@vzn/vx 0.0.594 → 0.0.596

package/src/exec/sandbox-runtime.ts

@@ -279,9 +279,16 @@ export function dependencyReason(errors: readonly string[]): string {
  * listen" on macOS and "Failed to create bridge sockets after 5 attempts"
  * on Linux (its retry loop swallows the code), neither naming the
  * directory (2026-09-16). Checked up front, with room for the sequence.
+ * On Linux the longer name is the network bridge's,
+ * `claude-http-<16 hex>.sock`, and it is the one that fails there.
  */
 export function socketPathRefusal(tmpdir = os.tmpdir()): string | undefined {
-  const sample = path.join(tmpdir, `srt-mux-${process.pid}-zzz.sock`)
+  const sample = path.join(
+    tmpdir,
+    process.platform === 'linux'
+      ? `claude-http-${'0'.repeat(16)}.sock`
+      : `srt-mux-${process.pid}-zzz.sock`,
+  )
   const limit = process.platform === 'darwin' ? 103 : 107
   const length = Buffer.byteLength(sample)
   if (length <= limit) return undefined
@@ -1219,6 +1226,7 @@ async function wrapIn(
         `holds ${held.length === 1 ? 'it' : 'them'} or list another port`,
     )
   }
+  if (ports.length > 0) writeFileSync(portDialScript(tag), PORT_DIAL_SCRIPT)
   const grouped =
     process.platform === 'linux'
       ? ownGroupCommand(tag, inTmp, args.trace, args.tracePaths === true)
@@ -1246,7 +1254,13 @@ async function wrapIn(
       ...macProfileRules(args.config),
       ...darwinWallRules(args.config, baselines.allowRead),
     ]
-    if (rules.length > 0) wrapped = injectProfileRules(wrapped, rules)
+    try {
+      if (rules.length > 0) wrapped = injectProfileRules(wrapped, rules)
+    } catch (err) {
+      releaseBridges(tag)
+      afterCommand(SandboxManager)
+      throw err
+    }
   }
   // Linux: the shell execs bwrap, so bwrap is the spawn itself and its
   // `--die-with-parent` is keyed to vx. Behind a shell that waited on it,
@@ -1383,15 +1397,24 @@ function ownGroupCommand(
     .join(' ')
   const body = shellQuote(`exec ${TRACE_FD}>&-; ${userCommand}`)
   const run = `{ trap - INT QUIT; exec ${setsid ?? ''}${tracer} ${shellQuote(sh)} -c ${body} 3<&-; } & c=$!;`
+  // Bash reports a job a signal killed on its stderr, the task's: a task
+  // whose shell died of SIGKILL printed this whole wrapper (X-111).
+  const wait = `wait "$c" 2>/dev/null`
   if (setsid === undefined) {
-    return { command: `${tag0} ${run} wait "$c"`, forwards: false, traced: true }
+    return { command: `${tag0} ${run} ${wait}`, forwards: false, traced: true }
   }
   const watch = `{ IFS= read -r s && kill -s "$s" -- "-$c"; } 2>/dev/null <&3 3<&- &`
-  return { command: `${tag0} ${run} ${watch} wait "$c"`, forwards: true, traced: true }
+  return { command: `${tag0} ${run} ${watch} ${wait}`, forwards: true, traced: true }
 }
 
-/** What strace stops on: the reads, and what moves or makes a process's cwd. */
-const TRACED_CALLS = 'trace=openat,chdir,fchdir,clone,?clone3,?fork,?vfork'
+/**
+ * What strace stops on: the reads, the execs and access probes (a refused
+ * `./gen.sh || fallback` passed unreported), and what moves or makes a
+ * process's cwd. Not the stat family: a stop per stat cost oxlint 19% and
+ * `git status` 30%, where the execs and probes cost nothing measurable.
+ */
+const TRACED_CALLS =
+  'trace=openat,execve,?access,faccessat,?faccessat2,chdir,fchdir,clone,?clone3,?fork,?vfork'
 
 /** The descriptor an in-sandbox strace writes its trace to (`ownGroupCommand`). */
 const TRACE_FD = 5
@@ -1501,18 +1524,40 @@ export function portBridgeSocket(tag: string, port: number): string {
   return path.join(taskTmpdir(tag), `vx-port-${tag}-${port}.sock`)
 }
 
+/**
+ * Which loopback a bridged connection dials, chosen per connection from
+ * the namespace's listen tables (`$1` the port, `$2` the tables' directory):
+ * `::1` when only it holds the port, else 127.0.0.1. A server bound to
+ * `localhost` on a host that resolves `::1` first (Vite's default) listens
+ * on `::1` alone, and a fixed 127.0.0.1 dial was refused. Read before any
+ * byte moves, so a connection is never retried halfway through.
+ */
+export const PORT_DIAL_SCRIPT = `p=$1 n=\${2:-/proc/net}
+h=$(printf %04X "$p")
+if grep -qsE "^ *[0-9]+: 0{24}01000000:$h [0-9A-F]+:0{4} 0A" "$n/tcp6" &&
+  ! grep -qsE "^ *[0-9]+: (0100007F|0{8}):$h [0-9A-F]+:0{4} 0A" "$n/tcp"; then
+  exec socat - "TCP6:[::1]:$p"
+fi
+exec socat - "TCP4:127.0.0.1:$p"
+`
+
+/** Where the dial script lives: beside the bridge's sockets, written by `wrapSandboxedCommand`. */
+function portDialScript(tag: string): string {
+  return path.join(taskTmpdir(tag), `vx-port-dial-${tag}.sh`)
+}
+
 /**
  * The task's side of the bridge, in front of the user command inside the
  * sandbox: one socat per port, listening on the unix socket and relaying
- * into the namespace's loopback. Backgrounded and reaped with the shell,
- * exactly as SRT starts its own proxy bridges. `unlink-early` clears a
- * socket a killed task left behind; `>/dev/null` keeps its chatter out
- * of the task's frame.
+ * into the namespace's loopback through `PORT_DIAL_SCRIPT`. Backgrounded
+ * and reaped with the shell, exactly as SRT starts its own proxy bridges.
+ * `unlink-early` clears a socket a killed task left behind; `>/dev/null`
+ * keeps its chatter out of the task's frame.
  */
 export function portBridgeInner(ports: readonly number[], tag: string): string {
   const cmds = ports.map(
     (p) =>
-      `socat UNIX-LISTEN:${shellQuote(portBridgeSocket(tag, p))},fork,unlink-early TCP:127.0.0.1:${p} >/dev/null 2>&1 &`,
+      `socat UNIX-LISTEN:${shellQuote(portBridgeSocket(tag, p))},fork,unlink-early ${shellQuote(`SYSTEM:sh ${portDialScript(tag)} ${p}`)} >/dev/null 2>&1 &`,
   )
   return `${cmds.join(' ')} trap 'kill $(jobs -p) 2>/dev/null' EXIT;`
 }
@@ -1646,15 +1691,9 @@ export function releaseBridges(tag: string): void {
   const tmp = taskTmpdir(tag)
   if (liveTaskTmpdirs.delete(tmp)) rmSync(tmp, { recursive: true, force: true })
   if (liveServers.delete(tag)) {
-    // A server's wrap counts as a live sandbox in SRT until this, and SRT
-    // removes bwrap's host stubs (`.bashrc`, `.vscode`, … under a write
-    // grant) only at a count of 0: one stopped server kept every later
-    // task's stubs in the workspace until the reset.
-    try {
-      srtLoaded!.SandboxManager.cleanupAfterCommand()
-    } catch {
-      // best-effort, as a one-shot task's
-    }
+    // A server's wrap stays counted until it stops: one stopped server
+    // kept every later task's stubs in the workspace until the reset.
+    afterCommand(srtLoaded!.SandboxManager)
     if (liveServers.size === 0 && resetDeferred) void resetSandbox().catch(() => {})
   }
   const bridges = hostBridges.get(tag)
@@ -1778,11 +1817,11 @@ async function runSandboxedOnce(
   // share a stream. Skipped when strace isn't on PATH — bwrap still
   // enforces structurally; we just lose the structured violation list.
   //
-  // We trace only `openat` — it's the actual file-read attempt, the
-  // signal the user cares about. `statx` / `newfstatat` / `access`
-  // are mostly shell PATH-walking and stat probes that aren't
-  // actionable (we'd report every node_modules/.bin entry the shell
-  // checks before resolving a command).
+  // We trace `openat`, the read itself, plus `execve` and the access
+  // probes (`TRACED_CALLS`). Not `statx` / `newfstatat`: a stop per stat
+  // is a tax on every stat-heavy task. A probe's ENOENT counts only where
+  // the host has the path (`parseStraceViolations`), so a PATH walk past
+  // a missing `node_modules/.bin` entry reports nothing.
   //
   // `--seccomp-bpf` is what makes that filter cheap: without it strace
   // ptrace-stops the tracee on EVERY syscall and discards the untraced
@@ -1792,7 +1831,7 @@ async function runSandboxedOnce(
   // 24/24; under `strace -f -e trace=openat` the same four fail with
   // medians 2.5–7× over budget; with `--seccomp-bpf` 24/24 again), and
   // it taxed every other sandboxed task the same way. With the flag the
-  // kernel filter stops only on `openat`. strace ≥ 5.3 (2019); an older
+  // kernel filter stops only on the traced calls. strace ≥ 5.3 (2019); an older
   // one gets the slow form rather than no detection.
   const useStrace = await wantsStraceDetection()
   // Before the spawn: what the task creates under a widened grant is its own.
@@ -1983,6 +2022,7 @@ async function runSandboxedOnce(
             records.map((v) => v.line),
             bindableWrites(args.config.allowWrite),
             scratch,
+            [...baselines.allowRead, ...bindableReads(args.config.allowRead)],
           ),
           ...refusedConnections(records.map((v) => v.line)),
         ]
@@ -2016,6 +2056,15 @@ async function runSandboxedOnce(
     })
     if (outside.length > 0)
       violations.push(outsideWritesHint(outside, baselines.denyRead, args.reportWithin))
+    if (process.platform === 'linux') {
+      const removed = grantRemovalHint(
+        `${stdout}\n${stderr}`,
+        bindableWrites(args.config.allowWrite),
+        args.cwd,
+        args.reportWithin,
+      )
+      if (removed !== undefined) violations.push(removed)
+    }
   }
 
   // The one denial macOS never logs. MEASURED 2026-09-05, same machine, two
@@ -2127,6 +2176,45 @@ function outsideWritesHint(
   return { timestamp: new Date(), hint: true, line }
 }
 
+/**
+ * Linux: a directory write grant is a bind mount, and a mount point cannot
+ * be removed or renamed, so `rm -rf dist` empties it and then fails with
+ * "Read-only file system" (EBUSY under a writable parent). Binding the
+ * parent instead would let the task write beside the grant, so the
+ * removal stays refused; a failure whose output names a grant on such an
+ * error line gets the spelling that works.
+ */
+function grantRemovalHint(
+  output: string,
+  roots: readonly string[],
+  cwd: string,
+  within: string,
+): SandboxViolation | undefined {
+  const lines = output
+    .split('\n')
+    .filter((l) => /Read-only file system|EROFS|EBUSY|resource busy/i.test(l))
+  if (lines.length === 0) return undefined
+  const named = roots.filter((root) => {
+    const rel = path.relative(cwd, root)
+    const spellings = rel === '' ? [root] : [root, rel]
+    return spellings.some((s) => {
+      const re = new RegExp(`(^|[\\s'"\`(])(\\./)?${RegExp.escape(s)}/?($|[\\s'"\`:,)])`)
+      return lines.some((l) => re.test(l))
+    })
+  })
+  if (named.length === 0) return undefined
+  const grants = named.map((r) => `'${path.relative(within, r) || '.'}/'`).join(', ')
+  const contents = path.relative(cwd, named[0]!) || '.'
+  return {
+    timestamp: new Date(),
+    hint: true,
+    line:
+      `vx: the write grant ${grants} is mounted in place on Linux: the task may empty it ` +
+      `but not remove or rename it ("Read-only file system"). Remove its contents ` +
+      `instead, e.g. \`rm -rf ${contents}/*\`.`,
+  }
+}
+
 /** A path as a JS string literal a config can take: a quote in it is escaped. */
 const jsString = (p: string): string => (p.includes("'") ? JSON.stringify(p) : `'${p}'`)
 
@@ -2192,8 +2280,12 @@ function sbplToken(value: string, field: string): string {
  */
 export function macProfileRules(c: ResolvedSandboxConfig): string[] {
   const rules: string[] = []
+  // A name is an info type to one caller and a sysctl to another (Bun
+  // reads `hw.optional.neon` with sysctl-read), so it grants both.
   for (const t of c.systemInfo ?? []) {
-    rules.push(`(allow system-info (info-type "${sbplToken(t, 'allow.systemInfo')}"))`)
+    const name = sbplToken(t, 'allow.systemInfo')
+    rules.push(`(allow system-info (info-type "${name}"))`)
+    rules.push(`(allow sysctl-read (sysctl-name "${name}"))`)
   }
   if (localBindingOn(c)) {
     // `*:*`, not `localhost:*`: a dual-stack socket bound to 127.0.0.1 is
@@ -2307,22 +2399,6 @@ function injectProfileRules(wrapped: string, rules: readonly string[]): string {
 }
 
 /**
- * Grant paths, with globs handled per platform.
- *
- * macOS: SRT's own `pathFilter` turns a glob into `(regex …)` and a literal
- * into `(subpath …)`, so a pattern is passed through and seatbelt matches
- * it — including files created DURING the run.
- *
- * Linux: a grant is a bwrap bind mount, and you cannot mount a pattern.
- * The glob is expanded against the filesystem here, which means it covers
- * what exists when the task STARTS. A pattern matching a file the task
- * creates later grants nothing there — declare its directory instead.
- *
- * That last sentence is the whole contract, and until item 496 a task
- * that broke it learned so from its OWN tool. Measured, one task per
- * spelling, each writing files it declares:
- *
- *   write: ['g/**
  * The walls a glob grant can reach: each one under (or at) a glob's
  * literal head. On Linux `expandGrants` drops such a hit before the bind
  * (B-1); seatbelt matches a glob as a path regex, with no hit to drop.
@@ -2367,7 +2443,23 @@ export function darwinWallRules(
   return rules
 }
 
-/**']         ok — collapsed to the directory
+/**
+ * Grant paths, with globs handled per platform.
+ *
+ * macOS: SRT's own `pathFilter` turns a glob into `(regex …)` and a literal
+ * into `(subpath …)`, so a pattern is passed through and seatbelt matches
+ * it — including files created DURING the run.
+ *
+ * Linux: a grant is a bwrap bind mount, and you cannot mount a pattern.
+ * The glob is expanded against the filesystem here, which means it covers
+ * what exists when the task STARTS. A pattern matching a file the task
+ * creates later grants nothing there — declare its directory instead.
+ *
+ * That last sentence is the whole contract, and until item 496 a task
+ * that broke it learned so from its OWN tool. Measured, one task per
+ * spelling, each writing files it declares:
+ *
+ *   write: ['g/**']         ok — collapsed to the directory
  *   write: ['g/a.txt']      ok — a literal is widened to its directory
  *   write: ['g/*']          FAILED: `bash: g/a.txt: Read-only file system`
  *   write: ['g/*.txt']      FAILED, same

package/src/exec/sandbox-violations.ts

@@ -4,7 +4,7 @@
 // task's owner can act on — inside the project, minus the loopback denial
 // no grant can avoid, minus what the task chose to ignore.
 
-import { statSync } from 'node:fs'
+import { lstatSync, statSync } from 'node:fs'
 import path from 'node:path'
 import { absolutize, atOrUnder, isUnderAny, localBindingOn, toRealPath } from './sandbox-paths.js'
 import { bindableReads, bindableWrites } from './sandbox-binds.js'
@@ -24,6 +24,7 @@ import type {
  *   <pid> openat(AT_FDCWD, "<path>", <flags>) = -1 ENOENT (...)
  *   <pid> access("<path>", <mode>) = -1 EACCES (...)
  *   <pid> statx(AT_FDCWD, "<path>", <flags>, <mask>, ...) = -1 ENOENT (...)
+ *   <pid> execve("<path>", ["<argv0>", ...], <envp>) = -1 ENOENT (...)
  *
  * …but ONLY when the syscall completes without another traced process
  * interleaving. Under `-f` strace splits an interrupted call across two
@@ -40,21 +41,26 @@ import type {
  * (`cStringPath` decodes it). Paths that are relative resolve against the
  * task's cwd (set by Bun.spawn).
  */
-const SYSCALLS = 'openat|access|statx|newfstatat'
+const SYSCALLS = 'openat|execve|faccessat2|faccessat|access|statx|newfstatat'
 const QUOTED = '"((?:[^"\\\\]|\\\\.)+)"'
 // The directory descriptor a call names, `-y`'s path included: taken up to
 // the `, "` that opens the path argument, since a directory's name may hold
 // a quote (`4</ws/q"d>`). Captured: a relative path is in that directory.
 const DIRFD = '(?:AT_FDCWD|\\d+)(?:<(.*?)>)?, '
+// The rest of the call: an `execve`'s argv strings may hold a `)`
+// (`sh -c "f()"`), so it reads to the result at the line's end.
+const ARGS = '.*'
 const STRACE_DONE_RE = new RegExp(
-  `^(\\d+)\\s+(${SYSCALLS})\\((?:${DIRFD})?${QUOTED}[^)]*\\)\\s*=\\s*-1\\s+(ENOENT|EACCES|EPERM)`,
+  `^(\\d+)\\s+(${SYSCALLS})\\((?:${DIRFD})?${QUOTED}${ARGS}\\)\\s*=\\s*-1\\s+(ENOENT|EACCES|EPERM)`,
 )
 const STRACE_UNFINISHED_RE = new RegExp(
-  `^(\\d+)\\s+(${SYSCALLS})\\((?:${DIRFD})?${QUOTED}[^)]*<unfinished`,
+  `^(\\d+)\\s+(${SYSCALLS})\\((?:${DIRFD})?${QUOTED}${ARGS}<unfinished`,
 )
 const STRACE_RESUMED_RE = new RegExp(
   `^(\\d+)\\s+<\\.\\.\\. (${SYSCALLS}) resumed>.*?=\\s*-1\\s+(ENOENT|EACCES|EPERM)`,
 )
+/** The calls that ask whether a path is there rather than read it. */
+const PROBES = new Set(['execve', 'faccessat2', 'faccessat', 'access', 'statx', 'newfstatat'])
 /** A resumed call that SUCCEEDED — clears the pending entry, emits nothing. */
 const STRACE_RESUMED_OK_RE = new RegExp(`^(\\d+)\\s+<\\.\\.\\. (${SYSCALLS}) resumed>`)
 /**
@@ -352,6 +358,11 @@ export async function parseStraceViolations(
       ...args.config.allowWrite.filter((w) => bindableWrites([w]).length > 0),
     ].map((p) => toRealPath(absolutize(p))),
   )
+  // A write glob no mount holds is a write grant too (`refusedWrites`
+  // counts its scratch): cp's probe of its destination there failed a task
+  // on its own output. One a read bind holds is readable; one outside the
+  // workspace, never reported.
+  const pendingWrites = (args.config.pendingWrites ?? []).map((g) => new Bun.Glob(g))
   const denyAnchors = baselines.denyRead.map((p) => toRealPath(absolutize(p)))
   // A read under a widened write grant's directory is never refused, so it
   // is reported when it succeeds: an entry that was there at the start and
@@ -382,8 +393,13 @@ export async function parseStraceViolations(
     // libs / /proc / /sys / etc. probes are not interesting violations.
     if (!denyAnchors.some((root) => atOrUnder(abs, root))) continue
     // Skip paths the user explicitly allowed (and their descendants).
-    if (isUnderAny(abs, allowAbs)) continue
+    if (isUnderAny(abs, allowAbs) || underGlob(abs, pendingWrites)) continue
     if (read === true && !undeclared(abs)) continue
+    // A hidden path answers ENOENT, as a missing one does: a probe
+    // (`./gen.sh || …`, `test -x`, a PATH walk) is a refusal only where
+    // the host has the file.
+    if (errno === 'ENOENT' && PROBES.has(syscall) && !lstatSync(abs, { throwIfNoEntry: false }))
+      continue
     const key = `${syscall}|${abs}`
     if (seen.has(key)) continue
     seen.add(key)
@@ -401,9 +417,9 @@ export async function parseStraceViolations(
             timestamp: new Date(),
             target: abs,
             path: abs,
-            // The trace is `-e trace=openat`, and an openat is a read or a
-            // write depending on flags the trace does not carry — so either
-            // list can silence it.
+            // An openat is a read or a write depending on flags the parse
+            // does not keep, and `access` may ask either — so either list
+            // can silence it.
             ignorable: ['read', 'write'],
           },
     )
@@ -418,7 +434,10 @@ export async function parseStraceViolations(
  * /path/x`, `deny(1) system-info vfs.disk-space` — so the operation picks
  * the list and the target is matched against its patterns. Anything
  * unparseable is NOT ignored: a record we cannot classify is exactly the
- * one worth seeing.
+ * one worth seeing. A file list matches the record's `path`, where it
+ * lands, as `read` and `write` patterns are anchored and as the report's
+ * own boundary judges it: a seatbelt record named through a link was
+ * reported and its pattern never matched.
  */
 function matchesIgnore(
   v: SandboxViolation,
@@ -428,7 +447,8 @@ function matchesIgnore(
   for (const which of v.ignorable) {
     const patterns = ignore[which]
     if (patterns === undefined) continue
-    if (patterns.some((pat) => pat === v.target || new Bun.Glob(pat).match(v.target!))) return true
+    const subject = which === 'read' || which === 'write' ? (v.path ?? v.target) : v.target
+    if (patterns.some((pat) => pat === subject || new Bun.Glob(pat).match(subject))) return true
   }
   return false
 }
@@ -685,6 +705,8 @@ export function refusedWrites(
   writable: readonly string[],
   /** Write globs whose writes land in the sandbox's scratch (`scratchWrites`): granted. */
   scratch: readonly string[] = [],
+  /** What the sandbox mounts readable, canonical: a mkdir of what is there is no write. */
+  readable: readonly string[] = [],
 ): SandboxViolation[] {
   const binds = new Set(writable.map((w) => toRealPath(absolutize(w))))
   const globs = scratch.map((g) => new Bun.Glob(g))
@@ -705,7 +727,9 @@ export function refusedWrites(
     // the bind: `mkdir -p node_modules/.cache/tool` under a grant of
     // `node_modules/.cache/` met EEXIST on `node_modules`, wrote nothing,
     // and the attempt failed a clean task (2026-10-03).
-    if (syscall.startsWith('mkdir') && [...binds].some((b) => atOrUnder(b, abs))) continue
+    // So does one a read grant shows, or holds: `mkdir -p src` under
+    // `read: ['src']` failed a clean task the same way (X-82).
+    if (syscall.startsWith('mkdir') && inSandbox(abs, binds, readable)) continue
     const key = `${syscall}|${abs}`
     if (seen.has(key)) continue
     seen.add(key)
@@ -720,6 +744,29 @@ export function refusedWrites(
   return out
 }
 
+/**
+ * `abs` exists inside the sandbox: a write bind lies at or under it (vx
+ * made each before the spawn), a read grant that exists does, or a read
+ * grant holds it and it exists. A read grant naming nothing is not
+ * mounted, so neither it nor its ancestors are there.
+ */
+function inSandbox(abs: string, binds: Set<string>, readable: readonly string[]): boolean {
+  return (
+    [...binds].some((b) => atOrUnder(b, abs)) ||
+    readable.some((r) => atOrUnder(r, abs) && exists(r)) ||
+    (readable.some((r) => atOrUnder(abs, r)) && exists(abs))
+  )
+}
+
+function exists(p: string): boolean {
+  try {
+    lstatSync(p)
+    return true
+  } catch {
+    return false
+  }
+}
+
 /** `p`, or a directory holding it, matches one of `globs`. */
 function underGlob(p: string, globs: readonly InstanceType<typeof Bun.Glob>[]): boolean {
   if (globs.length === 0) return false

package/src/graph/index.ts

@@ -11,6 +11,7 @@ export {
 export {
   type ContinueMode,
   deadServerBehind,
+  idleServers,
   type InputChanges,
   RestoreDemoted,
   runGraph,

package/src/graph/scheduler.ts

@@ -120,6 +120,12 @@ export interface TaskOutcome {
    * so a dependant that folds `hash` saves nothing either (A-12).
    */
   unkeyed?: true
+  /**
+   * The run's cache policy read and wrote nothing (`--no-cache`,
+   * `--cache=local:`): no cache answered for this task, so a run of it is
+   * `no-cache`, not a miss. Set by `run()`; `ranNoCache` reads it.
+   */
+  cacheOff?: true
   /**
    * On a `skipped` outcome: the task at the ROOT of what blocked it — the
    * failed (or aborted) upstream, followed through any chain of skips
@@ -292,9 +298,10 @@ export interface ScheduleOptions {
    * Admission over the worker count: asked for every exec-tier task about
    * to start on this machine, with the ids of the exec-tier tasks running
    * here right now (added on dispatch, so two asks in one tick see each
-   * other). `false` parks the task until something finishes. Undefined →
-   * count-only, the legacy path byte for byte. Restore-tier hits and
-   * pooled tasks hold no local resources and are never asked.
+   * other; removed when `execute` resolves, which for a persistent task is
+   * at ready). `false` parks the task until something finishes. Undefined →
+   * count-only, the legacy path byte for byte. Restore-tier hits, pooled
+   * tasks and groups hold no local resources: never asked, never listed.
    */
   admit?: (id: string, running: ReadonlySet<string>) => boolean
   /**
@@ -394,19 +401,26 @@ class ReadyHeap {
 /**
  * The dead server a dependency stands for: itself, or one a group reaches.
  * A group is a name for its deps, and it finished the moment the server
- * was ready, so a task behind it ran against the dead one.
+ * was ready, so a task behind it ran against the dead one. Walked with a
+ * stack and a seen set: recursion threw `RangeError` on a deep chain of
+ * groups, and re-walked a group each path reached it by.
  */
 export function deadServerBehind(
   nodes: ReadonlyMap<string, TaskNode>,
   serverDied: (id: string) => boolean,
   id: string,
 ): string | undefined {
-  if (serverDied(id)) return id
-  const n = nodes.get(id)
-  if (n === undefined || !isGroupTask(n)) return undefined
-  for (const d of n.deps) {
-    const dead = deadServerBehind(nodes, serverDied, d)
-    if (dead !== undefined) return dead
+  const stack = [id]
+  const seen = new Set<string>()
+  while (stack.length > 0) {
+    const at = stack.pop()!
+    if (seen.has(at)) continue
+    seen.add(at)
+    if (serverDied(at)) return at
+    const n = nodes.get(at)
+    if (n === undefined || !isGroupTask(n)) continue
+    // Reversed, so the first dep is walked first, as the order it names them.
+    for (let i = n.deps.length - 1; i >= 0; i--) stack.push(n.deps[i]!)
   }
   return undefined
 }
@@ -582,8 +596,10 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
     }
   }
   // The policy sees exec-tier local tasks only; a restore is a tar
-  // extract and a pooled task runs on someone else's capacity.
-  const local = (id: string): boolean => !inRestoreTier(id) && poolOf?.(id) === undefined
+  // extract, a pooled task runs on someone else's capacity, and a group
+  // runs nothing, so a packing policy that counted one parked work for it.
+  const local = (id: string): boolean =>
+    !inRestoreTier(id) && poolOf?.(id) === undefined && !isGroupTask(nodes.get(id) as TaskNode)
   const admits = (id: string): boolean => !local(id) || admitPolicy!(id, running)
   // With no policy nothing reads `running`, so nothing is tracked: the
   // count-only dispatch allocates no closure and touches no set per task.
@@ -969,7 +985,7 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
 }
 
 /** Persistent tasks nobody asked for whose every dependant is a restore-tier hit. */
-function idleServers(
+export function idleServers(
   nodes: ReadonlyMap<string, TaskNode>,
   dependents: ReadonlyMap<string, string[]>,
   restoreTier: ReadonlySet<string> | undefined,