@vzn/vx-history 0.0.651 → 0.0.653

package/README.md

@@ -36,7 +36,8 @@ A recorded p50 always wins over an assumption, and assumptions never feed the wo
 `url` (or `VX_HISTORY_URL`), its base URL without `/v1`, names a
 [`@vzn/vx-history-server`](https://github.com/vznjs/vx/tree/main/packages/vx-history-server),
 over `https://` (`http://` only to `127.0.0.1`, `::1` or `localhost`: every
-request carries the CI token).
+request carries the CI token), with no `?query` or `#fragment` (each
+route is appended to it).
 On a CI job with a token (GitHub's OIDC token, which needs
 `permissions: id-token: write` to set `ACTIONS_ID_TOKEN_REQUEST_URL`
 and `ACTIONS_ID_TOKEN_REQUEST_TOKEN`, or a GitLab `id_tokens` entry
@@ -55,10 +56,14 @@ timings of the tasks it ran, once: under DTE that is the orchestrator,
 with each worker's measurements. The upload starts as the last task
 ends, beside core's own end of run, and the plugin's teardown waits at
 most 2 s more for it (core bounds a teardown at 3 s); one not done by
-then is dropped and said, with how many timings it held. A task that shared a crowded worker's
+then is dropped and said, with how many timings it held and the status
+the server last answered, if one came. A task that shared a crowded worker's
 cores is sent as long as it would have taken alone, and its cores at
 most its machine's, as local history keeps them. A refusal is said with the server's
-words; a refused token (401) also names the repository and issuer the
+words, each token the request sent written `***`. Every warning shows the server's url with a `user:pass@` as
+`***@`. An answer is read no further than the protocol's largest (64 KiB,
+and 2 KiB more per hash a query asks): a longer one, a server's endless
+stream, is refused as `answered over N bytes`. A refused token (401) also names the repository and issuer the
 workspace declares and the audience it must carry, and the server is
 off for the rest of the run. A CI job with no token says so once (on GitHub Actions,
 `GITHUB_ACTIONS`, naming the permission).
@@ -77,6 +82,17 @@ unset value is left out, and a name the request sets itself
 redirect is not followed (it would carry them on): it fails the request,
 naming where it pointed.
 
+The same upload carries the flaky record: each cached task the run
+ran, by definition and cache key, with how it ended (`pass`, `fail`,
+or `flaky` when it passed on a retry). A task that ran behind a failed
+dependency (`--continue=always`) is left out: its result is not its
+key's. The server names a task flaky
+when one key failed and later passed, or a run saw it flake, on any
+branch of the repository. The run's query answers which of its tasks
+are flaky, and core gives such a task one retry when it fails, as it
+does a task its local history knows as flaky. So a CI machine that
+starts empty still retries a known flake.
+
 ```ts
 export default {
   plugins: [
@@ -127,9 +143,11 @@ The file is `{ "version": 1, "tasks": { "<task id>": <ms> } }`, keys
 sorted; an entry that is not a number of ms from 0 to 2^53 is dropped. A p50 recorded on this machine wins over it, and it wins over
 `assume`; like `assume`, it never feeds the workspace median. A task the
 run did not see keeps its time, one another writer put there while the
-run ran included. A file that is not one warns and is read as empty, one
-it cannot write warns and the run goes on; `--dry` writes
-nothing.
+run ran included. A run that executed nothing and restored only tasks
+the file already times leaves it as it was; an all-cached run writes a
+missing one. A file that is not one warns, is read as empty and is never
+written over; one it cannot write warns and the run goes on; `--dry`
+writes nothing.
 
 ## Reservations learned from history
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx-history",
-  "version": "0.0.651",
+  "version": "0.0.653",
   "license": "MIT",
   "description": "History-based scheduling for vx — a `schedule` plugin that orders ready tasks by their expected remaining critical path, learned from the local run history.",
   "keywords": [
@@ -37,7 +37,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@vzn/vx": "^0.0.651"
+    "@vzn/vx": "^0.0.653"
   },
   "repository": {
     "type": "git",

package/src/history-server.ts

@@ -15,6 +15,35 @@ export interface ServerTiming {
   readonly rssBytes?: number
 }
 
+/** One cached task's run, as the server's flaky record keeps it (PROTOCOL.md "Outcomes"). */
+export interface ServerOutcome {
+  /** The task's definition hash. */
+  readonly hash: string
+  /** The run's cache key. */
+  readonly key: string
+  readonly outcome: 'pass' | 'fail' | 'flaky'
+}
+
+/** What a query answers: each held hash's numbers, and the hashes asked that are flaky. */
+export interface Answer {
+  readonly timings: Map<string, ServerTiming>
+  readonly flaky: Set<string>
+}
+
+/**
+ * A cached task the run ran, as the flaky record takes it; else undefined.
+ * A hit ran nothing, and a task behind a failure ran on bytes its key never
+ * named: neither says anything of the key.
+ */
+export function outcomeOf(o: TaskOutcome, def: string): ServerOutcome | undefined {
+  if (o.node.config.cache !== true || o.hash === undefined || o.hash === '') return undefined
+  if (o.blockedBy !== undefined || o.taintedBy !== undefined) return undefined
+  if (o.status === 'failed') return { hash: def, key: o.hash, outcome: 'fail' }
+  if (o.status !== 'success') return undefined
+  const flaky = (o.attempts ?? 1) > 1 || o.flaky !== undefined
+  return { hash: def, key: o.hash, outcome: flaky ? 'flaky' : 'pass' }
+}
+
 /** Every request's deadline: a run never waits on history longer. */
 const DEADLINE_MS = 10_000
 /** Tries of a request, to the server or GitHub's OIDC endpoint, before it fails (`tried`). */
@@ -79,10 +108,56 @@ const printable = (s: string): string =>
   // oxlint-disable-next-line no-control-regex
   s.replace(/[\x00-\x1f\x7f-\x9f]/g, (c) => `\\x${c.charCodeAt(0).toString(16).padStart(2, '0')}`)
 
-/** A refusal, named by its status and the server's own `message`. */
-async function refusal(res: Response): Promise<Error> {
+/**
+ * A body's first `max` bytes as text, the rest cancelled unread, and
+ * whether there was more: a server's endless answer grew vx to 3 GB in
+ * 10 s (vx-cache's `upTo`).
+ */
+async function upTo(res: Response, max: number): Promise<{ text: string; over: boolean }> {
+  const reader = res.body?.getReader()
+  if (reader === undefined) return { text: '', over: false }
+  const parts: Uint8Array[] = []
+  let n = 0
+  for (;;) {
+    const { done, value } = await reader.read()
+    if (done) break
+    parts.push(value)
+    n += value.byteLength
+    if (n > max) {
+      // quiet: the answer is refused for its size; its cancel adds nothing
+      await reader.cancel().catch(() => {})
+      return { text: Buffer.concat(parts).subarray(0, max).toString('utf8'), over: true }
+    }
+  }
+  return { text: Buffer.concat(parts).toString('utf8'), over: false }
+}
+
+/** A CI token is a few hundred bytes: room to spare. */
+const SMALL_ANSWER_BYTES = 64 * 1024
+/**
+ * A query's answer per hash asked: its row (the hash, up to 512 bytes, and
+ * four numbers) and its place in `flaky` are under 1 200 bytes in JSON.
+ */
+const QUERY_BYTES_PER_HASH = 2048
+
+/** Shorter values are not hidden, as core masks none under 6 characters: each would blank common words. */
+const MIN_TOKEN_CHARS = 6
+
+/** `text` with each of `tokens` written `***`. */
+function hideTokens(text: string, tokens: Iterable<string>): string {
+  let out = text
+  for (const token of tokens)
+    if (token.length >= MIN_TOKEN_CHARS) out = out.replaceAll(token, '***')
+  return out
+}
+
+/**
+ * A refusal, named by its status and the server's own `message`, each
+ * token `hide` knows written `***` before the cut, so none is left in part.
+ */
+async function refusal(res: Response, hide: (text: string) => string): Promise<Error> {
   // quiet: with the body unread, the status alone names the refusal
-  const text = (await res.text().catch(() => '')).slice(0, 2048)
+  const { text } = await upTo(res, 2048).catch(() => ({ text: '' }))
   let said = text
   try {
     const m = (JSON.parse(text) as { message?: unknown }).message
@@ -90,13 +165,14 @@ async function refusal(res: Response): Promise<Error> {
   } catch {
     // quiet: not JSON, so the text is what it said
   }
-  said = printable(said.replace(/\s+/g, ' ').trim().slice(0, 200))
+  said = printable(hide(said).replace(/\s+/g, ' ').trim().slice(0, 200))
   return new Error(`HTTP ${res.status}${said === '' ? '' : `: ${said}`}`)
 }
 
-/** A 200's JSON; one that is none (a website's page) names the likely fault, the url. */
-async function jsonOf(res: Response, path: string): Promise<unknown> {
-  const text = await res.text()
+/** A 200's JSON of at most `max` bytes; one that is none (a website's page) names the likely fault, the url. */
+async function jsonOf(res: Response, path: string, max: number): Promise<unknown> {
+  const { text, over } = await upTo(res, max)
+  if (over) throw new Error(`${path} answered over ${max} bytes`)
   try {
     return JSON.parse(text)
   } catch {
@@ -113,9 +189,15 @@ async function jsonOf(res: Response, path: string): Promise<unknown> {
  */
 async function redirected(res: Response, from: string): Promise<Error> {
   await res.body?.cancel()
-  const to = res.headers.get('location')
+  const location = res.headers.get('location')
+  const to = location === null ? null : new URL(location, from)
+  // A relative Location keeps the url's `user:pass@`, and the error reaches the CI log.
+  if (to !== null && to.username + to.password !== '') {
+    to.username = '***'
+    to.password = ''
+  }
   return new Error(
-    `HTTP ${res.status}${to === null ? '' : ` to ${new URL(to, from).href}`}: not followed, as it would carry the server's headers; name the server's own URL`,
+    `HTTP ${res.status}${to === null ? '' : ` to ${to.href}`}: not followed, as it would carry the server's headers; name the server's own URL`,
   )
 }
 
@@ -138,17 +220,46 @@ function expiryOf(jwt: string): number {
 const isCount = (n: unknown): n is number =>
   typeof n === 'number' && Number.isSafeInteger(n) && n >= 0
 
-interface Limits {
-  readonly maxUploadTimings: number
-  readonly maxQueryHashes: number
+/**
+ * A request refused for its size, its refusal naming a smaller limit
+ * (`vx-max-*`): sent again in parts of at most `max`.
+ */
+class TooMany extends Error {
+  constructor(readonly max: number) {
+    super(`at most ${max} a request`)
+  }
+}
+
+/** The limit `header` names, when it is a whole number above 0. */
+function limitOf(res: Response, header: string): number | undefined {
+  const n = Number(res.headers.get(header) ?? NaN)
+  return Number.isSafeInteger(n) && n > 0 ? n : undefined
 }
 
 export class HistoryServer {
   private token: Promise<string> | undefined
   private held: { jwt: string; exp: number } | undefined
-  private limits: Promise<Limits> | undefined
   // A refused token is refused again: the run's later calls stay unasked and unsaid.
   private refused = false
+  /**
+   * Every token this client sent: a server that quoted a request's
+   * Authorization header in its refusal printed it to the CI log, as core
+   * masks only secret-named variables.
+   */
+  private readonly sent = new Set<string>()
+  private readonly hidden = (text: string): string => hideTokens(text, this.sent)
+
+  /** `work`, each error it throws with every token sent hidden: the one way an error leaves the client. */
+  private async guard<T>(work: Promise<T>): Promise<T> {
+    try {
+      return await work
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err)
+      const hidden = this.hidden(message)
+      if (hidden === message) throw err
+      throw new Error(hidden)
+    }
+  }
 
   constructor(
     readonly url: string,
@@ -180,9 +291,16 @@ export class HistoryServer {
       const u = new URL(ask)
       u.searchParams.set('audience', new URL(this.url).origin)
       const res = await this.askGithub(u, signal)
-      if (!res.ok) throw new Error(`GitHub's OIDC endpoint: ${(await refusal(res)).message}`)
-      // quiet: a body that is not JSON holds no token, said below
-      const jwt = ((await res.json().catch(() => null)) as { value?: unknown } | null)?.value
+      if (!res.ok)
+        throw new Error(`GitHub's OIDC endpoint: ${(await refusal(res, this.hidden)).message}`)
+      const { text, over } = await upTo(res, SMALL_ANSWER_BYTES)
+      if (over) throw new Error(`GitHub's OIDC endpoint: answered over ${SMALL_ANSWER_BYTES} bytes`)
+      let jwt: unknown
+      try {
+        jwt = (JSON.parse(text) as { value?: unknown } | null)?.value
+      } catch {
+        // quiet: a body that is not JSON holds no token, said below
+      }
       if (typeof jwt !== 'string' || jwt === '') throw new Error("GitHub's OIDC endpoint: no token")
       return { jwt, exp: expiryOf(jwt) }
     })()
@@ -224,6 +342,7 @@ export class HistoryServer {
 
   /** GitHub's OIDC endpoint: a 4xx is final. */
   private askGithub(ask: URL, signal?: AbortSignal): Promise<Response> {
+    this.sent.add(this.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN ?? '')
     return this.tried(
       () =>
         this.fetchImpl(ask, {
@@ -234,8 +353,20 @@ export class HistoryServer {
     )
   }
 
-  private async call(path: string, body?: unknown, signal?: AbortSignal): Promise<Response> {
+  /**
+   * One request. `sized`: its body's count of items and the `vx-max-*`
+   * header that limits them; a refusal naming a smaller limit throws
+   * `TooMany`.
+   */
+  private async call(
+    path: string,
+    body?: unknown,
+    signal?: AbortSignal,
+    sized?: { count: number; header: string },
+    answered?: (status: number | undefined) => void,
+  ): Promise<Response> {
     const bearer = this.writes ? await this.bearer(signal) : ''
+    if (bearer !== '') this.sent.add(bearer)
     const json = body === undefined ? undefined : JSON.stringify(body)
     // A 500 is the server's own failure, maybe after the fold: sent again, a
     // run would count twice. The edge's 502, 503 and 504 and a 429 come
@@ -243,8 +374,9 @@ export class HistoryServer {
     // would add seconds to every run's end.
     const url = `${this.url}${path}`
     const res = await this.tried(
-      () =>
-        this.fetchImpl(url, {
+      () => {
+        answered?.(undefined)
+        return this.fetchImpl(url, {
           method: json === undefined ? 'GET' : 'POST',
           headers: {
             ...this.headers,
@@ -254,13 +386,17 @@ export class HistoryServer {
           ...(json === undefined ? {} : { body: json }),
           signal: deadline(signal),
           redirect: 'manual',
-        }),
+        }).then((r) => {
+          answered?.(r.status)
+          return r
+        })
+      },
       (status) => status !== undefined && (status === 429 || (status >= 502 && status <= 504)),
     )
     if (res.status >= 300 && res.status < 400) throw await redirected(res, url)
     if (res.status === 401 && bearer === '') {
       // Off CI: the bare 401 said nothing of why or what to do (2026-10-26).
-      const err = await refusal(res)
+      const err = await refusal(res, this.hidden)
       const fix =
         this.env.GITHUB_ACTIONS === 'true'
           ? 'give the job `permissions: id-token: write`'
@@ -272,65 +408,105 @@ export class HistoryServer {
     if (res.status === 401) {
       // The bare "HTTP 401: wrong audience" named neither what was sent nor what to check.
       this.refused = true
-      const err = await refusal(res)
+      const err = await refusal(res, this.hidden)
       throw new Error(
         `${err.message}: the token was refused (this workspace names ${this.named.repository} at ${this.named.issuer}; the server's ALLOW must name it, and the token's audience be ${new URL(this.url).origin}); the history server is off for this run`,
       )
     }
-    if (!res.ok) throw await refusal(res)
+    if (!res.ok) {
+      const max = sized === undefined ? undefined : limitOf(res, sized.header)
+      if (max !== undefined && sized!.count > max) {
+        await res.body?.cancel()
+        throw new TooMany(max)
+      }
+      throw await refusal(res, this.hidden)
+    }
     return res
   }
 
-  /** `/v1/capabilities`, asked once a run, and again after a failed ask: nothing is guessed. */
-  private limitsNow(): Promise<Limits> {
-    const asked = (this.limits ??= (async () => {
-      const body = (await jsonOf(
-        await this.call('/v1/capabilities'),
-        '/v1/capabilities',
-      )) as Partial<Limits> | null
-      const n = (v: unknown) => (typeof v === 'number' && Number.isSafeInteger(v) && v > 0 ? v : 0)
-      const limits = {
-        maxUploadTimings: n(body?.maxUploadTimings),
-        maxQueryHashes: n(body?.maxQueryHashes),
-      }
-      if (limits.maxUploadTimings === 0 || limits.maxQueryHashes === 0) {
-        throw new Error('/v1/capabilities named no maxUploadTimings or maxQueryHashes')
+  /**
+   * `items` in requests of `send`, whole until an answer names the limit
+   * (`vx-max-*`): one refused for its size is sent again in parts of the
+   * limit it names, each a smaller one than the last. Nothing is asked apart: `/v1/capabilities` cost
+   * every run a request, and the query a round-trip (2026-11-06). A query
+   * sends its parts at once; an upload one after another, so a refused
+   * part resends no part the server folded.
+   */
+  private async parts<T, R>(
+    items: readonly T[],
+    header: string,
+    atOnce: boolean,
+    send: (part: readonly T[], sized?: { count: number; header: string }) => Promise<R>,
+  ): Promise<R[]> {
+    let per = this.limits.get(header) ?? items.length
+    const sized = (part: readonly T[]) => ({ count: part.length, header })
+    const learn = (err: unknown): void => {
+      if (!(err instanceof TooMany) || this.limits.get(header) === err.max) throw err
+      this.limits.set(header, err.max)
+      per = err.max
+    }
+    const split = (from: readonly T[]) =>
+      Array.from({ length: Math.ceil(from.length / per) }, (_, i) =>
+        from.slice(i * per, (i + 1) * per),
+      )
+    if (atOnce) {
+      const first = await Promise.allSettled(split(items).map((p) => send(p, sized(p))))
+      const refused = first.flatMap((r) => (r.status === 'rejected' ? [r.reason as unknown] : []))
+      const failed = refused.find((err) => !(err instanceof TooMany))
+      if (failed !== undefined) throw failed
+      if (refused.length === 0) return first.map((r) => (r as PromiseFulfilledResult<R>).value)
+      learn(refused[0])
+      return Promise.all(split(items).map((p) => send(p)))
+    }
+    const out: R[] = []
+    for (let at = 0; at < items.length;) {
+      const part = items.slice(at, at + per)
+      try {
+        out.push(await send(part, sized(part)))
+        at += part.length
+      } catch (err) {
+        learn(err)
       }
-      return limits
-    })())
-    // quiet: the awaited ask rethrows it; this only forgets it
-    asked.catch(() => {
-      if (this.limits === asked) this.limits = undefined
-    })
-    return asked
+    }
+    return out
   }
 
-  /** Each held hash's numbers under the first of `refs` that holds them: one request a run. */
-  async query(
-    refs: readonly string[],
-    hashes: readonly string[],
-  ): Promise<Map<string, ServerTiming>> {
-    if (hashes.length === 0 || this.refused) return new Map()
-    const per = (await this.limitsNow()).maxQueryHashes
-    const parts = await Promise.all(
-      Array.from({ length: Math.ceil(hashes.length / per) }, async (_, i) => {
-        const res = await this.call('/v1/timings/query', {
-          ...this.named,
-          refs,
-          hashes: hashes.slice(i * per, (i + 1) * per),
-        })
-        const body = (await jsonOf(res, '/v1/timings/query')) as { timings?: unknown } | null
-        if (typeof body?.timings !== 'object' || body.timings === null) {
-          throw new Error('the query answered no `timings` object')
-        }
-        return Object.entries(body.timings as Record<string, ServerTiming | null>)
-      }),
-    )
+  /** The limits a refusal named this run, by header: later requests keep to them. */
+  private readonly limits = new Map<string, number>()
+
+  /** Each held hash's numbers under the first of `refs` that holds them, and the flaky ones: one request a run. */
+  async query(refs: readonly string[], hashes: readonly string[]): Promise<Answer> {
+    if (hashes.length === 0 || this.refused) return { timings: new Map(), flaky: new Set() }
+    const asked = this.parts(hashes, 'vx-max-query-hashes', true, async (part, sized) => {
+      const res = await this.call(
+        '/v1/timings/query',
+        { ...this.named, refs, hashes: part },
+        undefined,
+        sized,
+      )
+      const max = SMALL_ANSWER_BYTES + part.length * QUERY_BYTES_PER_HASH
+      const body = (await jsonOf(res, '/v1/timings/query', max)) as {
+        timings?: unknown
+        flaky?: unknown
+      } | null
+      if (typeof body?.timings !== 'object' || body.timings === null) {
+        throw new Error('the query answered no `timings` object')
+      }
+      // A server before the flaky record answers none: nothing is flaky.
+      const flaky = Array.isArray(body.flaky)
+        ? body.flaky.filter((h): h is string => typeof h === 'string')
+        : []
+      return {
+        timings: Object.entries(body.timings as Record<string, ServerTiming | null>),
+        flaky,
+      }
+    })
+    const parts = await this.guard(asked)
     // Only numbers a server folds (PROTOCOL.md): `1e309` parses to Infinity,
     // and kept as a forecast it made a NaN weight that failed every later
     // run of the cache in `schedule`.
     const out = new Map<string, ServerTiming>()
-    for (const [hash, t] of parts.flat()) {
+    for (const [hash, t] of parts.flatMap((p) => p.timings)) {
       if (!isCount(t?.durationMs)) continue
       out.set(hash, {
         durationMs: t.durationMs,
@@ -340,16 +516,37 @@ export class HistoryServer {
         ...(isCount(t.rssBytes) ? { rssBytes: t.rssBytes } : {}),
       })
     }
-    return out
+    return { timings: out, flaky: new Set(parts.flatMap((p) => p.flaky)) }
   }
 
-  /** The run's timings, by task definition hash, in uploads of at most `maxUploadTimings`; `stop` abandons them. */
-  async upload(timings: ReadonlyMap<string, ServerTiming>, stop?: AbortSignal): Promise<void> {
-    if (timings.size === 0 || this.refused) return
-    const per = (await this.limitsNow()).maxUploadTimings
+  /**
+   * The run's timings, by task definition hash, and its outcomes, in
+   * uploads the server takes; `stop` abandons them. `answered` hears each
+   * try's status, undefined as it is sent.
+   */
+  async upload(
+    timings: ReadonlyMap<string, ServerTiming>,
+    stop?: AbortSignal,
+    outcomes: readonly ServerOutcome[] = [],
+    answered?: (status: number | undefined) => void,
+  ): Promise<void> {
+    if ((timings.size === 0 && outcomes.length === 0) || this.refused) return
     const all = [...timings].map(([hash, t]) => ({ hash, ...t }))
-    for (let i = 0; i < all.length; i += per) {
-      await this.call('/v1/timings/upload', { timings: all.slice(i, i + per) }, stop)
-    }
+    const at = Array.from({ length: Math.max(all.length, outcomes.length) }, (_, i) => i)
+    // A refused upload folded nothing: sent again in parts, none counts twice.
+    await this.guard(
+      this.parts(at, 'vx-max-upload-timings', false, (part, sized) => {
+        const from = part[0] ?? 0
+        const to = from + part.length
+        const some = outcomes.slice(from, to)
+        return this.call(
+          '/v1/timings/upload',
+          { timings: all.slice(from, to), ...(some.length > 0 ? { outcomes: some } : {}) },
+          stop,
+          sized,
+          answered,
+        )
+      }),
+    )
   }
 }

package/src/index.ts

@@ -33,7 +33,7 @@ import {
 import type { CommandContext } from '@vzn/vx'
 import path from 'node:path'
 import type { HistoryRow } from './history-view.js'
-import type { HistoryServer, Named, ServerTiming } from './history-server.js'
+import type { HistoryServer, Named, ServerOutcome, ServerTiming } from './history-server.js'
 
 export interface VxHistoryOptions {
   /** How many recent invocations to learn from. Default 20. */
@@ -189,15 +189,16 @@ const headroomOf = (options: VxHistoryOptions): number => {
   return usable(h) ? h : DEFAULT_HEADROOM
 }
 
-// The schedule reads no rates (`resourcesFor`); `vx history` shows runs.
-const readHistory = (
+// The file takes each task's p50 alone (`durationsFor`): `resourcesFor`'s
+// grouped reads of the window were 40 of its 55 ms at 8,002 tasks.
+const readDurations = (
   cache: Cache,
   ids: readonly string[],
   options: VxHistoryOptions,
   branch: string | null,
   defs: ReadonlyMap<string, string>,
-): Promise<ReadonlyMap<string, TaskResources>> =>
-  localHistory(cache, { recent: windowOf(options), branch, defs }).resourcesFor(ids)
+): Promise<ReadonlyMap<string, number>> =>
+  localHistory(cache, { recent: windowOf(options), branch, defs }).durationsFor(ids)
 
 /** What each task reserves: learned from the history unless `resources: false`, a declared reservation over either. */
 const reservationsFor = (
@@ -248,13 +249,6 @@ function assumptions(
 const isDuration = (ms: unknown): ms is number =>
   typeof ms === 'number' && ms >= 0 && ms <= Number.MAX_SAFE_INTEGER
 
-/** The timings file's durations a run can take; the rest are not carried. */
-function carriedOf(read: Readonly<Record<string, number>>): Record<string, number> {
-  const out: Record<string, number> = {}
-  for (const [id, ms] of Object.entries(read)) if (isDuration(ms)) out[id] = ms
-  return out
-}
-
 /** Each option `VxHistoryOptions` names, with its kind: derived from the type, so the two cannot drift. */
 const VX_HISTORY_KEYS: PluginOptionKinds<VxHistoryOptions> = {
   window: 'number',
@@ -290,10 +284,12 @@ function shown(url: string): string {
  * http:// to another host sent it in clear.
  */
 function secure(url: string): boolean {
-  if (/^https:\/\/\S/.test(url)) return true
-  if (!/^http:\/\/\S/.test(url)) return false
-  const host = URL.parse(url)?.hostname
-  return host === '127.0.0.1' || host === '[::1]' || host === 'localhost'
+  // Parsed as the request will be: a scheme in any case, no url it cannot carry.
+  const u = URL.parse(url)
+  if (u === null || u.host === '') return false
+  if (u.protocol === 'https:') return true
+  if (u.protocol !== 'http:') return false
+  return u.hostname === '127.0.0.1' || u.hostname === '[::1]' || u.hostname === 'localhost'
 }
 
 /** `VX_HISTORY_URL` under the option, trailing slashes dropped; undefined when neither names one. */
@@ -309,6 +305,12 @@ function serverUrlOf(
     throw new UserError(
       `vxHistory(): ${from} must be https (http only to 127.0.0.1, ::1 or localhost), got ${shown(url)}`,
     )
+  // Each route is appended to the url: past a `?` or `#` it was query or
+  // fragment, and every request asked the server's root.
+  if (/[?#]/.test(url))
+    throw new UserError(
+      `vxHistory(): ${from} takes no ?query or #fragment: each route is appended to it, got ${shown(url)}`,
+    )
   // Each route is the server's /v1/…: one that names /v1 asked /v1/v1/…, and every answer was a 404.
   if (url.endsWith('/v1'))
     throw new UserError(
@@ -403,7 +405,7 @@ export function vxHistory(options: VxHistoryOptions = {}): VxPlugin {
       const carried =
         file === undefined
           ? {}
-          : carriedOf((await import('./timings-file.js')).readTimings(file, ctx.warn))
+          : ((await import('./timings-file.js')).readTimings(file, ctx.warn) ?? {})
       const defs = taskDefinitions(nodes.values())
       if (file !== undefined)
         scheduled = {
@@ -463,7 +465,8 @@ export function vxHistory(options: VxHistoryOptions = {}): VxPlugin {
         stopImport = () => (late = true)
         const weights = (async () => {
           const hashes = [...new Set(ids.flatMap((id) => defs.get(id) ?? []))]
-          const got = await server.query(refs, hashes)
+          const { timings: got, flaky } = await server.query(refs, hashes)
+          if (flaky.size > 0 && !late) ctx.flaky(ids.filter((id) => flaky.has(defs.get(id) ?? '')))
           const timings = new Map<string, number>()
           const needs = new Map<string, TaskResources>()
           for (const id of ids) {
@@ -486,7 +489,7 @@ export function vxHistory(options: VxHistoryOptions = {}): VxPlugin {
         })().catch((err: unknown) => {
           if (!late) {
             ctx.warn(
-              `[vx] vx-history: the timings of the history server at ${server.url} were not applied: ${err instanceof Error ? err.message : String(err)}`,
+              `[vx] vx-history: the timings of the history server at ${shown(server.url)} were not applied: ${err instanceof Error ? err.message : String(err)}`,
             )
           }
           return undefined
@@ -528,25 +531,39 @@ export function vxHistory(options: VxHistoryOptions = {}): VxPlugin {
         defs: ReadonlyMap<string, string>
       }
     | undefined
-  let inRun = false
-  // A run that executed nothing and restored only tasks the file already
-  // times leaves it as it was: an all-cached CI run re-reads no history.
-  let changed = false
-  let fileWarn: { root: string; warn: (m: string) => void } | undefined
+  // The run's side of the file, from `setup`: the tasks it decided, and
+  // what reads the history when core asked no `schedule` (every task a
+  // confirmed local hit), so a missing file is written then too.
+  let fileRun:
+    | {
+        file: string
+        root: string
+        warn: (m: string) => void
+        cacheDir: string
+        branch: string | null
+        nodes: Map<string, TaskNode>
+        ran: boolean
+      }
+    | undefined
   hooks.setup = async (ctx) => {
     remote ??= await serverOf()
     if (remote?.writes === true) {
-      const { timingOf: timing } = await import('./history-server.js')
+      const { timingOf: timing, outcomeOf } = await import('./history-server.js')
       // Only the run that ran the tasks hears them: under DTE, the
       // orchestrator, with each worker's measurements.
       const timings = new Map<string, ServerTiming>()
-      const sent = (reported = { timings, warn: ctx.warn })
+      // Each task and key once, as the server takes them.
+      const outcomes = new Map<string, ServerOutcome>()
+      const sent = (reported = { timings, outcomes, warn: ctx.warn })
       const server = remote
       ctx.on('onTaskComplete', (node, outcome) => {
         if (node.config.exec?.command === undefined) return
         const def = taskDefinitions([node]).get(node.id)
+        if (def === undefined) return
         const t = timing(outcome)
-        if (def !== undefined && t !== undefined) timings.set(def, t)
+        if (t !== undefined) timings.set(def, t)
+        const o = outcomeOf(outcome, def)
+        if (o !== undefined) outcomes.set(`${o.hash}\0${o.key}`, o)
       })
       // Every outcome is known here, and core's own end of run (history
       // rows, cache uploads, telemetry) is still ahead: sent from teardown,
@@ -567,16 +584,22 @@ export function vxHistory(options: VxHistoryOptions = {}): VxPlugin {
       )
     }
     if (options.file === undefined) return
-    fileWarn = { root: ctx.workspaceRoot, warn: ctx.warn }
-    inRun = true
-    changed = false
+    const run: NonNullable<typeof fileRun> = {
+      file: path.resolve(ctx.workspaceRoot, options.file),
+      root: ctx.workspaceRoot,
+      warn: ctx.warn,
+      cacheDir: ctx.cacheDir,
+      branch: ctx.branch,
+      nodes: new Map(),
+      ran: false,
+    }
+    fileRun = run
     ctx.on('onTaskComplete', (node, outcome) => {
       // A group runs nothing and is never timed: counting it rewrote the
       // file on every all-cached run that went through one.
       if (node.config.exec?.command === undefined) return
-      if (outcome.status === 'success' || !(node.id in (scheduled?.carried ?? {}))) {
-        changed = true
-      }
+      run.nodes.set(node.id, node)
+      if (outcome.status === 'success') run.ran = true
     })
   }
   // After the run's history is recorded and before its cache closes.
@@ -591,33 +614,56 @@ export function vxHistory(options: VxHistoryOptions = {}): VxPlugin {
     uploading = undefined
     // Counted from here: the file's write below shares the bound.
     const waited = server !== undefined && sent !== undefined ? waitFor(UPLOAD_WAIT_MS) : undefined
-    const done = scheduled
-    const wrote = inRun && changed
+    const sched = scheduled
+    const done = fileRun
     scheduled = undefined
-    inRun = false
+    fileRun = undefined
     // The file first: core bounds a teardown (3 s), and an upload ahead of
     // it held the write hostage to the server's network. A failed write
     // still sends.
     try {
-      if (wrote && done !== undefined) {
-        const table = await readHistory(done.cache, done.ids, options, done.branch, done.defs)
+      if (done !== undefined && done.nodes.size > 0) {
         const timings = await import('./timings-file.js')
-        // Over the file as it is now: a time another writer (a run in another
-        // worktree sharing it) put there since `schedule` read it is kept. Its
-        // fault, if any, was said when the run read it.
-        const now = timings.readTimings(done.file, () => {})
-        let written = true
-        try {
-          timings.writeTimings(done.file, { ...done.carried, ...now }, table)
-        } catch (err) {
-          // Only the file is lost: said as the read is, not as a plugin failure.
-          written = false
-          fileWarn?.warn(
-            `[vx] vx-history: timings file ${done.file} not written: ${err instanceof Error ? err.message : String(err)}`,
-          )
+        // With no `schedule`, the file is first read here, and its fault said here.
+        let now = sched === undefined ? timings.readTimings(done.file, done.warn) : undefined
+        const carried = sched?.carried ?? now ?? {}
+        // A run that executed nothing and restored only tasks the file already
+        // times leaves it as it was: an all-cached CI run re-reads no history.
+        if (done.ran || [...done.nodes.keys()].some((id) => !(id in carried))) {
+          // Over the file as it is now: a time another writer (a run in another
+          // worktree sharing it) put there since `schedule` read it is kept. Its
+          // fault, if any, was said when the run read it.
+          if (sched !== undefined) now = timings.readTimings(done.file, () => {})
+          // Not a timings file (a mistyped `file`): never written over.
+          if (now !== undefined) {
+            // Asked now, answered beside the read and the write.
+            const ignored = timings.askIgnored(done.file, done.root)
+            const cache = sched?.cache ?? new Cache(done.cacheDir)
+            let table: ReadonlyMap<string, number>
+            try {
+              table = await readDurations(
+                cache,
+                sched?.ids ?? [...done.nodes.keys()],
+                options,
+                sched?.branch ?? done.branch,
+                sched?.defs ?? taskDefinitions(done.nodes.values()),
+              )
+            } finally {
+              if (sched === undefined) cache.close()
+            }
+            let written = true
+            try {
+              timings.writeTimings(done.file, { ...carried, ...now }, table)
+            } catch (err) {
+              // Only the file is lost: said as the read is, not as a plugin failure.
+              written = false
+              done.warn(
+                `[vx] vx-history: timings file ${done.file} not written: ${err instanceof Error ? err.message : String(err)}`,
+              )
+            }
+            if (written) await timings.warnUnignored(done.file, done.root, done.warn, ignored)
+          }
         }
-        if (written && fileWarn !== undefined)
-          timings.warnUnignored(done.file, fileWarn.root, fileWarn.warn)
       }
     } finally {
       if (server !== undefined && sent !== undefined && waited !== undefined) {
@@ -627,8 +673,9 @@ export function vxHistory(options: VxHistoryOptions = {}): VxPlugin {
         if (late) {
           u.stop.abort()
           const n = sent.timings.size
+          const status = u.answered()
           sent.warn(
-            `[vx] vx-history: the timings of ${n} task${n === 1 ? '' : 's'} were not sent to the history server at ${server.url}: no answer in the ${UPLOAD_WAIT_MS} ms a teardown waits`,
+            `[vx] vx-history: the timings of ${n} task${n === 1 ? '' : 's'} were not sent to the history server at ${shown(server.url)}: ${status === undefined ? `no answer in the ${UPLOAD_WAIT_MS} ms a teardown waits` : `it answered HTTP ${status}, and the ${UPLOAD_WAIT_MS} ms a teardown waits ran out before it was asked again`}`,
           )
         }
       }
@@ -659,6 +706,7 @@ export function vxHistory(options: VxHistoryOptions = {}): VxPlugin {
 
 interface Reported {
   readonly timings: Map<string, ServerTiming>
+  readonly outcomes: ReadonlyMap<string, ServerOutcome>
   readonly warn: (m: string) => void
 }
 
@@ -666,6 +714,8 @@ interface Upload {
   /** Settles when sent, or once a failure is said; never rejects. */
   readonly done: Promise<void>
   readonly stop: AbortController
+  /** The status the upload's latest try answered; undefined while it waits for one. */
+  readonly answered: () => number | undefined
 }
 
 /**
@@ -677,14 +727,17 @@ const UPLOAD_WAIT_MS = 2_000
 
 function sendTimings(server: HistoryServer, sent: Reported): Upload {
   const stop = new AbortController()
-  const done = server.upload(sent.timings, stop.signal).catch((err: unknown) => {
-    // Abandoned by teardown, which says so itself.
-    if (stop.signal.aborted) return
-    sent.warn(
-      `[vx] vx-history: the timings were not sent to the history server at ${server.url}: ${err instanceof Error ? err.message : String(err)}`,
-    )
-  })
-  return { done, stop }
+  let answered: number | undefined
+  const done = server
+    .upload(sent.timings, stop.signal, [...sent.outcomes.values()], (s) => (answered = s))
+    .catch((err: unknown) => {
+      // Abandoned by teardown, which says so itself.
+      if (stop.signal.aborted) return
+      sent.warn(
+        `[vx] vx-history: the timings were not sent to the history server at ${shown(server.url)}: ${err instanceof Error ? err.message : String(err)}`,
+      )
+    })
+  return { done, stop, answered: () => answered }
 }
 
 /** Resolves true after `ms`, unless cancelled first. */

package/src/timings-file.ts

@@ -4,12 +4,18 @@
 
 import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
-import type { TaskResources } from '@vzn/vx'
 
 const VERSION = 1
 
-/** The file's durations; none when it is absent, and none, with a warning, when it is not one. */
-export function readTimings(file: string, warn: (m: string) => void): Record<string, number> {
+/**
+ * The file's durations; none when it is absent or unread (with a warning),
+ * and undefined, with a warning, when it is a file but not a timings file:
+ * not one to write over.
+ */
+export function readTimings(
+  file: string,
+  warn: (m: string) => void,
+): Record<string, number> | undefined {
   let text: string
   try {
     text = readFileSync(file, 'utf8')
@@ -35,32 +41,34 @@ export function readTimings(file: string, warn: (m: string) => void): Record<str
     warn(
       `[vx] vx-history: timings file ${file} ignored: not { "version": ${VERSION}, "tasks": { id: ms } }`,
     )
-    return {}
+    return undefined
   }
-  const out: Record<string, number> = {}
-  for (const [id, ms] of Object.entries(tasks)) {
+  // Filtered in place: the parse is this read's own, and a copy of an
+  // 8,002-task file, filtered again by the caller, was ~6 ms of each
+  // all-cached run's teardown (2026-11-07).
+  const out = tasks as Record<string, unknown>
+  for (const id in out) {
+    const ms = out[id]
     // Bounded so no chain of them sums past a number: core refuses a
     // weight that is not finite, and the run failed on a hint.
-    if (typeof ms === 'number' && ms >= 0 && ms <= Number.MAX_SAFE_INTEGER) out[id] = ms
+    if (!(typeof ms === 'number' && ms >= 0 && ms <= Number.MAX_SAFE_INTEGER)) delete out[id]
   }
-  return out
+  return out as Record<string, number>
 }
 
 /**
- * The carried durations with this machine's p50s over them, written whole:
- * a task this run did not see keeps its carried time. Through a temp and a
- * rename, so a reader never sees half a file. Its directory is made: a CI
- * cache that missed restores none.
+ * The carried durations with this machine's p50s (`durationsFor`) over
+ * them, written whole: a task this run did not see keeps its carried time.
+ * Through a temp and a rename, so a reader never sees half a file. Its
+ * directory is made: a CI cache that missed restores none.
  */
 export function writeTimings(
   file: string,
   carried: Readonly<Record<string, number>>,
-  table: ReadonlyMap<string, TaskResources>,
+  p50s: ReadonlyMap<string, number>,
 ): void {
   const merged: Record<string, number> = { ...carried }
-  for (const [id, h] of table) {
-    if (h.p50DurationMs !== undefined) merged[id] = Math.round(h.p50DurationMs)
-  }
+  for (const [id, ms] of p50s) merged[id] = Math.round(ms)
   const tasks: Record<string, number> = {}
   for (const id of Object.keys(merged).sort()) tasks[id] = merged[id]!
   const tmp = `${file}.${process.pid}.tmp`
@@ -75,23 +83,45 @@ export function writeTimings(
 }
 
 /**
- * Says so when git does not ignore the file it rewrote: a task whose
- * inputs cover it (a root project's `**`) keyed each run's new timings,
- * and missed the run after every write. Asked after the write, off the run.
+ * Whether git ignores `file`, asked now and answered when git exits: true
+ * for a file outside the root, no repository, or a git that cannot run,
+ * which say nothing of it. Started before the history read, the check runs
+ * beside it: asked after the write, it held the run's end 7-10 ms.
  */
-export function warnUnignored(file: string, root: string, warn: (m: string) => void): void {
+export function askIgnored(file: string, root: string): Promise<boolean> {
   const rel = path.relative(root, file)
   // `..x.json` is a name inside the root, not a step out of it.
-  if (rel === '..' || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)) return
-  const p = Bun.spawnSync({
-    cmd: ['git', 'check-ignore', '-q', '--', rel],
-    cwd: root,
-    stdout: 'ignore',
-    stderr: 'ignore',
-  })
-  // 0: ignored; 128: no repository or git refused, which says nothing of it.
-  if (p.exitCode !== 1) return
+  if (rel === '..' || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel))
+    return Promise.resolve(true)
+  try {
+    const p = Bun.spawn({
+      cmd: ['git', 'check-ignore', '-q', '--', rel],
+      cwd: root,
+      stdin: 'ignore',
+      stdout: 'ignore',
+      stderr: 'ignore',
+    })
+    // 0: ignored; 128: no repository or git refused.
+    return p.exited.then((code) => code !== 1)
+  } catch {
+    // quiet: no git to run is no workspace git, which ignores nothing to warn of.
+    return Promise.resolve(true)
+  }
+}
+
+/**
+ * Says so when git does not ignore the file it rewrote: a task whose
+ * inputs cover it (a root project's `**`) keyed each run's new timings,
+ * and missed the run after every write.
+ */
+export async function warnUnignored(
+  file: string,
+  root: string,
+  warn: (m: string) => void,
+  ignored: Promise<boolean> = askIgnored(file, root),
+): Promise<void> {
+  if (await ignored) return
   warn(
-    `[vx] vx-history: timings file ${rel} is not git-ignored, so a task whose inputs cover it re-keys on every rewrite — add it to .gitignore`,
+    `[vx] vx-history: timings file ${path.relative(root, file)} is not git-ignored, so a task whose inputs cover it re-keys on every rewrite — add it to .gitignore`,
   )
 }