@vzn/vx 0.0.594 → 0.0.596

package/src/graph/task-graph.ts

@@ -1,4 +1,3 @@
-import path from 'node:path'
 import type { ProjectConfig, TaskConfig, WorkspaceRules } from '../config.js'
 import {
   asTrees,
@@ -109,6 +108,11 @@ export function isGroupTask(node: TaskNode): boolean {
   return node.config.exec === undefined
 }
 
+/** The default `build` (orchestrator/projects.ts): a config cannot key a group, so it is the one keyed group. */
+function isKeyedGroup(task: TaskConfig): boolean {
+  return task.exec === undefined && task.cache !== undefined
+}
+
 /**
  * Mark, for focused-flow display, the real tasks a requested GROUP
  * stands for. A group has no output of its own, so `vx run build`
@@ -160,7 +164,8 @@ export function markSurfacedDeps(nodes: Map<string, TaskNode>): number {
  *
  *   - Bare task names (`'build'`) → one entry per project in
  *     `candidates` that declares the task. Missing in a given project
- *     is silent (sparse tasks are normal across a workspace).
+ *     is silent (sparse tasks are normal across a workspace). A task
+ *     `unselected` holds (the default `build`) is no match.
  *   - Anchored entries (`'pkg#task'`) → one entry exactly, ignoring
  *     `candidates`. Silently dropped if pkg/task doesn't exist (the
  *     CLI's pre-validation catches malformed strings).
@@ -171,6 +176,7 @@ export function expandRequested(
   tasks: readonly string[],
   candidates: readonly string[],
   projects: Map<string, ProjectEntry>,
+  unselected?: (task: TaskConfig) => boolean,
 ): Array<{ project: string; task: string }> {
   const seen = new Set<string>()
   const out: Array<{ project: string; task: string }> = []
@@ -189,7 +195,7 @@ export function expandRequested(
       continue
     }
     for (const name of candidates) {
-      if (declaresTask(projects, name, spec)) push(name, spec)
+      if (selectsTask(projects, name, spec, unselected)) push(name, spec)
     }
   }
   return out
@@ -214,6 +220,17 @@ function declaresTask(projects: Map<string, ProjectEntry>, project: string, task
   return declaredTask(projects.get(project)?.config, task) !== undefined
 }
 
+/** What a bare name matches: a declared task `unselected` leaves alone. */
+function selectsTask(
+  projects: Map<string, ProjectEntry>,
+  project: string,
+  task: string,
+  unselected: ((task: TaskConfig) => boolean) | undefined,
+): boolean {
+  const config = declaredTask(projects.get(project)?.config, task)
+  return config !== undefined && unselected?.(config) !== true
+}
+
 /**
  * The requested specs `expandRequested` silently dropped — each one
  * matched NO project, so nothing it asked for will run.
@@ -230,6 +247,7 @@ export function unresolvedRequests(
   tasks: readonly string[],
   candidates: readonly string[],
   projects: Map<string, ProjectEntry>,
+  unselected?: (task: TaskConfig) => boolean,
 ): string[] {
   const out: string[] = []
   const seen = new Set<string>()
@@ -239,7 +257,8 @@ export function unresolvedRequests(
     const resolved =
       idx >= 0
         ? declaresTask(projects, spec.slice(0, idx), spec.slice(idx + 1))
-        : candidates.length === 0 || candidates.some((name) => declaresTask(projects, name, spec))
+        : candidates.length === 0 ||
+          candidates.some((name) => selectsTask(projects, name, spec, unselected))
     if (resolved) continue
     seen.add(spec)
     out.push(spec)
@@ -380,6 +399,55 @@ export function buildTaskGraph(options: BuildGraphOptions): Map<string, TaskNode
     return declared.has(name)
   }
 
+  // Package cycles, for the default `build` (`isKeyedGroup`): each project
+  // on one maps to its strongly connected component, found on the first ask
+  // (iterative Tarjan over `directDeps`, the order the `^name` walk reads).
+  const component = new Map<string, number>()
+  const cyclic = new Set<number>()
+  let components = 0
+  function componentOf(start: string): number {
+    const known = component.get(start)
+    if (known !== undefined) return known
+    const index = new Map<string, number>()
+    const low = new Map<string, number>()
+    const open: string[] = []
+    const work: Array<[name: string, next: number]> = []
+    const enter = (name: string): void => {
+      index.set(name, index.size)
+      low.set(name, index.size - 1)
+      open.push(name)
+      work.push([name, 0])
+    }
+    enter(start)
+    while (work.length > 0) {
+      const top = work[work.length - 1]!
+      const deps = packageGraph.directDeps(top[0])
+      if (top[1] < deps.length) {
+        const dep = deps[top[1]++]!
+        if (component.has(dep)) continue
+        if (!index.has(dep)) enter(dep)
+        else low.set(top[0], Math.min(low.get(top[0])!, index.get(dep)!))
+        continue
+      }
+      work.pop()
+      const name = top[0]
+      const parent = work[work.length - 1]
+      if (parent !== undefined) low.set(parent[0], Math.min(low.get(parent[0])!, low.get(name)!))
+      if (low.get(name) !== index.get(name)) continue
+      const id = components++
+      let size = 0
+      for (let member = ''; member !== name; size++) {
+        member = open.pop()!
+        component.set(member, id)
+      }
+      if (size > 1) cyclic.add(id)
+    }
+    return component.get(start)!
+  }
+  const onCycle = (name: string): boolean => cyclic.has(componentOf(name))
+  const sameCycle = (a: string, b: string): boolean =>
+    onCycle(a) && componentOf(a) === componentOf(b)
+
   // Resolves one `dependsOn` entry of `frame`'s task into its edges.
   function resolveEntry(frame: Frame, raw: string): void {
     const { node } = frame
@@ -451,7 +519,14 @@ export function buildTaskGraph(options: BuildGraphOptions): Map<string, TaskNode
       // shape), and a cycle walks the frontier straight back to the
       // origin. Mirrors the self-pattern rule above — a task can never
       // depend on itself.
+      //
+      // The default `build` sits on every project, so on a package cycle it
+      // would make a task cycle no config declares. Its own walk passes
+      // through the projects on its cycle (each of their builds reaches it),
+      // and a walk that meets it on a cycle takes the edge and goes on past
+      // it, so the builds it could not depend on still come first.
       const re = isTaskPattern(spec.task) ? compileTaskPattern(spec.task) : null
+      const keyed = isKeyedGroup(node.config)
       const visited = new Set<string>([projectName])
       const frontier = [...packageGraph.directDeps(projectName)]
       let held = false
@@ -460,8 +535,15 @@ export function buildTaskGraph(options: BuildGraphOptions): Map<string, TaskNode
         if (visited.has(target)) continue
         visited.add(target)
         if (re === null) {
-          if (visit(frame, target, spec.task, false)) held = true
-          else frontier.push(...packageGraph.directDeps(target))
+          if (keyed && sameCycle(projectName, target)) {
+            frontier.push(...packageGraph.directDeps(target))
+          } else if (visit(frame, target, spec.task, false)) {
+            held = true
+            const task = declaredTask(projects.get(target)!.config, spec.task)!
+            if (isKeyedGroup(task) && onCycle(target)) {
+              frontier.push(...packageGraph.directDeps(target))
+            }
+          } else frontier.push(...packageGraph.directDeps(target))
         } else {
           const names = Object.keys(projects.get(target)?.config.tasks ?? {}).filter((n) =>
             re.test(n),
@@ -975,36 +1057,51 @@ const GLOB_HEAD_END = /[*?{}\\!]/
  * directory its own head names. A whole subtree meets the globs whose
  * literal prefix lies at or under it, found the same way from the glob's
  * side (item 941).
+ *
+ * Given `sideOf`, only the pairs whose members sit on different sides are
+ * wanted (a reader and a writer, `detectInputOverlaps`), and each index is
+ * kept per side, so a member looks up only the other side's: thousands of
+ * readers sharing one input (`src/**`, a root `tsconfig.base.json`) were
+ * paired with each other, millions of pairs no rule judges (X-101).
  */
 function overlapCandidates<T>(
   tasks: readonly T[],
   globsOf: (n: T) => readonly string[] | undefined,
+  sideOf?: (n: T) => boolean,
 ): Array<[number, number]> {
-  const globs = new Map<string, number[]>()
-  const globsUnder = new Map<string, number[]>()
+  const sides = sideOf === undefined ? 1 : 2
+  // The index a member of side `s` looks up: its own side's, or the other's.
+  const across = (s: number): number => (sides === 1 ? s : 1 - s)
+  const perSide = (): Array<Map<string, number[]>> =>
+    Array.from({ length: sides }, () => new Map<string, number[]>())
+  const globs = perSide()
+  const globsUnder = perSide()
   const literals: Array<[task: number, path: string]> = []
   // `covers` (item 941): a whole subtree `P/**` meets every glob whose
   // literal prefix is P or under it, so each glob looks up the subtrees
   // filed at its prefix and at each of that prefix's ancestors.
-  const subtrees = new Map<string, number[]>()
+  const subtrees = perSide()
   const prefixes: Array<[task: number, prefix: string]> = []
   const file = (index: Map<string, number[]>, key: string, i: number): void => {
     const list = index.get(key)
     if (list === undefined) index.set(key, [i])
     else list.push(i)
   }
+  const side: number[] = []
   for (let i = 0; i < tasks.length; i++) {
+    const s = sideOf?.(tasks[i]!) === true ? 1 : 0
+    side.push(s)
     for (const tree of asTrees(globsOf(tasks[i]!) ?? [])) {
       if (isLiteralPattern(tree)) {
         literals.push([i, tree])
         continue
       }
-      file(globs, tree, i)
+      file(globs[s]!, tree, i)
       const dir = wholeSubtreePrefixes([tree])?.[0]
-      if (dir !== undefined) file(subtrees, dir, i)
+      if (dir !== undefined) file(subtrees[s]!, dir, i)
       prefixes.push([i, staticPrefix(tree)])
       const head = tree.slice(0, tree.search(GLOB_HEAD_END))
-      file(globsUnder, head.slice(0, Math.max(0, head.lastIndexOf('/'))), i)
+      file(globsUnder[s]!, head.slice(0, Math.max(0, head.lastIndexOf('/'))), i)
     }
   }
   const n = tasks.length
@@ -1012,34 +1109,38 @@ function overlapCandidates<T>(
   const pair = (x: number, y: number): void => {
     if (x !== y) pairs.add(x < y ? x * n + y : y * n + x)
   }
-  for (const list of globs.values()) {
+  for (const [tree, list] of globs[0]!) {
+    const other = sides === 1 ? list : (globs[1]!.get(tree) ?? [])
     for (let x = 0; x < list.length; x++) {
-      for (let y = x + 1; y < list.length; y++) pair(list[x]!, list[y]!)
+      for (let y = sides === 1 ? x + 1 : 0; y < other.length; y++) pair(list[x]!, other[y]!)
     }
   }
   // `witnessed`: two globs meet only when one's literal prefix is the
   // other's or under it, so each looks up the globs filed at its prefix
   // and at each ancestor.
-  const byPrefix = new Map<string, number[]>()
-  for (const [i, prefix] of prefixes) file(byPrefix, rootless(prefix), i)
+  const byPrefix = perSide()
+  for (const [i, prefix] of prefixes) file(byPrefix[side[i]!]!, rootless(prefix), i)
   for (const [i, raw] of prefixes) {
+    const index = byPrefix[across(side[i]!)]!
     const prefix = rootless(raw)
-    for (const j of byPrefix.get(prefix) ?? []) pair(i, j)
-    if (prefix !== '') for (const j of byPrefix.get('') ?? []) pair(i, j)
+    for (const j of index.get(prefix) ?? []) pair(i, j)
+    if (prefix !== '') for (const j of index.get('') ?? []) pair(i, j)
     for (let sep = prefix.indexOf('/'); sep !== -1; sep = prefix.indexOf('/', sep + 1)) {
-      for (const j of byPrefix.get(prefix.slice(0, sep)) ?? []) pair(i, j)
+      for (const j of index.get(prefix.slice(0, sep)) ?? []) pair(i, j)
     }
   }
   for (const [i, prefix] of prefixes) {
-    for (const j of subtrees.get(prefix) ?? []) pair(i, j)
+    const index = subtrees[across(side[i]!)]!
+    for (const j of index.get(prefix) ?? []) pair(i, j)
     for (let sep = prefix.indexOf('/'); sep !== -1; sep = prefix.indexOf('/', sep + 1)) {
-      for (const j of subtrees.get(prefix.slice(0, sep)) ?? []) pair(i, j)
+      for (const j of index.get(prefix.slice(0, sep)) ?? []) pair(i, j)
     }
   }
   for (const [i, path] of literals) {
-    for (const j of globsUnder.get('') ?? []) pair(i, j)
+    const index = globsUnder[across(side[i]!)]!
+    for (const j of index.get('') ?? []) pair(i, j)
     for (let sep = path.indexOf('/'); sep !== -1; sep = path.indexOf('/', sep + 1)) {
-      for (const j of globsUnder.get(path.slice(0, sep)) ?? []) pair(i, j)
+      for (const j of index.get(path.slice(0, sep)) ?? []) pair(i, j)
     }
   }
   return [...pairs].sort((x, y) => x - y).map((p) => [Math.floor(p / n), p % n])
@@ -1236,7 +1337,11 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
   if (projectReaders) {
     for (const sides of byProject.values()) {
       if (sides.length < 2) continue
-      for (const [i, j] of overlapCandidates(sides, (s) => s.globs)) {
+      for (const [i, j] of overlapCandidates(
+        sides,
+        (s) => s.globs,
+        (s) => s.reads,
+      )) {
         readsOutputs(sides[i]!, sides[j]!, 'files')
       }
     }
@@ -1251,7 +1356,11 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
       rooted.push({ node, globs, reads: false, rel })
     }
   }
-  for (const [i, j] of overlapCandidates(rooted, (s) => s.globs)) {
+  for (const [i, j] of overlapCandidates(
+    rooted,
+    (s) => s.globs,
+    (s) => s.reads,
+  )) {
     readsOutputs(rooted[i]!, rooted[j]!, 'workspaceFiles')
   }
 }

package/src/index.ts

@@ -179,6 +179,12 @@ export type {
 // A remote executor gives a task back to the local floor by rejecting with
 // this (B-100): core runs it here and says why once.
 export { executorFallback } from './exec/index.js'
+// How the local executor puts the args after `--` on a command, for an
+// executor that runs `ExecuteRequest.command` itself: `@vzn/vx-reapi` and
+// the `vx init --plugin executor` example each joined their own, and a
+// trailing comment or a template literal's closing newline lost the args
+// there while the local floor kept them (X-112).
+export { withForwardArgs } from './exec/index.js'
 export type {
   ExecuteRequest,
   ExecuteResult,

package/src/orchestrator/admission.ts

@@ -27,7 +27,10 @@ import { computeTaskHash, type ComputeHashArgs } from './task-hash.js'
 
 /** What `taintTracker` answers per dispatch, and what it learns per finish. */
 export interface TaintTracker {
-  /** Whether `node`, dispatched with these `upstream` outcomes, builds on bytes nothing vouches for. */
+  /**
+   * Whether `node`, dispatched with these key `upstream` outcomes, builds on
+   * bytes nothing vouches for. Its order-only deps count too.
+   */
   judge: (node: TaskNode, upstream: TaskOutcome[]) => boolean
   /** Every settled outcome, the scheduler's `onFinish`. */
   settled: (outcome: TaskOutcome) => void
@@ -102,8 +105,14 @@ export function taintTracker(
   }
   return {
     // A restore-tier task may run before its deps and see holes here; it
-    // never saves anyway (a hit restores), so a hole is not taint.
-    judge: (node, upstream) => seeds.has(node.id) || upstream.some(through),
+    // never saves anyway (a hit restores), so a hole is not taint. The
+    // upstream is the key's, which drops order-only edges; their failure
+    // reaches the task through the dependency `--exclude-dependencies`
+    // took out, so they are read from the settled outcomes.
+    judge: (node, upstream) =>
+      seeds.has(node.id) ||
+      upstream.some(through) ||
+      node.orderOnly?.some((d) => through(outcomes.get(d))) === true,
     settled: (outcome) => {
       outcomes.set(outcome.node.id, outcome)
     },

package/src/orchestrator/events.ts

@@ -13,6 +13,15 @@ import { maskedCommand, secretMask } from '../util/index.js'
 import type { Logger } from './logger.js'
 import type { RunContext } from './summary.js'
 
+/**
+ * A task no cache answered for: it declares no `cache`, or the run's policy
+ * read and wrote nothing. Its run is `no-cache`, never a miss, on every
+ * surface — `--dry`'s plan, the frame, the footer, `--report`, `--summarize`.
+ */
+export function ranNoCache(o: { node: TaskNode; cacheOff?: boolean }): boolean {
+  return o.node.config.cache === undefined || o.cacheOff === true
+}
+
 /** Payload of the `run:start` event — mirrors the Logger.runStart hook. */
 export interface RunStartInfo {
   total: number
@@ -373,7 +382,7 @@ export function projectOutcome(outcome: TaskOutcome): OutcomeView {
     durationMs: outcome.durationMs,
   }
   if (isGroupTask(outcome.node)) view.isGroup = true
-  else if (outcome.node.config.cache === undefined) view.noCache = true
+  else if (ranNoCache(outcome)) view.noCache = true
   if (outcome.storedDurationMs !== undefined) view.storedDurationMs = outcome.storedDurationMs
   if (outcome.storedCpuMs !== undefined) view.storedCpuMs = outcome.storedCpuMs
   if (outcome.storedPeakRssBytes !== undefined) view.storedPeakRssBytes = outcome.storedPeakRssBytes

package/src/orchestrator/execute-task.ts

@@ -38,6 +38,7 @@ import {
   type TaskInputs,
   PersistentReadyError,
   sandboxReads,
+  maskCaptured,
 } from '../exec/index.js'
 import { isGroupTask, RestoreDemoted, type TaskNode, type TaskOutcome } from '../graph/index.js'
 import {
@@ -361,12 +362,17 @@ async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutcome> {
       args.cacheDir,
     )
     placeholders = sb.placeholders
+    // A wrap that refuses (a port the host holds) leaves the server unspawned
+    // and the placeholders vx made for it in the project for every later run.
     const wrapped = await wrapSandboxedCommand({
       command: plainCommand,
       cwd: node.projectDir,
       env,
       ...sb.sandbox,
       server: true,
+    }).catch(async (err: unknown) => {
+      await sweepPlaceholders(placeholders)
+      throw err
     })
     command = wrapped.wrapped
     bridgeTag = wrapped.tag
@@ -534,6 +540,20 @@ async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutcome> {
     }
   }
 
+  // Ready only once the stop had landed: a trap that prints the marker on
+  // the way down, or a race with the signal. The stop is killing it (it
+  // is in `liveChildren`), and it served nobody, as a one-shot that exits
+  // 0 on the stop is aborted (item 962).
+  if (isAborted(args.stopSignal)) {
+    return {
+      node,
+      status: 'aborted',
+      exitCode: signalExitCode(forwardedSignal(args.stopSignal!.reason)),
+      durationMs: spawn.readyMs(),
+      wallclockStartNs,
+      wallclockEndNs: process.hrtime.bigint() - args.runStartHrTimeNs,
+    }
+  }
   args.persistentRegistry?.set(node.id, spawn.child)
   forgetUndeclaredWrites(args, undeclaredWriteReach(node, args.workspaceRoot))
   if (mayWriteFingerprint(node, args.workspaceRoot)) args.fingerprintWatch?.wrote()
@@ -914,7 +934,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       // re-create would stay in a same-project consumer's input set, keeping
       // that consumer's key unchanged while the file is gone from disk.
       const endClean = span('miss: clean outputs')
-      const cleanedRels = await cleanOutputs({ ...cleanArgs, keepGlobRoots: true })
+      const cleanedRels = await cleanOutputs(cleanArgs)
       endClean()
       args.gitFilesCache?.noteClean(node.id, node.projectDir, cleanedRels)
       args.gitFilesCache?.markOutputsChanged(node.projectDir, cleanedRels)
@@ -934,15 +954,21 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     const endReq = span('miss: build request')
     const req = await buildRequest()
     endReq()
-    // An executor that THROWS produces no captured output, so the task's
-    // frame would print the command and nothing else while the reason went
-    // straight to stderr and scrolled away in a broad run. Put it in the
-    // task's own stream first: the frame is where a reader looks for why a
-    // task failed, and a remote executor's failures are exactly the ones with
-    // no other trace. Rethrown unchanged — the scheduler still classifies it,
-    // and still prints it plainly for a UserError.
+    // An executor that THROWS produces no captured output. Rethrown: the
+    // scheduler classifies it and prints its one line into the task's own
+    // stream (run()'s onError), where the frame reads it; a copy written
+    // here too printed the reason twice.
     const endExec = span('miss: execute')
-    let res = await boundAfterAbort(args.executor.execute(req), req.signal)
+    // A plugin's execute may throw before returning or return a bare result:
+    // the throw is its rejection, the value its resolution, so both reach
+    // the naming catch and the cleanup in finally below.
+    let running: Promise<unknown>
+    try {
+      running = Promise.resolve(args.executor.execute(req))
+    } catch (thrown) {
+      running = Promise.reject(thrown)
+    }
+    let res = await boundAfterAbort(running, req.signal)
       .then((r: unknown) => {
         assertExecuteResult(args.executor.name, node.id, r)
         return r
@@ -966,15 +992,12 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
         }
         const err = nameExecutorFailure(args.executor, raw)
         // A remote executor's message carries the server's own text, which
-        // may echo the env it was sent: masked here, where it is printed,
-        // and on the error the scheduler prints with its cause (L-39).
+        // may echo the env it was sent: masked on the error the scheduler
+        // prints with its cause (L-39).
         if (secrets !== null) {
           for (const e of [err, err instanceof Error ? err.cause : undefined])
             if (e instanceof Error) e.message = secrets.mask(e.message)
         }
-        const message =
-          err instanceof Error ? err.message : (secrets?.mask(String(err)) ?? String(err))
-        log.taskStderr(node, `${message}\n`)
         await sweepPlaceholders(placeholders)
         throw err
       })
@@ -988,7 +1011,11 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       })
     endExec()
     if (secrets !== null)
-      res = { ...res, stdout: secrets.mask(res.stdout), stderr: secrets.mask(res.stderr) }
+      res = {
+        ...res,
+        stdout: maskCaptured(res.stdout, secrets),
+        stderr: maskCaptured(res.stderr, secrets),
+      }
     // An executor that stopped on the timeout's abort exits non-zero; say
     // why, so the frame, the retry line and `timedOut` read as a timeout.
     if (timeoutFired && res.exitCode !== 0 && res.timedOut !== true) {
@@ -1051,8 +1078,9 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     // 258) — and an exit above 128 is a signal's number and nothing
     // about what sent it (259). One frame line names the rule. A spawn that
     // threw ran no shell: its 127 is vx's, and the line would send the
-    // reader after a command that exists (A-41).
-    if (!res.timedOut && res.spawnFailed !== true) {
+    // reader after a command that exists (A-41). A run's stop killed it
+    // itself: the SIGKILL past the grace read as the OOM killer's.
+    if (!res.timedOut && res.spawnFailed !== true && args.stopSignal?.aborted !== true) {
       const verdict = shellVerdict({
         code,
         command: step.command,
@@ -1121,6 +1149,21 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     args.executor.remote === true ? 'none' : undeclaredWriteReach(node, args.workspaceRoot)
   const writesFingerprint =
     args.executor.remote !== true && mayWriteFingerprint(node, args.workspaceRoot)
+  // A stop that landed during the awaits above (the key, the probe, the
+  // input description): the first attempt would wipe the last build and
+  // hand the executor a request after the run had stopped. Through a call,
+  // so the loop's own reads of the stop are not narrowed to false.
+  if (isAborted(args.stopSignal)) {
+    return {
+      node,
+      status: 'aborted',
+      exitCode: signalExitCode(forwardedSignal(args.stopSignal?.reason)),
+      durationMs: 0,
+      hash,
+      wallclockStartNs,
+      wallclockEndNs: process.hrtime.bigint() - args.runStartHrTimeNs,
+    }
+  }
   for (;;) {
     attempt++
     const a = await runAttempt()
@@ -1203,7 +1246,6 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
             },
           }
         : {}),
-      signal: requestSignal(),
       ...(effectiveTimeout !== undefined ? { timeoutMs: effectiveTimeout } : {}),
       ...(inputs !== undefined ? { inputs } : {}),
       ...(cfgCacheable ? { cacheKey: hash } : {}),
@@ -1215,7 +1257,10 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       outputs: { files: outputs, workspaceFiles: wsOutputs },
       ...(args.terminal === true ? { terminal: true as const } : {}),
     }
-    if (!userSandbox) return base
+    // The signal last: it arms `exec.timeout`, and the sandbox's arming
+    // below is vx's work, not the task's. Armed first, a 60 ms timeout
+    // expired before the spawn and failed `echo` as timed out, unrun.
+    if (!userSandbox) return { ...base, signal: requestSignal() }
     await args.armSandbox?.()
     const sb = await sandboxRequestFor(
       node,
@@ -1227,7 +1272,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     )
     placeholders = sb.placeholders
     withheld = sb.withheld
-    return { ...base, sandbox: sb.sandbox }
+    return { ...base, sandbox: sb.sandbox, signal: requestSignal() }
   }
 
   const wallclockEndNs = process.hrtime.bigint() - args.runStartHrTimeNs

package/src/orchestrator/failure-mode.ts

@@ -29,6 +29,8 @@ export type FailureMode = 'stable' | 'flaky-recoverable' | 'flaky-fatal'
 function keyOutcomesSql(source: string, where = ''): string {
   return `SELECT project, task, hash,
        SUM(CASE WHEN status = 'failed' THEN 1 ELSE 0 END) AS failures,
+       SUM(CASE WHEN status = 'success' AND attempts > 1 THEN attempts - 1 ELSE 0 END)
+         AS retried_failures,
        SUM(CASE WHEN status = 'success' OR status IN ${HIT_STATUSES} OR cache_hit = 1
            THEN 1 ELSE 0 END) AS passes
        FROM ${source}
@@ -186,13 +188,17 @@ export interface FlakyTask {
 /**
  * Every task with a mixed-outcome key anywhere in the retained history
  * (30 days, `RunHistory.pruneOlderThan`), most failures first: the
- * doctor's list. A full scan of `runs`, which an inspection verb affords.
+ * doctor's list. A pass that took a retry mixes its key on its own: it is
+ * one `success` row whose failed attempts count as failures (`vx info`
+ * said `none` over one). A full scan of `runs`, which an inspection verb
+ * affords.
  */
 export function flakyTasks(db: Database): FlakyTask[] {
   const rows = db
     .query(
       `SELECT project, task, COUNT(*) AS keys, SUM(passes) AS passes, SUM(failures) AS failures
-       FROM (${keyOutcomesSql('runs')})
+       FROM (SELECT project, task, passes, failures + retried_failures AS failures
+             FROM (${keyOutcomesSql('runs')}))
        WHERE failures > 0 AND passes > 0
        GROUP BY project, task
        ORDER BY failures DESC, passes DESC, project, task`,

package/src/orchestrator/framed-output.ts

@@ -30,7 +30,7 @@ import { isGroupTask, type TaskNode, type TaskOutcome } from '../graph/index.js'
 import { maskedCommand } from '../util/index.js'
 import { paint, type ColorSupport } from './colors.js'
 import { formatDuration, neverStarted } from './summary.js'
-import { outcomeLabel, skippedReason } from './events.js'
+import { outcomeLabel, ranNoCache, skippedReason } from './events.js'
 
 const NO_COLOR: ColorSupport = { enabled: false }
 
@@ -274,8 +274,8 @@ function cacheOf(o: TaskOutcome): { word: string; color: string } {
   switch (o.status) {
     case 'success':
     case 'failed':
-      // A task with no `cache` block never consulted the cache: not a miss.
-      return { word: o.node.config.cache === undefined ? 'no-cache' : 'miss', color: '' } // dim
+      // A task no cache answered for never consulted one: not a miss.
+      return { word: ranNoCache(o) ? 'no-cache' : 'miss', color: '' } // dim
     case 'cache-hit':
       return o.restored === false
         ? { word: 'fresh', color: SUCCESS }

package/src/orchestrator/hit-restore.ts

@@ -8,7 +8,6 @@
 // which bytes a green run replays. Moved out of execute-task.ts
 // 2026-09-10 as pure code motion, the mirror of miss-save.ts.
 
-import path from 'node:path'
 import type { CacheConfig } from '../config.js'
 import {
   type CacheEntry,
@@ -224,11 +223,15 @@ export async function restoreHit(restore: RestoreHitArgs): Promise<TaskOutcome>
     let cleanedWsRels: string[] = []
     if (additive) {
       cleanedRels = hit.outputFiles.filter((p) => !p.startsWith(WORKSPACE_OUTPUT_PREFIX))
-      await cleanOutputPaths({ projectDir: node.projectDir, rels: cleanedRels })
+      await cleanOutputPaths({ projectDir: node.projectDir, rels: cleanedRels, outputs })
       cleanedWsRels = hit.outputFiles
         .filter((p) => p.startsWith(WORKSPACE_OUTPUT_PREFIX))
         .map((p) => p.slice(WORKSPACE_OUTPUT_PREFIX.length))
-      await cleanOutputPaths({ projectDir: args.workspaceRoot, rels: cleanedWsRels })
+      await cleanOutputPaths({
+        projectDir: args.workspaceRoot,
+        rels: cleanedWsRels,
+        outputs: wsOutputs,
+      })
     } else {
       if (outputs.length > 0) cleanedRels = await cleanOutputs(cleanArgs)
       if (wsOutputs.length > 0) cleanedWsRels = await cleanWorkspaceOutputs(wsCleanArgs)

package/src/orchestrator/local-shortcircuit.ts

@@ -194,7 +194,10 @@ export async function startLocalShortCircuit(args: ShortCircuitArgs): Promise<Sh
  * task's key, which is preliminary, so it cannot restore early either.
  * Cost: one pass over the nodes, no filesystem.
  */
-function restoreTierExclusions(nodes: Map<string, TaskNode>, workspaceRoot: string): Set<string> {
+export function restoreTierExclusions(
+  nodes: Map<string, TaskNode>,
+  workspaceRoot: string,
+): Set<string> {
   const prefixes: string[] = []
   let everything = false
   for (const node of nodes.values()) {