@@ -8,8 +8,10 @@ Building and testing: the README's "Building and testing locally" section. Gradl
 - **Collections.** Plain `java.util` types. `List.of`, `List.copyOf`, `Map.of` and `Stream.toList()` give
   unmodifiable collections, so new code does not need Guava's `ImmutableList` or `ImmutableMap`; use them only
   where an existing API already hands one over.
-- **Nullability.** One annotation, `javax.annotation.Nullable` (jsr305), the one the code uses; do not add another
-  `Nullable`.
+- **Nullability.** One annotation, JSpecify's `org.jspecify.annotations.Nullable`; do not add another `Nullable`,
+  nor a `NotNull` or `NonNull`: what is not `@Nullable` is non-null, and NullAway checks it. It is a type-use
+  annotation, so on a nested type it goes before the simple name (`Input.@Nullable Token`), and on an array before
+  the brackets (`String @Nullable []`).
 - **Local variables.** `var` wherever the initializer gives the type unchanged, in `for` loops too. Not where it
   would box a primitive (`for (var n : List<Integer>)`), and not without an initializer that has a type of its own
   (a lambda, `null`).
 
@@ -11,13 +11,36 @@ dependencies {
 }
 
 nullaway {
+    severity = net.ltgt.gradle.errorprone.CheckSeverity.ERROR
     annotatedPackages.add('com.palantir')
+    jspecifyMode = true
 }
 
 tasks.withType(JavaCompile).configureEach {
+    // JSpecify mode reads @Nullable on types from class files, which javac 21 does only with this flag.
+    options.compilerArgs.add('-XDaddTypeAnnotationsToSymbol=true')
     options.errorprone {
         // Annotation processor output (Immutables) is not ours to fix.
         excludedPaths = '.*/build/generated/.*'
+        nullaway {
+            handleTestAssertionLibraries = true
+        }
+        error('CanonicalAnnotationSyntax')
+        error('CollectorMutability')
+        error('DirectReturn')
+        error('EffectivelyPrivate')
+        error('FormatStringConcatenation')
+        error('JUnitClassModifiers')
+        error('JUnitMethodDeclaration')
+        error('RedundantStringConversion')
+        error('RefactorSwitch')
+        error('SameNameButDifferent')
+        error('StringConcatToTextBlock')
+        error('UnusedVariable')
+        disable('IsInstanceLambdaUsage')
+        disable('LexicographicalAnnotationAttributeListing')
+        disable('LexicographicalAnnotationListing')
+        disable('StringJoining')
     }
 }
 
@@ -27,27 +50,3 @@ pluginManager.withPlugin('java-gradle-plugin') {
         options.errorprone.disable('JavaxInjectOnAbstractMethod')
     }
 }
-
-// The checks vfs-s3 makes build-breaking. The commented ones stay off until the code is fixed, one check at a
-// time: StaticImport 84, LexicographicalAnnotationListing 46, RedundantStringConversion 6, AlmostJavadoc 3
-// findings; the rest have none.
-tasks.withType(JavaCompile).configureEach {
-    options.errorprone {
-        //error('StaticImport')
-        //error('UnnecessarilyFullyQualified')
-        //error('EmptyBlockTag')
-        //error('OperatorPrecedence')
-        //error('RedundantStringConversion')
-        //error('PatternMatchingInstanceof')
-        //error('UnnecessaryParentheses')
-        //error('LexicographicalAnnotationListing')
-        error('JUnitMethodDeclaration')
-        error('JUnitClassModifiers')
-        //error('MissingSummary')
-        //error('AlmostJavadoc')
-        //error('BadImport')
-        //error('JdkObsolete')
-        // NonStaticImport (Picnic) is the inverse of StaticImport and would give contradictory advice.
-        //disable('NonStaticImport')
-    }
-}
@@ -70,7 +70,7 @@ gradlePlugin {
         openJavaFormatProvider {
             id = 'dev.openjavaformat.java-format-provider'
             implementationClass = 'com.palantir.javaformat.gradle.PalantirJavaFormatProviderPlugin'
-            description = 'Exposes a configuration containing the open-java-format jars'
+            description = 'Declares palantirJavaFormat, which overrides the formatter that comes inside the open-java-format plugins'
             displayName = 'Open Java Format Provider'
             tags.set(['java', 'style'])
         }
@@ -117,8 +117,9 @@ tasks.register("copyNativeImage", Copy.class) {
     into("$buildDir/nativeImage")
 }
 
-// Split in two so the jar build does not need a GraalVM image: every test reads
-// impl.classpath, only the four that drive the binary read nativeImage.path.
+// Split in two so the jar build does not need a GraalVM image: the tests that declare the
+// formatter themselves read impl.classpath, which is also what bundleFormatter puts inside the
+// plugin; only the ones that drive the binary read nativeImage.path.
 //
 // Everything the doLast bodies touch is captured here, at configuration time: reaching for
 // `configurations` or `tasks` from inside them would pull the whole script into the task and
@@ -136,6 +137,31 @@ def writeImplClasspath = tasks.register("writeImplClasspath") {
     }
 }
 
+// The Java-based formatter travels inside the plugin, so that a build needs no repository and no dependency for it,
+// and runs the formatter of the plugin's own commit (#20). The jars go in unchanged, each with its own LICENSE and
+// NOTICE, next to jars.txt: a line per jar, "<sha256> <name>", in the order of the classpath. BundledFormatter
+// extracts them on first use.
+def bundledFormatterDir = layout.buildDirectory.dir("generated/bundledFormatter")
+def bundledFormatterPath = "open-java-format/formatter"
+def bundleFormatter = tasks.register("bundleFormatter", Sync) {
+    into(bundledFormatterDir)
+    into(bundledFormatterPath) {
+        from(implFiles)
+    }
+    doLast {
+        def lines = implFiles.files.collect { jar ->
+            "${java.security.MessageDigest.getInstance('SHA-256').digest(jar.bytes).encodeHex()} ${jar.name}"
+        }
+        bundledFormatterDir.get().file("${bundledFormatterPath}/jars.txt").asFile.text = lines.join('\n') + '\n'
+    }
+}
+sourceSets.main.resources.srcDir(bundleFormatter)
+
+// The sources jar takes the resources too; the formatter's jars are not the plugin's sources.
+tasks.named('sourcesJar', Jar) {
+    exclude("${bundledFormatterPath}/**")
+}
+
 def writeNativeImagePath = tasks.register("writeNativeImagePath") {
     inputs.files(tasks.named("copyNativeImage"))
     outputs.file(nativeImagePathFile)
 
@@ -46,6 +46,8 @@ public void apply(Project rootProject) {
                                 .from(rootProject
                                         .getConfigurations()
                                         .getByName(PalantirJavaFormatProviderPlugin.CONFIGURATION_NAME));
+                        task.getBundledFormatter().set(BundledFormatter.hash());
+                        task.getGradleUserHome().set(rootProject.getGradle().getGradleUserHomeDir());
                     });
 
             TaskProvider<UpdateWorkspaceXmlFile> updateWorkspaceXml = rootProject
 
@@ -17,19 +17,16 @@
 package com.palantir.javaformat.gradle;
 
 import com.palantir.javaformat.bootstrap.NativeImageFormatterService;
-import java.io.File;
 import java.io.IOException;
 import org.gradle.api.DefaultTask;
 import org.gradle.api.Plugin;
 import org.gradle.api.Project;
-import org.gradle.api.artifacts.Configuration;
 import org.gradle.api.file.ConfigurableFileCollection;
 import org.gradle.api.file.DirectoryProperty;
 import org.gradle.api.file.FileCollection;
 import org.gradle.api.file.RegularFileProperty;
 import org.gradle.api.logging.Logger;
 import org.gradle.api.logging.Logging;
-import org.gradle.api.provider.Provider;
 import org.gradle.api.tasks.Classpath;
 import org.gradle.api.tasks.InputFile;
 import org.gradle.api.tasks.Internal;
@@ -53,31 +50,23 @@ public void apply(Project project) {
         project.getPlugins().apply(PalantirJavaFormatSpotlessPlugin.class);
 
         project.getPlugins().withId("java", p -> {
+            var formatterClasspath = FormatterClasspath.of(project);
+            var nativeImage = FormatterClasspath.nativeImageOf(project);
 
             // TODO(dfox): in the future we may want to offer a simple 'format' task so people don't need to use
             // spotless to try out our formatter
             project.getTasks().register("formatDiff", FormatDiffTask.class, task -> {
                 task.getProjectDirectory().set(project.getLayout().getProjectDirectory());
+                task.getGradleUserHome().set(project.getGradle().getGradleUserHomeDir());
                 if (getNativeImageSupport().isNativeImageConfigured()) {
-                    task.getNativeImage().fileProvider(getNativeImplConfiguration(project));
+                    task.getNativeImage().fileProvider(nativeImage.map(FileCollection::getSingleFile));
                 } else {
-                    task.getFormatterClasspath().from(getImplConfiguration(project));
+                    task.getFormatterClasspath().from(formatterClasspath);
                 }
             });
         });
     }
 
-    private static Provider<Configuration> getImplConfiguration(Project project) {
-        return project.getRootProject().getConfigurations().named(PalantirJavaFormatProviderPlugin.CONFIGURATION_NAME);
-    }
-
-    private static Provider<File> getNativeImplConfiguration(Project project) {
-        return (project.getRootProject()
-                .getConfigurations()
-                .named(NativeImageFormatProviderPlugin.NATIVE_CONFIGURATION_NAME)
-                .map(FileCollection::getSingleFile));
-    }
-
     @DisableCachingByDefault(
             because = "Reformats whatever the working tree currently differs by; there is no reusable output")
     public abstract static class FormatDiffTask extends DefaultTask {
@@ -89,10 +78,17 @@ public abstract static class FormatDiffTask extends DefaultTask {
         @PathSensitive(PathSensitivity.NAME_ONLY)
         abstract RegularFileProperty getNativeImage();
 
-        /** The jars of the Java-based formatter, which runs when the native image is not configured. */
+        /**
+         * The jars a build declared for the Java-based formatter, which runs when the native image is not configured.
+         * Most builds declare none, and the task then runs the one inside the plugin.
+         */
         @Classpath
         abstract ConfigurableFileCollection getFormatterClasspath();
 
+        /** Where the formatter inside the plugin is extracted to, and the native image copied to. */
+        @Internal
+        abstract DirectoryProperty getGradleUserHome();
+
         /**
          * The project whose changed lines are formatted. The task reads it here rather than from {@code getProject()},
          * which a task must not call when it runs with the configuration cache.
@@ -112,13 +108,16 @@ public final void formatDiff() throws IOException, InterruptedException {
                 log.info("Using the native-image formatter");
                 FormatDiff.formatDiff(
                         projectDir,
-                        new NativeImageFormatterService(
-                                getNativeImage().get().getAsFile().toPath()));
+                        new NativeImageFormatterService(NativeImageAtomicCopy.copyToCache(
+                                getNativeImage().get().getAsFile().toPath(),
+                                getGradleUserHome().get().getAsFile())));
             } else {
                 log.info("Using the Java-based formatter");
                 FormatDiff.formatDiff(
                         projectDir,
-                        FormatterServiceLoader.load(getFormatterClasspath().getFiles()));
+                        FormatterServiceLoader.load(BundledFormatter.jarsUnlessOverridden(
+                                getFormatterClasspath().getFiles(),
+                                getGradleUserHome().get().getAsFile())));
             }
         }
     }
 
@@ -20,31 +20,69 @@
 import java.net.URI;
 import java.util.List;
 import org.gradle.api.DefaultTask;
+import org.gradle.api.Task;
 import org.gradle.api.file.ConfigurableFileCollection;
+import org.gradle.api.file.DirectoryProperty;
 import org.gradle.api.file.RegularFileProperty;
+import org.gradle.api.provider.Property;
+import org.gradle.api.specs.Spec;
 import org.gradle.api.tasks.Classpath;
+import org.gradle.api.tasks.Input;
 import org.gradle.api.tasks.InputFiles;
+import org.gradle.api.tasks.Internal;
 import org.gradle.api.tasks.OutputFile;
 import org.gradle.api.tasks.TaskAction;
 import org.gradle.work.DisableCachingByDefault;
 
 @DisableCachingByDefault(because = "Writes the developer's local .idea configuration; nothing to cache")
 public abstract class UpdatePalantirJavaFormatIdeaXmlFile extends DefaultTask {
 
+    /**
+     * The jars a build declared for the formatter. Most builds declare none, and the IDE then gets the formatter inside
+     * the plugin.
+     */
     @InputFiles
     @Classpath
     public abstract ConfigurableFileCollection getImplementationConfig();
 
+    /** The hash of the formatter inside the plugin, which names the directory its jars are extracted into. */
+    @Input
+    public abstract Property<String> getBundledFormatter();
+
+    /** Where the formatter inside the plugin is extracted to. */
+    @Internal
+    public abstract DirectoryProperty getGradleUserHome();
+
+    public UpdatePalantirJavaFormatIdeaXmlFile() {
+        // The IDE loads the jars from where the XML says: while they are gone, the task is not up to date.
+        getOutputs().upToDateWhen(new BundledFormatterIsExtracted());
+    }
+
     @org.gradle.api.tasks.Optional
     @OutputFile
     public abstract RegularFileProperty getXmlOutputFile();
 
     @TaskAction
     public final void updateXml() {
-        List<URI> uris =
-                getImplementationConfig().getFiles().stream().map(File::toURI).toList();
+        List<URI> uris = BundledFormatter.jarsUnlessOverridden(
+                        getImplementationConfig().getFiles(),
+                        getGradleUserHome().get().getAsFile())
+                .stream()
+                .map(File::toURI)
+                .toList();
         XmlUtils.updateIdeaXmlFile(
                 getXmlOutputFile().getAsFile().get(),
                 node -> ConfigureJavaFormatterXml.configureJavaFormat(node, uris));
     }
+
+    /** A class, not a lambda: the configuration cache stores it with the task. */
+    private static final class BundledFormatterIsExtracted implements Spec<Task> {
+        @Override
+        public boolean isSatisfiedBy(Task task) {
+            var xml = (UpdatePalantirJavaFormatIdeaXmlFile) task;
+            return !xml.getImplementationConfig().isEmpty()
+                    || BundledFormatter.isExtracted(
+                            xml.getGradleUserHome().get().getAsFile());
+        }
+    }
 }