@vzn/vx 0.0.18 → 0.0.21

package/src/orchestrator/failure-mode.ts

@@ -1,9 +1,10 @@
-// The flakiness verdict, in ONE place. Two surfaces classify the same
-// `runs` rows — the run-history readers and `LocalHistoryProvider` (what
-// `--dry` predictions read) — and they used
-// to encode the rule independently, which let them drift into opposite
-// verdicts on identical data. Both now call `classifyFailureMode`, so the
-// rule cannot fork again.
+// The flakiness verdict, in ONE place. Two readers classify `runs` rows —
+// the all-time per-task query here and `LocalHistoryProvider`'s bounded
+// window — and they used to encode the rule independently, which let them
+// drift into opposite verdicts on identical data. Both build on
+// `mixedOutcomeKeysSql` + `failureModeOf`, so the rule cannot fork again.
+// The per-run detector (`detectFlaky`) and the doctor's list (`flakyTasks`)
+// read the same per-key projection (`keyOutcomesSql`).
 
 import type { Database } from 'bun:sqlite'
 import { KEYED_RUNS_SQL } from '../cache/index.js'
@@ -19,43 +20,183 @@ const HIT_STATUSES = `(${TASK_STATUSES.filter(isCacheHit)
 export type FailureMode = 'stable' | 'flaky-recoverable' | 'flaky-fatal'
 
 /**
- * Distinct cache keys that produced BOTH a failure and a success — the
- * definitional flake: identical inputs, different outcomes. A failure whose
- * key never succeeded is a legitimate break (a changed input that fails),
- * which belongs to the regressions surface, not flakiness.
+ * Per-key outcome projection: every keyed (project, task, hash) under
+ * `source` (a relation with `project`, `task`, `hash`, `status`, `cache_hit`
+ * columns) with how often it failed and how often it passed — a pass being
+ * an executed success or a cache hit, which replays a success. Every
+ * flakiness reader is a filter over this one projection.
  */
+function keyOutcomesSql(source: string, where = ''): string {
+  return `SELECT project, task, hash,
+       SUM(CASE WHEN status = 'failed' THEN 1 ELSE 0 END) AS failures,
+       SUM(CASE WHEN status = 'success' OR status IN ${HIT_STATUSES} OR cache_hit = 1
+           THEN 1 ELSE 0 END) AS passes
+       FROM ${source}
+       WHERE ${KEYED_RUNS_SQL}${where}
+       GROUP BY project, task, hash`
+}
+
+/**
+ * Per-key outcome subquery: the distinct cache keys under `source` that
+ * produced BOTH a failure and a success — the definitional flake: identical
+ * inputs, different outcomes. A failure whose key never succeeded is a
+ * legitimate break (a changed input that fails), which belongs to the
+ * regressions surface, not flakiness. One projection of the rule serves the
+ * all-time query below and the windowed one in `history.ts`.
+ */
+export function mixedOutcomeKeysSql(source: string, where = ''): string {
+  return `SELECT project, task FROM (${keyOutcomesSql(source, where)})
+       WHERE failures > 0 AND passes > 0`
+}
+
+/** Mixed-outcome keys of one (project, task) over its WHOLE recorded history. */
 export function mixedOutcomeKeyCount(db: Database, project: string, task: string): number {
   const row = db
     .query(
-      `SELECT COUNT(*) AS n FROM (
-         SELECT hash FROM runs
-         WHERE project = ? AND task = ? AND ${KEYED_RUNS_SQL}
-         GROUP BY hash
-         HAVING SUM(CASE WHEN status = 'failed' THEN 1 ELSE 0 END) > 0
-            AND SUM(CASE WHEN status = 'success' OR status IN ${HIT_STATUSES} OR cache_hit = 1
-                    THEN 1 ELSE 0 END) > 0
-       )`,
+      `SELECT COUNT(*) AS n FROM (${mixedOutcomeKeysSql('runs', ' AND project = ? AND task = ?')})`,
     )
     .get(project, task) as { n: number }
   return row.n
 }
 
 /**
- * Flaky requires a NONDETERMINISM signal: a within-run retry, or a cache key
- * that both failed and succeeded. Failures alone — each on its own key — are
- * legitimate breaks, however many there are.
- *
- * The `failures > 0` short-circuit keeps the key-count query off the common
- * path: a task that never failed is stable without touching the DB.
+ * The verdict. Flaky requires a NONDETERMINISM signal: a within-run retry,
+ * or a cache key that both failed and succeeded (`mixedKeys`). Failures
+ * alone — each on its own key — are legitimate breaks, however many there
+ * are. `mixedKeys` is a thunk so a task that never failed is stable without
+ * the key count being computed at all.
  */
+export function failureModeOf(
+  counts: { total: number; failures: number; retried: number },
+  mixedKeys: () => number,
+): FailureMode {
+  const flakySignal = counts.retried > 0 || (counts.failures > 0 && mixedKeys() > 0)
+  if (!flakySignal) return 'stable'
+  return counts.failures < counts.total / 5 ? 'flaky-recoverable' : 'flaky-fatal'
+}
+
+/** `failureModeOf` over a task's whole recorded history (the DB is not touched unless it failed). */
 export function classifyFailureMode(
   db: Database,
   project: string,
   task: string,
   counts: { total: number; failures: number; retried: number },
 ): FailureMode {
-  const flakySignal =
-    counts.retried > 0 || (counts.failures > 0 && mixedOutcomeKeyCount(db, project, task) > 0)
-  if (!flakySignal) return 'stable'
-  return counts.failures < counts.total / 5 ? 'flaky-recoverable' : 'flaky-fatal'
+  return failureModeOf(counts, () => mixedOutcomeKeyCount(db, project, task))
+}
+
+/** An executed, keyed outcome of the run in progress — what `detectFlaky` judges. */
+export interface FlakyCandidate {
+  project: string
+  task: string
+  hash: string
+  status: 'success' | 'failed'
+  /** Attempts this run took; > 1 is a within-run retry. */
+  attempts: number
+}
+
+/** One task the run just proved nondeterministic. */
+export interface FlakyFinding extends FlakyCandidate {
+  /** `project#task`. */
+  taskId: string
+  /** Outcomes on record for this exact key, this run's included. */
+  passes: number
+  failures: number
+}
+
+// Bound parameters per statement: SQLite's compile-time cap is 32 766 in
+// every build Bun ships, but a run can execute more tasks than that only in
+// theory — chunking keeps the query shape identical at any size.
+const IN_CHUNK = 500
+
+function chunked<T>(items: readonly T[], each: (chunk: readonly T[]) => void): void {
+  for (let i = 0; i < items.length; i += IN_CHUNK) each(items.slice(i, i + IN_CHUNK))
+}
+
+const keyOf = (c: { project: string; task: string; hash: string }): string =>
+  `${c.project}\0${c.task}\0${c.hash}`
+
+/**
+ * Which of this run's executed tasks are flaky, judged BEFORE the run's own
+ * rows are recorded: a pass on a key that has failed before, a failure on
+ * a key that has passed before, or a within-run retry. The counts fold this
+ * run in.
+ *
+ * The cost follows the run's colour. No candidate (every task a hit or a
+ * skip): no query. A green miss: one probe of the `runs_failed` partial
+ * index for the keys that ever failed — failures are the rare rows, so the
+ * probe is microseconds however long the history. Only a key that DID fail
+ * before, or a task failing now, pays the projection scan over its own
+ * keys, and a run that is failing has more to look at than a scan.
+ */
+export function detectFlaky(db: Database, candidates: readonly FlakyCandidate[]): FlakyFinding[] {
+  if (candidates.length === 0) return []
+  const everFailed = new Set<string>()
+  const passedNow = candidates.filter((c) => c.status === 'success' && c.attempts <= 1)
+  chunked(passedNow, (chunk) => {
+    const rows = db
+      .query(
+        `SELECT DISTINCT project, task, hash FROM runs
+         WHERE status = 'failed' AND hash IN (${chunk.map(() => '?').join(', ')})`,
+      )
+      .all(...chunk.map((c) => c.hash)) as { project: string; task: string; hash: string }[]
+    for (const r of rows) everFailed.add(keyOf(r))
+  })
+  const suspects = candidates.filter(
+    (c) => c.status === 'failed' || c.attempts > 1 || everFailed.has(keyOf(c)),
+  )
+  if (suspects.length === 0) return []
+  const counts = new Map<string, { passes: number; failures: number }>()
+  chunked(suspects, (chunk) => {
+    const rows = db
+      .query(keyOutcomesSql('runs', ` AND hash IN (${chunk.map(() => '?').join(', ')})`))
+      .all(...chunk.map((c) => c.hash)) as {
+      project: string
+      task: string
+      hash: string
+      passes: number
+      failures: number
+    }[]
+    for (const r of rows) counts.set(keyOf(r), { passes: r.passes, failures: r.failures })
+  })
+  const out: FlakyFinding[] = []
+  for (const c of suspects) {
+    const before = counts.get(keyOf(c)) ?? { passes: 0, failures: 0 }
+    const passes = before.passes + (c.status === 'success' ? 1 : 0)
+    const failures = before.failures + (c.status === 'failed' ? 1 : 0)
+    if (!(passes > 0 && failures > 0) && c.attempts <= 1) continue
+    out.push({ ...c, taskId: `${c.project}#${c.task}`, passes, failures })
+  }
+  return out
+}
+
+/** One task the recorded history shows both passing and failing on unchanged inputs. */
+export interface FlakyTask {
+  /** `project#task`. */
+  taskId: string
+  project: string
+  task: string
+  /** Distinct cache keys that both passed and failed. */
+  keys: number
+  /** Outcomes over those keys. */
+  passes: number
+  failures: number
+}
+
+/**
+ * Every task with a mixed-outcome key anywhere in the retained history
+ * (30 days, `RunHistory.pruneOlderThan`), most failures first: the
+ * doctor's list. A full scan of `runs`, which an inspection verb affords.
+ */
+export function flakyTasks(db: Database): FlakyTask[] {
+  const rows = db
+    .query(
+      `SELECT project, task, COUNT(*) AS keys, SUM(passes) AS passes, SUM(failures) AS failures
+       FROM (${keyOutcomesSql('runs')})
+       WHERE failures > 0 AND passes > 0
+       GROUP BY project, task
+       ORDER BY failures DESC, passes DESC, project, task`,
+    )
+    .all() as { project: string; task: string; keys: number; passes: number; failures: number }[]
+  return rows.map((r) => ({ ...r, taskId: `${r.project}#${r.task}` }))
 }

package/src/orchestrator/framed-output.ts

@@ -28,6 +28,7 @@
 import { isGroupTask, type TaskNode, type TaskOutcome } from '../graph/index.js'
 import { paint, type ColorSupport } from './colors.js'
 import { formatDuration } from './summary.js'
+import { outcomeLabel } from './events.js'
 
 const NO_COLOR: ColorSupport = { enabled: false }
 
@@ -92,7 +93,6 @@ export function formatTaskBlock(
 
   const idPainted = paintTaskId(node, colors, { bold: true })
   const corner = (s: string) => paint('', s, colors, { dim: true })
-  const section = (title: string, color?: string) => sectionLine(title, color ?? '', colors)
   const header = formatBlockHeader(outcome, colors)
   const lines: string[] = [`${corner('┌─')} ${idPainted} ${corner('>')} ${header}`]
 
@@ -109,15 +109,7 @@ export function formatTaskBlock(
   pushStreamSection(lines, stdout, 'STDOUT', SUCCESS, body.droppedStdout ?? 0, colors)
   pushStreamSection(lines, stderr, 'STDERR', ERROR, body.droppedStderr ?? 0, colors)
 
-  // Sandbox violations get a dedicated section inside the frame so the
-  // user sees them in context with the failing task, not as loose
-  // status output above the box.
-  const vlines = outcome.sandboxViolationLines
-  if (vlines && vlines.length > 0) {
-    lines.push(section(`SANDBOX VIOLATIONS (${vlines.length})`, WARN), '')
-    for (const v of vlines) lines.push(v)
-    lines.push('')
-  }
+  lines.push(...violationSection(outcome, colors))
 
   lines.push(`${corner('└─')} ${idPainted} ${corner('──')}${formatBlockFooter(outcome, colors)}`)
   return lines.join('\n') + '\n'
@@ -220,7 +212,7 @@ function paintTaskId(node: TaskNode, colors: ColorSupport, opts: { bold?: boolea
 // the row. All detail (exit code, output) lives in the framed block.
 export const TIME_COL = 7 // "0ms" … "999.99s"
 const STATUS_COL = 7 // "success" / "running" / "skipped"
-const CACHE_COL = 6 // "remote" / "local" / "fresh" / "miss"
+const CACHE_COL = 8 // "no-cache" / "remote" / "local" / "fresh" / "miss"
 
 /** Right-align the duration in a TIME_COL cell (pad on the left). */
 function timeCell(ms: number | null, colors: ColorSupport): string {
@@ -278,7 +270,8 @@ function cacheOf(o: TaskOutcome): { word: string; color: string } {
   switch (o.status) {
     case 'success':
     case 'failed':
-      return { word: 'miss', color: '' } // dim
+      // A task with no `cache` block never consulted the cache: not a miss.
+      return { word: o.node.config.cache === undefined ? 'no-cache' : 'miss', color: '' } // dim
     case 'cache-hit':
       return o.restored === false
         ? { word: 'fresh', color: SUCCESS }
@@ -385,6 +378,27 @@ export function formatFrameOpen(node: TaskNode, colors: ColorSupport = NO_COLOR)
   return `${corner('┌─')} ${mark}${paintTaskId(node, colors, { bold: true })} ${corner('>')} $ ${cmd}`
 }
 
+/**
+ * Sandbox violations get a dedicated section inside the frame so the user
+ * sees them in context with the failing task, not as loose status output
+ * above the box. Shared by BOTH renderers: the focused/live frame used to
+ * omit it, so a single-task run — exactly how someone debugging one task
+ * invokes vx — showed a failure with no violations at all (owner,
+ * 2026-09-05).
+ */
+function violationSection(outcome: TaskOutcome, colors: ColorSupport): string[] {
+  const vlines = outcome.sandboxViolationLines
+  if (!vlines || vlines.length === 0) return []
+  // Unique lines only — a task's children trip the same denial many times
+  // and the repeats bury everything else. The lines themselves are printed
+  // VERBATIM: a violation is evidence, and evidence that has been rewritten
+  // for display is not the thing the sandbox reported. The outcome keeps
+  // every record for telemetry.
+  const body = [...new Set(vlines)]
+  // Red, not amber: a violation fails the task, so it reads as a failure.
+  return [sectionLine(`SANDBOX VIOLATIONS (${body.length})`, ERROR, colors), '', ...body, '']
+}
+
 export function formatFrameClose(
   node: TaskNode,
   outcome: TaskOutcome,
@@ -400,7 +414,9 @@ export function formatFrameClose(
     persistent && outcome.status === 'success'
       ? ` ${paint('', `(${formatDuration(outcome.durationMs)})`, colors, { dim: true })} ${paint(ACCENT, 'running', colors)}`
       : formatBlockFooter(outcome, colors)
-  return `${corner('└─')} ${mark}${paintTaskId(node, colors, { bold: true })} ${corner('──')}${tail}`
+  const close = `${corner('└─')} ${mark}${paintTaskId(node, colors, { bold: true })} ${corner('──')}${tail}`
+  const violations = violationSection(outcome, colors)
+  return violations.length === 0 ? close : `${violations.join('\n')}\n${close}`
 }
 
 function isPersistentNode(node: TaskNode): boolean {
@@ -454,27 +470,21 @@ export function formatPersistentList(
 function formatBlockHeader(o: TaskOutcome, colors: ColorSupport): string {
   const shortHash = o.hash ? o.hash.slice(0, 8) : ''
   const dim = (s: string) => paint('', s, colors, { dim: true })
+  const word = outcomeLabel(o)
   switch (o.status) {
     case 'cache-hit':
-      if (o.restored === false) {
-        return `${paint(SUCCESS, 'up-to-date', colors)} ${dim(`• ${shortHash}`)}`
-      }
-      return `${paint(SUCCESS, 'restored-local', colors)} ${dim(`• ${shortHash}`)}`
+      return `${paint(SUCCESS, word, colors)} ${dim(`• ${shortHash}`)}`
     case 'cache-hit-remote':
-      if (o.restored === false) {
-        return `${paint(SUCCESS, 'up-to-date', colors)} ${dim(`• ${shortHash}`)}`
-      }
-      return `${paint(ACCENT, 'restored-remote', colors)} ${dim(`• ${shortHash}`)}`
+      // A remote restore is the one hit painted accent: bytes came off the wire.
+      return `${paint(o.restored === false ? SUCCESS : ACCENT, word, colors)} ${dim(`• ${shortHash}`)}`
     case 'failed':
       // The command lives in its own `├─ command` section; the header
       // carries the outcome like every other status.
-      return paint(ERROR, `failed (exit ${o.exitCode})`, colors, { bold: true })
+      return paint(ERROR, word, colors, { bold: true })
     case 'skipped':
       return paint(WARN, 'skipped (upstream failed)', colors)
-    case 'success':
-      return dim('success')
     default:
-      return o.status
+      return dim(word)
   }
 }
 
@@ -492,21 +502,16 @@ function formatBlockFooter(o: TaskOutcome, colors: ColorSupport): string {
 }
 
 function formatStatusTag(o: TaskOutcome, colors: ColorSupport): string {
+  const word = outcomeLabel(o)
   switch (o.status) {
+    case 'failed':
+      return paint(ERROR, word, colors, { bold: true })
+    case 'skipped':
+      return paint(WARN, word, colors)
     case 'cache-hit':
-      return paint('', o.restored === false ? 'up-to-date' : 'restored-local', colors, {
-        dim: true,
-      })
     case 'cache-hit-remote':
-      return paint('', o.restored === false ? 'up-to-date' : 'restored-remote', colors, {
-        dim: true,
-      })
     case 'success':
-      return paint('', 'success', colors, { dim: true })
-    case 'failed':
-      return paint(ERROR, `failed (exit ${o.exitCode})`, colors, { bold: true })
-    case 'skipped':
-      return paint(WARN, 'skipped', colors)
+      return paint('', word, colors, { dim: true })
     default:
       return o.status
   }

package/src/orchestrator/history.ts

@@ -2,9 +2,10 @@
 // uses for predictive priority and `vx info --history` surfaces.
 //
 // The data has been in cache.db.runs since schema v11; what's new is
-// surfacing it. A single SQL CTE per run pulls the last N rows per
-// (project, task) pair; the result becomes a read-only snapshot for
-// the run's lifetime. Loaded once at prepareRun; never mutated mid-run.
+// surfacing it. One SQL statement per call pulls the last N executed rows
+// per (project, task) pair out of a rowid-bounded slice of the table; the
+// result becomes a read-only snapshot for the run's lifetime. Loaded once
+// by the `schedule` stage (or `--dry`); never mutated mid-run.
 //
 // Two providers:
 //   LocalHistoryProvider  — reads cache.db directly (zero-config).
@@ -13,7 +14,7 @@
 
 import type { Database } from 'bun:sqlite'
 import { EXECUTED_RUNS_SQL } from '../cache/index.js'
-import { classifyFailureMode } from './failure-mode.js'
+import { failureModeOf, mixedOutcomeKeysSql } from './failure-mode.js'
 import type { FailureMode } from './failure-mode.js'
 
 const DEFAULT_RECENT = 50
@@ -30,9 +31,22 @@ export interface TaskHistory {
   successRate: number
   /** Cache hit rate over the recent window ([0, 1]). */
   hitRate: number
-  /** Failure mode classification. Shares `classifyFailureMode` with
-   *  the run-history readers so the two surfaces cannot disagree. */
+  /** Failure mode classification over the same window (`failureModeOf`,
+   *  the one rule `vx why`'s all-time query also applies). */
   failureMode: FailureMode
+  /**
+   * Largest peak RSS (bytes) any successful execution in the window
+   * reported; undefined when none did (hits report nothing, and a
+   * platform may not expose rusage). The floor a memory reservation
+   * learned from history packs on.
+   */
+  maxPeakRssBytes?: number
+  /**
+   * The most CPU parallelism any successful execution in the window
+   * showed: cpu time over wall time, so 2.0 means two cores busy for the
+   * whole task. Undefined when no row carried both numbers.
+   */
+  maxCpuParallelism?: number
 }
 
 /** Map keyed by `project#task`. */
@@ -56,138 +70,144 @@ export class LocalHistoryProvider implements HistoryProvider {
     private readonly recent: number = DEFAULT_RECENT,
   ) {}
 
+  /**
+   * The window is the last `recent` INVOCATIONS, read as one rowid slice.
+   *
+   * `runs` has no (project, task) index: it cost every run a scattered
+   * B-tree write per task (2026-09-09, 1,000 warm hits: the record stage
+   * 57–79 ms with it, 14–19 ms without) and bought this reader nothing —
+   * ranking every pair's rows newest-first (`ROW_NUMBER` over a partition)
+   * sorted the whole table either way, 230 ms at 116k rows. Rows are
+   * appended in time order, one contiguous block per invocation, so the
+   * rows of the newest `recent` invocations are exactly `id >= MIN(id)` of
+   * the `recent`-th newest header — a primary-key range, no sort, plain
+   * aggregates, and at most one row per pair per invocation, so "the last
+   * `recent` invocations" IS the last `recent` runs for a pair that runs
+   * every time and whatever fewer it has for one that runs less often. A
+   * hint for ordering and prediction, not a ledger; `vx why` / `vx last`
+   * read by `run_id` and stay exact.
+   */
   async loadFor(taskIds: readonly string[]): Promise<HistoryTable> {
     const out = new Map<string, TaskHistory>()
     if (taskIds.length === 0) return out
 
-    // Split `project#task` into (project, task) pairs so the WHERE filters on a
-    // ROW-VALUE `IN (VALUES …)` the `runs(project, task)` index can SEARCH
-    // (seek) — filtering on the concatenated `project || '#' || task`
-    // expression forced a full index SCAN instead. Split on the FIRST `#`:
-    // task names never contain `#`, and a project name (a package name) never
-    // does either.
-    const pairs = (taskIds as string[]).map(splitTaskId)
-    const tupleParams = pairs.flat()
-    const tuplePlaceholders = pairs.map(() => '(?,?)').join(',')
-
-    // One CTE per call: rank rows per (project, task) descending by
-    // started_at, keep the top `recent`, aggregate. Cache-hit rows
-    // (cache_hit = 1) are excluded from the duration percentiles so
-    // p50/p99 reflect work the runner actually did. successRate +
-    // hitRate are computed over ALL recent rows.
-    //
-    // `skipped` rows are excluded from the window entirely: a skip is a task
-    // the run never executed, so it neither belongs in a success/hit RATE nor
-    // deserves to occupy one of the `recent` slots — a task whose upstream
-    // keeps breaking would otherwise push its own real history out of view.
-    const sql = `
-      WITH recent AS (
-        SELECT
-          project,
-          task,
-          status,
-          duration_ms,
-          cache_hit,
-          attempts,
-          ROW_NUMBER() OVER (PARTITION BY project, task ORDER BY started_at DESC) AS rn
-        FROM runs
-        WHERE (project, task) IN (VALUES ${tuplePlaceholders})
-          AND ${EXECUTED_RUNS_SQL}
+    const floorRow = this.db
+      .query(
+        `SELECT MIN(id) AS id FROM runs WHERE run_id =
+           (SELECT run_id FROM invocations ORDER BY started_at DESC LIMIT 1 OFFSET ?)`,
       )
+      .get(this.recent - 1) as { id: number | null }
+    // Fewer invocations than the window (or none): the whole table is the window.
+    const floor = floorRow.id ?? 0
+
+    // `skipped` rows are excluded: a skip is a task the run never executed,
+    // so it belongs in no success/hit RATE and no duration. Percentiles are
+    // over the executed-success rows of the slice — work the runner actually
+    // did — while the rates count every executed row.
+    const sql = `
       SELECT
-        project,
-        task,
+        r.project,
+        r.task,
         COUNT(*) AS total,
-        SUM(CASE WHEN status = 'success' THEN 1 ELSE 0 END) AS successes,
-        SUM(CASE WHEN cache_hit = 1 THEN 1 ELSE 0 END) AS hits,
-        SUM(CASE WHEN cache_hit IS NULL OR cache_hit = 0 THEN 1 ELSE 0 END) AS executed,
-        SUM(CASE WHEN status = 'failed' THEN 1 ELSE 0 END) AS failures,
-        SUM(CASE WHEN attempts > 1 THEN 1 ELSE 0 END) AS retried
-      FROM recent
-      WHERE rn <= ${this.recent}
-      GROUP BY project, task
+        SUM(CASE WHEN r.status = 'success' THEN 1 ELSE 0 END) AS successes,
+        SUM(CASE WHEN r.cache_hit = 1 THEN 1 ELSE 0 END) AS hits,
+        SUM(CASE WHEN r.status = 'failed' THEN 1 ELSE 0 END) AS failures,
+        SUM(CASE WHEN r.attempts > 1 THEN 1 ELSE 0 END) AS retried,
+        GROUP_CONCAT(CASE WHEN (r.cache_hit IS NULL OR r.cache_hit = 0) AND r.status = 'success'
+                          THEN r.duration_ms END) AS ds,
+        MAX(CASE WHEN (r.cache_hit IS NULL OR r.cache_hit = 0) AND r.status = 'success'
+                 THEN r.peak_rss_bytes
+                 WHEN r.cache_hit = 1 THEN e.peak_rss_bytes END) AS rss,
+        MAX(CASE WHEN (r.cache_hit IS NULL OR r.cache_hit = 0) AND r.status = 'success'
+                      AND r.cpu_ms IS NOT NULL AND r.duration_ms > 0
+                 THEN r.cpu_ms * 1.0 / r.duration_ms
+                 WHEN r.cache_hit = 1 AND e.cpu_ms IS NOT NULL AND e.duration_ms > 0
+                 THEN e.cpu_ms * 1.0 / e.duration_ms END) AS cpu
+      FROM runs r
+      -- A hit executed nothing here, but its entry carries what the
+      -- PRODUCING execution used (the artifact's sidecar, indexed at save
+      -- and ingest alike), so a task this machine has only ever restored
+      -- — a fresh runner behind a remote cache — still has a number. The
+      -- join is by primary key and only for hit rows; an entry pruned
+      -- since contributes nothing.
+      LEFT JOIN entries e ON r.cache_hit = 1 AND e.hash = r.hash
+      WHERE r.id >= ? AND ${EXECUTED_RUNS_SQL}
+      GROUP BY r.project, r.task
     `
-
     type Row = {
       project: string
       task: string
       total: number
       successes: number
       hits: number
-      executed: number
       failures: number
       retried: number
+      ds: string | null
+      rss: number | null
+      cpu: number | null
     }
-    const rows = this.db.query(sql).all(...tupleParams) as Row[]
-
-    // Percentiles need a row-wise read (percentile_cont isn't in SQLite), but
-    // ONE windowed query pulls the last `recent` EXECUTED+SUCCESS durations for
-    // EVERY task at once — the old per-task `percentilesFor` was an N+1 (one
-    // query per task on top of the counts CTE). Same per-task window (last
-    // `recent` executed-success rows by started_at DESC), grouped in JS.
-    const durationsByTask = this.durationsFor(taskIds)
+    // Every pair in the slice is grouped (the slice is bounded, so this is
+    // cheap) and the asked-for ones are picked out here — a per-row IN-list
+    // probe in SQL cost more than the grouping it would have saved.
+    const wanted = new Set(taskIds)
+    const rows = (this.db.query(sql).all(floor) as Row[]).filter((r) =>
+      wanted.has(`${r.project}#${r.task}`),
+    )
+
+    // The flakiness signal needs per-key outcomes, which the aggregate above
+    // folded away — one more pass over the slice, only for the pairs whose
+    // verdict actually depends on it (failed, and no retry already proving
+    // nondeterminism); a green history never pays for it.
+    const mixed = this.mixedOutcomeKeys(
+      floor,
+      rows.filter((r) => (r.failures || 0) > 0 && (r.retried || 0) === 0),
+    )
 
     for (const row of rows) {
       const key = `${row.project}#${row.task}`
       const total = row.total || 0
-      const failureMode = classifyFailureMode(this.db, row.project, row.task, {
-        total,
-        failures: row.failures || 0,
-        retried: row.retried || 0,
-      })
-      const durations = durationsByTask.get(key)
+      const counts = { total, failures: row.failures || 0, retried: row.retried || 0 }
+      const durations = row.ds === null ? undefined : row.ds.split(',').map(Number)
+      if (durations !== undefined) durations.sort((a, b) => a - b)
       out.set(key, {
         runs: total,
         p50DurationMs: durations ? pickPercentile(durations, 0.5) : undefined,
         p99DurationMs: durations ? pickPercentile(durations, 0.99) : undefined,
         successRate: total > 0 ? (row.successes || 0) / total : 0,
         hitRate: total > 0 ? (row.hits || 0) / total : 0,
-        failureMode,
+        failureMode: failureModeOf(counts, () => mixed.get(key) ?? 0),
+        ...(row.rss !== null ? { maxPeakRssBytes: row.rss } : {}),
+        ...(row.cpu !== null ? { maxCpuParallelism: row.cpu } : {}),
       })
     }
     return out
   }
 
-  /**
-   * The last `recent` executed-success `duration_ms` values per `project#task`,
-   * ASCENDING (ready for percentile picking), in ONE windowed query for the
-   * whole task set. A `project#task` with no executed-success rows is absent.
-   */
-  private durationsFor(taskIds: readonly string[]): Map<string, number[]> {
-    const pairs = (taskIds as string[]).map(splitTaskId)
-    const sql = `
-      SELECT project, task, duration_ms FROM (
-        SELECT project, task, duration_ms,
-          ROW_NUMBER() OVER (PARTITION BY project, task ORDER BY started_at DESC) AS rn
-        FROM runs
-        WHERE (project, task) IN (VALUES ${pairs.map(() => '(?,?)').join(',')})
-          AND (cache_hit IS NULL OR cache_hit = 0)
-          AND status = 'success'
+  /** Mixed-outcome key count per `project#task`, over the slice, for `pairs` only. */
+  private mixedOutcomeKeys(
+    floor: number,
+    pairs: readonly { project: string; task: string }[],
+  ): Map<string, number> {
+    const out = new Map<string, number>()
+    if (pairs.length === 0) return out
+    const placeholders = pairs.map(() => '(?,?)').join(',')
+    const rows = this.db
+      .query(
+        `SELECT project, task, COUNT(*) AS n FROM (${mixedOutcomeKeysSql(
+          'runs',
+          ` AND id >= ? AND (project, task) IN (VALUES ${placeholders})`,
+        )}) GROUP BY project, task`,
       )
-      WHERE rn <= ${this.recent}`
-    const rows = this.db.query(sql).all(...pairs.flat()) as {
+      .all(floor, ...pairs.flatMap((p) => [p.project, p.task])) as {
       project: string
       task: string
-      duration_ms: number
+      n: number
     }[]
-    const out = new Map<string, number[]>()
-    for (const r of rows) {
-      const key = `${r.project}#${r.task}`
-      const list = out.get(key)
-      if (list) list.push(r.duration_ms)
-      else out.set(key, [r.duration_ms])
-    }
-    for (const list of out.values()) list.sort((a, b) => a - b)
+    for (const r of rows) out.set(`${r.project}#${r.task}`, r.n)
     return out
   }
 }
 
-/** Split a `project#task` id on its FIRST `#` (task names contain no `#`). */
-function splitTaskId(id: string): [string, string] {
-  const i = id.indexOf('#')
-  return i < 0 ? [id, ''] : [id.slice(0, i), id.slice(i + 1)]
-}
-
 function pickPercentile(sorted: number[], q: number): number {
   if (sorted.length === 0) return 0
   const idx = Math.min(sorted.length - 1, Math.floor(q * sorted.length))