@vzn/vx-migrate 0.0.645 → 0.0.648

package/src/package-fs.ts

@@ -1,6 +1,6 @@
 // What packages.ts needs of the file system and of globs, as core has
 // them: core's copies are not on the façade, and these left core with the
-// package-manager discovery (M, 2026-10-14).
+// package-manager discovery (2026-10-14).
 
 import { readlinkSync, realpathSync } from 'node:fs'
 import path from 'node:path'
@@ -123,6 +123,11 @@ export async function gitTop(dir: string): Promise<string | null> {
     if (await file.exists()) {
       const gitdir = await file.text().catch(() => '')
       if (!/(^|[\s/])\.git\/modules\//.test(gitdir)) return d || '/'
+      // A submodule's own worktree points there too, and is a top-level:
+      // git writes `commondir` in a worktree's gitdir alone.
+      const to = gitdir.replace(/^gitdir:\s*/, '').trim()
+      if (await Bun.file(`${to.startsWith('/') ? '' : `${d}/`}${to}/commondir`).exists())
+        return d || '/'
     }
     if (d === '') return null
   }

package/src/packages.ts

@@ -1,11 +1,11 @@
 // Package-manager workspaces: the members `package.json#workspaces` or
 // `pnpm-workspace.yaml` list, and the root a migration writes
-// `.vx/workspace.ts` at. Core reads neither (M, 2026-10-14): a project is a
+// `.vx/workspace.ts` at. Core reads neither (2026-10-14): a project is a
 // directory holding a vx.config.
 import { constants, existsSync, type Dirent } from 'node:fs'
 import { access, readdir, realpath, stat } from 'node:fs/promises'
 import path from 'node:path'
-import { PROJECT_CONFIG_FILENAMES, UserError } from '@vzn/vx'
+import { PROJECT_CONFIG_FILENAMES, ui, UserError } from '@vzn/vx'
 import {
   BUN_GLOB_WILDCARDS,
   EXTGLOB,
@@ -75,7 +75,7 @@ const decoder = new TextDecoder()
  * Inside git the walk never goes above the git top-level ({@link gitTop}),
  * so a manifest above the checkout is never even read: a `package.json`
  * planted in a shared directory above it claimed it, and its workspace
- * config ran as you (owner, 2026-10-13: "find the root based on git").
+ * config ran as you (2026-10-13: "find the root based on git").
  *
  * Outside git the walk stops above `start` at a manifest another user
  * owns (root aside), the same case without a top-level to stop at
@@ -641,8 +641,9 @@ async function readManifest(root: string, dir: string, file: string): Promise<st
       () => false,
     )
     if (searchable) unreadable(err, file)
-    process.stderr.write(
-      `vx: ${shownDir(root, dir)} is not readable by this user — skipped, with any project in it\n`,
+    ui.say(
+      'warn',
+      `vx: ${shownDir(root, dir)} is not readable by this user — skipped, with any project in it`,
     )
     return null
   }
@@ -768,8 +769,9 @@ export async function discoverPackages(
     shared.sort()
     const shown =
       shared.slice(0, 2).join('; ') + (shared.length > 2 ? `; and ${shared.length - 2} more` : '')
-    process.stderr.write(
-      `vx: left out, as no project can be addressed by a name several manifests share (none has a vx config): ${shown}\n`,
+    ui.say(
+      'warn',
+      `vx: left out, as no project can be addressed by a name several manifests share (none has a vx config): ${shown}`,
     )
   }
 

package/src/plugin-gaps.ts

@@ -1,11 +1,13 @@
 // What a mapping could not say, reported once by `vx lock`, the pass that
-// checks configs (a run checks nothing, M 2026-10-15). What this machine
+// checks configs (a run checks nothing, 2026-10-15). What this machine
 // lacks to run the mapping (a bin, a graph export) is said on runs too. One line per DISTINCT gap, not one per task: n8n has a
 // `dev` and a `watch` in most of its 84 packages, and astro's `build`
 // carries the same `!vendor/**` output in every package — the per-task
 // form was a hundred identical lines before the first frame (2026-09-11).
 // Shared by `turbo()` and `nx()` since the second one existed.
 
+import { taskNameProblem } from '@vzn/vx'
+
 /** What both mappers' projects have in common: a name and tasks with todos. */
 interface MappedProject {
   readonly name: string
@@ -39,25 +41,49 @@ export function collectGaps(
   return { notes, todos, live }
 }
 
-/** At `vx lock` every gap; on a run only the live notes. */
+/**
+ * At `vx lock` every gap; on a run only the live notes. Each says `[vx]`
+ * first, as every plugin warning does, then the package's short name.
+ */
 export function warnGaps(
   warn: (line: string) => void,
   pluginName: string,
   gaps: Gaps,
   lock: boolean,
 ): void {
-  for (const note of gaps.live) warn(`[${pluginName}] ${note}`)
+  const tag = `[vx] ${pluginName.replace(/^@vzn\//, '')}:`
+  for (const note of gaps.live) warn(`${tag} ${note}`)
   if (!lock) return
-  for (const note of gaps.notes) warn(`[${pluginName}] ${note}`)
+  for (const note of gaps.notes) warn(`${tag} ${note}`)
   for (const [todo, ids] of gaps.todos) {
     if (ids.length === 1) {
-      warn(`[${pluginName}] ${ids[0]}: ${todo}`)
+      warn(`${tag} ${ids[0]}: ${todo}`)
       continue
     }
     const names = [...new Set(ids.map((id) => id.slice(id.indexOf('#') + 1)))]
     const packages = new Set(ids.map((id) => id.slice(0, id.indexOf('#'))))
     warn(
-      `[${pluginName}] ${ids.length} task(s) (${names.join(', ')} across ${packages.size} package(s)): ${todo}`,
+      `${tag} ${ids.length} tasks (${names.join(', ')} across ${packages.size} package${packages.size === 1 ? '' : 's'}): ${todo}`,
     )
   }
 }
+
+/**
+ * A task whose name the schema refuses (`lint#fix`, `^up`) becomes a TODO,
+ * as the scripts migrator does (item 1033): written as a task, core
+ * refused the whole config on the next command.
+ */
+export function refuseTaskNames(
+  projects: readonly { tasks: { name: string; todos: string[]; task: object | null }[] }[],
+  what: string,
+): void {
+  for (const p of projects)
+    for (const t of p.tasks) {
+      const why = t.task === null ? null : taskNameProblem(t.name)
+      if (why === null) continue
+      t.task = null
+      t.todos = [
+        `${what} ${JSON.stringify(t.name)} not migrated: its name ${why} — rename it, or add it by hand under another name`,
+      ]
+    }
+}

package/src/remote-cache.ts

@@ -1,6 +1,6 @@
 // The remote cache a Turbo or Nx repo already uses, as the repo shows it,
 // so the workspace file a migration writes keeps sharing it: native or
-// keep, from `vx init` or `bunx @vzn/vx-migrate` (M, 2026-10-14). Nx
+// keep, from `vx init` or `bunx @vzn/vx-migrate` (2026-10-14). Nx
 // Cloud's wire is Nx's own, so it is named, never declared.
 
 import { readFileSync } from 'node:fs'
@@ -28,6 +28,7 @@ export function remoteCacheSignal(root: string, runner: 'turbo' | 'nx'): string
         rc = (
           Bun.JSONC.parse(readFileSync(path.join(root, f), 'utf8')) as { remoteCache?: unknown }
         )?.remoteCache
+        // quiet: a local config file: none read is none declared
       } catch {
         continue
       }
@@ -42,6 +43,7 @@ export function remoteCacheSignal(root: string, runner: 'turbo' | 'nx'): string
     let linked: unknown
     try {
       linked = JSON.parse(readFileSync(path.join(root, '.turbo', 'config.json'), 'utf8'))
+      // quiet: a local config file: none read is none linked
     } catch {}
     if (
       typeof linked === 'object' &&
@@ -63,6 +65,7 @@ export function remoteCacheSignal(root: string, runner: 'turbo' | 'nx'): string
     let text: string
     try {
       text = readFileSync(path.join(root, f), 'utf8')
+      // quiet: a local config file: none read is none declared
     } catch {
       continue
     }
@@ -84,6 +87,7 @@ function usesNxCloud(root: string): boolean {
   } | null
   try {
     json = Bun.JSONC.parse(readFileSync(path.join(root, 'nx.json'), 'utf8')) as typeof json
+    // quiet: a local config file: none read is none declared
   } catch {
     return false
   }

package/src/remote-deadline.ts

@@ -11,9 +11,15 @@
  */
 export function deadline(timeoutMs: number): AbortSignal {
   const controller = new AbortController()
+  // A timer past 2^31-1 ms fires after 1 ms: a 30-day
+  // TURBO_REMOTE_CACHE_TIMEOUT aborted every request as it started. Turbo
+  // defines that value, so it is held here; an option is refused at the call.
   setTimeout(
     () => controller.abort(new Error(`no answer within ${timeoutMs} ms`)),
-    timeoutMs,
+    Math.min(timeoutMs, MAX_TIMER_MS),
   ).unref()
   return controller.signal
 }
+
+/** The longest delay a timer holds. */
+export const MAX_TIMER_MS = 2 ** 31 - 1

package/src/remote-refusal.ts

@@ -0,0 +1,31 @@
+/** How long the body's first chunk is waited for: a refusal is not held on a body that never comes. */
+const BODY_WAIT_MS = 1_000
+
+/**
+ * A remote's refusal, named by its status and its own words: "HTTP 500"
+ * alone said nothing, and a batch query Vercel refused with 400 "Too many
+ * hashes. Limit is 100." read as no answer and was never seen (main
+ * f71b377, 2026-10-23). One line of the body, bounded: it is remote text.
+ * Shared by `turboCache()` and `nxCache()`.
+ */
+export async function refusal(res: Response, what = ''): Promise<Error> {
+  let said = ''
+  try {
+    const reader = res.body?.getReader()
+    if (reader !== undefined) {
+      let timer: ReturnType<typeof setTimeout> | undefined
+      const first = await Promise.race([
+        reader.read(),
+        new Promise<undefined>((r) => {
+          timer = setTimeout(() => r(undefined), BODY_WAIT_MS)
+        }),
+      ]).finally(() => clearTimeout(timer))
+      // quiet: read no further; a cancel that fails has nothing left to free
+      void reader.cancel().catch(() => undefined)
+      said = new TextDecoder().decode(first?.value?.subarray(0, 512)).replace(/\s+/g, ' ').trim()
+    }
+  } catch {
+    // quiet: the status alone still names the refusal
+  }
+  return new Error(`${what}HTTP ${res.status}${said === '' ? '' : `: ${said.slice(0, 200)}`}`)
+}

package/src/remote-retry.ts

@@ -24,7 +24,8 @@ export class Cooldown {
  * One request with Turbo's retry rule (`turborepo-api-client/src/retry.rs`):
  * a 5xx other than 501, or a request that never connected, is sent again
  * after 2 s, `retries` times. A 429 opens the remote's `cooldown` for its
- * `Retry-After` (capped at 10 s a wait, 2 s without one), and the request
+ * `Retry-After` (capped at 10 s a wait, 2 s without one or for a `0`
+ * after the first), and the request
  * is resent once it ends, as often as fits in 20 s from its first 429: a
  * limit longer than one capped wait lost every hit before (Growth's
  * parity run, 2026-10-16). A spent deadline is not retried, unlike
@@ -55,8 +56,12 @@ export async function withRetry(
       continue
     }
     if (res.status === 429) {
+      // `Retry-After: 0` resends at once, but only once in a row: each
+      // answered so sent again at once, hundreds a second for 20 s.
+      const asked = retryAfterMs(res)
+      const delay =
+        asked === undefined || (asked === 0 && firstLimit !== undefined) ? BACKOFF_MS : asked
       firstLimit ??= now()
-      const delay = retryAfterMs(res) ?? BACKOFF_MS
       if (retries === 0 || now() + delay - firstLimit > RATE_LIMIT_BUDGET_MS) return res
       cooldown.extend(delay)
       await res.body?.cancel()
@@ -77,10 +82,10 @@ function retryable(status: number): boolean {
   return status >= 500 && status !== 501
 }
 
-/** A refused port or an unresolved host, as Bun's `fetch` codes them (measured on 1.4.2). */
+/** A refused port or an unresolved host, as Bun's `fetch` codes them (1.4.4 took errno names). */
 function neverConnected(err: unknown): boolean {
   const code = (err as { code?: unknown } | null)?.code
-  return code === 'ConnectionRefused' || code === 'ENOTFOUND'
+  return code === 'ECONNREFUSED' || code === 'ENOTFOUND'
 }
 
 /** `Retry-After` as seconds or an HTTP date, capped as Turbo caps it. */

package/src/remote-url.ts

@@ -0,0 +1,28 @@
+import { UserError } from '@vzn/vx'
+
+/**
+ * A remote cache's URL, refused as `from` names it (an option, a variable,
+ * a config file). Shared by `turboCache()` and `nxCache()`, at the call for
+ * the option and when the cache opens for every source.
+ *
+ * Plain http:// to any host is taken, where vxCache() takes it only to
+ * loopback: Turbo and Nx both send their token over it, and their
+ * self-hosted servers document such URLs (`TURBO_API=http://cache:3000`
+ * beside a CI service container; nx-cache-server's
+ * `NX_SELF_HOSTED_REMOTE_CACHE_SERVER=http://your-server:3000`). These
+ * plugins run such a repo unchanged.
+ */
+export function checkRemoteUrl(url: string, from: string): void {
+  // With no scheme every request failed on its own, as a bare "Invalid URL".
+  if (!/^https?:\/\//.test(url))
+    throw new UserError(`${from} must be an http(s) URL, got ${JSON.stringify(url)}`)
+  // The URL is printed in every refusal line, so a `user:pass@` in it would
+  // leak to the log. Credentials go in the token.
+  if (URL.canParse(url)) {
+    const u = new URL(url)
+    if (u.username !== '' || u.password !== '')
+      throw new UserError(
+        `${from} carries credentials (user:pass@); pass them as the token instead`,
+      )
+  }
+}

package/src/script-command.ts

@@ -20,9 +20,10 @@
 //   the shims `yarn run` writes, so inlined, `node -e "require('left-pad')"`
 //   was MODULE_NOT_FOUND (2026-09-28). Every script runs as `yarn run <name>`.
 
-import { readFileSync } from 'node:fs'
+import { existsSync, readFileSync } from 'node:fs'
 import path from 'node:path'
 import { foldScriptHooks } from '@vzn/vx'
+import { shellQuote } from './nx-command.js'
 
 const YARN_RUN_BUILTIN = /(^|&&|\|\||;|\(|\|)\s*run\s/
 const LIFECYCLE = /^(pre|post)(install|publish|pack|version)$|^(prepare|prepublishOnly|install)$/
@@ -36,15 +37,22 @@ export function scriptCommand(
   body: string,
   scripts: Readonly<Record<string, unknown>> = {},
   pnp = false,
+  /** `runsScriptHooks`: false where the manager runs no `pre` / `post` hook. */
+  hooks = true,
 ): string {
-  if (pnp) return `yarn run ${name}`
+  if (pnp) return yarnRun(name)
   const hook = (h: string): string | undefined =>
-    !LIFECYCLE.test(h) && usable(scripts[h]) ? scripts[h] : undefined
+    hooks && !LIFECYCLE.test(h) && usable(scripts[h]) ? scripts[h] : undefined
   const parts = [hook(`pre${name}`), body, hook(`post${name}`)]
-  if (parts.some((p) => p !== undefined && YARN_RUN_BUILTIN.test(p))) return `yarn run ${name}`
+  if (parts.some((p) => p !== undefined && YARN_RUN_BUILTIN.test(p))) return yarnRun(name)
   return foldScriptHooks(parts[0], body, parts[2])
 }
 
+/** `yarn run <name>`, the name one shell word: `a b` ran script `a` with an argument. */
+export function yarnRun(name: string): string {
+  return `yarn run ${shellQuote(name)}`
+}
+
 /**
  * Yarn ≥ 2 links Plug'n'Play unless `.yarnrc.yml` names another `nodeLinker`.
  * Read once per mapping; synchronous so every mapper, the synchronous ones
@@ -67,3 +75,101 @@ export async function yarnrcText(root: string): Promise<string> {
     .text()
     .catch(() => '\0absent')
 }
+
+/**
+ * The package manager that owns `dir`, when it runs `pre` / `post` hooks
+ * around a script; null when it runs none. The manager is the nearest `packageManager` field or
+ * lockfile, and its settings are read beside it, as each reads them for a
+ * member too. Probed with a `prebuild` / `build` / `postbuild` trio: Yarn
+ * 2+ runs none (D-31); npm runs none under `ignore-scripts=true` in
+ * `.npmrc`; pnpm runs none under `enable-pre-post-scripts=false` there or
+ * `enablePrePostScripts: false` in `pnpm-workspace.yaml` (D-33); Bun and
+ * Yarn 1 run them whatever those say. No manager found is npm's default.
+ */
+export function runsScriptHooks(dir: string, memo: Map<string, Owner>): string | null {
+  const { manager, at } = ownerOf(dir, memo)
+  const read = (f: string): string | undefined => {
+    try {
+      return readFileSync(path.join(at, f), 'utf8')
+    } catch {
+      return undefined
+    }
+  }
+  const npmrc = read('.npmrc') ?? ''
+  const set = (key: string, value: string): boolean =>
+    new RegExp(`^\\s*${key}\\s*=\\s*${value}\\s*$`, 'm').test(npmrc)
+  const runs =
+    manager === 'berry'
+      ? false
+      : manager === 'npm'
+        ? !set('ignore-scripts', 'true')
+        : manager === 'pnpm'
+          ? !set('enable-pre-post-scripts', 'false') && !pnpmSkipsHooks(read('pnpm-workspace.yaml'))
+          : true
+  return runs ? manager : null
+}
+
+/**
+ * `enablePrePostScripts: false` in `pnpm-workspace.yaml`, read as pnpm reads
+ * it, as YAML: a line regex missed `false # hooks off` and a flow mapping,
+ * which pnpm 10 honours, and folded hooks pnpm does not run.
+ */
+function pnpmSkipsHooks(yaml: string | undefined): boolean {
+  if (yaml === undefined) return false
+  try {
+    const parsed = Bun.YAML.parse(yaml) as { enablePrePostScripts?: unknown } | null
+    return parsed?.enablePrePostScripts === false
+  } catch {
+    return false
+  }
+}
+
+/** The package manager that owns a directory, and the directory that says so. */
+export interface Owner {
+  manager: string
+  at: string
+}
+
+/**
+ * The nearest `packageManager` field or lockfile from `dir` up: `berry` for
+ * Yarn 2+, `yarn` for Yarn 1, else the manager's name; none found is npm.
+ */
+export function ownerOf(dir: string, memo: Map<string, Owner>): Owner {
+  const known = memo.get(dir)
+  if (known !== undefined) return known
+  const read = (f: string): string | undefined => {
+    try {
+      return readFileSync(path.join(dir, f), 'utf8')
+    } catch {
+      return undefined
+    }
+  }
+  let manager: string | undefined
+  try {
+    // A byte-order mark is stripped, as npm, pnpm and discovery strip it:
+    // JSON.parse threw on one and the field went unread.
+    const manifest = (read('package.json') ?? '').replace(/^\uFEFF/, '')
+    const pm = (JSON.parse(manifest) as { packageManager?: unknown }).packageManager
+    // A manager vx knows nothing of (zod's `nub@0.8.3`) says nothing about
+    // hooks: the lockfile beside it does, and "nub ran `postbuild`" was a
+    // claim nothing had checked (D-96).
+    if (typeof pm === 'string' && /^(npm|pnpm|yarn|bun)@/.test(pm))
+      manager = /^yarn@([2-9]|\d{2,})/.test(pm) ? 'berry' : pm.split('@')[0]
+  } catch {}
+  if (manager === undefined) {
+    const yarnLock = read('yarn.lock')
+    if (yarnLock !== undefined) manager = yarnLock.includes('\n__metadata:') ? 'berry' : 'yarn'
+    else if (existsSync(path.join(dir, 'pnpm-lock.yaml'))) manager = 'pnpm'
+    else if (existsSync(path.join(dir, 'package-lock.json'))) manager = 'npm'
+    else if (['bun.lock', 'bun.lockb'].some((f) => existsSync(path.join(dir, f)))) manager = 'bun'
+  }
+  const up = path.dirname(dir)
+  const owner =
+    manager !== undefined
+      ? { manager, at: dir }
+      : up === dir
+        ? { manager: 'npm', at: dir }
+        : ownerOf(up, memo)
+  memo.set(dir, owner)
+  return owner
+}

package/src/shared-outputs.ts

@@ -23,6 +23,7 @@
 // file exists to prevent (item 445).
 
 import { isLiteralPattern, outputsOverlap, type GeneratedTask } from '@vzn/vx'
+import { withoutTakenBack } from './glob-grammar.js'
 import { relPosix } from './paths.js'
 import type { TrackedKinds } from './tracked-outputs.js'
 
@@ -192,18 +193,24 @@ function cachedOutputs(t: GeneratedTask, index: number): Cached | null {
 }
 
 /**
- * Can the keeper's `ga` give `gb`'s tree back? Only when `ga` is a
- * directory at any depth (`**\/dist`, `**\/dist/**`) and `gb`'s literal
- * head names no such directory: the two meet only at a `dist` nested in
- * `gb`'s tree, which is the sibling's. solid's build outputs `**\/dist`
- * beside types' `types/**`; Turbo caches both, and uncaching types made
- * vx the slower of the two.
+ * Can the keeper's `ga` give `gb`'s tree back? Only when one of the two is
+ * a directory at any depth (`**\/dist`, `**\/dist/**`) and the other's
+ * literal head names no such directory: they meet only where one tree
+ * nests in the other, which neither task writes. solid's build outputs
+ * `dist/**` and `**\/dist` beside types' `types/**` and `**\/types`; Turbo
+ * caches both, and uncaching types made vx the slower of the two.
  */
-function separable(ga: string, gb: string): boolean {
-  const name = /^\*\*\/([^*?[\]{}()!/\\]+)(?:\/\*\*)?$/.exec(ga)?.[1]
+const DIR_ANYWHERE = /^\*\*\/([^*?[\]{}()!/\\]+)(?:\/\*\*)?$/
+
+const separable = (ga: string, gb: string): boolean => apart(ga, gb) || apart(gb, ga)
+
+function apart(dir: string, other: string): boolean {
+  const name = DIR_ANYWHERE.exec(dir)?.[1]
   if (name === undefined) return false
+  const otherName = DIR_ANYWHERE.exec(other)?.[1]
+  if (otherName !== undefined) return otherName !== name
   const head: string[] = []
-  for (const seg of gb.replace(/^(\.\/)+/, '').split('/')) {
+  for (const seg of other.replace(/^(\.\/)+/, '').split('/')) {
     if (!isLiteralPattern(seg) || seg === '') break
     head.push(seg)
   }
@@ -348,7 +355,7 @@ function prefixIndex(): {
 }
 
 /**
- * A keyed group (`cache`, no `exec`: the `nx-input:<name>` twins, Turbo's
+ * A keyed group (`cache`, no `exec`: the `inputs:<name>` twins, Turbo's
  * transit nodes) runs nothing, so core lets its key read what a task
  * writes (`detectInputOverlaps` exempts it). Uncaching one left `{}`, a
  * task core refuses, and every verb failed.
@@ -606,7 +613,12 @@ export function excludeWorkspaceOutputs(
   }
 }
 
-/** A `!` output with no positive beside it takes back nothing, and core refuses a list of them alone. */
+/**
+ * A `!` output with no positive beside it takes back nothing, and core
+ * refuses a list of them alone; a literal one takes back was never saved,
+ * and core refuses it too (trpc's `package.json`, taken back).
+ */
 export function takingBack(globs: readonly string[]): string[] {
-  return globs.some((g) => !g.startsWith('!')) ? [...globs] : []
+  const kept = withoutTakenBack(globs)
+  return kept.some((g) => !g.startsWith('!')) ? kept : []
 }

package/src/tracked-outputs.ts

@@ -11,7 +11,7 @@ import { lstat, readFile } from 'node:fs/promises'
 import path from 'node:path'
 import { isLiteralPattern, outputsOverlap } from '@vzn/vx'
 import { relPosix } from './paths.js'
-import { isKeyedGroup, unkey } from './shared-outputs.js'
+import type * as SharedOutputs from './shared-outputs.js'
 
 /** The files git tracks under `root`, root-relative; null outside a repo or without git. */
 export async function trackedFiles(root: string): Promise<string[] | null> {
@@ -135,11 +135,13 @@ export async function headStamp(root: string): Promise<string> {
         const m = /^gitdir: (.*)$/m.exec(await readFile(dotGit, 'utf8').catch(() => ''))
         if (m !== null) gitDir = path.resolve(dir, m[1]!.trim())
       }
-      const head = await readFile(path.join(gitDir, 'HEAD'), 'utf8').catch(() => '')
-      const log = await lstat(path.join(gitDir, 'logs', 'HEAD')).catch(() => null)
-      const index = await lstat(path.join(gitDir, 'index')).catch(() => null)
-      // A worktree's own stack holds its HEAD; the common one, its branches.
-      const common = await readFile(path.join(gitDir, 'commondir'), 'utf8').catch(() => null)
+      const [head, log, index, common] = await Promise.all([
+        readFile(path.join(gitDir, 'HEAD'), 'utf8').catch(() => ''),
+        lstat(path.join(gitDir, 'logs', 'HEAD')).catch(() => null),
+        lstat(path.join(gitDir, 'index')).catch(() => null),
+        // A worktree's own stack holds its HEAD; the common one, its branches.
+        readFile(path.join(gitDir, 'commondir'), 'utf8').catch(() => null),
+      ])
       const tables = await Promise.all(
         [gitDir, ...(common === null ? [] : [path.resolve(gitDir, common.trim())])].map((d) =>
           readFile(path.join(d, 'reftable', 'tables.list'), 'utf8').catch(() => ''),
@@ -220,7 +222,7 @@ interface Outputs {
 /**
  * Fit a mapped task's outputs to the committed files they cover, in place,
  * and return one `[pkg#task, todo]` per task this leaves uncached. Core
- * never cleans a committed file (owner, 2026-10-14), so
+ * never cleans a committed file (2026-10-14), so
  * the outputs keep them; what is left is the readers' `!` that hides one.
  * `tracked` is root-relative.
  */
@@ -236,6 +238,8 @@ export function spareTrackedOutputs(
   }[],
   tracked: readonly string[],
 ): [string, string][] {
+  // Loaded here, on a remap only: a kept mapping's run never reads it.
+  const { isKeyedGroup, unkey } = require('./shared-outputs.js') as typeof SharedOutputs
   const todos: [string, string][] = []
   const trackedSet = new Set(tracked)
   /** Drop the `!` entries readers carry for a committed file no output names any more. */