@vzn/vx 0.0.594 → 0.0.596

package/src/cache/chained-cache.ts

@@ -4,7 +4,8 @@
 // once. Restore goes to the layer that produced the hit — remembered per
 // hash — because an entry's artifact lives wherever it was found.
 //
-// A layer that throws in a lookup is a miss there and the walk goes on; one
+// A layer that throws in a lookup (a batch row load or a has-many included)
+// is a miss there and the walk goes on; a throwing drain is passed; one
 // that throws in a save is skipped and the rest still save. Unisolated, a
 // plugin layer's throw ended the walk before the local floor under it: its
 // `get` failed the task, its `save` kept the entry from every later layer
@@ -122,14 +123,22 @@ export class ChainedCache implements CacheLayer {
       const found = await this.ask(
         layer,
         'remoteHasMany',
-        async () => (await layer.remoteHasMany?.(hashes)) ?? null,
+        // The shape check and the mark sit inside the ask: a layer that
+        // answers a non-Set or throws marking gave no answer.
+        async () => {
+          const got: unknown = (await layer.remoteHasMany?.(hashes)) ?? null
+          if (got === null) return null
+          if (!(got instanceof Set)) throw new TypeError('remoteHasMany answered a non-Set')
+          const set = got as Set<string>
+          layer.markRemoteAbsent?.(hashes.filter((h) => !set.has(h)))
+          return set
+        },
         null,
       )
       if (found === null) {
         complete = false
         continue
       }
-      layer.markRemoteAbsent?.(hashes.filter((h) => !found.has(h)))
       out ??= new Set()
       for (const h of found) out.add(h)
     }
@@ -142,15 +151,24 @@ export class ChainedCache implements CacheLayer {
   }
 
   async drainUploads(): Promise<void> {
-    await Promise.all(this.layers.map((l) => l.drainUploads?.()))
+    await Promise.all(
+      this.layers.map((l) =>
+        this.ask(l, 'drainUploads', async () => l.drainUploads?.(), undefined),
+      ),
+    )
   }
 
   loadOutputFilesBatch(hashes: readonly string[]): Map<string, OutputFileRow[]> {
     const out = new Map<string, OutputFileRow[]>()
-    for (const layer of this.layers) {
-      for (const [h, rows] of layer.loadOutputFilesBatch(hashes)) {
-        if (!out.has(h)) out.set(h, rows)
+    for (const [i, layer] of this.layers.entries()) {
+      let rows: Map<string, OutputFileRow[]>
+      try {
+        rows = layer.loadOutputFilesBatch(hashes)
+      } catch (err) {
+        this.onLayerError(i, 'loadOutputFilesBatch', err)
+        continue
       }
+      for (const [h, r] of rows) if (!out.has(h)) out.set(h, r)
     }
     return out
   }

package/src/cache/config-evals.ts

@@ -6,6 +6,9 @@
 import type { Database, SQLQueryBindings } from 'bun:sqlite'
 import { lazyStatement } from './schema.js'
 
+const CONFIG_EVALS_SWEPT_AT = 'config_evals_swept_at'
+const DAY_MS = 24 * 60 * 60 * 1000
+
 export class ConfigEvalTable {
   private readonly selectConfigEval: ReturnType<Database['prepare']>
   private readonly insertConfigEval: ReturnType<Database['prepare']>
@@ -106,10 +109,22 @@ export class ConfigEvalTable {
   /**
    * Retention: a row not WRITTEN since `cutoff`. A hit does not refresh it
    * (that would be a write per config on every warm run), so a config that
-   * hit for thirty days is evaluated once more and stored again.
+   * hit for thirty days is evaluated once more and stored again. No index
+   * covers `created_at`, so each sweep reads every row with its JSON (1–6 ms
+   * at 8,000 rows, 2 MB); it runs once a day, on its own clock in
+   * `schema_meta`, as the file-hash sweep does.
    */
-  pruneOlderThan(cutoff: number): void {
-    this.db.prepare('DELETE FROM config_evals WHERE created_at < ?').run(cutoff)
-    this.db.prepare('DELETE FROM config_closures WHERE created_at < ?').run(cutoff)
+  pruneOlderThan(cutoff: number, now: number = Date.now()): void {
+    const last = this.db
+      .prepare('SELECT value FROM schema_meta WHERE key = ?')
+      .get(CONFIG_EVALS_SWEPT_AT) as { value: string } | null
+    if (last !== null && now - Number(last.value) < DAY_MS) return
+    this.db.transaction(() => {
+      this.db.prepare('DELETE FROM config_evals WHERE created_at < ?').run(cutoff)
+      this.db.prepare('DELETE FROM config_closures WHERE created_at < ?').run(cutoff)
+      this.db
+        .prepare('INSERT OR REPLACE INTO schema_meta(key, value) VALUES (?, ?)')
+        .run(CONFIG_EVALS_SWEPT_AT, String(now))
+    })()
   }
 }

package/src/cache/git-inputs.ts

@@ -1304,8 +1304,11 @@ export async function startGitEnumeration(
   const facts = repoFacts(workspaceRoot)
   // The blob-size check's verdict is a function of the index's entries, so
   // the index file's bytes key it: one read, where `ls-files --debug` and a
-  // lookup per entry cost 550 ms at 100,000 files (A-60).
-  const pathspecKey = xxh3hex(pathspecs.join('\0'))
+  // lookup per entry cost 550 ms at 100,000 files (A-60). The verdict's
+  // paths are workspace-relative, so the repo→workspace prefix keys it too:
+  // a nested workspace sharing the cache read the outer one's verdict and
+  // trusted a resized blob.
+  const pathspecKey = xxh3hex([facts?.prefix ?? '', ...pathspecs].join('\0'))
   const indexFile =
     facts === null || facts.indexFile === ''
       ? undefined
@@ -1521,9 +1524,10 @@ export async function applyGitEnumeration(
   // Sort once, then each project's files are a contiguous range found
   // by binary search on its `dir/` prefix — O((F+P) log F) instead of
   // the O(P·F) per-project startsWith scan (54 ms at 1090 projects ×
-  // ~9k files; ~5 ms this way). '/' sorts below most filename chars,
-  // so the range [prefix, prefix+'\xff…') is contiguous in the sorted
-  // array; lowerBound on `prefix` and on `prefix + '￿'` bracket it.
+  // ~9k files; ~5 ms this way). Every path under `dir/` sorts in
+  // [`dir/`, `dir0`): '0' is the code unit after '/'. An upper bound of
+  // `dir/` + U+FFFF left out a file whose name starts with U+FFFF, and
+  // it never entered the key.
   // Git lists in order; a list that already is skips the sort.
   let inOrder = true
   for (let i = 1; i < all.length; i++) {
@@ -1557,10 +1561,15 @@ export async function applyGitEnumeration(
     return lo
   }
   for (const projectDir of projectDirs) {
-    const relPrefix =
+    const spelled =
       base !== undefined && projectDir.startsWith(base) && path.normalize(projectDir) === projectDir
         ? projectDir.slice(base.length).replace(/\/$/, '')
         : relPosix(workspaceRoot, projectDir)
+    // macOS git reports paths NFC (core.precomposeunicode) while a dir
+    // discovered by readdir keeps the spelling it was created with: match
+    // NFC, and key the OIDs by the project's spelling, which is how
+    // `resolveFiles` looks them up.
+    const relPrefix = spelled.normalize('NFC')
     if (relPrefix === '' || relPrefix === '.') {
       cache.set(projectDir, all)
       const rootOids = new Map<string, string>()
@@ -1570,14 +1579,16 @@ export async function applyGitEnumeration(
     }
     const prefix = `${relPrefix}/`
     const start = lowerBound(prefix)
-    const end = lowerBound(`${prefix}￿`)
+    const end = lowerBound(`${relPrefix}0`)
     const matches: string[] = []
     const projOids = new Map<string, string>()
+    const projAbs =
+      relPrefix === spelled ? abs : (rel: string) => path.join(projectDir, rel.slice(prefix.length))
     for (let i = start; i < end; i++) {
       const rel = sorted[i]!
       matches.push(rel.slice(prefix.length))
       const oid = trusted.get(rel)
-      if (oid !== undefined) projOids.set(abs(rel), oid)
+      if (oid !== undefined) projOids.set(projAbs(rel), oid)
     }
     // An empty slice is a directory git did not see, not an empty project:
     // a project has at least its package.json, tracked or untracked. A

package/src/cache/index.ts

@@ -11,6 +11,7 @@ export {
   type CacheKeyInput,
   type CacheLayer,
   type CachePolicy,
+  cachesNothing,
   EXECUTED_RUNS_SQL,
   FULL_CACHE_POLICY,
   type InvocationRecord,

package/src/cache/inputs.ts

@@ -109,10 +109,10 @@ export interface ResolveInputsArgs {
   envSource: NodeJS.ProcessEnv
   inputs: CacheInputs | undefined
   /** Project-relative output globs to exclude from inputs. */
-  ownOutputs: string[]
+  ownOutputs: readonly string[]
   /** Root-relative `outputs.workspaceFiles` globs to exclude from
    *  `inputs.workspaceFiles` (a task cannot invalidate itself). */
-  ownWorkspaceOutputs?: string[]
+  ownWorkspaceOutputs?: readonly string[]
   /** Absolute dirs of nested projects (cross-boundary isolation). */
   nestedProjectDirs: string[]
   /**
@@ -182,11 +182,14 @@ export type ProjectFilesCache = Map<
 >
 
 export async function resolveInputs(args: ResolveInputsArgs): Promise<ResolvedInputs> {
+  const projectRel = path.relative(args.workspaceRoot, args.projectDir).split(path.sep).join('/')
   const { files: projectFiles, listing } = await resolveFiles({
     projectDir: args.projectDir,
     workspaceRoot: args.workspaceRoot,
     files: args.inputs?.files,
     ownOutputs: args.ownOutputs,
+    ownWorkspaceOutputs: args.ownWorkspaceOutputs ?? [],
+    projectRel,
     nestedProjectDirs: args.nestedProjectDirs,
     ...(args.gitFilesCache !== undefined ? { gitFilesCache: args.gitFilesCache } : {}),
     ...(args.projectFilesCache !== undefined ? { projectFilesCache: args.projectFilesCache } : {}),
@@ -199,6 +202,8 @@ export async function resolveInputs(args: ResolveInputsArgs): Promise<ResolvedIn
       workspaceRoot: args.workspaceRoot,
       workspaceFiles: wsDecl,
       ownWorkspaceOutputs: args.ownWorkspaceOutputs ?? [],
+      ownOutputs: args.ownOutputs,
+      projectRel,
       ...(args.gitFilesCache !== undefined ? { gitFilesCache: args.gitFilesCache } : {}),
       ...(args.workspaceFilesCache !== undefined ? { memo: args.workspaceFilesCache } : {}),
     })
@@ -258,6 +263,9 @@ function resolveWorkspaceFiles(args: {
   workspaceRoot: string
   workspaceFiles: readonly string[]
   ownWorkspaceOutputs: readonly string[]
+  /** The task's project-relative `outputs.files`, and its project's root-relative directory. */
+  ownOutputs: readonly string[]
+  projectRel: string
   gitFilesCache?: GitFilesCache
   memo?: WorkspaceFilesCache
 }): { files: Promise<string[]>; listing: InputListing } | undefined {
@@ -274,6 +282,11 @@ function resolveWorkspaceFiles(args: {
   // A path the task's own outputs take back with `!` is no output, so it
   // stays an input (A-44).
   const ownOutput = outputMatcher(args.ownWorkspaceOutputs)
+  // Its project outputs too, which a root-anchored glob can reach as well:
+  // left in, the task's own build moved its key, and no run was ever saved.
+  let ownProjectOutput: ((rel: string) => boolean) | undefined
+  const ownProject = (rel: string): boolean =>
+    (ownProjectOutput ??= underProject(args.projectRel, outputMatcher(args.ownOutputs)))(rel)
   const positiveGlobs = asTrees(positive).map(globFor)
   // Workspace-wide partition, keyed by the workspace root. Populated
   // up-front by `populateGitFilesCache(..., workspaceWide: true)` when
@@ -293,9 +306,15 @@ function resolveWorkspaceFiles(args: {
   const memoKey =
     args.memo === undefined
       ? undefined
-      : JSON.stringify([positive, negative, args.ownWorkspaceOutputs])
+      : JSON.stringify([
+          positive,
+          negative,
+          args.ownWorkspaceOutputs,
+          args.ownOutputs,
+          args.projectRel,
+        ])
   let isPositive: ((rel: string) => boolean) | undefined
-  const excluded = (rel: string): boolean => isExcluded(rel) || ownOutput(rel)
+  const excluded = (rel: string): boolean => isExcluded(rel) || ownOutput(rel) || ownProject(rel)
   const listing: InputListing = {
     root: args.workspaceRoot,
     listed: gitFiles,
@@ -352,6 +371,24 @@ async function resolveWorkspaceFilesOver(
   return candidates.filter((abs) => oids?.has(abs) === true || isInputOnDisk(abs)).sort()
 }
 
+/** A project-relative matcher asked of root-relative paths: false outside the project. */
+function underProject(
+  projectRel: string,
+  matches: (rel: string) => boolean,
+): (rel: string) => boolean {
+  if (projectRel === '') return matches
+  const prefix = `${projectRel}/`
+  return (rel) => rel.startsWith(prefix) && matches(rel.slice(prefix.length))
+}
+
+/** A root-relative matcher asked of project-relative paths. */
+function inProject(
+  projectRel: string,
+  matches: (rel: string) => boolean,
+): (rel: string) => boolean {
+  return projectRel === '' ? matches : (rel) => matches(`${projectRel}/${rel}`)
+}
+
 /** Anything at the path — file, directory, symlink to anything or to nothing. */
 function existsOnDisk(abs: string): boolean {
   try {
@@ -609,7 +646,7 @@ function outputExcludes(outputs: readonly string[]): Bun.Glob[] {
 /** Resolve declared output globs (project-relative) to actual produced files. */
 export async function resolveOutputs(args: {
   projectDir: string
-  outputs: string[]
+  outputs: readonly string[]
   nestedProjectDirs: string[]
 }): Promise<string[]> {
   const { positive, negative } = splitNegations(args.outputs)
@@ -710,27 +747,15 @@ function isInside(dir: string, abs: string): boolean {
  */
 export async function cleanOutputs(args: {
   projectDir: string
-  outputs: string[]
+  outputs: readonly string[]
   nestedProjectDirs: string[]
-  /**
-   * Before a miss: keep the directory each wildcard glob is rooted at
-   * (`dist` for `dist/**`). The task writes its matches under it, so a
-   * remove there bought only an rmdir and the task's mkdir: 0.4 ms of a
-   * 4.9 ms one-file miss (B-49). A restore prunes it, since the entry's
-   * shape decides there.
-   */
-  keepGlobRoots?: boolean
 }): Promise<string[]> {
   const files = await resolveOutputs(args)
   // `force: true` makes rm tolerate ENOENT (e.g. when two output
   // globs overlap and a sibling already deleted a path mid-iteration).
   // A symlink is unlinked, never followed.
   const removed = await removeAll(files, args.projectDir)
-  await pruneEmptiedDirs(
-    args.projectDir,
-    removed,
-    args.keepGlobRoots === true ? globRoots(args.projectDir, args.outputs) : undefined,
-  )
+  await pruneEmptiedDirs(args.projectDir, removed, pruneScope(args.projectDir, args.outputs))
   // Project-relative posix paths of what was removed — the caller
   // feeds these to GitFilesCache.markOutputsChanged after a restore.
   return files.map((f) => relPosix(args.projectDir, f))
@@ -740,15 +765,20 @@ export async function cleanOutputs(args: {
  * Remove exactly these project-relative paths — the recorded rows of an
  * ADDITIVE task's own artifact (item 588), never a glob: the glob would
  * take the upstream's files the task adds beside. Emptied directories are
- * pruned as `cleanOutputs` prunes them, and stop at one the upstream still
- * fills.
+ * pruned as `cleanOutputs` prunes them, only inside the declared `outputs`
+ * (`pruneScope`), and stop at one the upstream still fills.
  */
 export async function cleanOutputPaths(args: {
   projectDir: string
   rels: readonly string[]
+  outputs: readonly string[]
 }): Promise<void> {
   const files = args.rels.map((r) => path.resolve(args.projectDir, r))
-  await pruneEmptiedDirs(args.projectDir, await removeAll(files, args.projectDir))
+  await pruneEmptiedDirs(
+    args.projectDir,
+    await removeAll(files, args.projectDir),
+    pruneScope(args.projectDir, args.outputs),
+  )
 }
 
 /**
@@ -771,7 +801,7 @@ export interface OutputStamp {
  */
 export async function stampOutputs(args: {
   projectDir: string
-  outputs: string[]
+  outputs: readonly string[]
   nestedProjectDirs: string[]
 }): Promise<Map<string, OutputStamp>> {
   return stampFiles(await resolveOutputs(args))
@@ -780,7 +810,7 @@ export async function stampOutputs(args: {
 /** `stampOutputs` for root-anchored `cache.outputs.workspaceFiles` (A-43). */
 export async function stampWorkspaceOutputs(args: {
   workspaceRoot: string
-  outputs: string[]
+  outputs: readonly string[]
 }): Promise<Map<string, OutputStamp>> {
   return stampFiles(await resolveWorkspaceOutputs(args))
 }
@@ -811,7 +841,7 @@ function stampFiles(files: readonly string[]): Map<string, OutputStamp> {
  * file back, so no entry reproduces that run and none is saved.
  */
 export async function ownOutputsSince(
-  args: { projectDir: string; outputs: string[]; nestedProjectDirs: string[] },
+  args: { projectDir: string; outputs: readonly string[]; nestedProjectDirs: string[] },
   before: ReadonlyMap<string, OutputStamp>,
 ): Promise<string[] | undefined> {
   return changedSince(await resolveOutputs(args), before)
@@ -819,7 +849,7 @@ export async function ownOutputsSince(
 
 /** `ownOutputsSince` for root-anchored `cache.outputs.workspaceFiles` (A-43). */
 export async function ownWorkspaceOutputsSince(
-  args: { workspaceRoot: string; outputs: string[] },
+  args: { workspaceRoot: string; outputs: readonly string[] },
   before: ReadonlyMap<string, OutputStamp>,
 ): Promise<string[] | undefined> {
   return changedSince(await resolveWorkspaceOutputs(args), before)
@@ -914,7 +944,10 @@ function notThroughLink(files: readonly string[], root: string): string[] {
       return null
     }
   }
-  const realRoot = real(root) ?? root
+  // Resolved only once a directory exists to compare: after a clean pruned
+  // the outputs (the common restore) nothing does, and the call was most
+  // of an empty clean.
+  let realRoot: string | undefined
   const own = new Map<string, boolean>()
   return files.filter((f) => {
     const dir = path.dirname(f)
@@ -923,7 +956,8 @@ function notThroughLink(files: readonly string[], root: string): string[] {
       // A directory already gone has nothing to delete through; its path
       // stays so the prune still reaches the parents it emptied.
       const r = real(dir)
-      ok = r === null || r === path.join(realRoot, path.relative(root, dir))
+      ok =
+        r === null || r === path.join((realRoot ??= real(root) ?? root), path.relative(root, dir))
       own.set(dir, ok)
     }
     return ok
@@ -937,12 +971,13 @@ function notThroughLink(files: readonly string[], root: string): string[] {
  * wrote `dist/out/…` and now writes `dist/out`) blocks the rename, and an
  * empty directory is not an output anyone declared. A directory that still
  * holds something — a stray the globs do not cover — stays, and the restore
- * says so if it is in the way.
+ * says so if it is in the way. With a `scope`, only a directory inside it
+ * goes (`pruneScope`).
  */
 async function pruneEmptiedDirs(
   root: string,
   removed: readonly string[],
-  keep?: ReadonlySet<string>,
+  scope?: PruneScope,
 ): Promise<void> {
   const rootResolved = path.resolve(root)
   // LEVEL ORDER, not a walk-up per directory. A parent is attempted only
@@ -960,7 +995,9 @@ async function pruneEmptiedDirs(
     const parents = new Set<string>()
     const dirs = [...level].filter(
       (dir) =>
-        dir !== rootResolved && dir.startsWith(rootResolved + path.sep) && keep?.has(dir) !== true,
+        dir !== rootResolved &&
+        dir.startsWith(rootResolved + path.sep) &&
+        (scope === undefined || inScope(dir, scope)),
     )
     const gone = (err: NodeJS.ErrnoException): boolean => err.code === 'ENOENT'
     if (dirs.length <= SYNC_CLEAN_MAX) {
@@ -983,19 +1020,42 @@ async function pruneEmptiedDirs(
   }
 }
 
+interface PruneScope {
+  /** Wildcard globs' roots (`dist` for `dist/**`): prune strictly below. */
+  below: string[]
+  /** Literal outputs (`out` as a tree): prune the path itself and below. */
+  atOrBelow: string[]
+}
+
 /**
- * The directories the wildcard output globs are rooted at, absolute. A
- * literal names a file or a tree whose shape the task decides, so it has
- * none; nor has a glob rooted at the project itself.
+ * Where a clean, before a miss or a restore, may prune: only the trees the
+ * task declared. A directory above a glob's root or holding a literal
+ * output (`out` for `out/a.txt`) stays: a sibling task running beside this
+ * one may have just made it and not yet written into it, and pruning it
+ * failed that task "Directory nonexistent". A glob's root stays: the task
+ * writes under it, and a remove there bought only an rmdir and the task's
+ * mkdir (B-49). A literal's own path goes: the entry or the task may need
+ * a file there. A glob rooted at the project prunes nothing.
  */
-function globRoots(projectDir: string, outputs: readonly string[]): Set<string> {
-  const roots = new Set<string>()
+function pruneScope(base: string, outputs: readonly string[]): PruneScope {
+  const scope: PruneScope = { below: [], atOrBelow: [] }
   for (const g of outputs) {
-    if (g.startsWith('!') || isLiteralPattern(g)) continue
+    if (g.startsWith('!')) continue
+    if (isLiteralPattern(g)) {
+      scope.atOrBelow.push(path.resolve(base, stripTrailingSlash(normalizeGlob(g))))
+      continue
+    }
     const prefix = staticPrefix(g)
-    if (prefix !== '.') roots.add(path.resolve(projectDir, prefix))
+    if (prefix !== '.') scope.below.push(path.resolve(base, prefix))
   }
-  return roots
+  return scope
+}
+
+function inScope(dir: string, scope: PruneScope): boolean {
+  return (
+    scope.below.some((r) => dir.startsWith(r + path.sep)) ||
+    scope.atOrBelow.some((r) => dir === r || dir.startsWith(r + path.sep))
+  )
 }
 
 /**
@@ -1007,7 +1067,7 @@ function globRoots(projectDir: string, outputs: readonly string[]): Set<string>
  */
 export async function resolveWorkspaceOutputs(args: {
   workspaceRoot: string
-  outputs: string[]
+  outputs: readonly string[]
 }): Promise<string[]> {
   const { positive, negative } = splitNegations(args.outputs)
   if (positive.length === 0) return []
@@ -1030,10 +1090,14 @@ export async function resolveWorkspaceOutputs(args: {
  */
 export async function cleanWorkspaceOutputs(args: {
   workspaceRoot: string
-  outputs: string[]
+  outputs: readonly string[]
 }): Promise<string[]> {
   const files = await resolveWorkspaceOutputs(args)
-  await pruneEmptiedDirs(args.workspaceRoot, await removeAll(files, args.workspaceRoot))
+  await pruneEmptiedDirs(
+    args.workspaceRoot,
+    await removeAll(files, args.workspaceRoot),
+    pruneScope(args.workspaceRoot, args.outputs),
+  )
   return files.map((f) => relPosix(args.workspaceRoot, f))
 }
 
@@ -1131,8 +1195,11 @@ async function assertNoInvisibleLiteralInputs(
 interface ResolveFilesArgs {
   projectDir: string
   workspaceRoot: string
-  files: string[] | undefined
-  ownOutputs: string[]
+  files: readonly string[] | undefined
+  ownOutputs: readonly string[]
+  /** Root-relative `outputs.workspaceFiles`, and the project's root-relative directory. */
+  ownWorkspaceOutputs: readonly string[]
+  projectRel: string
   nestedProjectDirs: string[]
   gitFilesCache?: GitFilesCache
   projectFilesCache?: ProjectFilesCache
@@ -1324,6 +1391,8 @@ async function resolveFiles(
   const { positive, negative, isExcluded, ownOutput, positiveGlobs, isPositive } = plan
 
   const nested = inNestedProject(args.projectDir, args.nestedProjectDirs)
+  // Its root-anchored outputs that land in the project, as `files` sees them.
+  const ownWsOutput = inProject(args.projectRel, outputMatcher(args.ownWorkspaceOutputs))
 
   // Defer to git for the file set (Turbo / Nx parity). Nested .gitignore
   // files, .git/info/exclude, and global excludes all participate
@@ -1335,7 +1404,7 @@ async function resolveFiles(
   // duration of one orchestrator run.
   // Everything below the snapshot that decides the result: the project, what
   // it declares, what it excludes as its own outputs, and the boundaries.
-  const memoKey = `${args.projectDir}\0${positive.join('\u0001')}\0${negative.join('\u0001')}\0${args.ownOutputs.join('\u0001')}\0${args.nestedProjectDirs.join('\u0001')}`
+  const memoKey = `${args.projectDir}\0${positive.join('\u0001')}\0${negative.join('\u0001')}\0${args.ownOutputs.join('\u0001')}\0${args.ownWorkspaceOutputs.join('\u0001')}\0${args.nestedProjectDirs.join('\u0001')}`
   let gitFiles = args.gitFilesCache?.snapshotFor(args.projectDir, positiveGlobs)
   let undecodable = args.gitFilesCache?.undecodableNames
   if (gitFiles !== undefined) {
@@ -1346,7 +1415,7 @@ async function resolveFiles(
     if (memo !== undefined && memo.snapshot === gitFiles) {
       return {
         files: [...memo.result],
-        listing: listingFor(args.projectDir, gitFiles, plan, nested),
+        listing: listingFor(args.projectDir, gitFiles, plan, nested, ownWsOutput),
       }
     }
   }
@@ -1397,7 +1466,7 @@ async function resolveFiles(
       input = isPositive(rel) && !isExcluded(rel) && !ownOutput(rel)
       verdicts.set(rel, input)
     }
-    if (!input || nested(rel)) continue
+    if (!input || nested(rel) || ownWsOutput(rel)) continue
     candidates.push(base === undefined ? path.resolve(args.projectDir, rel) : base + rel)
   }
   const unmatchedLiterals = unanswered(plan.literals, gitFiles)
@@ -1424,7 +1493,10 @@ async function resolveFiles(
   // Stored only on the way out: a declaration whose literal named an
   // invisible file threw above, and every task sharing it must throw too.
   args.projectFilesCache?.set(memoKey, { snapshot: gitFiles, result: resolved })
-  return { files: [...resolved], listing: listingFor(args.projectDir, gitFiles, plan, nested) }
+  return {
+    files: [...resolved],
+    listing: listingFor(args.projectDir, gitFiles, plan, nested, ownWsOutput),
+  }
 }
 
 function listingFor(
@@ -1432,11 +1504,12 @@ function listingFor(
   listed: readonly string[],
   plan: FilesPlan,
   nested: (rel: string) => boolean,
+  ownWsOutput: (rel: string) => boolean,
 ): InputListing {
   return {
     root,
     listed,
-    isInput: (rel) => inPlan(plan, rel),
+    isInput: (rel) => inPlan(plan, rel) && !ownWsOutput(rel),
     nested,
     prefixes: plan.prefixes,
     literals: plan.literals,

package/src/cache/layer.ts

@@ -296,7 +296,8 @@ export interface PruneOptions {
   olderThanMs?: number
   /**
    * After applying olderThanMs, if the cache still exceeds this size in
-   * bytes, evict LRU (smallest `accessed_at` first) until under it.
+   * bytes, evict LRU (smallest `accessed_at` first, a row-less artifact
+   * by its file time) until under it.
    */
   maxBytes?: number
   /**
@@ -312,10 +313,11 @@ export interface PruneResult {
   /** Bytes the evicted entries occupied, per the index. */
   bytesFreed: number
   /**
-   * Artifacts and temp files with no index row, unlinked by the orphan
-   * sweep that runs after eviction (a `SCHEMA_VERSION` drop, a deleted
-   * `cache.db`, a save that crashed before its rename). Files younger
-   * than one hour are never counted: they may be a save in flight.
+   * Artifacts and temp files with no index row, unlinked by the same
+   * policy (another vx version's open dropped the row, a deleted
+   * `cache.db`, a save that crashed before its rename). An artifact's file
+   * time plus an hour stands for its last use; a temp goes once an hour
+   * old. Files younger than one hour are never counted.
    */
   orphans: number
   /** Bytes the reaped orphans occupied on disk. */

package/src/cache/layered-cache.ts

@@ -185,7 +185,27 @@ class ScopedRemote implements RemoteCacheLayer {
   }
 
   async has(hash: string): Promise<boolean> {
-    return (await this.remote.has(this.scoped(hash))) || this.remote.has(hash)
+    return this.fallThrough(
+      () => this.remote.has(this.scoped(hash)),
+      () => this.remote.has(hash),
+    )
+  }
+
+  /**
+   * The scope's answer, else the trusted one. A scope lookup that fails
+   * still asks the trusted key, so a hit there is not lost; its error is
+   * rethrown (and warned) when the trusted key fails or has nothing too.
+   */
+  private async fallThrough<T>(own: () => Promise<T>, trusted: () => Promise<T>): Promise<T> {
+    let found: T
+    try {
+      found = await own()
+    } catch (err) {
+      const fallback = await trusted().catch(() => undefined)
+      if (!fallback) throw err
+      return fallback
+    }
+    return found || trusted()
   }
 
   private async scopedHasMany(hashes: readonly string[]): Promise<Set<string> | null> {
@@ -207,7 +227,10 @@ class ScopedRemote implements RemoteCacheLayer {
     hash: string,
   ): Promise<{ body: Blob | Response; durationMs: number | undefined } | null> {
     if (this.trustedOnly.has(hash)) return this.remote.get(hash)
-    return (await this.remote.get(this.scoped(hash))) ?? this.remote.get(hash)
+    return this.fallThrough(
+      () => this.remote.get(this.scoped(hash)),
+      () => this.remote.get(hash),
+    )
   }
 
   put(hash: string, body: Blob, meta: { durationMs: number }): Promise<void> {

package/src/cache/policy.ts

@@ -36,6 +36,11 @@ export const FULL_CACHE_POLICY: CachePolicy = {
   remoteWrite: true,
 }
 
+/** No axis on (`--no-cache`, `--cache=local:`): no cache answers for any task. */
+export function cachesNothing(p: CachePolicy): boolean {
+  return !(p.localRead || p.localWrite || p.remoteRead || p.remoteWrite)
+}
+
 /**
  * Parse a `--cache=<spec>` value into a `CachePolicy`, starting from a
  * base (defaults to {@link FULL_CACHE_POLICY}). The spec is a

package/src/cache/tar-stream.ts

@@ -11,7 +11,7 @@
 // short entry. Non-regular entries are reported with their type and their
 // bodies skipped; the caller decides what to materialise (nothing but `0`).
 
-export interface TarEntry {
+interface TarEntry {
   name: string
   size: number
   /** POSIX typeflag: '0' regular, '5' directory, '2' symlink, … */