@vzn/vx 0.0.591 → 0.0.595

package/launcher.cjs

@@ -37,8 +37,15 @@ const SUPPORTED = ['linux-x64', 'linux-arm64', 'darwin-x64', 'darwin-arm64']
 const key = `${process.platform}-${process.arch}`
 const args = process.argv.slice(2)
 
+// The prebuilt Linux binaries link glibc. On musl (Alpine) the loader they
+// name is absent, execve fails with ENOENT on a file that exists, and the
+// user read "failed to launch (spawn … ENOENT)". Treated as no binary here,
+// so Bun runs the source when present and the error names the cause.
+const GLIBC_LOADER = { x64: '/lib64/ld-linux-x86-64.so.2', arm64: '/lib/ld-linux-aarch64.so.1' }
+const noGlibc = process.platform === 'linux' && !existsSync(GLIBC_LOADER[process.arch] ?? '/')
+
 function platformBinary() {
-  if (!SUPPORTED.includes(key)) return undefined
+  if (!SUPPORTED.includes(key) || noGlibc) return undefined
   const platformPkg = `${name}-${key}`
   try {
     // No `exports` restriction on the platform packages, so package.json
@@ -119,7 +126,7 @@ if (bin !== undefined) {
 } else {
   const supported = SUPPORTED.join(', ')
   process.stderr.write(
-    `${base}: no prebuilt binary for ${key}.\n` +
+    `${base}: no prebuilt binary for ${key}${noGlibc ? ' without glibc (musl)' : ''}.\n` +
       `  Supported platforms: ${supported}.\n` +
       `  If your platform should be supported, reinstall so npm fetches the\n` +
       `  matching ${name}-${key} optionalDependency, or install Bun (>=1.4) to\n` +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx",
-  "version": "0.0.591",
+  "version": "0.0.595",
   "description": "The fastest task runner and build cache for JavaScript monorepos.",
   "type": "module",
   "exports": {
@@ -21,10 +21,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@vzn/vx-linux-x64": "0.0.591",
-    "@vzn/vx-linux-arm64": "0.0.591",
-    "@vzn/vx-darwin-x64": "0.0.591",
-    "@vzn/vx-darwin-arm64": "0.0.591"
+    "@vzn/vx-linux-x64": "0.0.595",
+    "@vzn/vx-linux-arm64": "0.0.595",
+    "@vzn/vx-darwin-x64": "0.0.595",
+    "@vzn/vx-darwin-arm64": "0.0.595"
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.76"

package/src/bin.ts

@@ -24,17 +24,10 @@ async function main(): Promise<void> {
     // costs). Registered before any verb runs; the façade loads on first use.
     registerCoreAlias(() => import('./index.js') as Promise<Record<string, unknown>>)
     const code = await run(argv)
-    // NOTHING calls `process.exit` here, and that is the fix rather than a
-    // simplification. Bun drops what a pipe has not yet taken when
-    // `process.exit` follows a large write: 300 KB written then exit
-    // delivered 64 KiB (128 KiB after a tick), and `vx history --format
-    // json` on a 300-project workspace was cut mid-string (2026-09-15).
-    // `stdout.end(cb)` fixed that on 1.4.2 — and on 1.3.11 the callback
-    // still fires early: 2 MiB written, 214 KB delivered (2026-09-20).
-    // Setting the code and letting the loop drain is the one form that
-    // does not depend on when a runtime decides a pipe is flushed; it
-    // costs a hang if a verb leaves a handle open, which the suite's
-    // several hundred spawns of this binary would show at once.
+    // Not `process.exit` here: Bun drops what a pipe has not yet taken
+    // when it follows a large write (300 KB written, 64 KiB delivered;
+    // `vx history --format json` was cut mid-string, 2026-09-15). The code
+    // is set, and `exitOnceFlushed` exits after both streams have ended.
     process.exitCode = code
   } catch (err) {
     const { fsRefusalHint, isFsRefusal, isOutOfFds, isUserError, OUT_OF_FDS_HINT } =
@@ -65,6 +58,28 @@ async function main(): Promise<void> {
     process.exitCode = 1
   }
   settled = true
+  await exitOnceFlushed()
+}
+
+/**
+ * Exit once stdout and stderr have ended, with the code the verb set. A
+ * config can leave a timer behind (a top-level `setInterval`, an await that
+ * hit its evaluation budget), and the loop it holds never drained: vx
+ * printed its verdict and hung for good. Only after `main` has settled, so
+ * `vx watch`, `vx mcp` and a run's kept-alive tasks end when their verb
+ * does. `end(cb)` delivers a large write whole on Bun 1.4.2 (4 MiB under a
+ * slow reader; `write('', cb)` delivered 450 KB), the floor `engines.bun`
+ * holds. A stream whose end never calls back leaves the loop to drain. A
+ * signal's handler exits by itself, with the signal's code.
+ */
+async function exitOnceFlushed(): Promise<void> {
+  if ((await import('./util/index.js')).exitClaimedBySignal()) return
+  let open = 2
+  const ended = (): void => {
+    if (--open === 0) process.exit()
+  }
+  process.stdout.end(ended)
+  process.stderr.end(ended)
 }
 
 // The loop drained while the verb was still pending: something it awaits

package/src/cache/archive.ts

@@ -168,7 +168,7 @@ export interface ExecUsage {
 }
 
 /** One regular file in an artifact, with its restore metadata resolved. */
-export interface ArchiveEntry {
+interface ArchiveEntry {
   /** Full archive-relative name, e.g. `outputs/dist/index.js`. */
   name: string
   size: number
@@ -192,7 +192,7 @@ export class ArchiveSecurityError extends Error {
 }
 
 /** What `packArtifactStream` packs: stdout plus archive name → absolute source path. */
-export interface PackArgs {
+interface PackArgs {
   /** The cache key, recorded in the sidecar (item 943); ingest refuses an artifact without it. */
   key?: string
   stdout: string
@@ -563,6 +563,8 @@ interface Staged {
   target: string
   /** The topmost directory `mkdir -p` created for it, pruned on abort. */
   created: string | undefined
+  /** Written by Bun's file writer, which creates with 0664 where `writeFile` uses 0666 (before the umask). */
+  streamed: boolean
 }
 
 /**
@@ -761,7 +763,8 @@ class Extractor {
       path.dirname(target),
       `.vx-tmp-${process.pid.toString(36)}-${(tmpSeq++).toString(36)}`,
     )
-    this.staged.push({ name, tmp, target, created })
+    const streamed = !(body instanceof Uint8Array)
+    this.staged.push({ name, tmp, target, created, streamed })
     if (body instanceof Uint8Array) {
       this.inflightBytes += body.byteLength
       // `writeFile`, not `Bun.write`: for a buffer this size `Bun.write`
@@ -803,17 +806,23 @@ class Extractor {
    * (measured 2026-09-11 on payload's ui, 4,069 files: 892 ms → see the
    * archive bench). A yield every `COMMIT_BATCH` files keeps the other
    * restores' round trips flowing. The chmod is skipped when the mode is
-   * the one the temp file was created with — the common case.
+   * the one the temp file was created with — the common case. The two
+   * writers create with different modes (under umask 000: 0666 and 0664),
+   * so each is stat'ed once.
    */
   async commit(
     metaFor: (name: string) => [mode: number, mtimeMs: number | undefined],
   ): Promise<void> {
     await this.drain()
-    const first = this.staged[0]
-    const createdMode = first === undefined ? -1 : statSync(first.tmp).mode & 0o777
+    const createdModes = new Map<boolean, number>()
     let n = 0
     for (const s of this.staged) {
       const [mode, mtimeMs] = metaFor(s.name)
+      let createdMode = createdModes.get(s.streamed)
+      if (createdMode === undefined) {
+        createdMode = statSync(s.tmp).mode & 0o777
+        createdModes.set(s.streamed, createdMode)
+      }
       if ((mode & 0o777) !== createdMode) chmodSync(s.tmp, mode & 0o777)
       if (mtimeMs !== undefined) {
         // A Date, not seconds: Bun reads a negative number of seconds as
@@ -837,7 +846,9 @@ class Extractor {
     await Promise.allSettled(this.inflight)
     this.inflight = []
     await Promise.all(this.staged.map((s) => unlink(s.tmp).catch(() => undefined)))
-    for (const s of this.staged) {
+    // Newest first: a later entry's chain can sit inside an earlier one's
+    // (`dist/` then `dist/sub/`), never the reverse.
+    for (const s of this.staged.toReversed()) {
       if (s.created === undefined) continue
       let dir = path.dirname(s.target)
       const top = path.resolve(s.created)

package/src/cache/cache.ts

@@ -42,7 +42,9 @@ import {
   lstatSync,
   mkdirSync,
   openSync,
+  readdirSync,
   renameSync,
+  utimesSync,
   writeFileSync,
 } from 'node:fs'
 import { readdir, rm, stat, unlink, writeFile } from 'node:fs/promises'
@@ -241,6 +243,30 @@ export const SCHEMA_VERSION = 'v32'
 /** The tables a store holds: dropped from a workspace index that held them itself. */
 const STORE_TABLES = ['entry_inputs', 'output_files', 'entry_stdout', 'store_meta', 'entries']
 
+/**
+ * An index that records a schema other than this vx's: the one an opener
+ * that writes resets. Reads the recorded version alone and touches
+ * nothing; an unreadable file is left to the open to refuse.
+ */
+function indexOfAnotherSchema(dbFile: string): boolean {
+  let found: string | undefined
+  try {
+    const db = new Database(dbFile, { readonly: true })
+    try {
+      found = (
+        db.query("SELECT value FROM schema_meta WHERE key = 'version'").get() as {
+          value: string
+        } | null
+      )?.value
+    } finally {
+      closeDb(db)
+    }
+  } catch {
+    return false
+  }
+  return found !== undefined && found !== SCHEMA_VERSION
+}
+
 /** An entry row with its stdout, which lives apart (v29); none stored reads as ''. */
 const SELECT_ENTRY =
   "SELECT e.*, COALESCE(s.stdout, '') AS stdout FROM entries e LEFT JOIN entry_stdout s ON s.hash = e.hash"
@@ -373,7 +399,7 @@ function usageOfEntry(entry: { cpuMs?: number; peakRssBytes?: number }): ExecUsa
  * it there", and the ignore file is created exclusively instead of probed
  * first. An existing cache costs three calls; it cost six.
  */
-function openCacheDir(cacheDir: string): string | null {
+function openCacheDir(cacheDir: string, workspaceRoot?: string): string | null {
   const ignore = path.join(cacheDir, '.gitignore')
   try {
     accessSync(cacheDir, constants.W_OK)
@@ -390,7 +416,7 @@ function openCacheDir(cacheDir: string): string | null {
     // A FILE at `cacheDir` passed the `access` above; mkdir names it.
     if (code === 'ENOTDIR') makeCacheDir(cacheDir)
     if (code !== 'ENOENT') return errorText(err)
-    refuseManifestDir(cacheDir)
+    refuseManifestDir(cacheDir, workspaceRoot)
   }
   try {
     writeFileSync(ignore, IGNORE_ALL, { flag: 'wx' })
@@ -456,21 +482,50 @@ const IGNORE_ALL = '*\n'
  * the workspace or a project (`cacheDir: ''`, `'.'`, `'packages/a'`): the
  * `*` ignore file above hid every file in it from git, so its inputs
  * matched nothing and a changed source replayed the old output, and the
- * artifacts landed among the sources (item 997). Asked only when there is
- * no index yet, so an open cache pays nothing for it.
+ * artifacts landed among the sources (item 997). A directory that holds
+ * projects (`'packages'`) or the workspace (`'..'`, `'/'`) does the same
+ * one level up. Asked only when there is no index yet, so an open cache
+ * pays nothing for it.
  */
-function refuseManifestDir(cacheDir: string): void {
-  for (const manifest of ['package.json', 'pnpm-workspace.yaml']) {
-    if (!existsSync(path.join(cacheDir, manifest))) continue
+function refuseManifestDir(cacheDir: string, workspaceRoot: string | undefined): void {
+  const manifestIn = (dir: string): string | undefined =>
+    MANIFESTS.find((m) => existsSync(path.join(dir, m)))
+  const own = manifestIn(cacheDir)
+  if (own !== undefined) {
     throw new UserError(
-      `cache directory ${cacheDir} holds a ${manifest}: it is the workspace's or a project's own ` +
+      `cache directory ${cacheDir} holds a ${own}: it is the workspace's or a project's own ` +
         `directory, and vx would keep its index there under a \`*\` .gitignore that hides every file ` +
-        `in it from git and from the cache keys. Point \`cacheDir\` in vx.workspace.ts (or ` +
-        `--cache-dir) at a directory of its own, such as .vx/cache.`,
+        `in it from git and from the cache keys. ${OWN_DIR_HINT}`,
+    )
+  }
+  let held: string | undefined
+  if (workspaceRoot !== undefined) {
+    const rel = path.relative(cacheDir, workspaceRoot)
+    if (!rel.startsWith('..') && !path.isAbsolute(rel)) held = workspaceRoot
+  }
+  if (held === undefined) {
+    for (const entry of readdirSync(cacheDir, { withFileTypes: true })) {
+      if (!entry.isDirectory()) continue
+      const sub = path.join(cacheDir, entry.name)
+      if (manifestIn(sub) !== undefined) {
+        held = sub
+        break
+      }
+    }
+  }
+  if (held !== undefined) {
+    throw new UserError(
+      `cache directory ${cacheDir} holds ${held}, a project or workspace directory, and vx would keep ` +
+        `its index there under a \`*\` .gitignore that hides it from git and from the cache keys. ` +
+        OWN_DIR_HINT,
     )
   }
 }
 
+const MANIFESTS = ['package.json', 'pnpm-workspace.yaml']
+const OWN_DIR_HINT =
+  'Point `cacheDir` in vx.workspace.ts (or --cache-dir) at a directory of its own, such as .vx/cache.'
+
 function makeCacheDir(cacheDir: string): void {
   try {
     mkdirSync(cacheDir, { recursive: true })
@@ -578,41 +633,6 @@ export class Cache implements CacheLayer {
     return new Cache(cacheDir, undefined, undefined, undefined, 'inspect')
   }
 
-  /**
-   * What a real prune reaps from an index of an EARLIER schema, which it
-   * resets first, leaving every aged artifact row-less: a dry run that
-   * refused it could not preview the biggest prune there is, the one
-   * after an upgrade (item 1083). Reads the recorded version alone and
-   * touches nothing. Null for an absent, current, newer or unreadable
-   * index; `Cache.inspect` answers those.
-   */
-  static async orphansBeforeReset(
-    cacheDir: string,
-  ): Promise<{ found: string; orphans: number; orphanBytes: number } | null> {
-    const dbFile = path.join(cacheDir, 'cache.db')
-    if (!existsSync(dbFile)) return null
-    let found: string | undefined
-    try {
-      const db = new Database(dbFile, { readonly: true })
-      try {
-        found = (
-          db.prepare("SELECT value FROM schema_meta WHERE key = 'version'").get() as {
-            value: string
-          } | null
-        )?.value
-      } finally {
-        closeDb(db)
-      }
-    } catch {
-      return null
-    }
-    if (found === undefined || found === SCHEMA_VERSION) return null
-    const aged = await scanOrphanFiles(cacheDir, () => new Set())
-    let orphanBytes = 0
-    for (const o of aged) orphanBytes += o.size
-    return { found, orphans: aged.length, orphanBytes }
-  }
-
   constructor(
     private readonly cacheDir: string,
     localPolicy: { read: boolean; write: boolean } = { read: true, write: true },
@@ -625,23 +645,25 @@ export class Cache implements CacheLayer {
      */
     private readonly artifactCeiling: number = MAX_DECOMPRESSED_ARTIFACT_BYTES,
     /**
-     * `'inspect'`: a reading verb (`why`, `last`, `info`, a dry prune). It
-     * never resets the index: a schema it cannot read is refused, named,
-     * and left as it was.
+     * `'inspect'`: a reading verb (`why`, `last`, `info`). It never resets
+     * the index: a schema it cannot read is refused, named, and left as it
+     * was. `'preview'`: a dry prune, which reads such an index as the reset
+     * the real prune does first leaves it, empty, with the store still
+     * reached, so it names what that prune takes (item 1083).
      */
-    mode: 'open' | 'inspect' = 'open',
+    mode: 'open' | 'inspect' | 'preview' = 'open',
     /**
      * The shared store's directory, unversioned: every key is seeded with
      * `CACHE_VERSION`, so two vx versions never read each other's entries,
      * and the store's own schema is `store_meta.schema` (`matchStoreSchema`). Or
      * `null` for an index that holds its entries itself (a `cacheDir`).
      * Undefined follows the layout the index records: a reading verb, a
-     * plugin's handle. An `'inspect'` open reads it only where the index
+     * plugin's handle. A reading open reads it only where the index
      * records none (deleted, or never written beside a run's store).
      */
     storeRoot?: string | null,
   ) {
-    this.inspecting = mode === 'inspect'
+    this.inspecting = mode !== 'open'
     this.read = localPolicy.read
     // The directory exists before the DB opens — bun:sqlite won't create
     // parent dirs for us. A directory this user cannot write into is a
@@ -657,8 +679,10 @@ export class Cache implements CacheLayer {
     // said "no recorded runs yet" (item 900).
     const dbFile = path.join(cacheDir, 'cache.db')
     this.dbFile = dbFile
-    const absent = mode === 'inspect' && !existsSync(dbFile)
-    this.writeBlocked = absent ? 'no index there yet' : openCacheDir(cacheDir)
+    const absent =
+      mode !== 'open' &&
+      (!existsSync(dbFile) || (mode === 'preview' && indexOfAnotherSchema(dbFile)))
+    this.writeBlocked = absent ? 'no index there yet' : openCacheDir(cacheDir, repoDir)
     this.write = localPolicy.write && this.writeBlocked === null
     try {
       this.db = new Database(absent ? ':memory:' : dbFile, { create: true })
@@ -749,7 +773,7 @@ export class Cache implements CacheLayer {
     // 2026-10-06; a newer one used to be refused, item 896). A reading verb
     // leaves it as it was.
     const refuseUnreadable = (found: string): void => {
-      if (mode === 'inspect') {
+      if (mode !== 'open') {
         throw new UserError(
           `the cache at ${cacheDir} holds index schema ${found} from another vx version; this vx reads ${SCHEMA_VERSION}, so nothing in it is readable here, and this verb leaves it untouched. The next \`vx run\` resets it`,
         )
@@ -803,7 +827,7 @@ export class Cache implements CacheLayer {
         )?.value,
     )
     let storeDir =
-      mode === 'inspect'
+      mode !== 'open'
         ? (recorded ?? (typeof storeRoot === 'string' ? storeRoot : undefined))
         : storeRoot === undefined
           ? recorded
@@ -847,17 +871,10 @@ export class Cache implements CacheLayer {
     this.storeDir = storeDir
     this.artifactDir = storeDir ?? cacheDir
     if (storeDir !== undefined) {
-      this.attachStore(storeDir, mode === 'inspect')
+      this.attachStore(storeDir, mode !== 'open')
       this.storeReset = this.matchStoreSchema(mode === 'open' && this.writeBlocked === null)
-    }
-
-    createTables(this.db, storeDir === undefined ? 'main' : 'store')
-    if (storeDir !== undefined && mode === 'open' && this.writeBlocked === null) {
-      this.db
-        .prepare(
-          "INSERT INTO store.store_meta(key, value) VALUES ('schema', ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value",
-        )
-        .run(SCHEMA_VERSION)
+    } else {
+      createTables(this.db, 'main')
     }
     if (mode === 'open' && this.writeBlocked === null && storeDir !== recorded) {
       if (storeDir === undefined)
@@ -988,50 +1005,63 @@ export class Cache implements CacheLayer {
    * reads it: a store another `SCHEMA_VERSION` wrote has its tables dropped
    * (owner, 2026-10-06), the artifacts kept. Each is indexed again from its
    * own bytes on its next hit (`adopt`). A reading verb reads such a store
-   * as empty and changes nothing.
+   * as empty and changes nothing. Creates the store's tables either way.
    */
   private matchStoreSchema(writable: boolean): SchemaReset | null {
-    const tables = new Set(
-      (
-        this.db
-          .prepare("SELECT name FROM store.sqlite_master WHERE type = 'table'")
-          .all() as Array<{
-          name: string
-        }>
-      ).map((r) => r.name),
-    )
-    if (!tables.has('entries')) return null
-    const found = tables.has('store_meta')
-      ? (
-          this.db.prepare("SELECT value FROM store.store_meta WHERE key = 'schema'").get() as {
-            value: string
-          } | null
-        )?.value
-      : undefined
-    if (found === SCHEMA_VERSION) return null
+    const read = (): { has: boolean; found: string | undefined } => {
+      const tables = new Set(
+        (
+          this.db
+            .prepare("SELECT name FROM store.sqlite_master WHERE type = 'table'")
+            .all() as Array<{
+            name: string
+          }>
+        ).map((r) => r.name),
+      )
+      const found = tables.has('store_meta')
+        ? (
+            this.db.prepare("SELECT value FROM store.store_meta WHERE key = 'schema'").get() as {
+              value: string
+            } | null
+          )?.value
+        : undefined
+      return { has: tables.has('entries'), found }
+    }
+    const seen = read()
+    if (seen.has && seen.found === SCHEMA_VERSION) {
+      createTables(this.db, 'store')
+      return null
+    }
     if (!writable) {
-      this.db.exec('DETACH DATABASE store')
-      this.db.prepare('ATTACH DATABASE ? AS store').run(':memory:')
+      if (seen.has) {
+        this.db.exec('DETACH DATABASE store')
+        this.db.prepare('ATTACH DATABASE ? AS store').run(':memory:')
+      }
+      createTables(this.db, 'store')
       return null
     }
-    let reset: SchemaReset | null = null
-    this.db
-      .transaction(() => {
-        // Re-read under the write lock: another workspace's open may have
-        // reset it first.
-        const now = (
-          this.db.prepare("SELECT value FROM store.store_meta WHERE key = 'schema'").get() as {
-            value: string
-          } | null
-        )?.value
-        if (now === SCHEMA_VERSION) return
-        for (const t of STORE_TABLES) {
-          if (t !== 'store_meta') this.db.exec(`DROP TABLE IF EXISTS store.${t}`)
+    // Re-read, drop, create and stamp under one write lock: as separate
+    // transactions, another vx's open landing after the drop made its own
+    // tables, and this one's `CREATE IF NOT EXISTS` kept them under its stamp.
+    return this.db
+      .transaction((): SchemaReset | null => {
+        const now = read()
+        let reset: SchemaReset | null = null
+        if (now.has && now.found !== SCHEMA_VERSION) {
+          for (const t of STORE_TABLES) {
+            if (t !== 'store_meta') this.db.exec(`DROP TABLE IF EXISTS store.${t}`)
+          }
+          reset = { from: now.found ?? 'an earlier schema', to: SCHEMA_VERSION }
         }
-        reset = { from: found ?? 'an earlier schema', to: SCHEMA_VERSION }
+        createTables(this.db, 'store')
+        this.db
+          .prepare(
+            "INSERT INTO store.store_meta(key, value) VALUES ('schema', ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value",
+          )
+          .run(SCHEMA_VERSION)
+        return reset
       })
       .immediate()
-    return reset
   }
 
   // --- config evaluations: `ConfigEvalStore`, delegated to `ConfigEvalTable` ---
@@ -1192,6 +1222,12 @@ export class Cache implements CacheLayer {
       // A second name for the same bytes: the index step renames it over
       // the artifact inside its write transaction, as for a save.
       linkSync(finalPath, tmpPath)
+      // The link shares the artifact's inode and so its mtime, which an
+      // artifact that needs adopting has had for hours: another process's
+      // orphan sweep read the temp as a crashed save's and took it, and the
+      // artifact with it, while this adopt was scanning them.
+      const now = new Date()
+      utimesSync(tmpPath, now, now)
     } catch {
       return false
     }

package/src/cache/config-evals.ts

@@ -6,6 +6,9 @@
 import type { Database, SQLQueryBindings } from 'bun:sqlite'
 import { lazyStatement } from './schema.js'
 
+const CONFIG_EVALS_SWEPT_AT = 'config_evals_swept_at'
+const DAY_MS = 24 * 60 * 60 * 1000
+
 export class ConfigEvalTable {
   private readonly selectConfigEval: ReturnType<Database['prepare']>
   private readonly insertConfigEval: ReturnType<Database['prepare']>
@@ -106,10 +109,22 @@ export class ConfigEvalTable {
   /**
    * Retention: a row not WRITTEN since `cutoff`. A hit does not refresh it
    * (that would be a write per config on every warm run), so a config that
-   * hit for thirty days is evaluated once more and stored again.
+   * hit for thirty days is evaluated once more and stored again. No index
+   * covers `created_at`, so each sweep reads every row with its JSON (1–6 ms
+   * at 8,000 rows, 2 MB); it runs once a day, on its own clock in
+   * `schema_meta`, as the file-hash sweep does.
    */
-  pruneOlderThan(cutoff: number): void {
-    this.db.prepare('DELETE FROM config_evals WHERE created_at < ?').run(cutoff)
-    this.db.prepare('DELETE FROM config_closures WHERE created_at < ?').run(cutoff)
+  pruneOlderThan(cutoff: number, now: number = Date.now()): void {
+    const last = this.db
+      .prepare('SELECT value FROM schema_meta WHERE key = ?')
+      .get(CONFIG_EVALS_SWEPT_AT) as { value: string } | null
+    if (last !== null && now - Number(last.value) < DAY_MS) return
+    this.db.transaction(() => {
+      this.db.prepare('DELETE FROM config_evals WHERE created_at < ?').run(cutoff)
+      this.db.prepare('DELETE FROM config_closures WHERE created_at < ?').run(cutoff)
+      this.db
+        .prepare('INSERT OR REPLACE INTO schema_meta(key, value) VALUES (?, ?)')
+        .run(CONFIG_EVALS_SWEPT_AT, String(now))
+    })()
   }
 }