fatal(err)
+  }
+  if got := IdentityTempBase(filepath.Join(nested, "banner.config.ts"), otherTemp, recordRoot); got != "" {
+    t.Fatalf("config inside identities selected ancestor: %q", got)
+  }
+  checkout, err := os.Getwd()
+  if err != nil {
+    t.Fatal(err)
+  }
+  if !strings.EqualFold(filepath.VolumeName(checkout), filepath.VolumeName(root)) {
+    packageRoot := filepath.Clean(filepath.Join(checkout, "..", ".."))
+    otherPhysical, err := os.MkdirTemp(packageRoot, "ttsc-banner-junction-test-")
+    if err != nil {
+      t.Fatal(err)
+    }
+    t.Cleanup(func() {
+      if err := os.RemoveAll(otherPhysical); err != nil {
+        t.Errorf("remove cross-volume fixture: %v", err)
+      }
+    })
+    if err := os.Mkdir(filepath.Join(otherPhysical, "identities"), 0o755); err != nil {
+      t.Fatal(err)
+    }
+    configAlias := filepath.Join(root, "linked-other-volume-config")
+    if out, err := exec.Command("cmd", "/c", "mklink", "/J", configAlias, otherPhysical).CombinedOutput(); err != nil {
+      t.Fatalf("cross-volume config junction failed: %v: %s", err, out)
+    }
+    linkedConfig := filepath.Join(configAlias, "banner.config.ts")
+    if got := IdentityTempBase(linkedConfig, otherTemp, recordRoot); got != physicalIdentity {
+      t.Fatalf("lexical-volume identities not selected for linked config: %q", got)
+    }
+    if got := IdentityTempBase(linkedConfig, otherTemp, otherPhysical); got != "" {
+      t.Fatalf("physical-volume identities selected for linked config: %q", got)
+    }
+  }
+}

package/driver/emit_provenance.go

@@ -14,15 +14,17 @@ import (
 )
 
 // NewEmitProvenanceRecorder wraps a writer and returns a build-owned snapshot
-// function for successfully written JavaScript outputs. The compiler's actual
+// function for successfully materialized JavaScript outputs. The compiler's actual
 // eligible source list and output resolver determine candidates; neither sibling
 // filenames nor source maps establish ownership.
 //
 // Snapshot keys are absolute native output paths. Values are sorted, distinct
 // physical source paths recorded by this compiler generation's input observer.
-// An empty value means an output was written but its eligible owners or some
+// An empty value means an output was emitted but its eligible owners or some
 // owner's physical proof were unavailable or inconsistent. Multiple values
-// preserve ambiguity. An empty object means no JavaScript write succeeded.
+// preserve ambiguity. An empty object means no JavaScript output succeeded.
+// A writer may leave an existing byte-identical output in place and return
+// success; that output remains part of this generation's emitted result.
 //
 // Call the snapshot after emission finishes. It remains attached to its captured
 // generation's ledger and never resolves an alias against post-build disk state.
@@ -32,12 +34,12 @@ import (
 // the supplied writer must not reenter either returned closure. Writer errors
 // prevent recording that callback even if the writer already had partial effects.
 //
-// @evidence contracts/common.md#principled-implementation Native eligible sources and resolved script destinations intersect only successful unskipped writes; all candidate generation-time physical proofs are required, with unknown and multiple owners represented explicitly.
+// @evidence contracts/common.md#principled-implementation Native eligible sources and resolved script destinations intersect only successful unskipped emit callbacks, including byte-identical existing outputs; all candidate generation-time physical proofs are required, with unknown and multiple owners represented explicitly.
 // @evidence contracts/common.md#clear-and-simple-design One compiler-owned candidate index, one serialized writer and one snapshot separate eligibility, successful publication and physical provenance without a same-stem fallback.
 // @evidence contracts/common.md#prohibited-implementation-shortcuts The recorder delegates supported emit-path helpers and actual writers; later realpath, fixture filenames or extension precedence cannot fabricate a unique source owner.
 // @evidence contracts/common.md#meaningful-documentation Native paragraphs explain snapshot timing, native keys, physical proof, ambiguity, unknown values and the non-atomic ledger limitation following the documentation skill.
 // @evidence contracts/portability.md#os-neutral-implementation Compiler path normalization and its coordinate case policy index candidate collisions; recorded native physical paths prove source identity separately from that policy, preserving lexical output names without an OS-derived identity guess.
-// @evidence contracts/performance.md#efficient-algorithms Latched linked hooks and native eligibility/output-path helpers precede the source index. Candidate/path normalization and text keys contribute work; each callback delegates arbitrary writer work, then records a successful script row. Snapshot visits each written row's candidates, compares captured proofs, deduplicates physical paths and sorts each owner list with path-text comparison costs; shared candidate lists can be revisited across written spellings.
+// @evidence contracts/performance.md#efficient-algorithms Latched linked hooks and native eligibility/output-path helpers precede the source index. Candidate/path normalization and text keys contribute work; each callback delegates arbitrary writer work, then records a successful script row even when the writer reuses matching bytes. Snapshot visits each row's candidates, compares captured proofs, deduplicates physical paths and sorts each owner list with path-text comparison costs; shared candidate lists can be revisited across output spellings.
 // @evidence contracts/performance.md#reuse-equivalent-work One generation's native eligibility and output paths serve every writer callback; the snapshot reuses captured input observations without re-reading source bytes or recomputing an independent compiler Program.
 // @evidence contracts/performance.md#bound-retention-and-release-resources Returned closures retain the captured input ledger and uncapped candidate/write path lists until their owner releases them. Snapshots allocate independent maps/slices; delegated writer resource release belongs to that writer. Shared locking serializes writer and snapshot with no deadline or reentrant acquisition; no independent descriptor or lease is acquired here.
 func (p *Program) NewEmitProvenanceRecorder(writeFile shimcompiler.WriteFile) (shimcompiler.WriteFile, func() map[string][]string, error) {

package/driver/resolutioninputs/recorder.cjs

@@ -775,10 +775,10 @@ function visitImportTargetCandidates(specifier, parent, extensions, visit) {
  *   the input set without a hash, even when resolution observation is
  *   complete.
  *
- * @evidence contracts/common.md#principled-implementation Before/after metadata plus repeated content and physical observations withdraw contradictory per-input proofs; the separate complete flag reports known observation capability gaps.
+ * @evidence contracts/common.md#principled-implementation Before/after metadata plus repeated content and physical observations withdraw contradictory per-input proofs; a selected file must have positive content and physical proof, while the separate complete flag reports known observation capability gaps.
  * @evidence contracts/common.md#clear-and-simple-design One evaluation owns its input ledger, resolution tokens and final envelope; callers explicitly invalidate capability rather than manipulating proof maps.
  * @evidence contracts/common.md#prohibited-implementation-shortcuts Unknown observations retain missing proofs and incomplete capability remains false; no expected digest or resolver monkeypatch makes reuse appear valid.
- * @evidence contracts/common.md#meaningful-documentation JSDoc describes hook ownership, entry recording, final reread and capability versus stability; returned operations have native descriptions and tags are separated.
+ * @evidence contracts/common.md#meaningful-documentation JSDoc describes hook ownership, entry recording, selected-file proof, final reread and capability versus stability; returned operations have native descriptions and tags are separated.
  * @evidence contracts/portability.md#os-neutral-implementation Native stat/realpath and URL conversion represent paths and identities; symlink ancestors are observed without equating an OS name to filesystem case policy.
  * @evidence contracts/performance.md#efficient-algorithms Sets/maps index paths, but candidate expansion and repeated pre/post/final observations still pay native stat/realpath/ancestor-link work and full file hashing; finish visits its captured input list and sorts output paths, with uncapped byte, path and manifest-expansion costs.
  * @evidence contracts/performance.md#reuse-equivalent-work Distinct candidates share the evaluation ledger and expanded bases; the first witness stays authoritative and contradictory later reads revoke its proof instead of refreshing it.
@@ -931,8 +931,8 @@ function createResolutionInputRecorder(options) {
     },
     /**
      * Settle a resolution: commit the fingerprints of the candidates it could
-     * have read, record them again as they are now, and record the module it
-     * selected.
+     * have read, record them again as they are now, and require positive proof
+     * for the file selected by a successful resolution.
      *
      * @param {{
      *   importPending: object[];
@@ -1008,6 +1008,18 @@ function createResolutionInputRecorder(options) {
         recordedBases,
       );
       recordFile(resolved);
+      const selected = asFile(resolved);
+      if (
+        selected !== undefined &&
+        (typeof hashes.get(selected) !== "string" ||
+          typeof realpaths.get(selected) !== "string")
+      ) {
+        inputs.add(selected);
+        hashes.delete(selected);
+        realpaths.delete(selected);
+        signatures.delete(selected);
+        unstable.add(selected);
+      }
     },
     recordFile,
 

package/driver/rewrite.go

@@ -157,10 +157,13 @@ func (p *Program) EmitAll(rs *RewriteSet, writeFile shimcompiler.WriteFile) (*sh
 // is the standard place to carry per-file cursors or an output map), so ttsc
 // owns the serialization rather than pushing goroutine-safety onto every
 // plugin author. See the emit-concurrency contract in the plugin docs.
+// A watch-owned writer may leave an already identical file in place; that
+// successful output remains in EmittedFiles. Rejected outDir paths are marked
+// skipped and do not appear there.
 //
 // @evidence contracts/common.md#principled-implementation Native emission honors linked program hooks, compiler incremental-output policy, and output containment while omitting only ttsc text rewrites.
 // @evidence contracts/common.md#clear-and-simple-design One serialized writer callback wraps the compiler emit owner and shared diagnostic conversion.
-// @evidence contracts/common.md#prohibited-implementation-shortcuts Compiler emission is not patched or replaced with expected-output text; skipped writes are marked for accurate emitted-file reporting.
+// @evidence contracts/common.md#prohibited-implementation-shortcuts Compiler emission is not patched or replaced with expected-output text; rejected outDir writes are marked skipped, while identical existing watch outputs remain successful emitted files.
 // @evidence contracts/common.md#meaningful-documentation Native prose distinguishes raw output and guaranteed callback serialization following the documentation skill.
 // @evidence contracts/portability.md#os-neutral-implementation Native containment resolves compiler paths with its case policy, and DefaultWriteFile uses native filesystem APIs.
 // @evidence contracts/performance.md#efficient-algorithms Native generation processes the current program and emitted text; serialized callbacks add lexical path-containment and default filesystem or arbitrary caller-writer costs. Result diagnostics require conversion. Native threading policy remains selected by the loaded program, with no measured claim that callback serialization is inexpensive.
@@ -185,8 +188,8 @@ func (p *Program) EmitAllRaw(writeFile shimcompiler.WriteFile) (*shimcompiler.Em
     wfMu.Lock()
     defer wfMu.Unlock()
     if p.outputEscapesOutDir(fileName) {
-      // Marking the write skipped keeps the file out of EmitResult.EmittedFiles,
-      // so callers reporting emitted counts don't include phantom outputs.
+      // Marking a rejected path skipped keeps it out of EmittedFiles. An
+      // existing identical output is still an emitted result and stays listed.
       if data != nil {
         data.SkippedDtsWrite = true
       }
@@ -243,8 +246,8 @@ func (p *Program) emit(rs *RewriteSet, target *ast.SourceFile, writeFile shimcom
     wfMu.Lock()
     defer wfMu.Unlock()
     if p.outputEscapesOutDir(fileName) {
-      // See EmitAllRaw: mark the write skipped so EmitResult.EmittedFiles
-      // reflects only files actually written.
+      // See EmitAllRaw: rejected paths are absent from EmittedFiles, while an
+      // existing identical watch output remains a successful result.
       if data != nil {
         data.SkippedDtsWrite = true
       }
@@ -316,19 +319,25 @@ func (p *Program) emitsBuildInfo() bool {
 }
 
 // DefaultWriteFile is the default disk writer used when EmitAll's caller does not
-// supply a custom WriteFile callback. Existing files are truncated; a failed
-// write can leave partial output. Requested creation modes are subject to the
-// native platform and umask, and do not replace existing file permissions.
+// supply a custom WriteFile callback. Existing files are normally truncated; a
+// watch child setting TTSC_WATCH_WRITE_IF_CHANGED=1 preserves byte-identical
+// regular output files instead. A failed write can leave partial output.
+// Requested creation modes are subject to the native platform and umask, and
+// do not replace existing file permissions.
 //
-// @evidence contracts/common.md#principled-implementation Parent directories are created before the output is written, and native errors remain visible to emit callers.
-// @evidence contracts/common.md#clear-and-simple-design One directory-creation step precedes one file write.
-// @evidence contracts/common.md#prohibited-implementation-shortcuts The writer uses actual requested filenames without suppressing filesystem failures or relying on shell commands.
-// @evidence contracts/common.md#meaningful-documentation Native prose identifies the default callback role following the documentation skill.
-// @evidence contracts/portability.md#os-neutral-implementation filepath.Dir, os.MkdirAll, and os.WriteFile supply OS-neutral native operations without separator or command assumptions.
-// @evidence contracts/performance.md#efficient-algorithms Native parent creation can walk missing ancestors and query existing entries; path length/depth and output bytes drive delegated work. The text-to-byte conversion and file write process the supplied output without a directory enumeration or intermediate output collection.
-// @evidenceExclude contracts/performance.md#reuse-equivalent-work Each emit write is requested independently; this writer owns no reuse coordinator.
-// @evidence contracts/performance.md#bound-retention-and-release-resources os.WriteFile opens one output handle and attempts its closure after the write, including write failure; open failure acquires no handle. The adapter retains no handle or historical output buffer after returning, but created directories and partial or completed files remain on disk without rollback.
+// @evidence contracts/common.md#principled-implementation The watch-only opt-in compares an existing writable regular output before deciding whether native writing is needed; all other writes use the original directory and file operations.
+// @evidence contracts/common.md#clear-and-simple-design One opt-in decision selects the unchanged-output check or the original writer.
+// @evidence contracts/common.md#prohibited-implementation-shortcuts Native file identity and bytes decide whether to skip; unknown state falls back to the original writer and its errors.
+// @evidence contracts/common.md#meaningful-documentation Native prose states normal truncation, watch opt-in, partial failure and permission behavior.
+// @evidence contracts/portability.md#os-neutral-implementation filepath.Dir, os.MkdirAll and os.WriteFile preserve native path and permission behavior; the optional check uses native file identity rather than path spelling.
+// @evidence contracts/performance.md#efficient-algorithms Normal writes retain one directory creation and file write. Watch writes add metadata and streamed comparison of up to the existing output size, then write only when content differs or safe comparison fails; no prior-output cache is retained.
+// @evidenceExclude contracts/performance.md#reuse-equivalent-work Each emit write is requested independently; this writer owns no cross-emit reuse coordinator.
+// @evidence contracts/performance.md#bound-retention-and-release-resources The optional comparison closes its one read/write handle before return or fallback; os.WriteFile owns and closes the later write handle. No output buffer or handle survives this call, while created directories and partial or completed files remain on disk.
 func DefaultWriteFile(fileName, text string) error {
+  return writeFileWithWatchMode(fileName, text, os.Getenv("TTSC_WATCH_WRITE_IF_CHANGED") == "1")
+}
+
+func defaultWriteFile(fileName, text string) error {
   if dir := filepath.Dir(fileName); dir != "" {
     if err := os.MkdirAll(dir, 0o755); err != nil {
       return err