@vzn/vx 0.0.16 → 0.0.18

package/src/orchestrator/stable-keys.ts

@@ -47,16 +47,45 @@ export async function deriveStableKeys(args: DeriveStableKeysArgs): Promise<Stab
   const order = topoOrder(args.nodes)
   const keyById = new Map<string, string>()
   const unstableById = new Set<string>()
+  // Transitive-upstream output producers, accumulated in topo order — the
+  // inputs to the stability gate. A task's key is preliminary if an upstream
+  // writes where its inputs read, and that reach is TRANSITIVE: a producer
+  // reached through a no-output intermediate still poisons the key, so each
+  // dep's accumulated producers fold forward.
+  //   - outputProjects: the project names of every upstream task declaring
+  //     cache.outputs.files (project-relative outputs land in the producer's
+  //     own dir).
+  //   - wsOutputUpstream: any upstream declares cache.outputs.workspaceFiles
+  //     (root-anchored, boundary-ignoring outputs).
+  const outputProjectsById = new Map<string, ReadonlySet<string>>()
+  const wsOutputUpstreamById = new Map<string, boolean>()
   const stableKeys: StableKey[] = []
 
   for (const id of order) {
     const node = args.nodes.get(id)!
     const upstream = synthUpstream(node, args.nodes, keyById)
 
+    // Fold every dep's accumulated producers + the dep's own declared
+    // outputs into this node's transitive-upstream producer sets.
+    const outputProjects = new Set<string>()
+    let wsOutputUpstream = false
+    for (const dep of node.deps) {
+      const depNode = args.nodes.get(dep)
+      if (!depNode) continue
+      for (const p of outputProjectsById.get(dep) ?? []) outputProjects.add(p)
+      if (wsOutputUpstreamById.get(dep) === true) wsOutputUpstream = true
+      const depOut = depNode.config.cache?.outputs
+      if ((depOut?.files?.length ?? 0) > 0) outputProjects.add(depNode.projectName)
+      if ((depOut?.workspaceFiles?.length ?? 0) > 0) wsOutputUpstream = true
+    }
+    outputProjectsById.set(id, outputProjects)
+    wsOutputUpstreamById.set(id, wsOutputUpstream)
+
     if (isGroupTask(node)) {
       // Groups have no exec/cache; they only fold upstream keys so
       // dependents that filter inputs.tasks through the group still
-      // cascade. They inherit instability from any unstable member.
+      // cascade (and forward their producers, above). They inherit
+      // instability from any unstable member.
       keyById.set(id, computeGroupHash(upstream))
       if (node.deps.some((d) => unstableById.has(d))) unstableById.add(id)
       continue
@@ -76,7 +105,8 @@ export async function deriveStableKeys(args: DeriveStableKeysArgs): Promise<Stab
     keyById.set(id, hash)
 
     const unstable =
-      node.deps.some((d) => unstableById.has(d)) || dependsOnSiblingOutputs(node, args.nodes)
+      node.deps.some((d) => unstableById.has(d)) ||
+      dependsOnSiblingOutputs(node, outputProjects, wsOutputUpstream)
     if (unstable) unstableById.add(id)
 
     const cacheEnabled = node.config.cache !== undefined
@@ -90,7 +120,7 @@ export async function deriveStableKeys(args: DeriveStableKeysArgs): Promise<Stab
  * are read by filterUpstreamHashes / computeGroupHash; the rest of
  * TaskOutcome is irrelevant here, so we cast a minimal shape.
  */
-export function synthUpstream(
+function synthUpstream(
   node: TaskNode,
   nodes: Map<string, TaskNode>,
   keyById: Map<string, string>,
@@ -111,44 +141,55 @@ export function synthUpstream(
 }
 
 /**
- * Conservative stability check: does any UPSTREAM task whose outputs
- * could land where this task reads its inputs make this task's key
- * preliminary?
+ * Conservative stability check: does any TRANSITIVE-upstream task whose
+ * outputs could land where this task reads its inputs make this task's
+ * key preliminary? The producers are pre-folded by `deriveStableKeys`
+ * (`upstreamOutputProjects` = projects declaring `cache.outputs.files`
+ * upstream; `hasWsOutputUpstream` = any `cache.outputs.workspaceFiles`
+ * upstream), so a producer reached through a no-output intermediate is
+ * caught too.
  *
- *   - Same-project upstream with declared `cache.outputs.files`: its
- *     outputs land inside this project's dir, which this task's input
- *     globs (default `**` / anything project-relative) can match —
- *     the upstream must run before this key is final. Project
- *     boundaries are hard, so only SAME-project outputs can reach a
- *     project-relative input.
- *   - Any upstream with declared `cache.outputs.workspaceFiles` when
- *     this task reads `cache.inputs.workspaceFiles`: root-anchored
- *     outputs ignore boundaries and can land anywhere the root-anchored
- *     inputs read.
+ *   - Project-relative inputs (default `**` / anything project-relative)
+ *     read THIS project's dir, so a same-project upstream's
+ *     `outputs.files` — direct or transitive — makes the key
+ *     preliminary. Project boundaries are hard, so only SAME-project
+ *     outputs can reach a project-relative input.
+ *   - `cache.inputs.workspaceFiles` is boundary-free: it can read ANY
+ *     project's dir (so any upstream `outputs.files`, in any project,
+ *     matters) or a root-anchored location (so any upstream
+ *     `outputs.workspaceFiles` matters). Either → preliminary key. This
+ *     is the reach the earlier per-dep check missed — it only compared a
+ *     dep's `outputs.workspaceFiles`, never a dep's `outputs.files`.
  *
- * Either case → unstable → skip prefetch (lazy read-through in
- * execute-task stays correct). When in doubt, unstable.
+ * Either case → unstable → skip prefetch AND probe reuse (execute-task
+ * recomputes the key lazily once the upstream ran). When in doubt,
+ * unstable.
  */
-export function dependsOnSiblingOutputs(node: TaskNode, nodes: Map<string, TaskNode>): boolean {
-  const inputs = node.config.cache?.inputs
+export function dependsOnSiblingOutputs(
+  node: TaskNode,
+  upstreamOutputProjects: ReadonlySet<string>,
+  hasWsOutputUpstream: boolean,
+): boolean {
+  const cache = node.config.cache
   // A cache-disabled task has no key to prefetch anyway; treat as
   // unstable-irrelevant (caller filters on cacheEnabled).
-  if (node.config.cache === undefined) return false
-  const readsWorkspaceFiles = (inputs?.workspaceFiles?.length ?? 0) > 0
-
-  for (const dep of node.deps) {
-    const depNode = nodes.get(dep)
-    if (!depNode) continue
-    const depOutputs = depNode.config.cache?.outputs
-    if (depOutputs === undefined) continue
-    const sameProject = depNode.projectName === node.projectName
-    if (sameProject && (depOutputs.files?.length ?? 0) > 0) return true
-    if (readsWorkspaceFiles && (depOutputs.workspaceFiles?.length ?? 0) > 0) return true
-  }
+  if (cache === undefined) return false
+  if (upstreamOutputProjects.has(node.projectName)) return true
+  // A root-anchored output is boundary-IGNORING by design, so it can land
+  // inside THIS task's own project dir — where an ordinary project-relative
+  // input reads it. Neither other clause sees that: `upstreamOutputProjects`
+  // holds the PRODUCER's project, not this one, and the reader clause below
+  // requires this task to read workspace-anchored inputs, which it need not.
+  // That gap was a real stale hit (a producer writing `pkgs/app/gen/**` while
+  // `app` read `gen/**` project-relative), so the mere presence of a
+  // workspace-output producer upstream makes the key preliminary.
+  if (hasWsOutputUpstream) return true
+  const readsWorkspaceFiles = (cache.inputs?.workspaceFiles?.length ?? 0) > 0
+  if (readsWorkspaceFiles && upstreamOutputProjects.size > 0) return true
   return false
 }
 
-export function topoOrder(nodes: Map<string, TaskNode>): string[] {
+function topoOrder(nodes: Map<string, TaskNode>): string[] {
   const indegree = new Map<string, number>()
   const dependents = new Map<string, string[]>()
   for (const node of nodes.values()) {

package/src/orchestrator/status-line.ts

@@ -19,6 +19,12 @@ const CLEAR = '\x1b[2K\r'
 export interface StatusStream {
   write(chunk: string): unknown
   isTTY?: boolean
+  /**
+   * Terminal width in columns. Read fresh on every draw — `process.stdout`
+   * updates it on SIGWINCH, so a mid-run resize is picked up. Absent (not a
+   * TTY) means the region is never drawn anyway.
+   */
+  columns?: number
 }
 
 export interface OutputWriter {
@@ -68,7 +74,9 @@ export function createOutputWriter(
 
   let current: readonly string[] | null = null
   let shown = false
-  let shownHeight = 0
+  // PHYSICAL rows the shown region occupies, not logical lines — see
+  // `regionRows`.
+  let shownRows = 0
   let dead = false
   let lastDraw = -Infinity
   // Trailing draw scheduled when a forced set lands inside the floor.
@@ -85,10 +93,41 @@ export function createOutputWriter(
     }
   }
 
-  // Erase sequence for whatever is currently shown. Single line keeps
-  // the exact legacy bytes (ESC[2K\r); a taller region moves to its
-  // top line and clears to end of screen.
-  const eraseSeq = (): string => (shownHeight > 1 ? `\r\x1b[${shownHeight - 1}A\x1b[J` : CLEAR)
+  /**
+   * How many PHYSICAL terminal rows `lines` occupies. The terminal wraps
+   * any line wider than the viewport, so a region of N logical lines can
+   * cover more than N rows — and erasing by the logical count moves the
+   * cursor up too few rows, leaving the top of the region on screen. It
+   * accumulates, because every redraw is short by the same amount.
+   *
+   * Both triggers are ordinary: the summary section is a fixed 62 visible
+   * columns (narrower terminal ⇒ every bar row wraps), and a task id is
+   * deliberately never truncated (long id ⇒ the worker row wraps at any
+   * width). Width is read per draw so a mid-run resize is handled. Width
+   * must be VISIBLE width — these lines carry ANSI, which occupies no
+   * column.
+   *
+   * Unknown width falls back to the logical count, which is a KNOWN
+   * residual rather than a guarantee: a wrapped line then under-erases
+   * exactly as it did before this function existed. It is deliberate,
+   * because the alternatives are worse — guessing a width over-erases on a
+   * wider terminal, and `ESC[J` clears to end of SCREEN, so over-erasing
+   * destroys output above the region instead of merely leaving junk below
+   * it. Reachable only on a TTY whose winsize ioctl fails, since a non-TTY
+   * disables the region outright.
+   */
+  const regionRows = (lines: readonly string[]): number => {
+    const cols = stream.columns
+    if (cols === undefined || cols <= 0) return lines.length
+    let rows = 0
+    for (const line of lines) rows += Math.max(1, Math.ceil(Bun.stringWidth(line) / cols))
+    return rows
+  }
+
+  // Erase sequence for whatever is currently shown. A single row keeps
+  // the exact legacy bytes (ESC[2K\r); anything taller moves to its
+  // top row and clears to end of screen.
+  const eraseSeq = (): string => (shownRows > 1 ? `\r\x1b[${shownRows - 1}A\x1b[J` : CLEAR)
 
   const draw = (): void => {
     // Whatever was pending is now painted — the trailing draw would
@@ -97,7 +136,7 @@ export function createOutputWriter(
     const erase = shown ? eraseSeq() : CLEAR
     stream.write(erase + current!.join('\n'))
     shown = true
-    shownHeight = current!.length
+    shownRows = regionRows(current!)
     lastDraw = now()
   }
   const set = (lines: readonly string[], o: { force?: boolean }): void => {
@@ -136,7 +175,7 @@ export function createOutputWriter(
       if (shown) {
         stream.write(eraseSeq())
         shown = false
-        shownHeight = 0
+        shownRows = 0
       }
       stream.write(chunk)
       if (chunk.length > 0) atLineStart = chunk.endsWith('\n')
@@ -156,7 +195,7 @@ export function createOutputWriter(
       if (shown) {
         stream.write(eraseSeq())
         shown = false
-        shownHeight = 0
+        shownRows = 0
       }
     },
   }

package/src/orchestrator/summary.ts

@@ -28,7 +28,7 @@ const GRADIENT_TO = [0xf4, 0x72, 0xb6] as const
 const RULE_DASHES = 57
 
 /** Total visible rule width: `\u2500 <mark> ` + dashes. Shared by summary + header. */
-export function gradientRule(colors: ColorSupport, mark = 'vx'): string {
+function gradientRule(colors: ColorSupport, mark = 'vx'): string {
   const head = `\u2500 `
   const dashes = '\u2500'.repeat(Math.max(8, RULE_DASHES + 2 - mark.length))
   if (!colors.enabled) return `${head}${mark} ${dashes}`
@@ -309,6 +309,27 @@ export function formatRunSummary(
   )
 }
 
+/**
+ * Post-summary section naming the tasks a shutdown signal killed. An aborted
+ * task did no work, so it is in no tally bucket and no history row — but the
+ * run still exits non-zero, and without this the user reads a red exit over a
+ * fully green summary that names nothing. The interactive Ctrl-C path never
+ * gets here (the signal handler exits before any outcome lands), so this only
+ * ever prints for a run that reached its summary WITH a task killed by some
+ * other signal — an external `kill`, a supervisor, a self-terminating child.
+ * Empty when nothing aborted.
+ */
+export function formatAbortedSection(outcomes: readonly TaskOutcome[]): string[] {
+  const aborted = outcomes.filter((o) => o.status === 'aborted')
+  if (aborted.length === 0) return []
+  const lines = [
+    '',
+    `  Aborted:  ${aborted.length} task${aborted.length === 1 ? '' : 's'} killed by a shutdown signal — not counted above`,
+  ]
+  for (const o of aborted) lines.push(`    ✗ ${o.node.id} — exit ${o.exitCode}, nothing cached`)
+  return lines
+}
+
 export function formatDuration(ms: number): string {
   if (ms < 1000) return `${Math.round(ms)}ms`
   return `${(ms / 1000).toFixed(2)}s`

package/src/orchestrator/tally.ts

@@ -1,6 +1,7 @@
-// Shared outcome-tally helper. Both `summary.ts` (end-of-run terminal
-// block) and `run-artifacts.ts` (`--summarize` JSON) count the same
-// numbers; centralising it keeps the two surfaces consistent.
+// Shared outcome-tally helper. `summary.ts` (end-of-run terminal block),
+// `run-artifacts.ts` (`--summarize` JSON) and `run-report.ts`
+// (`--report=markdown`) all count the same numbers; centralising the bucket
+// rules keeps the three surfaces from disagreeing about one run.
 
 import { isGroupTask, type TaskOutcome } from '../graph/index.js'
 
@@ -16,25 +17,31 @@ export interface Tally {
   /** Cache hits whose tree already matched — nothing was written. */
   upToDate: number
   cachedRemote: number
+  /**
+   * Killed by a shutdown signal. No work, so it joins no outcome bucket and
+   * not `total` — but it is counted, because it makes the run red: a red run
+   * whose every counted task succeeded is undiagnosable without this.
+   */
+  aborted: number
   /** Tasks counted toward `total`. Group tasks are excluded by default. */
   total: number
 }
 
 /**
- * Walk the outcome list and return a `Tally`. Group tasks (no `exec`)
- * are filtered out — they aren't real work, and including them
- * inflates the per-run "N total" count in ways that mislead the user
- * ("3 of 4 cached" when one was a group that ran nothing).
- *
- * Status bucket rules:
- *   `success`            → +successful
- *   `cache-hit`          → +successful, +cachedLocal
- *   `cache-hit-remote`   → +successful, +cachedRemote
- *   `failed`             → +failed
- *   `skipped`            → +skipped
+ * The minimum an outcome must expose to be bucketed. The in-process
+ * `TaskOutcome` and the serializable `OutcomeView` both satisfy it; they
+ * differ only in how they carry group-ness (a live node ref vs. a projected
+ * boolean), so each entry point supplies that and the RULE lives in one
+ * place. Declared structurally here rather than importing `OutcomeView`,
+ * which would close a module cycle (events → summary → tally).
  */
-export function tallyOutcomes(outcomes: readonly TaskOutcome[]): Tally {
-  const t: Tally = {
+export interface TallyItem {
+  status: TaskOutcome['status']
+  restored?: boolean
+}
+
+function emptyTally(): Tally {
+  return {
     successful: 0,
     failed: 0,
     skipped: 0,
@@ -43,27 +50,63 @@ export function tallyOutcomes(outcomes: readonly TaskOutcome[]): Tally {
     restoredRemote: 0,
     upToDate: 0,
     cachedRemote: 0,
+    aborted: 0,
     total: 0,
   }
-  for (const o of outcomes) {
-    if (isGroupTask(o.node)) continue
-    // aborted (killed by a shutdown signal) is no work — excluded
-    // from totals and every bucket, exactly like a group task.
-    if (o.status === 'aborted') continue
-    t.total++
-    if (o.status === 'success') t.successful++
-    else if (o.status === 'cache-hit') {
-      t.successful++
-      t.cachedLocal++
-      if (o.restored === true) t.restoredLocal++
-      else t.upToDate++
-    } else if (o.status === 'cache-hit-remote') {
-      t.successful++
-      t.cachedRemote++
-      if (o.restored === true) t.restoredRemote++
-      else t.upToDate++
-    } else if (o.status === 'failed') t.failed++
-    else if (o.status === 'skipped') t.skipped++
+}
+
+/**
+ * Fold ONE outcome into the tally — the single owner of the bucket rules.
+ *
+ * Group tasks (no `exec`) aren't real work; including them inflates the
+ * per-run "N total" count in ways that mislead ("3 of 4 cached" when one was
+ * a group that ran nothing).
+ *
+ * Status bucket rules:
+ *   `success`            → +successful
+ *   `cache-hit`          → +successful, +cachedLocal
+ *   `cache-hit-remote`   → +successful, +cachedRemote
+ *   `failed`             → +failed
+ *   `skipped`            → +skipped
+ *   `aborted`            → +aborted only (no bucket, no total)
+ */
+function fold(t: Tally, o: TallyItem, isGroup: boolean): void {
+  if (isGroup) return
+  if (o.status === 'aborted') {
+    t.aborted++
+    return
   }
+  t.total++
+  if (o.status === 'success') t.successful++
+  else if (o.status === 'cache-hit') {
+    t.successful++
+    t.cachedLocal++
+    if (o.restored === true) t.restoredLocal++
+    else t.upToDate++
+  } else if (o.status === 'cache-hit-remote') {
+    t.successful++
+    t.cachedRemote++
+    if (o.restored === true) t.restoredRemote++
+    else t.upToDate++
+  } else if (o.status === 'failed') t.failed++
+  else if (o.status === 'skipped') t.skipped++
+}
+
+/** Walk live outcomes and return a `Tally`. */
+export function tallyOutcomes(outcomes: readonly TaskOutcome[]): Tally {
+  const t = emptyTally()
+  for (const o of outcomes) fold(t, o, isGroupTask(o.node))
+  return t
+}
+
+/**
+ * The same tally over the serializable projection (`OutcomeView`), which
+ * carries group-ness as a flag because it has no node back-ref. An absent
+ * flag reads as "not a group" — the only outcomes without one predate the
+ * field and none of them are groups.
+ */
+export function tallyViews(views: readonly (TallyItem & { isGroup?: boolean })[]): Tally {
+  const t = emptyTally()
+  for (const v of views) fold(t, v, v.isGroup === true)
   return t
 }

package/src/orchestrator/task-hash.ts

@@ -1,9 +1,16 @@
 import path from 'node:path'
 import type { TaskConfig, CacheConfig } from '../config.js'
-import { type CacheLayer, resolveInputs, type GitFilesCache } from '../cache/index.js'
+import {
+  type CacheKeyInput,
+  type CacheLayer,
+  resolveInputs,
+  type GitFilesCache,
+  WORKSPACE_OUTPUT_PREFIX,
+} from '../cache/index.js'
+import type { InputFile, TaskInputs } from '../exec/index.js'
 import type { TaskNode, TaskOutcome } from '../graph/index.js'
-import { xxh3hex } from '../util/index.js'
-import { filterUpstreamHashes } from './upstream.js'
+import { span, relPosix, xxh3hex } from '../util/index.js'
+import { expandGroupUpstream, filterUpstreamHashes } from './upstream.js'
 
 /**
  * Per-run memoization caches for the two derived hashes that don't
@@ -83,6 +90,73 @@ export interface ComputeHashArgs {
  * `computeGroupHash` is exported for that purpose.
  */
 export async function computeTaskHash(args: ComputeHashArgs): Promise<string> {
+  const end = span('task hash')
+  try {
+    return await args.cache.key(await resolveKeyInput(args))
+  } finally {
+    end()
+  }
+}
+
+/**
+ * The key AND the structured input set behind it, for the executor seam.
+ * Miss path only: it re-runs the (memoized) resolution `computeTaskHash`
+ * did for the probe and retains the VALUES the key folded — env, runtime
+ * output, per-file digests — which `captureInto` deliberately reduces to
+ * digests because its rows are persisted. Per-file digests come from the
+ * same sources as the fold: the index-OID map for clean tracked files,
+ * else `hashFile`'s stat memo (already warm after `key()`).
+ */
+export async function describeTaskInputs(
+  args: ComputeHashArgs,
+): Promise<{ hash: string; inputs: TaskInputs }> {
+  const input = await resolveKeyInput(args)
+  const hash = await args.cache.key(input)
+  const sorted = [...input.inputFiles].sort()
+  const digests = await Promise.all(
+    sorted.map((f) => input.fileHashes?.get(f) ?? args.cache.hashFile(f)),
+  )
+  const files: InputFile[] = sorted.map((f, i) => ({
+    path: relPosix(input.workspaceRoot, f),
+    digest: digests[i]!,
+  }))
+  // Groups expanded: this list describes the INPUT ROOT, not the key, and a
+  // group produces nothing of its own (see `CacheKeyInput.upstreamGraft`).
+  // Sorted by hash so the list — and any action digest derived from it — is
+  // independent of dependency declaration order.
+  const graft = [...(input.upstreamGraft ?? [])].sort((a, b) =>
+    a.hash < b.hash ? -1 : a.hash > b.hash ? 1 : 0,
+  )
+  // Output lists come from the local index — one SELECT for every upstream
+  // entry. An upstream with no entry (non-cacheable) contributes an empty list.
+  const rows = args.cache.loadOutputFilesBatch(graft.map((g) => g.hash))
+  const upstream = graft.map((g) => {
+    const outputs = (rows.get(g.hash) ?? []).map((r) =>
+      r.path.startsWith(WORKSPACE_OUTPUT_PREFIX)
+        ? r.path.slice(WORKSPACE_OUTPUT_PREFIX.length)
+        : relPosix(input.workspaceRoot, path.join(g.projectDir, r.path)),
+    )
+    return { taskId: g.taskId, hash: g.hash, outputs }
+  })
+  return {
+    hash,
+    inputs: {
+      files,
+      env: input.envValues.map(([name, value]) => ({ name, value })),
+      runtime: (input.runtimeValues ?? []).map(([command, output]) => ({ command, output })),
+      workspaceRuntime: (input.workspaceRuntimeValues ?? []).map(([command, output]) => ({
+        command,
+        output,
+      })),
+      upstream,
+      packageJsonDigest: input.projectPackageJsonHash,
+      configDigest: input.taskConfigHash,
+      workspaceFingerprint: input.workspaceFingerprint,
+    },
+  }
+}
+
+async function resolveKeyInput(args: ComputeHashArgs): Promise<CacheKeyInput> {
   const cfg = args.node.config
   const cacheCfg: CacheConfig | undefined = cfg.cache
   const outputs = cacheCfg?.outputs.files ?? []
@@ -113,6 +187,16 @@ export async function computeTaskHash(args: ComputeHashArgs): Promise<string> {
   const upstreamHashes = upstreamPairs.map(([, hash]) => hash)
   // hash → upstream task id, for capture-row naming only (not folded).
   const upstreamIds = new Map(upstreamPairs.map(([id, hash]) => [hash, id]))
+  // The DEPENDENCY closure, groups expanded — for the executor's input root.
+  // Deliberately NOT the filtered set above: `cache.inputs.tasks` says which
+  // upstream KEYS this task's key folds, and what a task may READ is
+  // `dependsOn`. Locally every dependency's outputs are on disk before the
+  // command runs however the filter is written, so an executor that ships the
+  // input closure has to ship the same thing or the task sees less remotely
+  // than it does here. Not folded — see `upstreamGraft`.
+  const upstreamGraft = expandGroupUpstream(args.upstream)
+    .filter((u) => u.hash !== undefined)
+    .map((u) => ({ taskId: u.node.id, hash: u.hash!, projectDir: u.node.projectDir }))
   // Trusted index-OID map for this project (populated by the run's
   // bulk `git ls-files -s` + `git status` pass). Mapped files skip
   // hashFile entirely; everything else falls back to the identical
@@ -136,7 +220,7 @@ export async function computeTaskHash(args: ComputeHashArgs): Promise<string> {
 
   const effectiveForwardArgs = args.node.requested ? (args.forwardArgs ?? []) : []
 
-  return await args.cache.key({
+  return {
     taskId: args.node.id,
     taskConfigHash,
     projectPackageJsonHash,
@@ -147,11 +231,13 @@ export async function computeTaskHash(args: ComputeHashArgs): Promise<string> {
     workspaceRoot: args.workspaceRoot,
     upstreamHashes,
     upstreamIds,
+    upstreamGraft,
     workspaceFingerprint: args.workspaceFingerprint,
     forwardArgs: effectiveForwardArgs,
     ...(fileHashes !== undefined ? { fileHashes } : {}),
+    ...(args.node.keyParts !== undefined ? { pluginParts: args.node.keyParts } : {}),
     ...(args.captureInto !== undefined ? { captureInto: args.captureInto } : {}),
-  })
+  }
 }
 
 /**
@@ -178,17 +264,25 @@ function hashTaskConfig(cfg: TaskConfig, hashCache?: HashCache): string {
 }
 
 /**
- * Project the config for hashing: `exec.resources` is a pure scheduling
- * hint with zero effect on outputs, so it's stripped — tuning a
- * reservation never busts a cache. A config that declares none takes the
- * fast path and stringifies byte-identically to before the field existed
+ * Project the config for hashing: `exec.resources` (cores, memory AND the
+ * image a task must be matched to) and `exec.remote` are pure PLACEMENT
+ * hints with zero effect on outputs, so they're stripped — tuning a
+ * reservation, pinning a task to this machine, or naming the container it
+ * runs in never busts a cache. `remote` in particular must not: the whole
+ * contract of a remote executor is that the same command over the same
+ * inputs produces the same outputs, so a key that moved when placement
+ * changed would split a laptop from a worker pool over nothing. `image`
+ * rides the same rule one step further: a task that ran locally and the
+ * same task on a worker must share an entry, and a task whose output really
+ * does depend on its toolchain says so with `cache.inputs.runtime`, which
+ * works on both. A config that declares neither takes the fast path and stringifies byte-identically to before the fields existed
  * (why this needs no CACHE_VERSION bump). `timeout`/`retries` stay folded
  * — their keys are distinct by design (see the decision log); stripping
  * them retroactively would bump CACHE_VERSION.
  */
 function hashableConfig(cfg: TaskConfig): unknown {
-  if (cfg.exec?.resources === undefined) return cfg
-  const { resources: _resources, ...execRest } = cfg.exec
+  if (cfg.exec?.resources === undefined && cfg.exec?.remote === undefined) return cfg
+  const { resources: _resources, remote: _remote, ...execRest } = cfg.exec
   return { ...cfg, exec: execRest }
 }