@vzn/vx 0.0.591 → 0.0.595

package/src/exec/sandbox-violations.ts

@@ -44,8 +44,8 @@ const SYSCALLS = 'openat|access|statx|newfstatat'
 const QUOTED = '"((?:[^"\\\\]|\\\\.)+)"'
 // The directory descriptor a call names, `-y`'s path included: taken up to
 // the `, "` that opens the path argument, since a directory's name may hold
-// a quote (`4</ws/q"d>`).
-const DIRFD = '(?:AT_FDCWD|\\d+)(?:<.*?>)?, '
+// a quote (`4</ws/q"d>`). Captured: a relative path is in that directory.
+const DIRFD = '(?:AT_FDCWD|\\d+)(?:<(.*?)>)?, '
 const STRACE_DONE_RE = new RegExp(
   `^(\\d+)\\s+(${SYSCALLS})\\((?:${DIRFD})?${QUOTED}[^)]*\\)\\s*=\\s*-1\\s+(ENOENT|EACCES|EPERM)`,
 )
@@ -163,7 +163,7 @@ type Op = { chdir: string } | { lost: true } | { call: number }
 export function deniedCalls(text: string, cwd?: string, reads = false): DeniedCall[] {
   const pending = new Map<
     string,
-    { syscall: string; rawPath: string; read?: true; dirfd?: string }
+    { syscall: string; rawPath: string; read?: true; dirfd?: string; dir?: string }
   >()
   const out: DeniedCall[] = []
   const ops = new Map<string, Op[]>()
@@ -210,19 +210,22 @@ export function deniedCalls(text: string, cwd?: string, reads = false): DeniedCa
       continue
     }
     const done = STRACE_DONE_RE.exec(line)
-    if (done?.[2] !== undefined && done[3] !== undefined && done[4] !== undefined) {
-      denied(done[1]!, { syscall: done[2], rawPath: cStringPath(done[3]), errno: done[4] })
+    if (done?.[2] !== undefined && done[4] !== undefined && done[5] !== undefined) {
+      const rawPath = cStringPath(done[4])
+      denied(done[1]!, { syscall: done[2], rawPath, errno: done[5], ...within(done[3], rawPath) })
       continue
     }
     const unfinished = STRACE_UNFINISHED_RE.exec(line)
     if (
       unfinished?.[1] !== undefined &&
       unfinished[2] !== undefined &&
-      unfinished[3] !== undefined
+      unfinished[4] !== undefined
     ) {
+      const rawPath = cStringPath(unfinished[4])
       pending.set(unfinished[1], {
         syscall: unfinished[2],
-        rawPath: cStringPath(unfinished[3]),
+        rawPath,
+        ...within(unfinished[3], rawPath),
         ...(reads && OPEN_READ_UNFINISHED_RE.test(line) ? { read: true as const } : {}),
         ...(reads ? { dirfd: OPEN_READ_UNFINISHED_RE.exec(line)?.[2] ?? 'AT_FDCWD' } : {}),
       })
@@ -237,7 +240,12 @@ export function deniedCalls(text: string, cwd?: string, reads = false): DeniedCa
       // resume just retires the pending entry.
       const fd = held?.read === true ? RESUMED_FD_RE.exec(line) : null
       if (held !== undefined && resumed?.[3] !== undefined) {
-        denied(resumedOk[1], { syscall: held.syscall, rawPath: held.rawPath, errno: resumed[3] })
+        denied(resumedOk[1], {
+          syscall: held.syscall,
+          rawPath: held.rawPath,
+          errno: resumed[3],
+          ...(held.dir !== undefined ? { dir: held.dir } : {}),
+        })
       } else if (held !== undefined && fd !== null) {
         const at = readPath(held.dirfd ?? 'AT_FDCWD', held.rawPath, fd[1])
         if (at !== undefined) {
@@ -250,6 +258,12 @@ export function deniedCalls(text: string, cwd?: string, reads = false): DeniedCa
     // without the cwd tracking.
     follow(line)
   }
+  // `-y` names the directory a relative path was opened in: a denial
+  // through a descriptor (`openat(4</ws/p/sub>, "g")`) was placed in the
+  // cwd, naming a file the task never asked for.
+  function within(dir: string | undefined, rawPath: string): { dir?: string } {
+    return dir !== undefined && !rawPath.startsWith('/') ? { dir: cStringPath(dir) } : {}
+  }
   function follow(line: string): void {
     let m: RegExpExecArray | null
     if ((m = CHDIR_DENIED_RE.exec(line)) !== null) {
@@ -303,7 +317,7 @@ export function deniedCalls(text: string, cwd?: string, reads = false): DeniedCa
   }
   for (const [pid, list] of ops) {
     list.forEach((op, i) => {
-      if (!('call' in op)) return
+      if (!('call' in op) || out[op.call]!.dir !== undefined) return
       const dir = dirsOf(pid)[i]
       if (dir !== undefined && dir !== cwd) out[op.call]!.dir = dir
     })

package/src/graph/index.ts

@@ -11,6 +11,7 @@ export {
 export {
   type ContinueMode,
   deadServerBehind,
+  idleServers,
   type InputChanges,
   RestoreDemoted,
   runGraph,

package/src/graph/scheduler.ts

@@ -208,7 +208,7 @@ export interface ScheduleOptions {
    *   - 'deps-ok': a failed/skipped/aborted upstream skips its
    *     dependents; independent siblings keep running.
    *   - 'never': the first failure stops dispatch — in-flight tasks
-   *     finish naturally, everything not yet started completes as
+   *     finish their attempt but start no retry, everything not yet started completes as
    *     skipped (restore-tier included: a fail-fast run stops
    *     restoring too).
    *   - 'always': dependents run even when an upstream failed. Their
@@ -227,6 +227,11 @@ export interface ScheduleOptions {
    * 'never' it stops dispatch.
    */
   serverDied?: (id: string) => boolean
+  /**
+   * Called once, when 'never' stops dispatch: a task in flight then
+   * finishes its attempt but starts no retry.
+   */
+  onFailFast?: () => void
   execute: (node: TaskNode, upstream: TaskOutcome[]) => Promise<TaskOutcome>
   onStart?: (node: TaskNode) => void
   onFinish?: (outcome: TaskOutcome) => void
@@ -424,6 +429,11 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
   // dequeued task is skipped instead of dispatched (in-flight tasks
   // finish naturally and their dependents drain through the same path).
   let failFastTripped = false
+  const tripFailFast = (): void => {
+    if (failFastTripped) return
+    failFastTripped = true
+    options.onFailFast?.()
+  }
   const outcomes = new Map<string, TaskOutcome>()
 
   // Reverse adjacency + pending dep counts. Built once. A task becomes
@@ -588,7 +598,7 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
 
   return new Promise<Map<string, TaskOutcome>>((resolve) => {
     const finishOne = (id: string, outcome: TaskOutcome): void => {
-      if (continueMode === 'never' && outcome.status === 'failed') failFastTripped = true
+      if (continueMode === 'never' && outcome.status === 'failed') tripFailFast()
       outcomes.set(id, outcome)
       // A dormant server is asked again: the dispatch settles it once its
       // last dependant is in.
@@ -686,7 +696,7 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
     const willSkip = (id: string): boolean => {
       if (failFastTripped || aborted()) return true
       if (continueMode === 'never' && servers.some(serverDied)) {
-        failFastTripped = true
+        tripFailFast()
         return true
       }
       if (inRestoreTier(id)) return false
@@ -959,7 +969,7 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
 }
 
 /** Persistent tasks nobody asked for whose every dependant is a restore-tier hit. */
-function idleServers(
+export function idleServers(
   nodes: ReadonlyMap<string, TaskNode>,
   dependents: ReadonlyMap<string, string[]>,
   restoreTier: ReadonlySet<string> | undefined,

package/src/graph/task-graph.ts

@@ -3,6 +3,7 @@ import type { ProjectConfig, TaskConfig, WorkspaceRules } from '../config.js'
 import {
   asTrees,
   isLiteralPattern,
+  relPosix,
   splitNegations,
   staticPrefix,
   taskGlob,
@@ -872,7 +873,7 @@ function detectOutputCollisions(
   const entries: Entry[] = wsDeclarers.map((node) => ({ node, globs: wsFilesOf(node) ?? [] }))
   for (const bucket of byProject.values()) {
     for (const node of bucket) {
-      const rel = path.relative(workspaceRoot, node.projectDir).split(path.sep).join('/')
+      const rel = relPosix(workspaceRoot, node.projectDir)
       const globs = (filesOf(node) ?? []).map((g) => (rel === '' ? g : `${rel}/${g}`))
       entries.push({ node, globs, rel })
     }
@@ -1243,7 +1244,7 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
   if (!rootReaders) return
   if (workspaceRoot !== undefined) {
     for (const node of filesWriters) {
-      const rel = path.relative(workspaceRoot, node.projectDir).split(path.sep).join('/')
+      const rel = relPosix(workspaceRoot, node.projectDir)
       const globs = splitNegations(node.config.cache!.outputs.files).positive.map((g) =>
         rel === '' ? g : `${rel}/${g}`,
       )

package/src/index.ts

@@ -168,6 +168,9 @@ export type {
   DiscoverContext,
   NamedProject,
   PluginSetupContext,
+  PluginHookName,
+  PluginHookHandlers,
+  RunStartInfo,
 } from './orchestrator/index.js'
 // The per-task execution contract a plugin's `executor` capability returns.
 // (`runCommand` / `runSandboxed`, the local executor's own primitives, left
@@ -176,6 +179,12 @@ export type {
 // A remote executor gives a task back to the local floor by rejecting with
 // this (B-100): core runs it here and says why once.
 export { executorFallback } from './exec/index.js'
+// How the local executor puts the args after `--` on a command, for an
+// executor that runs `ExecuteRequest.command` itself: `@vzn/vx-reapi` and
+// the `vx init --plugin executor` example each joined their own, and a
+// trailing comment or a template literal's closing newline lost the args
+// there while the local floor kept them (X-112).
+export { withForwardArgs } from './exec/index.js'
 export type {
   ExecuteRequest,
   ExecuteResult,

package/src/orchestrator/affected-tasks.ts

@@ -105,16 +105,40 @@ export function affectedRoots(
     return (changes.paths.get(n.projectName) ?? []).some((rel) => declaresInput(cache, rel, null))
   }
   const reached = new Map<string, boolean>()
-  const reaches = (id: string): boolean => {
-    const known = reached.get(id)
-    if (known !== undefined) return known
-    // The graph is acyclic (the builder refuses a cycle); the mark only
-    // stops a diamond being walked twice.
-    reached.set(id, false)
-    const n = nodes.get(id)
-    const hit = n !== undefined && (seeded(n) || passesChanged(n) || n.deps.some(reaches))
-    reached.set(id, hit)
-    return hit
+  // Post-order on an explicit stack: a closure is as deep as the graph, and
+  // a recursion per edge threw `RangeError` on a chain the builder takes
+  // (item 737's 50,000; ~15,000 sufficed here). A frame holds the next dep
+  // to ask, -1 before the task itself is.
+  const reaches = (root: string): boolean => {
+    const stack: Array<[id: string, next: number]> = [[root, -1]]
+    while (stack.length > 0) {
+      const frame = stack[stack.length - 1]!
+      const id = frame[0]
+      if (frame[1] === -1) {
+        if (reached.has(id)) {
+          stack.pop()
+          continue
+        }
+        const n = nodes.get(id)
+        if (n === undefined || seeded(n) || passesChanged(n)) {
+          reached.set(id, n !== undefined)
+          stack.pop()
+          continue
+        }
+        frame[1] = 0
+      }
+      const deps = nodes.get(id)!.deps
+      let i = frame[1]
+      while (i < deps.length && reached.get(deps[i]!) === false) i++
+      frame[1] = i
+      if (i === deps.length || reached.get(deps[i]!) === true) {
+        reached.set(id, i < deps.length)
+        stack.pop()
+        continue
+      }
+      stack.push([deps[i]!, -1])
+    }
+    return reached.get(root)!
   }
   return ids.filter(reaches)
 }

package/src/orchestrator/doctor.ts

@@ -16,6 +16,7 @@ import {
   isUnsupportedBun,
   machineMemoryBytes,
   machineParallelism,
+  relPosix,
 } from '../util/index.js'
 import { VERSION } from '../version.js'
 import { probeSandbox, resetSandbox, untracedReason } from '../exec/index.js'
@@ -395,7 +396,7 @@ async function countLoadableTasks(
           ? bare.slice(where.length + 1).trimStart()
           : raw
         errors.push({
-          path: path.relative(root, where).split(path.sep).join('/'),
+          path: relPosix(root, where),
           message,
         })
       }

package/src/orchestrator/execute-task.ts

@@ -38,6 +38,7 @@ import {
   type TaskInputs,
   PersistentReadyError,
   sandboxReads,
+  maskCaptured,
 } from '../exec/index.js'
 import { isGroupTask, RestoreDemoted, type TaskNode, type TaskOutcome } from '../graph/index.js'
 import {
@@ -51,7 +52,7 @@ import {
   span,
   UserError,
 } from '../util/index.js'
-import { forwardedSignal, SIGNAL_SHUTDOWN_GRACE_MS } from './signals.js'
+import { forwardedSignal, SIGNAL_SHUTDOWN_GRACE_MS, terminateChildren } from './signals.js'
 import { executorLabel, nameExecutorFailure } from './plugin-host.js'
 import {
   mayWriteFingerprint,
@@ -133,6 +134,8 @@ export interface ExecuteArgs {
    * terms (item 962).
    */
   stopSignal?: AbortSignal
+  /** `continueMode: 'never'` stopped dispatch: no further attempt starts. */
+  failFast?: AbortSignal
   /**
    * Registry the orchestrator owns. For each persistent task we
    * spawn, we stash the subprocess handle here so the orchestrator
@@ -464,6 +467,11 @@ async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutcome> {
   try {
     await spawn.ready
   } catch (err) {
+    // A shell that exited before ready can leave its group running
+    // (`server & …; exit`): never registered, so no teardown reached it,
+    // and it held its port against the next `vx watch` cycle's server.
+    if (err instanceof PersistentReadyError && err.reason === 'exited')
+      await terminateChildren(() => [spawn.child])
     // A server the run's stop killed while it started is aborted, as any
     // task the stop kills (item 962): it read `failed (never ready:
     // exited, exit 130)` with a recap after every Ctrl-C (C-62). The stop
@@ -512,6 +520,10 @@ async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutcome> {
     // One the readiness timeout is killing reports the signal's, as an
     // ordinary timeout does (X-24).
     const ready = err instanceof PersistentReadyError ? err : undefined
+    // The timer's SIGKILL is a grace away and the shell may die on the
+    // TERM first: a server that ignores it held its port past run() into
+    // the next `vx watch` cycle. Return once the group is gone.
+    if (ready?.reason === 'timeout') await terminateChildren(() => [spawn.child])
     return {
       node,
       status: 'failed',
@@ -523,6 +535,20 @@ async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutcome> {
     }
   }
 
+  // Ready only once the stop had landed: a trap that prints the marker on
+  // the way down, or a race with the signal. The stop is killing it (it
+  // is in `liveChildren`), and it served nobody, as a one-shot that exits
+  // 0 on the stop is aborted (item 962).
+  if (isAborted(args.stopSignal)) {
+    return {
+      node,
+      status: 'aborted',
+      exitCode: signalExitCode(forwardedSignal(args.stopSignal!.reason)),
+      durationMs: spawn.readyMs(),
+      wallclockStartNs,
+      wallclockEndNs: process.hrtime.bigint() - args.runStartHrTimeNs,
+    }
+  }
   args.persistentRegistry?.set(node.id, spawn.child)
   forgetUndeclaredWrites(args, undeclaredWriteReach(node, args.workspaceRoot))
   if (mayWriteFingerprint(node, args.workspaceRoot)) args.fingerprintWatch?.wrote()
@@ -903,7 +929,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       // re-create would stay in a same-project consumer's input set, keeping
       // that consumer's key unchanged while the file is gone from disk.
       const endClean = span('miss: clean outputs')
-      const cleanedRels = await cleanOutputs({ ...cleanArgs, keepGlobRoots: true })
+      const cleanedRels = await cleanOutputs(cleanArgs)
       endClean()
       args.gitFilesCache?.noteClean(node.id, node.projectDir, cleanedRels)
       args.gitFilesCache?.markOutputsChanged(node.projectDir, cleanedRels)
@@ -977,7 +1003,11 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       })
     endExec()
     if (secrets !== null)
-      res = { ...res, stdout: secrets.mask(res.stdout), stderr: secrets.mask(res.stderr) }
+      res = {
+        ...res,
+        stdout: maskCaptured(res.stdout, secrets),
+        stderr: maskCaptured(res.stderr, secrets),
+      }
     // An executor that stopped on the timeout's abort exits non-zero; say
     // why, so the frame, the retry line and `timedOut` read as a timeout.
     if (timeoutFired && res.exitCode !== 0 && res.timedOut !== true) {
@@ -1040,8 +1070,9 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     // 258) — and an exit above 128 is a signal's number and nothing
     // about what sent it (259). One frame line names the rule. A spawn that
     // threw ran no shell: its 127 is vx's, and the line would send the
-    // reader after a command that exists (A-41).
-    if (!res.timedOut && res.spawnFailed !== true) {
+    // reader after a command that exists (A-41). A run's stop killed it
+    // itself: the SIGKILL past the grace read as the OOM killer's.
+    if (!res.timedOut && res.spawnFailed !== true && args.stopSignal?.aborted !== true) {
       const verdict = shellVerdict({
         code,
         command: step.command,
@@ -1058,7 +1089,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       // no edge to the producer fails naming only the file (A-48).
       if (code !== 0) {
         for (const c of (args.gitFilesCache?.trackedCleansMissing(node.id) ?? []).slice(0, 3)) {
-          const rel = path.relative(args.workspaceRoot, c.path).split(path.sep).join('/')
+          const rel = relPosix(args.workspaceRoot, c.path)
           log.taskStderr(
             node,
             `\n[vx] ${rel} is tracked by git, and ${c.by} removed it as an output before its run; it is still missing. A task that reads it needs dependsOn on ${c.by}.\n`,
@@ -1153,7 +1184,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       }
     }
 
-    if (effectiveExitCode === 0 || attempt >= maxAttempts) break
+    if (effectiveExitCode === 0 || attempt >= maxAttempts || args.failFast?.aborted === true) break
     failedAttempts.push({
       endedAt: Date.now(),
       exitCode: effectiveExitCode,
@@ -1192,7 +1223,6 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
             },
           }
         : {}),
-      signal: requestSignal(),
       ...(effectiveTimeout !== undefined ? { timeoutMs: effectiveTimeout } : {}),
       ...(inputs !== undefined ? { inputs } : {}),
       ...(cfgCacheable ? { cacheKey: hash } : {}),
@@ -1204,7 +1234,10 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       outputs: { files: outputs, workspaceFiles: wsOutputs },
       ...(args.terminal === true ? { terminal: true as const } : {}),
     }
-    if (!userSandbox) return base
+    // The signal last: it arms `exec.timeout`, and the sandbox's arming
+    // below is vx's work, not the task's. Armed first, a 60 ms timeout
+    // expired before the spawn and failed `echo` as timed out, unrun.
+    if (!userSandbox) return { ...base, signal: requestSignal() }
     await args.armSandbox?.()
     const sb = await sandboxRequestFor(
       node,
@@ -1216,7 +1249,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     )
     placeholders = sb.placeholders
     withheld = sb.withheld
-    return { ...base, sandbox: sb.sandbox }
+    return { ...base, sandbox: sb.sandbox, signal: requestSignal() }
   }
 
   const wallclockEndNs = process.hrtime.bigint() - args.runStartHrTimeNs

package/src/orchestrator/hit-restore.ts

@@ -8,7 +8,6 @@
 // which bytes a green run replays. Moved out of execute-task.ts
 // 2026-09-10 as pure code motion, the mirror of miss-save.ts.
 
-import path from 'node:path'
 import type { CacheConfig } from '../config.js'
 import {
   type CacheEntry,
@@ -22,6 +21,7 @@ import {
 import type { TaskOutcome } from '../graph/index.js'
 import {
   asTrees,
+  relPosix,
   secretMask,
   span,
   splitNegations,
@@ -165,10 +165,10 @@ export async function restoreHit(restore: RestoreHitArgs): Promise<TaskOutcome>
         const expectedRels = new Set(projExpected.map((e) => e.path))
         const expectedWsRels = new Set(wsExpected.map((e) => e.path))
         const actualRels = actualAbs
-          .map((p) => path.relative(node.projectDir, p).split(path.sep).join('/'))
+          .map((p) => relPosix(node.projectDir, p))
           .filter((rel) => expectedRels.has(rel) || !isAddition(rel))
         const actualWsRels = actualWsAbs
-          .map((p) => path.relative(args.workspaceRoot, p).split(path.sep).join('/'))
+          .map((p) => relPosix(args.workspaceRoot, p))
           .filter((rel) => expectedWsRels.has(rel) || !isAddition(rel))
         const rowsPresent = (
           actual: readonly string[],
@@ -223,11 +223,15 @@ export async function restoreHit(restore: RestoreHitArgs): Promise<TaskOutcome>
     let cleanedWsRels: string[] = []
     if (additive) {
       cleanedRels = hit.outputFiles.filter((p) => !p.startsWith(WORKSPACE_OUTPUT_PREFIX))
-      await cleanOutputPaths({ projectDir: node.projectDir, rels: cleanedRels })
+      await cleanOutputPaths({ projectDir: node.projectDir, rels: cleanedRels, outputs })
       cleanedWsRels = hit.outputFiles
         .filter((p) => p.startsWith(WORKSPACE_OUTPUT_PREFIX))
         .map((p) => p.slice(WORKSPACE_OUTPUT_PREFIX.length))
-      await cleanOutputPaths({ projectDir: args.workspaceRoot, rels: cleanedWsRels })
+      await cleanOutputPaths({
+        projectDir: args.workspaceRoot,
+        rels: cleanedWsRels,
+        outputs: wsOutputs,
+      })
     } else {
       if (outputs.length > 0) cleanedRels = await cleanOutputs(cleanArgs)
       if (wsOutputs.length > 0) cleanedWsRels = await cleanWorkspaceOutputs(wsCleanArgs)

package/src/orchestrator/index.ts

@@ -43,6 +43,7 @@ export type {
   EventBus,
   RunEvent,
   RunEventSubscriber,
+  RunStartInfo,
   WireEvent,
   TaskView,
   OutcomeView,

package/src/orchestrator/local-shortcircuit.ts

@@ -194,7 +194,10 @@ export async function startLocalShortCircuit(args: ShortCircuitArgs): Promise<Sh
  * task's key, which is preliminary, so it cannot restore early either.
  * Cost: one pass over the nodes, no filesystem.
  */
-function restoreTierExclusions(nodes: Map<string, TaskNode>, workspaceRoot: string): Set<string> {
+export function restoreTierExclusions(
+  nodes: Map<string, TaskNode>,
+  workspaceRoot: string,
+): Set<string> {
   const prefixes: string[] = []
   let everything = false
   for (const node of nodes.values()) {

package/src/orchestrator/lockfile-claim.ts

@@ -9,13 +9,13 @@
 //
 // The digests are memoised on disk under the cache dir by the file's
 // xxh3, so a warm run pays one read + hash + a small JSON read, never a
-// parse; within one process (a run, a watch cycle) the file's size and
-// mtime gate even the read; and per run the read happens once (a WeakMap
+// parse; within one process (a run, a watch cycle) the file's size,
+// mtime, ctime and inode gate even the read; and per run the read happens once (a WeakMap
 // on the context core hands every `key` call of a run).
 
 import path from 'node:path'
 import { rename, stat } from 'node:fs/promises'
-import { xxh3, xxh3hex } from '../util/index.js'
+import { relPosix, xxh3, xxh3hex } from '../util/index.js'
 import type { TaskNode } from '../graph/index.js'
 import type {
   FingerprintChange,
@@ -87,18 +87,33 @@ async function hashExtra(workspaceRoot: string, rel: string): Promise<string> {
   }
 }
 
-async function statsOf(
+/**
+ * A file's identity for the in-process gate, as `Cache.hashFile`'s memo
+ * keys one: size and mtime alone kept the digests of a lockfile or patch
+ * replaced by another of the same size with its mtime kept (`cp -p`,
+ * `tar -x`), and no task sets a ctime.
+ */
+function identityOf(st: { size: number; mtimeMs: number; ctimeMs: number; ino: number }): string {
+  return `${st.size}:${st.mtimeMs}:${st.ctimeMs}:${st.ino}`
+}
+
+async function statsOf(workspaceRoot: string, rels: readonly string[]): Promise<string[]> {
+  return Promise.all(
+    rels.map((rel) => stat(path.join(workspaceRoot, rel)).then(identityOf, () => 'gone')),
+  )
+}
+
+/** Each file's identity, taken BEFORE its hash, so a write between the two re-reads it. */
+async function hashExtras(
   workspaceRoot: string,
   rels: readonly string[],
-): Promise<Array<{ size: number; mtimeMs: number }>> {
-  return Promise.all(
-    rels.map((rel) =>
-      stat(path.join(workspaceRoot, rel)).then(
-        (st) => ({ size: st.size, mtimeMs: st.mtimeMs }),
-        () => ({ size: -1, mtimeMs: -1 }),
-      ),
-    ),
+): Promise<{ hashes: Record<string, string>; stats: Record<string, string> }> {
+  const ids = await statsOf(workspaceRoot, rels)
+  const stats = Object.fromEntries(rels.map((rel, i) => [rel, ids[i]!] as const))
+  const hashes = Object.fromEntries(
+    await Promise.all(rels.map(async (rel) => [rel, await hashExtra(workspaceRoot, rel)] as const)),
   )
+  return { hashes, stats }
 }
 
 export function lockfileClaim(options: LockfileClaimOptions): LockfileClaimHooks {
@@ -108,15 +123,14 @@ export function lockfileClaim(options: LockfileClaimOptions): LockfileClaimHooks
   if (scope !== 'project' && scope !== 'workspace') {
     throw new Error(`scope must be 'project' or 'workspace', not ${JSON.stringify(scope)}`)
   }
-  // Per workspace root: what the last read saw. `size` + `mtimeMs` gate a
-  // re-read; the content hash decides whether the digests are current.
+  // Per workspace root: what the last read saw. Each file's identity gates
+  // a re-read; the content hash decides whether the digests are current.
   const seen = new Map<
     string,
     {
-      size: number
-      mtimeMs: number
+      identity: string
       extras: readonly string[]
-      extraStats: ReadonlyArray<{ size: number; mtimeMs: number }>
+      extraStats: Readonly<Record<string, string>>
       digests: Digests
     }
   >()
@@ -125,23 +139,18 @@ export function lockfileClaim(options: LockfileClaimOptions): LockfileClaimHooks
 
   const load = async (workspaceRoot: string, cacheDir: string): Promise<Digests> => {
     const full = path.join(workspaceRoot, file)
-    let st: { size: number; mtimeMs: number }
+    let identity: string
     try {
-      st = await stat(full)
+      identity = identityOf(await stat(full))
     } catch {
       const digests: Digests = { lock: '', importers: new Map() }
-      seen.set(workspaceRoot, { size: -1, mtimeMs: -1, extras: [], extraStats: [], digests })
+      seen.set(workspaceRoot, { identity: 'gone', extras: [], extraStats: {}, digests })
       return digests
     }
     const last = seen.get(workspaceRoot)
-    if (last !== undefined && last.size === st.size && last.mtimeMs === st.mtimeMs) {
+    if (last !== undefined && last.identity === identity) {
       const now = await statsOf(workspaceRoot, last.extras)
-      if (
-        now.every(
-          (s, i) =>
-            s.size === last.extraStats[i]!.size && s.mtimeMs === last.extraStats[i]!.mtimeMs,
-        )
-      ) {
+      if (now.every((s, i) => s === last.extraStats[last.extras[i]!])) {
         return last.digests
       }
     }
@@ -152,28 +161,22 @@ export function lockfileClaim(options: LockfileClaimOptions): LockfileClaimHooks
     // re-hashes the files the memo names and never parses to learn them.
     const memo = await readMemo(memoFile, version, lockHash)
     let extras: Record<string, string> = {}
+    let extraStats: Record<string, string> = {}
     let importers: ReadonlyMap<string, string> | undefined
     if (memo !== undefined) {
-      const now = Object.fromEntries(
-        await Promise.all(
-          Object.keys(memo.extras).map(
-            async (rel) => [rel, await hashExtra(workspaceRoot, rel)] as const,
-          ),
-        ),
-      )
-      if (Object.entries(memo.extras).every(([rel, h]) => now[rel] === h)) {
+      const now = await hashExtras(workspaceRoot, Object.keys(memo.extras))
+      if (Object.entries(memo.extras).every(([rel, h]) => now.hashes[rel] === h)) {
         extras = memo.extras
+        extraStats = now.stats
         importers = memo.importers
       }
     }
     if (importers === undefined) {
       const text = decode(bytes)
       const rels = [...new Set(options.extraFiles?.(text) ?? [])].sort()
-      extras = Object.fromEntries(
-        await Promise.all(
-          rels.map(async (rel) => [rel, await hashExtra(workspaceRoot, rel)] as const),
-        ),
-      )
+      const now = await hashExtras(workspaceRoot, rels)
+      extras = now.hashes
+      extraStats = now.stats
       importers =
         scope === 'workspace'
           ? new Map<string, string>()
@@ -191,13 +194,7 @@ export function lockfileClaim(options: LockfileClaimOptions): LockfileClaimHooks
         ? lockHash
         : xxh3hex([lockHash, ...rels.map((r) => `${r}\0${extras[r]}`)].join('\0'))
     const digests: Digests = { lock, importers }
-    seen.set(workspaceRoot, {
-      size: st.size,
-      mtimeMs: st.mtimeMs,
-      extras: rels,
-      extraStats: await statsOf(workspaceRoot, rels),
-      digests,
-    })
+    seen.set(workspaceRoot, { identity, extras: rels, extraStats, digests })
     return digests
   }
   const loadOnce = (ctx: KeyHookContext): Promise<Digests> => {
@@ -270,8 +267,7 @@ function digestFor(importers: ReadonlyMap<string, string>, importer: string): st
 
 /** The lockfile's importer path for a project directory: `.` for the root, POSIX otherwise. */
 function importerOf(workspaceRoot: string, projectDir: string): string {
-  const rel = path.relative(workspaceRoot, projectDir)
-  return rel === '' ? '.' : rel.split(path.sep).join('/')
+  return relPosix(workspaceRoot, projectDir) || '.'
 }
 
 async function readMemo(