@vzn/vx 0.0.50 → 0.0.51

package/src/orchestrator/admission.ts

@@ -25,32 +25,87 @@ import { executeTask, type ExecuteArgs } from './execute-task.js'
 import type { ShortCircuit } from './local-shortcircuit.js'
 import { computeTaskHash, type ComputeHashArgs } from './task-hash.js'
 
+/** What `taintTracker` answers per dispatch, and what it learns per finish. */
+export interface TaintTracker {
+  /** Whether `node`, dispatched with these `upstream` outcomes, builds on bytes nothing vouches for. */
+  judge: (node: TaskNode, upstream: TaskOutcome[]) => boolean
+  /** Every settled outcome, the scheduler's `onFinish`. */
+  settled: (outcome: TaskOutcome) => void
+}
+
+const UNTAINTED: TaintTracker = { judge: () => false, settled: () => {} }
+
 /**
  * Records which tasks ran behind a failure, or on the key of a dependency
  * that did not run (`seeds`), and answers, per task, whether this one does.
  * Disabled (always `false`, nothing recorded) unless the run's
  * `continueMode` is `'always'` or there is a seed.
+ *
+ * A task's taint is read from its deps' SETTLED outcomes, not from what it
+ * saw at dispatch: a restore-tier hit dispatches before its deps settle,
+ * so it saw holes where the failure would be, and a dependent that asked
+ * "was that hit tainted?" heard no. Under `--continue=always` the
+ * dependent then saved the partial tree on its healthy key, and the next
+ * healthy run replayed it (C-1). A dependent is released only once the
+ * hit's own deps have settled too (scheduler.ts, item 963), so by the time
+ * anyone asks, the answer is complete.
  */
 export function taintTracker(
   continueAlways: boolean,
   seeds: ReadonlySet<string>,
-): (node: TaskNode, upstream: TaskOutcome[]) => boolean {
-  if (!continueAlways && seeds.size === 0) return () => false
-  const tainted = new Set<string>()
-  return (node, upstream) => {
-    const taint =
-      seeds.has(node.id) ||
-      upstream.some(
-        // A restore-tier task may run before its deps and see holes here;
-        // it never saves anyway (a hit restores), so a hole is not taint.
-        (u) =>
-          u !== undefined &&
-          (tainted.has(u.node.id) ||
-            (continueAlways &&
-              (u.status === 'failed' || u.status === 'aborted' || u.status === 'skipped'))),
-      )
-    if (taint) tainted.add(node.id)
-    return taint
+  nodes: ReadonlyMap<string, TaskNode>,
+): TaintTracker {
+  if (!continueAlways && seeds.size === 0) return UNTAINTED
+  const outcomes = new Map<string, TaskOutcome>()
+  const memo = new Map<string, boolean>()
+  const failed = (u: TaskOutcome): boolean =>
+    continueAlways && (u.status === 'failed' || u.status === 'aborted' || u.status === 'skipped')
+  const through = (u: TaskOutcome | undefined): boolean =>
+    u !== undefined && (failed(u) || taintOf(u.node.id))
+  // Post-order over the settled deps with an explicit stack: a chain of
+  // restore-tier hits is judged in one ask, and a recursion would take a
+  // frame per hop. Memoized once every dep has settled; until then the
+  // answer may still grow.
+  const taintOf = (root: string): boolean => {
+    const known = memo.get(root)
+    if (known !== undefined) return known
+    const local = new Map<string, boolean>()
+    const valueOf = (id: string): boolean | undefined => memo.get(id) ?? local.get(id)
+    const stack = [root]
+    while (stack.length > 0) {
+      const id = stack[stack.length - 1]!
+      if (valueOf(id) !== undefined) {
+        stack.pop()
+        continue
+      }
+      const deps = seeds.has(id) ? [] : (nodes.get(id)?.deps ?? [])
+      const next = deps.find((d) => {
+        const u = outcomes.get(d)
+        return u !== undefined && !failed(u) && valueOf(d) === undefined
+      })
+      if (next !== undefined) {
+        stack.push(next)
+        continue
+      }
+      stack.pop()
+      const taint =
+        seeds.has(id) ||
+        deps.some((d) => {
+          const u = outcomes.get(d)
+          return u !== undefined && (failed(u) || valueOf(d) === true)
+        })
+      local.set(id, taint)
+      if (taint || deps.every((d) => outcomes.has(d))) memo.set(id, taint)
+    }
+    return valueOf(root)!
+  }
+  return {
+    // A restore-tier task may run before its deps and see holes here; it
+    // never saves anyway (a hit restores), so a hole is not taint.
+    judge: (node, upstream) => seeds.has(node.id) || upstream.some(through),
+    settled: (outcome) => {
+      outcomes.set(outcome.node.id, outcome)
+    },
   }
 }
 

package/src/orchestrator/execute-task.ts

@@ -18,7 +18,7 @@ import {
   VX_RUN_TASK_ENV,
   VX_RUN_WORKSPACE_ENV,
   runPersistent,
-  shellQuote,
+  withForwardArgs,
   releaseBridges,
   wrapSandboxedCommand,
   signalExitCode,
@@ -260,16 +260,12 @@ async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutcome> {
   const env = taskEnv(node, step, args.workspaceRoot)
   const wallclockStartNs = process.hrtime.bigint() - args.runStartHrTimeNs
 
-  // When readyWhen is set we leave the command untouched so the
-  // regex matcher sees the unmodified output. When it's absent the
-  // task is "ready on spawn" — we can safely append forwardArgs in
-  // the same way runCommand does.
-  const plainCommand =
-    step.persistent.readyWhen !== undefined
-      ? step.command
-      : effectiveForwardArgs.length > 0
-        ? step.command + ' ' + effectiveForwardArgs.map(shellQuote).join(' ')
-        : step.command
+  // The args after `--` reach a server as they reach any task. A readyWhen
+  // server once got none — "so the matcher sees the unmodified output",
+  // though the args change the command, not what the matcher reads — and
+  // `vx run dev -- --port 4000` on the documented Vite task dropped the
+  // port in silence (item 1060).
+  const plainCommand = withForwardArgs(step.command, effectiveForwardArgs)
   // A persistent task declaring `exec.sandbox` runs inside it like any
   // other: the same grants, the same walls. What it cannot have is the
   // violation REPORT — that reads the trace after the child exits, and a
@@ -616,6 +612,10 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   let attempt = 0
   let result: ExecuteResult
   let effectiveExitCode: number
+  // What THIS run spent on the task, every attempt (`TaskOutcome.durationMs`):
+  // the last attempt alone read `max 407ms` beside a footer of 837 (item
+  // 1101). A saved entry keeps the attempt that produced it, what a hit saves.
+  let spentMs = 0
 
   // One task attempt: clean the declared outputs (before EVERY attempt — so a
   // stale prior-build artifact can't survive into a fresh run, and a failed
@@ -716,9 +716,12 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     // whole contract. `userSandbox` is the only way a task is sandboxed,
     // so this reads as "sandboxed and it tripped".
     // A child we SIGTERMed for exceeding the timeout is a genuine failure —
-    // stream a clear line so the 143 exit reads as a timeout.
+    // stream a clear line so the 143 exit reads as a timeout. One that outlived
+    // the grace died of the SIGKILL, and the line said SIGTERM over an exit
+    // 137 (item 1063).
     if (res.timedOut) {
-      log.taskStderr(node, `\n[vx] timed out after ${effectiveTimeout}ms — killed (SIGTERM)\n`)
+      const how = res.signal === 'SIGKILL' ? 'SIGKILL after the SIGTERM grace' : 'SIGTERM'
+      log.taskStderr(node, `\n[vx] timed out after ${effectiveTimeout}ms — killed (${how})\n`)
       // Force a non-zero classification even if the child TRAPPED SIGTERM and
       // still exited 0 (`trap 'exit 0' TERM`, a common graceful-shutdown
       // pattern). Without this a timed-out task is classified `success` and its
@@ -781,25 +784,36 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     if (writesFingerprint) args.fingerprintWatch?.wrote()
     result = a.result
     effectiveExitCode = a.exitCode
+    spentMs += result.durationMs
 
     // An attempt that ended in a shutdown never finished on its own terms —
     // it is aborted, so it is neither cached, counted, shown, nor RETRIED.
-    // Two ways to know: the child died of SIGINT / SIGTERM (Ctrl-C, or a
-    // `kill` vx never saw; a timeout also SIGTERMs, but `timedOut` marks it
-    // as our own deadline, a real and retryable failure), or the RUN is
-    // stopping. The child alone was not enough: one that traps the
-    // forwarded SIGINT and exits 0 was cached as a success with its partial
-    // outputs, one that exits 1 was retried after Ctrl-C, and one SIGKILLed
-    // at the end of the grace read as an OOM failure (item 962).
-    const shutdown =
-      args.stopSignal?.aborted === true ||
-      ((result.signal === 'SIGINT' || result.signal === 'SIGTERM') && !result.timedOut)
+    // The RUN stopping is what says so. A child that traps the forwarded
+    // SIGINT and exits 0 was cached as a success with its partial outputs,
+    // one that exits 1 was retried after Ctrl-C, and one SIGKILLed at the
+    // end of the grace read as an OOM failure (item 962). A child that died
+    // of SIGINT / SIGTERM while the run was NOT stopping (a supervisor, a
+    // `kill` from another shell) is a failure: it was labelled a shutdown
+    // abort, never retried, its output hidden, and fail-fast never tripped
+    // (item 1100). A terminal's Ctrl-C reaches the child and vx together,
+    // and the child's exit can be seen before vx's own handler has run, so
+    // a signal death waits one event-loop turn for a pending handler before
+    // it is judged; a timeout's SIGTERM is our own deadline and judged now.
+    let shutdown = args.stopSignal?.aborted === true
+    if (
+      !shutdown &&
+      (result.signal === 'SIGINT' || result.signal === 'SIGTERM') &&
+      !result.timedOut
+    ) {
+      await new Promise((resolve) => setTimeout(resolve, 0))
+      shutdown = args.stopSignal?.aborted === true
+    }
     if (shutdown) {
       return {
         node,
         status: 'aborted',
         exitCode: effectiveExitCode,
-        durationMs: result.durationMs,
+        durationMs: spentMs,
         hash,
         wallclockStartNs,
         wallclockEndNs: process.hrtime.bigint() - args.runStartHrTimeNs,
@@ -977,7 +991,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     node,
     status: effectiveExitCode === 0 ? 'success' : 'failed',
     exitCode: effectiveExitCode,
-    durationMs: result.durationMs,
+    durationMs: spentMs,
     hash,
     ...(attempt > 1 ? { attempts: attempt } : {}),
     ...(result.timedOut === true && effectiveExitCode !== 0 ? { timedOut: true as const } : {}),

package/src/orchestrator/hit-restore.ts

@@ -22,6 +22,7 @@ import {
 import type { TaskOutcome } from '../graph/index.js'
 import { asTrees, span, taskGlob, wholeSubtreePrefixes } from '../util/index.js'
 import type { ExecuteArgs } from './execute-task.js'
+import { entryHolds } from './miss-save.js'
 
 export interface RestoreHitArgs {
   args: ExecuteArgs
@@ -232,7 +233,12 @@ export async function restoreHit(restore: RestoreHitArgs): Promise<TaskOutcome>
     // ~75 ms of the no-op's CPU (2026-09-11). A caller with no list gets
     // no snapshot (item 637: recording here was that same refusal).
     if (dirPrefixes !== null && args.outputDirSnapshots !== undefined) {
-      args.outputDirSnapshots.push({ hash, projectDir: node.projectDir, prefixes: dirPrefixes })
+      args.outputDirSnapshots.push({
+        hash,
+        projectDir: node.projectDir,
+        prefixes: dirPrefixes,
+        holds: entryHolds(node),
+      })
     }
     // Restored outputs changed the project's tree — but on this
     // path we know the EXACT changed paths (wiped declared

package/src/orchestrator/miss-save.ts

@@ -13,9 +13,10 @@ import {
   type GitFilesCache,
   resolveOutputs,
   resolveWorkspaceOutputs,
+  WORKSPACE_OUTPUT_PREFIX,
 } from '../cache/index.js'
 import type { TaskNode } from '../graph/index.js'
-import { span, wholeSubtreePrefixes } from '../util/index.js'
+import { asTrees, span, taskGlob, wholeSubtreePrefixes } from '../util/index.js'
 import type { Logger } from './logger.js'
 import type { TaskInputComponent } from './task-hash.js'
 
@@ -24,6 +25,32 @@ export interface OutputDirSnapshot {
   hash: string
   projectDir: string
   prefixes: readonly string[]
+  /** Whether the files the run-end walk saw are the entry's rows (`recordOutputDirs`). */
+  holds: (files: readonly string[], rows: ReadonlyArray<{ path: string }>) => boolean
+}
+
+/**
+ * The `holds` of a run-end snapshot: the files under the prefixes are the
+ * entry's project rows, by the rule the next hit's walk applies. An
+ * additive task's rows need only be present (the upstream's files sit
+ * beside them); an upstream's tree may also hold what a dependant's glob
+ * adds. A stray a later task or another process wrote there before run
+ * end refuses the snapshot, and the next hit walks and restores
+ * (item 1087). The run reads every snapshot's rows in one batch.
+ */
+export function entryHolds(
+  node: TaskNode,
+): (files: readonly string[], rows: ReadonlyArray<{ path: string }>) => boolean {
+  return (files, rows) => {
+    const expected = new Set(
+      rows.map((r) => r.path).filter((p) => !p.startsWith(WORKSPACE_OUTPUT_PREFIX)),
+    )
+    const seen = new Set(files)
+    if ((node.addsToOutputsOf?.length ?? 0) > 0) return [...expected].every((p) => seen.has(p))
+    const added = (node.outputsAddedToBy ?? []).flatMap((g) => asTrees([g])).map(taskGlob)
+    const kept = files.filter((f) => expected.has(f) || !added.some((g) => g.match(f)))
+    return kept.length === expected.size && kept.every((f) => expected.has(f))
+  }
 }
 
 export interface SaveMissArgs {
@@ -151,6 +178,7 @@ export async function saveMiss(a: SaveMissArgs): Promise<{ landed: Promise<void>
         hash: a.hash,
         projectDir: node.projectDir,
         prefixes: savedDirPrefixes,
+        holds: entryHolds(node),
       })
     }
   }

package/src/orchestrator/placement.ts

@@ -1,7 +1,8 @@
 // Where each task runs: the placement of a graph over the resolved
 // executors, and the plan-mode view of it. Split from run.ts on 2026-09-10
 // (pure motion). A task is pinned to this machine when it is persistent,
-// depends on a persistent task, is sandboxed, or says `exec.remote: false`;
+// depends on a persistent task, is sandboxed, says `exec.remote: false`, or
+// folds a runtime probe into its key;
 // everything else asks the executors in declaration order, and the local
 // floor takes what nothing claimed.
 
@@ -19,7 +20,8 @@ import type { prepareRun } from './prepare.js'
  * submitter), declares `exec.sandbox` (the sandbox is this machine's
  * machinery — a worker has none of it, and a boundary "verified" where it
  * is not enforced passes vacuously), or declares `exec.remote: false`. A
- * dependant of a pinned task is pinned with it.
+ * dependant of a pinned task is pinned with it. A task whose key folds a
+ * runtime probe is pinned alone (`withProbedRuntime`).
  */
 export function pinnedLocalSet(nodes: Map<string, TaskNode>): Set<string> {
   const pinned = new Set<string>()
@@ -32,7 +34,7 @@ export function pinnedLocalSet(nodes: Map<string, TaskNode>): Set<string> {
       pinned.add(node.id)
     }
   }
-  if (pinned.size === 0) return pinned
+  if (pinned.size === 0) return withProbedRuntime(nodes, pinned)
   // Pinning flows up the dependant edges from what pins itself, one walk on
   // an explicit stack: a chain is as deep as the graph, and a recursion
   // per edge threw `RangeError` on the 50,000 the builder takes (item 737).
@@ -52,6 +54,24 @@ export function pinnedLocalSet(nodes: Map<string, TaskNode>): Set<string> {
       stack.push(up)
     }
   }
+  return withProbedRuntime(nodes, pinned)
+}
+
+/**
+ * A key that folds `cache.inputs.runtime` / `workspaceRuntime` holds what
+ * THIS machine answered (`node -v`); a worker runs its own runtime, which no
+ * executor can prove equal, and its output saved under this key is a stale
+ * hit here (C-2). Such a task runs here. Its dependants are not pinned with
+ * it: they fold the probe through its input key, and their own output does
+ * not depend on this machine's runtime.
+ */
+function withProbedRuntime(nodes: Map<string, TaskNode>, pinned: Set<string>): Set<string> {
+  for (const node of nodes.values()) {
+    const inputs = node.config.cache?.inputs
+    if ((inputs?.runtime?.length ?? 0) > 0 || (inputs?.workspaceRuntime?.length ?? 0) > 0) {
+      pinned.add(node.id)
+    }
+  }
   return pinned
 }
 

package/src/orchestrator/plugin-host.ts

@@ -151,7 +151,7 @@ export async function applyGraphHooks(
     last = plugin
   }
   if (last === undefined) return
-  await safe(last, 'graph', () => checkGraph(nodes))
+  await safe(last, 'graph', () => checkGraph(nodes, ctx.workspaceRoot))
 }
 
 /**

package/src/orchestrator/plugin.ts

@@ -224,7 +224,15 @@ export interface PluginCommand {
   run(argv: readonly string[], ctx: CommandContext): number | Promise<number>
 }
 
-export interface CommandContext extends BaseContext {}
+export interface CommandContext extends BaseContext {
+  /**
+   * The worker count a `vx run` here uses unless `--concurrency` says
+   * otherwise: `vx.workspace`'s `concurrency`, else what the machine allows.
+   * A verb that budgets a run (`vx history`) reads it here; its own
+   * `machineParallelism()` said 4 cores beside `concurrency: 1` (item 1068).
+   */
+  readonly concurrency: number
+}
 
 /** `config` runs before the cache dir is known — it may be what the hook changes. */
 export interface WorkspaceHookContext {

package/src/orchestrator/prepare.ts

@@ -405,6 +405,7 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
       projects,
       packageGraph,
       requested,
+      workspaceRoot,
       ...(projects.size < projectsWithConfigs.length
         ? { undeclaredDeps: (id: string, name: string) => void unproven.push([id, name]) }
         : {}),

package/src/orchestrator/run.ts

@@ -7,7 +7,12 @@ import { loadWorkspace, unreachedHint, unreachedPackages } from '../workspace/in
 import path from 'node:path'
 import { type CacheLayer, type CachePolicy, FULL_CACHE_POLICY } from '../cache/index.js'
 import { VERSION } from '../version.js'
-import { resetSandbox, VX_RUN_TASK_ENV, VX_RUN_WORKSPACE_ENV } from '../exec/index.js'
+import {
+  resetSandbox,
+  signalExitCode,
+  VX_RUN_TASK_ENV,
+  VX_RUN_WORKSPACE_ENV,
+} from '../exec/index.js'
 import { DeferredOutputs } from './deferred-outputs.js'
 import { resolveDownloadModes } from './download-policy.js'
 import type { TaskExecutor } from '../exec/index.js'
@@ -173,6 +178,20 @@ export function shouldShortCircuit(
   return nodes.size > 0
 }
 
+/**
+ * The command line a run hands to its telemetry sinks, with what follows
+ * `--` counted, not quoted. Those are the task's arguments,
+ * often a token (`-- --token=…`), and the line reached an OTLP span, the
+ * GitHub job summary and a check-run posted over the API verbatim (item
+ * 1057). Local history (`vx last`) keeps the whole line, on this machine.
+ */
+export function invocationCommand(argv: readonly string[]): string {
+  const sep = argv.indexOf('--')
+  if (sep === -1) return argv.join(' ')
+  const rest = argv.length - sep - 1
+  return [...argv.slice(0, sep), '--', `<${rest} argument${rest === 1 ? '' : 's'}>`].join(' ')
+}
+
 export async function run(options: RunOptions): Promise<RunSummary> {
   // Color decision: a custom logger (tests, embedders) handles its
   // own formatting and asserts on plain strings, so we suppress
@@ -465,7 +484,11 @@ async function runOnBus(
   // SIGKILL after the grace, and a run that returned first left that child
   // running past vx's exit (turborepo#14043's class).
   let aborting: Promise<void> | undefined
+  // The servers that had ended when the stop landed: those crashed. One that
+  // ends after it is the stop's own kill, and was named a crash (item 1061).
+  let endedBeforeStop: ReadonlySet<ReturnType<typeof Bun.spawn>> | undefined
   const onAbort = (): void => {
+    endedBeforeStop = new Set([...persistentRegistry.values()].filter(hasEnded))
     aborting = terminateChildren(
       () => [...liveChildren, ...persistentRegistry.values()],
       forwardedSignal(stopRun.signal.reason),
@@ -566,7 +589,7 @@ async function runOnBus(
       runContextRecord = {
         runId,
         vxVersion: VERSION,
-        command: options.command ?? process.argv.slice(1).join(' '),
+        command: options.command ?? invocationCommand(process.argv.slice(1)),
         requestedTasks: [...options.tasks],
         cachePolicy: compactCachePolicy(policy),
         concurrency,
@@ -707,13 +730,13 @@ async function runOnBus(
         `[vx] --exclude-dependencies: ${excluded.unsaved} cached task(s) build on a skipped dependency; what they build is not saved`,
       )
     }
-    const isTainted = taintTracker(options.continueMode === 'always', excluded.seeds)
+    const taint = taintTracker(options.continueMode === 'always', excluded.seeds, nodes)
     const dependedOn = new Set<string>()
     for (const n of nodes.values()) for (const d of n.deps) dependedOn.add(d)
 
     const buildExecuteArgs = (node: TaskNode, upstream: TaskOutcome[], reuseProbe = true) => {
       const probe = reuseProbe ? shortCircuit.preProbed.get(node.id) : undefined
-      const taint = isTainted(node, upstream)
+      const tainted = taint.judge(node, upstream)
       return {
         node,
         upstream,
@@ -737,7 +760,7 @@ async function runOnBus(
         gitFilesCache,
         hashCache,
         ...(probe !== undefined ? { preProbed: probe } : {}),
-        ...(taint ? { taintedUpstream: true } : {}),
+        ...(tainted ? { taintedUpstream: true } : {}),
         ...(dependedOn.has(node.id) ? {} : { noDependants: true as const }),
         fingerprintWatch,
         ...(sandboxArmer !== null ? { armSandbox: () => sandboxArmer.arm() } : {}),
@@ -778,6 +801,7 @@ async function runOnBus(
         log.taskStart?.(node)
       },
       onFinish: (o) => {
+        taint.settled(o)
         log.taskComplete(o.node, o)
         narrowDemand(o.node.id)
       },
@@ -801,14 +825,34 @@ async function runOnBus(
     // An aborted run's children are already being torn down: nothing to hold.
     const hold = options.holdPersistent === true && !stopRun.signal.aborted
     const keepAlive = selectKeepAlive(persistentRegistry, nodes, foreground || hold)
-    const crashedPersistent = await shutdownPersistent(persistentRegistry, keepAlive.children)
+    const crashedPersistent = (
+      await shutdownPersistent(persistentRegistry, keepAlive.children)
+    ).filter((c) => endedBeforeStop?.has(persistentRegistry.get(c.id)!) ?? true)
 
     mark('run graph')
     // Clear the status line for good before the summary prints.
     log.runEnd?.()
 
+    // A server that died on its own before the stop failed, whatever its
+    // outcome said when it became ready: the footer counted it a success
+    // over the run's red exit (item 1071). A kept one that has already
+    // died is the same; the keep-alive wait below names it. Its code is its
+    // own, or the shell's report of the signal that took it.
+    const failServer = (id: string, code: number | string): void => {
+      const o = outcomes.get(id)
+      if (o === undefined) return
+      const exitCode = typeof code === 'number' ? code : signalExitCode(code)
+      outcomes.set(id, { ...o, status: 'failed', exitCode })
+    }
+    for (const c of crashedPersistent) failServer(c.id, c.code)
+    keepAlive.nodes.forEach((n, i) => {
+      const child = keepAlive.children[i]!
+      if (!hasEnded(child) || child.exitCode === 0) return
+      if (endedBeforeStop !== undefined && !endedBeforeStop.has(child)) return
+      failServer(n.id, child.exitCode ?? child.signalCode ?? 'unknown')
+    })
     const list = [...outcomes.values()]
-    const ok = list.every((o) => isPassStatus(o.status)) && crashedPersistent.length === 0
+    const ok = list.every((o) => isPassStatus(o.status))
 
     // The summary + artifact writers + recordRun pass all exclude group
     // tasks via the shared tallyOutcomes helper. We pass the full
@@ -827,10 +871,15 @@ async function runOnBus(
     // A task killed by a shutdown signal is in no bucket above, yet it makes
     // `ok` false — name it, or the red exit is undiagnosable.
     for (const line of formatAbortedSection(list)) log.status(line)
-    // Likewise a dependency-only server that died before the end of the
-    // graph stopped it: its outcome says `success` (it became ready).
-    for (const c of crashedPersistent)
-      log.status(`vx: ${c.id} exited with code ${c.code} before the run stopped it`)
+    // And a dependency-only server that died before the end of the graph
+    // stopped it: the footer counts it failed, this says why.
+    // A signal death is named as its exit code, as the keep-alive wait
+    // names it: `code SIGTERM` read beside `code 143` for one event (item
+    // 1102).
+    for (const c of crashedPersistent) {
+      const code = typeof c.code === 'number' ? c.code : signalExitCode(c.code)
+      log.status(`vx: ${c.id} exited with code ${code} before the run stopped it`)
+    }
     // The footer's "N skipped" names no task; this names each under the
     // failure that blocked it.
     for (const line of formatSkippedSection(list)) log.status(line)
@@ -971,11 +1020,25 @@ async function runOnBus(
     // directories are old enough for the snapshot's racy window (see
     // miss-save.ts). A few at a time: each is an lstat + readdir per
     // prefix; the rows land together at close, in one transaction.
+    // Each walk is held to its entry's rows (item 1087), read here in one
+    // batch: read per snapshot, each read also flushed the snapshots before
+    // it, one transaction apiece (+110 ms at 1,000).
+    const snapshotRows = new Map<string, ReadonlyArray<{ path: string }>>()
+    for (let i = 0; i < outputDirSnapshots.length; i += 900) {
+      const batch = cache.loadOutputFilesBatch(
+        outputDirSnapshots.slice(i, i + 900).map((s) => s.hash),
+      )
+      for (const [hash, rows] of batch) snapshotRows.set(hash, rows)
+    }
     for (let i = 0; i < outputDirSnapshots.length; i += 32) {
       await Promise.all(
         outputDirSnapshots
           .slice(i, i + 32)
-          .map((s) => cache.recordOutputDirs?.(s.hash, s.projectDir, s.prefixes)),
+          .map((s) =>
+            cache.recordOutputDirs?.(s.hash, s.projectDir, s.prefixes, (files) =>
+              s.holds(files, snapshotRows.get(s.hash) ?? []),
+            ),
+          ),
       )
     }
     mark('output dir snapshots')

package/src/orchestrator/sandbox-request.ts

@@ -96,7 +96,7 @@ export function sandboxRunUnion(nodes: Iterable<TaskNode>): SandboxRunUnion | nu
  * The domain union is computed here from every sandboxed node, because
  * SRT runs ONE filtering proxy per run and checks every request against
  * the allowlist given to `initialize()` — never the per-call one
- * (`sandbox-manager.js` 0.0.75). A task that declares no domains still
+ * (`sandbox-manager.js`, 0.0.75 and 0.0.76). A task that declares no domains still
  * reaches nothing: its profile is not given the proxy's port at all.
  * The unix-socket allowance is per run the same way: SRT's Linux seccomp
  * filter on `socket(AF_UNIX)` is all-or-nothing and read at
@@ -183,11 +183,14 @@ export async function sandboxRequestFor(
   // Pre-create what the task said it will write — after the grants are
   // resolved, which refuses one that leaves the project through a link
   // before anything is created along it (item 1003).
-  const config = wallOff(resolveSandboxConfig(sandbox, node.projectDir), workspaceRoot, [
-    ...nested,
-    path.join(workspaceRoot, '.git'),
-    path.join(workspaceRoot, '.vx'),
-  ])
+  const walls = [...nested, path.join(workspaceRoot, '.git'), path.join(workspaceRoot, '.vx')].map(
+    toRealPath,
+  )
+  const config = wallOff(
+    resolveSandboxConfig(sandbox, node.projectDir, walls),
+    workspaceRoot,
+    walls,
+  )
   const placeholders = await prepareOutputsForBind(node.projectDir, sandbox.allow?.write ?? [])
   const request: NonNullable<ExecuteRequest['sandbox']> = {
     // Only what the task declared, plus node_modules. Write paths are
@@ -197,7 +200,13 @@ export async function sandboxRequestFor(
     // Enforcement anchors at the WORKSPACE ROOT: a task may not leave
     // its project, so every sibling and every root file is denied.
     // Reporting is a different question — see `reportWithin` below.
-    baseDenyRead: [workspaceRoot],
+    // On macOS the walls are denied too: seatbelt does not mount, so the
+    // punch cannot apply, and SRT emits a deny strictly inside a literal
+    // read grant AFTER the grant, where it wins (`lateReadDenyFilters`,
+    // 0.0.76). A grant naming a wall is not strictly outside it and wins.
+    // Without it a root task's `read: ['.']` read its nested projects under
+    // seatbelt (B-4).
+    baseDenyRead: process.platform === 'darwin' ? [workspaceRoot, ...walls] : [workspaceRoot],
     // …but only denials INSIDE the project are worth reporting. A task
     // bumping into the wall is the sandbox working, not a finding: the
     // walk `bun build --compile` makes from `/` down to its cwd lists
@@ -422,14 +431,14 @@ async function prepareOutputsForBind(
  * punched (`punchWalls`); a write grant whose bind would hold one — a file
  * grant binds its directory on Linux, so `write: ['out.txt']` in a root
  * project bound the whole workspace writable, `.git` included — is
- * refused, as there is no writable bind that leaves a wall out.
+ * refused, as there is no writable bind that leaves a wall out. A glob's
+ * hits already stop at the walls (`resolveSandboxConfig` takes them).
  */
 function wallOff(
   config: ResolvedSandboxConfig,
   workspaceRoot: string,
-  raw: readonly string[],
+  walls: readonly string[],
 ): ResolvedSandboxConfig {
-  const walls = raw.map(toRealPath)
   const home = toRealPath(workspaceRoot)
   for (const bind of bindableWrites(config.allowWrite)) {
     // A bind outside the workspace is the user's own path (`/tmp/x`,