@vzn/vx-dte 0.0.652 → 0.0.653

package/src/orchestrator.ts

@@ -63,7 +63,8 @@ import { names } from './outputs.js'
 
 interface Job {
   readonly req: ExecuteRequest
-  readonly need: Need
+  /** Read as it joined the queue, and again while it waits when history changes (`rerank`). */
+  need: Need
   /** The cores and memory it holds on its worker: its need, or the whole worker for one that filled its worker. */
   held?: Need
   readonly resolve: (r: ExecuteResult) => void
@@ -141,6 +142,12 @@ interface Worker {
   load?: { cpu: number; memory: number; at: number }
   /** Tasks whose outputs it holds: it ran them, or was sent them. */
   readonly has: Set<string>
+  /**
+   * The persistent tasks it runs, each with the base it books there
+   * (`Need.servers`): booked once, by the first task placed there that
+   * needs it, and given back when the run says none needs it.
+   */
+  readonly serving: Map<string, number>
   /** Each dependency it was sent whole, by the key it was sent under: the next order names it alone. */
   readonly sentDeps: Map<string, string>
   /** Sends to it go out in order: a run's parts before the run. */
@@ -158,6 +165,8 @@ export interface Declared {
   readonly memory: number
   /** Its size's platform: a worker reporting another is refused. None: planned as this machine's. */
   readonly platform?: string
+  /** Where tasks match it when the run has several worker types: `<type>:<platform>`. */
+  readonly place?: string
 }
 
 export interface OrchestratorOptions {
@@ -167,6 +176,8 @@ export interface OrchestratorOptions {
   readonly tree: string
   readonly nodes: () => ReadonlyMap<string, TaskNode> | undefined
   readonly need: (taskId: string) => Need
+  /** Each server's base, cores, as workers fit them: updated in place. */
+  readonly bases?: Map<string, number>
   /** The run's cache, by key: what workers save to and this machine restores from. */
   readonly artifacts: TaskArtifacts
   /** What workers read the cache under (`ExecutorContext.cacheFacts`). */
@@ -197,6 +208,11 @@ export interface OrchestratorOptions {
   readonly how?: Strategy
   /** The platform a task naming none runs on (`homeOf`). */
   readonly home?: string | undefined
+  /** A joined worker's place, by its size and the platform it reported: absent, the platform. */
+  readonly joinedPlace?: (
+    size: string | undefined,
+    platform: string | undefined,
+  ) => string | undefined
   /** No task began or ended for `stallMs`: what the run waits on, one line a task. */
   readonly stalled?: (waiting: string) => void
   /** A fault the run works around (a message the relay would not take); default stderr. */
@@ -233,6 +249,8 @@ const ADVICE: Record<WorkerAdvice['of'], readonly [label: string, note: string]>
   more: ['more', "past its sizes' max"],
   any: ['any', 'of any cores, the least core time'],
 }
+/** A platform as shown: a worker type's place (`ubuntu:linux-x64`) without its type, which its size names. */
+const bare = (platform: string): string => platform.slice(platform.indexOf(':') + 1)
 /** `3 × small (4c/16G linux)`. */
 const fleetText = (w: WorkerAdvice['workers'][number]): string =>
   `${w.count} × ${w.size === undefined ? '' : `${w.size} `}(${w.cores}c/${compact(w.memoryBytes)}${w.platform === undefined ? '' : ` ${w.platform}`})`
@@ -290,6 +308,8 @@ export class Orchestrator {
   private inTree?: Promise<Tree | undefined>
   /** Waiting tasks, by id, in the order a pump reads them (`Queue`). */
   private readonly waiting = new Map<string, Job>()
+  /** Handed by core and not yet waiting: held for a machine as the waiting are. */
+  private readonly handed = new Set<string>()
   private readonly queue: Queue
   /** Where a worker saved each task it ran: its cache key or its run key. */
   private readonly savedAs = new Map<string, string>()
@@ -321,6 +341,10 @@ export class Orchestrator {
   private readonly retired = new Set<Worker>()
   /** Workers asked for that never joined, with why. */
   private readonly unstarted = new Map<string, string>()
+  /** A task waited here on a worker: one ended with none joined needed one. */
+  private waited = false
+  /** Why each worker this run refused was refused, in order. */
+  private readonly refused: string[] = []
   /** Started, then not needed before they joined (`release`), or given up as late. */
   private readonly cancelled = new Set<string>()
   /** Of `cancelled`, those given up past their join limit, not let go: taken if they join. */
@@ -407,11 +431,32 @@ export class Orchestrator {
 
   async execute(req: ExecuteRequest): Promise<ExecuteResult> {
     if (this.lost !== undefined) throw new Error(this.lost)
+    this.handed.add(req.taskId)
+    try {
+      return await this.take(req)
+    } finally {
+      this.handed.delete(req.taskId)
+    }
+  }
+
+  private async take(req: ExecuteRequest): Promise<ExecuteResult> {
     // Walked once here, for every later read: walked again on the way in,
     // sharing, placing and sending, a run of 8000 tasks spent 17 s of this
     // machine's CPU on it (2026-11-05).
     const nodes = this.o.nodes()
     const up = upstream(nodes, req.taskId)
+    // A worker runs a task in its project's directory of the run's tree: a
+    // project whose config is untracked is not there, and every worker
+    // failed to spawn it, exit 127 (2026-11-07).
+    const dir = path.relative(this.o.root, req.cwd)
+    if (dir !== '' && !dir.startsWith('..')) {
+      this.inTree ??= listTree(this.o.root, this.o.tree)
+      const tree = await this.inTree
+      if (tree !== undefined && !holds(tree, dir))
+        throw new UserError(
+          `${req.taskId} runs in ${dir}, which is not in the commit workers check out: commit its project (its vx.config file is untracked)`,
+        )
+    }
     // A worker runs the run's tree: a file its key includes that the tree
     // lacks (untracked) is not there, and the output it saved under that
     // key was a stale hit for the next run (2026-10-24).
@@ -440,6 +485,21 @@ export class Orchestrator {
             : `${req.taskId} keys ${stray.path}, in submodule ${link}, whose files workers do not check out: leave it out of the task's inputs`,
         )
       }
+      // A worker runs the commit's bytes and modes (`unfilter`): a file on
+      // disk otherwise (CRLF a git filter wrote, an expanded ident, an LFS
+      // file's content) is not what it builds on, and the output saved
+      // under the key of this disk's bytes was a stale hit (2026-11-08).
+      const off =
+        tree === undefined
+          ? undefined
+          : req.inputs.files.find((f) => {
+              const has = tree.files.get(f.path)
+              return has !== undefined && has !== f.digest && !made(f.path)
+            })
+      if (off !== undefined)
+        throw new UserError(
+          `${req.taskId} keys ${off.path}, which is on disk other than the commit workers check out holds it (a git filter's text, eol, ident or LFS bytes, or core.autocrlf): leave it out of the task's inputs, or run the task without dte`,
+        )
     }
     for (const u of req.inputs?.upstream ?? []) this.upstreamKeys.set(u.taskId, u.hash)
     await this.share(up, nodes)
@@ -456,6 +516,7 @@ export class Orchestrator {
       // A retry runs elsewhere: the worker, or what ran beside it, may be the flake.
       const last = (req.attempt ?? 1) > 1 ? this.ranOn.get(req.taskId) : undefined
       if (last !== undefined) job.avoid = last
+      this.handed.delete(req.taskId)
       // A signal aborted already fires no `abort`.
       if (req.signal?.aborted === true) return resolve(stopped())
       req.signal?.addEventListener('abort', () => this.abort(job), { once: true })
@@ -534,6 +595,17 @@ export class Orchestrator {
     return this.trace.events(this.ended ? this.endedAt : performance.now())
   }
 
+  /** No task left in the run uses server `task`: each worker that started it stops it. */
+  unneeded(task: string): void {
+    for (const a of this.workers.values()) {
+      const base = a.serving.get(task)
+      if (base === undefined) continue
+      a.serving.delete(task)
+      a.usedCores -= base
+      this.post(a, { type: 'unserve', task })
+    }
+  }
+
   private abort(job: Job): void {
     if (this.waiting.get(job.req.taskId) === job) {
       this.waiting.delete(job.req.taskId)
@@ -555,9 +627,23 @@ export class Orchestrator {
     })
   }
 
+  /**
+   * History changed (`need`, `tail`): the waiting book and rank by it. On
+   * CI the default branch's timings land a moment after the roots joined
+   * the queue, each booked as unmeasured and ranked as an unknown task:
+   * shards ready later went first, and test.wire waited 129 s (2026-11-07).
+   */
+  rerank(): void {
+    for (const [id, job] of this.waiting)
+      job.need = { ...this.o.need(id), platform: job.need.platform }
+    this.queue.rerank()
+    this.pumpSoon()
+  }
+
   /** `jobs` wait, in order, behind the waiting tasks or, `front`, before them. */
   private enqueue(jobs: readonly Job[], front = false): void {
     for (const j of jobs) this.waiting.set(j.req.taskId, j)
+    if (jobs.length > 0) this.waited = true
     this.queue.add(
       jobs.map((j) => j.req.taskId),
       front,
@@ -582,6 +668,7 @@ export class Orchestrator {
         running,
         has: a.has,
         platform: a.platform,
+        serving: new Set(a.serving.keys()),
         a,
       }
     })
@@ -606,6 +693,7 @@ export class Orchestrator {
       const a = to.get(job.req.taskId)!.a
       job.worker = a.id
       job.sentAt = performance.now()
+      a.usage.sent(job.sentAt)
       a.busy.set(job.req.taskId, job)
       job.held = {
         cores: Math.min(this.booking(job.need).cores, a.cores),
@@ -622,6 +710,12 @@ export class Orchestrator {
       })
       a.usedCores += job.held.cores
       a.usedMemory += job.held.memory
+      // A server it starts there books its base once, while it runs.
+      for (const sv of job.need.servers ?? [])
+        if (!a.serving.has(sv.id)) {
+          a.serving.set(sv.id, sv.cores)
+          a.usedCores += sv.cores
+        }
       const batch = batches.get(a)
       if (batch === undefined) batches.set(a, [job])
       else batch.push(job)
@@ -709,7 +803,11 @@ export class Orchestrator {
     return this.o.pinWaitMs ?? PIN_WAIT_MS
   }
 
-  /** `ids`, uncached tasks that ran, run again where `where` says, for a dependant. */
+  /**
+   * `ids`, uncached tasks that ran, run again where `where` says, for a
+   * dependant: on its place, which the plan refused when one names another
+   * worker type or platform (`apart`).
+   */
   private remake(
     ids: readonly string[],
     where: { only?: string; avoid?: string; platform?: string | undefined },
@@ -813,7 +911,15 @@ export class Orchestrator {
     if (load === undefined) return
     a.load = { cpu: Number(load.cpu) || 0, memory: Number(load.memory) || 0, at: performance.now() }
     const avg = Number(load.avg)
-    if (Number.isFinite(avg) && avg >= 0) a.usage.machineAvg = avg
+    const self = Number(load.self)
+    if (Number.isFinite(avg) && avg >= 0)
+      a.usage.machine(avg, Number.isFinite(self) && self >= 0 ? self : undefined, a.load.at)
+    // Its servers' bases as it fits them (`server-fit.ts`): what the next
+    // task needing one books, and the next run.
+    if (typeof load.servers === 'object' && load.servers !== null)
+      for (const [id, cores] of Object.entries(load.servers))
+        if (typeof cores === 'number' && Number.isFinite(cores) && cores >= 0 && cores <= a.cores)
+          this.o.bases?.set(id, cores)
     const tasks = Number(load.tasks)
     this.trace.load(a.label, a.load.cpu, a.load.at, Number.isFinite(tasks) ? tasks : undefined)
   }
@@ -829,7 +935,8 @@ export class Orchestrator {
         !joined.has(id) &&
         !this.unstarted.has(id) &&
         !this.cancelled.has(id) &&
-        (platform === undefined || (declared.platform ?? hostPlatform()) === platform) &&
+        (platform === undefined ||
+          (declared.place ?? declared.platform ?? hostPlatform()) === platform) &&
         (declared.cpu > above.cores || declared.memory > above.memory)
       )
         return true
@@ -942,7 +1049,9 @@ export class Orchestrator {
       // A task sent here leaves its outputs here for its dependants.
       a.has.add(req.taskId)
       const node = nodes?.get(req.taskId)
-      const env = defined(req.env, req.envDefine)
+      const keyed = hostKeyed(req)
+      const env = defined(req.env, req.envDefine, keyed)
+      const unset = keyed.filter((k) => req.env[k] === undefined && !(k in req.envDefine))
       const order = {
         task: req.taskId,
         // Unsaved: under the run's own key, as an uncached task's.
@@ -960,6 +1069,7 @@ export class Orchestrator {
         cwd: path.relative(this.o.root, req.cwd),
         project: node === undefined ? '' : path.relative(this.o.root, node.projectDir),
         env,
+        ...(unset.length === 0 ? {} : { unset }),
         ...(node?.config.exec?.env?.secret === undefined
           ? {}
           : { secret: [...node.config.exec.env.secret] }),
@@ -983,6 +1093,13 @@ export class Orchestrator {
                   : {
                       reads: req.sandbox.dependencyReads.map((d) => path.relative(this.o.root, d)),
                     }),
+                ...(req.sandbox.dependencyReported === undefined
+                  ? {}
+                  : {
+                      reported: req.sandbox.dependencyReported.map((d) =>
+                        path.relative(this.o.root, d),
+                      ),
+                    }),
               },
             }),
         ...runtimeOrders(req),
@@ -1070,6 +1187,9 @@ export class Orchestrator {
           // Its orders' bytes, a comma between each, in the batch's own.
           a.usage.bytesIn += bytesOf({ ...batch, tasks: [] }) + bytes + tasks.length - 1
           for (const { intro } of part) for (const [t, k] of intro) a.sentDeps.set(t, k)
+          for (const { order } of part)
+            for (const sv of order.servers ?? [])
+              if (!a.serving.has(sv.task)) a.serving.set(sv.task, 0)
           for (const { job } of part) {
             pending.delete(job)
             // Sent, it runs: its worker takes only what it has room for.
@@ -1403,7 +1523,11 @@ export class Orchestrator {
     if (body.type === 'joined') {
       const info = body.info as Partial<WorkerInfo> | null
       const id = body.id!
+      // Only the worker heard why: the run sat silent and its footer said
+      // none joined (2026-11-07).
       const refuse = (reason: string): void => {
+        this.refused.push(reason)
+        this.warn(`dte: refused worker ${typeof info?.id === 'string' ? info.id : id}: ${reason}`)
         void this.o.me
           .send(id, { type: 'refused', reason } satisfies ToWorker)
           .catch(this.unsent('refused', id))
@@ -1475,7 +1599,7 @@ export class Orchestrator {
         cores,
         memory,
         reported: { cores: Number(info.cores), memory: Number(info.memory) },
-        platform,
+        platform: this.o.joinedPlace?.(spawn?.declared.size, platform) ?? platform,
         usedCores: 0,
         usedMemory: 0,
         label,
@@ -1483,6 +1607,7 @@ export class Orchestrator {
         started: new Set(),
         batches: 0,
         has: new Set(),
+        serving: new Map(),
         sentDeps: new Map(),
         // Its name first, before any batch.
         chain: this.cache()
@@ -1514,6 +1639,8 @@ export class Orchestrator {
     a.usage.to = performance.now()
     this.trace.left(a.label, 'lost', a.usage.to)
     this.gone.push(a)
+    // Its results' `end`s never come.
+    for (const k of this.parts.keys()) if (k.startsWith(`${a.id}\0`)) this.parts.delete(k)
     // Its tasks run again: first, as they were first to go.
     const back: Job[] = []
     for (const j of [...a.busy.values()]) {
@@ -1649,7 +1776,7 @@ export class Orchestrator {
   where(taskId: string): string | null | undefined {
     for (const a of this.workers.values())
       if (a.busy.has(taskId)) return a.started.has(taskId) ? a.label : null
-    return this.waiting.has(taskId) ? null : undefined
+    return this.waiting.has(taskId) || this.handed.has(taskId) ? null : undefined
   }
 
   /**
@@ -1705,7 +1832,7 @@ export class Orchestrator {
   }): void {
     const work = p.work?.map(
       (t) =>
-        `${t.id} ${t.ms === undefined ? '?' : Math.round(t.ms / 100) / 10}s ${Math.round(t.cores * 100) / 100}c${t.platform === undefined ? '' : ` ${t.platform}`}`,
+        `${t.id} ${t.ms === undefined ? '?' : Math.round(t.ms / 100) / 10}s ${Math.round(t.cores * 100) / 100}c${t.platform === undefined ? '' : ` ${bare(t.platform)}`}`,
     )
     const workers = p.workers.map((w) =>
       w.starting === true
@@ -1811,6 +1938,7 @@ export class Orchestrator {
         cores: a.cores,
         memory: a.memory,
         platform: a.platform,
+        ...(a.serving.size === 0 ? {} : { serving: new Map(a.serving) }),
         ...(a.declared === undefined ? {} : { size: a.declared.size }),
         at: 0,
         idle: a.busy.size === 0,
@@ -1837,7 +1965,7 @@ export class Orchestrator {
           // A size naming none is planned as this machine's, as `dte()`
           // planned it: on no platform, no task naming one fit it, and the
           // next plan cancelled it.
-          platform: declared.platform ?? hostPlatform(),
+          platform: declared.place ?? declared.platform ?? hostPlatform(),
           size: declared.size,
           at: Math.max(
             0,
@@ -1969,8 +2097,14 @@ export class Orchestrator {
 
   /** Every task sent here and not done fails with `reason`; later ones too. */
   private fail(reason: string): void {
-    for (const a of this.workers.values())
+    const now = performance.now()
+    for (const a of this.workers.values()) {
       for (const j of a.busy.values()) j.reject(new Error(reason))
+      // Lost, keeping what it ran: dropped, the footer read it as never joined.
+      a.usage.to = now
+      this.trace.left(a.label, 'lost', now)
+      this.gone.push(a)
+    }
     for (const [id, j] of this.waiting) {
       this.queue.delete(id)
       j.reject(new Error(reason))
@@ -2080,7 +2214,7 @@ export class Orchestrator {
                 count: w.count,
                 cores: w.cores,
                 memoryBytes: w.memory,
-                ...(w.platform === undefined ? {} : { platform: w.platform }),
+                ...(w.platform === undefined ? {} : { platform: bare(w.platform) }),
                 ...(w.size === undefined || sizes.length === 0 ? {} : { size: w.size }),
               })),
             },
@@ -2185,9 +2319,25 @@ export class Orchestrator {
     advice?: () => readonly WorkerAdvice[],
   ): [string, ui.Inline][] {
     // Over with none, it says so: core's own `N workers` (this machine's
-    // pool) read as the run's when no task needed one (2026-10-25).
+    // pool) read as the run's when no task needed one (2026-10-25), and
+    // says when one did and none joined (2026-11-06), and why any it
+    // refused was (2026-11-07).
     if (this.spawnedAt.size === 0 && this.workers.size === 0 && this.gone.length === 0)
-      return this.ended ? [['workers', ui.dim('none started: no task needed one')]] : []
+      return this.ended
+        ? [
+            [
+              'workers',
+              this.refused.length > 0
+                ? ui.tone(
+                    'warn',
+                    `none joined: ${this.refused.length} refused (${this.refused[0]})`,
+                  )
+                : this.waited
+                  ? ui.tone('warn', 'none joined: a task waited on one')
+                  : ui.dim('none started: no task needed one'),
+            ],
+          ]
+        : []
     const gone = new Set(this.gone)
     const all = [...this.workers.values(), ...this.gone]
     const joined = new Set(all.map((a) => a.label))
@@ -2257,13 +2407,18 @@ export class Orchestrator {
     // Once over, what each did, under its line.
     const usage = new Map<string, readonly string[]>()
     let cpuMs = 0
+    let tasksMs = 0
+    let workerMs: number | undefined
     let coreMs = 0
     if (this.ended)
       for (const a of all) {
         resources(a.label, a.reported.cores, a.reported.memory, a.declared)
         const st = a.usage.stats(a.cores, this.endedAt)
-        cpuMs += st.cpuMs
-        coreMs += a.cores * st.onlineMs
+        cpuMs += st.workCoreMs
+        tasksMs += st.tasksUtilization * a.cores * st.workMs
+        if (st.workerUtilization !== undefined)
+          workerMs = (workerMs ?? 0) + st.workerUtilization * a.cores * st.workMs
+        coreMs += a.cores * st.workMs
         usage.set(a.label, describe(st, a.usage))
       }
     return [
@@ -2341,7 +2496,7 @@ export class Orchestrator {
         ? [
             [
               '',
-              `${'total'.padEnd(width)}  cpu utilization ${percent(cpuMs / coreMs)}${this.needMs < LEARN_MS ? '' : ` · tasks used ${percent(this.usedMs / this.needMs)} of their history`}`,
+              `${'total'.padEnd(width)}  ${utilization(cpuMs / coreMs, tasksMs / coreMs, workerMs === undefined ? undefined : workerMs / coreMs)}${this.needMs < LEARN_MS ? '' : ` · tasks used ${percent(this.usedMs / this.needMs)} of their history`}`,
             ] as [string, ui.Inline],
           ]
         : []),
@@ -2421,27 +2576,49 @@ const nested = new WeakMap<
   { dirs: string[]; by: Map<string, readonly string[]> }
 >()
 
-/** A tree's file paths, and its submodules' (gitlinks). */
-type Tree = { files: Set<string>; links: string[] }
+/** A tree's files, each path with its identity as core keys it, and its submodules' (gitlinks); `dirs` once asked. */
+type Tree = { files: Map<string, string>; links: string[]; dirs?: Set<string> }
+
+/** Whether `tree` has a file under `dir`, or `dir` in a submodule (checked out or not, its own say). */
+function holds(tree: Tree, dir: string): boolean {
+  if (tree.dirs === undefined) {
+    const dirs = (tree.dirs = new Set<string>())
+    const above = (f: string): void => {
+      for (let d = path.posix.dirname(f); d !== '.' && !dirs.has(d); d = path.posix.dirname(d))
+        dirs.add(d)
+    }
+    for (const f of tree.files.keys()) above(f)
+    for (const l of tree.links) above(l)
+  }
+  return tree.dirs.has(dir) || tree.links.some((l) => dir === l || dir.startsWith(`${l}/`))
+}
 
 /** `tree`'s files and submodules under `root`, relative to it; undefined when git cannot list it. */
 async function listTree(root: string, tree: string): Promise<Tree | undefined> {
-  const p = Bun.spawn(['git', 'ls-tree', '-r', '-z', tree], {
-    cwd: root,
-    stdin: 'ignore',
-    stdout: 'pipe',
-    stderr: 'ignore',
-  })
+  let p
+  try {
+    p = Bun.spawn(['git', 'ls-tree', '-r', '-z', tree], {
+      cwd: root,
+      stdin: 'ignore',
+      stdout: 'pipe',
+      stderr: 'ignore',
+    })
+  } catch {
+    // quiet: no git, or no root, is git unable to say.
+    return undefined
+  }
   const [out, code] = await Promise.all([new Response(p.stdout).text(), p.exited])
   if (code !== 0) return undefined
-  const files = new Set<string>()
+  const files = new Map<string, string>()
   const links: string[] = []
   for (const e of out.split('\0')) {
     const tab = e.indexOf('\t')
     if (tab === -1) continue
     const name = e.slice(tab + 1)
-    if (e.startsWith('160000 ')) links.push(name)
-    else files.add(name)
+    // `<mode> <type> <oid>`: core's identity is the OID, the mode before it unless a plain file's.
+    const [mode, , oid] = e.slice(0, tab).split(' ')
+    if (mode === '160000') links.push(name)
+    else files.set(name, mode === '100644' ? oid! : `${mode}:${oid}`)
   }
   return { files, links }
 }
@@ -2468,6 +2645,47 @@ function leaves(node: TaskNode): boolean {
   return sandbox === undefined || (sandbox.allow?.write?.length ?? 0) > 0
 }
 
+/**
+ * A task and an upstream of it that `leaves` files, which `bound` says
+ * cannot run where the task does (its `exec.worker` or `exec.platforms`):
+ * the task reads those files where the upstream ran, or runs it again
+ * where it runs itself. Undefined when none.
+ */
+export function apart(
+  nodes: ReadonlyMap<string, TaskNode>,
+  bound: (upstream: TaskNode, dependant: TaskNode) => boolean,
+): { upstream: string; dependant: string } | undefined {
+  const runs = (n: TaskNode): boolean =>
+    n.config.exec?.command !== undefined && n.config.exec.persistent === undefined
+  const named = [...nodes.values()].filter(
+    (n) =>
+      runs(n) &&
+      leaves(n) &&
+      (n.config.exec?.worker !== undefined || n.config.exec?.platforms !== undefined),
+  )
+  if (named.length === 0) return undefined
+  const below = new Map<string, string[]>()
+  for (const n of nodes.values())
+    for (const d of n.deps) {
+      const of = below.get(d)
+      if (of === undefined) below.set(d, [n.id])
+      else of.push(n.id)
+    }
+  for (const u of named) {
+    const seen = new Set<string>()
+    const walk = [...(below.get(u.id) ?? [])]
+    for (let id = walk.pop(); id !== undefined; id = walk.pop()) {
+      if (seen.has(id)) continue
+      seen.add(id)
+      const d = nodes.get(id)
+      if (d === undefined) continue
+      if (runs(d) && bound(u, d)) return { upstream: u.id, dependant: id }
+      walk.push(...(below.get(id) ?? []))
+    }
+  }
+  return undefined
+}
+
 /**
  * Every task `id` depends on, transitively, each after its own
  * dependencies: the order a worker restores them in. Dependant first, an
@@ -2489,11 +2707,17 @@ function upstream(nodes: ReadonlyMap<string, TaskNode> | undefined, id: string):
   return out
 }
 
+/** Core-time busy over core-time had, from first send to last end: its machine, its tasks, its worker. */
+function utilization(machine: number, tasks: number, worker: number | undefined): string {
+  return `cpu utilization machine ${percent(machine)} · tasks ${percent(tasks)}${worker === undefined ? '' : ` · worker ${percent(worker)}`}`
+}
+
 /** A worker's run, spelled out: time, CPU, memory and the relay. */
 function describe(st: UsageStats, u: Usage): string[] {
   return [
     `online ${seconds(st.onlineMs)} · busy ${seconds(st.busyMs)} · idle ${seconds(Math.max(0, st.onlineMs - st.busyMs))}`,
-    `cpu peak ${st.cpuPeak.toFixed(1)} · used avg ${st.cpuAvg.toFixed(1)} cores${st.machineAvg === undefined ? '' : ` · machine avg ${st.machineAvg.toFixed(1)}`} · booked avg ${st.bookedAvg.toFixed(1)} · cpu utilization ${percent(st.utilization)}`,
+    `cpu peak ${st.cpuPeak.toFixed(1)} · used avg ${st.cpuAvg.toFixed(1)} cores${st.machineAvg === undefined ? '' : ` · machine avg ${st.machineAvg.toFixed(1)}`} · booked avg ${st.bookedAvg.toFixed(1)}`,
+    utilization(st.utilization, st.tasksUtilization, st.workerUtilization),
     // No task said what it held: `memory peak 0 B` would be a claim.
     ...(st.memoryPeak > 0
       ? [`memory peak ${bytes(st.memoryPeak)} · avg ${bytes(st.memoryAvg)}`]
@@ -2543,16 +2767,24 @@ function runtimeOrders(req: ExecuteRequest): { runtime?: RuntimeOrder[] } {
 
 /**
  * `env` as it travels: no unset name, and no name whose value is the
- * worker's (`HOST_ENV`) unless `define` sets it. A defined `HOME` ran
- * with the worker's own, saved under a key that folded the defined one
- * (2026-10-24).
+ * worker's (`HOST_ENV`) unless `define` sets it or the task keys it
+ * (`keyed`). A defined `HOME` ran with the worker's own, saved under a key
+ * that folded the defined one (2026-10-24); a keyed `XDG_CONFIG_HOME` did
+ * the same (2026-11-07).
  */
 function defined(
   env: NodeJS.ProcessEnv,
   define: Readonly<Record<string, string>>,
+  keyed: readonly string[] = [],
 ): Record<string, string> {
-  const out: Record<string, string> = {}
+  // No prototype: on `{}`, a name `__proto__` hit the setter and was not sent.
+  const out: Record<string, string> = Object.create(null)
   for (const [k, v] of Object.entries(env))
-    if (v !== undefined && (!HOST_ENV.includes(k) || k in define)) out[k] = v
+    if (v !== undefined && (!HOST_ENV.includes(k) || k in define || keyed.includes(k))) out[k] = v
   return out
 }
+
+/** The `HOST_ENV` names the task's `inputs.env` keys: their value is this machine's, as keyed. */
+function hostKeyed(req: ExecuteRequest): string[] {
+  return (req.inputs?.env ?? []).map((e) => e.name).filter((k) => HOST_ENV.includes(k))
+}